Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/5/2012
12:36 PM
50%
50%

New York Moves To Protect Health Data Privacy

Should a simple trip to the podiatrist unlock your lifelong medical history? As electronic medical records are shared, complex privacy questions arise, prompting a new state committee to tackle patient privacy and HIE data access questions.

Telemedicine Tools That Are Transforming Healthcare
Telemedicine Tools That Are Transforming Healthcare
(click image for larger view and for slideshow)
In the aftermath of criticism from the New York Civil Liberties Union, New York State health officials have taken further steps to tackle patient privacy. Specifically, the New York eHealth Collaborative (NYeC), in collaboration with the New York State Department of Health, has established the Statewide Health Information Network of New York (SHIN-NY) Policy Committee.

The new committee's mandate will be to create and update policies that protect personal health information while expanding the state's ability to share electronic health records between healthcare providers, and with consumers and other health-related community organizations, according to a statement announcing the formation of the SHIN-NY Policy Committee.

Corinne Carey, one of the committee members and assistant legislative director at the New York Civil Liberties Union (NYCLU), joins 16 other members that include public officials, healthcare providers, attorneys, and public advocates.

[ Most of the largest healthcare data security and privacy breaches have involved lost or stolen mobile computing devices. For possible solutions, see 7 Tools To Tighten Healthcare Data Security. ]

Carey told InformationWeek Healthcare that she would like the policy committee to "ask the state to conduct a thorough review of the policies and procedures governing health information exchange to determine if they are consistent with New York State law, in particular section 18 of the public health law which requires affirmative patient consent before any medical information is shared with a third party."

Recently, the NYCLU issued a report that bemoaned New York State's current privacy and security policies and procedures governing computer networks that share electronic medical records. The report concluded that under the state's current policies and procedures, providers are not required to have patient consent when they access a patient's medical record.

The report also noted that New York State is building a health information exchange that uploads the entire history of a patient's medical records, some of which is not required by specific providers to render adequate care. This allows, for example, a podiatrist to see the details of a sexually transmitted disease or a substance abuse disorder that occurred many years ago, information that's unrelated to the condition the podiatrist is treating.

Now that she's a member of the SHIN-NY Policy Committee, Carey is hoping these issues will be addressed. "We want the committee to put in place a policy that requires that health information exchange systems have the capacity to sort and segregate information so that both patients and providers have the ability to restrict access to certain portions of a medical record," Carey said.

She also wants the committee to revisit the policy that allows for the upload of patient information onto a health information exchange. In her view, patient consent should occur before the medical records are added to the network.

Officials at the NYeC said the organization is tasked with protecting the privacy and security of healthcare information. To advance this agenda, NYeC works with stakeholders from across the state and from a wide variety of interest groups to develop common policies, procedures, and technical approaches through an open and transparent process.

During 2010 and 2011, NYeC's privacy and security policy work focused mainly on reviewing the state's existing policy guidance on health IT, which directed the regional work of Regional Health Information Exchange Organizations (RHIOs).

With regional data now being tied together to provide for statewide exchange of healthcare data, the SHIN-NY Policy Committee will review and modify existing policy and explore the creation of a new policy as needed to improve interoperability while protecting patient information. New policy and policy amendments align with federal requirements, NYeC officials said in a statement.

"It's essential for the success of this electronic health information enterprise that it be transparent and that all stakeholders have a meaningful voice in its governance. This committee's diverse membership reflects that principle," Art Levin, director of the Center for Medical Consumers, member of the NYeC Board of Directors, and Co-Chair of the SHIN-NY Policy Committee, said in a statement.

The 2012 InformationWeek Healthcare IT Priorities Survey finds that grabbing federal incentive dollars and meeting pay-for-performance mandates are the top issues facing IT execs. Find out more in the new, all-digital Time To Deliver issue of InformationWeek Healthcare. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
jamescraig
50%
50%
jamescraig,
User Rank: Apprentice
7/22/2014 | 3:48:21 AM
Medical Workers
Rise in the salary of medical workers is the one off the easy solution to provide protection against the theft of health data records. On other hand low rank health workers can be the most ideal person to get the patient dats. Most of the workers are managing the patient records so they can esaily get through any of the secuirty measures.  
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: George has not accepted that the technology age has come to an end.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-28466
PUBLISHED: 2021-03-07
This affects all versions of package github.com/nats-io/nats-server/server. Untrusted accounts are able to crash the server using configs that represent a service export/import cycles. Disclaimer from the maintainers: Running a NATS service which is exposed to untrusted users presents a heightened r...
CVE-2021-27364
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. drivers/scsi/scsi_transport_iscsi.c is adversely affected by the ability of an unprivileged user to craft Netlink messages.
CVE-2021-27365
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. Certain iSCSI data structures do not have appropriate length constraints or checks, and can exceed the PAGE_SIZE value. An unprivileged user can send a Netlink message that is associated with iSCSI, and has a length up to the maximum length...
CVE-2021-27363
PUBLISHED: 2021-03-07
An issue was discovered in the Linux kernel through 5.11.3. A kernel pointer leak can be used to determine the address of the iscsi_transport structure. When an iSCSI transport is registered with the iSCSI subsystem, the transport's handle is available to unprivileged users via the sysfs file system...
CVE-2021-26294
PUBLISHED: 2021-03-07
An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/server.php/files/personal/%2e%2e when using the caldav_public_...