# Presentation: 151453

## Personal Health Records: Overview of Patient Identity Proofing Practices

- Presentation to the AHIC
- Confidentiality, Privacy and Security Workgroup
- February 20, 2007

## Agenda

- Introduction
- Analysis of IDP Practices
- Examples of Non-Healthcare IDP Practices
- IDP Considerations for the CPS WG
- Other Research Findings:
- Privacy Policies
- Authentication Credentials
- SSL Site Certificates

## Introduction

- Initial research:
- 50 companies providing PHRs that have no prior relationship with consumers
- Publicly available information from company web sites
- Types of PHR providers:
- _Off-line_: PHR products and applications operated by a consumer in a non-networked environment
- _On-line_: PHRs hosted by a provider and managed on-line by a consumer (i.e., via the Internet), or PHRs locally managed by the consumer and can also be network connected to obtain additional on-line services

## Introduction (cont.)

**Types of PHR Providers**

- 17 total off-line providers
- 33 total on-line providers

## Introduction (cont.)

- Research extended to identify PHR providers offering value-added services, where these services:
- Are in addition to medical journal services
- Require network connectivity to a third party (e.g., care provider)
- Consist of services such as secure messaging, prescription refill, and lab results reporting
- Off-line PHR providers did not offer any value-added services

## Introduction (cont.)

**Services Offered by On-line PHR Providers**

- 13 total value-added service providers
- 20 total journal only service providers

## Introduction (cont.)

**Value-Added Services Provided by On-line PHR Providers**

- Note: Some service providers offer multiple value-added services

## Introduction (cont.)

- Remaining research focused on the thirteen (13) PHR providers offering on-line, value-added services
- IDP practices
- Non-healthcare IDP practices
- Privacy policies (appendix A of research paper)
- Authentication credentials (appendix B of research paper)
- Miscellaneous findings (appendix C of research paper)

## PHR IDP Practices

**IDP Processes for Value-Added PHR Services**

- 8 total with IDP practices defined
- 5 total with no IDP practices defined

## PHR IDP Practices (cont.)

**Identity Data Verified by PHR Providers Offering Value-Added Services**

- Free PHRs

- Device purchase required before establishing on-line PHR service

- Not clear if purchase required to establish PHR service

## PHR IDP Practices (cont.)

| Value-added Service | Name & Email Address | Name, Address, Phone, Email & Credit Card No. | Name, Address, Phone, Email, Credit Card No., & Age | Name, Address, Phone, Email, SSN & DoB | Name, Address, Phone, Email, Credit Card No., & PHR Device ID |
| --- | --- | --- | --- | --- | --- |
| Secure Messaging w/ Care Provider | X | X |  | X |  |
| Appointment Scheduling | Information on identity proofing practices not found. |  |  |  |  |
| Prescription Refill | Information on identity proofing practices not found. |  |  |  |  |
| Medical Record Request by Consumer | Information on identity proofing practices not found. |  |  |  |  |
| 3rd Party Read Access to PHR |  | X | X |  | X |
| 3rd Party Write Access to PHR | X |  |  |  |  |
| Consumer Bill Pay | Information on identity proofing practices not found. |  |  |  |  |
| EMT Alert Services |  | X |  |  |  |

**Mapping of IDP Practices to Value-Added Services**

## PHR IDP Practices – Summary

- Minimal consumer IDP being performed
- Four of the value-added services had no IDP practices defined
- Four of the value-added services leveraged a successful credit card transaction to prove identity
- One case allowed write access based on name and email address identity data
- Little to no information on IDP for authorized 3rd parties accessing PHR services
- Consumers need to trust PHR provider to correctly establish authorized 3rd party relationships (e.g., care provider, pharmacy)
- 3rd parties need to trust the minimal consumer IDP practices of the PHR provider to ensure information is obtained from, or transferred to the correct the PHR

## PHR IDP Practices – Summary

- No use of technologies such as Knowledge Based Authentication (KBA)
- Real-time, on-line identity proofing of consumers with no prior relationship
- Based on access to trusted third party sources and proprietary algorithms to develop personal questions to be answered by the consumer
- Requires initial identity data to be provided by consumer
- Questions are then tailored to the user’s personal history (e.g., loans, residence, credit history)
- Additional information on KBA can be found at _[http://csrc.nist.gov/kba](http://csrc.nist.gov/kba)_

## Non-Healthcare IDP Examples

|  | Annual Credit Report | Capital One | HSBC Direct |
| --- | --- | --- | --- |
| Initial Set of Identity Information Collected | Legal Name
SSN
Date of Birth
Mailing Address
Residency More than 2 Years? | Legal Name
Citizenship
SSN
Date of Birth
Driver’s License/State ID #
Email Address
Mailing Address
Phone Number
Residency More than 2 Years? | Legal Name
Citizenship
SSN
Date of Birth
Driver’s License/State ID #
Email Address
Mailing Address
Phone Number
Residency More than 2 Years? |
| Additional Set of Identity Information Collected | Personal Questions*
Mortgage provider?
Mortgage amount?
Car loan provider?
Car loan amount? | Personal Questions*
Car loan provider?
Car loan term?
Personal loan provider?
Personal loan amount?
Credit card provider? | Personal Questions*
Student loan provider?
Student loan amount?
Car loan provider?
Car loan amount?
Credit card provider? |
| Method Used to Verify Identity Information | Third Party Source Verification and Knowledge Based Authentication | Third Party Source Verification and Knowledge Based Authentication | Third Party Source Verification and Knowledge Based Authentication |
| Account Activation Method | Immediate | Log back in with account information, SSN and email address to establish on-line account access; also required to provide 3 security answers for customer support. | Log back in with account information and SSN to establish on-line account access. |
| Authentication Credential | Credit report number provided by credit agency, along with State, Zip Code and SSN | Username/password | Username/password |

- * Personal questions are geared toward the applicant based on their verified credit information.  Verified credit information is determined from the initial set of identity information collected from the applicant.

## Non-Healthcare IDP Examples (cont.)

- IDP practices more stringent than researched PHR IDP practices
- More base identity data collected
- Use of KBA technology and on-line trusted third party resources
- Assuming PHR information is as sensitive as credit report and banking information, then current practices show PHR IDP is lacking to adequately identify consumers

## Considerations for the CPS WG

- Should PHR providers offering value-added services be required to explicitly describe their identity proofing practices on their provider sites?
- Are technologies such as KBA, along with utilization of on-line trusted third party sources adequate to perform identity proofing of a PHR consumer where the consumer has no prior relationship with the PHR provider?
- Should third parties who have access to a PHR be identity proofed separately from the consumer?  Further, should the identity proofing be more stringent for those third parties that have write access into a PHR?
- Should the degree of identity proofing be commensurate with the type of value-added services being provided by the PHR provider (e.g., is appointment scheduling less sensitive than communicating with a care provider, and therefore requires less identity proofing to be performed)?

## Additional Research

- Appendices in the Research Paper

## Privacy Policies

**Published Privacy Policies by Value-Added PHR Service Providers**

- Only one had their policy validated by Trust-e.

- Note: Privacy policies include how personal information is collected, used, managed, distributed and protected.

## Authentication Credentials

**Types of Authentication Credentials Used by Value-Added PHR Service Providers**

- Single Factor Authentication

- Note: The financial industry, based on guidance issued by the Federal Financial Institutions Examination Council, is moving toward the use of multi-factor authentication credentials for on-line banking solutions.

## Secure Socket Layer (SSL) Site Certificate Issues

**PHR Provider Web Sites with SSL Site Certificate Issues**

- Note: SSL site certificates are used to authenticate the provider site to the consumer as being a valid and trusted site.

## Secure Socket Layer (SSL) Site Certificate Issues (cont.)

- When an issue occurs during verification of an SSL site certificate...
- Certificate is expired
- Not trusted by the web browser (i.e., does not verify to one of the trusted root authorities in the browser)
- Name in certificate does not match URL of web site
- ...then a message such as this appears:
*“**The is a problem with this website’s certificate.*
*We recommend that you close this webpage and do not continue to this website.”*
- SSL site certificate issues can create a lack of trust between on-line PHR providers and the consumer community