Health information exchange (HIE) raises the stakes for health IT professionals and providers as more and more patient data come into play. Although still early in its development, HIE is coming to require the healthcare industry to consider what effect the sheer scale of exchange will have on efforts to safeguard sensitive information from unauthorized access. In many ways, rising to the challenge of safeguarding the exchange of health information comprises various tiers, from fundamental applications to advanced solutions.
At its most basic, HIE security begins with encryption. “From the security standpoint, you have the basics of making sure that data are encrypted and protected, not just in transit but also at rest,” continues Jeffrey Cunningham, CTO of Informatics Corporation of America (ICA), “so that any data, particularly in our role where you’re pulling multiple data from multiple systems, we’re protecting at a very basic level against any kind of data breach in terms of encryption or someone walks off with a laptop.”
The next level considers restrictions on how information is accessed in terms of user authentication:
That’s basically who’s authorized to see this information, and that’s tricky in an HIE scenario, particularly when you’re talking system to system. There are a number of emerging standards and other types of capabilities that are starting to get at establishing, credentialing, and other types of capabilities that need to be in place so that there are rules of the road — what two different entities need to be able to attest to — to say, “Yes, we can securely share information.”
Depending on what side the user is coming from (i.e., the host, sender, or receiver), authenticating users poses unique security challenge because of the difficulty associated with establishing trust. “If I have an EMR system asking me for permission, I have to trust that they’ve authenticated the user on the other side and can really see what they’re asking for. There’s no way that I can know that about everybody for lack of a better example,” explains Cunningham. “That’s the second part of that — making sure that all the technical pieces are there but there are also policies in place and common procedures that everybody’s following so that there’s a level of trust that’s established between the participants.”
Beyond encryption and user authentications are plans to develop ways of restricting access to various elements contained in the patient’s medical record and giving individuals the ability to prevent access to sensitive data without consent:
The final piece of that really gets into patient consent and sensitive data. That’s something that is very complex right now, something that we deal with in multiple scenarios because it varies from state to state. But really it all comes down to: What degree do patients have rights (and being able to choose what information is shared and what information is not shared) and then to what degree are sensitive aspects of the data put to more stringent protocols?
Whereas progress is being made handling patient consent, the same cannot be said of allowing portions of the patient record to remain inaccessible to certain providers (e.g., non-psychiatric doctors cannot view data pertaining to behavioral health or mental illness). “The current state of reality right now is we’re getting pretty good as an industry at dealing with patient consent,” Cunningham observes, “We’re not so good right now at dealing with certain types of data. As a matter of fact, it tends to work most often as an all-or-none capability.”
While much of the conversation about successful HIEs currently focuses on their sustainability and dominated by those funding their development, it is more likely that their success will come down to how willing patients are to trust their ability to safeguard that information that gives them their name.