1. Health Information Security and Privacy Collaborative (HISPC) Overview
John K. Evans
Mike Berry
VHITP Workgroup Call – April 4, 2007

2. Health Information Security and Privacy Collaboration Initiative
HISPC’s Goals for the Privacy and Security Assessment Project
1. Identify and develop best practices to:
Resolve barriers to health information exchange
Propose solutions to address identified challenges
2. Get stakeholders involved, participating and contributing
Seek consensus-based solutions and implementation plans in communities to increase local expertise about health information privacy and security protection
3. Support collaboration within and among states to:
Foster stakeholder participation
Maximize knowledge exchange
Identify common solutions

3. Stakeholder Groups Pharmacies Clinicians Long-term care facilities
Nursing homes
Homecare and hospice
Correctional facilities
Professional associations and societies
Medical and public health schools
State government entities
Clinicians
Physician groups
Federal health facilities
Hospitals
Payers (including employers that sponsor health plans)
Public health agencies
Community clinics
Labs
Individual consumers and consumer organizations

4. Consumer Focus Groups
What is consumers' level of knowledge and assumptions about what is currently happening with PHI and health information exchange (HIE)?
How do they feel about the benefits of HIE vs. the risk that the information could be misused?
What are their thresholds for and views about authentication, audit, and access control?
What needs to be in place (i.e., protections) in order for consumers to feel comfortable about their PHI being shared?
If their PHI were available to them electronically, would they make use of it themselves, and how?
What is the best way for them to learn/be educated about PHI and HIE?
In short, what are their concerns and what are solutions?

5. HISPC Tasks
1. Assess variation in organization-level business policies and state laws
Interim assessment of variation report
2. Formulate interim solutions and implementation plan
Interim analysis of solutions report
Interim implementation plan report

6. Major Themes: Variations
Infrastructure needed to support interoperability greatly lacking.
Infrastructure needed to support intraoperability greatly lacking.
Entity authentication procedures are highly variable and are not reliable.
Redundancy and inconsistency of consent between entities to exchange health information to treat patient.

7. Major Themes: Variations
There is a wide variation in the ways in which payers interface with health care entities.
IRB oversight includes a review of how information will be stored, but not necessarily exchanged.
There is some disagreement among stakeholders that they would or would not obtain PHI under specific scenarios.

8. Major Themes: Variations
HR departments are dealing with issues of access control, security of physical plant and packaging of PHI as it relates to employee records, specifically related to ADA compliance, Family Leave and return to work related laws and policies.
The granularity, complexity and thoroughness of privacy and security measures is related to the amount of PHI that is exchanged and/or the sensitive nature of the health conditions.
Under urgent circumstances PHI is shared more readily without patient consent.

9. Solutions  Implementation Plan
State-proposed solutions
Education
Infrastructure
Framework for Privacy & Security Technology Requirements
Solutions for Role-based Access Control
Patient Control
“Break the Glass”
National-level recommendations
Correlating Patient Records
Patient Consent

10. Implementation Deliverables
Identify barrier
Provide solution overview
Summary of effective practices
Planning assumptions and decision
Implementation scope:
Ownership and responsibilities
Identification of required tasks
Timeline and milestones
Projected costs and required resources
Possible barriers
Impact on affected stakeholders
Means of tracking, measuring and reporting progress

11. HIE Commission Concept
Concept of an independent entity raised in 4 solutions
Consistent with HIT Plan
VHITP Principles:
I: Vermonters will be confident that their health care information is secure and private and accessed appropriately.
32: Plan as a Living, Evolving Document

12. Next Steps Final Solutions Report Meet with VITL Executive Committee
Final Implementation Report
Questions or Comments Welcome