Preparing the information technology infrastructure to provide a secure and stable environment for the use of electronic health records (EHRs) and protected health information (PHI)

Background: Constantly changing legislative mandates such as HIPAA, HITECH and ARRA have provided a minefield of best practices with no detailed guidance on how to secure intersystem communications locally, between peers and up-line to federal agencies. To be in compliance with the ARRA HITECH Act, information technology infrastructure must be ready by the time data is transmitted, processed and stored. Rich but large datasets derived from electronic health records (EHRs) will require hospitals, clinics/physician offices, interlinked health exchanges and disease registries to collaborate to provide better and more streamlined data collection and communicate in secure ways. These collaborations foster a better continuum of care; secure infrastructure is critical for the further development and return on investment of EHRs.

Purpose: Describe benefits associated with integrating information security and information technology planning early on in preparing the environment for the use of EHRs and demonstrate how to transform high-level security and privacy mandates into operational best practices that reinforce secure data transfers of patient health information and communications between EHRs and disease registries.

Methods: We reviewed and analyzed the Missouri Cancer Registry and Research Center's current information infrastructure. We developed strategic steps to prepare the environment for new information technology use, including selecting secure messaging transfer software, and identified areas that needed to be improved to meet the increased data and information flow.

Discussion/Conclusions: Communicating with key stakeholders and technical implementation staff from the project onset, we were able to assure secure system design and secure messaging/data transfer between point-of-care clinical staff in multiple locations. This facilitated data aggregation from EHR sources and permitted encrypted data submission to authorized recipients. The requirement is not only to have the necessary information technology in place but also to create an environment that can support various applications needed to demonstrate meaningful use.