A Comprehension Approach for Formalizing Privacy Rules of HIPAA for Decision Support

Abstract

In this paper we explore automated verification of electronic medical record (EMR) transaction for compliance with a regulatory regimen such as HIPAA. We present an approach based on modeling the conceptual space of HIPAA. The clauses of HIPAA legal text is then converted into a disambiguated decision tree (DDT) rules precisely identifying the allowed, dis-allowed and prescribed actions per work flow request type. Given any EMR query the DT then enables one not only to verify the compliance as well as provide complete release guidance as prescribed by HIPAA, generate explanation and audit.