Privacy is Easy
Insuring patient privacy is easy. Well, easier than information security.
Insuring patient privacy is easy. Well, easier than information security.
Information security is about preventing unauthorized access to information. Information privacy is partially about security, but there is more to it. Privacy is not just about insuring all access is technically authorized. Information privacy is also protecting against technically authorized, but inappropriate access. Information privacy is also about giving the subject of the information some say over how the information is used and shared. And it is also about notifying them when something is amiss.
The best example of a privacy violation would be a noisy nurse or administrator checking out the health records of a patient in the system because they were "curious" for a myriad of reasons. Most large city hospitals have "VIP" watch lists to try to trap for these types of access for celebrities, but there is no system-wide approach to privacy that we have seen in any EHR or HIE.
The interesting thing is that it is quite easy to implement significant deterrents against these sorts of inappropriate accesses using the principle of notification.
Most EHRs provide an electronic logging mechanism that records each authorized access of health information. The EHR usage log contains records of the person accessing the records, the information accessed, and the patient's ID. All that would be required to greatly reduce the incidence of casual or criminal snooping would be to pass these log records against a patient notification profile.
The patient notification profile could be easily captured and stored, allowing the patient to specify if, when, and how they wish to be notified whenever their information is accessed.
This little procedure would go a long way to assist in insuring patent privacy and would also be an early warning of attempts to break-in to the system. One has to wonder why it hasn't.
Rob Tholemeier is a research analyst for Crosstree Capital Management in Tampa, Fla., covering the heath I.T. industry. He has over 25 years experience as an information technology investor, research analyst, investment banker and consultant, after beginning his career as a hardware engineer and designer.
Information security is about preventing unauthorized access to information. Information privacy is partially about security, but there is more to it. Privacy is not just about insuring all access is technically authorized. Information privacy is also protecting against technically authorized, but inappropriate access. Information privacy is also about giving the subject of the information some say over how the information is used and shared. And it is also about notifying them when something is amiss.
The best example of a privacy violation would be a noisy nurse or administrator checking out the health records of a patient in the system because they were "curious" for a myriad of reasons. Most large city hospitals have "VIP" watch lists to try to trap for these types of access for celebrities, but there is no system-wide approach to privacy that we have seen in any EHR or HIE.
The interesting thing is that it is quite easy to implement significant deterrents against these sorts of inappropriate accesses using the principle of notification.
Most EHRs provide an electronic logging mechanism that records each authorized access of health information. The EHR usage log contains records of the person accessing the records, the information accessed, and the patient's ID. All that would be required to greatly reduce the incidence of casual or criminal snooping would be to pass these log records against a patient notification profile.
The patient notification profile could be easily captured and stored, allowing the patient to specify if, when, and how they wish to be notified whenever their information is accessed.
This little procedure would go a long way to assist in insuring patent privacy and would also be an early warning of attempts to break-in to the system. One has to wonder why it hasn't.
Rob Tholemeier is a research analyst for Crosstree Capital Management in Tampa, Fla., covering the heath I.T. industry. He has over 25 years experience as an information technology investor, research analyst, investment banker and consultant, after beginning his career as a hardware engineer and designer.
More for you
Loading data for hdm_tax_topic #better-outcomes...