Third Party Registry: Difference between revisions
No edit summary |
No edit summary |
||
Line 38: | Line 38: | ||
==Policy== | ==Policy== | ||
The following serve as the guiding principles to follow when selecting a third-party vendor: | The following serve as the guiding principles to follow when selecting a third-party vendor: | ||
#Organizational Goals - the envisioned goals of the submission | #Organizational Goals - the envisioned goals of the submission shall be clearly documented and communicated to assess the benefits versus risks to form a recommendation on why the submission shall proceed. | ||
##Incentive Bonus - The amount the payer will increase payment if organization participates in the registry and the date required to submit to achieve. | ##Incentive Bonus - The amount the payer will increase payment if organization participates in the registry and the date required to submit to achieve. | ||
##Penalty Avoidance - The amount payer will decrease payment if organization does not participate in the registry and date required to submit to avoid penalty. | ##Penalty Avoidance - The amount payer will decrease payment if organization does not participate in the registry and date required to submit to avoid penalty. | ||
Line 57: | Line 57: | ||
###Must comply with File Transfer of Confidential Information Guidelines | ###Must comply with File Transfer of Confidential Information Guidelines | ||
##Access to the system needs to use user authentication through integration with Active Directory or LDAP | ##Access to the system needs to use user authentication through integration with Active Directory or LDAP | ||
##Transferred and stored data shall not be portable and there | ##Transferred and stored data shall not be portable and there shall be restrictions on the usage of portable storage methods like USB drives or exports to flat files | ||
##The vendor shall provide appropriate cyber liability coverage that covers the Organization in the event of a security or privacy breach and shall provide coverage for the following scenarios: | ##The vendor shall provide appropriate cyber liability coverage that covers the Organization in the event of a security or privacy breach and shall provide coverage for the following scenarios: | ||
###Allowing, or failing to prevent, unauthorized access to the system | ###Allowing, or failing to prevent, unauthorized access to the system | ||
Line 69: | Line 69: | ||
###Compliance with section 164.514(a) of the HIPAA Privacy Rule which provides the standard for de-identification of protected health information by usage of either the “Expert Determination” method or the “Safe Harbor” method | ###Compliance with section 164.514(a) of the HIPAA Privacy Rule which provides the standard for de-identification of protected health information by usage of either the “Expert Determination” method or the “Safe Harbor” method | ||
####The system shall apply the standard for de-identification method to both discrete and non-discrete data sets (e.g. narrative notes). | ####The system shall apply the standard for de-identification method to both discrete and non-discrete data sets (e.g. narrative notes). | ||
###Upon the event of terminating the relationship with a third party, all PHI data | ###Upon the event of terminating the relationship with a third party, all PHI data shall be removed from the system. | ||
###The third party does not have the right to use PHI data in any manner outside the explicit purpose of the submission (e.g. cannot re-sell PHI data to another party). | ###The third party does not have the right to use PHI data in any manner outside the explicit purpose of the submission (e.g. cannot re-sell PHI data to another party). | ||
###The system shall be able to remove a patient’s PHI data in the event the patient wants to be excluded from the registry after we begin submitting data to the third party. | ###The system shall be able to remove a patient’s PHI data in the event the patient wants to be excluded from the registry after we begin submitting data to the third party. |
Revision as of 16:41, September 20, 2022
Human Resources | Safety/Security | Research Compliance | Compliance | Privacy/Information Security | Business Operations | Intellectual Property | Faculty |
Identification Card | Secure Area Card Access | Privacy/Confidentiality | Computer Use/Electronic Information | Retention and Destruction/Disposal of Private and Confidential Information | Use and Disclosure of Protected Health Information | Notice of Privacy Practices | Access to Designated Record Set | Accounting of PHI Disclosures | Patient/Consumer Complaints | Vendors | Fax Transmissions | Psychotherapy Notes | Facility Security | Conditions of Treatment Form | Informed Consent for UNMC Media | Transporting Protected Health Information | Honest Broker | Social Security Number | Third Party Registry | Information Security Awareness and Training
Policy No.: 6300
Effective Date: 06/27/16
Revised Date: draft 09/20/22
Revised Date:
Third Party Registry Selection Policy
Basis for Policy
Nebraska Medicine/UNMC implements reasonable and appropriate access controls in alignment with National Institute of Standards and Technology (NIST) standards and guidance to maintain the minimum necessary access. NIST Special Publication 800-53 and the HIPAA Security Rule outline considerations for the access control family of security controls.
Policy
The following serve as the guiding principles to follow when selecting a third-party vendor:
- Organizational Goals - the envisioned goals of the submission shall be clearly documented and communicated to assess the benefits versus risks to form a recommendation on why the submission shall proceed.
- Incentive Bonus - The amount the payer will increase payment if organization participates in the registry and the date required to submit to achieve.
- Penalty Avoidance - The amount payer will decrease payment if organization does not participate in the registry and date required to submit to avoid penalty.
- Accreditation - Criteria required to obtain/retain accreditation
- Quality Objective - Quantifiable benefits due to specified quality goals
- Research Objective - Quantifiable benefits due to specified research goals
- Data is efficently collected
- Data quality
- The third-party vendor will provide a quality assurance process to ensure that the collected data is accurate prior to submission.
- The third party vendor will provide a data dictionary that clearly documents the data elements collected and how they will use those data elements.
- Workflow
- The data elements documented within the data dictionary will need to be collected as part of a clinical workflow within OneChart.
- Data quality
- Data Security
- All vendors and sub-contractors that transfer or store Protected Health Information (PHI) need to be covered under a Business Associate Agreement (BAA) (see UNMC Policy No. 8009, Contracts).
- Ability to track and audit all entities that were sent and accessed files. This includes secondary usages of the data that the third party may be conducting.
- Must be able to comply with Audit of Electronic Protected Health Information (ePHI) in Information Systems
- Transferred and stored files must be encrypted with at least 128-bit and a unique encryption key that is not stored on the server
- Must comply with File Transfer of Confidential Information Guidelines
- Access to the system needs to use user authentication through integration with Active Directory or LDAP
- Transferred and stored data shall not be portable and there shall be restrictions on the usage of portable storage methods like USB drives or exports to flat files
- The vendor shall provide appropriate cyber liability coverage that covers the Organization in the event of a security or privacy breach and shall provide coverage for the following scenarios:
- Allowing, or failing to prevent, unauthorized access to the system
- Costs associated with a privacy breach, such as consumer notification, customer support and costs of providing credit monitoring services to affected consumers
- Costs associated with restoring, updating or replacing assets stored electronically
- Business interruption and extra expense related to a security or privacy breach
- Liability associated with libel, slander, copyright infringement, product disparagement or reputational damage to others when the allegations involve a business website, social media or print media
- Expenses related to cyber extortion or cyber terrorism
- Coverage for expenses related to regulatory compliance for errors
- PHI protections
- Compliance with section 164.514(a) of the HIPAA Privacy Rule which provides the standard for de-identification of protected health information by usage of either the “Expert Determination” method or the “Safe Harbor” method
- The system shall apply the standard for de-identification method to both discrete and non-discrete data sets (e.g. narrative notes).
- Upon the event of terminating the relationship with a third party, all PHI data shall be removed from the system.
- The third party does not have the right to use PHI data in any manner outside the explicit purpose of the submission (e.g. cannot re-sell PHI data to another party).
- The system shall be able to remove a patient’s PHI data in the event the patient wants to be excluded from the registry after we begin submitting data to the third party.
- Compliance with section 164.514(a) of the HIPAA Privacy Rule which provides the standard for de-identification of protected health information by usage of either the “Expert Determination” method or the “Safe Harbor” method
Procedures
- The requestor submits a request that documents how the third-party registry will comply with the principles above.
- The Data and Governance Policy Committee (Subcommittee of IM Governance Cabinet Research Committee) reviews the requests and determines if the benefits of participating within the submission outweighs the risk.
Definitions
Affiliated Covered Entity (ACE)
Legally separate covered entities that designate themselves as a single covered entity for the purpose of HIPAA Compliance. Current ACE members are: The Nebraska Medical Center, UNMC Physicians, UNMC, University Dental Associates, Bellevue Medical Center and Nebraska Pediatric Practice, Inc. d/b/a Children’s Specialty Physicians. ACE membership may change from time to time. The Notice of Privacy Practices lists current ACE members. Access and amendment rights apply to designated record sets throughout the ACE.
Data Elements
The items collected by a third-party registry.
Organization
Do you want to define? It's only used twice, but if it's going to be used, should it be? Or should it be taken out and replaced with "Nebraska/Medicine or ACE in the text?
Protected Health Information (PHI)
Individually identifiable health information including demographic information, collected from an Individual, whether oral or recorded in any medium, that:
- is created or received by UNMC/ACE; and
- relates to the past, present or future physical or mental health or condition of an Individual; the provision of health care to an Individual; or the past, present or future payment for the provision of health care to an Individual and identifies the Individual or with respect to which there is a reasonable basis to believe the information can be used to identify the Individual.
PHI includes genetic information, which includes information about the following items (and excludes information about an Individual’s sex or age):
- an Individual’s genetic tests;
- the genetic tests of an Individual’s family members; or
- the manifestation of a disease or disorder in such Individual’s family members (i.e., family medical history); or
- any request for, or receipt of, genetic services (e.g., genetic test, genetic counseling, genetic education), or participation in clinical research which includes genetic services by the Individual or any family member of the Individual.
PHI excludes:
- individually identifiable health information of a person who has been deceased for more than fifty (50) years.
- education records covered by the Family Educational Rights and Privacy Act (FERPA); and
- employment records held by UNMC in its role as employer.
Registry
An organized system that uses observational study methods to collect uniform data (clinical and other) to evaluate specified outcomes for a population defined by a particular disease, condition, or exposure, and that serves a predetermined scientific, clinical, or policy purpose(s). (Workman, T.A. (n.d.). Retrieved September 20, 2022, from http://www.ncbi.nlm.nih.gov/books/NBK164514/).
Third Party Registry
An external entity that collects data for quality or research objectives.
Additional Information
- Contact Office of Information Security or 402.559.2545.
- UNMC Policy No. 6045, Privacy/Confidentiality
- UNMC Policy No. 6051, Computer_Use/Electronic_Information
- UNMC Policy No. 8009, Contracts
- Procedure for UNMC Policies No. 6051 and 6057, Electronic Communication of Protected Health Information
- Third Party Registry Procedure
- Business Associate Agreements and Addendums Procedures
- Third Party Registry Form
- NIST Special Publication 800-53
- Health Insurance Portability and Accountability Act of 1996 (HIPAA)
- HIPAA Security Rule
This page maintained by dkp.