Privacy and Security Solutions for Interoperable Health Information Exchange

For this project RTI International subcontracted with 33 states and one territory to create the Health Information Security and Privacy Collaboration (HISPC). The subcontractors leveraged input from state leadership and a broad range of stakeholders in health information exchange to assess the variations that exist at the organization level with respect to privacy and security practices and policies - and the legal bases for such practices and policies. The Privacy and Security project played a key role in laying a policy groundwork to support widespread interoperable electronic health information exchange. The assessment of variations in organization-level privacy and security practices and policies, and any related laws and regulations, identified the practices and policies currently in place across a broad array of stakeholders. Practices, policies and related laws were reviewed to assess whether the particular practice, policy, or law posed a challenge to the electronic exchange of health information. The HISPC undertook the following activities: 1) Preserved privacy and security protections in a manner consistent with interoperable health information exchange; 2) Promoted stakeholder identification of practical solutions and implementation strategies through an open and transparent consensus-building process; and 3) Created a knowledge base about privacy and security issues in electronic health information exchange in states and communities that endures to inform future HIE activities.

The HISPC produced several outcomes, including:

• The Interim Assessment of Variation of Business Practices, Policies, and State Law report, a "first look" at the findings of the 34 subcontractors. 
• A national conference where members of the 34 subcontractors assembled to discuss their outcomes. Day 1 included presentations and discussions of the key findings of the interim assessment reports. Day 2 included discussions about next steps and future directions. 
• The Assessment of Variation and Analysis of Solutions report, a final summary of the work produced by the 34 subcontractors. 
• The Final Implementation Plans, a summary of the documents that guided the work of each subcontractor. 
• The Health Information Security and Privacy Collaboration Toolkit, designed to provide others with tools and resources to help facilitate privacy and security when exchanging electronic health information exchange. 
• The Impact Analysis report, analyzes the impact of the HISPC on each participating State and their approach to privacy and security for electronic health information exchange.