1. HealthIT.gov
  2. >
  3. For Policy Researchers & Implementers
  4. >
  5. Privacy & Security Policy
  6. >
  7. Computable Privacy
  • Print

Computable Privacy

Electronic exchange of health information for treatment, payment, and health care operations is a key component of delivery system reform. As we move toward Electronic Health Record (EHR) interoperability and a learning health system, patient consent for health information exchange becomes all the more critical. Patient consent and electronic exchange of health information require a way of consistently capturing, communicating, processing, and automating individual choice. We call this consistent approach to consent and exchange “Computable Privacy.”

                    Graphic shows patient at center, with patient’s information streaming out to entities such as hospitals, doctor’s offices, skilled nursing facilities, and specialists. Information also flows between the entities providing care.

Computable Privacy is defined as a way of consistently capturing, communicating, processing, and automating individual choice, in order to enhance interoperability and move toward a learning health care system.

Computable Privacy in Action

While federal law allows individuals to electronically sign important legal documents, like loan applications, some providers still use paper to capture consent decisions. This hinders Computable Privacy. 

In addition, states have privacy and consent laws that are very diverse, complicating their ability to communicate and act on patient consent choices. Within a state, health care entities can have very different policies for privacy and consent.

Take a look at how today’s Computable Privacy environment handles consent decisions and the flow of Protected Health Information (PHI).

Learn more

Sharing PHI Electronically

The Office of the National Coordinator for Health Information Technology (ONC) has taken significant steps to help providers and patients understand how PHI can be used and disclosed without a patient’s written consent, all under the Health Insurance Portability and Accountability Act (HIPAA).  

A key point of the HIPAA Privacy Rule is that PHI-sharing can occur many ways: phone, fax, or digital exchange. No matter how PHI is exchanged for treatment, payment and health care operations, HIPAA does not require patient consent. Learn more about the scenarios in which providers can share PHI without patient consent.

Learn more

Patient Access to Health Information

Did you know that patients have the right to get a copy of their health records from their providers? They also have a right to get a copy in electronic format, if their provider keeps their records electronically. And, patients have the right to have their providers send a copy of their records to a third party.

Because HIPAA patient access rights are often not well known, ONC and OCR initiated the Access Project to provide patients and providers with patient access rights information.

For information about patient access rights visit OCR's Individuals’ Right under HIPAA to Access their Health Information page.

Learn more about OCR’s recently released access guidance.

Read more about patient access rights.

Learn more

ONC Activities to Support Computable Privacy

To help enable Computable Privacy, ONC supports a variety of activities on topics such as data segmentation, patient consent methods, patient access, and Patient-Centered Outcomes Research (PCOR). These efforts help advance nationwide interoperability, as described in the Interoperability Roadmap.

In addition, in 2015 ONC granted three new Funding Opportunities Announcements (FOAs) to promote advanced interoperability and workforce and community health development. In support of the FOAs, ONC is coordinating meetings between state policymakers to examine real and perceived policy and legal barriers to interoperability. With this information, states can seek ways to address barriers in their own states. Policymakers are also documenting a roadmap that can be used as a template by other states to improve interoperability.

Expect to hear more as participating states conduct legislative or policy activities and report on their progress. Click on the boxes at right to learn more about ONC’s additional activities.

Disclaimer

The information here is not intended to serve as legal advice nor should it substitute for legal counsel. The information presented is not exhaustive, and readers are encouraged to seek additional guidance to supplement the information contained herein.

Enabling Privacy: Data Segmentation

A tablet computer screen shows a clipboard with green checkmarks in decision boxes. A stethoscope is wrapped around the tablet to indicate health care. A combination lock is displayed at the bottom right of the tablet to indicate security of the information.

Data segmentation refers to the electronic labeling or tagging of a patient’s health information in a way that allows patients or providers to electronically share parts, but not all, of a patient record. Data segmentation plays a crucial role in enabling privacy of patient records.

Learn more

Patient Consent for Electronic Health Information Exchange

The center circle of the graphic has the words “Meaningful Consent for Electronic Health Information Exchange.” Round tabs coming out from the center circle say “Technology,” “Patient Education and Engagement,” and “Law and Policy.”

Learn more about the considerations providers, patients, and policy researchers/implementers should take into account related to meaningful consent policies.

Learn more