The privacy and security "tiger team" set up to resolve pressing issues for the Health IT Policy Committee is calling for standard authentication policies for direct electronic exchange of EHRs and other health data between providers when both sender and receiver know who the other party is.

No matter who is involved in health information exchange, all entities should have digital authentication certificates or similar electronic credentials whenever they take part in the kinds of simple transfers of patient data called for by the Stage 1 "meaningful use" standards, the team recommends. The opinion is based on the Office of the National Coordinator for Health Information Technology's directive to build public confidence in HIE via the NHIN Direct project, Government Health IT reports.

In direct provider-to-provider exchange, authentication is meant to ensure participants link to the proper electronic gateway for HIE, according to Deven McGraw, who chairs the tiger team and also directs the Health Privacy Project at the nonprofit Center for Democracy and Technology. "For the lightweight set of recommendations for Stage 1, there is an assumption that the organizations are more likely to know one another even if their computers don't know one another," McGraw said at a recent public meeting, according to Government Health IT. "That is likely to change in Stages 2 and 3."

Right now, the tiger team has been trying to strike a balance between building confidence in HIE and avoiding burdensome additional costs for healthcare organizations already struggling to meet federal standards for meaningful use in 2011 and 2012. But with tougher requirements to earn Medicare and Medicaid EHR incentive payments coming in 2013, the tiger team may look at credentialing of individuals for HIE next year, McGraw said.

To learn more:
- have a look at this Government Health IT story

Related Articles:
ONC privacy-security 'tiger team' ponders whether HIEs should view records
How do you convince the public that EMRs are safe?
FTC lawyer: Multi-layered data security essential in healthcare