Text Size:   A+ A- A   •   Text Only
Site Image

Health Information Security and Privacy
Health Information Technology
"We want to ensure that all of our citizens' health records are available to them and their healthcare provider anytime, anywhere they are needed, and that those health records are confidential and secure at all times."
 Governor Ted Kulongoski, March, 2006.
Oregon’s Health Information Security and Privacy Collaboration (2006-2009)
The Health Information Security and Privacy Collaboration (HISPC) was a national project to assess privacy and security laws and business practices with regard to the exchange of electronic health information that began in 2006 and ended July 2009. Oregon was one of the original 34 states and territories participating in this collaboration. 
The effort was managed by Research Triangle Institute International under a contract from the U.S. Department of Health and Human Services to work with the Office of the National Coordinator for Health Information Technology in partnership with the National Governors Association.  
The purpose of this project was to implement a national collaborative effort to address privacy and security policy questions affecting the electronic exchange of health information between hospitals, doctors’ offices, and others (interoperable health information exchange (HIE).  In Oregon, the Governor’s office designated the Office for Oregon Health Policy and Research (OHPR) to complete the project.
HISPC work was carried out in three phases.

HISPIC Phase 1 (June 2006-June 2007)
This initial phase focused on assessing relevant business practices and state laws, identifying solutions, and developing an implementation plan. The Oregon HISPC team included OHPR, the Oregon Health Care Quality Corporation (a multi-stakeholder, non-profit, representing the private sector), and other security and privacy experts. The team engaged a broad group of stakeholders to develop plans for an interoperable health information exchange that is private and secure. In addition to this planning work, Oregon conducted a Consumer Engagement Project and developed best practices around privacy and security. Oregon’s participation in this phase helped illuminate the issues surrounding HIT and guided the development of proposed solutions, while positioning Oregon for continued involvement in developing a national health information network.
Oregon’s HISPC Steering Committee (October 2006 – June 2007):  To oversee the Oregon HISPC project, Governor Ted Kulongoski appointed a HISPC Steering Committee with a breadth of expertise and a deep commitment to accomplishing the work of the project.  
The following reports detail the work of Oregon HISPC Phase I:
HISPC Phase 2 (July - December 2007)
This was a six-month project with 42 states and two territories participating. Each state was given the opportunity to implement a critical, state-specific solution identified during the Phase 1 assessment and findings, and to develop plans for multi-state collaboration in an anticipated HISPC Phase 3.
Based upon the Consumer Engagement Project conducted in Phase 1, Oregon produced a documentary on electronic health information exchange which would provide a foundation of knowledge to allow consumers to discuss the privacy and security issues raised by electronic data sharing. A full-length (15 minute) version and an executive summary (6 minutes) version are available for viewing on-line. The Project Summary and Impact Analysis report details the discussions and work completed during Phase 2. Oregon also produced a how-to guide for using the documentary as part of the Phase 3 Collaborative work.
Oregon’s documentary served as the basis for a number of other states’ documentary productions – proving that consumer education and engagement tools could be created to be not only useful in a specific state, but adaptable for use nationwide.  
HISPC Phase 3 (April 2008 - July 2009)
The Office of the National Coordinator for HIT selected 40 states and two territories to participate in seven content-specific Collaboratives and to execute the Collaborative strategies developed during Phase 2. The seven Collaboratives were:
  • Interstate Disclosure and Patient Consent Requirements
  • Consumer Education and Engagement
  • Consent Policy Options
  • Harmonizing State Privacy Law
  • Provider Education
  • Adoption of Standard Policies
  • Inter-organizational Agreements
Oregon participated in the Consumer Education and Engagement Collaborative.  Working with seven other HISPC states (Colorado, Georgia, Kansas, Massachusetts, New York, Washington and West Virginia), Oregon contributed to the development of an educational resource toolkit for general use by other states and organizations to educate and engage consumers about Heath Information Technology (HIT) and Health Information Exchange (HIE). 
Consumer Education and Engagement Toolkit:
HISPC Phase 3: Challenge Phase (April – July 2009): As a final project, Oregon, along with its Consumer Education and Engagement Collaborative partners, conducted presentations explaining the materials which were developed and the practical uses for these tools.  States were asked to participate in a four-month "HISPC Challenge Phase" in which consumer groups were asked to choose several Consumer Education and Engagement tools and adapt them for their constituencies. Oregon worked with American Cancer Society Cancer Action Network, OSPIRG and Health Care for All-Oregon during this phase.
Oregon also participated in the challenge phase through the dissemination of materials developed by the HISPC Provider Education Collaborative, working with The Oregon Medical Association, Accumentra and the Oregon Primary Care Association.  The provider education toolkit includes peer-to-peer video presentations, FAQs, a dashboard demonstration of what a provider would see with a typical electronic health record product, and other resources.  These resources provide an opportunity for physicians and other healthcare providers to learn more about electronic health information exchange and related privacy and security implications. See the Secure4Health.org website to access these resources.

Oregon's HIT Efforts beyond HISPC
Oregon will continue to make the privacy and security of Oregonian’s health information a priority, through the work of the Health Information Technology Oversight Council (HITOC) . The HITOC will coordinate Oregon's public and private statewide efforts in electronic health records adoption and the eventual development of a statewide system for electronic health information exchange. The HITOC takes over previous efforts of Oregon's HISPC and Health Information Infrastructure Advisory Committee.
The Health Information Infrastructure Advisory Committee (HIIAC) concluded its work in August 2009.  The HIIAC was established in May 2008 to make policy recommendations to: reduce barriers to health information exchange, while maintaining privacy and security of individuals’ health information; establish an appropriate role for the state in maintaining and building health information infrastructure; facilitate the adoption of infrastructure standards and interoperability requirements; facilitate collaboration between statewide partners; and develop evaluation metrics to measure the implementation of health information technology and the efficiency of health information exchange in Oregon. 
In Nov. 2008, the HIIAC produced a report to the Governor and the Oregon Health Fund Board exploring challenges in the current health care system, opportunities to transform the system through wider adoption and utilization of HIT, and providing recommendations to facilitate and accelerate this transformation.