ASTM E1988-98

NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
An American National Standard
Designation:E1988–98
Standard Guide for
Training of Persons who have Access to Health Information
This standard is issued under the fixed designation E 1988; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision. A number in parentheses indicates the year of last reapproval. A
superscript epsilon (e) indicates an editorial change since the last revision or reapproval.
1. Scope 3. Terminology
1.1 This guide addresses the privacy, confidentiality, and 3.1 Definitions:
security training of employees, agents and contractors who 3.1.1 access, n—The provision of an opportunity to ap-
have access to health information. This access shall be autho- proach, inspect, review, retrieve, store, communicate with, or
rized and required to meet job responsibilities. Training is make use of health information system resources (for example,
essential to developing an understanding about, and sensitivity hardware, software, systems, or structure) or patient identifi-
for, individually identifiable health information. Anyone in a able data and information, or both. E 1869
setting that collects, maintains, transmits, stores or uses health 3.1.2 confidential, adj—status accorded to data or informa-
information, or provides health services, or a combination tionindicatingthatitissensitiveforsomereason,andtherefore
thereof, shall provide privacy, confidentiality, and security it needs to be protected against theft, disclosure, or improper
awareness training to all staff and business partners. Training use, or both, and must be disseminated only to authorized
shall be based on job responsibilities. individuals or organizations with a need to know. E 1869
1.2 This guide applies to all individuals, groups, organiza- 3.1.3 disclosure, n—toaccess,release,transfer,orotherwise
tions, data-users, data-managers, and public and private firms, divulge health information to any internal or external user or
companies, agencies, departments, bureaus, service-providers entity other than the individual who is the subject of such
and similar entities that collect individual, group and organi- information. E 1869
zational data related to health care. Any organization which 3.1.4 external disclosure, n—to release, transfer, or other-
handles or stores individually identifiable health information wise divulge confidential health information beyond the
has the obligation to educate eemployees, agents, contractors, boundaries of the provider, healthcare organization or other
and volunteers and others with whom they have business entity which collected the data or holds the data for a specific
relationships regarding the privacy, confidentiality, and secu- health-related purpose.
rity principles and policies and procedures of the organization. 3.1.4.1 Discussion—external disclosure usually requires the
1.3 ASTM Committee E-31 gratefully acknowledges the consent of the individual who is the subject of the information;
contribution of the Computer-Based Patient Record Institute exceptions to this rule are laws that require reporting for public
(CPRI) in providing the document, Guidelines for Information health purposes or emergency treatment situations.
Security Education Programs at Organizations Using 3.1.5 health information, n—any information, whether oral
Computer-based Patient Records, to serve as the basis of this or recorded in any form or medium (1) that is created or
guide. received by a health care provider, a health plan, health
researcher, public health authority, instructor, employer, school
2. Referenced Documents
or university, health information service, or other entity that
2.1 ASTM Standards: creates, receives, obtains, maintains, uses, or transmits health
E 1869 Guide for Confidentiality, Privacy,Access and Data
information; a health oversight agency, a health information
Security Principles for Health Information Including Com- service organization; or (2) that relates to the past, present, or
puter Based Patient Records
future physical or mental health or condition of an individual,
2.2 CPRI Guidelines: or the past, present, or future payment for the provision of
Guidelines for Information Security Education Programs at
health care to a protected individual; and (3) that identifies the
Organizations Using Computer-based Patient Records individual with respect to which there is a reasonable basis to
June, 1995
believe that the information can be used to identify the
individual. E 1869
This guide is under the jurisdiction of ASTM Committee E31 on Healthcare
4. Significance and Use
Informatics and is the direct responsibility of Subcommittee E31.25 on Healthcare
4.1 Health information systems should employ generally
Management, Security, Confidentiality, and Privacy.
Current edition approved Oct. 10, 1998. Published November 1998. accepted security features; however, these features alone will
Annual Book of ASTM Standards, Vol. 14.01
notprotecttheconfidentialityofindividuallyidentifiablehealth
CPRI, 4915 St. Elmo Avenue, Suite 401, Bethesda, MD 20814.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959, United States.
E1988–98
information. Each individual who has access to health infor- 5.1.4 Sensitivity of health data and the type and degrees of
mation is responsible to maintain the confidentiality and protection needed in relation to the role and context of the data
security of the information. Most breaches in confidentiality and the role of the user.
occur as a result of a deliberate or inadvertent act of human 5.1.5 Sensitivity of employee data and the type and degree
behavior.
of protection needed.
4.2 Health information primarily supports the delivery of
5.1.6 Types of Threats to Information Security:
patient care but is commonly used for health care payment,
5.1.6.1 Human error (erasures, accidental damage, deliber-
research, public health, management, and oversight purposes.
ate acts, improper disposal of paper and disks, etc.).
Health information may migrate from the healthcare delivery
5.1.6.2 Nature (fire, water, lightning, earthquake, etc.).
system to other business record systems (insurance, employ-
5.1.6.3 Technical (lack of backup, system failure, virus, loss
ment, credit, etc.). In addition to health professionals, individu-
of power, etc.).
ally identifiable health information is available to many others
5.1.6.4 Deliberate (unauthorized disclosure, modification).
not directly involved in patient care.
5.1.7 Individual Responsibilities:
4.3 Education is a vital component of a comprehensive
5.1.7.1 Knowledge of organizations’ information security
information security management program addressing the
policies and procedures.
confidentialityandsecurityofhealthinformation.Itisessential
5.1.7.2 Collection of valid, accurate data.
that all organizations that collect, store, use, or maintain health
5.1.7.3 Challenging unauthorized users.
information in all venues train all employees, agents, contrac-
5.1.7.4 Protection of passwords, codes, etc.
tors, and volunteers.
5.1.7.5 Reporting security irregularities.
4.4 Participants should demonstrate competency. Training
5.1.7.6 Protection of hardware and software.
should be reinforced periodically. New information should be
5.1.7.7 Attending inservice education programs and partici-
communicated to all employees, agents, contractors, and vol-
pating in quality improvement activities (see CPRI Guide-
unteers and incorporated into continuing education programs.
lines).
Training should be reinforced annually and all employees,
5.1.8 Consequences and sanctions of security breaches to
agents, contractors, and volunteers should sign confidentiality
the involved individual, the organization, patients, and the
agreements on an annual basis. Organizations responsible for
healthcare goals
health information should impose sanctions on employees,
5.2 Job-Specific Health Information Training—Based on
agents, contractors, and volunteers who violate confidentiality
job responsibilities individual training needs will vary. Each
and security rules.
provider, organization, or entity will need to determine the
5. Privacy, Confidentiality, and Security Awareness
content of its educational programs based on job responsibili-
Training ties. For those employees, agents, contractors, and volunteers
who are authorized to access health information, training
5.1 General Security Awareness Training—All employees,
should address:
agents, contractors, and volunteers shall participate in infor-
5.2.1 Methods of Data Protection Including:
mation security awareness training programs. Based on job
5.2.1.1 Physical security (environmental, installation),
responsibilities, individuals may be required to attend custom-
5.2.1.2 Area access controls,
ized education programs that focus on issues regarding use of
health information and responsibilities regarding confidential- 5.2.1.3 Accountability controls,
ity and security. Training programs should address: 5.2.1.4 Equipment enclosures, lockdown, locks,
5.1.1 Concepts of privacy, confidentiality, disclosure, sys-
5.2.1.5 Fire protection systems,
temsecurity,informationsecurity,andintegrity,includingwhat
5.2.1.6 Encryption, and
constitutes a violation or breach and why breaches (intentional
5.2.1.7 System security softwar
...