Beyond The Hipaa Privacy Rule

In the realm of health care, privacy protections are needed to preserve patients' dignity and prevent possible harms. Ten years ago, to address these concerns as well as set guidelines for ethical health research, Congress called for a set of federal standards now known as the HIPAA Privacy Rule. In its 2009 report, Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research, the Institute of Medicine's Committee on Health Research and the Privacy of Health Information concludes that the HIPAA Privacy Rule does not protect privacy as well as it should, and that it impedes important health research.

This concise, practical guide helps the advocate understand the sometimes dense rules in advising patients, physicians, and hospitals, and in litigating HIPAA-related issues.

This User’s Guide is intended to support the design, implementation, analysis, interpretation, and quality evaluation of registries created to increase understanding of patient outcomes. For the purposes of this guide, a patient registry is an organized system that uses observational study methods to collect uniform data (clinical and other) to evaluate specified outcomes for a population defined by a particular disease, condition, or exposure, and that serves one or more predetermined scientific, clinical, or policy purposes. A registry database is a file (or files) derived from the registry. Although registries can serve many purposes, this guide focuses on registries created for one or more of the following purposes: to describe the natural history of disease, to determine clinical effectiveness or cost-effectiveness of health care products and services, to measure or monitor safety and harm, and/or to measure quality of care. Registries are classified according to how their populations are defined. For example, product registries include patients who have been exposed to biopharmaceutical products or medical devices. Health services registries consist of patients who have had a common procedure, clinical encounter, or hospitalization. Disease or condition registries are defined by patients having the same diagnosis, such as cystic fibrosis or heart failure. The User’s Guide was created by researchers affiliated with AHRQ’s Effective Health Care Program, particularly those who participated in AHRQ’s DEcIDE (Developing Evidence to Inform Decisions About Effectiveness) program. Chapters were subject to multiple internal and external independent reviews.

Determinants of health - like physical activity levels and living conditions - have traditionally been the concern of public health and have not been linked closely to clinical practice. However, if standardized social and behavioral data can be incorporated into patient electronic health records (EHRs), those data can provide crucial information about factors that influence health and the effectiveness of treatment. Such information is useful for diagnosis, treatment choices, policy, health care system design, and innovations to improve health outcomes and reduce health care costs. Capturing Social and Behavioral Domains and Measures in Electronic Health Records: Phase 2 identifies domains and measures that capture the social determinants of health to inform the development of recommendations for the meaningful use of EHRs. This report is the second part of a two-part study. The Phase 1 report identified 17 domains for inclusion in EHRs. This report pinpoints 12 measures related to 11 of the initial domains and considers the implications of incorporating them into all EHRs. This book includes three chapters from the Phase 1 report in addition to the new Phase 2 material. Standardized use of EHRs that include social and behavioral domains could provide better patient care, improve population health, and enable more informative research. The recommendations of Capturing Social and Behavioral Domains and Measures in Electronic Health Records: Phase 2 will provide valuable information on which to base problem identification, clinical diagnoses, patient treatment, outcomes assessment, and population health measurement.

Privacy is a growing concern in the United States and around the world. The spread of the Internet and the seemingly boundaryless options for collecting, saving, sharing, and comparing information trigger consumer worries. Online practices of business and government agencies may present new ways to compromise privacy, and e-commerce and technologies that make a wide range of personal information available to anyone with a Web browser only begin to hint at the possibilities for inappropriate or unwarranted intrusion into our personal lives. Engaging Privacy and Information Technology in a Digital Age presents a comprehensive and multidisciplinary examination of privacy in the information age. It explores such important concepts as how the threats to privacy evolving, how can privacy be protected and how society can balance the interests of individuals, businesses and government in ways that promote privacy reasonably and effectively? This book seeks to raise awareness of the web of connectedness among the actions one takes and the privacy policies that are enacted, and provides a variety of tools and concepts with which debates over privacy can be more fruitfully engaged. Engaging Privacy and Information Technology in a Digital Age focuses on three major components affecting notions, perceptions, and expectations of privacy: technological change, societal shifts, and circumstantial discontinuities. This book will be of special interest to anyone interested in understanding why privacy issues are often so intractable.

Develop a comprehensive plan for building a HIPAA-compliant security operations center, designed to detect and respond to an increasing number of healthcare data breaches and events. Using risk analysis, assessment, and management data combined with knowledge of cybersecurity program maturity, this book gives you the tools you need to operationalize threat intelligence, vulnerability management, security monitoring, and incident response processes to effectively meet the challenges presented by healthcare’s current threats. Healthcare entities are bombarded with data. Threat intelligence feeds, news updates, and messages come rapidly and in many forms such as email, podcasts, and more. New vulnerabilities are found every day in applications, operating systems, and databases while older vulnerabilities remain exploitable. Add in the number of dashboards, alerts, and data points each information security tool provides and security teams find themselves swimming in oceans of data and unsure where to focus their energy. There is an urgent need to have a cohesive plan in place to cut through the noise and face these threats. Cybersecurity operations do not require expensive tools or large capital investments. There are ways to capture the necessary data. Teams protecting data and supporting HIPAA compliance can do this. All that’s required is a plan—which author Eric Thompson provides in this book. What You Will Learn Know what threat intelligence is and how you can make it useful Understand how effective vulnerability management extends beyond the risk scores provided by vendors Develop continuous monitoring on a budget Ensure that incident response is appropriate Help healthcare organizations comply with HIPAA Who This Book Is For Cybersecurity, privacy, and compliance professionals working for organizations responsible for creating, maintaining, storing, and protecting patient information.

Each year, more than 33 million Americans receive health care for mental or substance-use conditions, or both. Together, mental and substance-use illnesses are the leading cause of death and disability for women, the highest for men ages 15-44, and the second highest for all men. Effective treatments exist, but services are frequently fragmented and, as with general health care, there are barriers that prevent many from receiving these treatments as designed or at all. The consequences of this are seriousâ€"for these individuals and their families; their employers and the workforce; for the nation's economy; as well as the education, welfare, and justice systems. Improving the Quality of Health Care for Mental and Substance-Use Conditions examines the distinctive characteristics of health care for mental and substance-use conditions, including payment, benefit coverage, and regulatory issues, as well as health care organization and delivery issues. This new volume in the Quality Chasm series puts forth an agenda for improving the quality of this care based on this analysis. Patients and their families, primary health care providers, specialty mental health and substance-use treatment providers, health care organizations, health plans, purchasers of group health care, and all involved in health care for mental and substanceâ€"use conditions will benefit from this guide to achieving better care.

Offering compelling practical and legal reasons why de-identification should be one of the main approaches to protecting patients' privacy, the Guide to the De-Identification of Personal Health Information outlines a proven, risk-based methodology for the de-identification of sensitive health information. It situates and contextualizes this risk-ba

Informed consent - the process of communication between a patient or research subject and a physician or researcher that results in the explicit agreement to undergo a specific medical intervention - is an ethical concept based on the principle that all patients and research subjects should understand and agree to the potential consequences of the clinical care they receive. Regulations that govern the attainment of informed consent for treatment and research are crucial to ensuring that medical care and research are conducted in an ethical manner and with the utmost respect for individual preferences and dignity. These regulations, however, often require - or are perceived to require - that informed consent documents and related materials contain language that is beyond the comprehension level of most patients and study participants. To explore what actions can be taken to help close the gap between what is required in the informed consent process and communicating it in a health-literate and meaningful manner to individuals, the Institute of Medicine's Roundtable on Health Literacy convened a one-day public workshop featuring presentations and discussions that examine the implications of health literacy for informed consent for both research involving human subjects and treatment of patients. Topics covered in this workshop included an overview of the ethical imperative to gain informed consent from patients and research participants, a review of the current state and best practices for informed consent in research and treatment, the connection between poor informed consent processes and minority underrepresentation in research, new approaches to informed consent that reflect principles of health literacy, and the future of informed consent in the treatment and research settings. Informed Consent and Health Literacy is the summary of the presentations and discussion of the workshop.