Top of Mind: Heath IT Security and Privacy
Tuesday, April 27, 2010 With the passage of health care reform and its requirements for electronic medical recordkeeping and information exchange, the security and privacy of the medical records of individuals and organizations nationwide will become more of an issue and concern than ever.
At the recent Healthcare Information Management Systems Society (HIMSS) conference in Atlanta, the current thinking about the security and privacy of the Nationwide Health Information Network (NHIN) was explored by Capto’s health IT expert Nick Vennaro, who is deeply involved in the design and development of the NHIN architecture.
NHIN, a Department of Health and Human Services, is at the center of the various initiatives surrounding health care and IT services. The NHIN is a set of standards, services and policies that enable health information to be securely exchanged over the Internet. Once fully implemented, the NHIN will provide a foundation for the exchange of health information between diverse entities, within communities and across the country, helping to achieve the goals of the Health Information Technology for Economic and Clinical Health (HITECH) program, which provides various funding opportunities to advance health information technology.
Nick, working within the Office of the National Coordinator for Health IT, is a principle architect on the NHIN. The work group is developing recommendations for extending the secure exchange of health information using NHIN standards, services and policies to the broadest audience possible. In his presentation at HIMSS Nick explained that NHIN is not a database – no healthcare information is stored here; the network is rather the zone for transporting health information between gateways, the NHIN provides security certificates, a services registry, membership agreements and a test environment for candidate participants.
Security elements of the NHIN will include: Managed PKI (Public Key Infrastructure) to provide message encryption between gateways insuring message confidentiality and encryption.
Security infrastructure factors outlined by Vennaro will also include:
- Security guidelines – the industry standard best practices that should be adhered to by NHIN participants. According to Nick, these will be non-binding.
- mPKI software/services to manage SSL certificates.
- A UDDI (Universal Description Discovery and Integration) services registry to look up who is participating and the services they support, is maintained by NHIN.
- Conformance and interoperability testing environments: The NHIN provides a platforms and scripts to test participant software, to ensure their gateway conforms to specifications and can run through basic business use cases.
- In addition the Data Use Reciprocal Support Agreement (DURSA) will become part of “the chain of trust,” Nick said, and will provide a legal framework for NHIN participation, confidentiality, performance and data use.
Download Nick's presentation from here.
Link to additional info from the conference here.
Applications 










