1. Protecting “High Stakes” PHI
HITSS It Out of the Park
9 April 2015

2. Harmonization Act
Signed into law by Governor Neil Abercrombie on July 10, 2012, HB Relating to Health Care Information harmonizes more than 50 existing state medical privacy laws with the federal Health Insurance Portability and Accountability Act (HIPAA)

3. Harmonization Act
“The new law reinforces the safe and secure exchange of clinical information and ultimately enables health care providers to improve the quality of patient care they provide without compromising privacy protections,” –Christine Sakuda

4. Harmonization Act
Essentially says: Compliance with HIPAA = compliance with all state laws
What if the State law is more stringent?
Doesn’t matter

5. What do we mean by High Stakes PHI?
Sensitive data?
Some forms of PHI is more sensitive than others…
Examples?

6. Segmenting Data Privacy
Special handling for specific parts of an electronic health record
Behavioral health
Mental health
There is only a specific law that pertains to Alcohol and Drug Abuse (42 CFR part 2)
Certain records for DVA facilities
Those records requested by patients to be sequestered

7. Data Segmentation for Privacy (DS4P)
Defined use cases based on the previous regulation
Specific privacy policies that can be electronically supported through data segmentation techniques
Specific enough to be addressed despite the harmonization act in states like Hawaii

8. DS4P
Could go a long way toward protecting information when data breaches are occurring
Could align with international requirements: PHIPA
Lock box provisions
Lock up information from any particular person or
Lock up entire records or segments from everyone
US organizations complete this manually

9. DS4P
Some vendors are placing DS4P ideas and technical specifics into their new products
Challenges continue
What do you think about the future of Data Segmentation for Privacy?