Privacy protections and practices. Ensuring the confidentiality and security of personal health information is paramount in the NHII. Privacy policies and practices continue to evolve, particularly for clinical and personal health information. All public health uses of information are already controlled by Federal and State laws and will remain so in the future.
In its June 1997 report to HHS, NCVHS made its privacy recommendations and stressed the need for national legislation to protect the confidentiality of medical records. The privacy regulations issued in 2001 by HHS in the absence of congressional action establish strong protections for individually identifiable health information that is held or transmitted by health plans, providers, and healthcare clearinghouses and sanctions for its misuse. 22 Although the regulations do not go into effect until 2003, and their legal status is being challenged, many healthcare providers and health Web sites are already implementing the regulations in anticipation. Their policies and specific practices vary greatly. Some major organizations have recognized that actions to improve privacy protections are a means to gain the confidence of consumers and patients. Prior to the issuance of the privacy regulations, numerous groups composed of private-and public-sector representatives (many of whom operate consumer-oriented health Web sites) developed their own guidelines for the management of personal information. These guidelines have evolved into standards and an accreditation process for health Web sites. 23
Standardization. In the context of HIPAA, standards development is a long-term, national, public-private initiative that is closely linked to the development of privacy protections. Like privacy activities, standards development cuts across all NHII dimensions. While incomplete, the process is gradually laying a platform for the NHII that will increase in usefulness the more it addresses the information needs in each of the NHII dimensions. The greatest progress so far has been made in the healthcare provider dimension. HIPAA not only establishes standards but promotes consolidation of standards development, updating, and maintenance efforts. HHS has encouraged these efforts by recognizing a group of Designated Standard Maintenance Organizations (DSMOs) to manage the maintenance of the EDI standards adopted under HIPAA. The American National Standards Institute's Healthcare Informatics Standards Board (ANSI HISB) provides coordination and collaboration among the healthcare informatics organizations to promote and facilitate voluntary consensus for national standards. ANSI HISB is supporting the development of the United States Health Information Knowledgebase (USHIK) metadata registry to assist in cataloging and harmonizing data elements across organizations. It also provides a forum for the HIPAA DSMOs to coordinate their efforts to define a common HIPAA electronic signature standard. International organizations are also important. c The International Organization for Standardization's U. S. Technical Advisory Group (ISO US TAG) coordinates the positions of U. S. standard development organizations for representation at the ISO Technical Committee 215's Committee on Healthcare Information Standards. Collaboration of government agencies and private industry within standards development organizations will be essential for creating optimum standards.
In the population health arena, various efforts are under way to improve cooperation between the public health and standards development worlds, with the Public Health Data Standards Consortium taking the lead. Since its establishment in 1999, the Public Health Data Standards Consortium has identified high-priority data needs, developed an educational strategy for public health databases to migrate to existing data standards, and established several workgroups to advance the incorporation of critical public health data into national standards.d
While these efforts do not directly impact the personal health dimension, they will benefit consumers to the extent that all these efforts ultimately contribute to appropriate information exchange across all the dimensions. Standards efforts unique to the personal health dimension are discussed below. The many technical and functional building blocks that standardization is contributing to NHII development were reviewed in Section 3.