[This Transcript is Unedited]
Department of Health and Human Services
National Committee on Vital and Health Statistics
Subcommittee on Privacy, Confidentiality and Security
March 2, 2012
Doubletree Hilton Hotel
8727 Colesville Road
Silver Spring, MD 20910
Proceedings by:
CASET Associates, Ltd.
Fairfax, Virginia 22030
(703)266-8402
P R O C E E D I N G S (8:33 a.m.)
Agenda Item: Welcome
DR. FRANCIS: I am going to now call the meeting into session. This is a meeting of the Privacy, Confidentiality and Security Subcommittee of the National Committee on Vital and Health Statistics. I’m Leslie Francis; I co-chair the Subcommittee, and I don’t have any conflicts. I would appreciate it if we just go around the room and say who’s here, and then we can move along with the agenda.
MS. JACKSON: I’m Debbie Jackson, National Center for Health Statistics, committee staff.
MS. JONES: Catherine Jones, National Center for Health Statistics, and staff to the Committee.
DR. MAYS: Vickie Mays, University of California Los Angeles, Member of the Full Committee.
DR. HORNBROOK: Mark Hornbrook, Kaiser Permanente, Member of the full Committee, no conflicts.
DR. BURKE: Jack Burke, Harvard Pilgrim Health Care in Boston, member of the Committee, no conflicts.
DR. TANG: Paul Tang, Palo Alto Medical Foundation, member of the Committee, no conflicts.
MS. KHAN: Hetty Khan, National Center for Health Statistics, staff to the Subcommittee on Privacy.
MS. KLOSS (on the telephone): Linda Kloss, member of the Committee, and Co-Chair of the Subcommittee, no conflicts.
DR. COOPER: Leslie Cooper, NIH, NIH Liaison.
MS. COOPER: Nicole Cooper, staff to the Committee.
DR. FRANCIS: Welcome everybody, and what we’re going to do today is talk first about the planned hearing, which we’re tentatively entitling, Next Steps for Community Data Use. Basically, the idea is that in what we’re calling shorthandedly, the CHIP Report, there was a promissory note that NCVHS would follow up with discussions about what are best practices for data protection to engender community trust when data are used, as in the CHIP Report?
And we had a conference call which most members of the subcommittee, unfortunately Paul was not able to be on that, although we did get some input from Paul, which we wanted to put in, in particular, to think about having the inquiry broadened to the use, not only of data that the public health sector already possesses, but also to the use of data that might be in things like HIEs and so on.
So that was my understanding of Paul’s suggestion, and I’m delighted that Paul is here to help me if that’s not quite the accurate one.
But we were looking at the afternoon of April 16, when Paul won’t be able to be there, but Walter will, and all day on the 17th, when Paul will be able to be there but Walter won’t. But otherwise, as far as I know, all members of the subcommittee can. We actually found a shelling point; a convergence point in game theory, which is unusual for this group. So that’s the tentative plan.
I would ask Sallie to introduce herself, who’s just come in, who’s a member of the subcommittee.
MS. MILAM: Sallie Milam, with the West Virginia Health Care Authority, member of the Committee, no conflicts.
DR. FRANCIS: So we have tentatively worked out some suggestions as to an agenda. What I’d like to turn us to – Maya sent it out – she’s apparently is stuck on the Metroa somewhere and will be here shortly; we got a text. So the tentative next steps for community data use, the tentative agenda is up on the screen. I’m not sure whether Linda got it over the internet, but basically, what it would have us do is if it were going to be all day on the 17th – I’ve got an all day on the 17th one, and then I’ve got – up there there’s an April 16th to 17th.
SPEAKER: Would this be done electronically?
DR. FRANCIS: Yes. But this is a different one printed. Yes. What’s up there on the screen was sent to me at 6 a.m. this morning, and I couldn’t open it on my iPhone, so this is the first I’ve actually seen it.
DR. TANG: I don’t think we have it, right?
DR. FRANCIS: I don’t think anybody does. We could go with that or we could go with what’s been sent around, which there’s a piece of paper in my folder which said “Next Steps for Community Data Use”.
MS. MILAM: Is it possible to do the whole hearing in one day? Is that what we’re thinking with the April 17th agenda?
DR. FRANCIS: That’s actually a first thing to think about. Walter’s not here right now; he could do the 16th but not – basically, we have everybody available except Paul on the 16th.
DR. MAYS: I’m only on the 17th.
DR. FRANCIS: So you and Paul are only on the 17th. Walter is a possible on the 17th, so let’s – the initial step would be to decide whether we want to just try to do it all on the 17th.
DR. HORNBROOK: On Tuesday and Wednesday, we had a hearing for the Population Committee. It was very successful, because the hearing went all day, from 9 to 5, then the next day was a half a day of work with just Committee members, and we got a lot further than we ever expected by having set aside time to finish up what the hearings told us.
DR. FRANCIS: So here is the question for everybody. What would it look like to use part of Wednesday morning, the 18th? Vicky can’t. I know Walter can’t because the Standards Committee is meeting on the 18th. The ONC Standards Committee meets on the 18th. Linda, are you available on the morning of the 18th?
MS. KLOSS: Yes I am fine on any of those –
DR. FRANCIS: Sallie, how about you?
MS. MILAM: I am fine.
DR. FRANCIS: Paul, how about you? You’re fine? Why don’t we do that? Why don’t we have, instead of having people try to leave on the night of the 17th, why don’t we have people stay over and have a working meeting on the morning of the 18th? Okay. Done. So we’re planning a hearing for – so what I was going to say is, so now we have a plan to plan for all day on the 17th, right? Okay, set in stone. And morning of the 18th, half day, so people can fly out early afternoon flights on the 18th.
And for those who can’t be there on the 18th, Vicky, do you have to leave on the 17th or could you –
DR. MAYS: I have class; I teach on Wednesday morning. I have to leave the end of the day on the 17th, and then even probably to catch up with you on – I teach from 8 to 10, so that would be –
DR. FRANCIS: That would be 11, so you could actually probably be on the phone for a good chunk of it. Okay.
MS. JACKSON: Can I confirm the people who are committed to the 18th as Sallie, Linda, Leslie, Mark Hornbrook –
DR. HORNBROOK: No, I can’t –
DR. FRANCIS: Jack is.
MS. JACKSON: It was Jack –
DR. FRANCIS: And Paul.
MS. JACKSON: And Paul, and maybe Vickie on the phone.
DR. FRANCIS: Vicky on the phone for a bunch of it. I do know that that leaves out Walter, but he said he thought it was really important for us to go ahead.
MS. MILAM: Do we know if Maya was available? I remember that we discussed the 18th on the phone, and there was trouble with it from some corner.
DR. FRANCIS: I think it was Walter. But I’m not sure. We can check.
SPEAKER: He’s here, somewhere in the building at another subcommittee meeting.
DR. FRANCIS: The Standards folks are working on stuff. We’ll ask him and find out whether he can do some phoning in and so on.
So if you look up there, the topics that we had talked about were governance models beyond data use agreements, and there were some suggested people for that. Beyond the identified data – drawing inferences and re-identifiability, scroll on down if you would, please – on data use agreements and deidentification, and how to protect groups.
What we were going to try to do is get, for each of those panels, representatives from different places in the universe; so we try to get people who have worked on the governance issue with HIEs, and we try to get people who have worked on the governance issue with public health data sets, and so on. So that was where we were as of the end of phone call. Linda, I don’t know if you want to add anything to that.
(No response)
Paul.
DR. TANG: What is the problem to solve here? Are you trying to solve a reidentification problem, or what’s the main problem to solve?
DR. FRANCIS: As I, at least my understanding was that the problem was community trust, which is not necessarily a reidentification problem, and indeed, often it’s a question of how data are being used, whether or not they are identifiable, and that we specifically wanted to steer clear of the controversy and proposed solutions to the controversy, because other people are working on it about reidentification. So we were bracketing that. But that may be a mistake. I don’t know. Sallie?
MS. MILAM: I think some of the additional framing might be that it’s a follow onto the CHIP report, missing infrastructure for population health privacy, really. We have stewardship models, but we haven’t really operationalized those along with privacy models to population health.
DR. FRANCIS: So, the areas, several of which are identified – just reading from the report – several of which are identified in the preceding pages, include a privacy and trust framework for local data use, key principles for data aggregation, guidelines for local knowledge management, and best practices in many areas. Vickie.
DR. MAYS: As Justine often asked, who is the client here? Is the client trying to solve the problem of what you heard, or is the client trying to bring the individuals who have the distrust into a system in a way in which the problem can be solved?
DR. FRANCIS: I don’t think we can bring them in, but I think one of the things we could do is look to how communities can do that.
DR. TANG: I like the problem of the making sure that the systems are trustworthy. I think the primary question, then, is are the organizations who have access to the data doing what the patient expects, or would they be surprised by what happens? So I think both the Community Health Data Initiative could lead to surprises, as well as what I mentioned, which is these private health information exchanges. I think people don’t know exactly what’s going on, and it hasn’t even been disclosed. There’s no MPP for this stuff.
So if the focus is maintaining trust, and I think that’s a good one, then we have to look at where the likely surprise is, and let’s try to get ahead of those and say either make sure people are aware that that’s happening or what are the things that shouldn’t be happening when people all of a sudden combine data?
DR. SUAREZ: On the same line of thinking, usually when we, at the Standards Subcommittee, we define a hearing, the first thing we write is what’s the purpose of the hearing. So the way we describe it usually is “the purpose of the hearing is to address, discuss and make recommendations about a series of – “; in this case, in my mind, it’s a series of privacy and security issues related to the community health data, the aggregation of data at population level, and those usually include, number one, trust, governance, deidentification and reidentification; I think those are sort of the key elements conceptually. And that’s how I would, I guess, characterize, as I understood the description of the purpose of the hearing, is really now that we have discussed the Community Health Data Initiative and the report that had published, one of the outputs that it had reported was a number of privacy and security issues. So is that consistent with –
DR. FRANCIS: That was my understanding.
MS. KLOSS: Perhaps we should title this from Next Steps to being a little more specific, on Trust Environment for Community Data Use.
MS. MILAM: I would like to suggest that we consider utilizing – I think it was a 2006 letter that set forth the stewardship model, and as Paul said, when you look at the stewardship model, it’s very similar to your privacy models and notices with your first element. So what does a notice need to look like in population health so you avoid surprises? There are numerous elements, and I think we’ve captured some of the trickiest, most complicated ones in this hearing, but perhaps we want to take a look at that model, and determine what we already know and map it to what this hearing is going to address, and figure out if there are any gaps, and then at the end of it, be able to have a model or framework for population health and community groups to apply and to readily see best practices, and different actions they can take to meet the different elements with respect to data search or with respect to privacy.
MS. KLOSS: We looked at the stewardship model; in fact, what had come out of it is a new set of guiding principles for a more detailed –.
DR. TANG: As Sallie was talking, I just sort of thought about a couple of ways to characterize stewardship. One is, what do I think, or want, my data to be used for? And the other is, and that’s sort of the purpose, what others am I implicitly or explicitly saying you can do with it? That would be wonderful, because if these are in concert with my expectations, then we’re fine.
The other is the notion of is my data going in an identifiable way, or reidentifiable way? Because these a little bit go to the solution, or the problem, presuppose the problem, rather than staying at the trust level; what constitutes – it’s almost like yes, our quality hearing, where we’re saying, what does the consumer want to do? How do they think about selecting a health plan provider? So in here, it’s like how is the consumer thinking about what should happen with their data, and I think there’s two things – what is it going to be used for and am I going to be identifiable?
And we can later figure out how to address both of those issues instead of as their steward.
DR. FRANCIS: Just related to that, I think one of the reasons we had zeroed in on the protecting groups question is that there’s a notorious example of data being used in a way people didn’t expect; namely, the Havasupai example, and so one of the ways in which trust can get broken is if a group feels – in the case of the Havasupai, they’re obviously an identifiable group even with the government structure, but if a subgroup of some kind, maybe more loosely understood than that, feels aggrieved by use of the data, that’s why we – that was a particular trust problem that we had identified, and that’s why there’s that one there.
By the way, I should ask to make sure that Larry and Walter have both put themselves on the record –
DR. SUAREZ: Oh thank you, very quickly, Walter Suarez, with Kaiser Permanente, a member of the committee and a member of the Privacy subcommittee.
DR. GREEN: Larry Green, a member of the full committee; visitor to this committee.
DR. MAYS: I apologize because I missed the call, because we were on a Pop call for the planning of the hearing. It seems like the theme really isn’t necessarily for the title of this, about trust. It’s about protection. And I think that may be kind of a better way to go at it. I don’t know if you can change the trust, but you can, in terms of being stewards of the data, actually protect individuals. When you gave the example that you gave, that’s actually a research one, and I guess I’m wondering how far you’re extending. I thought it was going to be in terms of data systems as opposed to research data.
DR. FRANCIS: I was not meaning to move that to research. I was just using that as an example of what had been perceived as group harm.
DR. GREEN: I want to go back to the framing from the Community Health Data Initiative hearings. Those two workshops, to deal with what Walter and Paul both surfaced and Sallie’s right around here; the overarching thing we learned was that when you get to community-based activity, when the community becomes a learning health system, the current approaches to human subjects’ protection are at once excessive and insufficient. And they are working badly. And then the list of things that you have pulled out here – the definitions of deidentification for community-based data, that’s neighborhood specific and it identifies six people, people sitting in the room can identify four of the six. What are you going to do about that?
DR. FRANCIS: That was the purpose of the – if you go up, having the session on aggregation –
DR. GREEN: So really, it seems to me the deliverable from this is to see if we can define what is begging for policy solutions? What is it that should happen to human subject protection policies to enable communities to be learning health systems?
And we are quite confident that the answer that it’s nothing is wrong. Something needs to happen here. It’s different. The HIPAA rules – the Belmont report stuff gone up; as important as it is, it’s not sufficient. And it’s actually requiring these communities to do things that waste their time. They only have about this much resource to start with; by the time they navigate this system, they’re exhausted. They don’t even get started.
DR. FRANCIS: So moving along on that, I’m trying to think about what a couple of problem areas would be. One is clearly governance. Another is clearly what kinds of inferences 0 bypassing the deidentification-reidentification controversy, you’re using local data, what kinds of inferences might get drawn that are potentially problematic? A third is, what are unexpected uses? What are some uses that people really have trouble with that they wouldn’t anticipate, and how do you deal with – I’ll call it the transparency problem, or notice problem, or something like that. That’s a quick summary.
I don’t know if people agree with that summary, but maybe a way to think about it would be to have four – we’re going to have four panels – we could pick the four top problems that require solving, or we could think about – I just listed three; maybe we need more than one session to deal with one of those problems. It could be the aggregation problem, the governance problem, the notice problem and the bait and switch problem. Paul?
DR. TANG: I guess I’m still uncomfortable that we are – when you go back to quality, what we tried to figure out is what’s the problem that the consumer thinks they’re trying to solve?
Here I think we’re already assuming that there is – we’re assuming one step problems and then trying to solve that. So I think this is where I thought they were saying about it can be excessive; some consumers want more information to go into aggregate data so that more can be learned. We just need to meet their expectations. So I don’t know – when we say protective, it somehow implicitly says we want to not allow certain things versus we need to allow what the patient wants to have happen.
On the other hand there’s the – you mention the groups. There’s implicit groups, say patients like me or – when you type some comment in that predisposition, then you are actually reporting and disclosing things about all the other kinds of patients like you, like in your family, as an example. And so that’s sort of an ethical thing, because it’s not only you that you’re giving up, you’re giving up all your family members as well.
So it’s – I guess what I’m suggesting is we need not explore peoples’ feelings about things. That’s the contribution that hasn’t been done. I think looking at reidentification of – looking at the extent – has been done by our group before, and others. I’m trying to go back to what’s the problem the consumer wants to solve. Then we’ll be all enlightened, I think, and that’s why I think it might be a contribution to the field.
MS. MILAM: I’m thinking back to the two different hearings we had; I’m thinking specifically of the May hearing, where we had Denise Love testify –it’s a privacy focus today – and NAHDO came to us with a wish list, of where their state data organizations need leadership, and they specifically asked this committee to provide leadership around most of the topics on this hearing list, draw our subcommittee’s attention to that, and suggest that perhaps we need to revisit the recommendations from NAHDO to help bring forward the issues more clearly.
Now perhaps – whether or not we want to try to meet those needs is another question, I think that’s where the request came from.
DR. FRANCIS: I think I would have conceptualized a little differently from the way you did, Paul. The way I would have conceptualized it is, what are the problems that people who want to use this data are finding? One set of problems is the one you point to. But there are others, and we’ve kind of been stuck on this well the only solution is informed consent, or something like that, which is the big barrier, and that’s obviously not working for communities who want to use this data, so the question is, how can you figure out how to make the data usable, in ways that don’t betray consumer trust?
DR. MAYS: Just want to kind of get to what Paul said. I think there are two different groups here. The group that you’re talking about is individuals who are stewards of community level data, and they’re at a very – different than, I think, the individuals. And see, it’s almost like when Larry was talking, Larry was talking more about the people that you heard from in the hearings that the CHIP is on, and I think it’s almost like what Paul has said; if the hearing was to satisfy them, I don’t know if this is their top ten. But if it’s more to talk about the group that NAHDO had, then I think we’re on top, and I think starting with a NAHDO group is probably better. They’re clearer as to what they want, and then when you have a recommendation, you have a way for it to make a difference. For the individual consumers, it would be, even if we had recommendations that could get enacted, it’s like we‘d have to do a PR campaign or something to get back to them, for them to know that there was a difference. So I would say store it with the NAHDO one.
DR. TANG: So I think you’ve delineated the question we’re trying to ask ourselves. So for the people who want to use data, they’re saying, how can I use the data; figure out ways that I can use data. I think that’s solvable if we knew the other side, which is the people whose data are in these things, let me know how to create a trustworthy relationship with them so that you are permitted to use the data. That’s what I think is unexplored.
There’s plenty of people out there who want to use data; just say and ask, just tell me how I can use this, versus – so let’s paint one of the scenarios. Let’s say the American public says you know what, we really could do more with the data that I’m a part of for my community and for knowledge – that could be – and then you could see what you would do with that situation. But we don’t know that. That’s where I think we – it’s almost like the quality; again, we don’t know. We have been supplying tons of measures, none of which are decipherable and meaningful to patients.
Let’s go back and ask the same question about privacy. There’s tons of data, there’s tons of people who want data. Let’s figure out what it takes, what’s in their minds the best approach. We might be very surprised.
DR. FRANCIS: Jack, you wanted to say something a little while –
DR. BURKE: Just what Paul said, finding out what’s in the minds of people whose data we already have.
DR. FRANCIS: So that could be a panel. Sallie and then Mark.
MS. MILAM: I’m thinking back to more of the testimony we heard, and we heard from a physician from Utah, who spoke to his research project, where he got into consumer views a little bit, we heard, but I think it would take more than a panel, I think, to really delve into what sort of notice is meaningful, and notice is one element of your framework. You would really need probably an immersion; you would need different views. I would think you would need a hearing around that issue alone.
I think it’s a subset of the bigger framework.
DR. SUAREZ: On that point, I think yes, I think there is a significant value on that aspect, understanding the consumer perspective. The challenge I see is that this will be another exercise of getting a group of people that represent certain consumer perspectives, but then there will be as many consumer perspectives as there are consumers, almost, and that’s the difficulty, is really I think it would advance the understanding if we focus – probably not all, but at least part of the hearing on the consumer perspective, and trying to address what are the individual concerns, really. And that will help us advance a little more, as Paul, you’re saying, advance the understanding there, but again, the challenge is really that’s – you get ten consumers and you get ten opinions, or maybe more.
So it’s always a challenge to really say what do consumers really want. Each consumer wants something different, depending on where they are with their health, when they are, where, in which part of the country they are, and all sorts of things. So I mean I do think it’s valuable, and it would be important to provide that perspective.
I think one of the calls I mentioned, that really the trust part is a critical element of the hearing, and that we should try to bring that to the consumer side. But it’s really hard. How do we really assess that, you know, across the board. So I think it’s –
DR. FRANCIS: So we were thinking of, on the governance side, we were thinking of having on beyond data use agreements. What are the various forms of governments, so people can know that whatever it is they want, gets done. On the consumer side, we were trying to identify certain subgroups where there have been problems; and then there should be subgroups where there haven’t been problems, right? And then there was the question of small area data, and aggregation and inferences. So that might be three panels right there, I don’t know.
DR. HORNBROOK: I’m looking at the – I’m reminded of the analogy of global warming, because there’s a group out there that says science itself should not be trusted. And we are going to walk into that by trying to do consumer education, probably, not necessarily exactly, you’d probably get a group who would come and say any sharing is wrong, and do we want to be manipulated by that group?
You don’t, but is the benefit of going through – argument with that group is going to be worth the benefit of what you get from the other side of the coin. I just don’t know. It’s frightful to put ourselves out there right now. It’s going under the radar. People don’t know how much their data is going around just for treatment, payment and operations, let alone research, and now public health surveillance. I mean, if they fully understood, then there would be, among some of the privacy people, a real outcry about the US government is taking over every part of your life.
DR. FRANCIS: You know, my thought is, I don’t want to go there.
MS. MILAM: We heard a lot from Dr. Bodkin from Utah about his research around informed consent, and the differences in consumer response to when they did research without consent or without good notice, and trying to get under the radar, versus being forthright, and if you marry that with available research that we could bring to the table, not necessarily through a hearing – I’m thinking of Marty Abrams’ work from Hunton & Williams; they internationally researched the components of the privacy notice; it’s not HIPAA, it’s generalized privacy in the commercial world.
There are five sections – there are some best practices out there that we could easily bring to the table, and research, that we already heard, that I think we could probably make some recommendations about using hearing time for that, and that would be to make a notice that is understandable by the people who are going to receive it, and full consents, so that patients fully understand how their information could be used, if that’s where the committee wanted to go.
DR. GREEN: I want to ask for caution about the way that I hear the conversation going around consumers. The Community Health Data Initiative is not about patients; it is not about consumers. It is about communities and their leadership. Most of the people we heard from who came and talked to us, not because they were consumers. They were concerned citizens who wanted to improve the health in their community. Many of them were not health professionals at all. I think this is an important part of the framing about where this hearing heads.
If we’re going to talk about the hidden, subterranean uses that insurance companies and others have, with administrative health care data that are flying around all over the place, it’s one thing, and the consumer applies here, in my view, but the first two workshops, and the report in the NAHDO recommendations, really go back to what was our core question, is what is it going to take to enable communities to become learning health systems?
Another thing underlying, healthcare is about ten percent of the variance. And the data that they need in order to make their communities healthy, most of it is not in electronic health records. It’s somewhere else, and as soon as it becomes local, these large population-type issues that are scattered geographically and all across the country, approaches to dealing with these issues there are just totally insufficient to deal with this in your town or your neighborhoods.
So again, my key point is the framing; I’d be careful about deciding that we want to hear from consumers. I think what you want to hear more from is leaders who are trying to turn their communities into learning health systems to improve the health of a particular community.
DR. FRANCIS: If what we want to do is look at the trust framework side, what we want to hear from are people who can help figure out what the best trust practices are, right? If I’ve got that right.
Maya, welcome.
So we’re still trying to get our focus right.
First question – are you available on the morning of the 18th?
MS. BERNSTEIN: Of what month?
DR. FRANCIS: The day after this, the 18th of April.
MS. BERNSTEIN: As far as I know.
DR. FRANCIS: So the plan is to have four sessions on the 17th, and an – I’m sorry Walter – and the morning of the 18th; and I think you can’t come. So then we’ve got everybody on the 17th, and so we’re going to do all the hearing on the 17th and then we’re going to have – maybe even we can have a working dinner or discussion or something. You can at least give input, and then if we’re going to have a committee working, not here, in a subcommittee working session the morning of the 18th. So dates are set.
Now we have 15 minutes; I’m going to be task-oriented. I think we’re in agreement that we don’t want open season on consumer preferences, and we don’t want what are all the hidden uses of whatever. We do want some best practices. We want recommendations that communities who want to use a lot of information, including information from HIEs, but also information from local grocery stores, what are some best practices that they can implement so they don’t end up like Minnesota or Texas, having to destroy all their newborn blood spots, which were public health disasters. And those are real and it happened recently.
And if things go wrong, things can go very, very wrong. So let’s pick four – peoples’ top four. Does that work for people because Maya’s going to be calling people next week to get them lined up. And we had some suggestions; maybe we ought to just go – so let’s pick number one. Hearing Panel Number One, and take it from there.
What would be everybody’s consensus, top choice, of a problem to be solved for communities trying to use data and rightfully not freak people out? I’m putting that in a sort of funny way, but –
MS. MILAM: What is your question?
DR. FRANCIS: The question I’m trying to ask is, what would be the group’s consensus, the four most important problems to get a handle on for community leaders who want to be able to use information in trustworthy ways, and not find themselves hit by a buzz saw when they do.
DR. TANG: I think you ought to go look for the buzz saw. So in one of these panels, and I would sort of put it up front, I would ask – you can educate the panelists on the kind of things we’re thinking about, but I’d ask what does it take to have a trusting relationship with organizations – I don’t know how to describe this – people who have your data? And we would ask them – we would probe on areas like would it be okay if your community used it to plan social services? A number of things, so they can think more broadly than I’m just going to batten down the hatches, and just have them think properly about what it would take to feel comfortable and to feel trust with an organization that does have your data and could use it in various ways.
Then that feeds into well then, what does it take for a community who wants to – then it goes more into what you are saying – to start with, just figure out how to let people use your data. To me it’s bypassing the voice of the customer.
DR. HORNBROOK: I was just thinking whether you could use one dimension, BMI, as a model for everything else; you could be focused on health promotion, focused on the dimension that people can “see”, and focused on something that for some part of this country, is very sensitive, but if you’re around that person, it’s obvious. If you’re looking at ways to improve the health and lower health costs in this country, it is controlling obesity and controlling diet and controlling exercise, or improving those things.
DR. SUAREZ: You ask what are our top three, I would say governance, trust, and I think the whole concept of the inferences, but in the sense of deidentification and reidentification, and the protection of certain groups. So I think those are my three.
DR. FRANCIS: So is there a consensus? I haven’t heard a lack of consensus on two issues; one is the governance, where – that was something that came out in NAHDO, it came out in the last one; it’s come out in everything. And so the governance, where one form of governance is a data use agreement, but there are many others.
A second panel would be specifically on the question, not the technical question of individual reidentification, but the question of using data in small communities, that when Larry said, we meet deidentification standards when there are a small number of people, but if you know who those small people are, that may be something that we have some reason to think really concerns people. So that was the aggregation inference panel.
Now if we tried to have a panel, that else would it take? To go back to Paul’s question, who would you want to have? If you could invite three people for that panel, who would it be?
DR. SUAREZ: For which panel?
DR. FRANCIS: The panel Paul was suggesting. Hearing a voice from the consumer, what’s going to upset you?
DR. TANG: I don’t think I’d frame it like that.
DR. FRANCIS: How would you frame it?
DR. TANG: What does it take, what are the rules for a good steward of your health data? And you could invite people who are steeped in this – Walter’s problem is real, that you can’t represent everybody, but people who have thought about it from both sides, and recognized the challenges on both sides. It could be – national partnership always gets brought up; they have thought about it both ways. Devon’s another person who can think of it and can portray the various perspectives and also the pitfalls of consent or even informed consent; it’s much better to understand and then create mechanisms for fulfilling those understandings and applications than to rely on consent, which actually undermines it all.
I would frame it on what kinds of rules would you have for a state steward of your health data? And maybe that’s an appropriate way; we could describe what it means by stewardship.
I like Mark’s example, I think we need to have individual examples, because clearly everyone understands obesity is a problem in America, and BMI is a number that describes you. How do I think through this? Tobacco is another one. Also a top one, it is visible, like Mark said, it’s a top priority for the Health Department. So on and so forth, and people get it, they understand that part. And yes, there are risks, because some people can’t actually get employment, so there are real tangible risks, and they have to think that through.
But we would ask them, through our framing of the questions to the panelists, think about not only your situation but the community’s and the country’s, and just have them – I think we can do this, by and large, Americans are smart, and if you give them enough information, they can try to figure out what’s the right thing to do.
DR. FRANCIS: I know some people who are doing data-driven work on peoples’ attitudes, and the people that I know who are doing that work, well there are three that I know pretty well, one is Barbara Koenig at the Mayo Clinic, who’s done a lot of focus group work; another is Jed Bodkin, who we had before, who’s done focus group work around newborn screening issues, and a third, who I hadn’t thought of before, but he’s at the Medical College of Wisconsin, named Ryan Spellecy, who’s doing – he’s actually got an educational model for how to think beyond informed consent.
But those are – there are people who are doing empirical work. Another one who’s doing empirical work is the Group Health of Puget Sound, who wrote a paper a year or so ago now, on using data NDB gap, and the paper is called “Just Want To Be Asked”, I think. People are happy to have their data used, but they want to be asked.
DR. TANG: That could be the answer we get, and that leads to very different approaches and very different policy recommendations, and that’s what I think we need to find out.
DR. FRANCIS: We could get a whole panel of those data-driven people. Those are the ones that I know the best, but I’m sure there are others. Vickie, Mark, Sallie – you’ve got ten minutes.
DR. MAYS: In terms of the people we’re bringing to the panels, do they have data and information that link to the people that you had at the community hearing? For example, if they’re talking about these issues, are they doing this work in the same communities that you’re getting the complaints from?
DR. FRANCIS: The Group Health of Puget Sound one is, and Barbara Koenig, who’s a medical anthropologist and a bioethics person at Mayo, we had people from the area around the Marshfield Clinic, so that’s not far off.
DR. HORNBROOK: I just want to remind us that if you know somebody, chances are if you know that they’re in a small group of six or five in a cell, you probably know a lot more about them, so you weren’t learning anything. So the distinction here is, you get the small numbers, somebody who already knows somebody in that group really learning something about the person they didn’t already know. Because you certainly know a lot of things about that person that the researcher doesn’t know because they didn’t ask.
But the other thing is, there’s also a lot of privacy uproar about Google’s changes in their use of your information, which you did not get asked, and they’re telling you go read their privacy laws, and the only way you’re going to get out of that is stop using Google.
MS. MILAM: Coming back around to one of the first comments made, I think it was one by Vickie, when we are talking about the hearing, it’s sounding like this informed consent discussion is relevant for research, but wouldn’t necessarily apply at all to public health. Public health receives data under state law, and it’s required to be sent by provider, and consent and notice really don’t figure in.
Now the providers are required by HIPAA to have an NPP, and that NPP has to have a statement that information, PHI, is given to public health. It’s really not an issue for communities who are public health organizations requiring the data under law. So this panel around the informed consent issue, really wouldn’t touch public health; it would be more for research and where you are not getting information under a state law.
DR. FRANCIS: I’m not sure that’s right, because it’s certainly true legally, but if you look at what happened in Minnesota, they changed – there was a statutory change because people got upset, and so that was not a good thing, that statutory change. So one of the – I mean, communities who want to be able to use data don’t want to have that kind of thing happen.
DR. HORNBROOK: Transvaginal ultrasounds law – attempted to change the law too. They’re actually working – they meaning people who want to change in a different way – are working to change the laws, constitutions, states. They want fundamental change.
DR. FRANCIS: So the question is, what are the appropriate protections so that there isn’t this yin-yang?
MS. MILAM: I guess when you have a lot of data organizations who are receiving this data under statutes under the required by law bucket, who are not consumer facing, and have no interaction with a patient whatsoever –
DR. FRANCIS: Ok, so five minutes, let’s design panels. Paul, if you were going to pick consumer groups, I was suggesting some of the data-driven people. Maybe we could have one panel that’s that, one panel that’s consumer-facing, another panel that is data use agreements, a fourth panel that’s the aggregation problem. How does that look to people? By the way, the aggregation problem, what I mean by that is, the small area and inferencing. That’s the one that’s tentatively entitled here – “Drawing Inferences” would be one, another would be “Consumers”, where to some extent, that would be groups, because that’s –
DR. TANG: But you’re presupposing that they want to protect groups.
DR. FRANCIS: Well, but they might not. But that’s – what we are trying to is get a sense of attitudes, and then the third one would be “Data Use Agreements and Governance”. The fourth one would be a data-driven panel about what’s known about what people want. And we could get the Just Want to be Asked people. We’ve already heard Jeff; we’ve got Jeff’s data, that was from last spring. We could try to get Barbara. Actually, Ryan’s in Wisconsin, too, he’s at MCW.
DR. SUAREZ: This last one, isn’t that a little bit a rehash of the panels that actually were done in preparation of the Population Health Report? The hearings on the Population Health Report were specific to data-driven people talking about what they want, right? What they need.
DR. TANG: I thought she was saying data-driven in terms of assessing consumer sentiment.
MS. MILAM: Exactly. We heard that, though, in the other hearings.
DR. FRANCIS: We heard some of it. But we didn’t hear it systematically. We could essentially try to figure out what’s the – what’s known about that.
DR. SUAREZ: So just clarifying the type of people, you have data-driven people on the last panel, you have governance policy people on the governance, you have consumers, and then the first one is drawing inferences; it’s sort of also drawing data-driven people, talking about drawing inferences, right?
DR. FRANCIS: That would be people who use the data and the questionnaire would be what are the worries about, say, stigmatizing neighborhoods? And how do you protect against those?
We have five minutes to give Maya names. We have a pretty good list of names for the governance EUAs. That’s actually where Devon would also potentially be good, although what she knows is pretty well-known.
MS. BERNSTEIN: (comments off table).
DR. FRANCIS: I had suggested the eMERGE consortium, which are, if you go up there to the list, they’re on – it is on the research side, not on the public health side, but what they’re doing is sharing data for a variety of research purposes. I can’t remember the exact details, but they started out with data use agreements and found that that was appallingly complex to keep when you’ve got a large consortium, to keep doing it onesie-onesie, so they’ve worked out a set of practices for governance that I thought might be helpful.
MR. BURKE: I think the Department of Population Medicine at Harvard Medical School, Richard Platt, someone from his group. They’re running Mini-Sentinel; it’s a consortium approach, but independent of that – I think data users, I think that’s the best bet, but there may be other opportunities.
MS. BERNSTEIN: (commenting off table)
DR. FRANCIS: I was thinking something like the Mini-Sentinel would be another – what are they doing with respect to governance?
DR. HORNBROOK: It is kind of a democracy, except for the FDA holds out money, then FDA controls things.
DR. SUAREZ: Controlled democracy.
DR. HORNBROOK: No data holder is forced to deal with any specific task. They electively participate in the task. No data holder is forced to participate in a task. Every task that comes out of the Mini-Sentinel, each data holder elects to be included or not included.
DR. FRANCIS: And they keep all their data. I mean, the question would be –
MS. BERNSTEIN: So does that mean it’s worth hearing from them or not worth hearing from them about that?
DR. HORNBROOK: It’s a sophisticated notion of public health surveillance, because there’s no IRB involved.
DR. FRANCIS: And it’s a potential model for data protection, because the data all stay with the original collectors of it. So you could go up to – you could go to the DRSA agreement so you could have a whole set of things on governance, you could have the DRSA folks, you could have the eMERGE folks, you could have the Sentinel folks, you could have the question be, are there other models of data use agreements that are effective governance models in the sense that people can be assured that whatever uses they want or don’t want are actually happening or not happening?
DR. HORNBROOK: Right now, what’s happened as far as I’m concerned is that at first there were lots of barriers when HIPAA first came out to sharing data for research, and my organization participated in not letting any data leave us, so if you wanted to use our data, you had to leave it with us, and use it. It makes sense to change practice such that research is a product line of the health plan, so that as long as you treat a researcher or a search agency as a vendor for treatment, payment and operations and research, then you use the usual business agreements to do research as you would do treatment.
DR. FRANCIS: We’re focusing on public health in some respects. So Paul, who would you want to hear?
DR. TANG: Another possibility is to pick on some of the states; California is one of them, who have notification laws, and there is somebody who receives these complaints, so that we could get one view of the public sentiment; we would want to have other balancing views about people who would like to have their data be used in some of these population studies. I almost think the people who listen to what, could have listened to the community health care data of the communities, would be impressed and would want – because it brings it home. So maybe – you know, we have Rochester here. Tap some of these communities and find some of their citizens who would want to say what’s it like being just a citizen of a community that’s active. Get that kind of perspective.
DR. FRANCIS: I don’t know how you get a citizen; that’s why I was thinking – I’m sort of an evidence-based person –
DR. TANG: You go through the community themselves; let’s say Rochester – Well pick one of these communities we heard from, I’m sure they had – in fact, I think some of them had a community action, like committee, get the Chair or whatever from there.
DR. FRANCIS: We had them from Denver; Barbara Koenig has tried to do Social Science research in which what she’s done is select representative community members and actually, she had three-day sessions with them an d so on, and so if we wanted to get somebody who was not of a –
DR. SUAREZ: Advocacy person?
DR. FRANCIS: Yes, but you count all het advocacy people; if we want to get somebody who’s tried to do evidence-based work, in a community like that, that’s –
DR. SUAREZ: But I think looking at the HIE experiment around the country, there are several HIEs that in their Board of Directors, actually have a consumer sitting in there, representing that perspective, and I know there’s been work done by ONC, the HIE side, to try to look at how that can be sort of an established practice. So in looking at the HIE side, like in New York or in some of the other Northeast states, anyway, that have that, it could be a possibility of identifying two or three individuals that are the actual consumer rep in the HIE that can provide that perspective of what’s –
DR. TANG: So one is a perspective, the other is a best practice, and I can’t remember which hearing it was where we heard, it was either Colorado or Utah, on what they did, because they’ve met – they had town halls in communities, and in a sense, it’s not just to say “oh, this is the consumer perspective, let’s just write” – it really is an engagement process, just like we talked about, again, in -– so that becomes best practice of what it takes to get the trust. It’s not just the policy. So I think that’s part of our contribution.
MS. KLOSS: Wilma Adams(?) in Rhode Island has done a lot of outreach and incorporation with consumers in Rhode Island –- she might be a good panelist.
DR. TANG: Do you remember the person I’m talking about? I think it was Colorado –
MS. BERNSTEIN: There were two communities from Colorado.
DR. TANG: So his slides talked about this Town Hall, these community town halls, and in some – we don’t need to repeat – maybe what’s useful, if we could go extract some of the stuff from our previous hearings that are relevant, so for the benefit of us, as well as the people who are going to look at this testimony, see the whole story as we put together well, what are our recommendations?
DR. FRANCIS: Okay, so we need – I promised Jeanine that we would add in three minutes. Maya needs to be doing calls to people. Action steps are, I think we’ve got a sense of the panels. If there is anybody that you really want to make sure gets invited, like if you’ve got a good suggestion, Paul, for one of the California people; Jack, you’ve got a good suggestion for the folks with Mini-Sentinel, I know people who have been doing the empirical work about attitudes, Sallie knows some of the DRSA people, maybe that’s the way to go, and send it to Maya by the close of business Monday. It’s your homework on the airplane. Does that work? Maya, does that work for you?
MS. BERNSTEIN: Yes, if you tell me especially which panel you think they fit in.
DR. FRANCIS: So the panels are – Beyond Governance, Beyond DRSA’s questions of governance, that’s one panel. The second panel is not solving the de-identification problem, but solving the local area problem. How do you deal with local stigma? A third one is what do we know about what consumers want, where that could be data-driven, that could be representatives of community organizations, and the fourth one is – I think we had the drawing inferences. What are some of the – So it was what do we know that was data driven and what do consumer groups want? That was the – those would be the four.
MS. BERNSTEIN: I still don’t understand the difference between panel one and panel four here. I’m having trouble with that distinction.
DR. FRANCIS: Panel one is about the question of what are the risks here.
MS. BERNSTEIN: As opposed to the risks of being identified in a small group, or the neighborhood being identified? Other risks?
DR. FRANCIS: Well maybe that’s – I don’t know. That was supposed to be the one about drawing inferences –
MS. MILAM: It’s the challenges of small area analysis?
DR. FRANCIS: Yes; that is a good way to put it.
MS. BERNSTEIN: Okay, but those are still the same thing.
DR. TANG: Is it only smaller area analyses?
DR. FRANCIS: I don’t know that it is; I mean, that’s one set of problems, but there’s some religious groups that have different views, there are racial and ethnic groups that might have different – there are all kinds of –
MS. BERNSTEIN: In the previous; when I did the previous grouping that I handed around this morning, I divided the disease people from the race/ethnicity/religion kind of people, because I don’t know if there’s enough of them to make a difference, but you really can only have three or four people on a panel. So if you want to get at all those things, and also we thought we were going to have five-six panels then.
It’s hard to cover the waterfront with only three or four people, but if you have more than that then you kind of don’t really have an opportunity to talk to them in any depth in the time that you have. That’s what I tried to do from our conversation before.
DR. FRANCIS: Well that would be a way to divide it up.
MS. BERNSTEIN: But I don’t want to suggest taking more time for that particular topic than the committee intends.
DR. FRANCIS: I am afraid we need to stop.
MS. JACKSON: Two sentences on the report dissemination plan that’s in the agenda; we had a good discussion about this in the Population subcommittee and several members here were there; we’ll follow up after the focus on your hearings; see what your identification of groups, listservs and things that would be helpful for us to disseminate this wonderful report, as well as continue what you’re planning for April. So it kind of all goes into one good strategic thrust. This kind of follows up the CHIP and then we’ll be able to use your suggestions to get our materials out to targeted audiences who have an interest in what we’re doing.
DR. FRANCIS: We could also, well so here is the assignment right there. If there’s someone you really want to make sure gets invited, please send to Maya ASAP, and that’s by close of business Monday, and Maya and I will be talking on the phone Monday, and she’ll start inviting people and we’ll take it from there. We may be able to get some and not others too.
PARTICIPANT: Is your e-mail address somewhere handy?
DR. FRANCIS: It’s maya.bernstein@hhs.gov. It’s very easy.
Okay, meeting adjourned, thank you all.
(Whereupon, the subcommittee adjourned at 9:48 a.m.)