The Health IT Policy Committee’s Privacy and Security Tiger Team is considering potential privacy and security policy issues that could arise when a family member, friend or legal designee is given access to patient information through the Certified EHR Technology “view/download/transmit” (V/D/T) capabilities.

Ideally, we want your comments in time to inform our discussions during a meeting we are convening Feb. 10.

HIPAA permits covered entities to share identifiable health information relevant to a patient’s care with family members or friends involved in a patient’s care, unless the patient objects.  It also requires covered entities to treat a “personal representative” (a person authorized under State or other applicable law to act on behalf of the individual in making healthcare related decisions) the same as they would treat the patient.  For example, personal representatives have the same rights of access to medical record information as the patient would have.  Because patients can access relevant health care information through V/D/T, the Tiger Team is considering whether there are additional privacy and security policy issues that need to be resolved when family or friends access the data.

That’s where you come in. To further inform this discussion, the Tiger Team wants broad input on this subject.  We offer the following questions to kick off this discussion but we invite comment on any issue related to this topic.

Personal Representatives:

• Are there policy issues that need further resolution regarding personal representative access to view/download/transmit accounts?
• How do health-care providers confirm that an individual is, in fact, a personal representative?

Friends & Family

• How are patients’ friends and family provided with credentialed access to view/download/transmit accounts?
• Is this access “all or nothing,” or are there more granular options?  If the latter, how does this get accomplished?

The Tiger Team will continue its discussion of these issues at its next meeting, scheduled for February 10^th from 2:00 to 3:30 pm EST. Instructions on how to listen to this meeting here.