Text Size:   A+ A- A   •   Text Only
Find     
Site Image

Health Information Security and Privacy
Health Information Technology
"We want to ensure that all of our citizens' health records are available to them and their healthcare provider anytime, anywhere they are needed, and that those health records are confidential and secure at all times."
 
 Governor Ted Kulongoski, March, 2006.
 
Oregon’s Health Information Security and Privacy Collaboration (2006-2009)
 
The Health Information Security and Privacy Collaboration (HISPC) was a national project to assess privacy and security laws and business practices with regard to the exchange of electronic health information that began in 2006 and ended July 2009. Oregon was one of the original 34 states and territories participating in this collaboration. 
 
The effort was managed by Research Triangle Institute International under a contract from the U.S. Department of Health and Human Services to work with the Office of the National Coordinator for Health Information Technology in partnership with the National Governors Association.  
 
The purpose of this project was to implement a national collaborative effort to address privacy and security policy questions affecting the electronic exchange of health information between hospitals, doctors’ offices, and others (interoperable health information exchange (HIE).  In Oregon, the Governor’s office designated the Office for Oregon Health Policy and Research (OHPR) to complete the project.
 
HISPC work was carried out in three phases.

HISPIC Phase 1 (June 2006-June 2007)
This initial phase focused on assessing relevant business practices and state laws, identifying solutions, and developing an implementation plan. The Oregon HISPC team included OHPR, the Oregon Health Care Quality Corporation (a multi-stakeholder, non-profit, representing the private sector), and other security and privacy experts. The team engaged a broad group of stakeholders to develop plans for an interoperable health information exchange that is private and secure. In addition to this planning work, Oregon conducted a Consumer Engagement Project and developed best practices around privacy and security. Oregon’s participation in this phase helped illuminate the issues surrounding HIT and guided the development of proposed solutions, while positioning Oregon for continued involvement in developing a national health information network.
 
Oregon’s HISPC Steering Committee (October 2006 – June 2007):  To oversee the Oregon HISPC project, Governor Ted Kulongoski appointed a HISPC Steering Committee with a breadth of expertise and a deep commitment to accomplishing the work of the project.  
 
The following reports detail the work of Oregon HISPC Phase I:
 
HISPC Phase 2 (July - December 2007)
This was a six-month project with 42 states and two territories participating. Each state was given the opportunity to implement a critical, state-specific solution identified during the Phase 1 assessment and findings, and to develop plans for multi-state collaboration in an anticipated HISPC Phase 3.
 
Based upon the Consumer Engagement Project conducted in Phase 1, Oregon produced a documentary on electronic health information exchange which would provide a foundation of knowledge to allow consumers to discuss the privacy and security issues raised by electronic data sharing. A full-length (15 minute) version and an executive summary (6 minutes) version are available for viewing on-line. The Project Summary and Impact Analysis report details the discussions and work completed during Phase 2. Oregon also produced a how-to guide for using the documentary as part of the Phase 3 Collaborative work.
 
Oregon’s documentary served as the basis for a number of other states’ documentary productions – proving that consumer education and engagement tools could be created to be not only useful in a specific state, but adaptable for use nationwide.
 

HISPC Phase 3 (April 2008 - July 2009)
The Office of the National Coordinator for HIT selected 40 states and two territories to participate in seven content-specific Collaboratives and to execute the Collaborative strategies developed during Phase 2. The seven Collaboratives were:
  • Interstate Disclosure and Patient Consent Requirements
  • Consumer Education and Engagement
  • Consent Policy Options
  • Harmonizing State Privacy Law
  • Provider Education
  • Adoption of Standard Policies
  • Inter-organizational Agreements
 
Oregon participated in the Consumer Education and Engagement Collaborative.  Working with seven other HISPC states (Colorado, Georgia, Kansas, Massachusetts, New York, Washington and West Virginia), Oregon contributed to the development of an educational resource toolkit for general use by other states and organizations to educate and engage consumers about Heath Information Technology (HIT) and Health Information Exchange (HIE). 
 
Consumer Education and Engagement Toolkit:
These and many other products developed by member states of the Consumer Education and Engagement Collaborative are also available as downloads from the HHS HISPC Consumer Education website See http:/healthhit.hhs.gov/HISPC for products developed from all seven Collaboratives.
 
HISPC Phase 3: Challenge Phase (April – July 2009): As a final project, Oregon, along with its Consumer Education and Engagement Collaborative partners, conducted presentations explaining the materials which were developed and the practical uses for these tools.  States were asked to participate in a four-month "HISPC Challenge Phase" in which consumer groups were asked to choose several Consumer Education and Engagement tools and adapt them for their constituencies. Oregon worked with American Cancer Society Cancer Action Network, OSPIRG and Health Care for All-Oregon during this phase.
 
Oregon also participated in the challenge phase through the dissemination of materials developed by the HISPC Provider Education Collaborative, working with The Oregon Medical Association, Accumentra and the Oregon Primary Care Association.  The provider education toolkit includes peer-to-peer video presentations, FAQs, a dashboard demonstration of what a provider would see with a typical electronic health record product, and other resources.  These resources provide an opportunity for physicians and other healthcare providers to learn more about electronic health information exchange and related privacy and security implications. See the Secure4Health.org website to access these resources.

Oregon's HIT Efforts beyond HISPC
Oregon will continue to make the privacy and security of Oregonian’s health information a priority, through the work of the Health Information Technology Oversight Council (HITOC) . The HITOC will coordinate Oregon's public and private statewide efforts in electronic health records adoption and the eventual development of a statewide system for electronic health information exchange. The HITOC takes over previous efforts of Oregon's HISPC and Health Information Infrastructure Advisory Committee.
 
The Health Information Infrastructure Advisory Committee (HIIAC) concluded its work in August 2009.  The HIIAC was established in May 2008 to make policy recommendations to: reduce barriers to health information exchange, while maintaining privacy and security of individuals’ health information; establish an appropriate role for the state in maintaining and building health information infrastructure; facilitate the adoption of infrastructure standards and interoperability requirements; facilitate collaboration between statewide partners; and develop evaluation metrics to measure the implementation of health information technology and the efficiency of health information exchange in Oregon. 
 
In Nov. 2008, the HIIAC produced a report to the Governor and the Oregon Health Fund Board exploring challenges in the current health care system, opportunities to transform the system through wider adoption and utilization of HIT, and providing recommendations to facilitate and accelerate this transformation. 
 
HISPC Resources
 
This report serves as a guide to the use of all of the tools, materials, and processes developed as part of HISPC Phase III. The AIM is organized by multistate collaborative and is presented in a format that seeks to both educate and promote the use of this work.
 
The following five reports detail variations in state law, business practices and policy related to privacy and security and the electronic exchange of health information.  For quick reference, several reports contain aggregate findings tables in their appendices.  See: http://healthit.hhs.gov/HISPC for these links.
  • Report on State Medical Record Access Laws 
    This report analyzes state laws that are intended to require health care providers (specifically, medical doctors and hospitals) to afford individuals access to their own health information and to identify potential barriers to the electronic exchange of health information.  Specific state law provisions examined: scope of medical records to which patients are afforded access, format of information furnished, deadlines for responding to requests, fees for furnishing copies, record retention laws and access to records of minors.
  • Report on State Law Requirements for Patient Permission to Disclose Health Information
    In Phase I of the HISPC project a majority of participants reported significant variation in the business practices and policies surrounding the need for and process of obtaining patient permission to use and disclose personal health information for a variety of purposes, including for treatment. This report furthers the initial work of this project by collating and analyzing state laws that govern the disclosure of identifiable health information for treatment purposes to identify commonalities and differences.
  • Releasing Clinical Laboratory Test Results: Report on Survey of State Laws
    For this report, state statutes and regulations were analyzed to determine to whom clinical laboratories may release test results. This report focused on clinical laboratory and hospital licensing laws (that contain standards for hospital laboratories). It also examined general state medical record access laws to determine whether they provided an avenue for patients to access their clinical laboratory results directly.  
  • Report on State Prescribing Laws: Implications for e-Prescribing
    This report identifies and analyzes the impact and variation of state laws related to e-prescribing.  The report addresses state laws related to the e-prescribing of controlled and non-controlled substances as well as topics such as record keeping and content requirements, out-of-state prescriptions, and generic substitution laws.
  • Perspectives on Patient Matching: Approaches, Findings, and Challenges
    This report analyzes various approaches to matching patients to their health information in the context of electronic health information exchange.  Current and potential methods for matching patients to their health records are discussed, challenges to performing patient matching such as scalability and ease of use are analyzed, and the types of information some HIOs use to match patients to their health records is described.
 
Contact Us
For additional information on the HISPC project:
Jeanene Smith MD, MPH
Administrator
Office of Oregon Health Policy and Research
1225 Ferry St. SE, 1st Floor
Salem, OR  97301
503-373-1779
fax 503-378-5511
jeanene.smith@state.or.us