WASHINGTON – The Health IT Standards Committee Tuesday endorsed a set of security and privacy standards for electronic health record systems that it said would get progressively tougher without holding back wider health information sharing.

The committee's security and privacy workgroup clarified requirements that electronic health record systems must meet so both vendors and healthcare providers could use a number of access controls in their electronic health record systems and practices by 2011.

Workgroup member David McCallie, vice president for medical informatics at Cerner Corp, made the presentation to the Committee.

McCallie said the standards were designed to ensure that the security of health IT systems is powerful enough to protect health information in a variety of private and public sector settings while at the same time promoting the sharing of records.

For instance, organizations that want to swap information may have differing security and privacy requirements, making it a challenge to exchange data. "If they want to communicate with each other, do we rise to the most stringent system or lower ourselves to the most common denominator?" he said.

The standards under discussion cover access control, authentication, authorization and transmission of health data. The group tried to make the guidance clear enough to make interoperability between organizations a reality, McCallie said.

"Security is a balance between ease-of-use, cost and bullet-proof protection," added John Halamka, MD, vice chairman of the Committee. The workgroup has tried to provide "a rational glide path to increasingly constrained security," he added.

Under the standards approved Tuesday, by 2011 EHR systems would have to meet several standards for access control, including technical requirements of the security and privacy rules of the Health Insurance Portability and Accountability Act's (HIPAA) and the Advanced Encryption Standard.

The HITECH provisions of the economic stimulus legislation toughened HIPAA's security and privacy rules. The standards endorsed today cover the terms of those rules.

Continued on next page...