This issue raises the thorny problem of Healthcare Security Policy, the nub of which is to specify a policy which, verifiably, satisfies ALL of the following criteria: (a) no item of patient data may be disclosed to any party to whom the patient denies it; (b) any clinician with responsibility for the healthcare of the patient must have access to all patient data relevant to that care; (c) all accesses to patient records, and all records granting and rescinding such access, must be recorded in audit trails for eventual use in either the defence or the prosecution of malpractice suits. As well as being extremely topical in the UK, given the recent data loss in the NHS, it has been a serious problem for much longer. In 1996, Ross Anderson famously reported that the NHS's enormously expensive networking plans could not be shown to satisfy a dozen or so requirements of this nature, a report that led the BMA to advise its members not to transmit any patient data on that network. In the same year, I constructed a formal, set-theoretic model of most of these constraints (see http://www.soi.city.ac.uk/~bernie/hsp.pdf). I submitted it for publication in a Healthcare Security Conference, where it was rejected by a panel including Ross Anderson. At that time, emotions were running high and the very idea of a networked EPR raised fears of security breaches that could not be addressed rationally. Also, to the healthcare community at that time, any attempt to address such issues mathematically was anathema. Perhaps times have changed. If anyone would like to explore the continued development and validation of such a formal model, I would be happy to help.
Quoting JP Freriks <jpfreriks at gmail.com>: > There are some things I would like to add to my last posting: > > 1. 'Author Access Control' is the concept I believe we're talking > about (instead of Author Mandate). /Although the two concepts are > related./ > This doesn't imply at all that a patient cannot request to see > the 'private' information. It is the author that must hand over > the info, so the author has the access control. Now, the > 'architecture overview' document section 7 only / mostly(?) speaks > about patient access control. > > 2. I think that there's agreement on the desirability on having > author acces control modelled in the open EHR architecture. Arguments: > > 1. It's advisable to put all possible requirements in, even > when some countries have the policy not to accomandate for > private notes. Policies change. (see Dipak's contribution). > And allready it seems to be normal policy in Germany (as > Karsten pointed out). > 2. Plus: private comments are part of the health care proces > (as many of you pointed out). Health care providers want to > make comments, or put in reminders that shouldn't be > disclosed to a patient instantly. These comments need to be > recorded too, connected to (or part of?) the patients record. > > /And I think also in the EHR, because (as Gerard pointed > out) when a patient requests it these comments must be > shown. So they must be sharable. And some comments (like the > ones Shinji mentioned) want to be shared amongst healt > ptoviders. What other place should it be recorded than > within the EHR? [As I understand it, the EHR is the whole > complex of medical information, with the EPR being a subpart > of it. Is this correct?] > > / > 3. There are different types of information that under certain > circumstances must become/remain inaccessible to the patient. What > types, according to which situations can be distinguished? > There's info that is part of the medical record but can become > inaccessible (when requested by the patient, for instance), and > there are working notes of the physician that aren't part of the EPR? > > /I guess (since I don't have a copy of it) that this is all in// > CEN 13606 part 4? > > - /Should stuff like working notes be accomodated for by > openEHR, or is this something extra to it, supplied for by > applications? > > 4. It's good to differentiate between: > 1) clinical management policies and information management policies; > 2) the definition of these policies and their use, and their > implementation; > 3) between a faithfull representation of (inter)national policies, > and the representation of the domain of plausible access policy > decisions (rules) in as generic and interoperable way as possible. > (Dipak) > > 5. The question remains on how author access control should be > covered by openEHR. > > 1. There is an existing standard (EN 13606 Part 4) that is 'a > logical model to represent the domain of plausible access > policy decisions (rules)' (Dipak) and covers '95% of all use > cases' (Gerard). Are there any objections on using this > standard within openEHR? > 2. What is the best way to handle access control? By creating > an Access Control Archetype or templates (as Gerard > suggests), or by modelling it as meta-data in the Reference > Model (as Ian suggests)? Or by security components / > Desktop, Networks, Applications, Service? > > /I think author comments should have a different status than > objective patient information. It seems better to provide > for this by adding an author controlled comment section > separately to the EPR part. This means that it would be > better to create archetyped meta-data in the RM, and not on > ENTRY level. Does this line of thinking make sense? > > / > 6. How to go from here? > > 1. The Architecture Overview chapter 7 treats access control > mainly as patient access control. (That's where ROLE comes > in.) We want a section speaking about author control, too? > 2. Will openEHR pick our 'recommendations' up, or should we > make an official request? > 3. Is there a committe that does the 'official' thinking, or > are we, as the community, doing that? > 4. Would it be advisable to form some sort of working group, > getting other people (specialists) involved too? (like Ian's > contact). > > > Best wishes, > > Josina > -- __ Prof Bernard Cohen, Dept of Comp Sc, City Univ, Northampton Sq. London EC1V 0HB tel: ++44-20-7040-8448 fax: ++44-20-7040-8587 b.cohen at city.ac.uk WWW: http://www.soi.city.ac.uk/~bernie "Patterns lively of the things rehearsed" ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program. ----- End forwarded message ----- -- __ Prof Bernard Cohen, Dept of Comp Sc, City Univ, Northampton Sq. London EC1V 0HB tel: ++44-20-7040-8448 fax: ++44-20-7040-8587 b.cohen at city.ac.uk WWW: http://www.soi.city.ac.uk/~bernie "Patterns lively of the things rehearsed" ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.
