Comments on Authentication Sought

Tiger Team Seeking Advice on Identity Verification for Organizations Howard Anderson (ismg_editor) • October 22, 2010

The privacy and security tiger team that's advising regulators about health information exchange issues is seeking comments on how to authenticate organizations exchanging electronic health records.

The team will make a recommendation on how best to verify the identity of a provider organization, such as a hospital or physician practice, seeking access to protected health information through a health information exchange.

Authentication Questions

In a new blog, the tiger team solicits comments, due Oct. 29, on such topics as:

What strength of authentication should be used?
Which providers should receive digital credentials?
What process should be used to issue credentials, and who should issue them?
What existing standard, if any, for digital credentials should be used?
What type of transactions should be authenticated?

The team eventually will make a long list of recommendations dealing with the privacy and security of health information exchange. They'll be included in a "policy and technology framework for health information exchange," says Deven McGraw, team co-chair and director of the health privacy project at the Center for Democracy & Technology.

Ultimately, the Department of Health and Human Services will determine how to use the recommendations of the tiger team, approved by the HIT Policy Committee, in new rules and regulations.

The HITECH Act called for expanding data exchange at the regional, state and national levels. It provided grants to states to help fund statewide exchanges.

On Oct. 20, the tiger team and the HIT Policy Committee discussed preliminary recommendations for notifying patients that an organization exchanges electronic health records with others.