Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems Lecture a This material (Comp7_Unit7a) was developed by Johns Hopkins University, funded by the Department of Health and Human Services, Office of the National Coordinator for Health Information Technology under Award Number IU24OC00013.

Protecting Privacy, Security, and Confidentiality in HIT Systems Learning Objectives—Lecture a Explain and illustrate privacy, security, and confidentiality in HIT settings. Identify common threats encountered when using HIT. Formulate strategies to minimize threats to privacy, security, and confidentiality in HIT systems. 2 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Electronic Health Information Risks and Opportunities Access to electronic vs. paper records Public apprehension around digitization of health information Success of HIT systems depends on ensuring patient privacy Security can facilitate patient-centered care 3 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Privacy, Confidentiality, Security Defined Privacy: patient is in control Confidentiality: only authorized individuals are allowed access Security: controls/safeguards that ensure confidentiality 4 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Security Management System Standards International Organization for Standardization (ISO) National Institute of Standards (NIST) Health Insurance Portability and Accountability Act (HIPAA) 5 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Health Insurance Portability and Accountability Act (HIPAA) and Protected Health Information (PHI) Health Insurance Portability and Accountability Act of 1996 Privacy Rule (effective 2003) Security Rule (effective 2005) HITECH Act of 2009 Civil and criminal penalties 6 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Patients Rights Under HIPAA Under HIPAA, patients health information rights include: Right to access their health information Right to an accounting of disclosures of their health information Right to correct or amend their health information Right to notice of privacy practices Right to file a complaint 7 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Types of Security Safeguards Administrative Safeguards Physical Safeguards Technical Safeguards 8 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Administrative Safeguards Security Management Process –Risk Analysis –Risk Management –Sanction Policy –System Activity Review 9 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Administrative Safeguards Assigned Security Responsibility –Security officer 10 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Administrative Safeguards Workforce Security, Information Access Management –Who can and who cannot have access –Who determines who can have access and how –Employee turnover –Contractors –User roles 11 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Administrative Safeguards Security Awareness and Training –Training –Security reminders –Log-in monitoring –Password management 12 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Administrative Safeguards Security Incident Procedures Contingency Plan –Data backup –Disaster recovery –Emergency operation plan 13 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a Courtesy of the US Centers for Disease Control and Prevention

Administrative Safeguards Evaluation Business Associate Agreements 14 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Protecting Privacy, Security, and Confidentiality in HIT Systems Summary—Lecture a Privacy, security, and confidentiality in HIT settings Common threats encountered when using HIT Strategies to minimize threats to privacy, security, and confidentiality in HIT systems 15 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a

Protecting Privacy, Security, and Confidentiality in HIT Systems References—Lecture a References The Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information. c2008. Available from: 5.pdf 5.pdf Images Slide 5: Cover Sheet from an National Institute of Standards and Technology (NIST) Information Security Document. Courtesy National Institute of Standards (NIST). Slide 9: Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information Available from: Slide 10: Security Operations in Action. Courtesy Centers for Disease Control. Slide 11: A New ISIS Video Camera. Courtesy Department of Homeland Security. Available from: Slide 12: A Regularly Scheduled Security Awareness Training Session. Image courtesy CDC. Slide 13: “Symposium on Diversity, Leadership Development and Succession Planning” at the CDC. Courtesy CDC. Slide 14: Doctor Looking Through Medical Records. Courtesy HHS. Slide 15: Centers for Disease Control’s Activity Lead for the Division of Specialized Media, Pete Seidel. Courtesy CDC. 16 Health IT Workforce Curriculum Version 3.0/Spring 2012 Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems—Lecture a