Health Information Exchange and patient privacy

1. BY Akinwunmi Owopetu

2. The Scope of the Practicum
Practicum Scope is the individual patients’
access to information in an HIE.
Practicum Goal is to list considerations
involved in making privacy and security
policy.

3. What is HIE?
An HIE is the electronic movement of
health-related information.

4. What is HIE?
In the process of care, health information
is created, captured and then shared with
other entities.

5. What is HIE?
For each connection there is a technology, standard, policy,
business case/ business model, product and specific sets of
information used, stored or which need to be transferred from one
source to one or more destinations in the course of caring for an
individual patient.

6. The case for a Patient Portal
Connection
Patients have the right to a copy of their health record 2
Patient records or health information are maintained in
many locations, and originate from a variety of sources.

7. The Patient Portal Connection
An HIE’s primary function is to provide structure –
connection, integration, standardizing and facilitation.
How can an HIE help patients get access to their
information from these various sources in an
easier way?

8. Policy considerations
 This practicum has a narrow focus, on privacy and
security policies.

9. Is my private information secure?
 Can anyone see my personal health information on the
Internet?

10. How do I know my information is
kept private and secure?
 Notice of privacy policy.
 Notifications and disclosures.

11. What types of information might
be shared in an HIE?
 Protected information
 Individually Identifiable Health Information
 Information for public good – example, syndrome
surveillance
 Genetic information, emergency preparedness
information, medical and health-related discipline
research information, mental health and other
sensitive health information.

12. What does this mean to me?
 Patient Safety
 Audit disclosures
 Breach notification

13. Ask your doctor or patient
representative the following
questions:
1. Is my health
information
automatically shared
in the HIE?
2. Who controls my • • What if I don’t want my information shared?
information? Me, the • • Can I control the information my doctor sees?
HIE, or my doctor? • • Can I control which doctor sees what information?
3. Do I have to take
action to not
participate?

14. Ask your doctor or patient
representative the following
questions: …continued
4. If your doctor uses • • What happens when I opt in?
terms like opt in/opt
• • What happens when I opt out?
out, ask what they
mean. • • Can I opt out of sharing a visit or a lab test?
5. How secure is my
personal information?
6. Do I have to share
mental health, drug • Courtesy American Health Information
abuse, or other Management Association (AHIMA)
sensitive data?

15. Privacy Policy considerations for
savvy individual patient
Wants to
know that
Has not Wants Adopts the
Wants to be some really
opted out assurance patient
empowered sensitive
of the HIE of privacy portal
details are
secured

16. Privacy Policy for entity granting
access to individual information
 Disclosing the rules to patients
 Individual’s Authentication
 Who is responsible?
 Is identity portable?
 Matching records to authenticated user?
 Maintain information integrity?
 Secure portal access

17. After granting Portal Access
 Transparency
 Disclosures
 Continuing privacy education.
 Manage and maintain TRUST

18. Refferences
 American Health Information Management
Association (AHIMA) www.ahima.org …1
 http://www.hhs.gov/ocr/privacy/hipaa/understanding
/consumers/medicalrecords.html …2