Confidentiality Codes Refactored

1. Confidentiality Codes Refactored Kathleen Connor Eversolve

2. Problem Statement • The current HL7 Confidentiality Code System is overloading the coded attributes of confidentiality • Current Confidentiality Codes mix: • Privacy Policy Codes about how Sensitive Information must be handled with • Metadata tags (data about data content) used to convey Information Sender and Receiver responsibilities to prevent unauthorized use or disclosure • Without guidance on the intended use of these metadata tags, implementers may mistakenly applying Privacy Policy and Sensitive Information Codes as metadata on protected information • On external wrappers used as transport information in exchange • On document headers for use by records management systems/repositories • As a result, they may be breaching protected information by disclosing the sensitive nature of that information to unauthorized Receivers

3. Happy News • Refactored Confidentiality Codes fit seamlessly into the Composite Security and Privacy DAM with minimal changes • This should be considered validation of that good work • Proposed changes specify • Sender responsibility to ensure that protected information is handled in accordance with Privacy Policies • Receiver responsibility for handling protected information the Sender is authorized to disclose • Interoperable and policy driven Confidentiality Codes that reduce the need for point to point negotiation when exchanging information

4. Proposed Changes to the DAM • Refactors current Confidentiality Code System • Reason: Multiple Axes that blend internal Privacy Policies with Role and User base Access and interoperable Confidentiality Codes • Defines new interoperable Confidentiality Codes • Specifies Receiver responsibilities for information being exchanged • Limited set of codes that convey general information handling rules • Convey sensitivity levels without disclosing why the information is or is not sensitive • Relocates Sensitive Information Codes to ActPrivacyPolicyType value set • Sensitive Information Codes represent a type of Organizational Privacy Policy • Like Jurisdictional Privacy Policies, these are implemented in a Policy Information Point to inform the Policy Decision Point • Adds Information Subject Authorization to Disclose • Consent Directives - specify disclosures that are more restrictive than generally applicable Jurisdictional Health Privacy Policies • Authorizations to Disclose - specify disclosures less restrictive than generally applicable Jurisdictional Health Privacy Policies

5. Current HL7 Confidentiality Code Concept Domains Current Confidentiality Codes Relationships

6. Disambiguating Confidentiality and Sensitivity • Definition of these concepts are often intertwined, and usage is not clearly orthogonal in many contexts • Healthcare differentiate these because of heightened Privacy concerns • Confidentiality is a security concept • How information is treated • Who can know and what they can do with it • Has no necessary bearing on social values • ISO 7498-2:1989 - Confidentiality is the property that information is not made available or disclosed to unauthorized individuals, entities, or processes • Sensitivity is a social perception concept • How information is regarded socially • What others will think about and act on the information • How that “social” perception and resulting reaction will impact the information subject and/or owner • ISO7498-2:1989 - Sensitivity is the characteristic of a resource which implies its value or importance and may include its vulnerability

7. Confidentiality – Sensitivity Matrix

8. ActPrivacyPolicyType

9. Vocabulary Changes to Support Use Cases • Added attribute to Privacy Policy that designates which Privacy Policy • May leverage existing HL7 vocabulary Act.code concept domain “ActPrivacyPolicyType” • Proposed Vocabulary includes: • ActPrivacyLaw – with example codes representing e.g., 42 CFR Part 2 and HIPAA • Sensitivity - • Defined as policies shared by a policy domain relating to sensitivity of information • Leverages ISO7498-2:1989 definition: Sensitivity is the characteristic of a resource which implies its value or importance and may include its vulnerability • Example codes from the ConfidentialityModifiers and ConfidentialityByInfoType and proposed codes for Use Case discovered gaps such as Sensitive Service Provider and Employee

10. Relocated Sensitive Information Codes Relocates Sensitive Information Codes from AccessByInfoType and Confidentiality Modifiers to the ActPrivacyPolicyType value set No impact on earlier models which will reference current Confidentiality Code System No impact on CDA which only uses Normal, Restricted, and Very Restricted Future models that use ActPrivacyPolicyCodes can target classes with a Comply relationship to an ActClassPolicy

11. Refactored Confidentiality Codes

12. Refactored Confidentiality Codes

13. Proposed Refactoring

14. Next Steps – Prepare Harmonization Proposal • UPCOMING HARMONIZATION MTGS • Harmonization Conference Call • Nov 15, 2011 to Nov 18, 2011Add to Outlook Calendar • Templates and Examples • Download Harmonization Proposal Template/Example • Initial Proposals • Submissions due 10/16/2011, midnight Eastern Final Proposals Submissions due 11/06/2011, midnight Eastern View/Upload Proposals View/Upload Proposals Policy and Procedural Excerpts Harmonization Process Overview <http://www.hl7.org/events/harmonization/index.cfm>

16. Annex Compares Current and Proposed Vocabulary

17. Confidentiality Code System Definition Current Definition of Confidentiality New Definition of Confidentiality Description: Values that control disclosure of information. Example: Normal, restricted, substance abuse related. Definition: The property that information is not made available or disclosed to unauthorized individuals, entities, or processes [ISO 7498-2:1989] Description: The codes in the Confidentiality code system are values that control the availability and disclosure of information. The confidentiality code assigned by an information sender (per policies intended by the custodian) that convey receiver obligation to ensure that the information is not made available or redisclosure to unauthorized individuals, entities, or processes (security principals). The receiver may on grant authorized principals access to the minimum necessary for the purpose of use intended by the sender. The receiver must grant principals permission to perform approved operations on the information object. (See the HL7 Healthcare Permission Catalog for further details and the definitions of permission, operations and object.)

18. Proposed & Current Confidentiality Code Definitions