Testimony of Gary A. Beatty, HIA
Mayo Foundation
August 5, 1997
Capital Hilton, Washington, D.C.

Maintaining and assuring confidentiality is an essential part of our environment within the Mayo Foundation. All members of the Foundation have an obligation to conduct themselves in accordance with the policy and hold in confidence all information concerning patients, employees, and business information. Confidential information includes all material, both paper-based and electronic, related to the operation of the Foundation including, but not limited to:

• financial information
• patient names and other identifying information
• patient personal and medical information
• patient billing information
• employee names including salaries and employment information
• proprietary products and product development
• marketing and general business strategies
• any discoveries, inventions, ideas, methods, or programs that have not been publicly disclosed
• any information marked "confidential"

Only physicians, or other authorized individuals, may access, use or release patient and or medical information. Such matters are confidential between the health care provider and the patient.

Mayo Foundation's confidentiality policies are implemented though publication and educational programs, a signed confidentiality statement by it's employees and business partners, and the utilization of technological safeguards such as physician ID card access to clinical data, user ID and password access control, data encryption, and authentication.

Mayo Foundation is committed to the ideals of the Health Insurance Portability and Accountability Act of 1996 related to health care simplification. We have taken an aggressive role in implementing it's requirements for the use of Electronic Data Interchange (EDI). Aside from the transactions mentioned in the legislation, we evaluated the various communication technologies that have been employed in the past including Clearing Houses, Value Added Networks (VANs), direct connections, and the Internet (intranets and extranets) to determine the most cost effective and efficient means of communications. We have also reviewed these communication technologies against our privacy policies to determine any potential security risks. We have chosen to support all of these communication technologies favoring the Internet and Intranets to communicate with our trading partner community (which can include Clearing Houses and Value Added Networks).

Many concerns ranging from privacy and confidentiality to fraud were raised in our review including:

• Can anyone else read the transactions?
• How did I know who sent the transactions?
• Did the transaction arrive exactly as they were sent?
• Can the receiver deny having received the transactions?
• How does the submitter know the transactions were received?
• How do I track the interchange activity for audibility?

We found that security technologies and procedures exist today which can answer these questions, allowing trading parnters to be confident that they can implement secure health care EDI. These include encryption to guarantee confidentiality and privacy, authentication via digital signatures to guarantee the identify of the submitter, and digitally signed return receipts similar to return receipt mail to guarantee the delivery of the transactions.

Currently Mayo Foundation is using asymmetric key or public/private key encryption using 1024 bit keys with its trading partners using insecure communication technologies such as the Internet and Intranets. Currently communication over dedicated lines are not encrypted although this policy is being reviewed.

Earlier this year Mayo conducted a pilot project using a private health care only Intranet called MedNet to submit health care claims to the Minnesota Health Information Network(MHIN) for reporting purposes. This pilot involved the submission of approximately 2500 health care claims on a weekly basis. Once the public keys were exchanged, Mayo set up a process to automatically encrypt the claims using MHIN's public key and digitally signed the file using Mayo's private key. The encrypted file was then sent to MHIN using FTP via MedNet. When MHIN received the encrypted file they authenticated the file using Mayo's public key to guarantee the claims came from Mayo and the integrity of the data was intact. Then they decrypted the files using their private key. Once MHDI had processed the claims they returned an acknowledgment of receipt back to Mayo to close the communication loop.

Benefits realized from this pilot included:

• Lower costs
• Simplified pricing as compared to Clearing Houses and Value Added Networks
• Easier and less expensive communications vs. direct connections
• Higher communication speeds
• Single network for file transfer (EDI), e-mail, Internet access, etc.
• Potential for distribute processes using Internet application technologies

Challenges from this pilot include the need to solve the public key distribution problems. With the large number of potential trading partners in the health care industry key distribution and trust will be key to the success to using the Internet and Intranets. Organizations such as certificate authorities need to be established to resolve this large logistical challenge.