Scribd
Upload
11 views

Privacy, Confidentiality, Security

Uploaded by

violetvineacc
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
11 views

Privacy, Confidentiality, Security

Uploaded by

violetvineacc
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 13

Privacy, Confidentiality, Security

Assurances World
Organization

The Health Insurance Privacy


Perspective/Role

Portability and Goals/Functions


Accountability Act of Workflow/Behavior/
Adoption
1996 (HIPAA) [Public
Information Systems
Law 104-191] governs Confidentiality
Module
much of our discussion
regarding electronic Data/
Information/ Algorithms
health data, but it’s not Knowledge/
the whole story Evidence
Security
Technology
Privacy
• “The right of individuals to keep information about themselves
from being disclosed to others; the claim of individuals to be let
alone, from surveillance or interference from other individuals,
organizations or the government”
– Trust
• Regulated: There is law or regulation
• Unregulated: Concerns (human, ethical)
• HIPAA: Defines who may have access
– Patient care
– Paying for care
– Business associates
– Public health
– Research
Fair Information Principles
Individual Participation

Collection Limitation

Use Limitation

Disclosure Limitation

Accountability

Openness

Data Quality
Privacy: HIPAA
Protection of individually identifiable health information by
”covered entities”:
•Health plans [insurers] •Health care providers
•Health care clearinghouses [e.g.,
process the bills]

May be overruled for specific clinical situations:


•Gunshot wound •Child/Elderly abuse
•Stab wound •Infectious, communicable or
•Injuries sustained in a crime reportable diseases

Does NOT directly cover:


•Employers •IT Vendors: EHR, mHealth apps,
•Pharmaceutical companies social media, internet search engine
•Research
CIA Triad: Confidentiality, Integrity,
Availability
• Confidentiality
– Protection from unauthorized access/disclosure
• Authentication: Are you who you say you are?
• Integrity
– information is kept accurate and consistent unless
authorized changes are made
• Availability
– When and where it is rightly needed
• Patients: Privacy
• Institution: Discoverability/Litigation
Protection World

Organization
• Privacy laws
Perspective/Role
• Covered Entity’s Business
Goals/Functions
Associate
Workflow/Behavior/
• Chief Information Security Adoption
[Privacy] Officer
Information Systems
• Information governance
Module
• Information access policies
Data/
• Audit trail Information/ Algorithms
Knowledge/
• Role-based access Evidence
• Multi-authentication login
Technology
• Encryption
• Network firewall/VPN
HIPAA Security Rule
World

• Security Personnel Organization


• Workforce Training and Perspective/Role
Management Goals/Functions
• Evaluation Workflow/Behavior/
• Security Management Process Adoption
• Information Access Management Information Systems
• Access Control Module
• Audit Controls Data/
• Integrity Controls Information/ Algorithms
Knowledge/
• Transmission Security Evidence
• Workstation and Device
Technology
Security
• Facility Access and Control
Deidentification

• HIPAA Privacy Rule for Protected Health Information


(PHI)
• “Safe Harbor” data elements
– 18 data elements that are identifying
– Includes any and all full dates
• Limited data set
– No identifying information
– Full dates
– City, state, zip code
– Age
Deidentification

• HIPAA Privacy Rule for Protected Health Information


(PHI)
• Beyond the 18
– Facial CT scan: Face can be reconstructed
– Clinical notes
• Penalties
– Office for Civil Rights (OCR)
Anonymization

• Expressed in terms of the probability of re-identification


• Sometimes includes adding false data to throw
algorithms off the scent
– “Salting”
Ongoing Issues
Who owns the data?

Adolescents?

Family members at risk?

EU’s broader General Data Protection Regulation (GDPR)?

Relation to law enforcement?

Accounting for disclosures?

What non-health data are really “Health data”?

Protection of patient-generated health data?


Beyond HIPAA

• Big data and expanding uses and users


• Cyber-security threats and approaches
• Personal devices and Internet of Things
• Laws in other domains (e.g., Fair Credit Reporting
restricting uses of consumer data)
• Evolving technologies for privacy and security
• Evolving consumer attitudes

You might also like