Managing consent for disclosure and redisclosure for protected health information in an electronic health information exchange

The Privacy and Security Solutions for Interoperable Health Information Exchange project coordinated projects in 33 states and Puerto Rico to assess the variation in privacy and security related business practices, policies, and state laws and identify impediments to nationwide electronic health data exchange. Using a “scenario” driven methodology to generate discussions among stakeholders, states conducted the assessments and identified practices, policies and state laws affecting electronic health information exchange. Each state then proposed solutions for building appropriate privacy and security safeguards into health informatics systems. This project uncovered a wealth of information concerning the underlying personal privacy and data security issues that prevent many entities from sharing data, even within the public health arena. Initial reports from the state projects identify a variety of issues that must be discussed in order to move forward with interoperable data exchange of public health data. These include questions about appropriate disclosure in non-emergent situations, state law restrictions that prevent exchange otherwise allowed by HIPAA, lack of coordination and consensus concerning information transmission security or exchange protocols between public health entities and questions concerning information authorization and access controls, especially in situations dealing with specially protected health information.