ASTM E1986-09(2013)
(Guide)Standard Guide for Information Access Privileges to Health Information (Withdrawn 2017)
Standard Guide for Information Access Privileges to Health Information (Withdrawn 2017)
SIGNIFICANCE AND USE
4.1 The maintenance of confidentiality in paper-based, electronic, or computer-based health information requires that policies and procedures be in place to protect confidentiality. Confidentiality of information depends on structural and explicit mechanisms to allow persons or systems to define who has access to what, and in what situation that access is granted. For guidelines on the development and implementation of privilege management infrastructures supporting these mechanisms, see Guide E2595.
4.2 Confidential protection of data elements is a specific requirement. The classification of data elements into restrictive and specifically controlled categories is set by policies, professional practice, and laws, legislation, and regulations.
4.3 There are three explicit concepts upon which the use of and access to health information confidentiality are defined. Each of these concepts is an explicit and unique characteristic relevant to confidentiality, but only through the combination (convergence) of all three concepts can appropriate access to an explicit data element at a specific point in time be provided, and unauthorized access denied. The three concepts are:
4.3.1 The categorization and breakdown of data into logical and reasonable elements or entities.
4.3.2 The identification of individual roles or job functions.
4.3.3 The establishment of context and conditions of data use at a specific point in time, and within a specific setting.
4.4 The overriding principle in preserving the confidentiality of information is to provide access to that information only under circumstances and to individuals when there is an absolute, established, and recognized need to access that data, and the information accessed should itself be constrained only to that information essential to accomplish a defined and recognized task or process. Information nonessential to that task or process should ideally not be accessible, even though an individual accessing tha...
SCOPE
1.1 This guide covers the process of granting and maintaining access privileges to health information. It directly addresses the maintenance of confidentiality of personal, provider, and organizational data in the healthcare domain. It addresses a wide range of data and data elements not all traditionally defined as healthcare data, but all elemental in the provision of data management, data services, and administrative and clinical healthcare services. In addition, this guide addresses specific requirements for granting access privileges to patient-specific health information during health emergencies.
1.2 This guide is based on long-term existing and established professional practices in the management of healthcare administrative and clinical data. Healthcare data, and specifically healthcare records (also referred to as medical records or patient records), are generally managed under similar professional practices throughout the United States, essentially regardless of specific variations in local, regional, state, and federal laws regarding rules and requirements for data and record management.
1.3 This guide applies to all individuals, groups, organizations, data-users, data-managers, and public and private firms, companies, agencies, departments, bureaus, service-providers, and similar entities that collect individual, group, and organizational data related to health care.
1.4 This guide applies to all collection, use, management, maintenance, disclosure, and access of all individual, group, and organizational data related to health care.
1.5 This guide does not attempt to address specific legislative and regulatory issues regarding individual, group, and organizational rights to protection of privacy.
1.6 This guide covers all methods of collection and use of data whether paper-based, written, printed, typed, dictated, transcribed, forms-based, photocopied, scanned, facsimile, telefax, magnetic me...
General Information
Relations
Standards Content (Sample)
NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: E1986 − 09 (Reapproved 2013) An American National Standard
Standard Guide for
Information Access Privileges to Health Information
This standard is issued under the fixed designation E1986; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope* picture, film, microfilm, animation, 3D, audio, digital media,
optical media, synthetic media, or computer-based.
1.1 This guide covers the process of granting and maintain-
ing access privileges to health information. It directly ad-
1.7 This guide does not directly define explicit disease-
dresses the maintenance of confidentiality of personal,
specific and evaluation/treatment-specific data control or
provider, and organizational data in the healthcare domain. It
access, or both. As defined under this guide, the confidential
addresses a wide range of data and data elements not all
protection of elemental data elements in relation to which data
traditionally defined as healthcare data, but all elemental in the
elements fall into restrictive or specifically controlled
provision of data management, data services, and administra-
categories, or both, is set by policies, professional practice, and
tive and clinical healthcare services. In addition, this guide
laws, legislation and regulations.
addresses specific requirements for granting access privileges
to patient-specific health information during health emergen-
2. Referenced Documents
cies.
2.1 ASTM Standards:
1.2 This guide is based on long-term existing and estab-
E1869 Guide for Confidentiality, Privacy, Access, and Data
lished professional practices in the management of healthcare
Security Principles for Health Information Including Elec-
administrative and clinical data. Healthcare data, and specifi-
tronic Health Records
cally healthcare records (also referred to as medical records or
E2595 Guide for Privilege Management Infrastructure
patient records), are generally managed under similar profes-
sional practices throughout the United States, essentially re-
3. Terminology
gardless of specific variations in local, regional, state, and
3.1 Definitions:
federal laws regarding rules and requirements for data and
3.1.1 access—the provision of an opportunity to approach,
record management.
inspect, review, retrieve, store, communicate with, or make use
1.3 This guide applies to all individuals, groups,
ofhealthinformationsystemresources(forexample,hardware,
organizations, data-users, data-managers, and public and pri-
software, systems, or structure) or patient identifiable data and
vatefirms,companies,agencies,departments,bureaus,service-
information, or both. (E1869)
providers, and similar entities that collect individual, group,
3.1.2 access control—the prevention of unauthorized use of
and organizational data related to health care.
a resource, including the prevention of use of a resource in an
1.4 This guide applies to all collection, use, management,
unauthorized manner.
maintenance, disclosure, and access of all individual, group,
3.1.2.1 Discussion—Access control counters the threat of
and organizational data related to health care.
unauthorized access to, disclosure of, or modification of data.
(ISO 7498-2)
1.5 This guide does not attempt to address specific legisla-
tive and regulatory issues regarding individual, group, and
3.1.3 accountability—the property that ensures that the
organizational rights to protection of privacy.
actions of an entity can be traced. (ISO 7498-2)
1.6 This guide covers all methods of collection and use of
3.1.4 audit trail—data collected and potentially used to
data whether paper-based, written, printed, typed, dictated,
facilitate a security audit. (ISO 7498-2)
transcribed, forms-based, photocopied, scanned, facsimile,
3.1.5 authentication—the corroboration that an entity is the
telefax, magnetic media, image, video, motion picture, still
one claimed. (ISO 7498-2)
This guide is under the jurisdiction of ASTM Committee E31 on Healthcare
Informatics and is the direct responsibility of Subcommittee E31.25 on Healthcare
Data Management, Security, Confidentiality, and Privacy. For referenced ASTM standards, visit the ASTM website, www.astm.org, or
Current edition approved March 1, 2013. Published March 2013. Originally contact ASTM Customer Service at service@astm.org. For Annual Book of ASTM
approved in 1998. Last previous edition approved in 2009 as E1986 –09. DOI: Standards volume information, refer to the standard’s Document Summary page on
10.1520/E1986-09R13. the ASTM website.
*A Summary of Changes section appears at the end of this standard
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
E1986 − 09 (2013)
3.1.6 authorize—the granting to a user the right of access to present, or future payments for the provision of health care to
specified data and information, a program, a terminal, or a a protected individual; and (3) that identifies the individual;
process. (E1869) with respect to which there is a reasonable basis to believe that
the information can be used to identify the individual.
3.1.7 authorization—(1) The granting of rights, which in-
(HIPAA, E1869)
cludes the granting of access based on access rights. (2) The
mechanism for obtaining consent for the use and disclosure of 3.1.17 information—data to which meaning is assigned,
health information. (ISO 7498-2, CPRI, AHIMA) according to context and assumed conventions.
(National Security Council, 1991, E1869)
3.1.8 confidential—status accorded to data or information
indicating that it is sensitive for some reason and needs to be
3.2 Definitions of Terms Specific to This Standard:
protected against theft, disclosure, or improper use, or both,
3.2.1 disclosure—to release, transfer, or otherwise divulge
and must be disseminated only to authorized individuals or
protected health information to any entity other than the
organizations with an approved need to know. Private infor-
individual who is the subject of such information.
mation which is entrusted to another with the confidence that
3.2.1.1 external disclosure—disclosure outside an organiza-
unauthorized disclosure that will be prejudicial to the indi-
tion.
vidual will not occur. (E1869)
3.2.1.2 internal disclosure—disclosure within an organiza-
3.1.9 confidentiality—the property that information is not
tion.
made available or disclosed to unauthorized individuals,
entities, or processes. (ISO 7498-2)
4. Significance and Use
3.1.10 database—a collection of data organized for rapid
4.1 The maintenance of confidentiality in paper-based,
search and retrieval. (Webster’s, 1993)
electronic, or computer-based health information requires that
3.1.11 data element—the combination of one or more data
policies and procedures be in place to protect confidentiality.
entities that forms a unit or piece of information, such as the
Confidentiality of information depends on structural and ex-
social security number, a diagnosis, an address, or a medica-
plicit mechanisms to allow persons or systems to define who
tion.
has access to what, and in what situation that access is granted.
For guidelines on the development and implementation of
3.1.12 data entity—a discrete form of data such as a number
or word. privilege management infrastructures supporting these
mechanisms, see Guide E2595.
3.1.13 disclosure (health care)—the release of information
to third parties within or outside the healthcare provider
4.2 Confidential protection of data elements is a specific
organization from an individual’s record with or without the requirement.The classification of data elements into restrictive
consent of the individual to whom the record pertains.
and specifically controlled categories is set by policies, profes-
3.1.13.1 Discussion—Under this guide the definition is sional practice, and laws, legislation, and regulations.
slightly modified to read: the release of information to an
4.3 There are three explicit concepts upon which the use of
individual, group or organization from an individual’s health
and access to health information confidentiality are defined.
information with or without the authorization of the individual
Each of these concepts is an explicit and unique characteristic
to whom the health information pertains. (CPRI)
relevant to confidentiality, but only through the combination
3.1.14 emergency—a sudden demand for action. Condition
(convergence) of all three concepts can appropriate access to
that poses an immediate threat to the health of the patient.
an explicit data element at a specific point in time be provided,
and unauthorized access denied. The three concepts are:
3.1.15 healthcare data—data which are input, stored, pro-
4.3.1 The categorization and breakdown of data into logical
cessed or output by the automated information system which
and reasonable elements or entities.
support the business functions of the healthcare establishment.
4.3.2 The identification of individual roles or job functions.
These data may relate to person identifiable records or may be
4.3.3 The establishment of context and conditions of data
part of an administrative system where persons are not
use at a specific point in time, and within a specific setting.
identified. (CEN)
3.1.16 health information—anyinformation,whetheroralor 4.4 The overriding principle in preserving the confidential-
recorded in any form or medium (1) that is created or received ity of information is to provide access to that information only
by a healthcare provider; a health plan; health researcher, under circumstances and to individuals when there is an
public health authority, instructor, employer, school or absolute, established, and recognized need to access that data,
university, health information service or other entity that and the information accessed should itself be constrained only
creates, receives, obtains, maintains, uses, or transmits health to that information essential to accomplish a defined and
information; a health oversight agency, a health information recognized task or process. Information nonessential to that
service organization, or (2) that relates to the past, present, or taskorprocessshouldideallynotbeaccessible,eventhoughan
future physical or mental health or condition of an individual, individual accessing that information may have some general
the provision of health care to an individual, or the past, right of access to that information.
E1986 − 09 (2013)
5. Principles tions as to race, religion, ethnicity, genetics, sexual
preferences, and other prejudicial indicators. The protection of
5.1 The following principles are based upon U.S. state and
individual, group, and organizational data confidentiality under
federal laws, current European Economic Community initia-
this guide is, therefore, absolute and is always based upon the
tives and laws and regulations resulting from those initiatives,
connectionofthatdatatotheindividual,group,ororganization
and professional practice within the U.S. and European health-
from which the data was collected and for or about whom the
care domains.
data is retained and managed. No data is releasable as discrete
5.2 Individuals, groups, and organizations retain rights over
data or discrete data-types under any assumption that since
the specific, intermediate, and ultimate use of any data col-
another related data element (for example, name, age, sex,
lected from them and about whom the data is retained and
address, etc.) was not released, that the data is no longer
managed.
individual, group, or organizational data, or can no longer be
identified or connected to any individual, group, or organiza-
5.3 No individual, group, or organizational data shall be
tion.
collected, used, maintained, released, or disclosed without the
specific explicit informed consent of the individual, group, or 5.7 All access shall be explicitly authorized. Unauthorized
organization, unless specifically required for the protection of access is explicitly forbidden.
public health, and mandated by local, state, regional, or federal
law. 6. Data Elements
6.1 Data elements under this guide represent fragmentation
5.4 Individual, group, or organizational data may only be
used for the purpose for which it was collected. Explicit (separation) of data into discrete entities. These entities (data
elements) represent discrete elemental data types that can be
informedconsentoftheindividual,group,ororganizationfrom
whichthedatawascollectedisrequiredifthedataistobeused reconstructed into complete data sets according to varying
needs and requirements of access and use, by appropriate
for any additional purpose. Organizational policies shall state
the purposes for which data will be collected, maintained, and data-users, under appropriately defined and authorized roles.
Data elements exist as discrete data in their own right or can be
used.
aggregated as data sets that represent data about a specific
5.5 All individuals, groups, organizations, data-users, data-
individual, provider, group, or organization, or they can be
managers, and public and private firms, companies, agencies,
aggregated across individuals, providers, groups, or organiza-
departments, bureaus, service-providers, and similar entities
tions.
that collect individual, group and healthcare related data, are
6.2 Data elements and data entities under this guide are
required to collect, manage, maintain, disclose, provide access
explicitly delineated and apply to healthcare related data in
to, or release that data only in strict compliance with the data
aggregate as well as discrete forms.
access rules defined in this guide. If they are unable to adhere
to this guide they will not retain data beyond its initial
6.3 If data exist in aggregate form and cannot be broken
collection and use, or will securely and confidentially entrust
down or protected from improper use or disclosure at the data
that data to an authorized organization that can abide by the
element or entity level, then the aggregate data itself cannot be
rules under this guide.
released for use or disclosure to any data-user other than those
who meet the access privilege rules for the most confidential
5.6 Data and data elements under this guide are defined at a
data within that aggregate.
discrete level. This is necessary in order to define data access
6.3.1 Example—HIVdata within a document, even if only a
and use rights down to discrete elemental data. This guide is
smallfractionofthecontentofthatdocument,makesth
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.