0.0.1 - ci-build International flag

ShiftPrivacyExamples, published by SHIFT-Task-Force. This guide is not an authorized publication; it is the continuous build for version 0.0.1 built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/SHIFT-Task-Force/demo-fhir-data/ and changes regularly. See the Directory of published versions

Monica at 19

19 y/o Monica "Mo" Rambeau. Currently in college at MouseHouse U in Orlando. Parents are divorced and mother (Maria) lives in Boston, Father (Frank) lives in Orlando, FL. Monica grew up in Mom's primary custody in Boston, and is now in college near dad in Orlando, but spends most school vacations back with mom in MA. She did establish FL residence with dad for in-state tuition, and is on her Frank's employer-sponsored health insurance (It's not Easy Being Green, Inc. or "Green") under the ACA. Monica receives her healthcare at a number of different entities: her school health center, a private PCP in FL (who has treated her asthma when she visited her dad since she was young), and MA Community Health Center when she is with her mother in MA. Since she turned 18 years of age, she has not set up any portal proxies for any EHR. Monica's medical history is notable for chronc constipation, for which she takes Miralax, moderate persistent asthma for which she uses a Pulmicort Flexhaler BID and albuterol PRN, and an allergy to amoxicillin (hives). Monica is sexually active with one M boyfriend.

Modules/Options

STI Module

Yesterday, she presented to the health system in MA where she is tested for gonorrhea, chlamydia, and HIV; testing is sent to a 3rd party lab. Gonorrhea and HIV are negative. MA has a state law requiring additional consent related to HIV (which some entities interpret as any HIV testing and some entities interpret as positive HIV results only). Chlamydia came back positive today; Azithromycin for the patient as well as Expedited Partner Therapy are provided to the patient through a Title X clinic grant supply of medications.

Chlaymida is a reportable disease in MA and a public health worker follows up with all patients to make sure they have taken their antibiotics and that EPT has been completed. Monica wishes to not share her data with the public health department but is told this is not optional. Monica states that she at least wants DPH to only be given the minimum necessary information and to not have any information about her gender identity, in case they speak with her parents.

STI HIV Option

Monica's boyfriend is bisexual, and he occasionally has unprotected sex with men. For this reason, Monica started PrEP at 18 years of age. This was originally prescribed by the MA Community Health Center, and is now continued by her school health center in Florida, but without the knowledge of her father's doctor in Florida - she wishes to keep this private from him given his relationship with her father.. MA requires additional consent to disclose any information about HIV-related treatment, including PrEP. In MA, an ACO care manager typically follows patients on PrEP to check in on their treatment. Monica wishes to opt out of this service due to concerns her parents or others may discover she is on PrEP.

Abortion Module

OB Hx: G1P0001.

For either option 1 or 2: All pregnancy and abortion care took place in MA. Monica does not want healthcare providers in FL to know about the abortion in MA due to concern for criminalization. Maria does not want either parent to know about her pregnancy or abortion.

Abortion Option 1

Monica had a medical abortion at 9 weeks gestation in MA (mifepristone + misoprostol) earlier this year at age 19. This abortion was part of a more comprehensive medical visit that was billed to her father's insurance; she requests that information about the abortion not be shared with the payer.

Abortion Option 2

Monica had a D&C abortion at 18 weeks gestation at age 18 in MA. She wasn't sure if she wanted to keep the baby, so she had a normal 1st trimester ultrasound at 10 weeks and a normal quad screen at 14 weeks, before deciding on termination. Monica's pregnancy services were payed for by the Healthy Start grant program; no bills were sent to her father's insurance for this. When she decided to terminate her pregnancy, she paid for this out of pocket, and requested that no information be sent to her insurance company.

SOGI Module

Although Monica is in a committed relationship with her boyfriend and has had only male partners in the past, she considers herself bisexual, and considers her gender as nonbinary or genderfluid. Pronouns are "she/her" or "they/them." She only shares her SO & GI data in MA, as she is concerned about stigma at her school in FL, so does not want this information shared with them. While she is fine being called Monica, she commonly goes by "Mo," and asks that this be added as her preferred name in both MA and FL.

In MA, the state collects deidentified data on gender and sexual minority patients to report to a Health Equity task force. Petra wishes to opt out of this as well due to concerns about reidentification. The clinic staff advises her that this could impact the Commonwealth's ability to provide equitable care to patients such as herself, but she is adamant that she does not want to share this data, even in a deidentified manner.

Contraception Module

At age 19, Monica started Loestrin 1/20 both for contraception but also to help with a history of irregular periods; this was continued at her university health service in FL. The medication was originally sent to pharmacy in MA, and is now sent to a pharmacy in FL. Mo is okay with her school prescribing this but does not want her dad's doctor to know about it since he has a close relationship with her father. She does not want either parent to know about her use of the OCP. She remains concerned because it is currently billed to her father's insurance, even though it is prescribed by the school, and asks if there is a way to prevent this.

3rd Party App Module

Mo's doctors recommend a diet/food tracker to help her manage her constipation. This app asks to receive data, including her OB history and current medications, from her medical record. She does not wish to share her OB History or OCP with the app due to privacy concerns, but is okay with it receiving information about her other (non-OCP, non-HIV) medications and allergies.

HIPAA 2024 Privacy Rule Module (optional - depending on state of law)

The FL Board of Medicine (BOM) is doing a review of her FL Private PCP (Dr. Nick Riviera)'s practice due to a complaint made by another patient; in the process, they request a review of a number of patient records, including Mo's. Under the OCR HIPAA Reproductive Health Privacy Rule, the BOM must provide an attestation to Dr. Riviera's office stating they will not use reproductive health data in the chart for impermissible purposes (e.g. criminalization) before obtaining access to the records.

Entity Medical Legal Sex Preferred Name Gender ID & Pronouns Sex.Orientation Sex. Hx & Contraception STI HIV TAB Hx All other OB Hx Other Repro Hx Genetic Hx
MA Health Center PCP (Dr. Hibbert) permit permit permit permit permit permit permit permit (1) permit permit permit permit (1)
MA Health Center OB/GYN (Dr. Lahiri) permit permit permit permit permit permit permit permit (1) permit permit permit permit (1)
MA Best Little Pharmacy (BLP) permit permit permit (2) permit (2) deny permit permit permit (1) permit (2) permit (2) permit deny
MA Third Party Lab (TPL) permit permit permit (2) permit (2) deny permit permit permit (1) deny permit (2) permit permit (1)
FL Private PCP (Dr. N. Riviera) permit permit permit deny deny deny deny deny deny deny permit deny
FL MouseHouse U Provider (Dr. McStuffins) permit permit permit deny deny permit permit (2) permit (2) deny deny permit deny
FL Big Box Pharmacy (BBP) permit permit permit deny deny permit (2) permit (2) permit (2) deny deny permit deny
Mapple Diet/Food Tracker permit permit permit deny deny deny deny deny deny deny permit deny
MA ACO Care Manager for PrEP f/u (Ann Perkins) deny (3) deny (3) deny (3) deny (3) deny (3) deny (3) deny (3) deny (3) deny (3) deny (3) deny (3) deny (3)
MA DPH Care Manager for CT & EPT f/u (T. Fauci) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4)
Commonwealth of MA (deidentified health equity data) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4) permit (4)
Payer (Green) permit permit permit deny deny permit (2) deny (5) permit (2) permit (2) permit (2) permit deny (5)
FL BOM permit (4) permit (4) permit (4) permit (4) permit (4) permit (6) permit (6) permit (6) permit (6) permit (6) permit (6) deny (7)
Mother, Maria (MA Portal) deny deny deny deny deny deny deny deny deny deny deny deny
Father, Frank (MA Portal) deny deny deny deny deny deny deny deny deny deny deny deny
Mother, Maria (FL School Portal) deny deny deny deny deny deny deny deny deny deny deny deny
Father, Frank (FL School Portal) deny deny deny deny deny deny deny deny deny deny deny deny
Mother, Maria (FL PCP Portal) deny deny deny deny deny deny deny deny deny deny deny deny
Father, Frank (FL PCP Portal) deny deny deny deny deny deny deny deny deny deny deny deny

Notes:

  1. Access is Permitted, but the recipient must not redisclose without additional Consent.
  2. Access is Permitted, but the data must be tagged as sensitive.
  3. not authorized at all
  4. Data must be collected / transmitted by Law, so Consent does not apply.
  5. Deny as the activity was paid for out of pocket.
  6. May access with OCR attestation
  7. upstream recipient would not have access

Data