Data Security Policy

SMRTNET Data Security

Privacy and Data Security Process

In many ways SMRTNET operates as a sophisticated electronic courier service. Much like mail or fax machines, SMRTNET does not own or control data. SMRTNET simply organizes and moves information according to HIPAA compliant instructions by SMRTNET members who are treating the same patient. The members always own and control their data. The instructions and regulations for transferring data are fully compliant with HIPAA and state law and are codified in a network agreement all members sign and follow.

There are numerous controls, which are generally much superior to controls on paper records that make certain that these rules are monitored and followed. As a federally funded research project, SMRTNET’s attention to the privacy and security of health information has always been an overreaching consideration of the network. The following experts have been included in the process of forming the SMRTNET data security processes: Bill Braithwaite, M.D., Ph.D. principal author of HIPAA. Dr. Braithwaite met with SMRTNET in Oklahoma to advise the network on the legal basis of health information exchange under HIPAA. He continues to be available to us as a consultant.

• Chris Sears, attorney for a sixteen-year-old data exchange in Indiana that exchanges over one billion pieces of health information for eleven hospitals, Medicaid, insurance, public health and other entities.
• Attorneys for the originating partners which are the Oklahoma State Department of Health, Oklahoma Department of Mental Health and Substance Abuse Services, Northeastern State University, Tahlequah City Hospital, NEO Community Health Center, and Cherokee Nation.
• A team of privacy officials from the partner agencies (above).
• Cerner, a company that is entrusted with personal health data by 1,500 hospitals and several interoperable networks, one with over two million lives.

Limits of Data Use

• The network is only used for treatment and treatment support as regulated by HIPAA, federal and state law and overseen by a public non-profit organization of healthcare providers.
• Only members who have applied and been accepted by the network can access data.
• The data cannot be used for research.
• Nobody can access a “list “of patients by any type except by approval of the management committee. Only data from one patient at a time can be seen and only for treatment or HIPAA related purposes.
• No employers, insurance companies or any non-member persons can access the data. 

Limited Data Set

The data shared is limited to the data types most needed to assist improving healthcare. These include diagnosis, medications, laboratory results, procedure codes, allergies and reactions, and other related information as determined by the public non-profit governance boards. 

Public and Transparent Oversight

The data exchange process is overseen by a management committee of provider agencies. The committee operates using a transparent process with public meetings and budgets under the umbrella of a legislatively created health authority. New members can be added to the management committee as the network grows. SMRTNET is made up of several health information exchange boards that oversee their particular health issues. These operate within the scope of the general management committee. 

Provider Oversight

• Each provider is issued a special identification and password, which they have to use to access the data. This is changed periodically.
• The provider must electronically certify that s/he is seeing the patient for treatment or treatment related issues before any information is shared.
• Every access to information is recorded.
• Within each organization only the level of information that is needed by that provider for treatment or support is shared. So, for instance, a clerk can only see the patient’s address but the physician can see medications and diagnosis.

Audits

• An audit report is issued to each member facility of SMRTNET of accesses by staff.
• Any provider or member can be audited for appropriate use at any time by request of any member. 

Patient Identification

• Name, date or birth, or social security number and other demographics identify patients before any information is shared.
• A sophisticated software program makes sure that names are correctly matched to records. Only statistically determined exact matches are shared. Close matches will be researched and corrections made by professional staff members when appropriate using additional demographics such as address and phone numbers to assure matches. 

Patient Oversight of Access and Use