Privacy, confidentiality, and security in information systems of state health agencies.
OBJECTIVE
To assess the employment and status of privacy, confidentiality, security and fair information practices in electronic information systems of U.S. state health agencies.


METHODS
A survey instrument was developed and administered to key contacts within the state health agencies of each of the 50 U.S. states, Puerto Rico and the District of Columbia.


RESULTS
About a third of U.S. state health agencies have no written policies in place regarding privacy and confidentiality in electronic information systems. The doctrines of fair information practice often seemed to be ignored. One quarter of the agencies reported at least one security breach during the past two years, and 16% experienced a privacy and confidentiality related transgression. Most of the breaches were committed by personnel from within the agencies.


CONCLUSIONS
These results raise questions about the integrity of existing privacy, confidentiality and security measures in the information systems of U.S. state health agencies. Recommendations include the development and vigorous enforcement of written privacy and confidentiality policies, increased personnel training, and expanded implementation of security measures such as encryption and system firewalls. A discussion of the current status of U.S. privacy, confidentiality and security issues is offered.
O'Brien
D G
DG
Life Concerns, Inc., Pacific Grove, CA, USA.
Yasnoff
W A
WA
D016494:Computer Security / Q000592:standards / Q000706:statistics & numerical data*; D003219:Confidentiality; D003625:Data Collection; D006801:Humans; D007256:Information Systems / Q000592:standards* / Q000706:statistics & numerical data; D020407:Internet / Q000592:standards / Q000706:statistics & numerical data; D011050:Policy Making; D018907:Privacy; D011635:Public Health Administration / Q000592:standards* / Q000706:statistics & numerical data; D012637:Security Measures; D013219:State Government; D014481:United States