Electronic Health Record Privacy - CIO's Perspective

Data Security and Privacy in Health IT HINZ Seminar Series 18 March 2005, Crowne Plaza Hotel, Auckland

A Well Known Quotation We trained hard but it seemed that every time we were beginning to form up into teams, we would be re-organised. I was to learn later in life that we tend to meet any new situation by re-organising; and a wonderful method it can be for creating the illusion of progress while producing confusion, inefficiency and demoralization."

Variously Attributed To 1. Petronius Arbiter, (200 BC) 2. Caius Petronius Arbiter (50 BC) 3. Petronius Satyricon, (50 AD) 4. Gaius Petronius. (66 AD) • Gaius Petronius Arbiter (1st Century AD)

But.... • The quote first appeared in Robert Townsend’s Up the Organization (1970) • Believed to have been originated by “some disgruntled soldier who pinned this quotation to a bulletin board in one of the camps of the armies occupying Germany sometime after 1945”

A Correct Quotation We trained hard but it seemed that every time we were beginning to form up into teams, we would be re-organised. I was to learn later in life that we tend to meet any new situation by re-organising; and a wonderful method it can be for creating the illusion of progress while producing confusion, inefficiency and demoralization." Gaius Petronius Arbiter (Not!)

• Most Black and White Documents could benefit from colour. research has shown that colour helps us to understand, retain and recall information. It also increases our willingness to read a document. In these ways colour helps to promote ideals, sell products and increase profits.

THE Facts about Privacy • Many people know the facts about privacy and security – regardless of whether the facts are right or wrong • The facts always support and justify a particular position or action • It’s a wonderful subject for lengthy debate and thus can be used to avoid action and responsibility

For Today’s Discussion... • Privacy means an individual' interest in s (limiting) who has access to personal health care information (HIPAA Privacy Rule) • Privacy is a legal issue – Not an IS/IT issue

For Today’s Discussion... • Security means the protection of data against unauthorized access • Security is an IS issue – In the sense of information created and stored in computers

Are Privacy & Security Issues? An emphatic YES! • The privacy issues have not changed significantly from ‘pre PC’ Days But • The ability to breach privacy is significantly higher – Unlike the good old days information can be accessed from anywhere in the world – And be sent around the world in seconds – And in three years time 50% of all “information” will be accessed from offsite.

As a Starting Principle • Auckland Regional IS Strategic Plan notes that – "Reasonable measures will be put in place to ensure that people’s information is managed in accordance with the Health Information Privacy Code, the NZ Privacy Act, and health information policies developed by the DHBs" • The RISSP defines Reasonable as – "finding an appropriate balance between the interests of the individual, the practicality of the use of the system and the cost of implementing the measures"

Health Information Privacy Rules • Rule 1: Purpose of collection of health information • Rule 2: Source of health information • Rule 3: Collection of health information from individual • Rule 4: Manner of collection of health information • Rule 5: Storage and security of health information • Rule 6: Access to personal health information • Rule 7: Correction of health information • Rule 8: Accuracy etc of health information to be checked before use • Rule 9: Retention of health information • Rule 10: Limits on use of health information • Rule 11: Limits on disclosure of health information • Rule 12: Unique identifiers

(un)Reasonable Measures • The Fortress Mentality – Lock it down – Throw away the key

(un) Reasonable Measures • “It is people who must taken on the responsibility for ensuring privacy” • Trust Us..

Reasonable • You must have processes, procedures and security in place to prevent breaches • All parties must be aware of their responsibilities and obligations • Balanced by practicality and cost

Internal Threats

What when there’s a breach • Too late

News CIO’s don’t want to hear • The system is down • The data is lost, corrupted, false, can’t be recovered etc etc • We’ve been hit with a worm, virus or Trojan • The Board would like.... • The Commissioner has a couple of queries

The Future?

In Closing

Electronic Health Record Privacy - CIO's Perspective

by Health Informatics New Zealand on Apr 03, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

1 Embed 4

Statistics

Electronic Health Record Privacy - CIO’s Perspective — Presentation Transcript