Information security and privacy in the healthcare sector is an issue of growing importance. The adoption of digital patient records, increased regulation, provider consolidation and the increasing need for information exchange between patients, providers and payers, all point towards the need for better information security. We critically survey the literature on information security and privacy in healthcare, published in information systems journals as well as many other related disciplines including health informatics, public health, law, medicine, the trade press and industry reports. In this paper, we provide a holistic view of the recent research and suggest new areas of interest to the information systems community.

http://www.mathcs.emory.edu/~lxiong/cs573_s12/share/slides/501.pdf

Information security and privacy in healthcare: current state of research

Throughout the world, sensitive personal information is now protected by regulatory requirements that have translated into significant new compliance oversight responsibilities for IT managers who ...

/pdf/the-influence-of-the-informal-social-learning-environment-on-3nlezqkyzf.pdf

The influence of the informal social learning environment on information privacy policy compliance efficacy and intention

This paper provides an overview of the challenges raised by concerns about data confidentiality in the context of health services research as well as the current environment and the significant issues raised by the advent of new electronic data systems and data linkage technologies. It describes the current methodologies used to ensure data security and privacy together with the impact on data analysis. It argues that the current data access modalities are insufficient to allow a response to the current national need for evidence-based research and provides an overview of successful approaches used in other contexts. It makes three recommendations to improve data access, thus improving data utility without affecting data confidentiality.

Balancing Access to Health Data and Privacy: A Review of the Issues and Approaches for the Future

One would think that the enactment of the HIPAA and associated mandates on data security and privacy has brought a major shift in the information security management practices across the US healthcare sector. Unfortunately, recent industry reports indicate substantially low level of regulatory compliance, thus raising security concerns to US health IT infrastructure. This research develops a regulatory compliance model by drawing insights from institutional theory literature to identify the key drivers influencing compliance, both institutional and market forces e.g. mix of state and federal privacy regulations, pressure from compliance leaders in the region, and the consumer demand for privacy among others. The primary contribution of this research lies in the novel application of institutional theory to explain the variability in regulatory compliance prevalent in the US healthcare sector.

https://aisel.aisnet.org/cgi/viewcontent.cgi?article=1268&context=amcis2009

HIPAA compliance: An institutional theory perspective

Resuscitation research is challenging but vital because few effective therapies exist for a number of life-threatening conditions. Cardiovascular disease has been a leading cause of death and morbidity in the United States. Although estimates vary, the American Heart Association estimates >150 000 out-of-hospital cardiac arrests each year in the United States,1 with little improvement in survival (≈5%) despite medical advances.2 Traumatic injury, resulting in severe hemorrhagic shock or traumatic brain injury, is the leading cause of death in persons 1 to 44 years of age and is a leading cause of morbidity.3 For treatments to be effective in these life-threatening situations, they must be administered immediately, usually at the site of the event.4 Consequently, researchers and regulatory agencies find that typical standards for informed consent cannot be applied in the emergency setting.

In 2004, the National Heart, Lung and Blood Institute organized the Resuscitation Outcomes Consortium (ROC) to conduct simultaneous prehospital studies of novel therapies for trauma and cardiac arrest. The consortium consists of 11 regional centers in the United States and Canada and a data coordinating center.

It was anticipated that these trials would require extra effort from a regulatory perspective because of the need to administer treatments during a relatively brief therapeutic window, making the standard practice of obtaining informed consent from the subjects before enrollment impossible. Because of the nature of the medical conditions being studied, the potential subjects would not be competent to consent. In addition, surrogate decision makers are not commonly available at the scene, and when they are, the emotional nature of the situation makes obtaining consent infeasible.5,6 These challenges are compounded in a trial involving multiple emergency medical services (EMS) systems and hospitals within each regional center. Finally, such trials may be logistically challenging because of the need …

Regulatory Challenges for the Resuscitation Outcomes Consortium

Although many perspectives on the impact of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) on health services research have been wide spread, little empirical evidence has been reported about HIPAA-related barriers during the implementation of research projects. Using three cases of health services research projects, this study examined practical barriers created by HIPAA regulation. During the stage of implementation of the three projects, we experienced some HIPAA-related concerns, previously raised in the field of health services research. We found that technically complicated consent forms and privacy protection forms as well as socially-sensitive clinical conditions make patients less willing to participate in research projects; concerns about safety of patient medical information makes health organizations more hesitant to let researchers have access to the patient's information, especially through electronic transfer; more restrictive IRB processes and challenging patient recruiting processes make health services researchers reluctant to go through the process; and as a result, they may compromise with the scientific soundness of the project. Overall, HIPAA complicates the research process and requires more resources and longer time to conduct research.

Amy Malone

Papers

Barriers of HIPAA Regulation to Implementation of Health Services Research