ISO/TR 18638:2017

TECHNICAL ISO/TR
REPORT 18638
First edition
2017-06
Health informatics — Guidance on
health information privacy education
in healthcare organizations
Informatique de santé — Composantes éducatives destinées à
garantir la confidentialité des informations relatives à la santé
Reference number
©
ISO 2017
© ISO 2017, Published in Switzerland
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form
or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior
written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of
the requester.
ISO copyright office
Ch. de Blandonnet 8 • CP 401
CH-1214 Vernier, Geneva, Switzerland
Tel. +41 22 749 01 11
Fax +41 22 749 09 47
copyright@iso.org
www.iso.org
ii © ISO 2017 – All rights reserved

Contents Page
Foreword .iv
Introduction .v
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviations. 7
5 Understanding information privacy in healthcare . 7
5.1 General concept . 7
5.2 Information privacy in healthcare. 8
5.2.1 Personal health information and privacy . 8
5.2.2 Patient’s rights on personal health information privacy . . 8
5.3 Privacy concerns . 9
5.4 Organization’s privacy protection program . 9
5.4.1 Policies and practices to protect health information . 9
5.4.2 Roles of workforce in protecting information privacy .10
5.4.3 Workforce education in protecting health information privacy .11
5.4.4 Patient’s education in protecting information privacy .11
6 Information privacy education in healthcare .11
6.1 General concepts .11
6.2 Target audience of the privacy education .12
6.3 Competencies, educational objectives and content.12
7 Examples of content modules .16
7.1 General .16
7.2 Introduction to information privacy, confidentiality and security in healthcare .16
7.3 International guidelines and principles for information privacy protection .16
7.4 National legislation, regulation and policies for information privacy protection .16
7.5 Patient’s rights on personal health information .17
7.6 Administrative policies for privacy protection .17
7.7 Technical and physical safeguards for protecting healthcare information privacy .18
8 Instructional methods, delivery mechanisms and evaluation .19
8.1 Instructors .19
8.2 Instructional methods and delivery mechanisms .19
8.3 Delivering training .19
8.3.1 Orientation and on-boarding training .19
8.3.2 Continuing education . .20
8.3.3 Education of patients .20
8.4 Evaluation methods .20
Annex A (informative) ISO/TC215 Health informatics: List of standards on privacy protection .21
e
Annex B (informative) Setting learning objectives (example) (Source: Triag Training
Group, HIPAA training playbook) .22
Annex C (informative) Level of Learning Objectives by Audience (Provided by South Korea) .24
Annex D (informative) Educational methods (examples) .26
Annex E (informative) Questions for quiz for privacy education (example) (Provided by
South Korea) .27
Bibliography .32
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation on the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO’s adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see the following
URL: w w w . i s o .org/ iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC 215, Health informatics.
iv © ISO 2017 – All rights reserved

Introduction
Health information privacy concerns need to be addressed with the expanding adoption of health
information technology (HIT) including the use of electronic health record (EHR) systems. Both the
increasingly legislated environment around privacy and the increasing need for information sharing
between patients, providers, payers, researchers and administrators contribute to the growing need
for information privacy education in the healthcare sector. In spite of increasing awareness of and
sensitivity to patient privacy, there are no guidelines or standardization for education on privacy of the
healthcare information within healthcare organizations.
The purpose of this document is to describe the essential educational components recommended
to ensure health information privacy in a healthcare organization. This document describes the
concepts of health information privacy, the components of a privacy education program for healthcare
organizations and basic health information privacy educational content that can be applied to various
jurisdictions.
This document provides guidance for healthcare organizations for establishing and improving the
health information privacy education for their workforce.
Annex A provides the list of standards published by ISO/TC 215 that may be used to develop privacy
education in healthcare organizations as they convey specific content and approach health information
privacy protection.
TECHNICAL REPORT ISO/TR 18638:2017(E)
Health informatics — Guidance on health information
privacy education in healthcare organizations
1 Scope
This document specifies the essential educational components recommended to establish and deliver
a privacy education program to support information privacy protection in healthcare organizations.
The primary users of this document are those responsible for planning, establishing and delivering
healthcare information privacy education to a healthcare organization.
This document provides the components of privacy education within the context of roles and job
responsibilities. It is the responsibility of the organization to define and apply privacy protection
policies and procedures and, in turn, ensure that all staff in the healthcare organization understands
their privacy protection responsibilities.
The scope of this document covers:
a) the concept of information privacy in healthcare;
b) the challenges of protecting information practices in the healthcare organization;
c) the components of a healthcare information privacy education program;
d) basic health information privacy educational content.
2 Normative references
There are no normative references for this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— IEC Electropedia: available at http:// www .electropedia .org/
— ISO Online browsing platform: available at http:// www .iso .org/ obp
3.1
access
ability or means necessary to read, write, modify, or communicate data/information or otherwise make
use of any system resources
[SOURCE: ISO/TR 18307:2001, 3.1]
3.2
access control
means of ensuring that the resources of a data processing system can be accessed only by authorized
entities in authorized ways
[SOURCE: ISO 17090-1:2013, 3.2.1]
3.3
anonymization
process by which personal identifiable information (PII) (3.21) is irreversibly altered in such a way that
a PII principal (3.22) can no longer be identified directly or indirectly, either by the PII controller (3.23)
alone or in collaboration with any other party
Note 1 to entry: See pseudonymization (3.33).
[SOURCE: ISO/IEC 27038:2014, 2.1, modified]
3.4
asset
anything that has value to the organization
Note 1 to entry: There are many types of assets, including:
a) information;
b) software, such as a computer program;
...