# Presentation: 148710

## HealthKey Roadmap:

**Briefing For Public Health Data Standards Consortium**
- Presented by: Holt Anderson
- Arlington, VA
- March 19, 2001

**HealthKey Roadmap**:
- Toward a Community-Wide, Privacy and Security Infrastructure

- Version 8.0

## This briefing provides HealthKey’s perspective on a HIPAA compliant privacy and security infrastructure.

- What is it and why is it important?
- Should organizations and communities invest in it?
- How might it get implemented?
- What are the barriers to implementation?
- How do we overcome those barriers?

- Version 8.0

## Highlights of what will be covered . . .

- _HEALTHCARE INFORMATION IS FLOWING_ _ELECTRONICALLY_.  There appears to be pent-up demand!!
- We need to focus on _PROTECTING_ this flow of electronic information.
- To protect this information flow, healthcare organizations and communities must _COLLABORATE_ to create a privacy and security infrastructure.
- We believe that progress toward a privacy and security infrastructure will be made across _FIVE SECTORS OF ACTIVITY._

- Version 8.0

## Most healthcare organizations are on their way to exchanging information electronically.

- Employers

- Health Plans

- Pharmacies & PBMs

- Reference Laboratories

- Hospitals

- Version 8.0

## An infrastructure is needed to PROTECT the flow of that information as it moves between organizations AND individuals.

- Employers

- Health Plans

- Patients & Families

- Pharmacies & PBMs

- Reference Laboratories

- This infrastructure serves the entire healthcare community.

- Hospitals

- Version 8.0

## Protecting the flow of information will enable broader acceptance of electronic exchange and corresponding benefits including:

- Presentation of a _complete health record_ assembled from sources spread across multiple and changing providers and payer sources.
- Allowing prompt access to complete and accurate information to improve the _quality of care_ through the communication of patient wishes and prevention of mishaps related to drug interactions, handwriting, allergies, transmissible diseases, etc.
- Providing more _timely access_ to health information to improve the detection, assessment and early response of public health incidents, such as epidemics, emerging infectious diseases and bioterrorism.
- Providing a standard means of controlling and monitoring access to sensitive information, thereby _protecting the privacy of individuals_.

- Version 8.0

## The privacy and security infrastructure must protect against . . .

**System Downtime** -- Individuals bringing down machines or causing *denials of service*
**Unauthorized Access** -- Individuals getting access to more information than they are authorized to
**Identity Theft** -- Individuals posing as someone else to access applications/databases, receive transmitted information, or generate/transmit mis-information
**Information Theft** -- Individuals intercepting email and other transmissions
**Misuse of Information/Breach of Privacy -- **Individuals using/distributing information inappropriately

- Version 8.0

## The risks to organizations of NOT protecting electronic exchange include . . .

**Curtailed  business operations** from system downtime
**Legal actions** from patients
**Civil and criminal fines** from non-compliance
**Lost revenue** from trading partners or patients
**Increased costs**
**“****Unethical” behavior**

- Version 8.0

## The risks to individuals of NOT protecting electronic exchange include . . .

**Identify theft**
**Exposure of clinical information**
**Threat of blackmail**
**Possible embarrassment**

- Version 8.0

## We see a privacy and security infrastructure for healthcare as having cascading layers of protection . . .

**Operations Procedures**

- Legal & regulatory definition of protections for healthcare information

_**Law**_

_**Security Practices**_

- Organization-Specific Layers

**Technologies**
**&**

- Version 8.0

## Privacy Policy is essential for effective Security Practices.

- Privacy Policy is a clear statement of what information should be protected and from whom.  This statement guides the scope and design of technology solutions and operations procedures.
- Privacy Policy establishes an organization’s intent to enforce security practices, and outlines actions that will be taken if the practices are not followed.
- Privacy Policy can act as a tool to educate about why protection is important.

- Version 8.0

## Select policies & practices must be aligned across organizations to ensure electronic inter-operability with seamless protection.

- Select policies & practices must be aligned across organizations to ensure electronic **inter-operability** with **seamless protection**.

-  This type of infrastructure requires community-wide collaboration.

- Version 8.0

## We believe that community-wide privacy and security infrastructure will only emerge if it: 

- Solves common problems in a standard way allowing organizations to focus on their individual interests in unique ways
- Lets each organization implement at their own pace (in “incremental steps” if necessary)
- Addresses a business need that organizations perceive as “real”
- Enables electronic exchange, rather than “getting in the way”
- Can be built using solutions that are available and practical
- Is affordable and justified

- We believe that community-wide privacy and security infrastructure will only emerge if it:

- Version 8.0

## $

- Impact

- Financial Risk         of electronic exchange

- “Too much” complexity

- Sophistication of Privacy and Security Infrastructure

- Version 8.0

## Will organizations collaborate to build and share a common privacy and security infrastructure?

- There seems to be good reasons for a common infrastructure.
- Same trading partners
- All want to mitigate the risk
- Organization-specific protection methods are sub-optimal.
- But organizations have real world limitations.
- Cannot wait for a common solution to unfold
- Limited resources to build a ‘near term’ and a ‘long term’ solution
- Vision and Leadership is needed.

- Version 8.0

## Healthkey’s findings suggest that progress toward a privacy and security infrastructure will be made across five sectors of activity:

- 1: 	_Enterprise Awareness_ -- recognizing there is risk/vulnerability and a need to do something
- 2:_ Enterprise Preparedness_ -- preparing the enterprise for external communication with trading partners
- 3:_ Enterprise Co-Existence_ -- enabling protected communication among enterprises
- 4:_ Enterprise Affiliation_ -- implementing standards between enterprises
- 5:_ Community-Wide Participation_ -- getting enterprises, small organizations, and individuals to use a common electronic identity for “users”

- Version 8.0

## First, enterprises must become aware that they are vulnerable and that they can do something about it.

- What could happen!

- Enterprise Awareness

** ****Call to Action**
-  There’s risk!
-  I’m vulnerable!
-  I need to be doing something!

**HIPAA**

- What I should do!

**HealthKey’s Roadmap -- to a ****Community**** Privacy and Security Infrastructure**

- Version 8.0

## From there, enterprises will take the necessary steps to protect themselves and the communities that they are serving. 

- HealthKey’s Roadmap - to a **Community** Privacy and Security Infrastructure

- Each sector of activity contains a number of action steps.   There is NO single route through the sectors or action steps.
- Sectors are NOT linear.  Progress can be made concurrently within multiple sectors of activity.
- Sectors do represent increasing collaboration and community-wide acceptance.
- Each action step represents a different capability of the infrastructure.
- Capabilities may be implemented at various levels of sophistication.

- Version 8.0

## HealthKey’s Roadmap - to a Community Privacy and Security Infrastructure

- Enterprise Preparedness

- Preparing the enterprise for external communication with trading partners

- Sector

- Capabilities

- HealthKey’s Roadmap - to a **Community** Privacy and Security Infrastructure

- Version 8.0

## HealthKey’s Roadmap - to a Community Privacy and Security Infrastructure

- HealthKey’s Roadmap - to a **Community** Privacy and Security Infrastructure

**Progress will be made at different rates in each sector, depending upon the community.**

_**Community Snapshot**_

- 50%

- 25%

- 75%

- Version 8.0

## HealthKey’s Roadmap -- Multiple routes to any destination

- Enterprise Preparedness

- Enterprise  Co-Existence

- Enterprise  Affiliation

**Standardize Identity Management**

**Standardize Identity Validation**

**Find an Electronic identity**

**Empower Administrative Entity**

- Community-Wide Participation

- Validate Servers

- Version 8.0

## HealthKey’s Roadmap - Implementation Options

- Enterprise Preparedness

- Enterprise  Affiliation

- Protect Electronic Perimeter

- Standardize Identity Management

- Standardize Identity Validation

- Find an Electronic Identity

- Upgrade Applications

- Administer User Accounts

- Enable Single  Log-On

- Set Privacy Policies

- Standardize Privacy Policies

- Set Access Control Policy

- Secure Connections

- Enterprise  Co-Existence

- Exchange E-mail

- Empower Administrative Entity

- Standardize Trading Partner Arrangements

- Authenticate & Validate User

- Validate Servers

- Community-Wide Participation

- Version 8.0

## HealthKey’s Roadmap - Doing Many Things At Once

- Enterprise Preparedness

- Enterprise  Affiliation

- Protect Electronic Perimeter

- Standardize Identity Management

- Standardize Identity Validation

- Find an Individual’s Electronic Identity

- Upgrade Applications

- Administer User Accounts

- Enable Single  Log-On

- Set Privacy Policies

- Standardize Privacy Policies

- Set Access Control Policy

- Secure Connections

- SSL/H

- Private Circuit

- VPN

- Enterprise  Co-Existence

- Internet Border

- DMZ

- Intrusion Detection

- Assurance & Tiger Team

- Not Encrypted

- Encrypted Gateway

- Encrypted by person

- Passwords

- Smart ID’s

- Biometrics

- Certificates

- Exchange E-mail

- Empower Administrative Entity

- Identification Policy

- Deploy Identity Procedures

- Support Procedures

- Standardize Trading Partner Arrangements

- Authenticate & Validate User

- Things most organizations are already doing!

- Validate Servers

- Community-Wide Participation

- User Registration Procedures

- Version 8.0

## We want to know if the “Roadmap” framework make sense to you?

- Can you see your organization on the map?
- Are there things that you would add or change?
- Is it a useful tool for community education and planning?
- Do you envision a common electronic identity for users?  If so, how will you make it happen?
- Will your organization collaborate towards a common privacy and security infrastructure?

- If not, is there something else that makes better sense?

- Version 8.0

## There are a number of Roadblocks between us and this critical infrastructure . . .

- There is confusion! -- “What problem?”* *
- The complexity is daunting -- infrastructure, technology, social implications, legislation, operations, cost, capital, etc.
- We act competitively, not collaboratively -- and collaboration is difficult
- We are looking for silver bullets -- there are many vendors pushing solutions, not solving problems
- Who’s driving?  -- There is a leadership void, organizations are reacting to regulations and vendor offerings

- Version 8.0

## Agree on the unique ‘Road Map’ for your community 
Convene key stakeholders
Agree upon a big picture of enterprise-specific and shared capabilities
Define approach for building shared capabilities (e.g. Business Associate Agreements, Privacy Policies, Strategies for User Authentication/Validation)

Demonstrate leadership of the ‘Critical Few’
Handful of influential organizations necessary to make things happen
Commit to shared capabilities
Work together and with vendors to guide implementation

Establish and empower a ‘Catalyst for Collaboration’
Trusted individuals and process for sustaining collaboration
Raise awareness/Educate about what is being done and why
Recommend ways to deploy innovation to small organizations and individuals

- Convene key stakeholders
- Agree upon a big picture of enterprise-specific and shared capabilities
- Define approach for building shared capabilities (e.g. Business Associate Agreements, Privacy Policies, Strategies for User Authentication/Validation)
- Demonstrate leadership of the ‘Critical Few’
- Handful of influential organizations necessary to make things happen
- Commit to shared capabilities
- Work together and with vendors to guide implementation
- Establish and empower a ‘Catalyst for Collaboration’
- Trusted individuals and process for sustaining collaboration
- Raise awareness/Educate about what is being done and why
- Recommend ways to deploy innovation to small organizations and individuals

- Recommendations to organizations and communities for making progress towards a common infrastructure.

- Version 8.0

## Where do we go from here?

- Do you agree with these roadblocks and recommendations?  Are they practical?
- Do you see a role for a HealthKey-like program in your community?  If so, what would it be?
- Would you contribute to funding the HealthKey-like program?

- Version 8.0

## Thank you !

- For further information:
- www.healthkey.org

- Version 8.0