1 / 15

Confidentiality Codes Refactored

Confidentiality Codes Refactored. Kathleen Connor Eversolve. Problem Statement. The current HL7 Confidentiality Code System is overloading the coded attributes of confidentiality Current Confidentiality Codes mix: Privacy Policy Codes about how Sensitive Information must be handled with

verne
Download Presentation

Confidentiality Codes Refactored

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Confidentiality Codes Refactored Kathleen Connor Eversolve

  2. Problem Statement • The current HL7 Confidentiality Code System is overloading the coded attributes of confidentiality • Current Confidentiality Codes mix: • Privacy Policy Codes about how Sensitive Information must be handled with • Metadata tags used to convey Information Sender and Receiver obligations to prevent unauthorized use or disclosure • Without guidance on the intended use of these metadata tags, implementers may mistakenly applying Privacy Policy and Sensitive Information Codes as metadata on external wrappers use in exchange • As a result, they may be breaching protected information by disclosing the sensitive nature of that information to unauthorized Receivers

  3. Happy News • Refactored Confidentiality Codes fit seamlessly into the Composite Security and Privacy DAM with minimal changes • This should be considered validation of that good work • Proposed changes specify • Sender responsibility to ensure that protected information is handled in accordance with Privacy Policies • Receiver responsibility for handling protected information the Sender is authorized to disclose • Interoperable and policy driven Confidentiality Codes that reduce the need for point to point negotiation when exchanging information

  4. Proposed Changes to the DAM • Refactors current Confidentiality Code System • Reason: Multiple Axes that blend internal Privacy Policies with Role and User base Access and interoperable Confidentiality Codes • Defines new interoperable Confidentiality Codes • Specifies Receiver responsibilities for information being exchanged • Limited set of codes that convey general information handling rules • Convey sensitivity levels without disclosing why the information is or is not sensitive • Relocates Sensitive Information Codes to ActPrivacyPolicyType value set • Sensitive Information Codes represent a type of Organizational Privacy Policy • Like Jurisdictional Privacy Policies, these are implemented in a Policy Information Point to inform the Policy Decision Point

  5. Confidentiality – Sensitivity Matrix

  6. Current HL7 Confidentiality Code Concept Domains Current Confidentiality Codes Relationships

  7. Disambiguating Confidentiality and Sensitivity • Definition of these concepts are often intertwined and not clearly orthogonal in most contexts • Healthcare differentiate these because of heightened Privacy concerns • Confidentiality is a security concept • How information is treated • Who can know and what they can do with it • Has no necessary bearing on social values • Sensitivity is a social perception concept • How information is regarded socially • What others will think about and act on the information • How that “social” perception and resulting reaction will impact the information subject and/or owner

  8. ActPrivacyPolicyType

  9. Vocabulary Changes to Support Use Cases • Added attribute to Privacy Policy that designates which Privacy Policy • May leverage existing HL7 vocabulary Act.code concept domain “ActPrivacyPolicyType” • Proposed Vocabulary includes: • ActPrivacyLaw – with example codes representing e.g., 42 CFR Part 2 and HIPAA • Sensitivity - • Defined as policies shared by a policy domain relating to sensitivity of information • Leverages ISO7498-2:1989 definition: Sensitivity is the characteristic of a resource which implies its value or importance and may include its vulnerability • Example codes from the ConfidentialityModifiers and ConfidentialityByInfoType and proposed codes for Use Case discovered gaps such as Sensitive Service Provider and Employee

  10. Relocated Sensitive Information Codes Relocates Sensitive Information Codes from AccessByInfoType and Confidentiality Modifiers to the ActPrivacyPolicyType value set No impact on earlier models which will reference current Confidentiality Code System No impact on CDA which only uses Normal, Restricted, and Very Restricted Future models that use ActPrivacyPolicyCodes can target classes with a Comply relationship to an ActClassPolicy

  11. Refactored Confidentiality Codes

  12. Refactored Confidentiality Codes

  13. Proposed Refactoring

  14. Next Steps – Prepare Harmonization Proposal • UPCOMING HARMONIZATION MTGS • Harmonization Conference Call • Nov 15, 2011 to Nov 18, 2011Add to Outlook Calendar • Templates and Examples • Download Harmonization Proposal Template/Example • Initial Proposals • Submissions due 10/16/2011, midnight Eastern Final Proposals Submissions due 11/06/2011, midnight Eastern View/Upload Proposals View/Upload Proposals Policy and Procedural Excerpts Harmonization Process Overview <http://www.hl7.org/events/harmonization/index.cfm>

More Related