The Balance Between Promoting Data Sharing and Ensuring the Privacy and Security of Sensitive Health Information

We talk a lot about sharing data and how it will improve patient outcomes and interoperability, but do we talk enough about how to do it safely? Most of the data that we are looking to share is highly sensitive health information, the kind of information that cybercriminals love to hold for ransom. So not only is it highly sensitive, it is also highly sought-after. This security risk, though high, shouldn’t discourage us from sharing data but we do need to make sure that we balance our conversations of how great data sharing is with conversations of the security needed to ensure this information stays safe and private.

We reached out to our beautiful Healthcare IT Today Community and asked, how are healthcare organizations navigating the balance between promoting data sharing for improved patient outcomes and ensuring the privacy and security of sensitive health information? The following is what they had to share.

Ryan Johnson, Chief Product Officer at CallRail
All players in the healthcare space should expect the U.S. Department of Health and Human Services to be much more active in the enforcement of healthcare privacy following recent, and increasing, events like the data breach with Change Healthcare. While there’s a growing focus on protecting the security of sensitive patient information, ensuring privacy requirements and controls needs to start even before someone becomes a patient – including online tracking technologies on your website and other digital properties. This becomes especially crucial with tracking companies, who should be assuming proportionate responsibility for securing patient-protected health information (PHI) and willing to enter into a Business Associate Agreement (BAA). Tracking vendors that are not willing to sign a BAA creates a huge risk for healthcare providers before a patient even walks into a care facility.

Ankur Mathakia, Solutions Architect, Interoperability, Digital Health at Nordic Global Consulting
From a technical perspective, there are ways that healthcare organizations will protect the privacy of their patients while still promoting innovation, especially in population health. A great example of this is de-identified patient data sets, where we’re able to take a large volume of data and determine trends. While that may not affect an individual patient whose data is included in the data set, it affects patient outcomes overall because it allows us to analyze the data and provide early interventions and programs.

Jay Nakashima, President at eHealth Exchange
Keeping patient data safe and private is our top priority. We address the privacy and security of sensitive health data in two ways. First, we established unique network and QHIN governance committees that enable network participants and not-for-profit vendors to have a major role in setting policies for our network. We’ve taken measures to engineer the highest levels of trust, transparency, and data stewardship in our operations.

Second, and probably more importantly, we operate as a pass-through exchange, keeping patient data only long enough to allow us to troubleshoot issues with transmission. This means there is no central repository to be hacked, cracked, sold, or used for any purpose. Studies show that patient healthcare data is worth anywhere from 10 times to 50 times more valuable to cybercriminals than credit card data. We believe that the best way to protect that information is to not store it. Instead, our participants retain full control over the security of their patients’ data. We do this because it’s what our participants expect.

Diana Sonbay-Benli, VP & Chief Product Officer, Cognizant TriZetto Healthcare Products at Cognizant
Since the advent of HIPAA, almost a career’s duration ago, we’ve focused on the safeguarding of data. It’s been as if the road only has “one ditch”, where an organization can be penalized for not safeguarding patient data and preserving patient privacy rights. However, the narrow road ahead has “two ditches.” An organization can be penalized for not safeguarding data and likewise be penalized for blocking its legitimate sharing. The question is, how does an organization avoid both? There’s a set of advanced data management techniques, including provenance, sensitivity labeling, consent management, and more, which are necessary to make this happen. Other industries, such as military, defense, finance, and banking, have been ahead of healthcare in their handling of sensitive data. Healthcare is going to be rapidly advancing as patient data becomes more interoperable and effectively used across traditional organizational boundaries.

Hans Buitendijk, Public Health Workgroup Chair & Executive Committee Member at EHR Association
At a high level, any interoperability must take place within the context of protecting patient privacy rights, whether from HIPAA, 42 CFR Part 2, or state laws. Thus, the legal/common agreement, standards, technology, and governance adopted by interoperability frameworks all must be enabled to properly manage the applicable privacy rules by law within and across all jurisdictions, in combination with any of the patient’s consent/authorization directives, for every dataset exchanged for each use case. TEFCA is especially strong as a network in this context because its explicit focus is to ensure that provider organizations can engage in trusted exchange with other healthcare stakeholders. Taking a deeper look, privacy, and security of health data are critical to ensure that care is provided in and with confidence. Recent cybersecurity events indicate that maintaining a secure infrastructure is critical for managing and sharing data 24/7.

Privacy addresses another layer of data sharing based on established privacy rules by jurisdictions (e.g., HIPAA and 24 CFR Part II at the federal level and expanded rule-making at the state level) and the patient’s information sharing consent directives (e.g., general opt-in/out considerations, targeted data sharing exclusions, or explicit consent to share with specific parties). The concern is that data that could be shared may not be out of an abundance of caution and because automated support to manage and apply privacy rules is in its infancy.

Current standards and the infrastructures necessary to manage this on a national scale are not yet available to the extent needed. Consent directives and privacy rules are largely expressed in plain, non-computable text, leaving them open to potentially conflicting interpretations across jurisdictions. A clear definition of what is considered sensitive information subject to such rules and directives has not yet been established. Technologies and processes to manage the steps, from documenting/administering the applicable rules to ensuring they are consistently applied to all relevant data-sharing interactions regardless of method, are starting to be explored and tested. However, they are not yet developed and deployed in the manner needed to address this complex challenge in a computable fashion. Providers therefore are cautious about sharing all data for all patients, and instead apply local filters to prevent potentially unauthorized sharing, including using manual reviews before data is released.

Sally Else, President at Mphasis Javelina
The healthcare organizations bound by HIPAA rules (Covered entities & Business Associates serving the patients directly/indirectly) understand the privacy and security of handling sensitive information. HIPAA/HITECH rules have been utilized in sharing data between various entities. TEFCA provides additional guidelines for QHINs for end-to-end handling of data and its encryption. TEFCA like health information networks (HINs) bring non-HIPAA entities (no direct/indirect healthcare service operations) but at a large scale and with broader coverage. Health Organizations also had experience with HINs to understand the aspect of opt-in consent, patient matching among datasets, and authenticating/authorizing the users. There is surely a need for more secure systems in place for such a scale. Non-HIPAA/third-party entities/apps role must be limited as a medium in only providing access to patients/providers without storing any data while securing it end to end during the access. TEFCA proposes that the adoption of FHIR access with OAuth2.0 will help in providing secure access through third-party entities/applications. Security Vulnerability of any system/tool/network of participating actors can become the weakest link in the chain. There is a strong audit/monitoring/certification needed for such tools/technologies interfacing with the information network.

Laxmi Patel, Chief Strategy Officer at Savista
We see our provider clients implementing robust cybersecurity measures and adhering to strict regulatory standards like HIPAA. They are employing advanced encryption techniques, access controls, and continuous monitoring to protect sensitive health information. Additionally, organizations are promoting a culture of privacy and security awareness among staff through regular training and compliance audits. By leveraging secure health information exchanges (HIEs) and consent management tools, they are facilitating data sharing while maintaining patient trust and confidentiality.

Marlena Herrera, Director, Customer Success at Protegrity
Organizations are having to perform a delicate balance of maintaining security and privacy with sensitive health information. Competing priorities and objectives are often evaluated against the regulatory, compliance, legal, privacy, and security risks. The focus of improving patient outcomes requires understanding highly sensitive individual identifying information, which is why using a framework such as TEFCA may yield significant improvements in the ability to complete these objectives while reducing the exposure of sensitive electronic health information [EHI].

Don Rucker, Chief Strategy Officer at 1upHealth
Modern APIs in healthcare are point-to-point and are readily secured by ubiquitous Internet standard mechanisms such as OAuth2, which relies on public key cryptography. To the extent that institutions use older protocols or “attestation” (aka “trust me” approaches), these rely on known contracts and, historically, on the fact that clinical data was effectively only exchanged between licensed hospitals and doctors. HIPAA was originally designed on the assumption that ‘Covered Entities’ were known to the patient. As TEFCA shares data between many parties unknown to and largely undiscoverable by the patient, we will need to see what happens. Current issues with Change Healthcare and Particle Health highlight some of the concerns.

So many good answers here! Huge thank you to Ryan Johnson, Chief Product Officer at CallRail, Ankur Mathakia, Solutions Architect, Interoperability, Digital Health at Nordic Global Consulting, Jay Nakashima, President at eHealth Exchange, Diana Sonbay-Benli, VP & Chief Product Officer, Cognizant TriZetto Healthcare Products at Cognizant, Hans Buitendijk, Public Health Workgroup Chair & Executive Committee Member at EHR Association, Srikumar Ramanathan, Chief Solutions Officer at Mphasis, Laxmi Patel, Chief Strategy Officer at Savista, Marlena Herrera, Director, Customer Success at Protegrity, and Don Rucker, Chief Strategy Officer at 1upHealth for taking the time out of your day to submit a quote! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

How do you think healthcare organizations are navigating the balance between promoting data sharing for improved patient outcomes and ensuring the privacy and security of sensitive health information? Let us know either in the comments down below or over on social media. We’d love to hear from all of you!

We talk a lot about sharing data and how it will improve patient outcomes and interoperability, but do we talk enough about how to do it safely? Most of the data that we are looking to share is highly sensitive health information, the kind of information that cybercriminals love to hold for ransom. So not only is it highly sensitive, it is also highly sought-after. This security risk, though high, shouldn’t discourage us from sharing data but we do need to make sure that we balance our conversations of how great data sharing is with conversations of the security needed to ensure this information stays safe and private.

We reached out to our beautiful Healthcare IT Today Community and asked, how are healthcare organizations navigating the balance between promoting data sharing for improved patient outcomes and ensuring the privacy and security of sensitive health information? The following is what they had to share.

Ryan Johnson, Chief Product Officer at CallRail
All players in the healthcare space should expect the U.S. Department of Health and Human Services to be much more active in the enforcement of healthcare privacy following recent, and increasing, events like the data breach with Change Healthcare. While there’s a growing focus on protecting the security of sensitive patient information, ensuring privacy requirements and controls needs to start even before someone becomes a patient – including online tracking technologies on your website and other digital properties. This becomes especially crucial with tracking companies, who should be assuming proportionate responsibility for securing patient-protected health information (PHI) and willing to enter into a Business Associate Agreement (BAA). Tracking vendors that are not willing to sign a BAA creates a huge risk for healthcare providers before a patient even walks into a care facility.

Ankur Mathakia, Solutions Architect, Interoperability, Digital Health at Nordic Global Consulting
From a technical perspective, there are ways that healthcare organizations will protect the privacy of their patients while still promoting innovation, especially in population health. A great example of this is de-identified patient data sets, where we’re able to take a large volume of data and determine trends. While that may not affect an individual patient whose data is included in the data set, it affects patient outcomes overall because it allows us to analyze the data and provide early interventions and programs.

Jay Nakashima, President at eHealth Exchange
Keeping patient data safe and private is our top priority. We address the privacy and security of sensitive health data in two ways. First, we established unique network and QHIN governance committees that enable network participants and not-for-profit vendors to have a major role in setting policies for our network. We’ve taken measures to engineer the highest levels of trust, transparency, and data stewardship in our operations.

Second, and probably more importantly, we operate as a pass-through exchange, keeping patient data only long enough to allow us to troubleshoot issues with transmission. This means there is no central repository to be hacked, cracked, sold, or used for any purpose. Studies show that patient healthcare data is worth anywhere from 10 times to 50 times more valuable to cybercriminals than credit card data. We believe that the best way to protect that information is to not store it. Instead, our participants retain full control over the security of their patients’ data. We do this because it’s what our participants expect.

Diana Sonbay-Benli, VP & Chief Product Officer, Cognizant TriZetto Healthcare Products at Cognizant
Since the advent of HIPAA, almost a career’s duration ago, we’ve focused on the safeguarding of data. It’s been as if the road only has “one ditch”, where an organization can be penalized for not safeguarding patient data and preserving patient privacy rights. However, the narrow road ahead has “two ditches.” An organization can be penalized for not safeguarding data and likewise be penalized for blocking its legitimate sharing. The question is, how does an organization avoid both? There’s a set of advanced data management techniques, including provenance, sensitivity labeling, consent management, and more, which are necessary to make this happen. Other industries, such as military, defense, finance, and banking, have been ahead of healthcare in their handling of sensitive data. Healthcare is going to be rapidly advancing as patient data becomes more interoperable and effectively used across traditional organizational boundaries.

Hans Buitendijk, Public Health Workgroup Chair & Executive Committee Member at EHR Association
At a high level, any interoperability must take place within the context of protecting patient privacy rights, whether from HIPAA, 42 CFR Part 2, or state laws. Thus, the legal/common agreement, standards, technology, and governance adopted by interoperability frameworks all must be enabled to properly manage the applicable privacy rules by law within and across all jurisdictions, in combination with any of the patient’s consent/authorization directives, for every dataset exchanged for each use case. TEFCA is especially strong as a network in this context because its explicit focus is to ensure that provider organizations can engage in trusted exchange with other healthcare stakeholders. Taking a deeper look, privacy, and security of health data are critical to ensure that care is provided in and with confidence. Recent cybersecurity events indicate that maintaining a secure infrastructure is critical for managing and sharing data 24/7.

Privacy addresses another layer of data sharing based on established privacy rules by jurisdictions (e.g., HIPAA and 24 CFR Part II at the federal level and expanded rule-making at the state level) and the patient’s information sharing consent directives (e.g., general opt-in/out considerations, targeted data sharing exclusions, or explicit consent to share with specific parties). The concern is that data that could be shared may not be out of an abundance of caution and because automated support to manage and apply privacy rules is in its infancy.

Current standards and the infrastructures necessary to manage this on a national scale are not yet available to the extent needed. Consent directives and privacy rules are largely expressed in plain, non-computable text, leaving them open to potentially conflicting interpretations across jurisdictions. A clear definition of what is considered sensitive information subject to such rules and directives has not yet been established. Technologies and processes to manage the steps, from documenting/administering the applicable rules to ensuring they are consistently applied to all relevant data-sharing interactions regardless of method, are starting to be explored and tested. However, they are not yet developed and deployed in the manner needed to address this complex challenge in a computable fashion. Providers therefore are cautious about sharing all data for all patients, and instead apply local filters to prevent potentially unauthorized sharing, including using manual reviews before data is released.

Sally Else, President at Mphasis Javelina
The healthcare organizations bound by HIPAA rules (Covered entities & Business Associates serving the patients directly/indirectly) understand the privacy and security of handling sensitive information. HIPAA/HITECH rules have been utilized in sharing data between various entities. TEFCA provides additional guidelines for QHINs for end-to-end handling of data and its encryption. TEFCA like health information networks (HINs) bring non-HIPAA entities (no direct/indirect healthcare service operations) but at a large scale and with broader coverage. Health Organizations also had experience with HINs to understand the aspect of opt-in consent, patient matching among datasets, and authenticating/authorizing the users. There is surely a need for more secure systems in place for such a scale. Non-HIPAA/third-party entities/apps role must be limited as a medium in only providing access to patients/providers without storing any data while securing it end to end during the access. TEFCA proposes that the adoption of FHIR access with OAuth2.0 will help in providing secure access through third-party entities/applications. Security Vulnerability of any system/tool/network of participating actors can become the weakest link in the chain. There is a strong audit/monitoring/certification needed for such tools/technologies interfacing with the information network.

Laxmi Patel, Chief Strategy Officer at Savista
We see our provider clients implementing robust cybersecurity measures and adhering to strict regulatory standards like HIPAA. They are employing advanced encryption techniques, access controls, and continuous monitoring to protect sensitive health information. Additionally, organizations are promoting a culture of privacy and security awareness among staff through regular training and compliance audits. By leveraging secure health information exchanges (HIEs) and consent management tools, they are facilitating data sharing while maintaining patient trust and confidentiality.

Marlena Herrera, Director, Customer Success at Protegrity
Organizations are having to perform a delicate balance of maintaining security and privacy with sensitive health information. Competing priorities and objectives are often evaluated against the regulatory, compliance, legal, privacy, and security risks. The focus of improving patient outcomes requires understanding highly sensitive individual identifying information, which is why using a framework such as TEFCA may yield significant improvements in the ability to complete these objectives while reducing the exposure of sensitive electronic health information [EHI].

Don Rucker, Chief Strategy Officer at 1upHealth
Modern APIs in healthcare are point-to-point and are readily secured by ubiquitous Internet standard mechanisms such as OAuth2, which relies on public key cryptography. To the extent that institutions use older protocols or “attestation” (aka “trust me” approaches), these rely on known contracts and, historically, on the fact that clinical data was effectively only exchanged between licensed hospitals and doctors. HIPAA was originally designed on the assumption that ‘Covered Entities’ were known to the patient. As TEFCA shares data between many parties unknown to and largely undiscoverable by the patient, we will need to see what happens. Current issues with Change Healthcare and Particle Health highlight some of the concerns.

So many good answers here! Huge thank you to Ryan Johnson, Chief Product Officer at CallRail, Ankur Mathakia, Solutions Architect, Interoperability, Digital Health at Nordic Global Consulting, Jay Nakashima, President at eHealth Exchange, Diana Sonbay-Benli, VP & Chief Product Officer, Cognizant TriZetto Healthcare Products at Cognizant, Hans Buitendijk, Public Health Workgroup Chair & Executive Committee Member at EHR Association, Srikumar Ramanathan, Chief Solutions Officer at Mphasis, Laxmi Patel, Chief Strategy Officer at Savista, Marlena Herrera, Director, Customer Success at Protegrity, and Don Rucker, Chief Strategy Officer at 1upHealth for taking the time out of your day to submit a quote! And thank you to all of you for taking the time out of your day to read this article! We could not do this without all of your support.

How do you think healthcare organizations are navigating the balance between promoting data sharing for improved patient outcomes and ensuring the privacy and security of sensitive health information? Let us know either in the comments down below or over on social media. We’d love to hear from all of you!