nlmpubs.nlm.nih.gov/2014.05.nlmpubs.nlm.nih.gov.tar/nlmpubs.nlm.nih.gov/bibs/cbm/confiden.txt

Text File | 1996-05-29 | 106KB | 2,822 lines

CBM  95-10



Confidentiality of Electronic Health Data:
Methods for Protecting Personally Identifiable Information


January 1990 through March 1996
448 Selected Citations


Prepared by

Ione Auston,  M.L.S., National Library of Medicine
Betsy  L. Humphreys,  M.L.S.,  National Library of Medicine
Paul D. Clayton, Ph.D., Columbia-Presbyterian Medical Center
Isaac S. Kohane,  M.D., Ph.D., Harvard Medical School
Lance J. Hoffman,  Ph.D., George Washington University
Zdenka Geisslerova, National Library of Medicine






U.S. DEPARTMENT OF HEALTH
 AND HUMAN SERVICES
Public Health Service
National Institutes of Health


National Library of Medicine
Reference Section
8600 Rockville Pike
Bethesda, Maryland  20894

1996










National Library of Medicine Cataloging in Publication



Confidentiality of electronic health data : methods for
  protecting personally identifiable information : January
  1990 through March 1996 : 448 selected citations /
  prepared by Ione Auston ... [et al.]. -- Bethesda, Md.
  (8600 Rockville Pike, Bethesda 20894) : U.S. Dept. of
  Health and Human Services, Public Health Service, National
  Institutes of Health, National Library of Medicine,
  Reference Section ; Pittsburgh, PA : Sold by the Supt. of
  Docs., U.S. G.P.O., 1996.
  -- (Current bibliographies in medicine ; 95-10)


  1. Confidentiality - bibliography  2. Computer Security
  - bibliography  3. Medical Informatics - bibliography  I.
  Auston, Ione  II. National Library of Medicine (U.S.).
  Reference Section  III. Title  IV. Series

  02NLM: ZW 1 N272 no.95-10










SERIES  NOTE


Current Bibliographies in Medicine (CBM) is a continuation in
part of theNational Library of Medicine's Literature Search
Series, which ceased in 1987 with No. 87-15.  In 1989 it also
subsumed the Specialized Bibliography Series.  Each bibliography
in the new series covers a distinct subject area of biomedicine
and is intended to fulfill a current awareness function.
Citations are usually derived from searching a variety of online
databases.  NLM databases utilized include MEDLINE, AVLINE,
BIOETHICSLINE, CANCERLIT,  CATLINE, HEALTH, POPLINE and TOXLINE.
The only criterion for the inclusion of a particular published
work is its relevance to the topic being presented; the format,
ownership, or location of the material is not considered.

Comments and suggestions on this series may be addressed to:

               Karen Patrias, Editor
               Current Bibliographies in Medicine
               Reference Section
               National Library of Medicine
               Bethesda, MD  20894
               Phone: [phone]
               Fax: [phone]
               Internet: [e-mail]

This bibliography, CBM 95-10, is the last publication in this
series for calendar year 1995.


Ordering Information:

Current Bibliographies in Medicine is sold by the Superintendent
of Documents, U.S. Government Printing Office, P.O. 371954,
Pittsburgh, PA  15250-7954.  To order the entire CBM series for
calendar year 1996 (approximately 10 bibliographies), send $47.00
($58.75 foreign) to the Superintendent of Documents citing GPO
List ID: CBM96.  For your convenience an order blank is given
inside the back cover.  Orders for individual bibliographies in
the series ($5.50, $6.88 foreign) should be sent to the
Superintendent of Documents citing the title, CBM number, and the
GPO List ID given above.


Internet Access:

The Current Bibliographies in Medicine series is also available
at no cost to anyone with Internet access through FTP (File
Transfer Protocol).  FTP to nlmpubs.nlm.nih.gov and login as
anonymous.  The index file in the "bibs" directory provides
information on the bibliographies available.



Use of funds for printing this periodical has been approved by
the Director of the Office of Management and Budget through
September 30, 1996.









FOREWORD


In 1995, in response to a request from the Vice-President of the
United States of America, the Department of Health and Human
Services assumed a leadership role in addressing four major
issues surrounding the use of the National Information
Infrastructure to advance health care and the public health: (1)
telemedicine; (2) health data privacy; (3) health data standards;
and (4) consumer access to health information.  One specific
health data privacy objective is the identification and
dissemination of information about current best practices for
ensuring the confidentiality of electronic health data.  This
bibliography of information sources that provide concrete
guidance on the policies, procedures, and technologies useful in
safeguarding electronic health data is a first step toward that
objective.  Although the bibliography contains many useful
references, the literature search conducted to produce it has
confirmed that published information about how to protect
electronic health data is fragmented and incomplete.  Many
institutions are currently addressing the need for comprehensive
policies and procedures for safeguarding electronic health, but,
to date, few institutional documents have been completed and
released.

Materials cited in this bibliography have been one source of
input to a study of "best practices" for protecting the
confidentiality of electronic health care data that is currently
being undertaken by the Computer Sciences and Telecommunications
Board of the National Research Council, under the chairmanship of
Paul Clayton, Ph.D., Columbia-Presbyterian Medical Center.
Funded by the National Library of Medicine and the Warren G.
Magnuson Clinical Center, National Institutes of Health, DHHS,
the study is also collecting data through a series of site visits
to institutions with electronic health information systems.  Its
final report, scheduled for release by January 1997, will bring
us a step closer to the goal of developing practical and coherent
guidelines for protecting the confidentiality of electronic
health data.


Nan D. Hunter
Deputy General Counsel
U.S. Department of Health and Human Services
Chair, Interdepartmental Health Privacy Working Group











CONFIDENTIALITY OF ELECTRONIC HEALTH DATA


Electronic health data can improve the quality and efficiency of
health care, research, and public health surveillance and
interventions.  To achieve these benefits without unacceptable
risk to patient confidentiality, electronic health data must be
created, used, transmitted, aggregated, and abstracted in ways
and in environments that maintain data security and accuracy;
prevent inadvertent or accidental release; prevent or deter
access by unauthorized users; and discourage, detect, and punish
inappropriate use of health data by unauthorized users.

This selective bibliography is primarily intended for those who
are responsible for protecting electronic health data and need
information on appropriate strategies for doing so.  It includes
references to publications, organizations, and electronic sources
that address methods for preserving the confidentiality and
security of electronic health data.  The methods covered include
technical approaches, institutional policies and procedures,
staff and patient education, and legal and regulatory
requirements.  In addition to substantive discussions of measures
for preserving confidentiality and security of health data, the
bibliography also has references to some recent standards and
guidelines that apply to electronic data in general.  Letters,
editorials, news items, and general descriptions of health
information systems in which security and privacy prevention are
mentioned briefly generally have been excluded.

The bibliography has a tight focus on how to protect electronic
health data and therefore also excludes references to the large
body of literature on related topics such as: the need to protect
privacy; the need for federal legislation; the potential privacy
and security problems associated with computer-based patient
records; the public's perceptions of privacy issues; special
ethical and privacy considerations associated with genetic
screening, AIDS testing, and occupational health records; the
conditions under which medical and psychiatric records must or
must not be disclosed to courts; the tension between privacy and
the public good in cases involving infectious disease, potential
violence, etc.; institutional review boards; and informed
consent, except as it relates directly to consent about use of
health data.

In general, publication dates for references included in this
bibliography range from January 1990 through March 1996, and
publications are primarily in English.  Journal articles, books
and book chapters, conference proceedings and papers, meeting
abstracts, laws and legal documents, and technical reports, as
well as unpublished documents, have been surveyed and selected
for inclusion.  Arrangement of the bibliography is by subject and
citations within each category are listed alphabetically by
author; a citation appears under only one category.

A number of Internet sites created by various organizations that
address confidentiality or computer security may be found by
using various world wide web searching tools.  A selected list of
these are included in the Organizations section of this
bibliography.  All Internet addresses were functional on the date
that this bibliography  became available.

The compilers wish to thank Marlyn Schepartz, National Library of
Medicine, for her technical assistance with production of this
bibliography.










SEARCH  STRATEGY


A variety of online databases are usually searched in preparing
bibliographies in the CBM series.  To assist you in updating or
otherwise manipulating the material in this search, the strategy
used for the NLM's MEDLINE database is given below.  Please note
that the search strategies presented here differ from individual
demand searches in that they are generally broadly formulated and
irrelevant citations edited out prior to printing.


SS 1 = CONFIDENTIALITY OR COMPUTER SECURITY OR PRIVACY (TW)
SS 2 = PATIENT IDENTIFICATION SYSTEMS OR PUBLIC HEALTH
ADMINISTRATION OR TELEMEDICINE OR DATABASES, FACTUAL OR NURSING
AUDIT OR PEER REVIEW, HEALTH CARE OR PROFESSIONAL REVIEW
ORGANIZATIONS OR MEDICAID OR SYSTEMS INTEGRATION OR JCAHO (MH)
SS 3 = *EPIDEMIOLOGIC METHODS (PX)
SS 4 = EXPLODE *MANAGEMENT INFORMATION SYSTEMS OR EXPLODE
*MEDICAL AUDIT OR EXPLODE *UTILIZATION REVIEW OR EXPLODE MEDICARE
OR EXPLODE CLINICAL TRIALS OR EXPLODE *MEDICAL INFORMATICS
SS 5 = EXPLODE OFFICE MANAGEMENT OR EXPLODE *INSURANCE
SS 6 = 1 AND 2
SS 7 = 1 AND 3
SS 8 = 1 AND 4
SS 9 = 1 AND 5
SS 10 = 6 OR 7 OR 8 OR 9




GRATEFUL MED and INTERNET GRATEFUL MED

To make online searching easier and more efficient, the Library
offers GRATEFUL MED, microcomputer-based software that provides a
user-friendly interface to most NLM databases.  This software was
specifically developed for health professionals and features
multiple choice menus and "fill in the blank" screens for easy
search preparation.  GRATEFUL MED runs on an IBM PC (or
IBM-compatible) with DOS 2.0 or a Macintosh, and requires a Hayes
(or Hayes-compatible) modem.  It may be purchased from the
National Technical Information Service in Springfield, Virginia,
for $29.95 (plus $3.00 per order for shipping).  For your
convenience, an order blank has been enclosed at the back of this
bibliography.

INTERNET GRATEFUL MED is available from the World Wide Web.  The
user with Internet access and an NLM user account need only point
a compatible Web browser (Netscape Navigator is strongly
recommended) to http://igm.nlm.nih.gov.  No other  software at
the user end is required.  At present, MEDLINE is the only NLM
database available through INTERNET GRATEFUL MED, but the Library
expects to add access to other files rapidly.










SAMPLE CITATIONS


Citations in this bibliographic series are formatted according to
the rules established for Index Medicus*.  Sample journal and
monograph citations appear below.  For journal articles written
in a foreign language, the English translation of the title is
placed in brackets; for monographs, the title is given in the
original language.  In both cases the language of publication is
shown by a three letter abbreviation appearing at the end of the
citation.



Journal Article:

   Authors                Article Title

Barrows RC Jr, Clayton PD.  Privacy, confidentiality, and
electronic medical records.
      J Am Med Inform Assoc 1996 Mar-Apr;3(2):139-48.

     Abbreviated Journal    Date  Volume  Issue  Pages
          Title



Monograph:

   Authors/Editors                            Title

Barber B, Treacher A, Louwerse CP, editors.  Towards security on
      medical telematics: legal and technical aspects.
      Washington: IOS Press; 1996.  252 p.

      Place of     Publisher  Date   Total No.
      Publication                    of Pages




_________________________________

*For details of the formats used for references, see the
following publication:

Patrias, Karen. National Library of Medicine recommended formats
for bibliographic citation.  Bethesda (MD):  The Library; 1991
Apr.  Available from: NTIS, Springfield, VA; PB91-182030.









TABLE  OF  CONTENTS





OVERVIEW
     General
     Health
POLICIES & POSITION STATEMENTS
     General
     Health
     Institutional
RISK ANALYSIS & CONTINGENCY PLANNING
EDUCATION & TRAINING
ACCESS CONTROL/AUTHENTICATION
PERSONAL IDENTIFIERS
AUDIT TRAILS
ELECTRONIC SIGNATURES
ENCRYPTION
SOFTWARE & APPLICATION DESIGN/PROTECTION
NETWORK SECURITY
IMAGES & TELEMEDICINE
SECONDARY USAGE OF HEALTH DATA
     Research & Quality Review
     Statistics
SMART CARDS
LAWS, REGULATIONS, LEGAL ASPECTS
     Federal
       Laws, Bills, & Regulations
       Legal Aspects - Commentary
     State
       Laws, Bills, & Regulations
       Legal Aspects - Commentary
     Other Countries
       Laws, Bills, & Regulations
       Legal Aspects - Commentary
OTHER BIBLIOGRAPHIES
ORGANIZATIONS
          General
          Health





OVERVIEW

  General


Bacard A. The computer privacy handbook. Berkeley (CA): Peachpit
Press; 1995.

Bowen J, Stavridou V.  [Safety-critical systems. Formal methods
are standards].  Genie Log Syst Expert 1993 Mar;30:37-64. (Fre).

Castano S. Database security. Reading (MA): Addison-Wesley; 1994.

Clark DD, Wilson DR. A comparison of commercial and military
computer security policies.  In: Proceedings of the 1987 IEEE
Symposium on Security and Privacy; 1987 Apr 27-29; Oakland, CA.
Washington: IEEE Computer Society Press; 1987.  p. 184-94.

Gilbert DM. Sample statements of work for federal computer
security services: for use in-house or contracting out. Lynch N,
editor. Gaithersburg (MD): National Institute of Standards and
Technology (US), Computer Systems Laboratory; 1991 Dec.  Report
No.: NIST Internal Report (NISTIR) 4749.  Available from: NTIS,
Springfield, VA; PB92-148261.

Guttman B, Roback EA. An introduction to computer security: the
NIST handbook. Gaithersburg (MD): National Institute of Standards
and Technology (US); 1995 Oct.  Report No.: NIST Special
Publication 800-12. 272 p.  Available from: US GPO, Washington;
SN003-003-03374-0.

National Institute of Standards and Technology (US); National
Computer Security Center (US). 17th National Computer Security
Conference; 1994 Oct 11-14; Baltimore, MD. [Ft. Meade (MD):
National Computer Security Center]; 1995. 2 vols.  Available
from: National Security Agency, Publications Office, Ft. Meade,
MD (410/766-8729).

National Institute of Standards and Technology (US), National
Computer Security Center (US). 18th National Information Systems
Security Conference); 1995 Oct 10-13; Baltimore. [Ft. Meade (MD):
National Computer Security Center]; 1996.  2 vols.  Available
from: National Security Agency, Publications Office, Ft. Meade,
MD (410/766-8729).  Formerly the National Computer Security
Conference.

Nazario NA, editor. General procedures for registering computer
security objects. Gaithersburg (MD): National Institute of
Standards and Technology (US), Computer Systems Laboratory; 1993
Dec.  Report No.: NIST Internal Report (NISTIR) 5308.  Available
from: NTIS, Springfield, VA; PB94-134897.

Saltman RG, editor. Good security practices for electronic
commerce, including electronic data interchange. Gaithersburg
(MD): National Institute of Standards and Technology (US),
Computer Systems Laboratory; 1993 Dec.  Report No.: NIST Special
Publication 800-9.  Available from: NTIS, Springfield, VA;
PB94-139045.

Saltman RG, editor. Workshop on Security Procedures for the
Interchange of Electronic Documents: selected papers and results.
Gaithersburg (MD): National Institute of Standards and Technology
(US), Computer Security Laboratory; 1993 Aug.  Report No.: NIST
Internal Report (NISTIR) 5247. 128 p.  Available from: NTIS,
Springfield, VA; PB94101854.

SECURICOM 95. Proceedings of the 13th Worldwide Congress on
Computer and Communications Security and Protection; 1995 Jun
8-9; Paris, France. Paris: Manifestations & Commun. Int.; 1995.
288 p.

United States, Congress, Office of Technology Assessment.
Information security and privacy in network environments.
Washington: U.S. Government Printing Office; 1994 Sep.  Report
No.: OTA-TCT-606.  244 p.

United States, Congress, Office of Technology Assessment.  Issue
update on information security and privacy in network
environments. Washington: U.S. Government Printing Office; 1995
Jun.  Report No.: OTA-BP-ITC-147.  142 p.


  Health


Bakker AR. Security in medical information systems.  In: van
Bemmel JH, McCray AT, editors. Yearbook of medical informatics:
Stuttgart: Schattauer; 1993. p. 52-60.

Barber B, Bakker A, Bengtsson S.  Conclusions and
recommendations.  Int J Biomed Comput 1994;35 Suppl:221-9.

Barber B, O'Moore R. The six safety first principles of health
information systems - Progress Report.  In: Commission of the
European Communities DG XIII/F AIM.  Data protection and
confidentiality in health informatics: handling health data in
Europe in the future.  Washington: IOS Press; 1991.  p. 308-14.
(Studies in health technology and informatics; vol. 1).

Barrows RC Jr, Clayton PD.  Privacy, confidentiality, and
electronic medical records.  J Am Med Inform Assoc 1996
Mar-Apr;3(2):139-48.

Benson T, Neame R. Healthcare computing: a guide to health
information management and systems. Harlow (Essex, UK): Longman
Group Ltd.; 1994. Chapter 11, Security and privacy;  p. 143-63.

Biskup J, Bleumer G. Reflections on security of database and data
transfer systems in health care.  In: Information processing '94.
Applications and impacts. Proceedings of the 13th IFIP World
Computer Congress; 1994 Aug 28-Sep 2; Hamburg, Germany.
Amsterdam: Elsevier Science Pub.; 1994. p. 549-56. (IFIP
transactions A (computer science and technology); vol.A-52).

Blum BI. Computer security in a clinical environment.  In:
Jajodia S, Landwehr CE, editors. Database Security, 4: Status and
Prospects. Results of the IFIP WG 11.3 workshop; 1990 Sep 18-21;
Halifax, UK. Amsterdam: North-Holland; 1991. p. 1-12.

Bruce JAC. Privacy and confidentiality of health care
information. 3rd ed. Chicago: American Hospital Pub.; Forthcoming
1996.

Bunz H, Bertsch A, Jurecic M, Baum-Waidner B. Secure multimedia
applications and teleservices: security requirements and
prototype for health care.  In: Steinmetz R, editor. Multimedia:
advanced teleservices and high-speed communication architectures.
Proceedings of the 2nd International Workshop, IWACA '94; 1994
Sep 26-28; Heidelberg, Germany. Berlin: Springer-Verlag; 1994. p.
224-36.

Caring for Health Information - Safety, Security and Secrecy.
Results of a working conference of the International Medical
Informatics Association. Heemskerk, The Netherlands, 1993 Nov
13-16.  Int J Biomed Comput 1994 Feb;35 Suppl:1-235.

Commission of the European Communities DG XIII/F AIM.  Data
protection and confidentiality in health informatics: handling
health data in Europe in the future. Washington: IOS Press; 1991.
Executive summary; p. 1-61. (Studies in health technology and
informatics; vol. 1).

Confidentiality and security measures for health care.  Toward
Electron Patient Rec 1994 Jun-Jul;3(1):1-13.

de Roulet D, Scherrer JR, editors. Data protection within a
hospital information system. In: SECURICOM 90. 8th Worldwide
Congress on Computer and Communications Security and Protection;
1990 Mar 14-16; Paris, France. Paris: SEDEP; 1990. p. 27-45.

Dolezol W.  System protection techniques within the hospital
information system at the hospitals of the University of
Wurzburg.  MUG Q 1991 Sep;21(4):27-32.

Furnell SM, Gaunt PN, Pangalos G, Sanders PW, Warren MJ.  A
generic methodology for health care data security.  Med Inf
(Lond) 1994 Jul-Sep;19(3):229-45.

Gabrieli ER.  Guidelines for minimal data security measures for
the protection of computer-based patient records.  J Clin Comput
1993;22(1):1-48.

Hamilton DL. Identification and evaluation of the security
requirements in medical applications. Bristol (UK):
Hewlett-Packard Laboratory; 1992 Jun.  Report No.: HPL-92-75.  11
p.

Health Records: Social Needs and Personal Privacy. Conference
Proceedings; 1993 Feb 11-12; Washington, DC. Washington: U.S.
Government Printing Office; 1993 Feb.  Also available from: NTIS,
Springfield, VA; PB94168192.

Hoffman LJ.  Data security and privacy in health information
systems.  Top Emerg Med 1995 Dec;17(4):24-6.

Iversen KR.  Security requirements for electronic patients
records: the Norwegian view.  Int J Biomed Comput 1994 Feb;35
Suppl:51-6.

Jurecic M, Bunz H. Exchange of patient records-prototype
implementation of a Security Attributes Service in X.500.  In:
Proceedings of 2nd ACM Conference on Computer and Communications
Security; 1994 Nov 2-4; Fairfax, VA. New York: ACM; 1994. p.
30-8.

Kaplan JG. Protecting sensitive medical information.  In:
Database Security, 6: Status and Prospects. IFIP WG 11.3
workshop; 1992 Aug 19-21; Vancouver, BC, Canada. [Amsterdam?:
North Holland?]; 1993. p. 1-14. (IFIP transactions A (computer
science and technology); vol. A-21).

Lincoln TL, Essin D. The computer-based patient record: issues of
organization, security and confidentiality.  In: Database
Security, 5: Status and Prospects. Results of the IFIP WG 11.3
workshop; 1991 Nov 4-7; Shepherdstown, WV. [Amsterdam?: North
Holland?]; 1992. p. 1-19. (IFIP transactions A (computer science
and technology); vol.A-6).

Louis Harris and Associates. Equifax-Harris consumer privacy
survey 1994. New York: The Associates; 1994.  Available from:
Equifax, Inc., Atlanta, GA.

Louis Harris and Associates. Equifax-Harris mid-decade consumer
privacy survey 1995. New York: The Associates; 1995.  Available
from: Equifax, Inc., Atlanta, GA.

Louis Harris and Associates. Health care information privacy: a
survey of the public and leaders. New York: The Associates; 1993.
Available from: Equifax, Inc., Atlanta, GA.

Louwerse CP.  The organisation and management of information
security issues in health care.  Int J Biomed Comput 1994 Feb;35
Suppl:195-200.

Meranda D.  Administrative and security challenges with
electronic patient record systems.  J AHIMA 1995 Mar;66(3):58-60.

Moehr JR.  Privacy and security requirements of distributed
computer based patient records.  Int J Biomed Comput 1994 Feb;35
Suppl:57-64.

O'Connor K.  Confidentiality, privacy and security concerns in
the modern healthcare environment.  Aust Comput J 1994
Aug;26(3):70-7.

Pfitzmann A, Pfitzmann B. Technical aspects of data protection in
health care informatics. In: Noothoven van Goor J, Christensen
JP, editors.  Advances in medical informatics: results of the AIM
Exploratory Action.  Washington: IOS Press; 1992.  p. 368-86.
(Studies in health technology and informatics; vol. 2).

Schmaus D.  Computer security and data confidentiality.  AORN J
1991 Oct;54(4):885-90.

Shea S, Sengupta S, Crosswell A, Clayton PD.  Network information
security in a phase III Integrated Academic Information
Management System (IAIMS).  Proc Annu Symp Comput Appl Med Care
1992;16:283-6.

Task Force on the Privacy of Private-Sector Health Records. Final
report. Rockville (MD): Kunitz and Associates, Inc.; 1995 Sep.
Contract No.: HHS-100-91-0036.  128 p. plus appendices.
Sponsored by the U.S. Department of Health and Human Services.

United States, Congress, Office of Technology Assessment.
Bringing health care online: the role of information
technologies. Washington: U.S. Government Printing Office; 1995
Sep.  Report No: OTA-ITC-624.  Chapter 3, Networks for health
information;  p. 79-122.

United States, Congress, Office of Technology Assessment.
Protecting privacy in computerized medical information.
Washington: U.S. Government Printing Office; 1993 Sep.  Report
No.: OTA-TCT-576.  157 p.

Woodward B.  The computer-based patient record and
confidentiality.  N Engl J Med 1995 Nov 23;333(21):1419-22.

Wright B.  Security concerns of computer-based health care
information.  Comput Secur J 1994 Spring;10(1):83-9.


POLICIES & POSITION STATEMENTS

  General


Bennett CJ. Regulating privacy: data protection and public policy
in Europe and the United States. Ithaca (NY): Cornell University
Press; 1992.

Information and Privacy Commissioner/Ontario. Access and the
Canadian information highway: submission to the Information
Highway Advisory Council Secretariat in response to the
Discussion Paper entitled Access, Affordability and Universal
Service on the Canadian Information Highway. [Ottawa (Ontario,
Canada): The Commissioner]; 1995 Mar.  8 p.

Information and Privacy Commissioner/Ontario. The information
highway: access and privacy principles. [Ottawa (Ontario,
Canada): The Commissioner]; 1994 Dec.  12 p.

Information and Privacy Commissioner/Ontario. Privacy and the
Canadian information highway: submission to the Information
Highway Advisory Council Secretariat. [Ottawa (Ontario, Canada):
The Commissioner]; 1994 Dec.  12 p.

Information Infrastructure Task Force (IITF), Information Policy
Committee, Privacy Working Group. Privacy and the National
Information Infrastructure: principles for providing and using
personal information.  Final version. [Washington]: The Group;
1995 Oct. [13 p.]  Available from:  Office of Management and
Budget, Washington, DC.

Information Infrastructure Task Force (IITF), National
Information Infrastructure Security Issues Forum. NII security:
the federal role. [Washington]: The Forum; 1995 Jun 5.  [35 p.]
Available from: Office of Management and Budget, Washington, DC.
Draft report issued for public comment, June 14, 1995.

Irving L, Farquhar MC, Brown KC, et al. Privacy and the NII.
Safeguarding telecommunications - related personal information.
[Washington]: Department of Commerce (US), National
Telecommunications and Information Administration; 1995 Oct.  28
p., Appendix A1-9.


  Health


American College of Healthcare Executives. Ethical policy
statement. Medical records confidentiality.  Healthc Exec 1994
May-Jun;9(3):43.

American Medical Association, Council on Ethical and Judicial
Affairs. Current opinions of the Council on Ethical and Judicial
Affairs.  Chicago: The Association; 1992.  Section 7.00, Opinions
on physician records;  p. 32-3.

American Medical Association, Council on Ethical and Judicial
Affairs. Current opinions of the Council on Ethical and Judicial
Affairs.  Chicago: The Association; 1992.  Sections 5.05-5.09,
Confidentiality;  p. 25-8.

Anderson RJ. Security in clinical information systems [monograph
online]. Cambridge (UK): University of Cambridge Computer
Laboratory; 1996 Jan 12.  Available from: World Wide Web,
http://www.cl.cam.ac.uk/users/rja14/policy11/policy11.html.
Prepared for the British Medical Association.

Barber B, Jensen OA, Lamberts H, Roger-France F, De Schouwer P,
Zöllner H. The six safety first principles of health information
systems: A programme of implementation: part 1 safety and
security.  In: Commission of the European Communities DG XIII/F
AIM.  Data protection and confidentiality in health informatics:
handling health data in Europe in the future. Washington: IOS
Press; 1991.  p. 296-301.  (Studies in health technology and
informatics; vol. 1).

Barber B, Treacher A, Louwerse CP, editors. Towards security in
medical telematics: legal and technical aspects. Washington: IOS
Press; 1996. 252 p. (Studies in technology and informatics; vol.
27).

Bengtsson S, Solheim BG. Enforcement of data protection, privacy
and security in medical informatics.  In: Lun KC, Degoulet P,
Piemme TE, Rienhoff O, editors. MEDINFO 92. Proceedings of the
7th World Congress on Medical Informatics; 1992 Sep 6-10; Geneva,
Switzerland. Vol. 2.  Amsterdam: North-Holland; 1992. p. 1561-5.

Blair JS. Overview of standards related to the emerging health
care information infrastructure. Schaumburg (IL): The
Computer-based Patient Record Institute; 1995 Jan.  Reprinted by
the Computer-based Patient Record Institute with permission of
CRC Press.

Brandt MD. Issue: disclosure of health information. A position
statement.  Chicago: American Health Information Management
Association; 1993 Dec. 2 p.

Brandt MD. Issue: disclosure of health information relating to
alcohol and drug abuse.  A position statement.  Chicago: American
Health Information Management Association; 1993 Dec. 1 p.

Brandt MD. Issue: facsimile transmission of health information.
A position statement.  Chicago: American Health Information
Management Association; 1994 May. 3 p.

Brandt MD. Issue: managing health information relating to
infection with the human immunodeficiency virus (HIV).  A
position statement.  Chicago: American Health Information
Management Association; 1994 Feb. 2 p.

Brandt MD. Issue: patient cards.  A position statement.  Chicago:
American Health Information Management Association; 1993 Nov. 2
p.

Brandt MD. Issue: protecting patient information after a closure.
A position statement.  Chicago: American Health Information
Management Association; 1994 Apr. 4 p.

Brandt MD. Issue: physician signatures on attestations.  A
position statement.  Chicago: American Health Information
Management Association; 1993 Nov. 1 p.

Brandt MD. Issue: redisclosure of health information.  A position
statement.  Chicago: American Health Information Management
Association; 1993 Dec. 1 p.

Brandt MD. Issue: retention of health information.  A position
statement.  Chicago: American Health Information Management
Association; 1994 Mar. 2 p.

Brandt MD. Maintenance, disclosure, and redisclosure of health
information.  Chicago: American Health Information Mangement
Association; 1993. 23 p.

Canadian Medical Association.  The medical record:
confidentiality, access and disclosure. [CMA policy summary].
Can Med Assoc J 1992 Dec 15;147(12):1860A-1860B. (Eng, Fre).

Christensen JP, Villasante J. Data protection and confidentiality
in health care informatics. In: Noothoven van Goor J, Christensen
JP, editors.  Advances in medical informatics: results of the AIM
Exploratory Action.  Washington: IOS Press; 1992.  p. 387-92.
(Studies in health technology and informatics; vol. 2).

Computer-based Patient Record Institute (CPRI). Guidelines for
establishing information security policies at organizations using
computer-based patient record systems. Schaumburg (IL): The
Institute; 1995.  Prepared by the CPRI Work Group on
Confidentiality, Privacy, and Security, 1995 Feb.

Computer-based Patient Record Institute (CPRI). Position paper:
access to patient data. Schaumburg (IL): The Institute; 1994 Apr
15.

Computer-based Patient Record Institute (CPRI). Position paper:
authentication in a computer-based patient record. Schaumburg
(IL): The Institute; 1993 Aug 11.

Conference of Medical Royal Colleges and Their Faculties in the
United Kingdom.  Interim guidelines on confidentiality and
medical audit.  BMJ 1991 Dec 14;303(6816):1525.

Conference of Medical Royal Colleges and Their Faculties in the
United Kingdom, Audit Working Group.  Access to medical records
for the purposes of medical audit. [Statement].  BMJ 1993 Apr
3;306(6882):896-7.

Council on Competitiveness. Highway to health: transforming U.S.
health care in the information age. Washington: The Council; 1996
Mar. Chapter 4, Integration of health information systems; p.
40-60.

Data confidentiality--could this policy work for you?  QRC Advis
1993 May;9(7):7-8.

De Schouwer P, Barber B, Jensen OA, Lamberts H, Roger-France F,
Zöllner H. The six safety first principles of health information
systems: A programme of implementation: Part 2 the environment,
convenience and legal issues.  In: Commission of the European
Communities DG XIII/F AIM.  Data protection and confidentiality
in health informatics: handling health data in Europe in the
future.  Washington: IOS Press; 1991.  p. 302-07.  (Studies in
health technology and informatics; vol. 1).

Feasibility of ensuring confidentiality and security of
computer-based patient records. Council on Scientific Affairs,
American Medical Association.  Arch Fam Med 1993 May;2(5):
556-60.

Feste L. Issue: confidentiality of the computer-based patient
record.  A position statement. Chicago: American Health
Information Management Association; 1992 Jul. 2 p.

Feste LK. Issue: patient access to personal health information.
A position statement.  Chicago: American Health Information
Management Association; 1992 Mar. 2 p.

Guideline No. 4. Security of data held in computer systems.
Institute of Health Record Information and Management.  IHRIM
1995 Feb;36(1 Suppl):1-2.

Health care information: collection and privacy [microfiche] :
Hearing Before the Senate Comm. on Governmental Affairs, 103rd
Cong., 2d Sess. (May 6, 1994). Washington: U.S. Government
Printing Office; 1995.  125 p.  Available from: US GPO,
Washington; Y 4.G 74/9:S.HRG. 103-100.

Joint Commission on Accreditation of Healthcare Organizations.
1996 accreditation manual for hospitals. Vol.1, Standards.
Chicago: The Commission; 1996.  Section 2, Management of
information; p. 171-90.

Mayo Clinic Foundation, Information Security Subcommittee. Data
security policies and standards.  Unpublished internal document
dated September 1994.

Metzger JB, Stevens JM, Schwartz JE, Nelson R.  Implications of
the JCAHO information management initiative for information
systems.  Healthc Inf Manage 1994 Spring;8(2):23-30.

National Healthcare Billing Audit Guidelines, adopted March 13,
1992. AHIMA, AHA, Association of Healthcare Internal Auditors,
Blue Cross and Blue Shield Association, HFMA, and HIAA. J AHIMA
1992 Jun;63(6):105-9.

Pitman SC.  Standards in the medical transcription service
industry.  J Am Health Inf Manag Assoc 1992;63(7):75-7.

Position statement: Confidentiality of the computer-based patient
record. American Health Information Management Association.  J
AHIMA 1992 Sep;63(9):125-6.

Sommerville A. Confidentiality and medical records.  In: British
Medical Association, Ethics Science and Information Division.
Medical ethics today: its practice and philosophy. London: BMJ
Publishing Group; 1993. p. 36-68, 339-40.

Tiemann S. The individual, society and the protection of personal
data.  In: Commission of the European Communities DG XIII/F AIM.
Data protection and confidentiality in health informatics:
handling health data in Europe in the future. Washington: IOS
Press; 1991.  p. 62-4. (Studies in health technology and
informatics;  vol. 1).

United States, Congress, Office of Technology Assessment.
Genetic monitoring and screening in the workplace. Washington:
U.S. Government Printing Office; 1990 Oct.  Report No.:
OTA-BA-455.  262 p.

Users and uses of patient records. Report of the Council on
Scientific Affairs. Council on Scientific Affairs, American
Medical Association.  Arch Fam Med 1993 Jun;2(6):678-81.

Wanerus P, Brandt MD. Issue: Managing health information in
facility mergers and acquisitions. A position statement.
Chicago: American Health Information Management Association; 1994
Apr. 4 p.

Wogan MJ. Issue: HCFA's uniform clinical data set (UCDS).  A
position statement.  Chicago: American Health Information
Management Association; 1991 Nov.  2 p.

Work Group on Computerization of Patient Records.  Toward a
national health information infrastructure: report of the Work
Group on Computerization of Patient Records to the Secretary of
the U.S. Department of Health and Human Services.  [Washington:
Department of Health and Human Services (US)]; 1993 Apr.

Workgroup for Electronic Data Interchange (WEDI). The new
Workgroup for Electronic Interchange, summary report, April 1995.
[place unknown]: The Workgroup; 1995?

Workgroup on Electronic Data Interchange (WEDI). Report, October
1993. [place unknown]: The Workgroup; 1993?

Workgroup for Electronic Data Interchange (WEDI). Report to
Secretary of U.S. Department of Health and Human Services, July
1992. [place unknown]: The Workgroup; 1992?


  Institutional


Brandt M.  Developing an information management plan.  J AHIMA
1995 May;66(5):24-8, 30, 32-3.

Gramlich D.  Confidentiality issues in the 90's.  NAHAM Manag J
1992 Fall;18(2):6-8.
Hospital survey shows computer-based patient record protection
weaknesses.  Inf Manag Bull 1994 Fall;7(3-4):5-6.

Katsikas SK, Gritzalis DA.  The need for a security policy in
health care institutions.  Int J Biomed Comput 1994 Feb;35
Suppl:73-80.


RISK ANALYSIS & CONTINGENCY PLANNING


Bakker AR. Benefits and threats of new technologies.  In:
Commission of the European Communities DG XIII/F AIM. Data
protection and confidentiality in health informatics: handling
health data in Europe in the future. Washington: IOS Press; 1991.
p. 191-6.  (Studies in health technology and informatics; vol.
1).

Bakker AR. Computers in hospitals, vulnerability aspects.  In:
Adlassnig KP, Grabner G, Bengtsson S, Hansen R, editors. Medical
Informatics Europe 1991. Proceedings; 1991 Aug 19-22; Vienna,
Austria. Berlin: Springer-Verlag; 1991. p. 62-6.  (Lecture notes
in medical informatics; 45).

Barber B.  Are your systems securely engineered?  Br J Healthc
Comput Inf Manag 1995 Apr;12(3):30-1.

Barber B, Davey J.  Approaching safe and secure health
information systems in Europe.  Comput Methods Programs Biomed
1994 Jul;44(1):23-9.

Barber B, Davey J. The use of the CCTA risk analysis and
management methodology (CRAMM) in health information systems.
In: Lun KC, Degoulet P, Piemme TE, Rienhoff O, editors. MEDINFO
92. Proceedings of the 7th World Congress on Medical Informatics;
1992 Sep 6-10; Geneva, Switzerland. Vol. 2. Amsterdam:
North-Holland; 1992. p. 1589-93.

Barber B, Fairey M.  Attack and defence: NHS security and data
protection programme.  Br J Healthc Comput Inf Manag 1995
Jul;12(6):30-2.

Berleur J, Beardon C, Laufer R, editors. Proceedings of the IFIP
WG9.2 Working Conference on Facing the Challenge of Risk and
Vulnerability in an Information Society; 1993 May 20-22; Namur,
Belgium. Amsterdam: Elsevier Science Pub.; 1993.  311 p. (IFIP
Transactions A (Computer Science and Technology); vol.A-33).

Brandt M.  Confidentiality today: where do you stand?  J AHIMA
1993 Dec;64(12):59-62.

Cloud AC.  An EDP audit with a twist.  Inf Exec 1990
Fall;3(4):14-5.

Cox TP.  The 'paperless' physician office: a risk management
perspective.  J Healthc Risk Manag 1993 Fall;13(4):29-35.

Davey J. Risk analysis and management.  In: Commission of the
European Communities DG XIII/F AIM.  Data protection and
confidentiality in health informatics: handling health data in
Europe in the future.  Washington: IOS Press; 1991.  p. 350-9.
(Studies in health technology and informatics; vol. 1).

Eleazar PY.  Risks associated with clinical databases.  Top
Health Rec Manag 1991 Nov;12(2):49-58.

Ferraiolo DF, Gilbert DM, Lynch N. Assessing federal and
commercial information security needs. Gaithersburg (MD):
National Institute of Standards and Technology (US), Computer
Systems Laboratory; 1992 Nov.  Report No: NIST Internal Report
(NISTIR) 4976.  Available from: NTIS, Springfield, VA;
PB93-138956.

Furnell SM, Sanders PW, Stockel CT. An expert system for health
care data security: a conceptual outline.  In: Ifeachor EC, Rosen
KG, editors. Proceedings of the International Conference on
Neural Networks and Expert Systems in Medicine and Healthcare.;
1994 Aug 23-26; Plymouth, UK. Plymouth (UK): Univ. of Plymouth;
1994.  p. 346-52.

Gabrieli ER.  Data security.  J Clin Comput 1992;21(1-2):17-41.

Gritzalis D, Tomaras A, Katsikas S, Keklikoglou J.  Data security
in medical information systems: the Greek case.  Comput Secur
1991 Apr;10(2):141-59.

Liczbanski M.  Protect your data!  Data Based Advis 1992
May;10(5):114-24.

Louwerse CP. Practical aspects of handling data protection and
data security.  In: Commission of the European Communities DG
XIII/F AIM.  Data protection and confidentiality in health
informatics: handling health data in Europe in the future.
Washington: IOS Press; 1991.  p. 324-33. (Studies in health
technology and informatics; vol. 1).

Miller D.  Security, durability & portable computers.  Healthc
Inform 1993 May;10(5):72, 74.

Miller DW.  Commonly overlooked information security issues.
Toward Electron Patient Rec 1994 May;2(10):1, 3-7.
Morris DC.  It could never happen here!  Comput Healthc 1990
Aug;11(8):38-44.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Guideline for the analysis of local area
network security. Gaithersburg (MD): The Institute; 1994 Nov.
(Federal information processing standards; FIPS PUB 191).
Available from: NTIS, Springfield, VA.

Pangalos GJ.  Medical database security evaluation.  Med Inf
(Lond) 1993 Oct-Dec;18(4):283-92.

Picukaric JM.  The computer-based patient record: risks,
security, and the HIM role. J AHIMA 1992 Mar;63(3):78-84.

Skok R.  Security systems: malpractice insurance for healthcare
organizations.  J AHIMA 1993 Jan;64(1):51-2.

Warnock-Matheron A, Gruending DL, Hannah KJ.  A risk management
approach to the security of hospital information systems.  Can J
Nurs Adm 1993 May-Jun;6(2):22-4, 30.

Warren MJ, Sanders PW, Gaunt PN. Security criteria expert system
concept: the healthcare application.  In: Ifeachor EC, Rosen KG,
editors. Proceedings of the International Conference on Neural
Networks and Expert Systems in Medicine and Healthcare; 1994 Aug
23-26; Plymouth, UK. Plymouth (UK): Univ. Plymouth; 1994.  p.
146-53.


EDUCATION & TRAINING


Brown MM.  Building respect for confidentiality through
education.  J AHIMA 1993 Dec;64(12):65-6.

Computer-based Patient Record Institute (CPRI). Guidelines for
information security education programs at organizations using
computer-based patient record systems. Schaumburg (IL): The
Institute; 1995.  Prepared by the CPRI Work Group on
Confidentiality, Privacy, and Security, 1995 Jun.

Merski P.  Optical imaging the Right way. J AHIMA 1993
May;64(5):69-72.

Self-assessment tool. Confidentiality and security in the
computer-based patient record environment. J AHIMA 1992
May;63(5):77-9.

Smith HJ, Kallman EA.  Information privacy: medical record
directors' perceptions of policy and practice.  J AHIMA 1993
Feb;64(2):48-51.


ACCESS CONTROL/ AUTHENTICATION


Birkegaard N. User authorization in distributed hospital
information systems.  In: Commission of the European Communities
DG XIII/F AIM. Data protection and confidentiality in health
informatics: handling health data in Europe in the future.
Washington: IOS Press; 1991.  p. 285-95.  (Studies in health
technology and informatics; vol. 1).

Biskup J. Protection of privacy and confidentiality in medical
information systems: problems and guidelines.  In: Spooner DL,
Landwehr C, editors. Database Security, 3: Status and Prospects.
Results of the IFIP WG 11.3 workshop; 1989 Sep 5-7; Monterey, CA.
Amsterdam: North-Holland; 1990. p. 13-23.

Biskup J, Eckert C. [Secure delegation in information systems].
In: Weck G, Horster P, editors. Proceedings of VIS '93; 1993 May
11-13; Munich, Germany. Wiesbaden: Vieweg; 1993.  p. 107-33.
(Ger).

Bobis KG. Implementing right to know security in the
computer-based patient record. In: Proceedings of the IEEE 13th
Annual International Phoenix Conference on Computers and
Communications; 1994 Apr 12-15; Phoenix, AZ. Piscataway (NJ):
IEEE; 1994. p. 156-60.

Brannigan VM.  A framework for Need to Know authorizations in
medical computer systems: responding to the constitutional
requirements.  Proc Annu Symp Comput Appl Med Care 1994;18:392-6.

Dargahi R, Classen DW, Bobroff RB, Petermann CA, Moreau DR, Beck
JR, Buffone GJ. The development of a data security model for the
Collaborative Social and Medical Services System.  Proc Annu Symp
Comput Appl Med Care 1994;18:349-53.

Decoster C.  [Data protection within the Ministry of Public
Health and in the hospitals].  Acta Hosp 1994;34(1):87-91. (Dut).

Eichenwald S.  Information technologies. Physician- hospital
networks.  J AHIMA 1992 Mar;63(3):50-1.

Gritzalis D, Katsikas S, Keklikoglou J, Tomaras A.  Data security
in medical information systems: technical aspects of a proposed
legislation.  Med Inf (Lond) 1991 Oct-Dec;16(4):371-83.

Henkind SJ, Orlowski JM, Skarulis PC.  Application of a
multilevel access model in the development of a security
infrastructure for a clinical information system.  Proc Annu Symp
Comput Appl Med Care 1993;17:64-8.

High-tech privacy issues in health care: Hearings Before the
Subcomm. on Technology and the Law of the Senate Comm. on the
Judiciary,  103d Congress, 1st and 2d Sess. (October 27, 1993,
and January 27, 1994). Washington: U.S. Government Printing
Office; 1994.  137 p.  Available from: US GPO, Washington; Y 4.J
89/1; Y 4.J 89/22:S.HRG.103-836.

Kohler CO.  [Medical documentation in the 'new health care
system'].  Nachr Dok 1994 May-Jun;45(3):135-42. (Ger).

Lonquet P, Barthier S, Leport C, Bompis B, Guilloy Y, Vlide JL.
Assessement of a written procedure to improve the protection of
confidentiality for hospitalized patients.  Int Conf AIDS 1991
Jun 16-21;7(1):424.  Abstract no. M.D.4138.

Morris P, McDermid J. The structure of permissions: a normative
framework for access rights.  In: Database Security, 5: Status
and Prospects. Results of the IFIP WG 11.3 workshop; 1991 Nov
4-7; Shepherdstown, WV. [Amsterdam?: North Holland?]; 1992. p.
77-97. (IFIP transactions A (computer science and technology);
vol.A-6).

Murphy G, Anderson EM.  An organizational model for data access
and management--work in progress.  J AHIMA 1994 Aug;65(8):50-2,
54.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Automated password generator (APG).
Gaithersburg (MD): The Institute; 1993 Oct. (Federal information
processing standards; FIPS PUB 181).  Available from: NTIS,
Springfield, VA.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Guideline for the use of advanced
authentication technology alternatives. Gaithersburg (MD): The
Institute; 1994 Sep.  (Federal information processing standards;
FIPS PUB 190).  Available from: NTIS, Springfield, VA.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Standard on password usage. Gaithersburg
(MD): The Institute; 1985 May. (Federal information processing
standards; FIPS PUB 112).  Available from: NTIS, Springfield, VA.

Notargiacomo LA, Graubart RD, Jajodia S, Landwehr CE. Health
delivery: the problem solved?  In: Database Security, 4. Status
and Prospects.  Results of the IFIP WG 11.3 workshop; 1990 Sep
18-21; Halifax, UK. Amsterdam: North-Holland; 1991. p. 13-26.

Orr GA, Brantley BA Jr.  Development of a model of information
security requirements for enterprise-wide medical information
systems.  Proc Annu Symp Comput Appl Med Care 1992;16:287-91.

Pangalos G, Khair M, Bozios L.  Enhancing medical database
security.  J Med Syst 1994 Aug;18(4):159-71.

Pangalos GJ.  Medical database security policies.  Methods Inf
Med 1993 Nov;32(5):349-56; discussion 357.

Peterson HE. Management and staff issues in data protection.  In:
Commission of the European Communities DG XIII/F AIM. Data
protection and confidentiality in health informatics: handling
health data in Europe in the future.  Washington: IOS Press;
1991.  p. 315-23.  (Studies in health technology and informatics;
vol. 1).

Pinkert JR.  Contemporary issues in HIM. Kerberos--security for
sensitive data.  J AHIMA 1994 Jun;65(6):22-4, 26-8.

Quisquater JJ, Bouckaert A. Zero-knowledge procedures for
confidential access to medical records.  In: Quisquater JJ,
Vandewalle J, editors. Advances in cryptology - EUROCRYPT '89.
Proceedings of the Workshop on the Theory and Application of
Cryptographic Techniques; 1989 Apr 10-13; Houthalen, Belgium.
Berlin: Springer-Verlag; 1990.  p. 662-4.

Rihaczek K. Data protection in networks.  In: Commission of the
European Communities DG XIII/F AIM.  Data protection and
confidentiality in health informatics: handling health data in
Europe in the future.  Washington: IOS Press; 1991.  p. 249-70.
(Studies in health technology and informatics; vol. 1).

Riley WD.  Safe as a bank.  LAN Technol 1992 May;8(5):29-31.

Safran C, Rind D, Citroen M, Bakker AR, Slack WV, Bleich HL.
Protection of confidentiality in the computer-based patient
record.  MD Comput 1995 May-Jun;12(3):187-92.

Sandhu RS, Coyne EJ, Feinstein HL, Youman CE.  Role-based access
control models.  Computer 1996 Feb;29(2):38-47.

Shimaoka A.  Security evaluation for the information system of
Oita Medical University Hospital [abstract].  Annu Meet Int Soc
Technol Assess Health Care 1994;10:Abstract no. 131.

Wear LL, Pinkert JR.  Computer security.  J AHIMA 1993
Sep;64(9):30-2, 34, 36-7.

Yamamoto K, Ishikawa K, Miyaji M, Nakamura Y, Nishi S, Sasaki T,
Tsuji K, Watanabe R.  Necessity to improve common understanding
about the security issues among hospitals in Japan and some
feasible approaches.  Int J Biomed Comput 1994 Feb;35
Suppl:205-12.


PERSONAL IDENTIFIERS


American Medical Informatics Association.  Standards for medical
identifiers, codes, and messages needed to create an efficient
computer-stored medical record.  J Am Med Inform Assoc 1994
Jan-Feb;1(1):1-7.

Asher A, Edson D, Howell E, Pence K. The unique record number: an
alternative to traditional person identifiers.  In: Toward the
year 2000: refining the measures. Proceedings of the 24th Public
Health Conference on Records and Statistics; 1993 Jul 19-21;
Washington. Hyattsville (MD): National Center for Health
Statistics (US); 1994.  p. 308-11.

Baitty RL, Jain RB, Hager C, Pope W, Goosby EP, Bowen GS.
Protecting confidentiality in a national reporting system for HIV
services.  Int Conf AIDS 1993 Jun 6-11;9:947  Abstract no.
PO-D36-4374.

Barber B, France FR, Winkeler B, Olsen P. The EuroHealth
Database-handling personal data without access to personal
identification.  In: Adlassnig KP, Grabner G, Bengtsson S, Hansen
R, editors.  Medical Informatics Europe 1991. Proceedings;
1991 Aug 19-22; Vienna, Austria. Berlin: Springer-Verlag; 1991.
p. 646-52. (Lecture notes in medical informatics; 45).

Carpenter PC, Chute CG.  The Universal Patient Identifier: a
discussion and proposal.  Proc Annu Symp Comput Appl Med Care
1993;17:49-53.

Concept models of patient identification: issues surrounding the
use of social security numbers for patient identification.
Toward Electron Patient Rec 1993;Analysis 2:1-15.

Dilger K.  [Use of computers for patient data and billing].
Fortschr Ophthalmol 1990;87 Suppl:S1-4. (Ger).

Fitzmaurice JM, Murphy G, Wear P, Korpman R, Weber G, Whiteman J.
Patient identifiers: stumbling blocks or cornerstones for CPRs
(computer-based patient records)?  Healthc Inform 1993
May;10(5):38-40, 42.

Gabrieli ER.  Guide for unique healthcare identifier model.  J
Clin Comput 1993;21(5):101-39.

Gardner RM.  Integrated computerized records provide improved
quality of care with little loss of privacy.  J Am Med Inform
Assoc 1994 Jul-Aug;1(4):320-2.

Goldschmidt AJW, Gaal L.  [Optimised computer-aided random number
generation for achieving anonymity of patients' records].  Softw
Kur Med Psychol 1991;4(5):145-50. (Ger).

Information and Privacy Commissioner/Ontario. Privacy and
electronic identification in the information age. [Ottawa
(Ontario, Canada): The Commissioner]; 1994 Nov.  13 p.

Meux E. California's experience: SSN and confidentiality.  In:
Toward the year 2000: refining the measures.  Proceedings of the
24th Public Health Conference on Records and Statistics (US);
1993 Jul 19-21; Washington. Hyattsville (MD): National Center for
Health Statistics (US); 1994. p. 312-4.

Meux E.  Encrypting personal identifiers.  Health Serv Res 1994
Jun;29(2):247-56.

Mjolsnes SF. Privacy, cryptographic pseudonyms, and the state of
health. In: Imai H, Rivest RL, Matsumoto T, editors. Advances in
cryptology - ASIACRYPT '91. Proceedings of the International
Conference on the Theory and Application of Cryptology; 1991 Nov
11-14; Fujiyoshida, Japan. Berlin: Springer-Verlag; 1993.  p.
493-4.

Mulligan D. Methods of identifying individuals in health
information systems. In: Toward an electronic patient record '95.
11th International Symposium on the Creation of Electronic Health
Record Systems. Proceedings; 1995 Mar 14-19; Orlando, FL.  Vol.
2.  Newton (MA): Medical Records Institute; 1995.  p. 428-41.

National ID systems demand proper safeguards. Data Protection
Registrar advocates debate.  IHRIM 1994 Aug;35(3):9-10.

Szolovits P, Kohane I.  Against simple universal health-care
identifiers.  J Am Med Inform Assoc 1994 Jul-Aug;1(4):316-9.

Thirion X, Maldonado J, Sambuc R, San Marco JL.  An experiment in
the anonymous distribution of AIDS-medicaments in Southern
France.  Int Conf AIDS 1990 Jun 20-23;6(3):301.  Abstract no.
S.D.845.

Waegemann CP.  Patient identifiers: insurance identification and
patient identification in health care.  Executive summary.
Toward Electron Patient Rec 1993 Oct;Analysis 3:10-4.

Williams BC, Demitrack LB, Fries BE.  The accuracy of the
National Death Index when personal identifiers other than Social
Security number are used.  Am J Public Health 1992 Aug;82(8):
1145-7.


AUDIT TRAILS


Bakker AR. Special care needed for the heart of medical
information systems.  In: Biskup J, Morgenstern M, Landwehr CE,
editors. Database Security, 8: Status and Prospects.  Proceedings
of the IFIP WG11.3 Working Conference on Database Security; 1994
Aug 23-26; Bad Salzdetfurth, Germany. London: Chapman & Hall
Ltd.; 1994. p. 3-10. (IFIP transactions A (computer science and
technology); vol. A-60).

Borten K. Using an audit facility to protect patient data at the
Massachusetts General Hospital.  In: Toward an electronic patient
record '95. 11th International Symposium on the Creation of
Electronic Health Record Systems.  Proceedings; 1995 Mar 14-19;
Orlando, FL. Newton (MA): Medical Records Institute; 1995.  p.
115-20.

Hammond JE, Berger RG, Carey TS, Fakhry SM, Rutledge R, Kichak
JP, Cleveland TJ, Dempsey MJ, Tsongalis NM, Ayscue CF.  Report on
the clinical workstation and clinical data repository utilization
at UNC Hospitals.  Proc Annu Symp Comput Appl Med Care
1994;18:276-80.

Hayam A.  Security Audit Center--a suggested model for effective
audit strategies in health care informatics.  Int J Biomed Comput
1994 Feb;35 Suppl:115-27.

Kowalski S.  An accountability server for health care information
systems.  Int J Biomed Comput 1994 Feb;35 Suppl:129-38.

Muhlenberg provides secure access to patient files.  Commun News
1995 May;32(5):16.

Schwartz M.  Protecting patient data confidentiality in the
healthcare environment. EDPACS 1993 Sep;21(3):12-8.

Walker NS.  An integrated clinical computer system: implications
for a medical information services department.  J AHIMA 1994
Dec;65(12):41-3.


ELECTRONIC SIGNATURES


Barber B, Douglas S.  An initial approach to the security
techniques required by the electronic patient record.  Int J
Biomed Comput 1994 Feb;35 Suppl:33-8.

Branstad DK, editor. Report of the NIST Workshop on Digital
Signature Certificate Management, December 10-11, 1992.
Gaithersburg (MD): National Institute of Standards and Technology
(US), Computer Systems Laboratory; 1993 Aug.  Report No.: NIST
Internal Report (NISTIR) 5234.  Available from: NTIS,
Springfield, VA; PB94-135001.

Bryant LE Jr.  Health law: legal authorization for the electronic
signature or computer-generated signature code on medical records
in Illinois.   J AHIMA 1992 Sep;63(9):18-9.

Curtis EH.  Electronic signature of computerized patient records.
Top Health Inf Manag 1994 Aug;15(1):64-73.

French B, Priester RA.  Electronic signature thrives in different
environments.  J AHIMA 1995 Jun;66(6):61-3.

Kadzielski MA, Reynolds MB.  Legal review: auto- authentication
of medical records raises verification concerns.  Top Health Inf
Manag 1993 Aug;14(1):77-82.

Lima C.  Challenges in the approval process for the physician
computerized signature.  J AHIMA 1993 Feb;64(2):55-8.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Digital signature standard (DSS).
Gaithersburg (MD): The Institute; 1994 May 19. (Federal
information processing standards; FIPS PUB 186).  Available from:
NTIS, Springfield, VA.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Secure hash standard. Gaithersburg (MD): The
Institute; 1995 Apr. (Federal information processing standards;
FIPS PUB 180-1).  Available from: NTIS, Springfield, VA.

Noel LA.  Electronic signatures: a brief overview.  J Am Med Rec
Assoc 1991 Sep;62(9):38-43.

Silva A.  Electronic signatures: one hospital's approach.  J Am
Med Rec Assoc 1991 Jul;62(7):24-5.

Smith JP.  Authentication of digital medical images with digital
signature technology.  Radiology 1995 Mar;194(3):771-4.

Waegemann CP.  The new standard guide for electronic signatures.
ASTM Stand News 1995 Aug;23(8):4-7.


ENCRYPTION


Abou-Tayiem E. Implementation of the RSA public-key cryptosystem.
Stevenage (Herts, UK): Institution of Electrical Engineers; 1995.

Baum MS. Federal certification authority liability and policy.
Gaithersburg (MD): National Institute of Standards and Technology
(US), Computer Systems Laboratory; 1994 Jun.  Report No: NIST GCR
94-654.  Available from: NTIS, Springfield, VA; PB94-191202.

Garfinkel S. PCP: pretty good privacy. Sebastopol (CA): O'Reilly
& Associates, Inc.; 1994.

Houser WR.  NIST's 'victory' will save DSS users an arm and a
leg.  Gov Comput News 1993 Jul 5;12(14):25-6.

National Institute of Standards and Technology (US).  Proposed
Federal Information Processing Standard (FIPS) for public key
cryptographic entity authentication mechanisms.  Fed Regist 1995
Jun 6;60(108):29830-2.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Appendix 5. Example of the DSA. Gaithersburg
(MD): The Institute; 1995 Oct 2.  (Federal information processing
standards; FIPS PUB 186).

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Data encryption standard. Gaithersburg (MD):
The Institute; 1993 Dec (Reaffirmed until 1998).  (Federal
information processing standards; FIPS PUB 46-2).  Available
from: NTIS, Springfield, VA.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Escrowed encryption standard (EES).
Gaithersburg (MD): The Institute; 1994 Feb. (Federal information
processing standards; FIPS PUB 185).  Available from: NTIS,
Springfield, VA.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Key management using ANSI X9.17. Gaithersburg
(MD): The Institute; 1992 Apr. (Federal information processing
standards; FIPS PUB 171).  Available from: NTIS, Springfield, VA.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Security requirements for cryptographic
modules. Gaithersburg (MD): The Institute; 1994 Jan.  (Federal
information processing standards; FIPS PUB 140-1).  Available
from: NTIS, Springfield, VA.

National Institute of Standards and Technology (US), Computer
Systems Laboratory.  Standard on computer data authentication.
Gaithersburg (MD): The Institute; 1985 May.  (Federal information
processing standards; FIPS PUB 113). Available from: NTIS,
Springfield, VA.

Oldehoeft AE, Branstad D, editors. Report of the NIST Workshop on
Key Escrow Encryption. Gaithersburg (MD): National Institute of
Standards and Technology (US), Computer Systems Laboratory; 1994
Jun.  Report No.: NIST Internal Report (NISTIR) 5468.  Available
from: NTIS, Springfield, VA; PB94-209459.

Olnes J.  EDIFACT security made simple-the EDIMED approach.
Comput Secur 1993 Dec;12(8):765-74.

Schneier B. Applied cryptography: protocols, algorithms and
source code in C. 2nd ed. New York: Wiley & Sons, Inc.; 1995.

Stevens A.  Hacks, spooks, and data encryption.  Dr Dobbs J 1990
Sep;15(9):127-38.

Zamparo R. A study of OSI key management. Gaithersburg (MD):
National Institute of Standards and Technology (US), Computer
Systems Laboratory; 1992 Nov.  Report No.: NIST Internal Report
(NISTIR) 4983.  Available from: NTIS, Springfield, VA;
PB93-151579.


SOFTWARE & APPLICATION DESIGN/PROTECTION


Bassham LE, Polk WY. Security of SQL-based implementations of
product data exchange using STEP. Gaithersburg (MD): National
Institute of Standards and Technology (US), Computer Systems
Laboratory; 1993 Oct.  Report No.: NIST Internal Report (NISTIR)
5283.  Available from: NTIS, Springfield, VA; PB94-139649.

Bassoe CF.  [Data hygiene. Data security, prevention of wrong or
useless information and high quality of communication].  Tidsskr
Nor Laegeforen 1995 Jan 20;115(2):252-5. (Nor).

Baum-Waidner B, Bunz H, Capellaro C.  SAMSON, security management
in a health care scenario.  In: Kugler HJ, Mullery A, Niebert N,
editors. 2nd International Conference on Intelligence in
Broadband Services and Networks; 1994 Sep 7-9; Aachen, Germany.
Berlin: Springer-Verlag; 1994. p. 503-12.

Bennett PA. Safety standards in medical software.  In: Commission
of the European Communities DG XIII/F AIM.  Data protection and
confidentiality in health informatics: handling health data in
Europe in the future.  Washington: IOS Press; 1991.  p. 197-213.
(Studies in health technology and informatics; vol. 1).

Biskup J. Medical database security.  In: Commission of the
European Communities DG XIII/F AIM.  Data protection and
confidentiality in health informatics: handling health data in
Europe in the future.  Washington: IOS Press; 1991.  p. 214-30.
(Studies in health technology and informatics; vol. 1).

Cannataci JA. Data protection issues in database management and
expert systems.  In: Commission of the European Communities DG
XIII/F AIM.  Data protection and confidentiality in health
informatics: handling health data in Europe in the future.
Washington: IOS Press; 1991.  p. 161-80.  (Studies in health
technology and informatics; vol. 1).

Davey J.  Tools and techniques for the development of secure
software.  Int J Biomed Comput 1994 Feb;35 Suppl:173-8.

Eichinger S, Pernul G. Design environment for a hospital
information system: meeting the data security challenge.  In: Lun
KC, Degoulet P, Piemme TE, Rienhoff O, editors. MEDINFO 92.
Proceedings of the 7th World Congress on Medical Informatics;
1992 Sep 6-10; Geneva, Switzerland. Vol.2.  Amsterdam:
North-Holland; 1992.  p. 1582-8.

Filsinger J. Integrity and the audit of trusted database
management systems.  In: Database Security, 6: Status and
Prospects. IFIP WG 11.3 workshop; 1992 Aug 19-21; Vancouver, BC,
Canada. [Amsterdam?: North-Holland?]; 1993. p. 349-65. (IFIP
transactions A (computer science and technology); vol. A-21).

Haber L.  Prevention is the best medicine. (impact and prevention
of computer viruses and the emergence of anti-virus software).
MIDRANGE Syst 1992 Feb 4;5(3):68-70.

Kailey JB, editor. Validated products list 1995 No. 2. Vol. 1,
Programming languages, database language SQL, graphics, POSIX,
and computer security; Vol. 2, GOSIP. Gaithersburg (MD): National
Institute of Standards and Technology (US), Computer Systems
Laboratory; 1995 Apr.  Report No: NIST Internal Report (NISTIR)
5629.  Available from: NTIS, Springfield, VA; PB95-937301.

Kemmerer RA. A multi-level formal specification of a mental
health care database.  In: Jajodia S, Landwehr CE, editors.
Database Security, 4: Status and Prospects. Results of the IFIP
WG 11.3 workshop; 1990 Sep 18-21; Halifax, UK. Amsterdam:
North-Holland; 1991. p. 27-51.

Morgan JD.  Point of care and patient privacy: who is in control?
Top Health Inf Manag 1994 May;14(4):36-43.

Pangalos G, Pomportsis A, Bozios L, Khair M. Development of
secure medical database systems.  In: Karagiannis D, editor.
Proceedings of DEXA 94; 1994 Sep 7-9; Athens, Greece. Berlin:
Springer-Verlag; 1994. p. 680-9.

Polk WT, Bassham LE. A guide to the selection of anti-virus tools
and techniques. Gaithersburg (MD): National Institute of
Standards and Technology (US), Computer Systems Laboratory; 1992
Dec.  (NIST special publication; 800-5).  Available from: NTIS,
Springfield, VA; PB93-152049.

Polk WT, Bassham LE. Security issues in the database language
SQL. Gaithersburg (MD): National Institute of Standards and
Technology (US), Computer Systems Laboratory; 1993 Aug. (NIST
special publication; 800-8).  Available from: US GPO, Washington;
SN 003-003-03225-5.

Ting TC. Application information security semantics: a case of
mental health delivery.  In: Spooner DL, Landwehr C, editors.
Database Security, 3: Status and Prospects. Results of the IFIP
WG 11.3 workshop; 5-7 Sep 1989; Monterey, CA. Amsterdam:
North-Holland; 1990. p. 1-12.

Ulirsch RC, Ashwood ER, Noce P.  Security in the clinical
laboratory. Guidelines for managing the information resource.
Arch Pathol Lab Med 1990 Jan;114(1):89-93.

van Dorp HD, Dubbeldam JF.  The AIM SEISMED guidelines for system
development and design.  Int J Biomed Comput 1994 Feb;35
Suppl:179-86.

Watt R.  Security in VAX DSM Version 6.0.  MUG Q 1991
Jun;21(3):106-11.

Weingarten J.  Can confidential patient information be kept
private in high-tech medicine?  MD Comput 1992
Mar-Apr;9(2):79-82.


NETWORK SECURITY


Bagwill R, Barkley J, Carnahan L, et al.  Security in open
systems. Gaithersburg (MD): National Institute of Standards and
Technology (US), Computer Systems Laboratory; 1994 Jul. (NIST
special publication; 800-7). Available from: US GPO, Washington;
SN003-003-03276-0.

Bleumer G.  Security for decentralized health information
systems.  Int J Biomed Comput 1994 Feb;35 Suppl:139-45.

Campbell LA.  How secure is the Internet for health care
applications?  Toward Electron Patient Rec 1995 Jun-Jul;4(1):1,
3-16.

Castagna R.  The well-guarded LAN.  PC Sources 1991
Sep;2(9):139-42.

Cheswick WR, Bellowin SM. Firewalls and Internet security:
repelling the wily hacker. Reading (MA): Addison-Wesley Pub. Co.,
Inc.; 1994.   306 p.

Dayanim J.  Disaster recovery: options for public and private
networks. (includes related article on network recovery for
integrated LAN/WAN networks). Telecommunications 1991 Dec;
25(12):48-52.

de Roulet D, Le HS, Scherrer JR.  The technical conditions for an
open architecture. Int J Biomed Comput 1994 Feb;35 Suppl:107-14.

Fernandez Del Val C. Medical network security and viruses.  In:
Commission of the European Communities DG XIII/F AIM. Data
protection and confidentiality in health informatics: handling
health data in Europe in the future.  Washington: IOS Press;
1991.  p. 271-84.  (Studies in health technology and informatics;
vol. 1).

Harwood R.  Install the wall.  DEC Prof 1994 Dec;13(12):44-5.

Howlett P, Powell T.  United we stand (hospital network
security).  Br J Healthc Comput Inf Manag 1994 Oct;11(8):26-7.

Klimmins J, Dinkel C, Walters D. Telecommunications security
guidelines for telecommunications management network.
Gaithersburg (MD): National Institute of Standards and Technology
(US); 1995 Oct.  37 p. (NIST special publication; 800-13).
Available from: US GPO, Washington; SN003-003-03376-6.

Leon BJ, Narayanan R. Network management information for system
control.  In: Proceedings of GLOBECOM '93. IEEE Global
Telecommunications Conference; 1993 Nov 29 - Dec 2; Houston, TX.
Vol. 3. New York: IEEE; 1993.  p. 1553-7.

McWilliams S.  How Boston's Beth Israel Hospital copes with
security on the Internet.  IS Anal 1994 Dec;33(12):12-6.

Moehr JR, McDaniel JG.  Security precautions for networked
computers.  Dimens Health Serv 1991 Apr;68(3):21-4.

National Institute of Standards and Technology (US), Computer
Systems Laboratory. Standard security label for information
transfer. Gaithersburg (MD): The Institute; 1994 Sep. (Federal
information processing standards; FIPS PUB 188).  Available from:
NTIS, Springfield, VA.

Pfitzmann A, Pfitzmann B. Security in medical networks.  In:
Commission of the European Communities DG XIII/F AIM.  Data
protection and confidentiality in health informatics: handling
health data in Europe in the future.  Washington: IOS Press;
1991.  p. 231-48.  (Studies in health technology and informatics;
vol. 1).

Private Branch Exchange (PBX) security guidelines. Gaithersburg
(MD): National Institute of Standards and Technology (US),
Computer Systems Laboratory; 1993 Sep.  Report No.: NIST GCR
93-635.  Available from: NTIS, Springfield, VA; PB94-100880.

Rotenberg M.  Communications privacy: implications for network
design.  Commun ACM 1993 Aug;36(8):61-9.

Vaughan-Nichols S.  Safety nets and Unix networks.  Comput Shopp
1991 Dec;11(12):770-2.

Wack JP, Carnahan LJ. Keeping your site comfortably secure: an
introduction to Internet firewalls. Gaithersburg (MD): National
Institute of Standards and Technology (US), Computer Systems
Laboratory; 1994 Dec.  (NIST special publication; 800-10).
Available from: US GPO, Washington; SN003-03313-8.


IMAGES & TELEMEDICINE


Gilbert F.  How to minimize the risk of disclosure of patient
information used in telemedicine.  Telemed J 1995;1(2):91-4.

Kuroda C, Yoshioka H, Kadota T, Narumi Y, Okamoto H, Kumatani T,
Hiruma O, Kumatani Y, Yoshida J.  Small PACS for digital medical
images--reliability and security in a clinical setting.  Comput
Methods Programs Biomed 1994 May;43(1-2):101-6.

Manny B.  Professional practice forum: photographs and
videotapes.  J AHIMA 1992 Dec;63(12):24-6.

Norton SA, Lindborg CE, Delaplain CB.  Consent and privacy in
telemedicine.  Hawaii Med J 1993 Dec;52(12):340-1.

Ohyama N.  IS & C system and file protection mechanism.  Comput
Methods Programs Biomed 1994 May;43(1-2):37-42.

Parsons DF.  Progress and problems of interhospital consulting by
computer networking.  Ann N Y Acad Sci 1992 Dec 17;670:1-11.

Savkar S, Waters RJ.   Telemedicine - implications for patient
confidentiality and privacy.  Health Inf Syst Telemed 1995;
(1):4-7.

Smith JP.  Ensuring confidentiality on computer networks.  Diagn
Imaging (San Franc) 1995 Jul;17(7):43-4, 47.

Yachida M, Kitagawa H.  [File security techniques on Image Save
and Carry system]. J Inst Telev Eng Jpn 1993 Feb;47(2):154-7.
(Jpn).


SECONDARY USAGE OF HEALTH DATA


  Research & Quality Review


Agency for Health Care Policy and Research (US). Report to
Congress: the feasibility of linking research-related data bases
to federal and non-federal medical adminstrative data bases.
Rockville (MD): The Agency; 1991 Apr.  (AHCPR Pub; no. 91-0003).

Benbassat J, Levy M. Ethical and legal problems in researcher's
access to data stores. In: Allebeck P, Jannsson B, editors.
Ethics in medicine: individual integrity versus demands of
society. New York: Raven Press; 1990.  p. 159-65.

Bentley-Cooper JE.  Protecting human research from an invasion of
privacy: the unintended results of the Commonwealth Privacy Act
1988.  Aust J Public Health 1991 Sep;15(3):228-34.

Berglund CA.  Australian standards for privacy and
confidentiality of health records in research: implications of
the Commonwealth Privacy Act.  Med J Aust 1990 Jun
18;152(12):664-9.

Beto JA, Geraci MC, Marshall PA, Bansal VK.  Pharmacy computer
prescription databases: methodologic issues of access and
confidentiality.  Ann Pharmacother 1992 May;26(5):686-91.

Clayton EW.  Panel comment: why the use of anonymous samples for
research matters.  J Law Med Ethics 1995;23(4):375-7.

Donaldson MS. Regional health databases, health services
research, and confidentiality: summary of an invitational
workshop. National Implications of the Development of Regional
Health Database Organizations; 1994 Jan 31-Feb 1; Washington.
Washington: Institute of Medicine; 1994.  49 p.

Donaldson MS, Lohr KN, editors. Health data in the information
age: use, disclosure, and privacy. Washington: National Academy
Press; 1994.   257 p.

Edouard L, Rawson NS.  Use of personal records for research
purposes. Identification numbers help maintain confidentiality
[letter].  BMJ 1995 Jan 28;310(6974):257-8.  Comment on: BMJ 1994
Nov 26;309(6966):1422-4.

Fayerweather WE, Tirey SL, Baldwin JK, Hoover BK.  Issues in data
sharing and access: an industry perspective.  J Occup Med 1991
Dec;33(12):1253-6.

Flaherty DH.  Privacy, confidentiality, and the use of Canadian
health information for research and statistics.  Can Public Adm
1992 Spring;35(1):75-93.

Gostin LO, Lazzarini Z.  Childhood immunization registries.  A
national review of public health information systems and the
protection of privacy.  JAMA 1995 Dec 13;274(22):1793-9.

Gulbinat W.  Dialogue: will the increased integration of
information systems necessitate lowering standards for patient
confidentiality and data privacy? Balancing individual and
societal needs: micro- vs. macro-ethics.  Behav Healthc Tomorrow
1994 Jan-Feb;3(1):32, 39-41.

Hakulinen T.  [Cancer registry and data security].  Nord Med
1993;108(8-9):213-5. (Swe).

Harding N, Giles A, Graveney M. Evolution and protection of the
health care record as a European document.  In: Commission of the
European Communities DG XIII/F AIM.  Data protection and
confidentiality in health informatics: handling health data in
Europe in the future.  Washington: IOS Press; 1991.  p. 88-121.
(Studies in health technology and informatics; vol. 1).

Helgason T.  Epidemiological research needs access to data.
Scand J Soc Med 1992 Sep;20(3):129-33.

Jones JK, Staffa J, Lian J, Miwa L.  Record linkages.  Eur J Clin
Res 1994;6:87-91.

Kluge EH.  Advanced patient records: some ethical and legal
considerations touching medical information space. Methods Inf
Med 1993 Apr;32(2):95-103. Comment in: Methods Inf Med 1993
Apr;32(2):104-7.

Kluge EH.  Health information, the fair information principles
and ethics.  Methods Inf Med 1994 Oct;33(4):336-45. Comment in:
Methods Inf Med 1994 Oct;33(4):348-50.

Lawrence LM.  Safeguarding the confidentiality of automated
medical information.  Jt Comm J Qual Improv 1994
Nov;20(11):639-46.

Lincoln TL.  Privacy: a real-world problem with fuzzy boundaries
[editorial].  Methods Inf Med 1993 Apr;32(2):104-7.  Comment on:
Methods Inf Med 1993 Apr;32(2):95-103.

Lincoln TL, Essin DJ.  In search of rules for confidentiality: a
critique of oneproposal [editorial].  Methods Inf Med 1994
Oct;33(4):348-50.  Comment on: Methods Inf Med 1994
Oct;33(4):336-45.

Logan JA 3rd, Hebbeler G.  Formatting and presenting quality data
to medical staffs and hospital boards.  Physician Exec 1994 Oct;
20(10):19-21.

Lousson JP.  [Teletransmission, health care and deontology].  Ann
Pharm Fr 1995;53(2):79-82. (Fre).

Lowel H, Lewis M, Gostomzyk J, Keil U.  [Population-based heart
infarct register in the Augsburg region: possibilities and
limitations].  Soz Praventivmed 1991;36(3):159-65. (Ger).

Lynge E.  European directive on confidential data: a threat to
epidemiology [editorial].  BMJ 1994  Feb 19;308(6927):490.
Comment on: BMJ 1994 Feb 19;308(6927):522-3.

McClure ML.  The uses and abuses of large data sets.  J Prof Nurs
1991 Mar-Apr;7(2):72.

Panda SK, Nagabhushanam A.  Fuzzy data distortion.  Comput Stat
Data Anal 1995 May;19(5):553-62.

Reilly PR.  Panel comment: the impact of the Genetic Privacy Act
on medicine.  J Law Med Ethics 1995;23(4):378-81.

Schrage R.  [Cancer register problems--modified reporting law
model for the improvement of data protection].  Offentl
Gesundheitswes 1991 Nov;53(11):746-52. (Ger).

Ten Ham M.  Confidentiality of medical databases and
pharmaco-epidemiology.  Drug Inf J 1995;29(1):343-49.

Thomas SP.  Issues in data management and storage.  J Neurosci
Nurs 1993 Aug;25(4):243-5.

Tuchsen F, Bach E, Andersen O, Jorgensen J.  The use of a
national hospital register for hypothesis generation.  Inf Serv
Use 1990;10(1-2):15-23.

van der Leer OF.  The use of personal data for medical research:
how to deal with new European privacy standards.  Int J Biomed
Comput 1994 Feb;35 Suppl:87-95.

Verloove-Vanhorick SP, Brand R.  [Perinatal registration: a pilot
study of matching of data from the National Obstetrics
Registration and the National Neonatology Registration].  Ned
Tijdschr Geneeskd 1992 Oct 24;136(43):2127-31. (Dut)

Walsh M, Cortez F.  Quality assurance system must balance
functionality with data security.  Comput Nurs 1991
Jan-Feb;9(1):27-8.

Wan L.  The legality of unlinked anonymous screening for HIV
infection: the U.S. approach.  Health Policy 1990
Jan-Feb;14(1):29-35.

Westrin CG.  Ethical, legal, and political problems affecting
epidemiology in European countries.  IRB 1993 May-Jun;15(3):6-8.


  Statistics


Ahituv N, Lapid Y, Neumann S.  Protecting statistical databases
against retrieval of private information.  Comput Secur 1988
Feb;7(1):59-63.

Denning DE, Schlorer J.  Inference controls for statistical
databases.  Computer 1983 Jul:69-82.

Duncan GT, Jabine TB, de Wolf VA, editors. Private lives and
public policies: confidentiality and accessibility of government
statistics. Washington: National Academy Press; 1993.

Guynes CS, Maples GE, Prybutok VR.  Privacy issues in statistical
database environments.  Comput Soc 1995 Dec;25(4):3-5.

Hoffman LJ, Miller WF.  Getting a personal dossier from a
statistical data bank.  Datamation 1970 May;16(5):74-5.

Ozsoyoglu G, Chin FY.  Enhancing the security of statistical
databases with a question-answering system and a kernel design.
IEEE Transact Softw Eng 1982 May;SE-8(3):223-34.

Thelot B.  [A general solution to the linkage of anonymous
medical data].  C R Acad Sci III 1990;310(8):333-8. (Fre).


SMART CARDS


Allaert FA, Dusserre L.  Security of health information system in
France: what we do will no longer be different from what we tell.
Int J Biomed Comput 1994 Feb;35 Suppl:201-4.

Boulanger MH.  Legal aspects of the medical data card. I.  Comput
Law Secur Rep 1990 Sep-Oct;6(3):8-11.

Card technologies.  Toward Electron Patient Rec 1993 Oct;Analysis
3:1-6.

Chaum D, editor. Smart Card 2000. Selected papers from the 2nd
International Smart Card 2000 Conference; 1989 4-6 Oct;
Amsterdam, Netherlands. Amsterdam: North-Holland; 1991. 206 p.

de Martino A. The laser card: a challenge for physicians.  In:
Waegemann CP, editor.  Patient care with computers and cards. 5th
Global Congress on Patient Cards and Computerization of Health
Records; 1993 Jun 7-9; Venice, Italy. Newton (MA): Medical
Records Institute; 1993.   p. 33-5.

Guanyabens J, Baig B. AIM coordinated action on patient data
cards.  In: Noothoven van Goor J, Christensen JP, editors.
Advances in medical informatics: results of the AIM Exploratory
Action.  Washington: IOS Press; 1992.   p. 393-96.  (Studies in
health technology and informatics; vol. 2).

Guibert H, Gamache A.  Optical memory card applicability for
implementing a portable medical record.  Med Inf (Lond) 1993
Jul-Sep;18(3):271-8.

Gunner C. Portable health card interface for multiple health care
applications.  In: 3rd Global Conference on Patient Cards; 1991
Mar 12-15; Barcelona, Spain. Newton (MA): Medical Records
Institute; 1991.  p. 305-16.

Hartleb U. Administrative aspects of data protection.  In:
Commission of the European Communities DG XIII/F AIM.  Data
protection and confidentiality in health informatics: handling
health data in Europe in the future.  Washington: IOS Press;
1991.  p. 334-49.  (Studies in health technology and informatics;
vol. 1).

Hayes G. The AIM Patient Data Card Working Group's view of
security.  In: 3rd Global Conference on Patient Cards; 1991 Mar
12-15; Barcelona, Spain. Newton (MA): Medical Records Institute;
1991. p. 280-3.

Klein GO.  Smart cards--a security tool for health information
systems.  Int J Biomed Comput 1994 Feb;5 Suppl:147-51.

Kohler CO, Rienhoff O, Schaeffer OP, editors. Health cards '95.
Proceedings of the Health Cards '95 Conference; 1995 Oct 23-26;
Frankfurt. Washington: IOS Press; 1995. 372 p. (Studies in health
technology and informatics; vol. 26).

Krings G.  Intelligent memory chips for smart cards.  Siemens
Compon (Eng Ed) 1994 Jan-Feb;29(1):13-7.

Kuhnel E, Klepser G, Engelbrecht R.  Smart cards and their
opportunities for controlling health information systems.  Int J
Biomed Comput 1994 Feb;35 Suppl:153-7.

Martelli M, Tenneriello L. The CP8 smart card: a technology for
solutions in medical areas.  In: Waegemann CP, editor. Patient
care with computers and cards. 5th Global Congress on Patient
Cards and Computerization of Health Records; 1993 Jun 7-9;
Venice, Italy. Newton (MA): Medical Records Institute; 1993. p.
36-8.

Nguyen Nam T, Printz Y, Saadoui S, Nicolay A. Benefit and risk
assessment of computerized health cards: a case study.  In:
Berleur J, Beardon C, Laufer R, editors. Proceedings of the IFIP
WG9.2 Working Conference on Facing the Challenge of Risk and
Vulnerability in an Information Society; 1993 May 20-22; Namur,
Belgium. Amsterdam: Elsevier Science Pub.; 1993. p. 153-60. (IFIP
transactions A (computer science and technology); vol. A-33).

Pangalos G.  Design and implementation of computer-readable
patient data cards--applications in Europe.  Med Inf (Lond) 1992
Oct-Dec;17(4):243-56.

Paradinas P, Vandewalle JJ. A personal and portable database
server: the CQL card.  In: Litwin W, Risch T, editors.
Proceedings of 1994 International Conference on Applications of
Databases; 1994 Jun 21-23; Vadstena, Sweden. Berlin:
Springer-Verlag; 1994.  p. 444-57.

Pernice A, Doare H, Rienhoff O, editors. Healthcare card systems,
EUROCARDS concerted action, European Commission, Healthcare
Telematics, DG XIII-C4. Washington: IOS Press; 1995. 218 p.
(Studies in health technology and informatics; vol. 22).

Poullet Y, Boulanger MH.  Data protection-medicine. III. Towards
a new normative framework.  Comput Law Secur Rep 1991
Jan-Feb;6(5):18-23.

Poullet Y, Boulanger MH.  Part II-existing regulations applicable
to medical data cards.  Comput Law Secur Rep 1990
Nov-Dec;6(4):25-8.

Quisquater JJ. Practical zero-knowledge protocols.  In:
Proceedings of Compsec International 1990; 1990 Oct 10-12;
London. Oxford (UK): Elsevier Advanced Technol.; 1990. p. 427-8.

Rossing N, Pernice A.  Harmonized developments of patient data
cards in the European Community.  Toward Electron Patient Rec
1993 Oct;Analysis 3:6-10.

Scherrer JR. Smart cards and medical data protection.  In: 3rd
Global Conference on Patient Cards; 1991 Mar 12-15; Barcelona,
Spain. Newton (MA): Medical Records Institute; 1991. p. 276-9.

Seaton B.  The smart card: a tool for smart hospitals.  Dimens
Health Serv 1991 Apr;68(3):15-8.

Takac PF.  A discussion of the application of smart cards within
health care.  Int J Comput Appl Technol 1993;6(2-3):112-21.

Waegemann CP.  The role of patient cards in health care.  Toward
Electron Patient Rec 1993 Oct;2(3):1, 3-4, 8-15.


LAWS, REGULATIONS, LEGAL ASPECTS


  Federal

    - Laws, Bills, & Regulations


A Bill to Safeguard Individual Privacy of Genetic Information
from the Misuse of Records Maintained by Agencies or Their
Contractors or Grantees for the Purpose of Research, Diagnosis,
Treatment, or Identification of Genetic Disorders, and to Provide
to Individuals Access to Records Concerning their Genome which
are Maintained by Agencies for Any Purpose. H.R. 2045, 102d
Cong., 1st Sess. (1991).  Introduced April 24, 1991 by John
Conyers.

Civil money penalties for failure to report on medical
malpractice payments and for breaching the confidentiality of
information--HHS. Final rule.  Fed Regist 1991 Jun
21;56(120):28488-94.

Fair Health Information Practices Act of 1995.  H.R.435, 104th
Congress, 1st Sess. (1995).  Introduced by Gary Condit,
California.

Federal Privacy Act of 1974, 5 U.S.C. Sec. 552a (1988).

Medicaid program: computer matching and privacy protection for
Medicaid eligibility--HCFA. Final rule.  Fed Regist 1994 Jan
31;59(20):4252-5.

Medical Records Confidentiality Act of 1995.  S.1360, 104th
Congress, 1st Sess. (1995).  Introduced by Robert Bennett, Utah.

Smith RE, Sulanowski JS, editors.  Compilation of state and
federal privacy laws. Providence (RI): Privacy Journal; 1992.
Medical records; p. 32-7.


     - Legal Aspects - Commentary


Alpert S.  Smart cards, smarter policy. Medical records, privacy,
and health care reform.  Hastings Cent Rep 1993
Nov-Dec;23(6):13-23.

American Health Information Management Association.  Health
information model legislation language.  Chicago: AHIMA; 1993
Feb. 14 p.

American Health Information Management Association. Language for
model health information legislation on creation, authentication
and retention of computer-based patient records. Chicago: AHIMA;
1995 May.   6 p.

Andresen DC.  The computerization of health care: can patient
privacy survive?  J Health Hosp Law 1993 Jan;26(1):1-10, 19.

Annas GJ, Glantz LH, Roche PA.  Drafting the Genetic Privacy Act:
science, policy, and practical considerations.  J Law Med Ethics
1995;23(4):360-6.

Brannigan V, Beier B.  Standards for privacy in medical
information systems: a technico-legal revolution.  Proc Annu Symp
Comput Appl Med Care 1990;14:266-70.

Brannigan VM.  Behavioral healthcare computer systems and the
law: the problem of privacy.  Behav Healthc Tomorrow 1994
Jan-Feb;3(1):57-61.

Brannigan VM.  Protecting the privacy of patient information in
clinical networks: regulatory effectiveness analysis.  Ann N Y
Acad Sci 1992 Dec 17;670:190-201.

Brannigan VM.  Protection of patient data in multi-institutional
medical computer networks: regulatory effectiveness analysis.
Proc Annu Symp Comput Appl Med Care 1993;17:59-63.

Branscomb AW. Who owns information?  From privacy to public
access. New York: BasicBooks; 1994. Chapter 3, Who owns your
medical history; p. 54-72, 202-8.

Collins HL.  Legal risks of computer charting .  RN 1990
May;53(5):81-6. Published erratum appears in RN 1990 Sep;53(9):9.

Cummings NB.  Patient confidentiality.  Second Opin 1993
Oct;19(2):112-6.

Frawley KA.  Achieving the CPR while keeping an ancient oath.
Healthc Inform 1995 Apr;12(4):28-30.

Gobis LJ.  Protecting the confidentiality of computerized medical
records, preparing for litigation.  Healthspan 1994
Sep;11(8):11-3.

Gostin LO.  Genetic privacy.  J Law Med Ethics 1995;23(4):320-30.

Gostin LO.  Health information privacy.  Cornell Law Rev 1995
Mar;80(3):451-528.

Gostin LO, Turek-Brezina J, Powers M, Kozloff R.  Privacy and
security of health information in the emerging health care
system.  Health Matrix 1995 Winter;5(1):1-36.

Gostin LO, Turek-Brezina J, Powers M, Kozloff R, Faden R,
Steinauer DD.  Privacy and security of personal information in a
new health care system.  JAMA 1993 Nov 24;270(20):2487-93.
Comment in: JAMA 1994 May 18;271(19):1484-5.

Green VL, Marsh CK.  Unauthorized disclosure of medical records
opens facility to liability.  Provider 1992 Sep;18(9):58-60.

Ivancic JM.  Confidentiality of health care information: some
notable concerns.  Perspect Healthc Risk Manag 1992
Winter;12(1):13-6.

Miller DW.  Fulfilling the transcriptionist's responsibility for
information security.  J Am Assoc Med Transcr 1995
May-Jun;14(3):30, 32-5.

Miller DW.  Preserving the privacy of computerized patient
records.  Healthc Inform 1993 Oct;10(10):72-4.

Oliver WW.  Technology versus privacy: prescription
accountability in the health care delivery system. J Psychoact
Drugs 1992 Jul-Sep;24(3):285-90.

Reed K.  Computerization of health care information: more
automation, less privacy.  J Health Hosp Law 1994
Dec;27(12):353-68, 384.

Roach WH. Medical records and the law.  2nd ed. Gaithersburg
(MD): Aspen Pub.; 1994.  346 p.

Schwartz PM.  The protection of privacy in health care reform.
Vanderbilt Law Rev 1995 Mar;48(2):VI-347.

Simpson RL.  Ensuring patient data, privacy, confidentiality and
security.  Nurs Manag 1994 Jul;25(7):18-20.

Tomes JP. Compliance guide to electronic health records: a
practical reference to legislation, codes, regulations, and
industry standards.  New York: Faulkner & Gray; 1996.

Tomes JP. Health care records management disclosure and
retention: the complete legal guide.  Chicago: Probus Pub; 1994.
636 p.

Tyler JM.  The Internet: legal rights and responsibilities.
Medsurg Nurs 1995 Jun;4(3):229-33.

van Dam MN.  The scarlet letter A: AIDS in a computer society.
Comput Law J 1990 Apr;10(2):233-64.

Waldman MT, Tapay NH. Electronic data interchange and
computerized information systems: privacy and confidentiality
issues in a changing health care system.  In: Group Health
Association of America. Navigating reform: HMOs and managed
care in a time of transition. Proceedings of the 44th Annual
Group Health Institute; 1994 Jun 5-8; Miami Beach, Florida.
Washington: The Association; 1994.   p. 406-30.

Waller AA, Fulton DK.  The electronic chart: keeping it
confidential and secure.  J Health Hosp Law 1993 Apr;26(4):104-9.

Zick CJ.  Legal aspects of medical records confidentiality.  J
AHIMA 1995 May;66(5):57-62.


  State

     - Laws, Bills, & Regulations


Boynton MM, Paltzer-Fleming J.  Educating your patients about
health records--the new notice law.  Minn Med 1994
Nov;77(11):57-61.

Buckner F.  The uniform health-care information act: A
physician's guide to record and health care information
management.  J Med Pract Manag 1990;5(3):207-12.

Health Care Access and Cost Commission - Medical Care Data Base
Collection - Notice and Informed Consent.  H.R. 557, 410th Sess.
(1996) Maryland General Assembly.  Also introduced as S. 702.

Jones R.  Medical record access laws.  J AHIMA 1992
Mar;63(3):29-34.

Medical Records Institute's State Watch Project.  Toward Electron
Patient Rec 1995 Dec;4(5):14-23.

Patient confidentiality.  Salt Lake City: Med-Index Pub.; 1993.
104 p.


     - Legal Aspects - Commentary


Cohen JD.  HIV/AIDS confidentiality: are computerized medical
records making confidentiality impossible?  Softw Law J 1990
Oct;4(1):93-115.

Curran WJ, Stearns B, Kaplan H.  Privacy, confidentiality and
other legal considerations in the establishment of a centralized
health-data system.  N Engl J Med 1969 Jul 31;281(5):241-8.

Green JH.  Confidentiality of medical records under Minnesota
law.  Minn Med 1993 Oct;76(10):31-6.

Prentnieks ME.  Minnesota access to health records. Practical
steps to complying with a confusing law.  Minn Med 1992
Sep;75(9):39-41.

Ryland CF.  Confidentiality of medical records.  Md Bar J 1993
Jul-Aug;26(4):44-8.

Vilensky R.  New York law on confidentiality of medical records.
(part 1).  N Y State Bar J 1994 Jan;66(1):38-44.

Vilensky R.  New York law on confidentiality of medical records.
(part 2).  N Y State Bar J 1994  Feb;66(2):24-30.


  Other Countries

     - Laws, Bills, & Regulations


Access to Health Records Act 1990. (Great Britain).  Ind Relat
Leg Inf Bull 1991 Nov 1;(436):11-2.

Assia N.  Data protection in Israel-the Protection of Privacy
Law.  Comput Law Pract 1990 May-Jun;6(5):158-62.

Cavoukian A.  The privacy provisions of the Freedom of
Information and Privacy Act. Health Law Can 1990;10(3):206-9.

Great Britain, Department of Health, National Health Service.
Access to Health Records Act, 1990: a guide for the NHS. London:
NHS Management Executive; 1991 Aug 23.  29 p.

Health Administration (Quality Assurance Committees) Amendment
Bill 1989, New South Wales.  Aust Clin Rev 1990;10(1):19-21.

Laske C.  Data protection laws in Europe.  Toward Electron
Patient Rec 1995 Dec;4(5):1, 3-13.

Lee-Winser J.  The Data Protection Act: a decade of data
protection in the NHS.  Br J Healthc Comput Inf Manag 1995
Jun;12(5):20-1.

Revill S.  Privacy Act 1993. Health sector perspective.  N Z
Health Hosp 1993 Sep-Oct;45(5 Suppl):1-3.


     - Legal Aspects - Commentary


Allaert FA, Dusserre L. Transborder flows of personal medical
data in Europe: legal and ethical approach.  In: Lun KC, Degoulet
P, Piemme TE, Rienhoff O, editors. MEDINFO 92. Proceedings of the
7th World Congress on Medical Informatics; 1992 Sep 6-10; Geneva,
Switzerland. Vol. 2. Amsterdam: North-Holland; 1992.  p. 1572-5.

Brahams D.  Right of access to medical records [news].  Lancet
1994 Sep 10;344(8924):743.

Callens SH.  The automatic processing of medical data in Belgium:
is the individual protected?  Med Law 1993;12(1-2):55-9.

Cannataci JA.  Legal aspects of picture archiving and
communications systems.  Int J Biomed Comput 1992
May;30(3-4):209-14.

de Klerk A.  The right of patients to have access to their
medical records: the position in South African law.  Med Law
1993;12(1-2):77-83.

Dickens BM.  Medical records - patient's right to receive copies
- physician's fiduciary duty of disclosure: McInerney v.
McDonald. (Canada).  Can Bar Rev 1994 Jun;73(2):234-42.

Dierks C.  Medical confidentiality and data protection as
influenced by modern technology.  Med Law 1993;12(6-8):547-51.

European Parliament, Council of the European Union. Directive 95/
/EC of the European Parliament and of the Council of on the
protection of individuals with regard to the processing of
personal data and on the free movement of such data. Brussels:
The Council; 1995 Jul 20.  53 p.

Gritzalis D, Tomaras A, Katsikas S, Keklikoglou J.  Medical data
protection: a proposal for a deontology code.  J Med Syst 1990
Dec;14(6):375-86.

Howard G.  Implications of the access to Health Records Act 1990.
Occup Health (Lond) 1991 Oct;43(10):294-5.

Jones RB, McGhee SM, McGhee D.  Patient on-line access to medical
records in general practice.  Health Bull (Edinb) 1992
Mar;50(2):143-50.

Laske C.  Legal aspects of digital image management and
communication.  Med Inf (Lond) 1994 Apr-Jun;19(2):189-96.

Legemaate J.  The right of psychiatric patients to access to
their records: Dutch developments.  Med Law 1990;9(1):707-12.

Lobato de Faria P. Data protection and confidentiality in health
informatics: A survey of legal issues in the EC community.  In:
Noothoven van Goor J, Christensen JP, editors.  Advances in
medical informatics: results of the AIM Exploratory Action.
Washington: IOS Press; 1992.  p. 358-67.  (Studies in
health technology and informatics; vol. 2).

Lobato De Faria P. A survey of legal issues and gaps in legal
coverage in the EC.  In: Commission of the European Communities
DG XIII/F AIM.  Data protection and confidentiality in health
informatics: handling health data in Europe in the future.
Washington: IOS Press; 1991.  p. 122-37.  (Studies in health
technology and informatics; vol. 1).

Miller DW.  What we can learn from the European privacy standard.
Healthc Inform 1992 Jul;9(7):92, 94.

Naish J, Barr M.  Records. Rights of access.  Health Visit 1991
Sep;64(9):300-1.

Poullet Y. Legal aspects of data protection in medical
informatics.  In: Commission of the European Communities DG
XIII/F AIM.  Data protection and confidentiality in health
informatics: handling health data in Europe in the future.
Washington: IOS Press; 1991.  p. 138-60.  (Studies in health
technology and informatics; vol. 1).

Rienhoff O.  Digital archives and communication highways in
health care require a second look at the legal framework of the
seventies.  Int J Biomed Comput 1994 Feb;35 Suppl:13-9.

Robinson DM.  A legal examination of computerized health
information.  Health Law Can 1993;14(2):40-6.

Robinson DM. A legal examination of format, signature and
confidentiality aspects of computerized health information.  In:
Lun KC, Degoulet P, Piemme TE, Rienhoff O, editors. MEDINFO 92.
Proceedings of the 7th World Congress on Medical Informatics;
1992 Sep 6-10; Geneva, Switzerland. Vol. 2. Amsterdam:
North-Holland; 1992.  p. 1554-60.

Smith D.  The challenges of new technologies applying the UK Data
Protection Act to document image processing.  Int J Biomed Comput
1994 Feb;35 Suppl:81-6.

Tervo-Pellikka R.  The principles of data protection concerning
patient related data in Finland.  Int J Biomed Comput 1994 Feb;35
Suppl:39-50.

Thiry E.  Personal medical and social data: their processing and
legal protection.  Med Law 1993;12(6-8):643-9.

Vulliet-Tavernier S. [The protection of medical information data
in France].  In: Commission of the European Communities DG XIII/F
AIM.  Data protection and confidentiality in health informatics:
handling health data in Europe in the future. Washington: IOS
Press; 1991.  p. 181-90. (Studies in health technology and
informatics; vol. 1).  (Fre).

Weigelt E, Scherb H.  [Data protection and data access (I):
federal data protection law and the social welfare code with
reference to carrying out occupational medicine epidemiologic
studies in Germany].  Gesundheitswesen 1992 Nov;54(11):666-72.
(Ger)

Weigelt E, Scherb H.  [Data protection and data access (II):
Physician's responsibility for confidentiality, federal
statistics law and data collection by authorization with
reference to implementing occupational medicine epidemiologic
studies in Germany].  Gesundheitswesen 1993 Jan;55(1):8-15.
(Ger).


OTHER BIBLIOGRAPHIES


Computer security and computer viruses [bibliography]. Tolland
(CT): NERAC, Inc.; 1995 Dec.  Available from: NTIS, Springfield,
VA; PB96-858717.  Prepared from Conference Papers Index.

Jaisingh C, Fountain P, compilers. Smart cards [bibliography].
London: Institute of Electrical Engineers; 1994.  91 p.  Includes
information pack.

Tavani HT.  A computer ethics bibliography.  Comput Soc 1995
Dec;25(4):9-38. Section 7, Computers and privacy; p.18-24.


ORGANIZATIONS


  General

Center for Democracy and Technology
1634 Eye Street NW, Suite 1100
Washington, DC 20006
202/637-9800 (Voice)
202/637-0968 (Fax)
Email: [e-mail]
http://www.cdt.org

CERT (Computer Emergency Response Team) Coordination Center
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, PA 15213-3890
412/268-7090 (24-Hour Hotline)
412/268-6989 (Fax)
Email: [e-mail]
http://www.cert.org

Computer Professionals for Social Responsibility (CPSR)
P.O. Box 717
Palo Alto, CA 94302
415/322-3778 (Voice)
415/322-4748 (Fax)
Email: [e-mail]
http://www.cpsr.org

Computer Science and Telecommunications Board
National Research Council
2101 Constitution Avenue, NW, HA560
Washington, DC 20418
202/334-2605 (Voice)
202/334-2318 (Fax)
Email: [e-mail]
http://www.nas.edu

Computer Security Resource Clearinghouse
Computer Systems Laboratory
National Institute of Standards and Technology
Bldg. 820, Room 426
Gaithersburg, MD 20899
301/975-2832 (Voice)
301/975-3282 (Voice Hotline)
Email: [e-mail]
http://www.ncsl.nist.gov
http://csrc.nist.gov

Computer Security Technology Center
Lawrence Livermore National Laboratory
L-303
P.O. Box 808
Livermore, CA 94551
510/423-6224 (Voice)
510/423-8002 (Fax)
Email: [e-mail]
http://ciac.llnl.gov/

Electronic Frontier Foundation
1667 K Street, NW
Suite 801
Washington, DC 20006-1650
202/861-7700 (Voice)
202/861-1258 (Fax)
Email: [e-mail]
http://www.eff.org

Electronic Privacy Information Center
666 Pennsylvania Avenue, SE
Suite 301
Washington, DC 20003
202/544-9240 (Voice)
202/547-5482 (Fax)
Email: [e-mail]
http://epic.org

Information Infrastructure Task Force Secretariat
Susannah B. Schiller
Program Office
National Institute of Standards and Technology
A1000 Admin
Gaithersburg, MD 20899
301/975-4529 (Voice)
301/216-0529 (Fax)
Email: [e-mail]
http://iitf.doc.gov

Internet Engineering Task Force
c/o Corporation for National Research Initiatives (CNRI)
1895 Preston White Drive
Suite 100
Reston, VA 22091
703/620-8990 (Voice)
Email: [e-mail]
http://www.cnri.reston.va.us

Internet Society
12020 Sunrise Valley Drive
Suite 270
Reston, VA 22091
703/648-9888 (Voice)
Email: [e-mail]
http://info.isoc.org

National Computer Security Association
10 South Courthouse Avenue
Carlisle, PA 17013
717-258-1816 (Voice)
717-243-8642 (Fax)
Email: [e-mail]
http://www.ncsa.com

National Security Agency
Publications Office
INFOSEC Awareness Division
Attn: Y13/IAOC
9000 Savage Road
Ft. Meade, MD 20755-6000
410/766-8729 (Voice)
http://www.nsa.org:8080

Privacy Forum
c/o Lauren Weinstein
Vortex Technology
Woodland Hills, CA
818/225-2800 (Voice)
818/225-7203 (Fax)
Email: [e-mail]
http://www.vortex.com

Privacy Journal
P.O. Box 28577
Providence, RI 02908
401/274-7861 (Voice)
Email: [e-mail]

Privacy Rights Clearinghouse
Center for Public Interest Law
5998 Alcala Park
San Diego, CA 92110
619/260-4806 (Voice)
619/298-3396 (Voice Hotline)
619/260-4753 (Fax)
Email: [e-mail]
http://www.manymedia.com/prc/


  Health


American Bar Association
Section of Science and Technology
Health Care Informatics Subsection
Francoise Gilbert, Chair
Altheimer & Gray
Suite 4000
10 South Wacker Drive
Chicago, Il 60606
312/715-4984 (Voice)
312/715-4800 (Fax)
Email: [e-mail]

American Health Information Management Association (AHIMA)
919 N. Michigan Avenue, Suite 1400
Chicago, IL 60611
312/787-2672 (Voice)
312/787-5926 (Fax)
202/218-3535 (Voice - Washington, DC Office)
202/682-0078 (Fax - Washington, DC Office)
http://www.ahima.org

American Medical Informatics Association
4915 St. Elmo Avenue, Suite 401
Bethesda, MD 20814
301/657-1291 (Voice)
301/657-1296 (Fax)
Email: [e-mail]
http://amia2.amia.org

American National Standards Institute
Healthcare Informatics Standards Planning Panel
11 West 42nd Street
New York, NY 10036
212/642-4969 (Voice)
212/398-0023 (Fax)
Email: [e-mail]
http://www.ansi.org

American Society for Testing and Materials
Committee on Healthcare Informatics (E31)
(with Subcommittees:
E31.17 - Access, Privacy & Confidentiality of Medical Records;
E31.20 - Authentication of Computer-Based Health Information;
E31.21 - Health Information Networks)
100 Barr Harbor Drive
West Conshohocken, PA 19428-2959
610/832-9555 (Voice)
610/832-9666 (Fax)
Email: [e-mail]

Arent Fox Kintner Plotkin & Kahn
Advisors in Technology and Information Law
(including Telemedicine)
1050 Connecticut Avenue, NW
Washington, DC 20036-5339
202/857-6000 (Voice)
202/857-6395 (Fax)
Email: [e-mail]
http://www.arentfox.com/

American Telemedicine Association
901 15th Street, NW, Suite 230
Washington, DC 20005
202/408-1400 (Voice)
202/408-1134 (Fax)
Email: [e-mail]

Community Medical Network Society
5500 Interstate North Parkway, Suite 435
Atlanta, GA 30328
770/850-0540 (Voice)
770/850-9616 (Fax)
Email: [e-mail]
http://www.comnetsociety.org/~comnet

Computer-Based Patient Record Institute (CPRI)
1000 E. Woodfield Road, Suite 102
Schaumburg, IL 60173
847/706-6746 (Voice)
847/706-6747 (Fax)
Email: [e-mail]
http://www.cpri.org

European Committee for Standardisation
Technical Committee 251 (Medical Informatics)
Working Group 6 (Healthcare Security, Privacy, Quality & Safety)
Dr. Gunnar Klein, Chair
Swedish Institute for Health Services Development (SPRI)
P.O. Box 70487 S-10726
Stockholm, Sweden
46-8-7024745 (Voice)
46-8-7024799 (Fax)
Email: [e-mail]
http://miginfo.rug.ac.be:8001/centc251/prestand/wg6/wg6.htm

Health Information Confidentiality Resource Center
Health Information Administration
Health Services Department
School of Public Health and Community Medicine
University of Washington
1107 NE 45th Street, Suite 355 JD-02
Seattle, WA 98105
206/543-8810 (Voice)
206/685-4719 (Fax)
Email: [e-mail]

Interdepartmental Health Privacy Working Group
Nan D. Hunter, Chair
Deputy General Counsel
Department of Health and Human Services
Room 713 Humphrey Building
200 Independence Avenue
Washington, DC 20201
202/690-7780 (Voice)
202/690-7998 (Fax)
Email: [e-mail]

Medical Records Institute
567 Walnut Street
P.O. Box 289
Newton, MA 02160
617/964-3923 (Voice)
617/964-3926 (Fax)
Email: [e-mail]
http://www.medrecinst.com

Workgroup for Electronic Data Interchange (WEDI)
10 Rogers Street, Unit 321
Cambridge, MA 02142
617/374-9170 (Voice)
617/494-0727 (Fax)
Email: [e-mail]