Loading presentation...

Present Remotely

Send the link below via email or IM


Present to your audience

Start remote presentation

  • Invited audience members will follow you as you navigate and present
  • People invited to a presentation do not need a Prezi account
  • This link expires 10 minutes after you close the presentation
  • A maximum of 30 users can follow your presentation
  • Learn more about this feature in our knowledge base article

Do you really want to delete this prezi?

Neither you, nor the coeditors you shared it with will be able to recover it again.


Privacy and Security of the EHR

My presentation of the issues concerning the privacy and security of Electronic Health Records.

Clarah Mutandiro

on 6 March 2011

Comments (0)

Please log in to add your comment.

Report abuse

Transcript of Privacy and Security of the EHR

Universal Electronic Health Record
Privacy and security
Clarah Mutandiro
CML 6203
Spring, 2011 What is this? what does it mean?
EHR EMR PHR PHI HIT HIPAA Electronic Health Record Electronic Medical Record Patient Health Record Protected Health Information Health Insurance Portability Accountablility Act Health Information Technology Timeline of the EHR Introduced in the 1990s April 27, 2004 Universal EHR by 2014
Signed by George Bush
2008 Obama endorses EHR with privacy. 2009 American Recovery Reinvestment Act George Bush identified that computerization of health records was a good step to improve care and reduce costs.

"By computerizing health records, we can avoid dangerous medical mistakes, reduce costs, and improve care."
-June 20, 2004 State of the Union Address On April 27, 2004, President Bush called for widespread adoption of interoperable
EHRs within 10 years, and also established the position of National Coordinator for
Health Information Technology. Understanding the Terms Although the terms “EHR” (Electronic Health Record) and “EMR” (electronic medical record) are often used interchangeably, there is a difference between them.
The Office of the National Coordinator for Health Information Technology (ONC) makes the distinction.

The EMR is the legal patient record that is created in hospitals and ambulatory environments and is the data source for the EHR.

The EHR is the system that gives patients, physicians and other health care providers, employers, and payers or insurers access to a patient’s medical records across facilities.

The Centers for Medicare & Medicaid Services (CMS), and subsequently the ONC, believes that certified EHR technology used in a meaningful way is an important piece of the broader health information technology infrastructure needed to reform the health care system and improve health care quality, efficiency, and patient safety.

The PHR is commercial systems for storing, managing, and accessing a patients medical information on an online encrypted service. The EHR It is important to note that an EHR is generated and maintained within an institution, such as a hospital, integrated delivery network, clinic, or physician office, to give patients, physicians and other health care providers, employers, and payers or insurers access to a patient's medical records across facilities.
A government promoted technological system that allows health care workers to consolidate, store, retrieve, and share medical information about an individual's entire medical history Why the EHR? The good...

Provides fast, easy access to a consolidated patient record Allows secure concurrent access across multiple, remote users Facilitates remote coding initiatives
Provides significant reduction in storage space requirements Eliminates lost or misplaced documents, paper files & records Reduces medical errors.
Strengthened public monitoring, which has better safeguards than paper. So where is the problem???

http://healthcare411.ahrq.gov/featureAudio.aspx?id=693 The critics said: What is the correct software? Many vendors have with many software applications and the privacy threat posed by the interoperability of a national network. (a key concern)
What happens when the electronic system has an error? The threat of security and privacy of information.
How the public feels. Concerns about weakened privacy and confidentiality of patient information.
Concerns about information security from widespread dissemination of information through out the health care system, (secondary users) health insurance companies, equipment vendors, marketing companies, drug and pharmaceutical companies, employers, government, etc. Concerns over medical data breaches and medical information security Concerns that the current privacy laws, administration and policing are inadequate
Concerns among persons with adverse health conditions and minorities
Public’s view Majority is ambivalent Some see EHR systems as assembling more sensitive medical information in a patient’s electronic record
Many apply the existing data securities to the EHR Some want the option of opting out. Governance , privacy, and legal issues When Congress held hearings about patient privacy, hundreds of individuals came forward with horror stories about their private medical information being released without authorization.
In Tampa, Florida, a disgruntled public health worker sent the names of more than 4,000 people who tested positive for HIV to two newspapers.
Many large companies self insure their employees; employees of some of these companies had been fired without cause when their employers had discovered that these employees have a potentially expensive medical condition.
Medical doctors had sold their patient lists to marketing and pharmaceutical companies without patient permission, thereby allowing this information to be easily accessed to the general public.
Pharmacists and hospitals had disclosed personal information to friends and family members without first obtaining permission;
One patient's children found out that he had AIDS when they were informed by a pharmacy clerk. laney@laneykay.com What the governments did? Western governments agree in adopting measures to ensure the privacy of health records. HIPAA, (Health Insurance Portability and Accountability Act) - USA
enacted in 1996 to establish rules for access, authentications, storage and auditing, and transmittal of electronic medical records. This standard made restrictions for electronic records more stringent than those for paper records EU (European Union) – Europe
part of its provision is : to protect the processing and free movement of personal data, including for purposes of health care PIPEDA (Personal Information Protection and Electronic Documents Act) – Canada
enacted in 2000, to establish rules on the use, disclosure and collection of personal information. HIPPA The Privacy Rule a Federal law, gives individuals rights over their health information and sets rules and limits on who can look at and receive the health information. The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral. The Security Rule a Federal law that protects health information in electronic form, requires entities covered by HIPAA to ensure that electronic protected health information is secure. HIPPA Privacy rule Who Is Not Required to Follow These Laws? Many organizations that have health information that do not have to follow the Privacy and Security Rules include:
life insurers health insurers employers workers compensation carriers,
many schools and school districts, many state agencies like child protective service agencies,
many law enforcement agencies, many municipal offices.
www.hhs.gov Where does that leave privacy and security? One major issue that has risen on the privacy of the U.S. network for electronic health records is the strategy to secure the privacy of patients. The government called for the creation of Universal EHR by 2014 , but federal investigators report that there is no clear strategy to protect the privacy of patients as the promotions of the electronic medical records expands throughout the United States.
In 2007, the Government Accountability Office reported that there is a “jumble of studies and vague policy statements but no overall strategy to ensure that privacy protections would be built into computer networks linking insurers, doctors, hospitals and other health care providers
Who is l--- king at the records? The privacy threat posed by the interoperability of a national network is a key concern. One of the most vocal critics of EMRs, New York University Professor Jacob M. Appel, has claimed that the number of people who will need to have access to such a truly interoperable national system, (which he estimates to be 12 million), will inevitably lead to breaches of privacy on a massive scale. While both federal and state laws prohibit such snooping, obstacles to enforcing these rules on a national scale are prohibitive We have already witnessed that nosey hospital employees have leaked the medical records of celebrities -- from Farah Fawcett to Bill Clinton -- to the media.
Fortunately, hospitals keep careful tabs on who accesses the charts of VIP patients In contrast, when a meddlesome pharmacist in Alaska looks up the urine toxicology on his daughter's fiancé in Florida, to check if the fellow has a cocaine habit, no red flags will alert the hospital.
The real threat of an outside party, such as a computer-savvy terrorist, breaching the system's security and laying bare our intimate medical secrets for the eyes of the world. This is a significant barrier for the adoption of an EHR. Accountability among all the parties that are involved in the processing of electronic transactions including the patient, physician office staff, and insurance companies, is the key to successful advancement of the EHR in the U.S.
Supporters of EHRs have argued that there needs to be a fundamental shift in “attitudes, awareness, habits, and capabilities in the areas of privacy and security” of individual’s health records if adoption of an EHR is to occur
....and is HIPAA enforcing the law? According to the Wall Street Journal, the DHHS takes no action on complaints under HIPAA, and medical records are disclosed under court orders in legal actions such as claims arising from automobile accidents.
HIPAA has special restrictions on psychotherapy records, but psychotherapy records can also be disclosed without the client's knowledge or permission, according to theJournal. For example, Patricia Galvin, a lawyer in San Francisco, saw a psychologist at Stanford Hospital & Clinics after her fiance committed suicide. Her therapist had assured her that her records would be confidential. But after she applied for disability benefits, Stanford gave the insurer her therapy notes, and the insurer denied her benefits based on what Galvin claims was a misinterpretation of the notes. Stanford had merged her notes with her general medical record, and the general medical record wasn't covered by HIPAA restrictions From the OCR. In the recently-releasedfiscal 2012 budget for HHS, http://www.hhs.gov/about/FY2012budget/ocr_cj_fy2012.pdf the Office of Civil Rights does not have the resources to review all reported breaches of health information. In fact, if you have a breach that impacts up to 499 people, you are unlikely to hear from OCR at all. Current OCR practice is to validate, post to the HHS website, and subsequently investigate all breach reports that impacted more than 500 individuals.
While this prioritization makes a certain amount of sense, it leaves the vast majority of breaches un-reviewed. 

According to that same budget report, ”[a]s of September 30, 2010, OCR has received a total of 9,300 breach reports (191 impact more than 500 individuals and 9,109 impact less than 500 individuals).”  That’s a mere 2% of all breaches that have OCR’s full attention.  The takeaway from this is to count your breaches carefully before reporting, as there seems to be a real benefit to being able to report an impact on less than 500 individuals. Is this HIPAA Compliance? How the OCR deals with violators Breach reports that impacted fewer than 500 individuals are compiled for future reporting to Congress; however they are treated as discretionary and only investigated if resources permit. Based on OCR’s current HIPAA case load, almost all breach reports that impact less than 500 individuals are not investigated. Accordingly, OCR requires additional FTE and resources to ensure it is able to conduct investigations of potential small- and mid-sized breaches. By 2007 A poll by the Wall street Journal : The use of electronic medical records hit roadblocks over privacy concerns and doctors' resistance to the potential time and financial costs of transferring paper records online.

The poll indicates these privacy concerns remain:
half of those surveyed say the use of electronic medical records makes it more difficult to ensure patients' privacy,down from 61% in a 2006 poll,
while 25% disagree
and another quarter say they aren't sure. But..
nearly two-thirds of respondents say the benefits  of electronic medical records outweigh the privacy risks,
compared with 40% who think they don't.

By 2009 Barriers to and Facilitators of Electronic-Records Adoption Among hospitals without electronic-records systems,
the most commonly cited barriers were: EHR, The Doctor & Privacy EHRs record all electronic transactions, from the input of orders to time stamps of clinical activity, although they vary in their ability to produce reports of these data on demand. This information, called metadata, provides a permanent electronic footprint that can be used to track physician activity.
In a case cited by the New England Journal of Medicine, a surgeon was sued by a plaintiff who used the EHR that showed negligence in the Operating Room Though it was unclear whether errors were made in patient treatment, the collective weight of the discrepancies became difficult to defend in court, and the anesthesiologist settled the case.

and lack of availability of staff with adequate expertise in information technology (30%) (Figure 1:http://www.nejm.org/action/showImage?doi=10.1056/NEJMsa0900592&iid=f01) inadequate capital for purchase (74%) concerns about maintenance costs (44%)
resistance on the part of physicians (36%) unclear return on investment (32%), Having said that ……… IS privacy and security of the EHR achievable and sustainable??? The Health Insurance Portability and Accountability Act of 1996 (HIPAA)included a Privacy Rule and Security Rule that significantly changed privacy, security, and confidentiality practices.The privacy rule set the floor in the necessary safeguards to be implemented in protecting Personal Health Information (PHI) across all media while affording certain rights to the consumer regarding their own PHI. In addition, individual states have passed rules and regulations to tighten laws in reaction to emerging threats to privacy and security. Most recently, the American Recovery and Reinvestment Act (ARRA), particularly Title XIII, subtitled Health Information Technology for Economic and Clinical Health Act (HITECH), introduced new regulation addressing privacy and security practices with health information technology (HIT).
Now it’s time that I bow out gracefully…………… security and confidentiality These practices are intertwined....., therefore Privacy of electronic information cannot be achieved without security safeguards. Likewise, security of electronic information cannot be achieved without the privacy and confidentiality rules that define what and when private information may be accessed. Privacy and security are critical success factors in the movement toward EHR adoption and interoperability. Furthermore, protecting patient information is on the national agenda for the 21st century through continued legislative and regulatory changes and governmental and private initiatives. -Individual's desire to limit disclosure of personal information -the number of measures that organizations implement to protect information sytems -condition in which information is shared or released in a controlled manner Becky Bright. Benefits of Electronic Health Records See as Outweighing Privacy Risks, November, 2007 NOW...... Sit back and watch the movie!!!! Privacy
Full transcript