E N D
2. [Cover a range of topics here related to privacy, including consumer consent to participate in HIE][Cover a range of topics here related to privacy, including consumer consent to participate in HIE]
3. What is the Arizona Health Privacy Project?
34 states and territories (including Arizona) awarded federal grants to evaluate privacy and security issues in electronic health information exchange (HIE)
Identify privacy and security practices that affect HIE
Propose solutions and develop implementation plans to remove barriers to HIE
Collaborate through regional and national meetings to develop solutions with broader application
Based on this assessment, Arizona Health-e Connection will identify practical ways to enable HIE, while protecting the privacy and security of health information
4. Arizona Health Privacy Project Project Team
Kim Snyder Arizona Government Information Technology Agency
Nell Lawrence Arizona Government Information Technology Agency
Kristen Rosati Coppersmith Gordon Schermer & Brockelman PLC
Ajay Vinze ASU Center for Advancing Business through Information Technology (CABIT)
Benjamin Shao ASU CABIT
Harvey Shrednick ASU CABIT
Raghu Santanam ASU CABIT
Minu Ipe ASU CABIT
Orneita Burton ASU CABIT
5. Arizona Health Privacy Project Chairs and Facilitators of Work Groups
Variations Work Group
Rick Potter, Health Services Advisory Group (Chair)
Harvey Shrednick, CABIT (Facilitator)
Solutions and Implementation Work Group
Mike Stearns, formerly at Scottsdale Healthcare (Chair)
Raghu Santanam, CABIT (Facilitator)
Legal Work Group
Kristen Rosati , Coppersmith Gordon Schermer & Brockelman PLC (Chair)
Bill Pike, Carondelet (Facilitator)
Education Work Group
Anne Winter, United Health Care (Chair)
Ajay Vinze, CABIT (Facilitator)
6. Volunteers! Hundreds of people volunteered on the Arizona Health Privacy Project workgroups
THANK YOU!! Now that the Arizona Health Privacy Project is formally coming to an end, Arizona Health-e Connection certainly will not end this outreach to volunteers and particularly to consumers. We continue to welcome the guidance and input from consumers in how the health information exchange should protect the privacy of their health information.Now that the Arizona Health Privacy Project is formally coming to an end, Arizona Health-e Connection certainly will not end this outreach to volunteers and particularly to consumers. We continue to welcome the guidance and input from consumers in how the health information exchange should protect the privacy of their health information.
7. The Process The Arizona Health Privacy Project was operating under the ground rules set by AHRQ and its subcontractors RTI and the National Governor’s Association.
Unfortunately, the required process was a bit bureaucratic and unwieldy, but we thankfully ended up with some very useful information. Also, getting all of these volunteers involved in the process served probably the most important underlying goal—getting the stakeholders—consumers, health care providers, and insurance companies-- involved in the process
One of the frustrations for the project leaders about the required processes is that we were prohibited from doing surveys of Arizona stakeholders– apparently the federal Paperwork Reduction Act prohibited suveys under this grant. We were particularly excited about the involvement of ASU and CABIT because of their expertise in survey development and their ability to conduct research.
But we were able to convene focus groups to collect information about what Arizona providers and plans’ security and privacy business practices, and CABIT did a great job at that process.
Here is a quick view of the required process we applied, and then Harvey and Raghu form CABIT will provide more details for you.The Arizona Health Privacy Project was operating under the ground rules set by AHRQ and its subcontractors RTI and the National Governor’s Association.
Unfortunately, the required process was a bit bureaucratic and unwieldy, but we thankfully ended up with some very useful information. Also, getting all of these volunteers involved in the process served probably the most important underlying goal—getting the stakeholders—consumers, health care providers, and insurance companies-- involved in the process
One of the frustrations for the project leaders about the required processes is that we were prohibited from doing surveys of Arizona stakeholders– apparently the federal Paperwork Reduction Act prohibited suveys under this grant. We were particularly excited about the involvement of ASU and CABIT because of their expertise in survey development and their ability to conduct research.
But we were able to convene focus groups to collect information about what Arizona providers and plans’ security and privacy business practices, and CABIT did a great job at that process.
Here is a quick view of the required process we applied, and then Harvey and Raghu form CABIT will provide more details for you.
8. The Process
9.
LEGAL WORK GROUP (LWG)
10. Legal Work Group Findings Some Arizona laws and regulations may interfere with HIE
Genetic testing information, A.R.S. § 12-2801, et seq. and A.R.S. § 20-448.02, et seq.
Communicable disease information: A.R.S. § 36-661 et seq., A.R.S. § 20-448.01 and A.A.C. R20-6-1204
Mental health information, A.R.S. § 36-501, et seq.
AHCCCS member information regulations: A.A.C. R9-22-512
Adult Day Health Care Facility records regulation: A.A.C. R9-10-511(C)
Medical records subpoena statute: A.R.S. § 12-2294.01
11. Legal Work GroupFindings Some Arizona laws may be required to encourage HIE
Immunity from liability for participants in e-health data exchange that follow best privacy and security practices
Enforcement statute with penalties for participants who do not follow the access rules for the exchange, as well as unauthorized individuals that have not been granted access
12. Legal Work Group Subgroups Nine subgroups are working on proposals for legislative/regulatory changes:
(1) Genetic testing statutes: Ira Berkowitz, St Joseph’s Hospital and Medical Center
(2) Communicable disease information statutes and regulations: Laura Carpenter
(3) Drafting amendments to the mental health information statute: Bob Sorce, Arizona Attorney General’s Office, representing Department of Health Services
13. Legal Work Group Subgroups Nine subgroups continued:
(4) AHCCCS member information regulations: Matt Devlin, AHCCCS
(5) Adult Day Health Care Facility records regulation
(6) ADHS disclosure of immunization information: Beth Dietz, Arizona Attorney General’s Office, representing ADHS
(7) Medical records subpoena statute: Bonnie Petterson, Phoenix College and Brigid Holland, Navapache Regional Medical Center
14. Legal Work Group Subgroups Nine subgroups continued:
(8) Immunity statute for participants in e-health data exchange: Ira Berkowitz
(9) Enforcement statute with penalties for participants who do not follow the access rules for the exchange, as well as unauthorized individuals that have not been granted access: Barbara Hess, Pinal/Gila County Long Term Care
15. Legal Work Group Subgroups Your involvement is encouraged!
16.
VARIATIONS WORK GROUP (VWG)
17. Assessment Process of Business Practices
18. Variations Work Group: Business Practices 18 factual scenarios about health information exchange were provided by RTI
Six volunteer focus groups convened to identify business practices used to handle each factual scenario
Representatives from consumer advocacy organizations, hospitals, specialized facilities, physician offices, insurance companies, public health
Over 200 business practices identified!
19. Stakeholder Representation and Outreach
20. “Barriers” and “Non-barriers” Business Practices were coded as a “barrier” or “non-barrier” to information exchange
“Non-barrier” practices were defined broadly as those that were:
consistent with Arizona law
permit interoperability (exchange between providers)
easy to put into practice
“Barriers” were practices that make electronic information exchange challenging
Coding a practice as a barrier ‘flagged’ that practice for further review by Legal Working Group and Solutions Working Group
21. VWG Major Findings Variations in business practices principally centered around mode of communication, security procedures, and interpretation of HIPAA regulations
Variations in communications media create difficulties in information exchange
Non-uniform implementation of encryption technology is a concern in electronic methods of information exchange
Organization size and associated financial constraints pose barriers to information exchange as a result of lack of investments in implementing technologies for information safeguards
Organizations interpret HIPAA “reasonable safeguards” guidelines inconsistently
22. Variations in practice cause barriers to HIE Different information transmission security or exchange protocols
Different administrative or physical security safeguards
Different information use and disclosure policies
Lack of appropriate information sharing protocols between the state public health department and the 22 Native American tribes in the state
23.
SOLUTIONS AND IMPLEMENTATION WORK GROUPS (SWG & IPWG)
24. Solutions Work Group Objectives
25. Solutions Work Group Analysis Critical barriers identified for deliberation:
Reviewed barriers within “as-is” business practices that make HIE challenging
Brainstormed and collected potential solutions to barriers
Highlighted identified solutions and best practices
Identified issues for follow-up in implementation
Identified practices with no solutions
26. Identification of Barriers to HIE Legal (covered earlier)
Business
Variations in interpretation of HIPAA guidelines
Financial constraints of smaller organizations
Technology
Authorization, authentication, access control, audit
Protection of information from unauthorized/improper modification when transmitted electronically
27. Major Barriers Health care organizations in Arizona use different media to share critical information. These multiple communication methods cause challenges in responding to information requests.
Health care organizations interpret the HIPAA regulations inconsistently and implement safeguards that may be either overly restrictive or lax. These differences in interpretation pose a barrier to e-health data exchange.
Health care organizations in Arizona face different financial constraints on whether, or how much, they invested in technologies such as encryption and secure emails to protect patient information.
28. SWG Recommendations Over 25 distinct (and related) solutions were recommended
Examples:
Use RHIOs to develop consensus on role-based authorization standards for all entities in the network
Centralized provider directory within the state
Use certification authorities (such as Certification Commission for Healthcare IT (CCHIT)) to establish criteria for ensuring secure information exchange
Explore uniform adoption of technology solutions such as Digital Signatures, biometrics, etc.
29. Implementation Work Group Objectives To document practical approaches and actionable steps for implementing solutions
Planning assumptions and decisions
Project ownership and responsibilities
Project scope
30. IPWG Recommended Projects
31. Next Steps Recommendations are the first steps in addressing the privacy and security issues facing Arizona
Suggest integration into the Arizona Health-e Connection implementation roadmap
EMR-Lite
Master Provider Index
32. Perspectives of the Stakeholders Arizona Health Privacy Project Work Group Members:
Mary Beth Joublanc
Arizona Department of Health Services
Wendy Dietrich Benz
Raising Special Kids
Theresa Wall
Native American Public Health
Cleo Long
Arizona Senior Care
33. Questions?