Privacy Rules Research Articles

Study on National Protected Health Information for Secondary Use and De-identification

Recently the interest in secondary use of medical information has emerged. But the domestic legislation or guidelines, such as being able to say that already specialize in healthcare information, can be seen a 'national medical privacy guidelines'. However the guidelines have suggested that only a violation of privacy laws in the medical information, it does not defined clearly with respect to protected health information(PHI) for secondary use. In this paper, we learn the HIPAA(Health Insurance Portability and Accountability Act) Privacy Rule of the US legislation which provides a non-identifiable screen instructions for secondary utilization of medical information, domestic guidelines and other country's guidelines. comparing with the HIPAA, national medical privacy guidelines and the domestic studies, we propose a new domestic target non-identifying information suitable for the domestic field and present future research direction.

Mental Illness and Firearms Background Checks-Combatting Violence Without Inhibiting Care.

The history of American firearms legislation is one of tragedy and response. The Gun Control Act of 1968, prohibiting certain categories of individuals from possessing or purchasing firearms, was prompted by political violence. The Brady Handgun Violence Prevention Act of 1993, requiring background checks on prospective buyers via the National Instant Criminal Background Check System (NICS), memorialized an attempted presidential assassination. The NICS Improvement Amendments Act of 2007, designed to strengthen the background check system, followed the mass shooting at Virginia Tech University. The latest initiatives aimed at curbing gun violence were announced by President Barack Obama on the heels of the tragic events in Newtown, Connecticut. Among the President’s 23 executive actions was a directive to “address unnecessary legal barriers” that prevent reporting “on people prohibited from gun ownership for mental health reasons.” In response, the US Department of Health and Human Services (HHS) recently published a final regulation that amends the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule to enable disclosures to the federal background check system under specified circumstances. This Viewpoint analyzes the new rule, explores the nexus between mental health records and firearms background checks, and examines implications for psychiatrists. Federal law prohibits 9 categories of persons from shipping, transporting, possessing, or receiving firearms or ammunition. One such category applies to individuals who (in now-antiquated terminology) have been either “adjudicated as a mental defective” or “committed to a mental institution.” Such adjudications and commitments involve action “by a court, board, commission, or other lawful authority.” While there is some judicial disagreement as to how much due process is required before the federal mental health prohibitor can be invoked, there is widespread consensus that “a mental health diagnosis does not, in itself,” trigger the prohibitor. Moreover, in most cases the treating psychiatrist is not the legal authority responsible for placing an individual in a prohibited class. This distinction between treatment and adjudication is a cornerstone of both the physician-patient relationship and the due process rights of mentally ill individuals. THE BACKGROUND CHECK SYSTEM The NICS was activated in 1998 to help enforce the firearms prohibitions under federal and state law by creating a mechanism to determine the eligibility of a prospective gun buyer at the point of sale. Licensed sellers are required to contact the NICS to relay identifying information about the customer. The Federal Bureau of Investigation checks the information against 3 databases to see if there is a record match and advises whether the sale may proceed. Federal agencies are required to report prohibited persons to the NICS, whereas states are incentivized via grants. The US Supreme Court has held that states may not be compelled to participate. The efficacy of the NICS is predicated on the currency and completeness of available data. In 2012,investigators examined the extent to which states had made mental health prohibiting information available to the NICS and found overall progress to be limited and uneven. Specifically, officials from half of the states studied cited privacy laws as an obstacle. The perception that HIPAA in particular created an impediment to NICS reporting formed the backdrop for the latest regulatory action.... Language: en

Can I Communicate With My Adult Patient’s Caregiver?

Back to table of contents Previous article Next article Legal NewsFull AccessCan I Communicate With My Adult Patient’s Caregiver?Moira Wertheimer,J.D., R.N.Moira Wertheimer,Search for more papers by this authorJ.D., R.N.Published Online:24 Jun 2016https://doi.org/10.1176/appi.pn.2016.6b12AbstractCaregivers (who many times are family/friends/guardians) of adult individuals with mental illness can play a vital role in the patient’s psychiatric treatment, often providing important background information that may not be gleaned from an in-office visit, such as information related to patient compliance and troubling behavior patterns, as well as providing physical care and support for the patient. A recent study, however, indicated that a large percentage of these caregivers felt excluded from the patient’s care because health care providers refused to discuss the patient’s condition with them due to concerns about violating federal/state privacy laws.Generally, under the Health Insurance Portability and Accountability Act (HIPAA) and state privacy laws, although providers can always receive information about their patients, they cannot disclose patient information without patient consent, particularly mental health/substance use information. Under certain circumstances, however, the HIPAA privacy rule recognizes the integral role that family and friends play in a patient’s health care, and allows routine—and often critical—communications between health care providers and some third parties. While there are no easy answers, the Department of Health and Human Services addresses these situations and answers the following questions in detail about HIPAA and mental health on its website at http://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/.Does HIPAA allow a health care provider to communicate with a patient’s family, friends, or other persons who are involved in the patient’s care?Is a health care provider permitted to discuss an adult patient’s mental health information with the patient’s parents or other family members?When does mental illness or another mental condition constitute incapacity under the privacy rule? For example, what if a patient who is experiencing temporary psychosis or is intoxicated does not have the capacity to agree or object to a health care provider’s sharing information with a family member, but the provider believes the disclosure is in the patient’s best interests?If a health care provider knows that a patient with a serious mental illness has stopped taking a prescribed medication, can the provider tell the patient’s family members?What options do family members of an adult patient with mental illness have if they are concerned about the patient’s mental health and the patient refuses to agree to let a health care provider share information with the family?Remember that state privacy laws apply and often require more stringent protections than HIPAA; thus, it is important for you to be aware of all applicable laws. Please note also that “psychotherapy notes” as defined and maintained under HIPAA receive a heightened level of protection from disclosure and may not be disclosed without patient authorization.Before disclosing patient information to an adult patient’s caregiver, psychiatrists should keep in mind the following risk management considerations: Know your state’s laws regarding patient privacy in addition to HIPAA. Understand your state’s duty to warn laws.Seek the assistance of an attorney in the state in which you practice to develop policies and guidelines for sharing and/or releasing patient information to third parties. Inform patients at the outset of your policy on communicating with others and under what circumstances that would occur. Obtain necessary consents, if possible, at the outset of treatment.Lawful communication with an adult patient’s caregivers can often help psychiatrists deliver quality care and is not necessarily prohibited by federal and state privacy laws. Psychiatrists should understand their obligations under applicable privacy laws and should consult their local attorney or risk management professional before disclosing information without the patient’s or legal guardian’s consent. For other risk management topics, please see the online risk management courses available on APA’s Learning Center risk management page. ■This information is provided as a risk management resource and should not be construed as legal, technical, or clinical advice. This information may refer to specific local regulatory or legal issues that may not be relevant to you. Consult your professional advisors or legal counsel for guidance on issues specific to you. This material may not be reproduced or distributed without the express, written permission of Allied World Assurance Company Holdings, AG (“Allied World”). Risk management services are provided by or arranged through AWAC Services Company, a member company of Allied World.Moira Wertheimer, J.D., R.N., is assistant vice president of the Psychiatric Risk Management Group of AWAC Services Company, a member company of Allied World. ISSUES NewArchived

Honoring Dental Patients’ Privacy Rule Right of Access in the Context of Electronic Health Records

A person's right to access his or her protected health information is a core feature of the U.S. Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. If the information is stored electronically, covered entities must be able to provide patients with some type of machine-readable, electronic copy of their data. The aim of this study was to understand how academic dental institutions execute the Privacy Rule's right of access in the context of electronic health records (EHRs). A validated electronic survey was distributed to the clinical deans of 62 U.S. dental schools during a two-month period in 2014. The response rate to the survey was 53.2% (N=33). However, three surveys were partially completed, and of the 30 completed surveys, the 24 respondents who reported using axiUm as the EHR at their dental school clinic were the ones on which the results were based (38.7% of total schools at the time). Of the responses analyzed, 86% agreed that clinical modules should be considered part of a patient's dental record, and all agreed that student teaching-related modules should not. Great variability existed among these clinical deans as to whether administrative and financial modules should be considered part of a patient record. When patients request their records, close to 50% of responding schools provide the information exclusively on paper. This study found variation among dental schools in their implementation of the Privacy Rule right of access, and although all the respondents had adopted EHRs, a large number return records in paper format.

Window-conflicts in the Ottoman Empire and Turkey: visual privacy, materiality and right to the city

ABSTRACTThis article focuses on the visual privacy rights as practised in the urban settings in the late Ottoman Empire (1850–70) and in contemporary Turkey (1980–2010). The analysis draws on the detailed examination of the legal conflicts on the overlooking windows between neighbouring houses in both periods. A hundred legal cases from the Ottoman context and 35 parallel cases from the last decades in Turkey were covered to understand the everyday practices of visual privacy and to compare them with the official privacy rules in the Ottoman and Republican contexts. First, the cases suggest that even today many citizens, including some lower court judges, confidently defend the urban right to be unseen from the neighbour's window despite the contrary decisions of the Supreme Court. Second, the in-depth analysis of the window-conflicts showed that the radical separation of the material world from the human world in both Islamic law and the Republican Civil Law was challenged by popular claims to visual privacy thanks to their exclusive focus on windows. It is argued that popular privacy rights were not about individual private space but about the urban built environment. Hence, windows were targets of the claims of the right to the city.

Grief Communication and Privacy Rules: Examining the Communication of Individuals Bereaved by the Death of a Family Member

ABSTRACTCommunication about one’s grief is both essential and complicated. We employ communication privacy management theory to examine how bereaved individuals manage the revelation and concealment of private information about the death of a parent or sibling. In-depth interviews (N = 21) with the bereaved indicate that (a) they conceptualize information surrounding the death and their grief as private, (b) they create rules to govern their private information, and (c) violations of those rules result in turbulence. Specifically, individuals employ selectivity, avoidance, and positivity rules that dictate what and with whom they share. We discuss the implications of our findings on grief communication scholarship, CPM theory, and practical issues for helping bereaved individuals and their loved ones navigate discussions about death and the deceased.

Group privacy management strategies and challenges in Facebook: A focus group study among Flemish youth organizations

A large body of research has studied young people’s privacy practices and needs in Facebook. Less is known about group privacy. In this study 12 focus groups were organized with a total of 78 adolescents and young adults of local Flemish youth organizations to discuss their privacy practices. Findings describe how different strategies are used to coordinate the group information flow. The study also shows how online group privacy management can be challenging because ‘implicit’ privacy rules need to be made ‘explicit’, personal boundaries may conflict with those of the group one belongs to and privacy turbulence is difficult to define.

Feds Launch Phase 2 of HIPAA Audits

The federal government has launched the second phase of its HIPAA Audit Program and will soon be identifying health providers it plans to target. For the 2016 Phase 2 HIPAA Audit Program, auditors will review policies and procedures enacted by covered entities and their business associates to meet selected standards of the Privacy, Security, and Breach Notification Rules, according to a recent announcement by the Department of Health & Human Services Office for Civil Rights (OCR). Physicians and other covered entities can expect an email at some point this year requesting that updated contact information be provided to the OCR. The office will then send health providers a pre-audit questionnaire to gather data about the practice’s size, type, and operations, according to the announcement. The government will use the data as well as other information to create audit subject pools. If an entity does not respond to the OCR’s contact request or the pre-audit questionnaire, the agency will use publicly available information about the practice. Every covered entity and business associate is eligible for an audit, the OCR noted. For Phase 2, the government plans to identify health providers and business associates that represent a wide range of health care providers, health plans, health care clearinghouses, and business associates to access HIPAA compliance across the industry. Sampling criteria for auditee selection will include size of the entity, affiliation with other health care organizations, whether an organization is public or private, geographic factors, and present enforcement activity with OCR. Entities with open complaints or that are currently undergoing investigations will not be chosen. The first set of audits will be desk audits of covered entities followed by a second round of desk audits of business associates, OCR stated. OCR plans to complete all desk audits by December 2016. A third set of audits will be onsite and will examine a broader scope of requirements under the HIPAA rules. Some desk auditees may be subject to a subsequent on-site audit, the government noted. A list of frequently asked questions about the 2016 Phase 2 HIPAA Audit Program can be found on the OCR’s website (www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html). Phase 2 of the HIPAA audits follows a pilot program launched in 2011 and 2012 by OCR that assessed HIPAA controls and processes implemented by 115 covered entities. Phase 2 will draw on the results and experiences learned from the pilot program, according to OCR. Alicia Gallegos is a Frontline Medical News freelance writer based in Chicago.

Propelling the Profession with Outcomes and Evidence: Building a Robust Research Agenda at the Academy

Though the origins of evidence-based medicine are generally acknowledged as dating back to Dr Ernest Codman’s development of the first bone registry in 1920, outcomes studies took decades to radiate to other health disciplines, as practitioners grappled with the difficulties of implementing protocols and gathering meaningful data. 1 McGinnis L.S. Common origins: The two ACSs—100 years of collaboration to improve the lives of cancer patients. Bull Am Coll Surg. 2012; 97: 6-15 PubMed Google Scholar Today, research represents the backbone in dietetics and across health care disciplines, as the need to discover and verify causations and develop new therapies to improve public health and care delivery via clinical and scientific inquiry represents a priority role of the highest order. 2 Manore M.M. Myers E.F. Research and the dietetics profession: Making a bigger impact. J Am Diet Assoc. 2003; 103: 108-112 Abstract Full Text Full Text PDF PubMed Scopus (25) Google Scholar , 3 Nass SJ, Levit LA, Gostin LO, eds. The value, importance, and oversight of health research. In: Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, DC: The National Academies Press; 2009. National Center for Biotechnology Information website. http://www.ncbi.nlm.nih.gov/books/NBK9571/. Accessed October 8, 2014. Google Scholar , 4 King C. Byham-Gray L. O’Sullivan-Maillet J. et al. Dietitians and research: Facilitating involvement—History of dietitian involvement in dietetics research in the U.S. Top Clin Nutr. 2014; 29: 227-238 Crossref Scopus (11) Google Scholar Since the Academy of Nutrition and Dietetics ∗ Until January 2012, the Academy of Nutrition and Dietetics was known was the American Dietetic Association; throughout this document, it will be called “the Academy.” ∗Until January 2012, the Academy of Nutrition and Dietetics was known was the American Dietetic Association; throughout this document, it will be called “the Academy.” was founded, its leaders intended that the profession be rooted in science. In its role as “research advocate, facilitator, convener, funder, educator, and disseminator,” 4 King C. Byham-Gray L. O’Sullivan-Maillet J. et al. Dietitians and research: Facilitating involvement—History of dietitian involvement in dietetics research in the U.S. Top Clin Nutr. 2014; 29: 227-238 Crossref Scopus (11) Google Scholar the Academy has demonstrated a longstanding investment in identifying the impact of nutrition on disease risk factors and treatment outcomes, presenting it to stakeholders to influence public policy, and translating it to practice to yield many more programs and opportunities for nutrition and dietetics practitioners.

Biomedical research: Privacy rules.

Biomedical research: Privacy rules.

English

8 ORIGINAL PROF-3279 ABSTRACT… Introduction: National Health Information Exchange (NHIX) Systems are rapidly evolving. Due to the cyber infrastructure and improvements in communication technology, it is possible to share healthcare related data within a geographic region electronically among healthcare related autonomous entities such as physicians, hospitals, test laboratories, insurers, emerging Health Information Organizations (HIO), and even government departments. Study Design: Whether data are collected with the RCT, Quasi-experimentation or Triangulation etc., we present to explore a NHIX system for EHR that has also been implemented as a test case. We particularly propose to demonstrate a concept application, Medical Drop Box (MDB) with the key technological components of a future NHIX System for medical industry. Setting: Data from different medical settings have been used for testing the new system but the technological development has been done at IIU, Islamabad. Period: The proposed system is not time bond in terms of data collection. Basically the proposed system can handle data collected in any chunk of time in the history and can provide information as and when needed in future. Material & Methods: With MDB, a person is able to collect his/her health data and share it with the whole medical industry according to his/her own preferences and setting. Besides the technology for handing numerous forms of health care data, the main challenge of NHIX system is to allow individuals and associated medical entities to manage and share their medical information based on personal control and preferences given to each by medical laws, information rights and privacy rules. The main focus in this research paper is to make a standard medical application for the medical data that is in exchangeable format according to the standards defined in HL7. Results: The new system is able to make standardized Clinical document for medical data in exchangeable format according to HL7 standard. The MDB is the first step to setup NHIX system. With the help of MDB Statistical Analyzer now the health industry of the country can perform a variety of analysis for the future improvements in different health settings. Conclusions: The availability of medical data of patients on MDB cloud has improved Clinical Impact, created new Business & Services opportunities and reduced the overall Treatment Cost.

Governance Through Privacy, Fairness, and Respect for Individuals.

Introduction:Individuals have a moral claim to be involved in the governance of their personal data. Individuals’ rights include privacy, autonomy, and the ability to choose for themselves how they want to manage risk, consistent with their own personal values and life situations. The Fair Information Practices principles (FIPPs) offer a framework for governance. Privacy-enhancing technology that complies with applicable law and FIPPs offers a dynamic governance tool for enabling the fair and open use of individual’s personal data.Perceptions of Risk:Any governance model must protect against the risks posed by data misuse. Individual perceptions of risks are a subjective function involving individuals’ values toward self, family, and society, their perceptions of trust, and their cognitive decision-making skills.The HIPAA Privacy Rule Puts Some Governance in the Hands of Individuals:Individual privacy protections and individuals’ right to choose are codified in the HIPAA Privacy Rule, which attempts to strike a balance between the dual goals of information flow and privacy protection. The choices most commonly given individuals regarding the use of their health information are binary (“yes” or “no”) and immutable. Recent federal recommendations and law recognize the need for granular, dynamic choices.Building a Governance Framework Based in Trust: Avoiding Surprises:Individuals expect that they will govern the use of their own health and genomic data. Failure to build and maintain individuals’ trust increases the likelihood that they will refuse to grant permission to access or use their data. The “no surprises principle” asserts that an individual’s personal information should never be collected, used, transmitted, or disclosed in a way that would surprise the individual were she to learn about it.Fair Information Practices Principles:The FIPPs provide a powerful framework for enabling data sharing and use, while maintaining trust. We introduce the eight FIPPs adopted by the Department of Health and Human Services, and provide examples of their interpretation and implementation.Reducing Risk through Consumer Engagement:Privacy risk and health risk can be reduced by giving consumers control, autonomy, and transparency, and by engaging them in managing their own health. Explicit “consent” may not always be necessary – the FIPPs offer multiple ways to engender trust and avoid surprises.

Preserving temporal relations in clinical data while maintaining privacy.

Maintaining patient privacy is a challenge in large-scale observational research. To assist in reducing the risk of identifying study subjects through publicly available data, we introduce a method for obscuring date information for clinical events and patient characteristics. The method, which we call Shift and Truncate (SANT), obscures date information to any desired granularity. Shift and Truncate first assigns each patient a random shift value, such that all dates in that patient's record are shifted by that amount. Data are then truncated from the beginning and end of the data set. The data set can be proven to not disclose temporal information finer than the chosen granularity. Unlike previous strategies such as a simple shift, it remains robust to frequent - even daily - updates and robust to inferring dates at the beginning and end of date-shifted data sets. Time-of-day may be retained or obscured, depending on the goal and anticipated knowledge of the data recipient. The method can be useful as a scientific approach for reducing re-identification risk under the Privacy Rule of the Health Insurance Portability and Accountability Act and may contribute to qualification for the Safe Harbor implementation.

La tele-E-Health in carcere. Collaborazione e innovazione

The future of drug treatment services in today’s digital society (web society) depends, among other things, on the interoperability between health care information systems and other information systems linked to social control agencies, police forces and the judiciary. Agreements and partnerships between such different institutional actors should be strengthened, with regard to both old addictions (to psychoactive substances), and ones (regarding Internet, gambling, and so on). Possible areas of interoperability and related problems should be analyzed. We focus on four points: a) the impact models and tools of tele-e-Health in prison; b) the intertwining between e-government and new digital privacy rules with regard to addictions; c) the operational networks of inter-institutional cooperation (e.g. the recovery paths for addicted subjects reported to the judiciary); d) a federal model of tele-cooperation in prison as example of interoperability between institutions.

Tele-e-Health in prison. Innovation and collaboration

The future of drug treatment services in today’s digital society (web society) depends, among other things, on the interoperability between health care information systems and other information systems linked to social control agencies, police forces and the judiciary. Agreements and partnerships between such different institutional actors should be strengthened, with regard to both old addictions (to psychoactive substances), and ones (regarding Internet, gambling, and so on). Possible areas of interoperability and related problems should be analyzed. We focus on four points: a) the impact models and tools of tele-e-Health in prison; b) the intertwining between e-government and new digital privacy rules with regard to addictions; c) the operational networks of inter-institutional cooperation (e.g. the recovery paths for addicted subjects reported to the judiciary); d) a federal model of tele-cooperation in prison as example of interoperability between institutions.

A Framework for Extracting and Modeling Hipaa Privacy Rules for Healthcare Applications

Some organizations use software applications to manage their customers' personal, medical, or financial information. In the United States, those software applications are obligated to preserve users' privacy and to comply with the United States federal privacy laws and regulations. To formally guarantee compliance with those regulations, it is essential to extract and model the privacy rules from the text of the law using a formal framework. In this work we propose a goal-oriented framework for modeling and extracting the privacy requirements from regulatory text using natural language processing techniques.

(Re)Negotiating Our Relationship: How Contradictions Emerge in Sibling Privacy Boundaries

ABSTRACTSibling relationships go through a period of change when one or both of the siblings becomes an emerging adult and moves out of the family home. Through a communication privacy management lens, we can begin to understand how communication during this transition period is (re)negotiated and used to deidentify from the family while still maintaining a sense of connection with the family unit. Sibling communication during this life stage provides greater understanding for how siblings are choosing to communicate once the relationship has become more voluntary in nature. Through an interpretive analysis, several patterns related to how siblings negotiate privacy rules emerged. The themes we identified—rules, co-ownership, and permeable boundaries—all represented ways in which siblings communicated privacy negotiation as being contradictory. These contradictions provide a foundation for more closely examining how siblings are using privacy management and communicating in ways that highlight the extent to which they connect privacy management to closeness in the sibling relationship.

Organizational Violations of Externally Governed Privacy and Security Rules: Explaining and Predicting Selective Violations under Conditions of Strain and Excess

Privacy and security concerns are pervasive because of the ease of access to information. Recurrent negative cases in the popular press attest to the failure of current privacy regulations to keep consumer and protected health information sufficiently secure in today’s climate of increased IT use. One reason for such failure is that organizations violate these regulations for multiple reasons. To address this issue, we propose a theoretical model to explain the likelihood that organizations will select an externally governed privacy or security rule for violation in response to organizational strain or slack resources. Our proposed theoretical model, the selective organizational information privacy and security violations model (SOIPSVM), explains how organizational structures and processes, along with characteristics of regulatory rules, alter perceptions of risk when an organization’s performance does not match its aspiration levels and thereby affects the likelihood of rule violations. Importantly, SOIPSVM is contextualized to organizational privacy and security violations. SOIPSVM builds on and extends the selective organizational rule violations model (SORVM), which posits that organizational rule violations are selective. SOIPSVM provides at least four contributions to the privacy and security literature that can further guide empirical research and practice. First, SOIPSVM introduces the concept of selectivity in rule violations to privacy and security research. This concept can improve privacy and security research by showing that organizational violations of privacy and security rules are dynamic and selective yet influenced by external forces. Second, SOIPSVM extends the boundaries of SORVM, which is limited to explaining the behavior of organizations under strain, such as economic hardship. We contribute to the theory of selective deviance by proposing that selectivity extends to organizations with slack resources. Third, we address ideas of non-economic risk and strain in addition to economic risk and strain. SOIPSVM thus explains organizational rule-violating behavior as an attempt to protect core organizational values from external entities that pressure organizations to change their values to comply with rules. Fourth, we broaden the theoretical scope of two important constructs, namely structural secrecy and procedural emphasis to improve the explanatory power of the model. Fifth, we identify important elements of rule enforcement by drawing from the tenets of general deterrence theory. We also discuss how constructs from general deterrence theory can be studied at the organizational level. To conclude, we offer recommendations for the structuring of organizations and external regulations to decrease organizational rule violations, which often lead to the abuse of consumer information.

2013 HIPAA Changes Provide Opportunities and Challenges for Researchers: Perspectives from a Cancer Center

In 2013, the U.S. Department of Health and Human Services modified the Health Insurance Portability and Accountability Act Privacy Rule to "strengthen privacy and security protections" while "improving workability and effectiveness to increase flexibility for and decrease burden on regulated entities." In this article, we attempt to translate these generalized goals into the real-world implications of these changes. Under the new rules, researchers can obtain participants' permission to use their protected health information for more research activities with a single, upfront authorization (thereby reducing paperwork for participants, researchers, and institutional review boards) while providing potential participants with more information upon which to base their decisions about participation. The combined authorizations can be used in clinical trials and their optional substudies and in stand-alone biospecimen-banking research that includes authorization to permit future research use. We also suggest best practices for taking advantage of the flexibility offered by the new rules while maintaining strong privacy protections for human subjects.

A Healthcare Information System for Secure Delivery and Remote Management of Medical Records

With the rapid merger of healthcare business and information technology, more healthcare institutions and medical practices are sharing information. Since these records often contain patients’ sensitive personal information, Healthcare Information Systems (HISs) should be properly designed to manage these records in a secure manner. We propose a novel security design for the HIS complying with the security and privacy rules. The proposed system defines protocols to ensure secure delivery of medical records over insecure public networks and reliable management of medical record in the remote server without incurring excessive costs to implement services for security. We demonstrate the practicality of the proposed system through a security analysis and performance evaluation. key words: Healthcare Information System (HIS), privacy, Elliptic Curve Cryptography (ECC), Protected Health Information (PHI)