ASTM E2211-02
(Specification)Standard Specification for Relationship Between a Person (Consumer) and a Supplier of an Electronic Personal (Consumer) Health Record
Standard Specification for Relationship Between a Person (Consumer) and a Supplier of an Electronic Personal (Consumer) Health Record
ABSTRACT
This specification covers the relationship between a person (consumer), organization, or custodian (or other authorized representative) and a managing (storing) organization (such as a web site or other organization). This will provide guidance to consumers, suppliers of personal (consumer) health records (PCHR) applications, and the public at large regarding the PCHR. Because the PCHR is distinct from the provider-based patient health record (PHR), the laws and conventions for provider-based patient health records may not apply to the PCHR. The PCHR supplier shall allow a consumer or other authorized individual easy access at any point in the PCHR application to the policies and standards to which the PCHR supplier site adheres, as well as their associated charges, if any. In a PCHR application, a consumer has the right to know about the following: the PCHR supplier's business model or a general outline of how its revenues are generated; how PCHR information is handled; how to get a copy of the PCHR; the extent of data mining, whether it is in aggregate or de-identified form, as well as options for opting-out of such data mining activities; PCHR supplier's privacy policy; options for transferring the PCHR to another supplier or elsewhere; provisions for identifying the audit trail for access to the consumer record when suppliers change and when changes occur in the business enterprise under which the supplier and record keeper operates; in case the business enterprise changes, the reissuance of privacy statements and positive reconfirmation of postal and mail address by the consumer following any corporate changes is recommended; and how to request deletion or destruction, or both, of a personal file at a PCHR supplier's system.
SCOPE
1.1 This specification covers the relationship between a person (consumer), organization, or custodian (or other authorized representative) and a managing (storing) organization (such as a web site or other organization). However, web-based personal (consumer) health records that are created by healthcare providers or health plans are not within the scope of this specification. Further, this specification will not address personal (consumer) health records (PCHR) that are created and managed by patients on paper records, on personal computers, or on other media offline.
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
An American National Standard
Designation: E2211 – 02
Standard Specification for
Relationship Between a Person (Consumer) and a Supplier
of an Electronic Personal (Consumer) Health Record
This standard is issued under the fixed designation E2211; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 3.1.2 disclosure statement—a prominent notice that de-
scribes an organization’s policies in order to enable a person to
1.1 This specification covers the relationship between a
decide whether (s)he can trust this organization with health
person (consumer), organization, or custodian (or other autho-
information.
rized representative) and a managing (storing) organization
3.1.3 Gramm-Leach-Bliley Act—federal legislation enacted
(such as a web site or other organization). However, web-based
in 1999 as part of the Financial Services Modernization Act
personal (consumer) health records that are created by health-
that specifies for web activities that “opt-out” is the norm.
care providers or health plans are not within the scope of this
3.1.4 individually identifiable health information—
specification. Further, this specification will not address per-
information that is a subset of health information, including
sonal (consumer) health records (PCHR) that are created and
demographic information collected from an individual, and
managed by patients on paper records, on personal computers,
that: (1) is created or received by a healthcare provider, health
or on other media offline.
plan, employer, or healthcare clearinghouse; and (2) relates to
2. Referenced Documents
the past, present, or future physical or mental health or
condition of an individual; the provision of healthcare to an
2.1 Other References:
individual; or the past, present, or future payment for the
Internet Healthcare Coalition
provision of healthcare to an individual; and (1) that identifies
Health on the Net (HON)
theindividual;or (2)withrespecttowhichthereisareasonable
Federal Trade Commission FTC
basis to believe the information can be used to identify the
Hi Ethics Alliance
individual. HIPAA
MedCertain
3.1.5 patient health record (PHR)—theprimarylegalrecord
American Medical Association Guidelines for Medical and
created and maintained by the healthcare provider document-
Health Information Sites on the Internet
ing the healthcare services provided to a person, in any aspect
AHIMA E-health Tenets
of healthcare delivery. This term is synonymous with medical
URAC (also known as the American Accreditation
record, health record, patient care record (primary patient care
HealthCare/Commission)
record), client record, and resident record. The term includes
3. Terminology
routine clinical or office records, records of care in any
health-related setting, preventive care, wellness, lifestyle
3.1 Definitions:
evaluation, research protocols, special study records, and
3.1.1 consumer—thepersonwhoprovidesinformationtobe
various clinical databases. The records may be in paper-based
stored by the personal (consumer) health record (PCHR)
or electronic form.
supplier.
3.1.6 personal (consumer) health record (PCHR)—an elec-
tronic application through which individuals can maintain and
This specification is under the jurisdiction of ASTM Committee E31 on
manage their health information, and that of others for whom
Healthcare Informatics and is the direct responsibility of Subcommittee E31.25 on
they are authorized, in a private, secure, and confidential
Healthcare Data Management, Security, Confidentiality, and Privacy.
environment that allows the individual or other authorized
Current edition approved May 10, 2002. PublishedAugust 2002. DOI: 10.1520/
E2211-02.
persons to access and share such information.
http://www.ihealthcoalition.org/
http://www.hon.ch/HONcode/Conduct.html
http://www.ftc.gov/reports/privacy3/fairinfo.htm
http://www.ihealthcoalition.org/ethics/ethics.html
http://www.medcertain.org/
7 10
http://www.ama-assn.org/ama/pub/category/1905.html For a summary of the act, see www.senate.gov/~banking/conf/grmleach.htm.
8 11
www.ahima.org Information on legislation and standards can be found at http://aspe.hhs.gov/
www.urac.org admnsimp .
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959, United States.
E2211 – 02
3.1.7 personal (consumer) health record (PCHR) 6.3 Such a disclosure shall be clearly stated, shall be posted
supplier—the company or organization that maintains or man- in a prominent location, and shall be readily accessible from
ages, or both, the personal (consumer) health record (PCHR) boththesite’shomepageandanyWebpagewhereinformation
online service. is collected from the consumer. It gives consumers meaningful
3.1.8 personal identifiable information (PII)—individually
and effective notice of what will happen to the personal
identifiable information about an individual collected online, information they divulge.
including:(1) a first and last name; (2) a home or other physical
6.4 The PHR supplier shall state its policies regarding its
address, including street name and name of a city or town; (3)
sharing and use of information from an individual’s PHR (for
an e-mail address or other online contact information, includ-
example, are there any conditions under which individually
ing but not limited to an instant-messaging user identifier, or a
identifiable information is made available to or used by third
screen name that reveals an individual’s e-mail address; (4) a
parties?). PCHR suppliers shall also state their policies regard-
telephone number; (5) a Social Security number; (6) a persis-
ing access to the consumer’s PHCR by others than the
tent identifier, such as a customer number held in a cookie or
consumer, for example, how a child’s record is handled when
a processor serial number, where such identifier is associated
the child reaches the age of majority, and how an individual
with individually identifiable information; or a combination of
gains authorization to serve as custodian to a parent’s record
a last name or photograph of the individual with other
when that parent is no longer competent to do so himself or
information such that the combination permits physical or
herself.
online contacting; or (7) information concerning the child or
6.5 Choice/Consent:
the parents of that child that the operator collects online from
6.5.1 The PCHR contains both personal identifier informa-
the child and combines with an identifier described in this
11 tion (PII) and individually identifiable health information
definition. COPPA
(IIHI). The standard for PII is generally used as opt-out,
NOTE 1—This standard is based on the current Gramm-Leach-Bliley
meaning that a consumer must specifically request that such
Act which specifies “opt-out” as the standard for e-commerce (and
information is not shared.
e-health) in the United States. The alternative of “opt-in” was considered
6.5.2 For IIHI, PCHR suppliers shall allow consumers to
for this standard but has not been adopted because it would not conform
to current e-health legal considerations, practices, and accepted industry choose if and how any personally identifiable information
thinking.
collected from them may be used. These choices shall be
presented in a manner requiring that the consumer give specific
4. Significance and Use
permission for use of such data. Options for secondary uses of
4.1 The purpose of this standard is to provide guidance to
information shall be provided, that is, uses beyond the PCHR
consumers, suppliers of PCHR applications, and the public at
storageandmanagementapplication.Suchsecondaryusesmay
large regarding the PCHR. Because the PCHR is distinct from
be internal, such as placing the consumer on a sponsor’s or
the provider-based PHR, the laws and conventions for
other organization’s mailing list in order to market additional
provider-based patient health records may not apply to the
products or promotions, or external, such as the transfer of
PCHR.
information to third parties.
6.6 Access/Corrections:
5. Terms and Conditions
6.6.1 APCHR supplier shall provide the consumer with the
5.1 The PCHR supplier shall allow a consumer or other
ability to access data within the PCHR in order to verify its
authorized individual easy access at any point in the PCHR
correctness or to contest its accuracy and completeness, or
application to the policies and standards to which the PCHR
both.Access policies shall describe the turnaround time related
supplier site adheres, as well as their associated charges, if any.
to such requests (time from request to access), shall specify
associatedcharges,andshallincludeinstructionsforcontesting
6. Privacy, Security, and Confidentiality Notice/
and correcting inaccurate or incomplete data.
Awareness / Disclosure of Policies
6.6.2 The PCHR supplier shall disclose its policies regard-
6.1 The PCHR supplier shall disclose its policies for estab-
ingwhenandhowthePHRdatamaybeaccessed.Inparticular,
lishing authorization to create, ma
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.