The resolution would appear to be an extensive educational campaign to make the public aware of the checks in place to protect the privacy of their data while supporting ongoing research. Concurrently, the attributes of patient data that would constitute an individual's identity must be defined and clarified. Protecting the information is fairly straightforward once it is defined. That protection takes the form of access control. Access to health care data has broader concerns than just research.
Access controls are as important during the episode of care as after.
The dichotomy faced by vendors is providing access controls that protect the patient, but don't hinder the caregiver. We are supportive of the approach that defines stakeholder roles and assigns an access level to each role. An orderly or nurse's assistant may only be able to determine the patient's location and the service they are scheduled to provide. At the other end of the spectrum the attending or primary care physician would have full access to the patient's medical records. It should fall to the standards development organizations, in a cooperative effort, to define these roles and the appropriate level or levels of access.