ASTM E2211-02(2010)
(Specification)Standard Specification for Relationship Between a Person (Consumer) and a Supplier of an Electronic Personal (Consumer) Health Record (Withdrawn 2014)
Standard Specification for Relationship Between a Person (Consumer) and a Supplier of an Electronic Personal (Consumer) Health Record (Withdrawn 2014)
ABSTRACT
This specification covers the relationship between a person (consumer), organization, or custodian (or other authorized representative) and a managing (storing) organization (such as a web site or other organization). This will provide guidance to consumers, suppliers of personal (consumer) health records (PCHR) applications, and the public at large regarding the PCHR. Because the PCHR is distinct from the provider-based patient health record (PHR), the laws and conventions for provider-based patient health records may not apply to the PCHR. The PCHR supplier shall allow a consumer or other authorized individual easy access at any point in the PCHR application to the policies and standards to which the PCHR supplier site adheres, as well as their associated charges, if any. In a PCHR application, a consumer has the right to know about the following: the PCHR supplier's business model or a general outline of how its revenues are generated; how PCHR information is handled; how to get a copy of the PCHR; the extent of data mining, whether it is in aggregate or de-identified form, as well as options for opting-out of such data mining activities; PCHR supplier's privacy policy; options for transferring the PCHR to another supplier or elsewhere; provisions for identifying the audit trail for access to the consumer record when suppliers change and when changes occur in the business enterprise under which the supplier and record keeper operates; in case the business enterprise changes, the reissuance of privacy statements and positive reconfirmation of postal and mail address by the consumer following any corporate changes is recommended; and how to request deletion or destruction, or both, of a personal file at a PCHR supplier's system.
SCOPE
1.1 This specification covers the relationship between a person (consumer), organization, or custodian (or other authorized representative) and a managing (storing) organization (such as a web site or other organization). However, web-based personal (consumer) health records that are created by healthcare providers or health plans are not within the scope of this specification. Further, this specification will not address personal (consumer) health records (PCHR) that are created and managed by patients on paper records, on personal computers, or on other media offline.
WITHDRAWN RATIONALE
Formerly under the jurisdiction of Committee E31 on Healthcare Informatics, this test method was withdrawn in April 2014. This standard is being withdrawn without replacement due to its limited use by industry.
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation:E2211 −02(Reapproved 2010) An American National Standard
Standard Specification for
Relationship Between a Person (Consumer) and a Supplier
of an Electronic Personal (Consumer) Health Record
This standard is issued under the fixed designation E2211; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 3.1.2 disclosure statement—a prominent notice that de-
scribes an organization’s policies in order to enable a person to
1.1 This specification covers the relationship between a
decide whether (s)he can trust this organization with health
person (consumer), organization, or custodian (or other autho-
information.
rized representative) and a managing (storing) organization
(such as a web site or other organization). However, web-based 3.1.3 Gramm-Leach-Bliley Act—federal legislation enacted
personal (consumer) health records that are created by health- in 1999 as part of the Financial Services Modernization Act
care providers or health plans are not within the scope of this that specifies for web activities that “opt-out” is the norm.
specification. Further, this specification will not address per-
3.1.4 individually identifiable health information—
sonal (consumer) health records (PCHR) that are created and
information that is a subset of health information, including
managed by patients on paper records, on personal computers,
demographic information collected from an individual, and
or on other media offline.
that: (1) is created or received by a healthcare provider, health
plan, employer, or healthcare clearinghouse; and (2) relates to
2. Referenced Documents
the past, present, or future physical or mental health or
2.1 Other References:
condition of an individual; the provision of healthcare to an
Internet Healthcare Coalition
individual; or the past, present, or future payment for the
Health on the Net (HON)
provision of healthcare to an individual; and (1) that identifies
Federal Trade Commission FTCC
theindividual;or (2)withrespecttowhichthereisareasonable
Hi Ethics Alliance
basis to believe the information can be used to identify the
MedCertain
individual. HIPAA
American Medical Association Guidelines for Medical and
3.1.5 patient health record (PHR)—the primary legal record
Health Information Sites on the Internet
8 created and maintained by the healthcare provider document-
AHIMA E-health Tenets
ing the healthcare services provided to a person, in any aspect
URAC (also known as the American Accreditation Health-
9 of healthcare delivery. This term is synonymous with medical
Care/Commission)
record, health record, patient care record (primary patient care
record), client record, and resident record. The term includes
3. Terminology
routine clinical or office records, records of care in any
3.1 Definitions:
health-related setting, preventive care, wellness, lifestyle
3.1.1 consumer—the person who provides information to be
evaluation, research protocols, special study records, and
stored by the personal (consumer) health record (PCHR)
various clinical databases. The records may be in paper-based
supplier.
or electronic form.
3.1.6 personal (consumer) health record (PCHR)—an elec-
This specification is under the jurisdiction of ASTM Committee E31 on
tronic application through which individuals can maintain and
Healthcare Informatics and is the direct responsibility of Subcommittee E31.25 on
manage their health information, and that of others for whom
Healthcare Data Management, Security, Confidentiality, and Privacy.
Current edition approved March 1, 2010. Published August 2010. Originally
they are authorized, in a private, secure, and confidential
approved in 2002. Last previous edition approved in 2002 as E2211–02. DOI:
environment that allows the individual or other authorized
10.1520/E2211-02R10.
persons to access and share such information.
http://www.ihealthcoalition.org/
http://www.hon.ch/HONcode/Conduct.html
http://www.ftc.gov/reports/privacy3/fairinfo.htm
http://www.ihealthcoalition.org/ethics/ethics.html
6 10
http://www.medcertain.org/ For a summary of the act, see www.senate.gov/~banking/conf/grmleach.htm.
http://www.ama-assn.org/ama/pub/category/1905.html
8 11
www.ahima.org Information on legislation and standards can be found at http://aspe.hhs.gov/
www.urac.org admnsimp .
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
E2211−02 (2010)
3.1.7 personal (consumer) health record (PCHR) supplier— 6.3 Such a disclosure shall be clearly stated, shall be posted
the company or organization that maintains or manages, or in a prominent location, and shall be readily accessible from
both, the personal (consumer) health record (PCHR) online boththesite’shomepageandanyWebpagewhereinformation
service. is collected from the consumer. It gives consumers meaningful
and effective notice of what will happen to the personal
3.1.8 personal identifiable information (PII)—individually
information they divulge.
identifiable information about an individual collected online,
including:(1) a first and last name; (2) a home or other physical
6.4 The PHR supplier shall state its policies regarding its
address, including street name and name of a city or town; (3)
sharing and use of information from an individual’s PHR (for
an e-mail address or other online contact information, includ-
example, are there any conditions under which individually
ing but not limited to an instant-messaging user identifier, or a
identifiable information is made available to or used by third
screen name that reveals an individual’s e-mail address; (4) a
parties?). PCHR suppliers shall also state their policies regard-
telephone number; (5) a Social Security number; (6) a persis-
ing access to the consumer’s PHCR by others than the
tent identifier, such as a customer number held in a cookie or
consumer, for example, how a child’s record is handled when
a processor serial number, where such identifier is associated
the child reaches the age of majority, and how an individual
with individually identifiable information; or a combination of
gains authorization to serve as custodian to a parent’s record
a last name or photograph of the individual with other
when that parent is no longer competent to do so himself or
information such that the combination permits physical or
herself.
online contacting; or (7) information concerning the child or
6.5 Choice/Consent:
the parents of that child that the operator collects online from
6.5.1 The PCHR contains both personal identifier informa-
the child and combines with an identifier described in this
tion (PII) and individually identifiable health information
definition. COPPA
(IIHI). The standard for PII is generally used as opt-out,
NOTE 1—This standard is based on the current Gramm-Leach-Bliley
meaning that a consumer must specifically request that such
Act which specifies “opt-out” as the standard for e-commerce (and
information is not shared.
e-health) in the United States. The alternative of “opt-in” was considered
6.5.2 For IIHI, PCHR suppliers shall allow consumers to
for this standard but has not been adopted because it would not conform
choose if and how any personally identifiable information
to current e-health legal considerations, practices, and accepted industry
thinking.
collected from them may be used. These choices shall be
presented in a manner requiring that the consumer give specific
4. Significance and Use
permission for use of such data. Options for secondary uses of
4.1 The purpose of this standard is to provide guidance to
information shall be provided, that is, uses beyond the PCHR
consumers, suppliers of PCHR applications, and the public at
storageandmanagementapplication.Suchsecondaryusesmay
large regarding the PCHR. Because the PCHR is distinct from
be internal, such as placing the consumer on a sponsor’s or
the provider-based PHR, the laws and conventions for
other organization’s mailing list in order to market additional
provider-based patient health records may not apply to the
products or promotions, or external, such as the transfer of
PCHR.
information to third parties.
5. Terms and Conditions
6.6 Access/Corrections:
6.6.1 APCHR supplier shall provide the consumer with the
5.1 The PCHR supplier shall allow a consumer or other
ability to access data within the PCHR in order to verify its
authorized individual easy access at any point in the PCHR
correctness or to contest its accuracy and completeness, or
application to the policies and standards to which the PCHR
both.Access policies shall describe the turnaround time related
supplier site adheres, as well as their associated charges, if any.
to such requests (time from request to access), shall specify
6. Privacy, Security, and Confidentiality Notice/
associatedcharges,andshallincludeinstructionsforcontesting
Awareness / Disclosure of Policies
and correcting inaccurate or incomplete data.
6.6.2 The PCHR supplier shall disclose its policies regard-
6.1 The PCHR supplier shall disclose its policies for estab-
ingwhenandhowthePHRdatamaybeaccessed.Inparticular,
lishing authorization to create, maintai
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.