Health Care Information Systems

Module 15 Health Information Security

The following objectives should be met by the end of this module:

• Describe an effective plan for implementing a Health Information Network (HIN)
• Discuss issues that affect planning of the HIN
• Discuss the history and the current state of the Internet
• Describe business strategies for HSOs using Internet and Intranet technology

These notes are intended only to supplement your readings. The best way to ensure each module is absorbed is to complete all the readings prior to reviewing these lecture notes. I will try to highlight what I believe to be the most important topics from your module readings. If you have any questions or concerns or there is something you do not understand, please ask me. You can either post on the webboard the question you have (that way others can benefit from the response), or you can e-mail me if you want a more private response. Either way it is extremely important that you have a complete and thorough understanding of the material for the module.

Health care systems today more than ever contain sensitive information.  It is the responsibility of all those involved with patient information to protect the confidentiality of information about patients, employees, finances, and organizational strategies.  Policies and procedures must be developed , implemented and updated to meet the demands of high security.

Laws have been passed at every level of government to protect medical information privacy, the most comprehensive of these  being the Health Insurance Portability and Accountability Act of  1996. (HIPPA)  HIPPA originally designed to improve efficiency in the health care system by establishing uniform national standards to be used for the electronic transmission of certain financial and administrative transactions has now widen it's mission to restriction of health care information to a minimum.  (See articles under readings on syllabus) 

In addition to patient privacy and confidentiality, organizations must have in place a comprehensive disaster protection and recovery plan.  Backing up data is essential in the event of systems  crashes, sabotage, or  other technical problems.

Employee education and training is another important issue with regard to security passwords and sharing, biometrics, encryption, and other authentication measures.