Trustworthy Healthcare Provider - Revision history

Tomjones: /* External References */

2021-02-18T01:34:31Z

External References

← Older revision		Revision as of 01:34, 18 February 2021
Line 170:		Line 170:
	# a therapist		# a therapist
	# any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary		# any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary
	# ONC is considering adjusting the ~~information blocking~~ definition of “health care provider” to cover all individuals and entities covered by the HIPAA “health care provider” definition.		# ONC is considering adjusting the [[Information Blocking]] definition of “health care provider” to cover all individuals and entities covered by the HIPAA “health care provider” definition.

	[[Category:Profile]]		[[Category:Profile]]

Tomjones: /* Real World Members */

2020-03-20T00:50:26Z

Real World Members

← Older revision		Revision as of 00:50, 20 March 2020
Line 21:		Line 21:
	# Patient - is the person receiving care and the one that "owns" the rights to the information. (In some cases the patient allows other users access to their PHI.)		# Patient - is the person receiving care and the one that "owns" the rights to the information. (In some cases the patient allows other users access to their PHI.)
	# Patient Support - is source of the user phone or computer and the code running on the user's phone or computer. It is trusted to protect the patient's credentials and medical records from disclosure.		# Patient Support - is source of the user phone or computer and the code running on the user's phone or computer. It is trusted to protect the patient's credentials and medical records from disclosure.
	# Covered Entities (called providers below) - Any entities that is covered by HIPAA rules including the places that a patient goes for medical care. They will all be recognized as such in the digital world by virtue of trust certificates. Many of these will perform [[Identity Proofing]]. All will provide evidence that a user is accepted as a patient at the entity to any other registered covered entity. (For the ~~record locator service~~.) The services that they provide are listed below.		# Covered Entities (called providers below) - Any entities that is covered by HIPAA rules including the places that a patient goes for medical care. They will all be recognized as such in the digital world by virtue of trust certificates. Many of these will perform [[Identity Proofing]]. All will provide evidence that a user is accepted as a patient at the entity to any other registered covered entity. (For the [[Record Locator Service]].) The services that they provide are listed below.

	===Names use within the Ecosystem===		===Names use within the Ecosystem===

Tomjones: /* External References */

2019-10-28T16:47:37Z

External References

← Older revision		Revision as of 16:47, 28 October 2019
Line 143:		Line 143:
	*[https://tcwiki.azurewebsites.net/index.php?title=Patient_Experience Patient Experience]		*[https://tcwiki.azurewebsites.net/index.php?title=Patient_Experience Patient Experience]
	*[https://tcwiki.azurewebsites.net/index.php?title=PHI Patient (or Protected) Health Information - PHI]		*[https://tcwiki.azurewebsites.net/index.php?title=PHI Patient (or Protected) Health Information - PHI]
	*[https://digital.nhs.uk/services/health-and-social-care-network The UK HSCN Internet Access Form] In the UK only ~~trusted~~ sites are permitted to handle health information.<blockquote>The HSCN Internet Access Form has replaced the Data Security Centre (DSC) HSCN ANME Firewall Change Request Form. The form can be used if your CNSP has advised you are trying to access something that has been blacklisted, the port you are trying to access is not an allowed any/any port or you had access to a site on the Transition Network (previously N3) however you do not have the same access on HSCN.</blockquote>		*[https://digital.nhs.uk/services/health-and-social-care-network The UK HSCN Internet Access Form] In the UK only known sites are permitted to handle health information.<blockquote>The HSCN Internet Access Form has replaced the Data Security Centre (DSC) HSCN ANME Firewall Change Request Form. The form can be used if your CNSP has advised you are trying to access something that has been blacklisted, the port you are trying to access is not an allowed any/any port or you had access to a site on the Transition Network (previously N3) however you do not have the same access on HSCN.</blockquote>
	*[https://tcwiki.azurewebsites.net/index.php?title=TEFCA TEFCA], Trusted Exchange Framework and Common Agreement for an FHIR interaction with the transfer of PHI between Secure Nodes<blockquote>The TEF Draft 2 supports the Cures Act’s goal of advancing nationwide interoperability and is a key component of HHS’ and the Administration’s broader strategy to facilitate nationwide interoperability. HINs must agree on a minimum set of principles that enable trust in order to facilitate interoperability and the exchange of EHI necessary to support the entire care continuum. The TEF Draft 2 establishes a uniform set of principles that all HINs should adhere to allow for the trusted and secure electronic exchange of health information. Adherence to these principles will help improve the flow of EHI, providing patients with secure access to their information when and where they need it most.</blockquote>		*[https://tcwiki.azurewebsites.net/index.php?title=TEFCA TEFCA], Trusted Exchange Framework and Common Agreement for an FHIR interaction with the transfer of PHI between Secure Nodes<blockquote>The TEF Draft 2 supports the Cures Act’s goal of advancing nationwide interoperability and is a key component of HHS’ and the Administration’s broader strategy to facilitate nationwide interoperability. HINs must agree on a minimum set of principles that enable trust in order to facilitate interoperability and the exchange of EHI necessary to support the entire care continuum. The TEF Draft 2 establishes a uniform set of principles that all HINs should adhere to allow for the trusted and secure electronic exchange of health information. Adherence to these principles will help improve the flow of EHI, providing patients with secure access to their information when and where they need it most.</blockquote>
	* Public Health Service Act (42 U.S.C. 300jj) Health Care Provider Definition<blockquote>The term “health care provider” includes a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, community mental health center (as defined in section 300x–2(b)(1) of this title), renal dialysis facility, blood center, ambulatory surgical center described in section 1395l(i) of this title, emergency medical services provider, Federally qualified health center, group practice, a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1395x(r) of this title), a practitioner (as described in section 1395u(b)(18)(C) of this title), a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act [25 U.S.C. 450 et seq.]), tribal organization, or urban Indian organization (as defined in section 1603 of title 25), a rural health clinic, a covered entity under section 256b of this title, an ambulatory surgical center described in section 1395l(i) of this title, a therapist (as defined in section 1395w–4(k)(3)(B)(iii) of this title), and any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary</blockquote>		* Public Health Service Act (42 U.S.C. 300jj) Health Care Provider Definition<blockquote>The term “health care provider” includes a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, community mental health center (as defined in section 300x–2(b)(1) of this title), renal dialysis facility, blood center, ambulatory surgical center described in section 1395l(i) of this title, emergency medical services provider, Federally qualified health center, group practice, a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1395x(r) of this title), a practitioner (as described in section 1395u(b)(18)(C) of this title), a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act [25 U.S.C. 450 et seq.]), tribal organization, or urban Indian organization (as defined in section 1603 of title 25), a rural health clinic, a covered entity under section 256b of this title, an ambulatory surgical center described in section 1395l(i) of this title, a therapist (as defined in section 1395w–4(k)(3)(B)(iii) of this title), and any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary</blockquote>

Tomjones: /* External References */

2019-10-28T16:46:21Z

External References

← Older revision		Revision as of 16:46, 28 October 2019
Line 144:		Line 144:
	*[https://tcwiki.azurewebsites.net/index.php?title=PHI Patient (or Protected) Health Information - PHI]		*[https://tcwiki.azurewebsites.net/index.php?title=PHI Patient (or Protected) Health Information - PHI]
	*[https://digital.nhs.uk/services/health-and-social-care-network The UK HSCN Internet Access Form] In the UK only trusted sites are permitted to handle health information.<blockquote>The HSCN Internet Access Form has replaced the Data Security Centre (DSC) HSCN ANME Firewall Change Request Form. The form can be used if your CNSP has advised you are trying to access something that has been blacklisted, the port you are trying to access is not an allowed any/any port or you had access to a site on the Transition Network (previously N3) however you do not have the same access on HSCN.</blockquote>		*[https://digital.nhs.uk/services/health-and-social-care-network The UK HSCN Internet Access Form] In the UK only trusted sites are permitted to handle health information.<blockquote>The HSCN Internet Access Form has replaced the Data Security Centre (DSC) HSCN ANME Firewall Change Request Form. The form can be used if your CNSP has advised you are trying to access something that has been blacklisted, the port you are trying to access is not an allowed any/any port or you had access to a site on the Transition Network (previously N3) however you do not have the same access on HSCN.</blockquote>
			*[https://tcwiki.azurewebsites.net/index.php?title=TEFCA TEFCA], Trusted Exchange Framework and Common Agreement for an FHIR interaction with the transfer of PHI between Secure Nodes<blockquote>The TEF Draft 2 supports the Cures Act’s goal of advancing nationwide interoperability and is a key component of HHS’ and the Administration’s broader strategy to facilitate nationwide interoperability. HINs must agree on a minimum set of principles that enable trust in order to facilitate interoperability and the exchange of EHI necessary to support the entire care continuum. The TEF Draft 2 establishes a uniform set of principles that all HINs should adhere to allow for the trusted and secure electronic exchange of health information. Adherence to these principles will help improve the flow of EHI, providing patients with secure access to their information when and where they need it most.</blockquote>
	~~Read more on the HSCN technical guidance and forms page.~~
	*[https://tcwiki.azurewebsites.net/index.php?title=TEFCA TEFCA], Trusted Exchange Framework and Common Agreement for an FHIR interaction with the transfer of PHI between Secure Nodes
	<blockquote>The TEF Draft 2 supports the Cures Act’s goal of advancing nationwide interoperability and is a key component of HHS’ and the Administration’s broader strategy to facilitate nationwide interoperability. HINs must agree on a minimum set of principles that enable trust in order to facilitate interoperability and the exchange of EHI necessary to support the entire care continuum. The TEF Draft 2 establishes a uniform set of principles that all HINs should adhere to allow for the trusted and secure electronic exchange of health information. Adherence to these principles will help improve the flow of EHI, providing patients with secure access to their information when and where they need it most.</blockquote>
	* Public Health Service Act (42 U.S.C. 300jj) Health Care Provider Definition<blockquote>The term “health care provider” includes a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, community mental health center (as defined in section 300x–2(b)(1) of this title), renal dialysis facility, blood center, ambulatory surgical center described in section 1395l(i) of this title, emergency medical services provider, Federally qualified health center, group practice, a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1395x(r) of this title), a practitioner (as described in section 1395u(b)(18)(C) of this title), a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act [25 U.S.C. 450 et seq.]), tribal organization, or urban Indian organization (as defined in section 1603 of title 25), a rural health clinic, a covered entity under section 256b of this title, an ambulatory surgical center described in section 1395l(i) of this title, a therapist (as defined in section 1395w–4(k)(3)(B)(iii) of this title), and any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary</blockquote>		* Public Health Service Act (42 U.S.C. 300jj) Health Care Provider Definition<blockquote>The term “health care provider” includes a hospital, skilled nursing facility, nursing facility, home health entity or other long term care facility, health care clinic, community mental health center (as defined in section 300x–2(b)(1) of this title), renal dialysis facility, blood center, ambulatory surgical center described in section 1395l(i) of this title, emergency medical services provider, Federally qualified health center, group practice, a pharmacist, a pharmacy, a laboratory, a physician (as defined in section 1395x(r) of this title), a practitioner (as described in section 1395u(b)(18)(C) of this title), a provider operated by, or under contract with, the Indian Health Service or by an Indian tribe (as defined in the Indian Self-Determination and Education Assistance Act [25 U.S.C. 450 et seq.]), tribal organization, or urban Indian organization (as defined in section 1603 of title 25), a rural health clinic, a covered entity under section 256b of this title, an ambulatory surgical center described in section 1395l(i) of this title, a therapist (as defined in section 1395w–4(k)(3)(B)(iii) of this title), and any other category of health care facility, entity, practitioner, or clinician determined appropriate by the Secretary</blockquote>
	* [https://www.healthit.gov/sites/default/files/page/2019-04/ONCCuresActNPRMIBWebinar031919.pdf type of Health Care Providers from onc] (interestingly does not include the Electronic Health Repository (EHR) itself)		* [https://www.healthit.gov/sites/default/files/page/2019-04/ONCCuresActNPRMIBWebinar031919.pdf type of Health Care Providers from onc] (interestingly does not include the Electronic Health Repository (EHR) itself)

Tomjones: /* External References */

2019-10-28T16:45:32Z

External References

← Older revision		Revision as of 16:45, 28 October 2019
Line 142:		Line 142:
	*[https://tcwiki.azurewebsites.net/index.php?title=Medical_Records_Identifier Medical Records Identifier]		*[https://tcwiki.azurewebsites.net/index.php?title=Medical_Records_Identifier Medical Records Identifier]
	*[https://tcwiki.azurewebsites.net/index.php?title=Patient_Experience Patient Experience]		*[https://tcwiki.azurewebsites.net/index.php?title=Patient_Experience Patient Experience]
	*[https://tcwiki.azurewebsites.net/index.php?title=PHI Patient Health Information - PHI]		*[https://tcwiki.azurewebsites.net/index.php?title=PHI Patient (or Protected) Health Information - PHI]
			*[https://digital.nhs.uk/services/health-and-social-care-network The UK HSCN Internet Access Form] In the UK only trusted sites are permitted to handle health information.<blockquote>The HSCN Internet Access Form has replaced the Data Security Centre (DSC) HSCN ANME Firewall Change Request Form. The form can be used if your CNSP has advised you are trying to access something that has been blacklisted, the port you are trying to access is not an allowed any/any port or you had access to a site on the Transition Network (previously N3) however you do not have the same access on HSCN.</blockquote>

			Read more on the HSCN technical guidance and forms page.
	*[https://tcwiki.azurewebsites.net/index.php?title=TEFCA TEFCA], Trusted Exchange Framework and Common Agreement for an FHIR interaction with the transfer of PHI between Secure Nodes		*[https://tcwiki.azurewebsites.net/index.php?title=TEFCA TEFCA], Trusted Exchange Framework and Common Agreement for an FHIR interaction with the transfer of PHI between Secure Nodes
	<blockquote>The TEF Draft 2 supports the Cures Act’s goal of advancing nationwide interoperability and is a key component of HHS’ and the Administration’s broader strategy to facilitate nationwide interoperability. HINs must agree on a minimum set of principles that enable trust in order to facilitate interoperability and the exchange of EHI necessary to support the entire care continuum. The TEF Draft 2 establishes a uniform set of principles that all HINs should adhere to allow for the trusted and secure electronic exchange of health information. Adherence to these principles will help improve the flow of EHI, providing patients with secure access to their information when and where they need it most.</blockquote>		<blockquote>The TEF Draft 2 supports the Cures Act’s goal of advancing nationwide interoperability and is a key component of HHS’ and the Administration’s broader strategy to facilitate nationwide interoperability. HINs must agree on a minimum set of principles that enable trust in order to facilitate interoperability and the exchange of EHI necessary to support the entire care continuum. The TEF Draft 2 establishes a uniform set of principles that all HINs should adhere to allow for the trusted and secure electronic exchange of health information. Adherence to these principles will help improve the flow of EHI, providing patients with secure access to their information when and where they need it most.</blockquote>

Tomjones: /* Full Title or Meme */

2019-10-02T04:24:53Z

Full Title or Meme

← Older revision		Revision as of 04:24, 2 October 2019
Line 1:		Line 1:
	==Full Title or Meme==		==Full Title or Meme==
	There are two contexts where [[Trustworthy Healthcare Provider]] is defined and so there are two memes that it covers:		There are two contexts where [[Trustworthy Healthcare Provider]] is defined and so there are two memes that it covers (perhaps these two classes are isomorphic):
	# Providers that share trust among themselves to know that [https://tcwiki.azurewebsites.net/index.php?title=PHI Protected Health Information (PHI)] can be shared as the correspondent is a recognized HIPAA-covered entity.		# Providers that share trust among themselves to know that [https://tcwiki.azurewebsites.net/index.php?title=PHI Protected Health Information (PHI)] can be shared as the correspondent is a recognized HIPAA-covered entity.
	# Providers that may be trusted by patients (or other end users) with their PHI and their [[UXC Dictionary\|Consent]] as to permitted use.		# Providers that may be trusted by patients (or other end users) with their PHI and their [[UXC Dictionary\|Consent]] as to permitted use.

Tomjones: /* Relational Trust */

2019-10-02T04:22:45Z

Relational Trust

← Older revision		Revision as of 04:22, 2 October 2019
Line 47:		Line 47:

	==Solutions==		==Solutions==

	~~===Relational Trust===~~

	The definition of (relational) trust is to believe in the honesty and reliability of someone or an entity you have known over time, made a good faith effort to live up to an agreement to fulfill their commitment, be it a contract or handshake agreement. ‘Trust’ is a transnational catalyst, the chemistry that initiates an interaction and reaction if not abused. (So that the trust expressed as "known to the practice" can be transmitted to other participants.)

	===Online Trust===		===Online Trust===

Tomjones: /* Data Categorization */

2019-10-02T01:39:20Z

Data Categorization

Tomjones: /* Data Categorization */

2019-10-02T01:36:17Z

Data Categorization

Tomjones: /* Goals */

2019-10-01T23:53:58Z

Goals

← Older revision		Revision as of 23:53, 1 October 2019
Line 4:		Line 4:
	# Providers that may be trusted by patients (or other end users) with their PHI and their [[UXC Dictionary\|Consent]] as to permitted use.		# Providers that may be trusted by patients (or other end users) with their PHI and their [[UXC Dictionary\|Consent]] as to permitted use.
	===Goals===		===Goals===
	# [[IDEF Registry\|Trust Registry]] of IDEF (Trusted Identifiers in Cyberspace) for healthcare industry in US.		# [[IDEF Registry\|Trust Registry]] of IDEF (Trusted Identifiers in Cyberspace) for healthcare industry in US that is available to all inquiries at any time at low latency and at no cost to occasional users.

	==Context==		==Context==

← Older revision		Revision as of 01:39, 2 October 2019
Line 74:		Line 74:
	\| sev\|\| Name\|\| Definitions		\| sev\|\| Name\|\| Definitions
	\|-		\|-
	\| L \|\|low\|\|~~Privacy metadata indicating that~~ the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity.		\| L \|\|low\|\| the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity.
	Examples: Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets.		Examples: Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets.
	Map: No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services.		Map: No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services.
	Usage Note: This metadata indicates the receiver may have an obligation to comply with a data use agreement.		Usage Note: This metadata indicates the receiver may have an obligation to comply with a data use agreement.
	\|-		\|-
	\| M\|\|moderate\|\|~~Privacy metadata indicating~~ moderately sensitive information, which presents moderate risk of harm if disclosed without authorization.		\| M\|\|moderate\|\|moderately sensitive information, which presents moderate risk of harm if disclosed without authorization.
	Examples: Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws.		Examples: Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws.
	Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff).		Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff).
	Usage Note: This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies.		Usage Note: This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies.
	\|-		\|-
	\| N\|\|normal\|\| ~~Privacy metadata indicating that~~ the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization.		\| N\|\|normal\|\| the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization.
	Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance.		Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance.
	Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations.		Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations.
	Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization.		Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization.
	\|-		\|-
	\| R\|\| restricted\|\|~~Privacy metadata indicating~~ highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be pre-empted by jurisdictional law, e.g., for public health reporting or emergency treatment.		\| R\|\| restricted\|\| highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be pre-empted by jurisdictional law, e.g., for public health reporting or emergency treatment.
	Examples: Includes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patient's standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual, e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer.		Examples: Includes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patient's standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual, e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer.
	Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations..		Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations..
	Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization..		Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization..
	\|-		\|-
	\| U\|\| unrestricted\|\| ~~Privacy metadata indicating that~~ the information is not classified as sensitive.		\| U\|\| unrestricted\|\| the information is not classified as sensitive.
	Examples: Includes publicly available information, e.g., business name, phone, email or physical address.		Examples: Includes publicly available information, e.g., business name, phone, email or physical address.
	Usage Note: This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestricted" to that information even if it is publicly available.		Usage Note: This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestricted" to that information even if it is publicly available.
	\|-		\|-
	\| V \|\|very restricted \|\|~~Privacy metadata indicating that~~ the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence.		\| V \|\|very restricted \|\| the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence.
	Examples: Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under 'legal lock' or attorney-client privilege. This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject.		Examples: Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under 'legal lock' or attorney-client privilege. This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject.
	\|-		\|-

← Older revision		Revision as of 01:36, 2 October 2019
Line 72:		Line 72:

	{\|border="1" padding="2" width="888px"		{\|border="1" padding="2" width="888px"
	\| ~~Ver \|\| severity~~\|\| Name\|\| ~~Other~~		\| sev\|\| Name\|\| Definitions
	\|-		\|-
	~~\|2 \|~~\| L \|\|low\|\|~~Definition:~~ Privacy metadata indicating that the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity.		\| L \|\|low\|\|Privacy metadata indicating that the information has been de-identified, and there are mitigating circumstances that prevent re-identification, which minimize risk of harm from unauthorized disclosure. The information requires protection to maintain low sensitivity.
	Examples: Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets.		Examples: Includes anonymized, pseudonymized, or non-personally identifiable information such as HIPAA limited data sets.
	Map: No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services.		Map: No clear map to ISO 13606-4 Sensitivity Level (1) Care Management: RECORD_COMPONENTs that might need to be accessed by a wide range of administrative staff to manage the subject of care's access to health services.
	Usage Note: This metadata indicates the receiver may have an obligation to comply with a data use agreement.		Usage Note: This metadata indicates the receiver may have an obligation to comply with a data use agreement.
	\|-		\|-
	\|~~2\|\|~~ M\|\|moderate\|\|~~Definition:~~ Privacy metadata indicating moderately sensitive information, which presents moderate risk of harm if disclosed without authorization.		\| M\|\|moderate\|\|Privacy metadata indicating moderately sensitive information, which presents moderate risk of harm if disclosed without authorization.
	Examples: Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws.		Examples: Includes allergies of non-sensitive nature used inform food service; health information a patient authorizes to be used for marketing, released to a bank for a health credit card or savings account; or information in personal health record systems that are not governed under health privacy laws.
	Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff).		Map: Partial Map to ISO 13606-4 Sensitivity Level (2) Clinical Management: Less sensitive RECORD_COMPONENTs that might need to be accessed by a wider range of personnel not all of whom are actively caring for the patient (e.g. radiology staff).
	Usage Note: This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies.		Usage Note: This metadata indicates that the receiver may be obligated to comply with the receiver's terms of use or privacy policies.
	\|-		\|-
	~~\|2\|~~\| N\|\|normal\|\| ~~Definition:~~ Privacy metadata indicating that the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization.		\| N\|\|normal\|\| Privacy metadata indicating that the information is typical, non-stigmatizing health information, which presents typical risk of harm if disclosed without authorization.
	Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance.		Examples: In the US, this includes what HIPAA identifies as the minimum necessary protected health information (PHI) given a covered purpose of use (treatment, payment, or operations). Includes typical, non-stigmatizing health information disclosed in an application for health, workers compensation, disability, or life insurance.
	Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations.		Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations.
	Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization.		Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable jurisdictional privacy law or disclosure authorization.
	\|-		\|-
	\|~~2\|\|~~ R\|\| restricted\|\| Privacy metadata indicating highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be pre-empted by jurisdictional law, e.g., for public health reporting or emergency treatment.		\| R\|\| restricted\|\|Privacy metadata indicating highly sensitive, potentially stigmatizing information, which presents a high risk to the information subject if disclosed without authorization. May be pre-empted by jurisdictional law, e.g., for public health reporting or emergency treatment.
	Examples: Includes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patient's standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual, e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer.		Examples: Includes information that is additionally protected such as sensitive conditions mental health, HIV, substance abuse, domestic violence, child abuse, genetic disease, and reproductive health; or sensitive demographic information such as a patient's standing as an employee or a celebrity. May be used to indicate proprietary or classified information that is not related to an individual, e.g., secret ingredients in a therapeutic substance; or the name of a manufacturer.
	Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations..		Map: Partial Map to ISO 13606-4 Sensitivity Level (3) Clinical Care: Default for normal clinical care access (i.e. most clinical staff directly caring for the patient should be able to access nearly all of the EHR). Maps to normal confidentiality for treatment information but not to ancillary care, payment and operations..
	Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization..		Usage Note: This metadata indicates that the receiver may be obligated to comply with applicable, prevailing (default) jurisdictional privacy law or disclosure authorization..
	\|-		\|-
	\|~~2\|\|~~ U\|\| unrestricted\|\| ~~Definition:~~ Privacy metadata indicating that the information is not classified as sensitive.		\| U\|\| unrestricted\|\| Privacy metadata indicating that the information is not classified as sensitive.
	Examples: Includes publicly available information, e.g., business name, phone, email or physical address.		Examples: Includes publicly available information, e.g., business name, phone, email or physical address.
	Usage Note: This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestricted" to that information even if it is publicly available.		Usage Note: This metadata indicates that the receiver has no obligation to consider additional policies when making access control decisions. Note that in some jurisdictions, personally identifiable information must be protected as confidential, so it would not be appropriate to assign a confidentiality code of "unrestricted" to that information even if it is publicly available.
	\|-		\|-
	\|~~2 \|\|~~ V \|\|very restricted \|\|. Privacy metadata indicating that the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence.		\| V \|\|very restricted \|\|Privacy metadata indicating that the information is extremely sensitive and likely stigmatizing health information that presents a very high risk if disclosed without authorization. This information must be kept in the highest confidence.
	Examples: Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under ~~â€œlegal lockâ€?~~ or attorney-client privilege		Examples: Includes information about a victim of abuse, patient requested information sensitivity, and taboo subjects relating to health status that must be discussed with the patient by an attending provider before sharing with the patient. May also include information held under 'legal lock' or attorney-client privilege. This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject.
	~~Map: This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject~~.
	~~Usage Note:~~ This metadata indicates that the receiver may not disclose this information except as directed by the information custodian, who may be the information subject.
	\|-		\|-
	\|}		\|}