Patient with Lab and Referral Use Case

Full Title of Use Case

Patient at private care provider is given a lab test which results to a referral to a different practice.

Context

To provide good assurance that a patient data is kept as private as possible consistent with quality health care.

Goal

The patient in the very near future has full capability to exercise their right to participate in the care plan and see who has access to their medical records.

Actors

1. Patient
2. Provider of patient's general health care
3. Lab to perform test on patient sample
4. Provider of specialized services related to patient diagnosis

Preconditions

1. The patient is "known to the practice" where general health care is provided.
2. A trust registry exists which the patient knows and trusts.
3. The providers of health care and lab services present the patient with a trusted identity which confirms that they subscribe to the privacy regulations of the trust provider.

An optional condition would be for the patient to have a trusted identity in cyberspace that can be used to access their health records at any of their care providers.

Scenarios

Primary Scenario:

1. Patient schedules an appointment with primary care physician and is authenticated at the front desk.
2. Patient see doctor, is reauthenticated and explains symptoms.
3. Doctor schedules a lab test for a sensitive condition
4. The patient is given a consent receipt that tells the patient the labs trusted identity and adherence with the trust registry conditions for handling patient records.
5. The patient positively gives consent consonant with the receipt by signing a copy and returning to the doctors practice.
6. The patient goes to the lab which gives a trusted identifier to the patient.
7. The patient is authenticated and given the test.
8. The lab has consent and so passes the patient data to the doctor's practice.
9. The doctor asks for patient consent to schedule further diagnostics with a doctor in a different practice.
10. The patient can evaluate that other practice with respect to competence and compliance with appropriate privacy practices.
11. The patient gives consent, schedules a consultation and the lab results are passed to the other practice.
12. The patient receives a consent receipt from the primary doctor as to the transfer of health records to that other practice

Results

Accepted Risks:

1. Data transfers involved work within a framework of trust and mutual understand as to the patient's wishes with respect to care and privacy.

Post Condition:

1. The patient results are available it is assumed that the consent receipt acknowledged that the data would be sent back to the primary care doctor.

Examples:

1. tbd

Dependencies::

1. Web Sites must be trusted before any user information is released.
2. Trust federations can be used to help users make informed decisions.
3. User consent and trust must begin with no user information transferred.
4. Standards exist to collect needed attributes where-ever they may be.

Workflow Diagram

TK