ASTM E1869-04

Standard Guide for Confidentiality, Privacy, Access, and Data Security Principles for Health Information Including Electronic Health Records

SCOPE
1.1 This guide covers the principles for confidentiality, privacy, access, and security of person identifiable health information. The focus of this standard is computer-based systems; however, many of the principles outlined in this guide also apply to health information and patient records that are not in an electronic format. Basic principles and ethical practices for handling confidentiality, access, and security of health information are contained in a myriad of federal and state laws, rules and regulations, and in ethical statements of professional conduct. The purpose of this guide is to synthesize and aggregate into a cohesive guide the principles that underpin the development of more specific standards for health information and to support the development of policies and procedures for electronic health record systems and health information systems.
1.2 This guide includes principles related to:
1.3 This guide does not address specific technical requirements. It is intended as a base for development of more specific standards.

General Information

• Status: Historical
• Publication Date: 31-Oct-2004
• ICS: 11.020 - Medical sciences and health care facilities in general
• ICS: 35.240.80 - IT applications in health care technology
• Technical Committee: E31 - Healthcare Informatics
• Drafting Committee: E31.25 - Healthcare Data Management, Security, Confidentiality, and Privacy

Relations

• Replaces: ASTM E1869-97 - Standard Guide for Confidentiality, Privacy, Access, and Data Security Principles for Health Information Including Electronic Health Records
• Effective Date: 01-Nov-2004
• Replaced By: ASTM E1869-04(2010) - Standard Guide for Confidentiality, Privacy, Access, and Data Security Principles for Health Information Including Electronic Health Records
• Effective Date: 01-Aug-2010
• Referred By: ASTM E2147-18 - Standard Specification for Audit and Disclosure Logs for Use in Health Information Systems
• Effective Date: 01-Nov-2004

Standards Content (Sample)

NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
An American National Standard
Designation: E1869 – 04
Standard Guide for
Confidentiality, Privacy, Access, and Data Security
Principles for Health Information Including Electronic Health
1
Records
This standard is issued under the fixed designation E1869; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope Health Record (EHR)
E1714 Guide for Properties of a Universal Healthcare
1.1 This guide covers the principles for confidentiality,
Identifier (UHID)
privacy, access, and security of person identifiable health
E1762 Guide for Electronic Authentication of Health Care
information. The focus of this standard is computer-based
Information
systems; however, many of the principles outlined in this guide
E1769 Guide for Properties of Electronic Health Records
alsoapplytohealthinformationandpatientrecordsthatarenot
and Record Systems
in an electronic format. Basic principles and ethical practices
E1986 Guide for Information Access Privileges to Health
for handling confidentiality, access, and security of health
Information
informationarecontainedinamyriadoffederalandstatelaws,
E1987 Guide for Individual Rights Regarding Health Infor-
rules and regulations, and in ethical statements of professional
3
mation
conduct. The purpose of this guide is to synthesize and
E1988 Guide for Training of Persons who have Access to
aggregate into a cohesive guide the principles that underpin the
3
Health Information
development of more specific standards for health information
E2017 Guide for Amendments to Health Information
and to support the development of policies and procedures for
E2147 Specification forAudit and Disclosure Logs for Use
electronic health record systems and health information sys-
in Health Information Systems
tems.
1.2 This guide includes principles related to:
3. Terminology
Section
3.1 Definitions:
Privacy 7
Confidentiality 8
3.1.1 access—the provision of an opportunity to approach,
Collection, Use, and Maintenance 9
inspect, review, retrieve, store, communicate with, or make use
Ownership 10
ofhealthinformationsystemresources(forexample,hardware,
Access 11
Disclosure/Transfer of Data 12
software, systems or structure) or patient identifiable data and
Data Security 13
information, or both.
Penalties/Sanctions 14
3.1.2 authentication:
Education 15
3.1.2.1 authentication (data entry)—to authorize or validate
1.3 This guide does not address specific technical require-
an entry in a record by a signature including first initial, last
ments.Itisintendedasabasefordevelopmentofmorespecific
name, and discipline or a unique identifier allowing identifica-
standards.
tion of the responsible individual.
3.1.2.2 authentication (data origin/sender)—corroboration
2. Referenced Documents
that the source/sender of data received is as claimed.
2
2.1 ASTM Standards:
3.1.2.3 authentication (user/receiver)—the provision of as-
E1384 Practice for Content and Structure of the Electronic
surance of the claimed identity of an entity/receiver.
3.1.3 authorize—the granting to a user the right of access to
1 specified data and information, a program, a terminal, or a
This guide is under the jurisdiction of ASTM Committee E31 on Healthcare
process.
Informatics and are the direct responsibility of Subcommittee E31.25 on Healthcare
Management, Security, Confidentiality, and Privacy.
3.1.4 clinical data centers—all computer-based (and
Current edition approved Nov. 1, 2004. Published December 2004. Originally
manual) systems which handle and store patient records and
approved in 1997. Last previous edition approved in 1997 as E1869 – 97. DOI:
health information, for example, solo practitioners, clinics,
10.1520/E1869-04.
2
For referenced ASTM standards, visit the ASTM website, www.astm.org, or
contact ASTM Customer Service at [e-mail]. For Annual Book of ASTM
3
Standards volume information, refer to the standard’s Document Summary page on Withdrawn. The last approved version of this historical standard is referenced
the ASTM website. on www.astm.org.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959, United States.
1

---------------------- Page: 1 ----------------------
E1869 – 04
hospitals, state departments of health, data centers, and health 3.1.14 information—data that have been processed for use;
maintenance organizations. human interpretation of data; data that have been processed
into a meaningful form.
3.1.5 clinical information—data and information collected
from the patient or patient’s family by a healthcare practitioner 3.1.15 informed consent—informed consent require
...