Data Segmentation for Privacy (DS4P)

Transcription

1 Data Segmentation for Privacy (DS4P) Where It s Been and Where It s Going Jeremy Maxwell, PhD Office of the Chief Privacy Officer Office of the National Coordinator for Health IT US Department of Health and Human Services

2 Defining Terms In Data Segmentation for Privacy the concept, different information needs different levels of privacy protections (e.g., flu shot vs. HIV test). These protections are often expressed in laws Data Segmentation for Privacy (DS4P) the standard is a technical standard that specifies how to tag clinical data with privacy metadata to express confidentiality levels and downstream obligations 2

3 Agenda Why is data segmentation (the concept) important? Background on the Data Segmentation for Privacy (DS4P) standard DS4P in the 2015 Edition Certification Rule Current & future work 3

4 Why is Data Segmentation (the concept) Important? All health information used by healthcare providers afforded baseline level of privacy protection Some data is more sensitive than others» Flu shot vs. HIV test Laws provide additional protection for categories of sensitive health information» Behavioral health, HIV, reproductive health, minor confidentiality, victim confidentiality, rehab treatment» Sensitive health information is shorthand for data that receives this additional protection 4

5 Why is Data Segmentation (the concept) Important? 1 in 5 Americans suffer from serious mental illness [SAMHSA] In the past year, 20.2 million adults had a substance abuse disorder [SAMHSA]» 7.9 million people had both Serious repercussions when individuals do not receive treatment» 8% of individuals have withheld information from HCP due to privacy or security concerns [ONC]» In the worst case 41,000 suicide deaths per year 5

6 Individuals Want Electronic Exchange Despite Privacy & Security Concerns Source: Individuals Perceptions of the Privacy and Security of Medical Records and the Sharing of Medical Records between Health Care Providers. 6

7 Data Segmentation Goals Three goals: Interoperability Patient Safety Patient privacy These goals are not mutually exclusive! 7

8 Agenda Why is data segmentation (the concept) important? Background on the Data Segmentation for Privacy (DS4P) standard DS4P in the 2015 Edition Certification Rule Current & future work 8

9 The Data Segmentation for Privacy (DS4P) Initiative Began in 2011, initial pilots focused on use cases for 42 CFR Part 2 Six pilots, work resulted in an implementation guide (IG) Balloted as an HL7 normative standard 9

10 DS4P Standards: What can DS4P do? Data Segmentation for Privacy (DS4P) is a technical standard that specifies how to tag clinical data with privacy metadata to express confidentiality levels and downstream obligations Segmentation can occur at the document or field level The DS4P standard did not create new privacy requirements or grant new segmentation rights 10

11 Agenda Why is data segmentation (the concept) important? Background on the Data Segmentation for Privacy (DS4P) standard DS4P in the 2015 Edition Certification Rule Current & future work 11

12 2015 Edition Proposed Rule Released in March 2015, included a criteria for document-level DS4P Send and DS4P Receive Summary of public comments» Provider organizations/associations commenters generally split on DS4P» Vendor commenters generally voiced concerns with DS4P proposal» Consumer / patient advocate organizations generally supportive of DS4P proposal Commenters voiced concerns focused on policy-level concerns» E.g., Swiss cheese problem, visualization of segmented information 12

13 2015 Edition Final Rule ONC adopted DS4P Send and Receive criteria in the final rule released Oct From the preamble:» DS4P enables interoperable exchange of health data subject to privacy restrictions» DS4P itself does not create incomplete records, instead, DS4P allows for tagging and exchange of health information that has already been determined to be sensitive and in need of special protections» Providers should already have workflows and procedures to handle privacy laws» In the absence of DS4P, this specially protected data may still be exchanged, if consent is given for disclosure, by fax or mail, but these methods may make the data unavailable in electronic form in the receiving provider s EHR. Optional in that not required for certification for Stage 3 EHR Incentives 13

14 2015 Edition Certification Rule Text (b)(7) Data segmentation for privacy send. Enable a user to create a summary record formatted in accordance with the standard adopted in (a)(4) that is document-level tagged as restricted and subject to restrictions on re-disclosure according to the standard adopted in (o)(1) (b)(8) Data segmentation for privacy receive. Enable a user to: (i) Receive a summary record that is formatted in accordance with the standard adopted in (a)(4) that is document-level tagged as restricted and subject to restrictions on redisclosure according to the standard adopted in (o)(1); (ii) Sequester the document-level tagged document from other documents received; and (iii) View the restricted document without incorporating any of the data from the document. 14

15 Policy Challenges Laws tell data-holders not to disclose; law rarely tells them what to say about that non-disclosure. For example: HIV Status: **Redacted** This is a likely indicator that the patient has a test result if the applicable law protects results of tests, not occurrences, this may indicate a positive result; or HIV Status: **No data available** This is may be misleading for a physician, who may then make a health decision for the patient without knowing important details that could lead to safety issues. HIV Status: [record is silent] This is ambiguous. The recipient does not know if there was a redaction, or no data is available. 15

16 Data Segmentation: Things to Solve How to Segment: There are multiple levels at which segmentation could occur, such as:» Type of Data category of data - e.g. medications, diagnostic codes, etc.» Clinical category of code of whatever type» Disclosing provider» Intended recipient» Facility type (e.g. Part 2 clinic) Structured vs unstructured Data: Prevalence of free-text complicates identification of data that is subject to enhanced protection. 16

17 Data Segmentation: Things to Solve Granularity: Should data be segmented:» At the whole document level?» For parts of a document?» According to clinical nature within the document? Standardized mapping of specially protected categories to codes would make segmentation more predictable:» For individuals through standard understanding» For providers through standard expectations» For developers, with less confusion about what law requires 17

18 Agenda Why is data segmentation (the concept) important? Background on the Data Segmentation for Privacy (DS4P) standard DS4P in the 2015 Edition Certification Rule Current & future work 18

19 What is Computable Privacy? To achieve health, an individual s electronic health information needs to be digitally connected to his/her sharing choices. Health care providers, health plans, and researchers health IT systems need to know what to do when an individual does not document a choice. Telemedicine, community health supports, and other innovative delivery processes will be stunted if the health care industry cannot make privacy computable. 19

20 Explain HIPAA Better HIPAA Permitted Uses & Disclosures» HIPAA is media agnostic and has supported health information exchange through permitted uses and disclosures for which an individual s authorization is not required for the past 17 years.» ONC/OCR Fact Sheets Illustrating permitted sharing for : Treatment (Care planning & Referral) Health Care Operations of Payor Case Management Multi-provider Quality Assessment/ Improvement Multi-provider reduction in hospital acquired infections HIPAA Right of Access» Gives patients the right to access their heath information electronically if stored electronically» Provides patients with the right to send information to a third party HIPAA Basics» See ONC Permitted Use Fact Sheets and Blog and OCR New Access Guidance

21 Basic Choice: Understanding & Documenting Individual s Choice to Share Basic Choice refers to the choice an individual makes about the use and disclosure of health information, including the electronic exchange of health information not subject to the heightened disclosure restrictions of federal or state laws. Granular Choice is the choice an individual makes regarding the distinctions between legally sensitive clinical conditions, such as mental health or HIV/AIDS status and evolves over time to enable choice about disclosure to specifically identified participants in the health care system. If offered, use standards Granular Choice Basic Choice Permitted Uses = Background Rules This is HIPAA 21

22 Basic Choice Observation Choosing to share to exchange or for research is the same process:» Compare Please let my data flow to other doctors/please do not let my data flow to other doctors to Please use my data in this research project/please do not use my data in this research project. Basic Choice, then, is a process, for which documentation and standards can be developed in an context-neutral way Which led OCPO to» Apply concept of Basic Choice to project underway in 2014 to develop privacy and technical policy framework research; and» Expand the scope of a project underway in 2014 on technical standards for research choice 22

23 Research Privacy & Security Policy Framework Phase I Recruit and engage Patient Centered Outcomes Research (PCOR) stakeholders, including researchers, patients, providers, health IT technologists, and legal experts that have experience relevant to PCOR data Develop research data use scenarios where consent choices have to be made, based on feedback from the PCOR research community including patients Produce a lessons learned report highlighting priority research scenarios, lessons learned, and next steps 23

24 Research Privacy & Security Policy Framework Phase II Identify and define data types Identify ethical principles as well as legal requirements related to the privacy and security of health information that may be accessed to support PCOR and CER» Includes genomic data and PMI use-case, as well as other use cases. Map privacy and security legal requirements to the potential flow of data for the use cases, identifying gaps where applicable Develop a legal framework for addresses privacy and security requirements at an organizational policy level as well as ethical principles Develop a Privacy and Security Conceptual Enterprise Architecture 24

25 Research Privacy & Security Policy Framework Timeline Phase 1 Public Kick-off Meeting Dec bi-weekly meetings Dec. 9 to Mar. 31, 2016 Submit draft research data use scenarios Feb. 2, 2016 Submit final research data use scenarios Mar. 31, 2016 Phase 2 Legal and ethical framework development Early 2016 to Sep

26 Patient Choice Technical Project aka: Standards Development for Patient Choice Basic Choice and Granular Choice for Treatment Payment and Operations and for Patient-Centered Outcomes Research What the project will accomplish:» Analysis of current research consent landscape» Analyze and develop technical standards for implementing and sharing individual consent for: Basic choice for TPO Basic choice for research Granular choice for TPO & research 26

27 Patient Technical Choice Project Goals Phase 1: Basic Choice for TPO and Research Consent Landscape Analysis Develop Basic Consent Use Cases and Functional Requirements which can be used to guide a Piloting process Conduct pilots which test the functional requirements and scenarios described in the Use Case Development Phase Develop a best practices implementation guide based on lessons learned from piloting efforts. Align work efforts with Standards Developing Organizations (SDO) when possible Develop implementation guidance in form of a standard or artifact Analyze current research consent landscape Phase 2: Basic Choice for Research Consent and Phase 3: Granular Choice Build upon artifacts and lessons learned from Phase 1 and repeat the process for Phases 2 & 3 27

28 Patient Technical Choice Project Timeline Overview Sep 15 Jan 16 Jul 16 Jan 17 Jul 17 Jan 18 Jul 18 Jan 19 Jul 19 Mar 20 Phase 1: Basic Choice Deliverable: Basic Choice for TPO Implementation Guide (IG) Research Consent Landscape Analysis Phase 2: Basic Choice for Research Consent Deliverable: Basic Choice for Research IG Phase 3: Granular Choice Deliverable: Granular Choice for Research IG 28

29 For More Information Patient Choice Technical Project» al+project+homepage P&S Research Scenario Initiative and Legal Analysis and Ethics Framework Development» Research+Scenario+Initiative+and+Legal+Analysis+and+Ethics+Framework+Dev elopment+home 29

30 30