A Framework for Evaluating the Tension between Sharing and Protecting Health Information

Health information exchange (HIE) is expected to improve the quality and cost of healthcare but sustained use of HIE by providers has been difficult to achieve. A number of factors play a role in that process including concern for the security and privacy of the exchanged information. This tension between the expected benefits of HIE resulting from collaboration and information sharing on the one hand, and the potential security risks inherent in the exchange process on the other hand, is not well understood. We propose an information security control theory to explain this tension. We evaluate this theory through a case study of the iterative development of the information security policy for an HIE in the western United States. We find that the theory offers a good framework through which to understand the information security policy development process.