Transcript of the September 17, 2008 NCVHS Subcommittee on Privacy and Security Breakout Session

MR. HOUSTON: Yes, because it does become – we do need to take it before the Committee to be sure there is agreement as to the substance.

DR. FRANCIS: Right. And the idea is that this doesn’t need to go before the Full Committee, this is just a Subcommittee.

MS. GREENBERG: Well, the Full Committee voted to do this, right?

DR. FRANCIS: To do this, oh, yes, but I mean this particular version of the text, as I understand it, once the Subcommittee’s okay with it, it’s out the door or into production.

MS. GREENBERG: I did want to thank Leslie and Debbie Jackson for working with Susan Kanaan on this, this summer.

MR. REYNOLDS: Well done.

MS. GREENBERG: And John, of course, contributed.

DR. FRANCIS: And John did, too. It’s kind of interesting to be a two-headed – I don’t know if one’s a monster – a Janus, or quite what, but it’s fine.

MR. HOUSTON: What are you calling me?

DR. FRANCIS: Janus-faced, two-headed, right? One facing forward, one facing backwards, I’m not sure who’s doing which. I said I’m not sure.

Then the next thing to look at is the little blurb on Page 3, which is with respect to the first letter.

MR. HOUSTON: This has all been circulated to the Subcommittee. I’m assuming people read it. I know I made some changes when I reviewed it initially, and the like. Do you people have concerns about what’s on Page 3?

DR. SUAREZ: Not so much of a concern, but a suggestion, three formatting suggestions, I guess. One is on each of the sections, because really these are sections, like Page 3 and Page 16, the different sections that start with this year, I would move the title that is below this box, just below the box there’s a title, Roman Numeral I, “Privacy and Confidentially, June 22^nd,” I would move it before the box.

MR. HOUSTON: This is going to go through a lot of – I mean they’re going to turn it into a brochure, so I think there’s going to be more formatting, I believe.

DR. SUAREZ: The reason I was suggesting that is because it gives a better sense of sections, if you will.

DR. FRANCIS: These were the original titles of the letters, and the reason that this got structured this way, and this is I think up to the group to say, is that because this was the original title of the letter and because what’s in the box didn’t appear in the letter, we were structuring it to preserve the integrity of the letter.

MR. HOUSTON: The other part of it too, I think, is I don’t know how this is going to look once they actually go and do the additional formatting. It might be good to have a title page with that on it, as well as the box, and then keep the title associated with the letter itself as well. I understand your point.

DR. SUAREZ: The second suggestion is I noticed in some of the boxes there were, “the report made the following recommendations,” for example, Page 23, February 2008, inside the box is a summary of the recommendations. In all the boxes that’s not the case. For example, the first one is June 2006, it doesn’t highlight the recommendations made, and I think it serves as a summary in that box of the specific recommendations that were made. Somehow inserting in that summary box the recommendations in all of the summary boxes is what I would suggest adding.

MR. REYNOLDS: Maybe a better question is what is the purpose of the box?

DR. FRANCIS: The purpose of each box is, first of all, to put the letter in context to tell the story of when the letters were written. Second of all, to at least tell the people what they’re going to find in the letters. I think the reason why the June – there was an effort to be consistent, to have those little bullets across each summary, but with the first letter there’s so many recommendations, it’s like 26, that putting them in that little box seemed like way too much.

So what we did actually at the end was all of the recommendations are together at the end in the appendix.

DR. SUAREZ: I noted that. That was going to be my third. I think one of the most important aspects of this compiling is showing the set of recommendations that were made.

DR. FRANCIS: Right.

DR. SUAREZ: And it almost bears a 40 page or so report, it almost provides an opportunity to include an executive summary or something that at the introduction, right at the beginning it summarizes the recommendations, putting them into the appendix. I know that the issue might be putting all the recommendations into context because they follow different timelines and they follow different topics, but to some extent this is what is the most important part of the report in my mind is all these recommendations and have they been addressed, or where are they, not just necessarily to describe are they being addressed.

DR. FRANCIS: We went back and forth on that, and the initial try that was a worry was once they’re summarized the concern was they wouldn’t be the exact language of the Committee. So that’s why we did it this way. That may be a mistake.

Paul, you had a comment?

DR. TANG: I’m picking up, while Walter with fresh eyes is looking at it. I understand how we don’t want to add new content or even change the wording, but there could be new value. One value is it’s all in one place, that’s a key value. Another value might be like a table that basically gives sort of like a table of contents, but it’s if I want to find something I see this is a topic of interest and I’ll go to page 30. So that’s actually a value add to the set of materials without changing anything.

Then it also addresses some of Walter’s, I’m trying to get in my mind, this box is a summary or this box is it, and if we could just sort of put this additional table of contents it can show the comprehensiveness of all of the recommendations, and be a finding tool without changing anything. I’m trying to weigh both of the comments.

DR. FRANCIS: How doesn’t box number 1, box number 2, and box number 3?

DR. TANG: They’re in three different places and I don’t really know, box number 1 means something, its topic is covered, box number 2 means recommendations because box number 1 can’t be that big. Do you see the rules? So Walter’s trying to put together what’s the rule of looking for a box.

MR. HOUSTON: I think Paul makes a good point. It might be helpful to have some type of cross-reference tool. I would also say that to be entirely consistent maybe what we need to do is go back to Page 23 and where we talk about recommendations maybe we should take that part out and simply say the report identified or addressed the following topics, as we have in the other boxes, so that we keep recommendations out of the text box. Then we simply provide a bulletized overview of the contents of the letter or the themes of the letter, so we’re not talking about recommendations in any of the boxes.

DR. FRANCIS: That actually is a simple change, because it could say, “The report identified the following issues for the Secretary, the need for a policy for.”

DR. TANG: So what Mark did with their common framework is they had an overview which sort of, why do I have 23 policies, and then almost a diagram, this policy P-21 deals with this topic. It’s just sort of like a table of contents.

MR. HOUSTON: I understand your point and I understand where you’re going and I think it makes sense. It probably is more meaningful because these letters are all freestanding letters. The different topics may not necessarily be where you’d want them to be if they were all part of one big letter.

DR. FRANCIS: And Susan’s vision I think of this is that what’s in the boxes would actually look larger in the final document. I think the vision is that when this goes to design that some of what you’re saying, what we have is, for example, the February 2008 box be a clearly identified opening page box, “than for the individual control of.” By the way, “individual control of” shouldn’t be 4, it should be 3, there’s one glitch.

MR. HOUSTON: But I think Paul’s point is more basic than that.

DR. FRANCIS: Oh, I know.

MR. HOUSTON: Which is how do you cross-reference all the different themes?

DR. TANG: So 2008 means nothing to Walter. He needs to have an organizing – that’s why we’re too close to it, we’re saying oh the June 2006, well, that means nothing. Basically he wants to show me where I can find out information about this.

MS. GREENBERG: I understand where you’re coming from, but the risk is that these things are very interrelated, and it’s hard to say this only relates to this policy or that relates to that policy because they’re very interrelated. So you could, and if you try to capture all the relationships this is going to make it even bigger and sort of more cumbersome document, and it’s already pretty big.

We wanted to preserve the letters, which were carefully crafted over a long period of time and have quite a lot, particularly that one has a lot in it. So that would be my concern, and sometimes when you add value you also sort of start adding meaning that wasn’t there in the first place, or what have you. I’m not saying don’t do it, but it’s just.

DR. FRANCIS: We do have a table of contents at the front.

MS. GREENBERG: Yes, well, that’s fine, I mean a table of contents is certainly legit.

DR. SUAREZ: Maybe we’re trying to form something that is still in the formation stages, and we don’t know necessarily at the end how this is going to look graphically speaking, and in terms of distributions.

MR. HOUSTON: Harry and Sallie both wanted to say something.

DR. FRANCIS: Yes, and I also wanted to ask Debbie if she has thoughts about the formatting.

DR. SUAREZ: Oh, right, I’ll withdraw that and just wait.

MS. MILAM: Looking at the recommendations it’s clear there are a variety of audiences, some of them are directed to HHS, others are probably directed to Health Information Exchanges, maybe state governments or public health. I’m wondering if the goal is action, if it would be helpful to have an executive summary grouping them by the direct audience, just a thought.

MR. HOUSTON: The audience on these I believe is always supposed to be the Secretary.

MS. MILAM: Right.

MR. HOUSTON: And the reason why some of the recommendations are worded as they are is because you have to recognize where the Secretary has authority, and what the bounds are we can expect HHS to do. Like something might not be within the purview of HHS, it might be under the FTC or something, so you would say HHS needs to work with the FTC to do whatever. The audience of these letters is always intended to be things that were actionable to HHS.

DR. FRANCIS: The goal of having these be available is so that the world knows that these were NCVHS’s recommendations to the Secretary.

MS. MILAM: I guess before I joined NCVHS, I’ve always known that it gives recommendations to the Secretary, but the world watches these and reviews them for appropriate impact even on their own organizations. That’s what was behind –

MR. HOUSTON: I understand the point.

DR. FRANCIS: And that’s what I was going to say, absolutely.

MR. HOUSTON: You might find some of the recommendations may seem a little bit odd, not oddly worded, but have a particular focus to them, because we recognize what our authority was, so you’re right, you can read into any of these recommendations and say I understand what the practical import of that is. But at the end of the day we had to make recommendations that were consistent with our charge and our authority, so that’s why you see some of that occurring.

DR. FRANCIS: Debbie, do you have some thoughts, yes?

MS. JACKSON: Just that we’ll be very comfortable formatting it to get across the impact he needs. Susan is intimately involved with you all trying to get across in the boxes in the summaries, and in the statements, so we can accommodate that. It’s just that coming to grips with your kind of two directives: One, keeping the integrity of the letter. She was very careful almost to the point of – it was just very difficult at some points staying within that as the objective, versus opening it up and making more of a through line and story and statement and communication. It just seems like this was the closest we could come to keeping the objectives as they were identified at first, and that was to keep things as precise as possible in the letter, and made it clear what was in front was added text, and then the letter was to stay intact.

DR. FRANCIS: And that was, as I understood it, that was the clear direction that we were given in the last meeting, so we didn’t go back on that.

MR. HOUSTON: Can we go back to Paul’s point for a second? There is an introduction which only describes the three letters and doesn’t really go into more detail. I’m sorry, not introduction, table of contents. Would it be of value in the table of contents to drill down to the next level at least of headings?

DR. FRANCIS: We could certainly do it in a table, I was thinking that too, we could in the table of contents add the subheadings in the letters. How about we do that?

MR. HOUSTON: I think that would help with what Paul’s trying to achieve, which is at least let me have some way to find what I might be interested in.

MS. BERNSTEIN: Walter, how do you feel about that? Would that resolve your issues, or would it help?

DR. SUAREZ: Yes, I was thinking the same thing as I was looking at the table of contents and seeing there are at least three levels of headings here: the major heading within a letter, the subheading within that major heading, and then the recommendations headings. At least the first level headings which describe the topics covered in this letter should be highlighted. Some of the sections don’t have any heading, like the 2007 letter, but I think that would be helpful to have that.

I was talking about formatting-wise on this letter of February 2008, the headings don’t have the same formatting as the letter back in 2006, where it has A, B, C, D, E, F, G. It might be, even I presume this was the original way the letter was actually formatted, so in the 2008 letter they didn’t use A, B, C, and in the 2006 letter they used –

MR. HOUSTON: I don’t think we necessarily need to use the A, B, C, D, E, I mean the heading titles, I think.

DR. SUAREZ: In the table of contents you want to put some sort of a structure so that it doesn’t just –

MR. HOUSTON: I think we can figure out a way to make it look consistent. Then the other 2007 letter, I don’t think it really wasn’t that long.

DR. SUAREZ: Yes, the 2007 letter.

MR. HOUSTON: It was a fairly short letter.

DR. FRANCIS: And the 2008 letter does have some subheadings, but I think they were thought of as smaller. We could just take out the A, B, C, D, E in the first letter, or we could A, B, C, D, E the subheadings in the third letter, either way.

MS. GREENBERG: Consistency would make it.

DR. SUAREZ: Yes, consistency would be helpful.

MR. HOUSTON: I don’t think we’re changing the substance of the letter by doing that.

DR. FRANCIS: No, we’re not. If we A, B, C, D, E, so I’ve been making a mental list, so what we’re going to do is we’re going to fix the first paragraph of the introduction, we’re going to fix the table of contents.

MS. BERNSTEIN: Did you come up with language while I was out of the room? Do you want me to just do it now?

DR. FRANCIS: No, we will work on that language and send it around to people. It’s basically just a first sentence, then we’re moving the sentence “taken together.”

MS. GREENBERG: Then capturing that idea that Mary had.

DR. FRANCIS: The contemporary relevance, yes. Then what we’re going to do is we’re going to augment the table of contents to include the subheadings, and A, B, C, D, E the subheadings in the third letter, which has them.

DR. TANG: Are you planning to include the recommendation titles in that?

DR. FRANCIS: No, we’ll just do the subheading titles in the table of contents. Then we’ll make sure that the boxes are consistent so they all identify issues or topics rather than identifying recommendations.

Then we’ll take out “an historic document.” Those are the changes –

MR. HOUSTON: By the way, Harry has some comments.

MR. REYNOLDS: No, please finish.

DR. FRANCIS: Those are the changes I have written down we will do. Then also the letter three is mis-headed as letter four in one place.

MR. REYNOLDS: What I’m hearing from everybody is, I agree, we don’t want to change the letters. Whatever we put down there, we put down there, period, end of game. But the question I haven’t heard us ask is, How do we want this used? We can use it as an historical document and we can write it anyway we want to, because all we’re saying is your attention please, this is what NCVHS did.

I’ll play off of Sallie’s, and a lot of the industry watches these things. How useful do we want it to be to other people? So the questions that are coming about indexes, the questions are becoming about cross-references, those questions allow me as a privacy official in some organization to look at this and go, ah-ha, that’s my problem right there, rather than reading a forty page document, going through it a letter at a time, a thought at a time, a feeling at a time. I don’t think anybody has any problem with the whole preface.

MR. HOUSTON: I think we’re trying to address that.

MR. REYNOLDS: But that’s what I’m saying, that’s what I’m hearing, is how we want people to use this.

MR. HOUSTON: Let’s take another shot at the table of contents, look at it and see if it’s meaningful or whether to Paul’s point we go down to the next level so we do get to that. I’m going to list one concern though, which is if somebody comes to this document and expects it to be the end-all be-all of privacy and NHIN it’s going to fall short. So we also have to be careful that we recognize these are selected topics, as well.

DR. FRANCIS: I can tell you we tried as an initial ploy to do it topic by topic, and we couldn’t keep the integrity of the letters doing it topic by topic. Susan and I actually tried that, and Debbie. I think while we were doing this as an initial document where what we did was go topic by topic on recommendations, there would of course be enormous gaps too that would be noticed. We would have done it that way, but that’s not how this happened. With the Committee’s charge to us, the Full Committee, being to preserve the integrity of the letters, the only way that I see to do that is with a really good analytic table of contents.

MR. HOUSTON: I agree. I think that’s what we’re all saying.

MR. REYNOLDS: That’s what we’re all saying.

DR. FRANCIS: Yes, we’ll do that.

MR. HOUSTON: Let’s take a couple shots at the table of contents and see which one works best. I think we can do it with more or less granularity, and see which one seems to flow better, and then make sure they’re consistent in terms of the way they are formatted, maybe we indent certain ways or maybe we don’t, or maybe we bold out, I don’t know. We can play with it.

DR. FRANCIS: We should I think send it with the graphic design, and then play with table of contents to see how that works.

DR. SUAREZ: I absolutely agree, I think those will be good improvements. I think there are two aspects that might still be missing from the list of the ideas that we were trying to do. Number one is in the introduction, there is no summary statement context of what each of the three reports or four reports were. I was thinking this, if one were to read the introduction which talks about the purpose of this monograph and why it was created and what is the intent of it, it will be helpful to say basically describing the different components of it, the June 2006, the June 2007, the February 2008. Then giving a short paragraph within each of those saying like the first little paragraph in each of the boxes including that in the introduction will help give context to what people are about to read.

DR. FRANCIS: I was just making a note to myself that a way to do that would be if we move the sentence “taken together” up to the first paragraph, then we say “the letter reports are,” then you have the first one and there’s two sentences describing it after the title, then you have the second one and two sentences describing it after the title, and the third one, ditto. That would do that, I think.

DR. SUAREZ: Yes, I think that would be helpful. That would give a sense of I’m not about to read everything about privacy you wanted to know, I’m about to read these three aspects of privacy that have been addressed by the Committee.

DR. FRANCIS: Right. We’ll make sure that happens, yes. Paul and then Sallie; Paul, Marjorie, and Sallie I think was the order I saw.

DR. TANG: I think Harry set the context correctly. I’m going to play off a little bit of what Sallie said, because I have a live example. So there’s a vendor that’s creating essentially a mini NHIN, and reinventing or not addressing the issues that we’ve spent three years of our life doing. And here it is right in front of us, like recommendation on mandatory voluntary participation, if they only knew it was in this document, that’s the driving. So I’m very much wearing the consumer hat rather than the producer hat, and I think we’ve been talking a whole lot about the producer hat and we want to make it a consumer.

Because the frustrating thing is, here it is, and people don’t know, even if I point to the link you can’t find the information you want to consume, or even notes there. That’s why we’re so intent on bringing it up all the way to recommendations on mandatory voluntary participation in the table of contents. It just makes it so much more consumable.

MS. BERNSTEIN: You mean consumers of the document?

DR. TANG: Yes, consumers of the document. That’s what Sallie’s point is, we understand to whom we were originally addressing the letter, it has value and impact way beyond that.

DR. FRANCIS: If table of contents reads 1, and then A Definitions, B The Importance of Privacy and Confidentiality, C The Role of Individuals, then C-1 Flexibility or Uniformity, Mandatory or Voluntary Participation, Nature of –

DR. TANG: Of all the words the thing that got my attention is the mandatory voluntary participation.

DR. FRANCIS: What I’m doing is just pulling up what are the headings and subheadings.

DR. TANG: I’m just trying to say what would the consumer really like to see? Because all those words are code words that we understand. I don’t think that – they’re not transparent and impactful. That’s just a word.

MR. HOUSTON: Let’s play with the table of contents, do it a couple different ways, and then circulate it and decide what we think is most meaningful.

DR. FRANCIS: Also, in that initial sentence paragraph about how we think this remains relevant, this is crucial today, we can say this is crucial for all kinds of stakeholders in the development of health, we believe these privacy recommendations are crucial for all kinds of stakeholders in the health IT.

DR. TANG: Invite people in.

DR. FRANCIS: Yes, invite everybody in with that sentence and then we’re fine, I think. I must confess I’m hoping not to have to do major surgery because the thought is this needs to be out the door. These are great suggestions, and what I’m trying to do is figure out how to do this consistently without doing major surgery, and in particular preserving the integrity of the letters, which was the thing we struggled with.

MS. GREENBERG: I thought I was next.

MR. REYNOLDS: You are next.

MS. GREENBERG: I’ll be quick. First of all, I’m much more comfortable with a really detailed table of contents than some kind of trying to go like that, diagramming that this means this, that points to that, because of the thing I mentioned before.

The other thing is just playing off what you said, Leslie, we’re dealing with the letters we have, not the letters we wish we’d written as it were, although they’re very good and they’re a treasure in a sense, so that’s why we’re spending this time. But by putting this all together and recognizing this is what we have and we don’t have more to deal with, I think it may rise to the surface some gaps, some areas that the Committee has not addressed, and for your future agenda. So I think that’s another thing, so you don’t have to lament, gee, this isn’t the way we would have written it if we’d started from scratch. It’s what it is, that’s what we’re doing, but then it should actually maybe call attention to some other areas.

DR. FRANCIS: And a conscious choice that the three of us made in the initial draft and with John was not to have a summary that indicated possible next steps or anything like that, because we were worried about there was one that was drafted and we dumped it because we were worried about the risks it involved.

MS. GREENBERG: If you were going to do next steps you would have to take it back to the Committee, and go through that.

MR. HOUSTON: We honestly at this point in time we don’t even know what our next steps are, that’s part of what this meeting is to talk about.

MR. REYNOLDS: We can’t touch the letters, and I don’t think we’ve heard anybody say touch the letters. Those are done, those are set. Our relevance in all these debates is what this usability is about. It’s been useful in the functional requirements of the NHIN, those immediately turned up in RFPs. This is going to be a theme in general of ours, which is we did this, now how can we differentiate ourselves and make it more useable than the other things that are out there. Because there’s a whole lot of privacy discussions going on in a whole lot of places, and everybody’s putting out documents. So I think that’s all you’re hearing.

So nobody’s asking to change it, to change the content, it really is make it useable so that when people are having these debates or these issues they know how, they can find our stuff the best. That’s all that’s about.

And that’s going to be a continuing theme that I’m going to be talking about on a regular basis, because one of the things, we have customers, and that’s kind of what we talked a little bit about yesterday and we talked before. So our initial customer has been satisfied, that’s the Secretary. But now we have a whole world out there, that’s our secondary customer, and that’s all we’re talking about.

MS. GREENBERG: That’s been the case for 60 years of the Committee.

MR. REYNOLDS: It has. The monographs really give us a way to lump a lot more subjects than we’ve done before, and that’s pretty exciting.

DR. FRANCIS: Would it be okay if we resolved this by sending around a couple of versions of the table of contents?

MR. HOUSTON: Please. We have to get this out.

DR. FRANCIS: In the next week or so, so we can actually have this move into production. Would that be okay?

MR. HOUSTON: Yes.

DR. FRANCIS: Okay. Sallie?

MS. MILAM: I just wanted to raise some discussion. I’m looking at a recommendation on sequestration. And, Mark, I might need you to help me with this.

MS. BERNSTEIN: Leslie, can we stop and recognize the fact that Dr. Overhage has joined us.

DR. FRANCIS: Oh, I’m sorry.

DR. OVERHAGE: I was really here for the next Committee meeting, early.

MS. BERNSTEIN: I know, but you’re welcome to join us.

MS. MILAM: The recommendation on Page 29 says, “The design of the NHIN should ensure that when a healthcare provider accesses health information with one or more categories sequestered, a notation indicates that sensitive health information has been sequestered at the direction of the patient.” I think at the NHIN we took it a step further, I think the consumers told us they didn’t want to have a notation in their record that it was sensitive, and that what we’re having coming back is just some sort of generic phrase that if there’s no information that phrase comes back, if it’s sensitive information that’s been sequestered the same phrase comes back so we don’t point out that there’s somebody with specially protected information.

Is that right, Mark?

DR. OVERHAGE: I think that’s what the NHIN cooperative may have decided.

MS. MILAM: I just wanted to bring that to this group’s attention.

DR. FRANCIS: We know that our recommendations aren’t always the same that others – yes, this was much debated.

MR. REYNOLDS: And, again, our already positioned letters will remain. There may be a follow-up for this Committee to do something further on, but I don’t think we have to –

MR. HOUSTON: Can I suggest? We definitely do need to get this particular thing out the door, unless it becomes even more dated, some of these recommendations are actually getting a little dated in that respect.

DR. FRANCIS: We will send it around in the next week or so.

MR. HOUSTON: I just think we need to by email make some decisions, and then we need to get this done so we can get out in front of it.

MR. REYNOLDS: What I’d like you to do is obviously we appreciate everything you guys have done, is when you send out this revision, in other words, we’re talking about style and usability, when you send it out is there a time box when you expect the responses?

DR. FRANCIS: Yes, absolutely.

MR. REYNOLDS: If you don’t get those and people aren’t prompt with their responses then your move.

DR. FRANCIS: We will nag, we’ll do one nag so everybody really does get an opportunity to make sure that they’ve thought about it, but it will be a short timeframe nag.

Agenda Item: Subcommittee Charge Revisions

DR. FRANCIS: Now we need to talk about the Subcommittee Charge Revisions.

MR. HOUSTON: Which was also distributed for review prior to this meeting. Actually the date at the bottom, November ’96, would be wrong, by the way.

DR. FRANCIS: I have a question about the name of the Committee actually in conjunction with this, which is why confidentiality got left out, because I think it should be the Subcommittee on Privacy, Confidentiality, and Security. That may be silly, but it is a different concept.

MR. HOUSTON: AHIC had all three words in theirs.

DR. FRANCIS: Yes.

MR. HOUSTON: The only reason why I think it got left out was in past committee names there was security and privacy, so we just simply moved security rather than trying to.

DR. FRANCIS: Would people be okay if we called it Privacy, Confidentiality, and Security? Harry?

MR. REYNOLDS: I’d rather you talk to everybody. I’d rather you asked everybody else first. If I speak you may be asking me as a Chair on that. I’d rather not answer as the Chair of the Full Committee; I’d rather be part of this Committee.

MS. MILAM: It doesn’t cause me pause, but isn’t confidentiality a subset of both privacy and security?

DR. SUAREZ: It is in many respects the link between privacy and security.

MS. MILAM: I mean I don’t care.

DR. SUAREZ: I feel comfortable if you choose to include confidentiality. That will be fine by me.

DR. FRANCIS: I think they’re related concepts.

MR. HOUSTON: This is not the latest set of edits for the charge though, because it doesn’t talk about security, and I know we rode security into this. So this is wrong.

DR. FRANCIS: Yes, this is wrong.

MR. HOUSTON: This isn’t what was circulated. And I know that it wasn’t the document I drafted. I don’t know if I have it on my computer or not.

DR. FRANCIS: The one that was sitting over there.

MS. HORLICK: Was it only circulated in the book?

DR. FRANCIS: Can you talk into the mike? I can’t hear you, Gail.

MS. HORLICK: Sorry. Was it only circulated in the book? Because I don’t think I received any draft.

MS. BERNSTEIN: It’s not in the book.

DR. SUAREZ: I don’t think it was in the book.

MS. HORLICK: Okay, I might have gotten it, but I don’t recall seeing the charge at all.

MR. HOUSTON: Actually, it’s funny, because the charge I drafted has confidentiality in the name, by the way.

MS. BERNSTEIN: John, was it you who circulated the charge to everybody?

DR. FRANCIS: John drafted it and sent it to me. We may have a two-headed monster problem here.

MR. HOUSTON: I know it went to Harry also for sure, because Harry asked about it, and I thought that went into it. So maybe it hasn’t been circulated.

MS. BERNSTEIN: Do you know if it went through your office and was circulated? Because I can’t remember, it’s quite possible it’s sitting in my inbox, but I do not recall.

MR. HOUSTON: Then we’re going to need to table this discussion. We all recognize the fact that security is now part of this Committee. I think we do need to get this Charge completed. But I think we need to make sure everybody’s on the same page.

DR. FRANCIS: We will send around a copy of John’s draft. Basically the way we divvied up stuff this summer was that I took the lead on the draft with Debbie and Susan, and John took the lead on the charge. So we were in a little bit of a state of not quite knowing what the right hand and the left hand were doing.

DR. SUAREZ: Would it be helpful to just take a look at that, I mean just do a quick reading of it?

DR. FRANCIS: This is the wrong one.

MR. HOUSTON: Yes.

MS. BERNSTEIN: That is the wrong document.

DR. SUAREZ: But I don’t know if we can project something there.

MR. HOUSTON: It’s completely wrong.

DR. SUAREZ: It looks like you have it on your computer.

MR. HOUSTON: I have it on mine.

DR. FRANCIS: Email it to Maya. There we go.

MR. HOUSTON: Do you want the redlined, or the non-redline one? I’ll give you the redlined one, then you can always accept everything if you want to.

It should be under Privacy, Confidentiality and Security Subcommittee Charge, provisions. I guess I didn’t realize.

DR. FRANCIS: Here we go. It does say, “Privacy, Confidentiality, and Security,” there we go. John’s going to lead the discussion on this one.

MR. HOUSTON: Really all I tried to do was two-fold. One was obviously add the concept of security in the Charge for this group, as well as to pull out what I think were some artifacts of things that no longer are of relevance as part of the charge in particular. If I look at number 3 here, something I pulled out was a statement about the attention to the development of the HHH Health Information Privacy Recommendations to Congress, and I’m not even sure what the heck that is. I tried to make this as timeless as possible, and literally that’s all I did.

I would be more than happy to read it if people would like me to read it, or if they can see it up on the screen.

DR. SUAREZ: Can I ask a couple questions?

MR. HOUSTON: Sure.

DR. SUAREZ: In the intro statement are we bound exclusively by HIPAA, or can we extend that to something related to other?

MR. HOUSTON: We have a specific Congressional mandate, I guess, that requires us to provide oversight with regards to HIPAA. So there is a statutory, I don’t think it’s statutory.

DR. FRANCIS: It’s not limited, it doesn’t say that. Why don’t we change so it’s not all one sentence? Just say, “Identify issues and opportunities for investigation, and make recommendations to the Full Committee.”

MR. HOUSTON: And then assist department.

DR. FRANCIS: And then say, “The Subcommittee will also assist the Department in its administration of.” How’s that?

MR. HOUSTON: That’s fine. I tried to make as few changes and incorporate the concept of security into this charge. I think it’s fairly broad in its coverage. I don’t think we want to get too specific about anything, for fear that it does limit what we would be working on otherwise.

MS. BERNSTEIN: Is there anything else to say on the first paragraph? I’m hearing no dissent?

DR. FRANCIS: Okay.

MR. HOUSTON: I think we’re good.

MS. BERNSTEIN: Is that big enough for everybody to read? I can make it bigger.

MR. HOUSTON: You can make it full screen. I can read through each one of these if need be. Why don’t I do that, in fact?

Number 1, “Identify opportunities and issues in health information privacy, confidentiality, and security, for Committee attention.”

Number 2, “Through public hearings and other means serve as a forum for the public, employers, the health industry, the privacy and security community, standards development organizations, the research community, state and local government and others.”

DR. FRANCIS: It should be “governments.”

MS. BERNSTEIN: Should be “communities” as well.

MR. HOUSTON: I guess I could look at that as being – either of those could be plural or singular, they both work that way. I added “and others” because I don’t want to limit the types of audiences we serve on health information privacy, confidentiality and security matters.

DR. SUAREZ: Isn’t it also federal, not just state and local governments?

MR. HOUSTON: You’re right. You know, federal was never in that original one, that’s right, we should add “federal, state, and local governments.”

I guess it probably shouldn’t be federal, because I think our obligation is to the Secretary and to Congress.

DR. SUAREZ: Yes, but we serve as a forum for other federal.

MS. BERNSTEIN: Sure. We have the VA here all the time, and others.

MR. HOUSTON: Okay. Then we should say “federal, state and local,” okay, good catch.

Number 3, “Based upon public hearings, consultation and analysis, make recommendations to the Full Committee and assist the Department in its administration of the privacy and security provisions of PL104-191,” which is HIPAA.

DR. FRANCIS: We’re not consistent in capitalizing “Committee,” but that’s easy.

MR. HOUSTON: That’s fine, yes.

MS. BERNSTEIN: Do you want to be – do you want it capital or small?

DR. FRANCIS: I think we should capitalize.

MR. HOUSTON: Number 4, “Make recommendations to the Full Committee on strategies, including public information and education efforts, as well as research and development to promote the development and adoption of sound health information privacy, confidentiality in policies and practice, and security policies and practices.”

Number 5. Go ahead.

MS. BERNSTEIN: I don’t have an elevator box anymore.

DR. FRANCIS: You can close full screen and you will.

MS. BERNSTEIN: I’m going to accept all this stuff. Is that all right?

MR. HOUSTON: Yes. In the new version of Word you can do that.

MS. BERNSTEIN: I’m not on full screen, I can do it.

MR. HOUSTON: What were you going to say, Walter?

DR. SUAREZ: I was looking at the number 4, “make recommendations and strategies,” and then there’s information about the content of that, and then highlights public information and education efforts. I was looking for the word “policies.”

MR. HOUSTON: Down at the very bottom.

DR. SUAREZ: I’m trying to see it now.

MR. HOUSTON: Behind there.

DR. SUAREZ: To promote the development, okay, yes.

MR. HOUSTON: Is there a concern?

DR. SUAREZ: No, no.

MR. HOUSTON: Okay.

DR. SUAREZ: I think that looks good.

MR. HOUSTON: Any others? Harry?

MR. REYNOLDS: I’d like to defer to Maya and the two co-chairs. On number 2, the list of entities there, let’s take a look at that and see if there’s any reason you would want to order them in any other way.

MR. HOUSTON: By the way, I put “and others” in number 2 because before it was a set group rather than a sort of examples of the types of groups.

MR. REYNOLDS: I just asked you, I’m not saying it’s right or wrong, I’d just like you to see if we are sending any message either way. I don’t care what your list is, that’s a good list, I don’t care what the order is. I’d just like you guys to look at them.

MR. HOUSTON: Frankly, to me the one group I would probably pull out of there, not that they wouldn’t be part of the “and others,” but would be “employers.” I left it in because it’s always been there. “Employers” almost seems a little out of place as being specifically called out, but I can take it or leave it because again it falls under the “and others” category by what I added.

MS. BERNSTEIN: I was thinking you were going to say SDOs.

MR. HOUSTON: No. We can do that as well.

MS. BERNSTEIN: The main constituency of another subcommittee, is all I was pointing out. Sure, they listen to what we do, too.

MR. HOUSTON: I’d be happy to delete both of those, if people have a thought. Again, this is supposed to be examples of things we serve. So maybe would it be clearer with employers and SDOs being out of there?

DR. FRANCIS: No, I like it. But I think Harry’s question was the order, because sometime order implies importance.

MR. REYNOLDS: That’s all I’m asking, just take a look at it so you guys are comfortable, we’re not –

DR. FRANCIS: Yes, like maybe “governments” ought to be first, or something, the public, governments.

MR. HOUSTON: Yes, you have to put “public” first.

DR. FRANCIS: “Public” first, and then “governments.”

DR. SUAREZ: There are no providers, for example.

MR. HOUSTON: That’s good. Yes, “providers” isn’t there, and I think providers and employers.

DR. SUAREZ: And health plans is the other big one. I mean those are two industries.

DR. FRANCIS: Isn’t that the health industry?

MR. HOUSTON: Health industry. We could put in parentheses (health industry).

MS. BERNSTEIN: If we start doing that we’re going to list every pharmacy, everything.

MR. HOUSTON: Let’s go back to Harry’s comment, which is let’s just reorder it the best that we can.

MS. BERNSTEIN: When you say “the public” do you mean consumers, or did you mean public outside?

DR. SUAREZ: Yes, the word “consumers” is the one that is missing.

MR. HOUSTON: I think public was the word that was used originally. Again, I left it in because it was there. Really the only thing I tried to do with this paragraph originally was to add “and others” to make it more inclusive. We can change “consumers,” but we’re a public advisory, aren’t we a public, isn’t that in our charter? So I think using the word “public” has some, I don’t know if it is a term of art or not.

DR. SUAREZ: Just to bring some consistency perspective from other charges, from other subcommittees, here’s what our Subcommittee on Standards describe as the audience. Exactly the same wording, “serve as a public forum on 4, consumer groups, the health industry, public health, standards development organizations, the research committee, and federal, state and local governments.”

MR. HOUSTON: Do they say federal on theirs?

DR. SUAREZ: Federal, state, and local.

MR. HOUSTON: I don’t know how federal dropped off of that.

DR. SUAREZ: We added it.

MR. HOUSTON: I think with regards to public versus consumer groups, I think consumer groups is actually narrower than public. You might say public consumer groups or advocacy groups, something like that, but we do hear from public, I mean there is an opportunity at the end to hear from them.

MS. BERNSTEIN: The reason I asked is because in government when we talk about “the public” sometimes we mean essentially the private sector. That is those who are not us in the federal government, those outside they’re the public. But it often just means industry, right? So that’s just sort of counterintuitive. So I was asking do you mean the wide ranging everybody who is out there in the public, or do you mean consumers, or do you mean advocacy groups, which are not the same as individual consumers, or do you mean – and do we want to include any of those others?

MR. HOUSTON: We can add consumers and advocacy groups.

DR. SUAREZ: I would suggest replacing the words “the public” with “consumers.”

MR. HOUSTON: But here’s my concern about taking out word “public,” is being we have “public” in the charter of NCVHS, and so I think that is probably the one thing that we need to preserve even if we add others to it. I think we need to keep “public” in here because that is expressly part of our charge.

DR. SUAREZ: Then I would add “consumers” right after “public.” That’s good.

MR. HOUSTON: Let’s do that.

DR. FRANCIS: Add that, and then actually I wouldn’t add it before “governments,” I would add it after “governments.” “Consumers, employers, the health industry,” I would also add “public health.”

DR. SUAREZ: Public health is the other one.

MR. HOUSTON: “Research and public health communities.”

MS. BERNSTEIN: Here’s research.

MR. HOUSTON: I’m sure they both would hate the fact we grouped them together, but I think it’s probably the cleanest way.

DR. FRANCIS: Not a bad idea.

MS. BERNSTEIN: Public health is not a subset of federal, state and local governments? No, okay, that’s fine.

MR. HOUSTON: I would keep them separate.

MS. BERNSTEIN: Right, especially since we’ve mentioned researcher.

MR. HOUSTON: Because we’re talking about legislative issues, we’re not talking about research or public health.

MS. BERNSTEIN: We’ll say “researchers, the public health community.”

MR. REYNOLDS: The other thing we’ll do when we get all these charters in, I’ll make a note, we can normalize them.

MR. HOUSTON: Right. I would have concerns about the standards.

MR. REYNOLDS: We need to normalize it when we do this.

MR. HOUSTON: Why don’t we do that? Why don’t we reserve the rest of number 2 until you’ve done that? Then once we do that we can all sit down and make sure we’re all on the same page.

Let’s move back then to 5, unless people have other questions, we can move to 5, which is “Monitor privacy, confidentiality, and security legislation and the implementation of regulations.”

MS. BERNSTEIN: I was thinking development as opposed to implementation, because it implies we have no role in commenting or whatever at the time.

MR. HOUSTON: You’re right, I would agree with that.

MS. BERNSTEIN: So now it says, “Development and implementation.” Is that okay?

MR. HOUSTON: Fine.

MS. BERNSTEIN: Okay.

MR. HOUSTON: And then 6, “Assist the Chair in the preparation of testimony and reports to the Secretary and Congress.”

DR. FRANCIS: I think that should just say, “Assist the Committee Chair,” so you’re sure which chair.

DR. SUAREZ: There’s one more that I would suggest adding, which is again consistency that we want to make sure exists across all chargers, that is collaborate with the other subcommittees on cross-cutting issues.

MR. HOUSTON: I think that’s a good one.

MS. HORLICK: John, going back to number 5?

MR. HOUSTON: Before we go to that. Real quick, do we want to just in terms of wordsmithing, cross-cutting, though we all know what that means, it’s a little slangish, maybe we even want to use issues of interest.

DR. SUAREZ: Common issues.

MR. HOUSTON: “Common issues.” We all know what cross-cutting is, it’s actually a good word, but I hate slang, and it’s probably more of a slangish thing.

DR. FRANCIS: On “Issues of common interest.”

DR. SUAREZ: That’s good. Then we can change this one, too.

DR. FRANCIS: Gail wanted to go back to 5.

MS. HORLICK: I just wanted to make sure. It says, “Monitor privacy, confidentiality and security legislation, and then development and implementation of regulations.” I want to make sure that we only mean legislation in the first part, and regulations in the second part.

MR. HOUSTON: I took out legislation out of the second part, and maybe I shouldn’t have. Maybe my thought process was when you have legislation you ultimately have regulations that relate to the legislation, but maybe I’m wrong.

DR. SUAREZ: You can actually switch the order and say, “Monitor the development and implementation of privacy, confidentiality, and security legislation and regulation.”

MS. HORLICK: I like that, and I think it’s more comprehensive.

MS. BERNSTEIN: Say again, Walter?

DR. SUAREZ: “Privacy, confidentiality, and security legislation and regulations.”

MR. HOUSTON: That’s probably better.

MS. MILAM: Has the Committee ever asked to give its opinion or aHas theducate others about pending legislation?

MR. HOUSTON: Marjorie would probably know better than I, but I think they’ve testified before the Senate.

DR. FRANCIS: The Committee Chair. That’s the whole point of number 6.

MS. CHAPPER: It was a little more than monitoring.

DR. FRANCIS: Because reports to the Congress, yes.

MR. HOUSTON: Why don’t we say, “Monitor and provide input as requested,” or something like that.

DR. FRANCIS: I think 6 does that.

MS. BERNSTEIN: The whole point of the Committee is to provide input, that’s what we do, we provide input.

MR. HOUSTON: Then let’s say, “Monitor and provide input with regards to the development and implementation of privacy, confidentiality, and security legislation and regulation.” Because what we did yesterday, that one letter that Judith brought forth, we were making comments to, what was that?

MR. REYNOLDS: The Secretary, DEA, e-prescribing.

MS. MILAM: It’s important to call it “education” as opposed to input and other things, as you’re not a lobbyist.

MR. HOUSTON: But we are permitted to give the Secretary, and frankly, we have a statutory obligation to give Congress input. So it’s not a matter of – we’re not lobbying.

MS. BERNSTEIN: That’s more limited though, right? Our statutory obligation to the Congress specifically relates to HIPAA, as I understand it.

MR. HOUSTON: Absolutely. But that would still be privacy, confidentiality and security legislation, because it’s already statutorily provided for. So I would say, “Monitor and provide input as appropriate.” At least with regards to HIPAA we are recognized as providing input specifically to Congress, providing reports, things like that. So that would not be out of – that would be consistent with what we just put there then.

DR. SUAREZ: Of course, now the question is, Who are we providing input? But I think it might be helpful to leave it open, because we don’t have to be specific to the Secretary, Congress, and whomever else.

MR. HOUSTON: If you look at it today as I understand it, our obligation in large measure is to provide recommendations to the Secretary. The ‘but’ to that is, is where you look specifically at HIPAA there is a specific charge to us to do certain things directly to Congress. The point being there is in HIPAA it does say “NCVHS,” so we have a specific charge that we need to carry out.

DR. SUAREZ: So it’s best to leave it open.

MR. HOUSTON: Right.

DR. SUAREZ: Otherwise we’ll have to begin adding other audiences.

MS. BERNSTEIN: Any other comments on that one, number 5?

MR. HOUSTON: I think this is good input. Why don’t we get a revision out to everybody?

MS. BERNSTEIN: What happened to 4? We skipped over it.

MR. HOUSTON: I’m sorry, I thought I read that one. “Make recommendations to the Full Committee on strategies, including public information, education efforts, as well as research and development, to promote the development and adoption of sound health information, privacy, confidentiality, and security policies and practices.” I think we actually read that one and nobody had any comments to it.

MS. BERNSTEIN: Well, I’m having an issue with this development-development thing, because it’s confusing to me.

MR. HOUSTON: We could take out development as part of the first one, as well as research. It is redundant. Take out “and development” out of the first.

MS. BERNSTEIN: Put research up here on this list, “public information, research, and education.”

MR. HOUSTON: Well, public information and education efforts is something different than research. Yes, to promote the development. Leave the “as well as” in, just take out “and development” because we do make recommendations to do research into privacy practices. You’ll look back at these letters we just went over today, there are numerous recommendations regarding research. I think that’s as well as education.

DR. SUAREZ: Then I would just say “including public information, education efforts, and research.” Because what we’re doing is making recommendations on strategies that include public information, education efforts, and research.

MR. HOUSTON: “Public information and education” I think were intended to be lumped together. Now, mind you, that was part of the original charge before I got to it. What is the difference between public information and education? I guess any public information we’re providing has, you could argue, some educational component to it.

DR. SUAREZ: It’s just that education efforts are much more specific in terms of education. Public information might be –

MR. HOUSTON: I guess you could just say “including public information.”

DR. SUAREZ: Public education efforts and research.

MR. HOUSTON: And research, that’s fine. Anything else?

MS. HORLICK: Take out “efforts.”

MR. HOUSTON: There you go.

DR. SUAREZ: There’s an extra space after research.

MR. HOUSTON: Should it be public education as well?

MS. BERNSTEIN: No, because that refers to public schools.

MR. HOUSTON: All right. Any other comments? Going once, going twice? Gone.

Maya, will you redistribute, or Debbie, or who, will you redistribute once we have it cleaned up?

MS. BERNSTEIN: Yes.

MR. HOUSTON: Thank you.

MS. BERNSTEIN: What do you want to do about this paragraph 2? Because that’s the part we’re going to continue to discuss at the committee level?

MR. HOUSTON: Can we note that it’s subject to consolidation with other committees, or subcommittees?

MS. BERNSTEIN: Yes. Debbie or Marjorie’s staff will circulate it. Do you want this circulated to the Full Committee?

MR. HOUSTON: I want it circulated to the Subcommittee, and I want comments back within a week, or two weeks, I don’t know.

MS. BERNSTEIN: Well, we’re here.

MR. HOUSTON: Paul’s gone, and I think we just want to make sure people have an opportunity to do a clean read.

DR. SUAREZ: That’s a good idea.

MR. HOUSTON: Once the Subcommittee says yes, then we can circulate it, but I don’t want to sit on it too long, that way we can get it done.

DR. FRANCIS: Yes, just a week. Going, going, gone.

MR. HOUSTON: Thank you. Now we have one more topic to talk about, then I need to take a little bio break here, which is the idea of what we’re going to do next.

Can we take a two minute break?

DR. FRANCIS: Sure, but only two.

(Off the Record)

DR. FRANCIS: The Committee is now back in order. Actually, several Subcommittee members aren’t here.

MR. HOUSTON: We still need Sallie, and that’s it. Nobody say anything, Jeff’s now in the room. All right.

Agenda Item: Next Steps

DR. FRANCIS: So we should probably just update you a little bit on a couple of things that have happened. First of all, Paul and I have had some conversations about what might be next steps for the Committee.

Secondly, we’ve also had some conversations with Morris Landau, both earlier on and after the presentation yesterday with respect to the update of ONC activities.

There have been several topics that have been identified as ones the Committee might want to look at. Morris is going to be sending us a suggestion from them that as I understand it has to do with de-identified data.

We’ve also looked in some detail at the issues involving PHRs. And Maya has a brilliant book, the table of contents and electronic links were sent out to everyone, so that there was – notice the size of the book –

MS. BERNSTEIN: And the book is not entirely complete, actually.

DR. FRANCIS: And we were attempting to be tree sensitive in that.

John is very interested in the overarching question of accountability.

Just one other little preliminary comment, I would just call attention to the fact if you look at the slide that I think it was Charles put up yesterday, Relationship of Goals and Objectives to the Federal Activities, is summarized in a table in Appendix B, and if you look at Objective 2.1, Privacy and Security, there is a complete lacuna of anybody working on those questions, all the other goals and objectives. Anyway, this is with respect to Goal 2.1, and that’s the Population Health Privacy and Security.

With respect to privacy and security and individuals, the only identified place where work is being done right now is HRQ Health IT Portfolio.

So it looks like there’s a wide, wide west out there.

MR. HOUSTON: To Leslie’s point, more specifically, I’m a big fan of this idea that the Committee as a whole needs to look at data stewardship. And each one of the subcommittees sort of bite off its piece of data stewardship, or look at things it’s doing in the context of data stewardship, because overall in NHIN I think it’s huge.

When Leslie and I spoke yesterday a little bit one of the things we had talked about with Morris had been how do we deal with the issue of de-identification, and that was an area of interest to Morris. I guess my response was after talking is I think we sort of arrived at a common ground on this, which is de-identification, though it is a matter of great interest, people understand the issue, and the issue is that no matter how well we try to de-identify information there is still the possibility that information can be re-identified. If you look at the work of people like Latanya(?) Sweeney and others, they have demonstrated that is in fact the case.

So we all know that de-identification is not an absolute, and people who would like to think that it is, I think that’s disconcerting. I think what we decided upon was that the value of the Subcommittee could be was not to take a lot of testimony on this, but rather to try to summarize in some reasonable fashion all the different uses of de-identified data today. Whether they be appropriate or not, what people are actually wanting to use de-identified data for in the constituent audiences, and then maybe trying to set some standards for when it’s appropriate and when it’s not.

And I’ll give you a great example. I find that there are vendors, IT vendors who will come to you and say we want your de-identified data. My response back to them is always, no, you can’t have it. And they say why? It’s de-identified, why should you care? My response always back is it’s never completely de-identified, in that we always have that concern.

So that might be one constituent group is that IT vendors or commercial vendors shouldn’t have de-identified data. That would be an area I think we could provide some value while not really having to try to do a deep dive and try to drill down to it substantively.

Because I’m also of the opinion that our highest and best use right now really is on a data stewardship side in dealing with what I think is a really pressing issue, which is that really in terms of accountability within NHIN there’s to me nobody has really expressed a model that I think provides the appropriate public trust with regards to oversight of data, of how do we administer the NHIN. I’ll give you an example of that. If we develop NHIN to its fullest we’re literally going to have hundreds of thousands of participants in NHIN. And I don’t believe that anybody has really thought about it. Maybe they have in the real context, but a sustainable model on a national basis for how do we decide who can participate, how do we decide when there is an issue with regards to appropriate access, how is that adjudicated. Nobody’s thought about those things.

If NHIN you have a pool model where I go request records for a patient and those records come from ten locations, if I’m the patient and I say that was not appropriate, how do I feel with the fact that those records have come from ten facilities? How do I deal with adjudicating issues like that, how do I ensure that access is appropriate, and how do I deal with people that inappropriately access data by the NHIN?

I’m looking over at Sue McAndrew thinking I’m sure OCR would love to step to the plate in that regard. We have issues in that. But it has to be answered.

And I think you would agree.

MS. MCANDREW: Right. But why do you think – we are thinking about every day.

MR. HOUSTON: Yes. But when we get the NHIN I think the opportunity for frolic and detour, that’s a legal term by the way, is much greater than it is with our current model.

DR. FRANCIS: So John and I had a quick proposal on this, which maybe that John is going to try to look at what the question of accountability might look like, and who that might be given shape. It’s obviously PROLIX, and there are lots of aspects to it. Indeed, even the question what accountability means, as we were discussing this.

I’m going to await Morris sending the ONC request about de-identified data, and I’ll take the lead in putting things together on that to see. The plan would be to work on that one without hearings.

I don’t know what John is thinking about, but we’ll just open it to comments for a minute.

DR. SUAREZ: I was just trying to take a step back and understand the various topics and areas that the Committee wanted to work. I started doing a list from the comments and ideas and my own list.

So I don’t know. When would it be appropriate to begin to kind of identify?

DR. FRANCIS: Go for it right now.

DR. SUAREZ: Just from the top, there’s data stewardship, which is a big, big issue that has been already identified, along with it accountability.

I think ONC has two tracks. There’s the ONC strategic plan that identified privacy and security as one specific dimension on the two goals. But there’s the ONC soon to be released privacy framework, which is going to be a major statement of the federal government on privacy. My hope is that ONC would be looking at input on putting this together. I know it’s being put together, I know it’s almost done or is close to being done, but it would be helpful to know how and whether there would be an opportunity to provide input, whether before or after.

I think there is NHIN in privacy and security questions still, meaning we’re about to see the first testing of NHIN implementations, or the second or third, whatever. But it’s going to be sort of the public one next week, and then in December will be the bigger one. What is the privacy and security approach that is being finally decided to be used? Perhaps hearing in more detail about that, this particular Subcommittee receiving information from NHIN, the appropriate people within NHIN about the actual approach being done. So that’s another topic I’ve been looking at.

There is a big topic I have in special interests is public health and privacy. This is one of the projects that Public Health Data Standards Consortium is doing, we are doing a major study on what are the current critical topics and issues that public health privacy officers are dealing with.

DR. FRANCIS: That’s why the de-identified data actually interests me.

DR. SUAREZ: Absolutely. De-identified data is one of the 15 top topics that I have. I mean there are those, and then you mention PHR as one other topic.

DR. FRANCIS: If you look at the little chart of the three ways of NHIN, you have the systems, you have then the PHRs. So we were thinking of picking up on that, and then you have the RHIOs and so on.

I want to make sure Mark gets a chance. Mark, can you please introduce yourself?

DR. MARK HORNBROOK: I’m Mark Hornbrook from Kaiser Permanente, a member of the Committee, and crashing your meeting this morning.

MR. HOUSTON: You just became part of the Committee.

DR. FRANCIS: I do need to warn people we have about 7-8 minutes.

DR. MARK HORNBROOK: I just wanted to recognize some things in my world as anecdotal evidence for you. First, our Oregon Public Health Department can come into Kaiser at any time and get identified data for public health purposes. I assume all of you assume that that’s the power that public health agencies have. When they’re doing an outbreak investigation they get names, addresses, relatives, everything, and we try to cooperate as much as possible. Although we tell them they have to go through the Regional Administrative Office, not through Research.

Now, the second thing I want to tell you about is we’ve done at the research center three tests of empirical programs that ostensibly tell us a de-identified data, you know, one is I-2 B-2, one is spin, one is another program I’ve forgotten. And we found that every single one of them from our perspective as a HIPAA entity are totally unsatisfactory. Because all it takes is one failure even in a million records for you to be at business risk. It’s unacceptable for our business officers.

At the same time there is an area, a very gray area, where we have de-identified data going out for clinical trials where people have signed consent forms and there’s a risk of attribute identification, but the health plan is willing to take a business risk because the public interest of getting that clinical trial data out and maintaining the validity of the original sample so that it doesn’t harm the usefulness of the science for every other person who signed the consent form in true basic public spirit. Because the worst thing you can do is to harm a study to the point where it’s junk and nobody’s benefit.

MR. HOUSTON: But I don’t think anybody – let me say this –

DR. MARK HORNBROOK: Does anybody say anything about this?

MR. HOUSTON: Hold on. I don’t think people, I don’t think we’re saying that the use of de-identified data is always inappropriate. I think the point we’re trying to make is that there are absolutely bona fide uses of de-identified data by particular audiences who are trustworthy. I think they recognize the fact, and if you look at data use agreements which deal with the limited dataset, even if you extend that to de-identified data you have people in groups you can trust and they say they’re going to use it for appropriate purposes, they’re going to safeguard it appropriately, and they’re not going to try to re-identify it.

The problem is I think what we’re finding is that there are numerous groups out there that we have no controls over. And I use the example the software IT vendor who says I want all your data. I’ve seen it in probably two dozen contracts where an IT vendor is trying to get customer data. I always strike it out. I’d be amazed how many customers don’t do that though, and that’s part of the issue.

DR. MARK HORNBROOK: The other issue is leakage into graduate student theses, and migration into the graduate student’s next job.

DR. FRANCIS: Sure. And there are also issues about – there is the kind of radical because we can’t guarantee – because there is all this linkage nobody should ever be able to use de-identified data. We’re not coming from that. What we’re coming from – yes, I thought that was your worry. No, no, no, we’re coming from the question about how do we think these through so that we preserve the benefits.

This is part of what John and I have been talking about is whether this is a hot area for the Committee or whether we ought to be going somewhere else.

MR. HOUSTON: Yes. Go ahead, Harry.

MR. REYNOLDS: We do have five minutes. We’re having the planning session for the Executive Subcommittee, and I would assume this committee will probably have to have some kind of a phone call prior to that.

DR. FRANCIS: Yes, we’ll have a conference call.

MR. REYNOLDS: Because we were looking for kind of a chart on things you were interested in, some kind of a focus on what you were planning to do out of this committee. And I think the discussion is great, but I think we need to get to something pragmatic and bring this whole thing together.

MR. HOUSTON: I think what we need to do is look at there will be an endless list of things we can review and look at. What we have to do is what is our highest and best use and try to look at things that are not tactical but rather strategic, and ones that are timely.

So I think we need to be very judicious in what we decide to bite off, for fear that we either bite off something that’s too big, it’s going to take too long to do, or simply doesn’t have the importance overall.

That’s why under the data stewardship heading I think there’s a lot of things that are intriguing to me.

MR. REYNOLDS: One thing I would have added to that chart that was put out yesterday, under data stewardship especially under privacy and security, is the sensitive data. It was not listed as one of the subjects. Remember that was a key subject we had in one of our letters. It is something that’s going a thousand miles an hour by everybody that’s doing it.

DR. FRANCIS: And it was fascinating to see it’s actually doable in the health trio model, or at least there’s a –

MR. REYNOLDS: Well, the point is everybody’s going to pick a way to do it. We stop short because we agreed to stop short. All we’re saying is I don’t see anybody else picking up that particular mantel.

MS. BERNSTEIN: Can I just say at our last meeting we had a similar kind of discussion about the variety of topics we might cover, I realized before the supper many things had changed, but at that time this subcommittee was interested into looking into PHRs and seeing where we are with that. You can change direction at any time you want to do that, but we should at least tag that that was something and talk about that.

DR. FRANCIS: And we have first rate set. What John and I will do because we have now no time is we will send you around this list, and something more like an analytic framework of what it might look like, including Morris’s whatever he’s going to ask us about de-identified, he was going to send that. Whatever we learn from NHIN and the ONC privacy framework, we don’t have a clue what that’s going to look like and whether that’s anything that – perhaps some of these topics might actually fit into comments on that, including PHRs and so on. We’ll have a conference call sometime in about two to three weeks.

MS. BERNSTEIN: Can I just make one request? If you get requests for things to do from ONC, would you please share them with me? Because the staff has so far neglected to do so, which is a little frustrating, because I didn’t know about this until you mentioned it today.

DR. SUAREZ: Which part did you not know?

MS. BERNSTEIN: That Morris had requested us to do work on de-identification.

DR. FRANCIS: No. He hasn’t actually, they’re planning to send us a request, I should clarify.

MS. BERNSTEIN: I’m just saying I have no knowledge.

DR. SUAREZ: Can I suggest? I think we need a list, because I think also Committee members have my list of topics that I thought it would be good to bring up, but I haven’t done that yet except a quick short review. I haven’t talked about security yet, and I haven’t talked about standards, technical standards for privacy and security.

MR. HOUSTON: Hold it, I’m going to say one thing, and again I’m going to reiterate, I could have a list a mile long. I’m going to implore you we need to look at where our highest and best use is. When you talk about technical security standards, I get concerned when I hear about that. I’m a security guy myself. Because this Committee has to be very careful what it picks and chooses to try to do and what to get out in front of, and the amount of effort it’s going to take to get there so that we can be most meaningful.

There are a lot of topics that are timely that are high level that haven’t been picked off, and I just think as we’re putting these things together we need to prioritize in terms of strategic importance and timeliness which ones we want to pick off.

DR. SUAREZ: I am absolutely in agreement. All I’m saying is throwing a kind of list, and it is not an endless list, I mean I only have like twelve topics.

MS. BERNSTEIN: I think we should welcome that, we should look at the whole panoply of possibilities and then discuss the –

DR. FRANCIS: Absolutely. Anybody has a list send it to John and me, or just send it to all of us. We have a circulation list for the Committee.

MS. BERNSTEIN: Yes. You can respond to any of those messages on the PHRs, and we’ll have the full list for the subcommittee and the staff.

MR. HOUSTON: I’m being told we’re done now.

DR. FRANCIS: The meeting is now adjourned.

MR. HOUSTON: Thank you very much.

(Whereupon, the Subcommittee adjourned)