Health System Interoperability: A Case Study

Latour, Kathleen and Eichenwald-Maki, eds. (2009). HI300: Information Technology & Systems for Healthcare. Chicago: American Health Information Management Association

Health information management, also known as HIM, has been acknowledged as an allied health profession since 1928. HIM is a profession dedicated to the effective management of patient information and healthcare data needed to deliver quality treatment and care to the public. The original objective was to elevate the standards of clinical recordkeeping in hospitals, dispensaries, and other healthcare facilities (Sayles, 2014). Today HIM is known as the American Health Information Management Association or AHIMA. It still holds similar underlying purposes: to ensure the quality, confidentiality, and availability of health information across diverse organizations, settings, and disciplines (Sayles, 2014). HIM plays a critical role in the successful implementation of electronic health records and ensures that providers, healthcare organizations, and patients have access to the right health information when and where it is needed while maintaining the highest standards of data integrity, confidentiality, and security. It ensures compliance with legal mandates, but it has proven to be a challenge with the constant change in legislation and regulatory environment. Past surveys suggest that HIM plays some type of importance in accordance to HIPAA privacy and security compliance. In a 2006 AHIMA survey, members were asked about the progress of their organizations’ privacy and security compliance efforts. Margret Amatayakul & Mitch Work discuss those results in a 2007 journal article

Health information is a fundamental piece of data which represents a person, business, organization, or a community. This data is vital in monitoring and coordination of care for individuals and communities. It not only monitors and coordinates patient care, but reduces costly mistakes and prevent duplication of treatments as well as taking a pivotal role in preserving, securing, and protecting personal health information. Since, this information is extremely essential and sensitive, it must remain secure and safe to prevent frauds and cyber-attacks. First of all, this paper discusses vitality of the health information in regards to individuals, professionals, and organizations along with its benefits to improve overall quality of life. Secondly, it discusses the role of information technology in various aspects of the industry and the what the future holds within IT.

There is no doubt in that technology has multifaceted benefits but, at the same time, it has forced mankind to feel insecure. Every industry depends upon the data of the customers and the health industry is no more an exception here. The data of each patient is shared to facilitate health itself and for more rigorous and authentic research. Hence, protecting patient data is very important. It is so important that in 1996, the federal government introduced the Health Insurance

Under the HIPAA Security Rule, health care providers are required to conduct an accurate and thorough analysis of the potential risks and vulnerabilities. Protecting the confidentiality, integrity, availability, and privacy of data in health care is very important. For a risk analysis, health care providers would prioritize risks based on the severity of the impact that it would cause their patients and practices (Security Risk Analysis TipSheet, 2014). In addition, identifying the potential threats to patient privacy and security (Security Risk Analysis TipSheet, 2014). A risk analysis process would include determining the likelihood and impact of potential risk to electronic protected health information, implementing security measures to

One type of personal data we should be concerned with keeping secure is Protected Health Information or PHI. PHI is defined in the Privacy Rule section of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) as “"individually identifiable health information" held or transmitted by a covered entity or its business associate, in any form or media, whether electronic, paper, or oral” (U.S. Department of Health & Human Services). While HIPAA was enacted to address the protection of PHI, it falls short of this task because there are no measures to proactively ensure entities are abiding by its guidelines, the penalties are subjective and fail to inflict enough punishment on entities for data breaches and it puts the onus

Currently, the topic of interoperability is at the forefront of health data management. While lacking a standard definition of interoperability itself, the National Alliance for Health Information Technology defines it as “the ability of different information technology systems and software applications to communicate, to exchange data accurately, effectively, and consistently, and to use the information that has been exchanged.” Interoperability now stands at the center of health IT’s future, as the success of electronic health records (EHRs) relies upon the exchange of health information. In essence, health information is already interoperable, as providers can write down data on a

Securing larger volumes of data than before, health care providers must be able to adapt to new methods of data storage and access of patient records. Security breaches in health care organizations is lost or stolen from unencrypted devices and media where the provider is using to retrieve records. As more health providers continue to use mobile devices to access pertinent information from electronic medical records systems the chances for breach increases so dramatically. (Rogers,

As health professionals, it’s essential to take every precaution to protect sensitive patient information including personal contact information and medical history. Patient data is regulated by the government and provides privacy and security provisions for safeguarding medical information. The law that regulates these processes, the Health Insurance Portability and Accountability Act (HIPAA), has become a prominent point of public discussion over recent years due to an onslaught of security concerns and cyberattacks on health providers and insurers.

Data privacy is vital to healthcare organizations and the health information they store. Johns (YEAR) defines data security as “a collection of protection measures and practices that safeguard data, computers, and associated resources from undesired occurrences and exposures” (p. 207). To protect their information, organizations must develop a data security program to meet the needs of Health Information Portability Accountability Act (HIPAA), stakeholders, and the business’s needs. Additionally following the guidelines set by HIPAA is key to being in compliance with the law. These programs differ depending on the organizations that are required to establish them, however, they all follow the same steps in creating and implementing this program

According to U.S. Department of Health and Human Services (n.d.), the migration of healthcare providers to using electronic health records and the wide-spread use of computer and web based applications motivated the U.S. Department of Health and Human Services to develop regulations for protecting the privacy and security of Private health Information (PHI) of individuals. The advance in computing technology and easy storage options, led healthcare providers change their physician order entry, patient health records, pharmacy, laboratory systems, health insurance plans to fully computerized systems. While the change facilitates work efficiency and increased quality of service by ensuring greater mobility and easy access to information anywhere at any time, it adds potential security and privacy risks (Mercuri, 2004). HIPAA requires that every covered entity keep the privacy of individuals and implement acceptable form of security to protect the integrity, availability and confidentiality of private health information. According to U.S. Department of Health and Human Services (n.d.), the goal of the Security Rule is to safeguard the security of electronic private health information (ePHI) while giving more flexibility to covered entities such as healthcare providers, healthcare clearing houses and insurance companies in using new security technologies to better the quality of service and healthcare. The HIPAA Security Rule is updated on a regular basis

Health information technology (HIT) involves trading of health information in an electronic format to advance health care, reduce health expenditures, improve work efficiency, decrease medication errors, and make health care more accessible. Maintaining privacy and security of health information is crucial when technology is involved. Health information exchange plays an important role in improving the quality and delivery of health care and cost-effectiveness. “There is very little electronic information sharing among clinicians, hospitals, and other providers, despite considerable investments in health information technology (IT) over the past five years” (Robert Wood Johnson Foundation, 2014, p. 1).

As the implementation of electronic health records (EHR) progress nationwide, the concepts of interoperability and health information exchange (HIE) must be discussed. The Healthcare Information and Management Systems Society (2005, p. 2) define interoperability as “the ability of health information systems to work together within and across organizational boundaries in order to advance the effective delivery of healthcare for individuals and communities.” Interoperability is the enabling of two systems, including those that do not share

In light of available security measures and their widespread acceptance within the information security community, there is no excuse for healthcare organizations to fail in fulfilling their duty to protect personal patient information. Guaranteeing the confidentiality and privacy of data in healthcare information is crucial in safeguarding the data of patients as there should be a legal responsibility to protect medical records from unauthorized access.

The rapid changes in technology over the past few decades has left the healthcare industry ill-prepared to operate in today’s environment. Most substantial protections of sensitive consumer information has come as a result of federal regulation, most notably in 1996 with the Health Insurance Portability and Accountability Act and 2009 as part of the American Recovery and Reinvestment Act. Protection of information in the healthcare industry has lagged behind all other industries, perhaps because the records aren’t financial in nature or sensitive government information. Implementing simple steps for many organizations may be enough to limit the vast majority of breaches, although a layered, comprehensive security approach should be the ultimate goal for companies.