They must ensure that authorized users don't abuse their access privileges and that unauthorized users don't break into their information systems to alter or delete data. Second, the nation as a whole must decide how to address the privacy concerns that arise from the sharing of patient information among different entities in the nation's health system. Unless ways can be found to balance the privacy rights of individuals against the legitimate needs of such institutions for patient information, health care may suffer as patients may become less willing to seek care, or they withhold sensitive personal information. Protection at Individual Institutions Protecting health information within individual institutions requires a combination of sound policies and strong security. Policies determine whom within an institution can access different types of data and under what circumstances.
Security provides the technical means of implementing and enforcing policy.
Health organizations are beginning to develop new means of protecting health information as they put it on-line. Most have developed policies and practices in an ad hoc fashion, reacting to individual incidents. The first step in addressing these problems is to develop a set of standard practices for protecting health information within individual institutions. These practices should be adopted by all organizations that handle patient-identifiable health information, not just providers and payers. The practices should include technical tools to identify and validate the identity of users, limit their access to particular types of information, protect remote access points, and keep logs of all accesses to health information.