# Presentation: 029182

## Findings From Florida’s Health Information Security and Privacy Collaboration Project  for Health Information Exchange

**American Health Information Community**
**Confidentiality, Privacy and Security **
**Workgroup Meeting**** **
**June 22, 2007**

**Christopher B. Sullivan, Ph.D.**
- Florida Center for Health Information and Policy Analysis
- Agency for Health Care Administration

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## AHIC Confidentiality, Privacy and Security Workgroup Request for Information:

- Make recommendations to the CPS Workgroup on determining which HIPAA requirements are relevant for your business model in the case of health information exchange.
- For a given participant’s characteristics and role in an electronic health information exchange environment, please identify specific sections of the HIPAA Privacy and Security Rules that are not required under your business model.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## The Florida Health Information Network

**Florida’s Health Information Networks**
- 1. Big Bend RHIO
- 2. Central Florida RHIO
- 3. Community Health Information Organization
- 4. Escambia HIN
- 5. Jacksonville Health Information Network
- 6. Palm Beach County Community Health Alliance
- 7. Pinellas RHIO
- 8. Space Coast Health Information Network
- 9. South Florida HII
- 10. Tampa Bay RHIO
- See: _[http://](http://www.hhs.gov/healthit/)__[ahca.myflorida.com/dhit](http://www.hhs.gov/healthit/)_

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Privacy and Security (HISPC) Project Response for the Florida Health Information Network (FHIN)

- Address the CPS Workgroup questions regarding:
- Enforceable mechanisms
- Relevant Requirements
- Business Associates
- Report on the relevant findings of Florida’s Privacy and Security (HISPC) Project

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Addressing Enforceable Mechanisms

- Appropriate, effective, and feasible ways to enforce confidentiality, privacy, and security protections in this new electronic environment.** **
- The question presupposes that the current enforcement mechanisms are adequate to protect patient rights and privacy.
- In general, existing enforcement mechanisms should be the foundation for enforcement at the state and national level and these mechanisms should be strengthened.
- One possibility is to establish or designate a State-level organization to enforce security within the network of each State on behalf of the NHIN.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Addressing Relevant Requirements

- Identify specific sections of the HIPAA Privacy and Security Rules that are not required under your business model.
- HIPAA is not problematic for health information exchange in patient care.  We urge caution in making changes to HIPAA.
- The findings from the Privacy and Security (HISPC) Project indicate that the most important barriers to health information exchange are confusion about HIPAA requirements and other federal and state laws that are inconsistent with or more stringent than HIPAA.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Addressing Relevant Requirements – the Florida Health Information Network (FHIN)

- The FHIN does not meet the description of a health plan, a** **health care clearinghouse, or health care provider, hence is not a covered entity and is not legally required to adhere to the specifications of HIPAA.
- As a best practice for the secure exchange of protected health information (PHI) and to create minimum standards for covered entity participation in the FHIN, the implementation specifications for PHI as set forth in the HIPAA Security Rule should be followed by the administrators of the FHIN and its participants as a minimum standard.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Addressing Business Associates

- How does your organization ensure compliance with the privacy and security policies of covered entities with whom it contracts, particularly when there are numerous contracts?** **
- Health information exchanges including paper-based exchanges require trust relationships but there needs to be a level playing field regarding accountability and enforcement to the extent possible.
- Expanding direct accountability for meeting relevant HIPAA requirements to those entities routinely handling protected health information such as personal health records systems would be beneficial.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Addressing General Questions

- Is there a minimum set of confidentiality, privacy, and security protections that you think everyone should follow?
- HIPAA is the appropriate minimum.** **
- The rationale for the FHIN responses to the Confidentiality, Privacy and Security Workgroup are grounded in the findings of the Health Information Security and Privacy Collaboration (HISPC) Project conducted during 2006-2007.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Health Information Security and Privacy Collaboration Project (HISPC) Overview

- Florida is one of 33 states awarded a contract to study variations in business practices and laws related to electronic health information exchange.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
Lisa does project overview

## Health Information Security and Privacy Collaboration (HISPC) Project Objectives

- To identify business practices and policies related to electronic health information exchange (HIE).
- To analyze the policies and laws that are “barriers” to HIE.
- To identify solutions to the “barriers.”
- To develop a plan for implementing the solutions.
- Worked with 34 health care stakeholders from across Florida to identify barriers and solutions.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
Carladenise discuss project objectives, if Lisa has not covered in her background.

## Major Barriers to Health Information Exchange in Florida

- HIPAA is not a problem. Rather it is the misinterpretation of HIPAA policies and regulations – “HIPAA Folklore.”
- Inconsistent or contradictory laws at state and federal level.
- Mistrust of other health care entities and liability concerns  - “Battle of Consent Forms.”
- Limited use of technology and electronic health information.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## “HIPAA Folklore” as a Barrier to Health Information Exchange in Florida

- HIPAA requirements were often misunderstood by respondents in the course of the project.
- One major misinterpretation of HIPAA was that is prevented any health care information from being exchanged.
- This “HIPAA Folklore” rationale was cited by numerous providers for why they could not exchange health care data with a RHIO.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## Inconsistent or Contradictory Laws at State Level

- During the project over 45 sections of Florida law were identified as potentially applicable.
- In Florida’s HISPC report, a major barrier was the inconsistency between the records disclosure requirements for health records maintained by health care providers regulated under Chapter 456 of the Florida Statutes and those maintained by hospitals, regulated under Chapter 395 of the Florida Statutes.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## Florida Statute Regulating Disclosure of Information by Health Care Practitioners

- §456.057(7)(a), F.S., provides the applicable requirements for treatment and payment disclosures by health care practitioners.
- Pursuant to this statute, a health care provider may release a patient’s record, without the patient’s written or oral consent, to another health care provider involved in the treatment and care of the patient.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## Florida Statute Regulating Disclosure of Information by Hospitals

- §395.3025(4), F.S., provides the applicable requirements for treatment and payment disclosures by hospitals.
- A patient’s hospital record cannot be disclosed to a treating provider without the patient’s written consent, unless the provider is “licensed facility personnel” or an “attending physician.”

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## Inconsistency in Florida Statutes as a Barrier to Health Information Exchange

- The inconsistency between §395.3025(4), F.S. and §456.057(7)(a), F.S. is identified as a barrier to health information exchange, particularly in emergency situations when consent in unavailable.
- The rationale for the inconsistency between the two statutes is unknown.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## Burden Placed on Providers 

- Health care providers must understand multiple laws governing health information exchange.
- Health care providers must determine which laws are applicable in the often ambiguous context of events.
- Health care providers must rely on the other provider making the request for facts, context, that determines applicable law.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## Proposed Solutions to Statutory Barriers

- Consolidate statutes related to the exchange of health information among physicians, hospitals and other health care entities.
- Adopt uniform standards for consent and for the person consenting on behalf of patient.
- Facilitate electronic patient consent through the use of an authentication mechanism such as an electronic signature or, preferably, a digital signature.
- Address emergency care when neither the patient or a medical surrogate is able to consent.

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

**Notes:**
carladenise

## Goals of Florida’s HISPC Implementation Plan for Interoperable Health Information Exchange

- Goal I: Establish Uniform Privacy Policies for   e-Health
- Goal II:	Adopt a Secure Technological Framework for e-Health
- Goal III:	Raise the Community’s Awareness of e-Health
- Goal IV:	Participate in the Framing of National Standards for e-Health
- _[http://ahca.myflorida.com/dhit/Privacy_ss.shtml](http://ahca.myflorida.com/dhit/Privacy_ss.shtml)_

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange

## Christopher B. Sullivan, Ph.D.

**Christopher B. Sullivan, Ph.D.**
- Agency for Health Care Administration
- Florida Center for Health Information and Policy Analysis
- Office of Health Information Technology
- 2727 Mahan Drive
- Tallahassee, FL 32309
- _[sullivac@ahca.myflorida.com](mailto:rawlinsl@ahca.myflorida.com)__[ ](mailto:rawlinsl@ahca.myflorida.com)_

- American Health Information Community Confidentiality, Privacy and Security Workgroup Meeting, June 22, 2007

- Findings From Florida’s Health Information Security and Privacy Collaboration Project for Health Information Exchange