Hospital can’t go it alone when in deploying patient privacy measures

Implementing privacy safeguards in a hospital setting isn’t as simple as making sure to protect internal information, says one privacy specialist, because the solution will also have to apply to external facilities."Consent management allows patients some control over the use and access to their health information in a healthcare environment," says Mike Gurski, a privacy strategist with Bell Information and Communications Technology Solutions in Toronto. "The real challenge to that is that it has to be used across hospitals. It is prohibitive to have individual hospitals try to build in IT solutions for consent management." Addressing an audience in Toronto at a conference on health information privacy and security, Gurski stresses that the consent management architecture has to be able to replicate Canada Health Infoway’s (CHI) electronic health record vision. The consent management solution puts tags on digital information, so it necessitates computerizing health records. The tags attached to pieces of information validate the users who want to access the information and grants them entry to the system."The consent management framework has to support that (CHI) vision, so that electronic records can be accessed across the country," says Gurski. "The consent has to occur across multiple jurisdictions and hospitals. It gives clinicians certain rights of access."If a patient doesn’t want a diagnostic image available to his or her family physician, a consent management system would be equipped with controls to keep that information from the family physician, he says. Similarly, a patient in a small town seeing a psychiatrist who doesn’t want his family physician to be aware of the content of the psychiatric sessions would have controls to ensure privacy in the implementation of the content management solution. The model suggested by Bell uses architecture that is integrated with HL7 – the messaging standard that CHI has chosen for a pan-Canadian electronic health record. The model uses off-the-shelf products and is based on current identity management solutions that large vendors already provide, says Gurski.He stresses that privacy must be automated to be effective in high-volume, transaction-oriented information systems, and that privacy and security should be considered together when implementing information systems. Privacy impact assessments are conducted, but systems are not routinely built with privacy concerns in mind, he says."One of the barriers is that you do need collaboration across hospitals to do this, either at the local health network level or a provincial stamp of interest to this, so that you can secure funding for consent management solutions," he says, noting dedicated funding sources for privacy solutions don’t exist."There is funding to do privacy impact assessments because those assessments are a requirement," explains Gurski, "but there isn’t a pot of money put aside federally, provincially or at hospitals to develop consent management solutions from an IT perspective."Hospitals are as a result implementing what Gurski terms "mitigation strategies" to address privacy concerns and are not implementing systems that are at the forefront in addressing privacy concerns."We are talking about building a consent management system that does nothing but consent management that integrates with other tools," says Gurski.While several provinces have drafted pieces of health information legislation stipulating that patients have control of their information and have indicated the need for expressed individual consent, the provincial pieces of legislation don’t contain an explicit checklist of technology requirements to ensure rights of patients, says Gurski.A consent management tool would also protect individual health information from being retrieved by larger organizations, such as insurance companies or pharmaceutical firms, for the purposes of research.Hospitals need to assess their maturity in their identity management process before they can establish where the consent management component of the process will fit, according to Gurski, who stresses it needs to be integrated and not separate from the process. If there are ad hoc wireless networks existing in healthcare facilities, such as the use of Blackberry handheld devices throughout a hospital, there may be vulnerability to invasions of privacy if the information is not travelling via a routing system and is not encrypted between handheld devices, says Gurski.The healthcare sector should learn lessons about the significance of protecting personal information from prying eyes, given reports of recent breaches of privacy in the retail sector and given that identity theft is becoming more sophisticated."We are not immune from this happening in the healthcare space," Gurski predicts. "When more health information migrates to digital format and there are large databases of health information, you may start seeing breaches of that information, which is very sensitive information. It can be used for illegal activity."The cost of implementing privacy solutions seems hefty if they are deployed on a one-off basis, but savings can be produced if these solutions are implemented across the spectrum of healthcare facilities, explains Hernan Matute, director of identity management and e-health strategy for Bell."If measures to protect data are deployed in a fractured way, it seems like a big cost," says Matute. "If there is large-scale infrastructure deployment, economies of scale can be achieved, making the investment seem more measured and controlled."

Hospital can’t go it alone when in deploying patient privacy measures

News | 03/19/2007 4:00 am EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us