Using the attached form fill out the required sections to develop an annotated bibliography for the journal article that you accessed and read this week.  

Annotated Bibliography Worksheet

Student Name:

A. Bibliographical Information:

Author(s) Name:

Title of Article:

Date of Article:

Journal Name:

B. Summary of Article:

C. Evaluation of Article:

D. Reflection on Application to Practice:

Ethics in Information Technology

Chapter 1

An Overview of Ethics

George W. Reynolds

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›

Learning Objectives, Part 1

What is ethics?

What trends have increased the likelihood of unethical behavior?

What is corporate social responsibility, and why is fostering good business ethics important?

© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Learning Objectives, Part 2
What measures can organizations take to improve their business ethics?
How can you include ethical considerations in your decision making?
What trends have increased the risk that information technology will be used in an unethical manner?
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Ethics: A code of behavior defined by the group to which an individual belongs
Morals: Personal principles upon which an individual bases his or her decisions about what is right and what is wrong
Virtue: A habit that inclines people to do what is acceptable
Vice: A habit of unacceptable behavior
What is Ethics?
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
The Relationship Between Ethics and Morals
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Acting in accordance with a personal code of principles
Extending the same respect and consideration that one expects to receive from others
Applying the same moral codes in all situations
Consistency can be difficult to achieve in situations that conflict with one’s moral standards.
Inconsistency also occurs if one applies moral standards differently depending on the situation or people involved.
Integrity
© 2019 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›

Morals Ethics Law
Personal principles an individual uses to determine what is right and what is wrong
Moral acts conform to what an individual believes to be the right thing to do
Code of behavior that is defined by the group to which an individual belongs System of rules, enforced by a set of institutions, that tells us what we can and cannot do
Legal acts are acts that conform to the law

Difference Between Morals, Ethics, and Laws
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›

Legal versus Ethical
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Trends that have increased the risk of unethical behavior:
More complex work environments spanning diverse cultures make it more difficult to apply principles and
codes of ethics consistently.
Today’s challenging economic climate has increased the pressure on organizations to maintain revenue and profits.
Heightened vigilance by employees, shareholders, and regulatory agencies has increased the risk of financial loss and lawsuits for businesses that act unethically.

Ethics in the Business World
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Term used to describe the moral corruption of those in power
Refers to the biblical story of King David, who became corrupted by his power and success
Moral corruption of people in power is often facilitated by a tendency for people to look the other way when their leaders behave inappropriately

Bathsheba Syndrome
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Who Is Responsible for Instances of Misconduct?
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Organization takes responsibility for the impact of its
actions on:
Shareholders
Consumers
Employees
Community
Environment
Suppliers
Supply chain sustainability: A component of CSR focused on developing and maintaining a supply chain that meets the needs of the present without compromising the ability of future generations to meet their needs
Corporate Social Responsibility (CSR)
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Gain the goodwill of the community
Create an organization that operates consistently
Foster good business practices
Protect the organization and its employees from
legal action
Avoid unfavorable publicity
Reasons to Foster Corporate Social
Responsibility and Good Business Ethics
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›

Reducing the Risk of Unethical Behavior
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Employees are willing to seek advice about ethics-related issues.
Employees feel prepared to handle situations that could lead to misconduct.
Employees are rewarded for ethical behavior.
The organization does not reward success obtained through questionable means.
Employees feel positively about their company.

Characteristics of a Successful Ethics Program
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Also called a corporate compliance officer
Provides an organization with vision and leadership in the area of business conduct
Ideally a senior-level manager who reports directly to the CEO
Responsibilities:
Ensuring compliance with ethical procedures
Creating and maintaining the ethics culture envisioned
by the highest level of corporate authority
Serving as the key contact person for ethics issues

Corporate Ethics Officer
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Conduct themselves according to the highest standards of personal and professional integrity
Set the standard for company-wide ethical conduct
Ensure compliance with laws and regulations
Create an environment in which employees can:
Seek advice about business conduct
Raise issues
Report misconduct

Ethical Standards Set by Board of Directors
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
A code of ethics:
Highlights an organization’s key ethical issues
Identifies the overarching values and principles important to the organization and its decision making
Organizational code of ethics should:
Apply to directors, officers, and employees
Focus employees on areas of ethical risk
Offer guidance to help employees recognize and deal with ethical issues
Provide mechanisms for reporting unethical conduct
Foster a culture of honesty and accountability

Corporate Code of Ethics
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Organization reviews its ethical and social responsibility goals, and communicates its goals for the upcoming year.
Information is shared with:
Employees
Investors
Market analysts
Customers
Suppliers
Government agencies
Community

Social Audit
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
A comprehensive ethics education program:
Encourages employees to act ethically
Shows employees examples of how to apply the code of ethics in real life
Goals of ethics training:
Encourage employees to report any misconduct
Show employees effective ways of reporting incidents
Reassure employees that such feedback will be acted on and that they will not be subjected to retaliation
Ethics Training for Employees
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Treating others fairly and with respect
Operating effectively in a multicultural environment
Accepting personal accountability for meeting business needs
Continually developing others and themselves
Operating openly and honestly with suppliers, customers, and other employees
Ethical Criteria in Employee Appraisals
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›

QUESTION YES NO
Does your organization have a code of ethics?
Do employees know how and to whom to report any infractions of the code of ethics?
Do employees feel that they can report violations of the code of ethics safely and without fear of retaliation?
Do employees feel that action will be taken against those who violate the code of ethics?
Do senior managers set an example by communicating the code of ethics and using it in their own decision making?
Do managers evaluate and provide feedback to employees on how they operate with respect to the values and principles in the code of ethics?
Are employees aware of sanctions for breaching the code of ethics?
Do employees use the code of ethics in their decision making?

Manager’s Checklist for Establishing an
Ethical Work Environment
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Develop a problem statement
A clear, concise description of the issue
Don’t make assumptions; verify “facts”
Identify alternatives
Enlist help of others
Choose alternative
Defensible and consistent; consider impact on others
Implement decision
Transition plan
Evaluate results
Poor alternative?
Bad implementation?
Five-Step Ethical Decision-Making Process
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
Surveillance of citizens by governments
Email and Internet access monitoring at work
Music and movies downloaded in violation of
copyright laws
Unsolicited email and text messages
Identify theft by hackers
Plagiarism by students
Cookies and spyware used to track users’ online purchases and activities

Concerns About the Ethical Use of Information Technology
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
What is ethics?
Ethics: A code of behavior defined by the group to which one belongs
Morals: Personal principles upon which an individual bases decisions about right and wrong
A person who acts with integrity acts in accordance with a personal code of principles.
Law: A system of rules that tells us what we can and
cannot do
Code of ethics: States the principles and core values essential to one’s work
An activity may be legal but still not be ethical.
Summary, Part 1
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
What trends have increased the likelihood of unethical behavior?
More complex work environments make it more difficult to apply principles and codes of ethics consistently.
Organizations may resort to unethical behavior to maintain profits in an uncertain economic climate.
Highly successful individuals may fail to act in morally appropriate ways.
Summary, Part 2
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
What is corporate social responsibility (CSR), and why is fostering good business ethics important?
CSR: An organization takes responsibility for the impact
of its actions
Supply chain sustainability: Meets current needs without compromising the ability of future generations to meet
their needs
Reasons to foster CSR and good business ethics:
Gain the goodwill of the community
Create an organization that operates consistently
Foster good business practices
Protect the organization and employees from legal action
Avoid unfavorable publicity

Summary, Part 3
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
What measures can organizations take to improve their business ethics?
Appoint a corporate ethics officer.
Require the board of directors to set and model high
ethical standards.
Establish a corporate code of ethics.
Conduct social audits.
Require employees to take ethics training.
Include ethical criteria in employee appraisals.
Create and ethical work environment.

Summary, Part 4
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
How can you include ethical considerations in your decision making?
Use a five-step model for decision making:
Define the problem
Identify alternatives
Choose an alternative
Implement the decision
Monitor the results
Incorporate ethical considerations into decision making:
Weigh laws, guidelines, and principals.
Consider the impact of the decision.
Summary, Part 5
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›
What trends have increased the risk that information technology will be used in an unethical manner?
The growth of the Internet and social networks
The ability to capture, store, and analyze vast amounts
of personal data
A greater reliance on information systems in all aspects
of life
The importance of ethics and human values has been underemphasized

Summary, Part 6
© 2019 Cengage. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part, except for use as permitted in a license distributed with a certain product or service or otherwise on a password-protected website for classroom use.

‹#›

Chapter 2: Introduction to the Fundamentals of

Law

Fundamentals of Law for Health Informatics and Information Management, Third Edition

© 2017 American Health Information Management Association

© 2017 American Health Information Management Association

Law and

Ethics

Law
Ethics

Moral values

Applied ethics

Medical ethics

Professional ethics

Bioethics

© 2017 American Health Information Management Association
Ethics in Healthcare
HIM and informatics professionals have an ethical responsibility to
Patients
The profession
Their employers
Patient rights
Privacy
Confidentiality
Unethical behavior can have same repercussions as illegal behavior

© 2017 American Health Information Management Association
Ethical Theories
Utilitarianism—Best option in any decision is based on which choice provides greatest advantage or benefits the greatest number of people
Deontology—Duty-based ethics
Individuals should be ethical because it is their duty

© 2017 American Health Information Management Association
Ethical Theories (continued)
Right-based ethics—The primary goal of decision making should be maintaining the rights of every individual
Virtue-based ethics—Seeking the good life. An individual’s positive moral principles lead them to do positive things

© 2017 American Health Information Management Association
Ethical Principles
Autonomy—Recognizing the right of a person to make one’s own decision
Beneficence—Doing good, promoting the health and welfare of others, demonstrating kindness, showing compassion, and helping others
Nonmaleficence—Do no harm
Justice—Obligation to be fair in the distribution of benefits and risks

© 2017 American Health Information Management Association
Examples of Ethical Principles
Autonomy requires HIM professional to ensure patient, and not a spouse or third party, makes decision regarding access to his or her health information.
Beneficence requires the HIM professional to ensure information is released only to individuals who need it to do something that will benefit patient (payment for an insurance claim).
Nonmaleficence requires the HIM professional to ensure the information is not released to someone who does not have authorization to access it and who might harm patient if access were permitted (newspaper seeking information about a famous person).
Justice requires HIM professional to apply the rules fairly and consistently for all and not to make special exceptions based on personal or organizational perspectives.

© 2017 American Health Information Management Association
Professionalism
Professionalism—The qualities that characterize a particular profession
Changes based on age, education, position, or work setting
Conflict of interest—When a conflict arises between personal interests and official responsibilities or duties
Often occurs when an individual has power to make decisions involving finances or the opportunity for financial gain

© 2017 American Health Information Management Association
Professional Code of Ethics
Reflects the values and principles defined by a profession as acceptable behavior within a practice setting
Guiding principles by which a profession governs the conduct of its members
Used as a benchmark for what constitutes acceptable practice in malpractice, negligence, or other litigious situations
Dynamic in that they change as societal and practice expectations change

© 2017 American Health Information Management Association
Examples of Professional Codes of Ethics to Protect Health Information
American Medical Association (AMA)
Code of Medical Ethics Principle IV of the code states: “A physician shall respect the rights of patients, colleagues, and other health professionals, and shall safeguard patient confidences and privacy within the constraints of the law.”
Chapter 3 specifically addresses privacy, confidentiality, and medical records including electronic data

© 2017 American Health Information Management Association
Examples of Professional Codes of Ethics to Protect Health Information (continued)
American Health Information Management Association (AHIMA)
The Code of Ethics are Tenets I, III, and IV that specifically address protecting the privacy and confidentiality of health information and records (see figure 2.2)
The Health Information Bill of Rights for protecting healthcare consumers lists seven measures designed to
Safeguard an individual’s right to lawful access of their personal health information
Prevent unauthorized access to that information
Promote its best possible accuracy
Seek proper remedy when any such privilege is violated

© 2017 American Health Information Management Association
Examples of Professional Codes of Ethics to Protect Health Information (continued)
American Medical Informatics Association (AMIA)
The Code of Professional Ethical Conduct specifically addresses use of patient information in its first ethical guideline and also offers ethical guidance as related to patients, employers, colleagues, society, research and general performance (see figure 2.3)
Addresses ethical issues of vendor-user contracts related to EHR systems, associated devices and health-related software applications

© 2017 American Health Information Management Association
Ethics Committee
Provides a standardized approach to ethical decision making in the healthcare organization
Members analyze ethical decisions and make recommendations
Must take into consideration the mission and vision of the healthcare organization as well as any applicable laws and regulations

© 2017 American Health Information Management Association
Making Ethical Decisions
7 step ethical decision making model
Define the problem
Seek out relevant assistance, guidance and support
Identify alternatives
Evaluate the alternatives
Make the decision
Implement the decision
Evaluate the decision

© 2017 American Health Information Management Association
Making Ethical Decisions
3 step Blanchard-Peale ethics check
Is it legal?
Is It balanced?
How will it make me feel about myself?

© 2017 American Health Information Management Association
Bioethics
When ethical issues arise as a result of advancements in technology leading to disease detection, medication interventions, and enhanced treatments
Often subject of much debate as the fields of biology and technology intertwine
Dilemmas often are seen in beginning and end of life stages of treatment

© 2017 American Health Information Management Association
Bioethics—Beginning of Life
Procreation—The beginning of life
Many ethical issues surround the creation of life
In vitro fertilization
Embryonic stem cell research
Contraception and sterilization

© 2017 American Health Information Management Association
Bioethics—End of Life
End of Life often presents ethical issues in terms of:
Terminal patients who wish to forgo treatment
Hospice care—Palliative care to make terminally ill patients more comfortable
Euthanasia
Conflict between a patient’s wishes and their family or loved ones’ wishes

© 2017 American Health Information Management Association
Bioethics—Genetics
Technology has advanced the discovery of genetic codes and research focuses on identification of diseases at the genetic level
Gene testing and gene therapy can be ethically challenging for patients and families
Production of more genetic information requires additional protection of that specific data

© 2017 American Health Information Management Association
Law and Ethics
Professional codes of ethics impose a duty on healthcare professionals to conform to professional standards of practice.
As patients and professionals are presented with ethical decisions, utilizing standardized decision making models can be beneficial in considering all influences, avenues, and barriers to make the best decision.
Advancements in science and technology now and in the future continue to create ethical issues for both patients as well as HIM professionals.

© 2017 American Health Information Management Association

Annotated Bibliography Rubric

50 Pts

Exemplary

Developing

Needs Improvement

Written Criteria

10 Points

7 Points

4 Points

Faculty Comments

Bibliographical Information 

Bibliographical information is accurately stated and formatted.

Bibliographical information contains 2-3 errors.

Bibliographical information contains more than 3 errors.

Summary of Article 

Article is concisely summarized in one paragraph with no more than one error

Article is more than one paragraph with one error

Article exceeds one paragraph and has more than 2 errors.

Evaluation of Article

Article is evaluated in light of its purpose and credibility

Evaluation is loosely based on evidence but well organized

Evaluation does not relate to purpose of article and is not evidence-based.

Reflection on Application to Practice

Reflection contains reference to application to current of future practice merits or lack of merit.

Reflection is vague and only loosely related to current or future practice.

Reflection does not connect merit or lack of merit to practice.

Grammar, Syntax, APA Format

APA format, grammar, spelling, and/or punctuation are accurate, or with zero to three errors.

Four to six errors in APA format, grammar, spelling, and syntax noted.

Paper contains greater than six errors in APA format, grammar, spelling, and/or punctuation or repeatedly makes the same errors after faculty feedback.

Chapter 1: Introduction to the Fundamentals of

Law

Fundamentals of Law for Health Informatics and Information Management, Third Edition

© 2017 American Health Information Management Association

© 2017 American Health Information Management Association

Defining Law

Law

Represents a set of governing rules designed to protect citizens living in a civilized society

Establishes order, provides parameters for conduct, and defines rights and obligations of government and its citizens

Controls behavior that threatens public safety and sets penalties for disobedience

© 2017 American Health Information Management Association
Two Types of Law
Public law
Involves federal, state, and local governments
Defines, regulates, and enforces rights and duties among individuals and businesses as related to government.
Private law
Involves rules and principles that defines rights and duties among individuals and private businesses

© 2017 American Health Information Management Association
Law and Healthcare
US healthcare is a trillion-dollar business regulated by federal and state laws, accrediting bodies, practice standards, and codes of ethics
Serves to protect consumers and providers by requiring accountability for services and privacy, confidentiality, and security of health information

© 2017 American Health Information Management Association
Law and Health Information
Health information
Data generated and collected as a result of delivering care to a patient
Uses of health information
Primary use—clinical care
Secondary uses—public health reporting, population health management, third-party reimbursement, quality improvement, and patient safety
Used as evidence in legal cases in which conflict arises and resolutions is sought through the court system

© 2017 American Health Information Management Association
Health Information
Protected under federal law—HIPAA,
defines health information as:
“It is any information, whether oral or recorded in any form or medium, that: (1) is created or received by a health care provider, health plan, public health authority, employer, life insurer, school or university, or health care clearinghouse; and (2) relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual” (45 CFR 160.103).

© 2017 American Health Information Management Association
Health Information Technology
Push to decrease healthcare costs and improve quality and safety of healthcare through use of health information technology (HIT)
Movement from paper to electronic health records (EHRs) and health information exchanges (HIE) that enable the sharing of information with multiple parties and across multiple boundaries

© 2017 American Health Information Management Association
Law and HIT
Public and private collaborations are working together to eliminate legal barriers for sharing electronically stored health information
Example: National Governors Association— roadmap to help states improve health information flow

© 2017 American Health Information Management Association
Health Records
Health information comprises a health record which is defined as:
“Individually identifiable data, in any medium, that are collected, processed, stored, displayed, and used by healthcare professionals” (AHIMA 2010)

© 2017 American Health Information Management Association
Types of Health Records
Hybrid health record
Electronic health record
Electronic medical record
Personal health record

© 2017 American Health Information Management Association
Hybrid Health Record
Record that consists of both paper and electronic records and media (for example, film, video, or imaging system) and uses both manual and electronic processes
Data in the record may be handwritten, direct voice entry captured in a word-processing system, or from provider wireless devices such as handheld personal computers

© 2017 American Health Information Management Association
Electronic Health Record
“An electronic record of health-related information on an individual that conforms to nationally recognized interoperability standards and that can be created, managed, and consulted by authorized clinicians and staff across more than one healthcare organization.” The National Alliance for Health Information Technology (NAHIT) definition

© 2017 American Health Information Management Association
Electronic Medical Record
“An electronic record of health-related information on an individual that can be created, gathered, managed, and consulted by authorized clinicians and staff within one healthcare organization” The National Alliance for Health Information Technology definition

© 2017 American Health Information Management Association
Personal Health Record
“An electronic record of health-related information on an individual that conforms to nationally recognized interoperability standards and that can be drawn from multiple sources while being managed, shared, and controlled by the individual” The National Alliance for Health Information Technology definition

© 2017 American Health Information Management Association
Protection of Health Information and Health Records
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Privacy Rule in effect 2002
Security Rule in effect 2003
Health Information Technology for Economic and Clinical Health Act (HITECH) of the American Reinvestment and Recovery Act of 2009 (ARRA)

© 2017 American Health Information Management Association

Privacy and Confidentiality of Health Information
Historically key components of the patient-provider relationship.
Inherent trust that patient information will be kept private and protected from unauthorized access.
It is important to understand differences between privacy, confidentiality, and security and how the concepts relate to law

© 2017 American Health Information Management Association
Privacy
Privacy is an important social value; it means “a right to be left alone.”
Definitions
“Privacy is a right of individuals to be let [sic] alone and to be protected against physical or psychological invasion or the misuse of their property. It includes freedom from intrusion or observation into one’s private affairs, the right to maintain control over certain personal information, and the freedom to act without outside interference” (ASTM 2010)
“Right to limit the disclosure of personal information” (Joint Commission 2016)

© 2017 American Health Information Management Association

17

Confidentiality
Results from sharing private thoughts with someone else in confidence
Definitions
“Status accorded to data or information indicating that it is sensitive for some reason, and therefore it needs to be protected against theft, disclosure, or improper use, or both, and must be disseminated only to authorized individuals or organizations with a need to know” (ASTM 2010)
“Protection of data or information from being made available or disclosed to an unauthorized person(s) or process(es)” (The Joint Commission 2016)

© 2017 American Health Information Management Association
Confidentiality (continued)
Privileged communication
Confidentiality, as recognized by law, stems from a relationship where information is shared between two parties such as attorney and client, clergy and parishioner, husband and wife, or physician and patient. The information or communication shared in these relationships is considered “privileged.”
Confidentiality obligates healthcare providers (individuals and organizations) to protect patient information

© 2017 American Health Information Management Association
Security
Relates to privacy and confidentiality
Pertains to the physical and electronic protection of information that preserves these concepts
Definition
“Prevent unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system” (Joint Commission 2016)

© 2017 American Health Information Management Association
Security (continued)
ASTM E 31 offers two perspectives
Data security
Systems security

© 2017 American Health Information Management Association
ASTM E 31—Data Security
Data security is defined as
“The result of effective data protection measures; the sum of measures that safeguard data and computer programs from undesired occurrences and exposure to accidental or intentional access or disclosure to unauthorized persons, or a combination thereof; accidental or malicious alteration; unauthorized copying; or loss by theft or destruction by hardware failures, software deficiencies, operating mistakes; physical damage by fire, water, smoke, excessive temperature, electrical failure or sabotage; or a combination thereof. Data security exists when data are protected from accidental or intentional disclosure to unauthorized persons and from unauthorized or accidental alteration” (ASTM 2010).

© 2017 American Health Information Management Association
ASTM E 31—System Security
System security is defined as
The totality of safeguards including hardware, software, personnel policies, information practice policies, disaster preparedness, and oversight of these components. Security protects both the system and the information contained within from unauthorized access from without and from misuse from within. Security enables the entity or system to protect the confidential information it stores from unauthorized access, disclosure, or misuse, thereby protecting the privacy of the individuals who are the subjects of the stored information” (ASTM 2010).

© 2017 American Health Information Management Association
US Code on Information Security
Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide
Integrity, which means guarding against improper information modifications or destruction, and includes ensuring information non-repudiation and authenticity
Confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and propriety information
Availability, which means ensuring timely and reliable access to and use of information

© 2017 American Health Information Management Association
Ownership of Health Record
Ownership of the health record
Traditionally granted to healthcare provider who generates the record. However, state and federal laws have long upheld the right of the patient to control the information within the record
The HIPAA Privacy Rule (45 CFR 164.524–526) grants a patient the right to access, view, copy, or amend the record.
Ownership does not permit providers to share or sell patient-identifiable medical information as they wish.

© 2017 American Health Information Management Association

Custodian of Health Records
“Individual who has been designated as having responsibility for the care, custody, control, and proper safekeeping and disclosure of health records for such persons or institutions that prepare and maintain records of healthcare” (AHIMA 2010)
Role of custodian = gatekeeper

© 2017 American Health Information Management Association
Stewardship
Similar to role of custodianship
Goes beyond physical record to include
“Responsibilities for ensuring integrity (accuracy, completeness, timeliness) and security (protection of privacy as well as from tampering, loss or destruction) within the context of electronic information and records management” (Davidson 2010)

© 2017 American Health Information Management Association
Information Governance
Stewardship as a component of information governance which is the “strategic management of enterprise electronic information including the standards, policies, and procedures for access, use, and control of that information” (Johns 2015)

© 2017 American Health Information Management Association
Stewardship and Governance
Role of steward requires leadership, responsibility and governance to ensure consistent application of, and compliance with policies across organization-wide distributed information systems.

© 2017 American Health Information Management Association