Take the 2-minute tour ×
Healthcare IT Stack Exchange is a question and answer site for healthcare IT professionals and solution providers. It's 100% free, no registration required.

I'm struggling to find good documentation regarding requirements around security and encryption of patient clinical information when delivered to a patient in electronic format. Patient portals, etc., implicitly have authentication. However, what are the requirements, if any, with respect to encrypting and password-protecting a soft copy of clinical information handed to the patient on a CD, Thumb Drive, etc.?

In general, we have secure exchange and encryption/integrity checking. So my question focuses more on what mandates exist for applying passwords, etc., to an electronic copy of this info.

Right now I'm exploring this topic in the context of implementing MU-compliant solutions to deliver electronic copies of patient clinical info upon request. So this includes a full health record/ccd, a visit summary, discharge instructions, etc.

Thanks! (my first question posted, and have reviewed similar titles and didn't find a match for my inquiry)


migrated to security.stackexchange.com by jonsca May 1 '12 at 11:07

This question belongs on our site for Information security professionals.

Great question! Welcome to town! Please ask more questions, and answer some too. –  David P. Hochman Dec 22 '11 at 18:45
You mentioned MU (meaningful use), so I assume that you want the MU specific requirements for this situation. If I recall correctly the CCD interface I built had the option to not encrypt, specifically for the case where the data is given to the patient, but I'm not 100% on this. It makes sense to assume that the average patient would not have decryption software, though MU requirements should have a stance on this. –  user453441 Dec 22 '11 at 19:04
Yes, I'm definitely seeking MU-specific requirements, however, I aimed to ask the question in a broader sense in that I'm not sure what requirements may be out there (and of course, we're seeking to add value to our products for customers to meet regulatory & quality standards that are thrown at them from any angle!). Incorporating interaction design, I'm really hoping we can make this process as simple as possible yet secure as necessary (e.g. PDF file on thumb drive w/password defaulted to patient DOB). Thanks! –  Wayne Heilala Dec 22 '11 at 19:22