HHS Demonstrates Secure Transmittal of Confidential Health Information

The Department of Health and Human Services’ (HHS) Substance Abuse and Mental Health Services Administration (SAMHSA) and the Department of Veterans Affairs (VA) yesterday demonstrated a new computer program that allows agencies to share individual patient information without permitting further disclosure. The Data Segmentation for Privacy (DS4P) Pilot allows providers to transmit information to other agencies with patient authorization, but prevents the other agencies from further transmitting that confidential information without obtaining new authorization. The goal of the program is to encourage patient participation in the health care system.

The DS4P Initiative was created to facilitate the transmittal of patient information to trusted agencies while protecting information from view by additional parties. The team received support from HHS’ Office of the National Coordinator for Health Information Technology (ONC) in creating the pilot. The DSP4 program tags specific confidential information when sending it to other parties, indicating how this information should be handled. The program allows patients to share relevant information for purposes of care, payment, analysis, research and reporting.

 In a mock transmittal yesterday, SAMHSA sent sensitive information to the VA. The subject patient wanted to transmit information about his participation in an alcohol and drug abuse treatment program to his primary care physician (PCP), without allowing his physician to share that information with other parties. The DSP4 tagged the information so that if the PCP attempted to transmit the sensitive information to a third party, such as a specialist, the system would not permit the transmittal and would require the PCP to contact the patient for authorization. John “Mike” Davis, Veterans Health Administration Security Architect, praised the program. In an HHS news release, he noted, “Data Segmentation . . . make[s] it possible for the first time, to consistently apply and enforce individual privacy choices whether in the primary care physician’s office, shared with other provider’s [sic], returned in reports from outside laboratories or wherever privacy protected health information is used.”