1 / 29

Developing the HIPAA-Aware EAD Finding Aid

Developing the HIPAA-Aware EAD Finding Aid. The Concept of HIPAA Awareness Nancy McCall Michael Miers Phoebe Evans Letocha Kate Ugarte Marjorie W. Kehoe Johns Hopkins Medical Institutions.

keona
Download Presentation

Developing the HIPAA-Aware EAD Finding Aid

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Developing the HIPAA-Aware EAD Finding Aid The Concept of HIPAA Awareness Nancy McCall Michael Miers Phoebe Evans Letocha Kate Ugarte Marjorie W. Kehoe Johns Hopkins Medical Institutions NHPRC Electronic Records Symposium

  2. What is HIPAA?Health Insurance Portability and Accountability Act, 1996http://www.hhs.gov/ocr/hipaa/finalreg.html First federal law on access and use of health information First federal law to extend rights of privacy beyond file unit of medical record to individually identifiable health information in all types of file systems, documents, formats, and media First federal law to extend rights of privacy beyond health information of living individuals to health information of decedents NHPRC Electronic Records Symposium

  3. HIPAA Privacy Rulehttp://www.hhs.gov/ocr/hipaa/finalreg.html • Privacy Rule regulates access to and use of individually identifiable health information in any format and medium • Applies to individually identifiable health information of living individuals and decedents in perpetuity NHPRC Electronic Records Symposium

  4. Research Agenda of the Johns Hopkins Team Topic Implications of HIPAA Privacy Rule (PR) for development of privacy aware finding aid Purpose Study PR compliance requirements for research and publication ObjectiveDevelop HIPAA compliant guidelines for archival reference and research Final Goal Integrate set of PR compliance standards into development of CDA/EAD finding aid NHPRC Electronic Records Symposium

  5. Research Agenda of the Johns Hopkins Team Methodologies • “Learning-by-doing” • Consultation with • Officials at Health and Human Services and Office of Civil Rights • Experts in health law, privacy, IT security • Archivists and historians (SAA and AAHM membership) • Search of literature NHPRC Electronic Records Symposium

  6. Research Agenda of the Johns Hopkins Team Major findings • Privacy Rule provides viable and accountable controls for access and use of health information • Controls allow multiple modes of access for research • Controls for access protect individual privacy • Controls allow publication of de-identified health information • Controls for publication of identifiable health information require authorization of subjects or legal representatives of subjects • Controls for research adaptable to CDA/EAD finding aid • Controls for publication of de-identified health information adaptable to CDA/EAD finding aid NHPRC Electronic Records Symposium

  7. HIPAA Applies to Entities in both Public and Private Sectors Health care providers Health systems, hospitals, clinics, group practices, individual providers Health care clearinghouses Billing services, community health information systems Health plans Group, individual health insurance, Medicare, Medicaid NHPRC Electronic Records Symposium

  8. HIPAA Designation of Archives at Covered Entities HIPAA Hybrid entity Covered entity Covered function Archives HIPAA Covered entity Covered function Archives HIPAA Hybrid entity Non-covered entity Non-covered function Archives NHPRC Electronic Records Symposium

  9. Designation of Archival/Manuscript Repositories at Covered Entities • Confusion over designation • HIPAA applies only toinstitutional divisions designated as covered functions of covered entities • Individual institutions are responsible for designating own covered entities and covered functions • Criteria for designation is based on whether division/department holds andtransmits identifiable health information • Lack of consistent interpretation of criteria for designation • Main source of confusion at institutional/repository levels over criteria for protecting decedent and electronic health information • Lack of awareness • Privacy Rule criteria for decedent and electronic health information • Changing concepts of individual privacy in Information Age NHPRC Electronic Records Symposium

  10. Health Privacy at Risk! Repositories Unregulated by HIPAA have Limited Controls for Access and Use of Health Information • Repositories Opted Out of HIPAA Hybrid Entities • Repositories not subject to HIPAA • Wide range of public/private repositories NHPRC Electronic Records Symposium

  11. Unregulated Repositories Most unregulated repositories have limited controls on access and use of decedent health information • Policies largely based on long-held legal principle that rights to privacy cease upon death Some unregulated repositories are beginning to add HIPAA-like policies for access and use of decedent health information • Growing awareness that decedent health information may be linked to the health status of living individuals NHPRC Electronic Records Symposium

  12. Profession Must Come to Terms with Information Age Benefits Powerful new tools for converting archival documents into digital formats so that they may be made easily and widely accessible for research and publication Risks Wider accessibility via internet by a large body of new users introduces new sets of risks to privacy and intellectual property NHPRC Electronic Records Symposium

  13. Forces Emerging for Greater Protection of Individual Privacy in Information Resources Growing awareness Advances in technology bring new risks to personal privacy Ethics, laws, and policy must be revised to address new risks Legislation HIPAA GLBA FERPA Options for Self-Regulation Tim Berners-Lee and CSAIL PORTIA Project TAMI NHPRC Electronic Records Symposium

  14. Privacy Rule Controls for Protection of Privacy in Research Access to de-identified health information Set of 18 identifiers stripped from body of health information • names • geographic subdivisions smaller than a state • all elements of dates (except year) • telephone numbers • facsimile numbers • electronic mail addresses • social security numbers • medical record numbers • health plan beneficiary numbers • account numbers • certificate/license numbers • vehicle identifiers and serial numbers • device identifiers and serial numbers • web universal resource locators (URLs) • internet protocol (IP) address numbers • biometric identifiers • full-face photographic images • Any other unique identifying number, characteristic, or code, unless otherwise permitted by the Privacy Rule for re-identification NHPRC Electronic Records Symposium

  15. Privacy Rule Controls for Protection of Privacy in Research Authorized access to identifiable health information • Authorization by subject of health information • Authorization by legal representative of subject of health information • Waiver of authorization from institutional Privacy Board • Other allowed uses or disclosures • Limited data set • Research on decedents • Treatment, payment, and health care operations • Health care emergencies NHPRC Electronic Records Symposium

  16. Examples of De-identified Documents NHPRC Electronic Records Symposium

  17. Examples of De-identified Documents NHPRC Electronic Records Symposium

  18. Examples of De-identified Documents NHPRC Electronic Records Symposium

  19. Examples of De-identified Documents NHPRC Electronic Records Symposium

  20. Examples of De-identified Documents NHPRC Electronic Records Symposium

  21. Examples of De-identified Documents NHPRC Electronic Records Symposium

  22. Examples of De-identified Documents NHPRC Electronic Records Symposium

  23. CDA/EAD Finding Aid to Serve as Main Portal for Access to Health Information Privacy Rule controls to embed in architecture of Finding Aid • Protocols for de-identifying health information • Protocols for authorizing access to identifiable health information • Links to forms for initiating interactive adjudication processes • Protocols for administering authorized access to identifiable health information NHPRC Electronic Records Symposium

  24. HIPAA Privacy Rule Serves as Model for Archival Access Policies Repositories not regulated by HIPAA Self-regulate in the “spirit” of HIPAA Regulated and unregulated repositories Join together to develop model of “best practices” for protection of individually identifiable health information in archival access and use NHPRC Electronic Records Symposium

  25. HIPAA-Aware EAD Finding AidPrototype to Stimulate Development of “Best Practices” Models • Preserves intellectual integrity of information • Imposes legal/ethical safeguards on individually identifiable health information • Introduces modes of accountability in access and use of individually identifiable health information • Promotes new opportunities across a wide array of disciplines for research, analysis, and publication of health information NHPRC Electronic Records Symposium

  26. Promoting HIPAA Awareness to Archivists and Archival Patrons Guiding Principle: do no harm to subjects of health information • Controls for access serve as protectors of personal privacy • Controls for authorizing access to identifiable health information are fair and reasonable • Controls provide framework for administering access and use of health information • Controls allow broad access for research NHPRC Electronic Records Symposium

  27. HIPAA to Finding Aid HIPAA Privacy Rule Covered Entity Privacy Board Covered Function Archives Processing Finding Aid NHPRC Electronic Records Symposium

  28. References to HIPAA Legislation 1996 Health Insurance Portability and Accountability Act Public Law 104-191, Health Insurance Portability and Accountability Act (HIPAA) of 1996, 104th Congress – 21 August 1996 http://www.gpoaccess.gov/plaws/search.html Administrative Simplification of HIPAA http://aspe.hhs.gov/admnsimp/pl104191.htm 2001 Privacy Rule of HIPAA - National Standards to Protect the Privacy of Personal Health Information. http://www.hhs.gov/ocr/hipaa/finalreg.html Definitions of covered entity 45CFR – Public Welfare Subtitle A – Department of Health and Human Services Subpart A – General Provisions – 45CFR 160.102, 160.103 http://www.access.gpo.gov/nara/cfr/waisidx_01/45cfr160_01.html Eighteen Identifiers 45CFR – Public Welfare Subtitle A – Department of Health and Human Services Subpart 164 – Security and Privacy – 45CFR 164.514 (b) http://www.access.gpo.gov/nara/cfr/waisidx_01/45cfr164_01.html Privacy Board Role 45CFR – Public Welfare Subtitle A – Department of Health and Human Services Subpart 164 – Security and Privacy – 45CFR 164.512 (i)(B) http://www.access.gpo.gov/nara/cfr/waisidx_01/45cfr164_01.html Definition of research 45CFR – Public Welfare Subtitle A – Department of Health and Human Services Subpart 164 – Security and Privacy - 164.501 - “Research” http://www.access.gpo.gov/nara/cfr/waisidx_01/45cfr164_01.html 2003 Security Rule of HIPAA 21 April 2005 – Deadline for compliance http://www.cms.hhs.gov/SecurityStandard/ 2006 HIPAA Enforcement Rule - http://www.hhs.gov/ocr/hipaa/enforcerule06.htm NHPRC Electronic Records Symposium

  29. References Barth, Adam, Datta, Anupam, Mitchell, John C., & Helen Nissenbaum. Privacy and Contextual Integrity: Framework and Applications. http://www.adambarth.org/papers/barth-datta-mitchell-nissenbaum-2006.pdf#search=%22H.%20Nissenbaum%2C%20Privacy%20and%20Contextual%20Integrity%22 Berners-Lee, Tim. The MIT Computer Science and Artificial Intelligence Laboratory (CSAIL). http://www.csail.mit.edu/index.php http://www.w3.org/people/Berners-Lee/research.html Decentralized Information Group. TAMI (Transparent Accountable Datamining Initiative) http://dig.csail.mit.edu/TAMI/ Nissenbaum, Helen. “Privacy and Contextual Integrity”. Washington Law Review. Volume 79:119, 2004. ---. “Protecting Privacy in an Information Age: The Problem of Privacy in Public”. Law and Philosophy. Volume 17, Numbers 5-6 / November, 1998 NYU PORTIA - http://www.nyu.edu/projects/valuesindesign/nyuportia.html PORTIA – Privacy, Obligations, and Rights in Technologies of Information Assessment. http://crypto.stanford.edu/portia/ Stanford Computer Forum. PORTIA: Managing Sensitive Information in a Wired World. http://forum.stanford.edu/research/project.php?id=55 Workshop on Privacy and Accountability, 28-29 June 2006, Massachusetts Institute of Technology, MIT Stata Center (Building 32), 32 Vassar St., Cambridge, MA USA. Held in Classroom 144. Co-sponsored by PORTIA and TAMI projects NHPRC Electronic Records Symposium

More Related