Data Privacy and Security

Abstract

This chapter begins by explaining why health information privacy is important, both to nurses and to patients. The concept of privacy is complex and it is common to think of privacy as interchangeable with security. This is untrue and this chapter will introduce readers to the definitions of privacy, personal health information, health information custodians, and security-related terms such as authentication, authorization, and audit trails. The concept of personal health information (PHI) is explored in relation to its collection, use, disclosure, and retention. The rationale for privacy, implicit and deemed consent, and withholding and revoking consent are also presented. Other approaches to protecting privacy are described, including developing a privacy policy, designating a privacy officer, de-identification of personal information, and pseudonomization. Information security is surveyed, including international standards and current areas of concern. The chapter closes by exploring how nurses can contribute to the protection of privacy.

Glossary

Access control

The identification of users during user registration, the assignment of access privileges that determine which information resources and services these users can access, their subsequent authentication during log in, and their authorisation prior to being granted access to specific services and data

Anonymity

Term used which allows the subjects in a database to remain nameless and unidentified

Audit

Auditing is done by keeping audit log files (sometimes referred to as an audit trail) that record which users have done what (accessed information or performed actions on information on specific patient records) and when (date of access; number of times record was accessed).

Circle of care

A term used which refers to the persons participating in, and the activities related to, the provision of health care to the patient

Consent

An agreement, approval, or permission given voluntarily by a competent person that permits some act(s) for some stated purpose(s). Adapted from Black’s Law Dictionary (9th edition), 2009

GDPR

European General Data Protection Regulation (GDPR), a European Union directive that, 20 years after the Canadian principles were written, expanded upon these privacy principles and added several new principles relevant to healthcare and the protection of personal health information

Health information custodian

A health information custodian (sometimes called a data steward) is an individual or organization that collects, uses, or discloses personal health information for the purposes of patient treatment and care, medical billing, health system planning and management, or health research

PHI

Personal health information

Privacy

The right of individuals and organizations to decide for themselves when, how, and to what extent information about them is transmitted to others NI Conference 2013 Toronto

Pseudonymity

A term used which allows the subjects in a database to be tracked over time while at the same time remaining nameless

Pseudonyms

Term used such as patient x or patient y which are attached to records instead of names, addresses and other public identifiers.

Ransomware

A form of computer virus that encrypts the data in a system to make it inaccessible to the system’s users. System administrators are then met with a ransom demand to unlock the data.

Security

Physical protection of data using such means as firewalls, encryption, user credentials, and other physical means

User authentication

User authorization attempts to securely verify the identify of the person logging into the system

User enrolment

User enrolment registers each person for specific functionality in an online service or computer program within an organization that a registered user is authorized to access. Once enrolled, a user has the authorization to access the relevant data or services. Not all users will have access to all modules or components of a service or program as access is typically based on the “need to know” principle.