Working with Health IT Systems

1. Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems Lecture b This material (Comp7_Unit7b) was developed by Johns Hopkins University, funded by the Department of Health and Human Services, Office of the National Coordinator for Health Information Technology under Award Number IU24OC00013.

2. Protecting Privacy, Security, and Confidentiality in HIT Systems Learning Objectives─Lecture a • Explain and illustrate privacy, security, and confidentiality in HIT settings. • Identify common threats encountered when using HIT. • Formulate strategies to minimize threats to privacy, security, and confidentiality in HIT systems. Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

3. Physical Safeguards Facility Access Controls Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

4. Physical Safeguards Examples • Workstation Use • Workstation Security • Device and Media Controls (e.g., media disposal, access to backup and storage media) Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

5. Physical Safeguards Examples • Device and Media Controls • media disposal • access to backup and storage media Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

6. Technical Safeguards Examples • Access Control • Unique user identification • Emergency access • Automatic logoff • Encryption/decryption Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

7. Technical Safeguards Examples • Audit Controls • Integrity Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

8. Technical Safeguards Examples • Person or Entity Authentication • Password/passphrase/PIN • Smart card/token/key • Biometrics • Two factor authentication Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

9. Technical Safeguards Examples • Transmission Security • Integrity controls • Encryption Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

10. Risk Analysis and Management • Analysis • Gather data on potential threats and vulnerabilities • Assess current security measures • Determine likelihood, impact and level of risk • Identify needed security measures • Management • Develop a plan for implementation • Evaluate and maintain security measures Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

11. Meaningful Use • Criteria for meaningful use of EHRs related to privacy, security, and confidentiality meant to align with HIPAA • Emphasizes need to conduct a risk analysis • Some specific requirements for EHR vendors Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

12. Protecting Privacy, Security, and Confidentiality in HIT Systems Summary—Lecture b • Privacy, security, and confidentiality in HIT settings • Common threats encountered when using HIT • Strategies to minimize threats to privacy, security, and confidentiality in HIT systems Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

13. Protecting Privacy, Security, and Confidentiality in HIT Systems References—Lecture b References • American Health Information Management Association. Available from: http://www.ahima.org • Ensuring Security of High-Risk Information in EHRs c2008. Available from: http://library.ahima.org/xpedio/groups/public/documents/ahima/bok1_039956.hcsp?dDocName=bok1_039956 • HIPAA Security Series: Security 101 for Covered Entities .c2004 Available from: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/security101.pdf • Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information. c2008. Available from:http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_0_10731_848088_0_0_18/NationwidePS_Framework-5.pdf • Scribd. Mobility Infrastructure Solution Design Guide. c2008. Available from: http://www.scribd.com/doc/24975115/Procurve-Wifi-Network-Design-Guide • U.S. Department of Health and Human Services. Available from: http://www.hhs.gov Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b

14. Protecting Privacy, Security, and Confidentiality in HIT Systems References—Lecture b Images Slide 3: HIPPA Security Bulletins. Courtesy HIPPA. Available from: http://www.hhs.gov/ocr/privacy Slide 5: Logo of the Federal Trade Commission. Courtesy Federal Trade Commission. Slide 6: Cloud Computing will Challenge Security Policies. Courtesy U.S. Dept. of Commerce Slide 7: The Field of Security Has to Adapt. Courtesy National Institutes of Health (NIH) Slide 8: A Sophisticated Users’ Station. Courtesy National Science Foundation (NSF) Available from: http://www.nsf.gov/od/lpa/news/press/00/stim5.htm Slide 9: Transmission Security Controls Prevent Unauthorized Access to ePHI. Available from: http://blog.tsa.gov/2008/08/encryption-is-issue-in-case-of-missing.html. Working with Health IT Systems Protecting Privacy, Security, and Confidentiality in HIT Systems─Lecture b