Privacy and Security

• Knowledge Base
• Privacy and Security

How does HCPF hold CIVHC accountable?

Why should the government, or a private entity like CIVHC, be able to collect information about the health care services I’m using?

How does the CO APCD keep information private and safe?

Will my medical information be at risk to data breaches I’ve read about?

How can you guarantee us that no one will hack into the CO APCD?

As a patient, can I opt out of having my information included in the CO APCD?

Will the detailed health history and family health questionnaire that I filled out for my doctor or insurance company be stored in the CO APCD?

Insurance claims show diagnosis codes, not just treatment codes, so could someone get into the CO APCD and see that I have cancer, or AIDS?

How can you adequately protect the health information of people living in rural areas where the population is so low that it wouldn’t be difficult to determine who a person of a certain age with a certain diagnosis is?

If you take out the zip codes from sparsely-populated areas, won’t it be difficult to be able to see health care utilization from, say, the eastern plains?

I’ve heard that 87 percent of the population can be accurately identified with just 3 pieces of information: zip code, birthday and gender, so can’t someone get into the CO APCD and get enough information to steal my identity?

What do you mean by “date of birth will be changed to age or age range”?

What would a hacker see if he got into the database?

How does the CO APCD Data Manager ensure their employees with access to the database don’t hack in remotely or that a disgruntled former employee doesn’t hack in?

Could an employer or law enforcement agency requisition information about an individual from the CO APCD?

Could the federal government request information about an individual from the CO APCD?

Will you ever release identified information?

Is CIVHC going to sell my health information to make the CO APCD sustainable?

Who decides who can get information from the CO APCD? What rules do they use?

Could a company get a report from the CO APCD identifying all the people in a given zip code who have a certain diagnosis or have been prescribed a certain drug?

What kind of information can organizations get from the CO APCD?

Are there limitations on the data that organizations can get from the CO APCD?

What can CO APCD data be used for? Are there any restrictions on the purposes for which it may be used?

Is there any circumstance in which a private company or individual could get personal, identifiable health information out of the CO APCD?

What happens if an entity misuses CO APCD data or uses it for a purpose other than that for which the entity applied?