ASTM_E_1869_-_04_2014.pdf

Designation:E186904(Reapproved 2014)An American National StandardStandard Guide forConfidentiality,Privacy,Access,and Data SecurityPrinciples for Health Information Including Electronic HealthRecords1This standard is issued under the fixed designation E1869;the number immediately following the designation indicates the year oforiginal adoption or,in the case of revision,the year of last revision.A number in parentheses indicates the year of last reapproval.Asuperscript epsilon()indicates an editorial change since the last revision or reapproval.1.Scope1.1 This guide covers the principles for confidentiality,privacy,access,and security of person identifiable healthinformation.The focus of this standard is computer-basedsystems;however,many of the principles outlined in this guidealso apply to health information and patient records that are notin an electronic format.Basic principles and ethical practicesfor handling confidentiality,access,and security of healthinformation are contained in a myriad of federal and state laws,rules and regulations,and in ethical statements of professionalconduct.The purpose of this guide is to synthesize andaggregate into a cohesive guide the principles that underpin thedevelopment of more specific standards for health informationand to support the development of policies and procedures forelectronic health record systems and health information sys-tems.1.2 This guide includes principles related to:SectionPrivacy7Confidentiality8Collection,Use,and Maintenance9Ownership10Access11Disclosure/Transfer of Data12Data Security13Penalties/Sanctions14Education151.3 This guide does not address specific technical require-ments.It is intended as a base for development of more specificstandards.2.Referenced Documents2.1 ASTM Standards:2E1384 Practice for Content and Structure of the ElectronicHealth Record(EHR)E1714 Guide for Properties of a Universal Healthcare Iden-tifier(UHID)E1762 Guide for Electronic Authentication of Health CareInformationE1769 Guide for Properties of Electronic Health Recordsand Record SystemsE1986 Guide for Information Access Privileges to HealthInformationE1987 Guide for Individual Rights Regarding Health Infor-mation(Withdrawn 2007)3E1988 Guide for Training of Persons who have Access toHealth Information(Withdrawn 2007)3E2017 Guide for Amendments to Health InformationE2147 Specification for Audit and Disclosure Logs for Usein Health Information Systems3.Terminology3.1 Definitions:3.1.1 accessthe provision of an opportunity to approach,inspect,review,retrieve,store,communicate with,or make useof health information system resources(for example,hardware,software,systems or structure)or patient identifiable data andinformation,or both.3.1.2 authentication:3.1.2.1 authentication(data entry)to authorize or validatean entry in a record by a signature including first initial,lastname,and discipline or a unique identifier allowing identifica-tion of the responsible individual.3.1.2.2 authentication(data origin/sender)corroborationthat the source/sender of data received is as claimed.3.1.2.3 authentication(user/receiver)the provision of as-surance of the claimed identity of an entity/receiver.3.1.3 authorizethe granting to a user the right of access tospecified data and information,a program,a terminal,or aprocess.1This guide is under the jurisdiction of ASTM Committee E31 on HealthcareInformatics and are the direct responsibility of Subcommittee E31.25 on HealthcareData Management,Security,Confidentiality,and Privacy.Current edition approved April 1,2014.Published April 2014.Originallyapproved in 1997.Last previous edition approved in 2010 as E186904(2010).DOI:10.1520/E1869-04R14.2For referenced ASTM standards,visit the ASTM website,www.astm.org,orcontact ASTM Customer Service at serviceastm.org.For Annual Book of ASTMStandards volume information,refer to the standards Document Summary page onthe ASTM website.3The last approved version of this historical standard is referenced onwww.astm.org.Copyright ASTM International,100 Barr Harbor Drive,PO Box C700,West Conshohocken,PA 19428-2959.United States1 3.1.4 clinical data centersall computer-based(andmanual)systems which handle and store patient records andhealth information,for example,solo practitioners,clinics,hospitals,state departments of health,data centers,and healthmaintenance organizations.3.1.5 clinical informationdata and information collectedfrom the patient or patients family by a healthcare practitioneror healthcare organization.A healthcare practitioners objec-tive measurement or subjective evaluation of a patientsphysical or mental state of health,descriptions of an individu-als health history and family health history,diagnostic studies,decision rationale,descriptions of procedures performed,findings,therapeutic interventions,medications prescribed,description of responses to treatment,prognostic statementsand descriptions of socioeconomic factors,and environmentalfactors related to the patients health.3.1.6