Minutes of the March 30-31, 2005 Subcommittee on Privacy and Confidentiality Hearing

Department of Health and Human Services

NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS

Subcommittee on Privacy and Confidentiality

March 30 – 31, 2005

Millennium Knickerbocker Hotel
Chicago, IL

Meeting Minutes

---

The National Committee on Vital and Health Statistics Subcommittee on Privacy and Confidentiality was convened on March 30 – 31, 2005 at the Millennium Knickerbocker Hotel in Chicago, Illinois. The meeting was open to the public.

Present:

Committee members

• Mark A. Rothstein, J.D., Chair
• Simon P. Cohn, M.D.
• Richard K. Harding, M.D.
• John P. Houston, J.D.
• Paul Tang, M.D. (present on 3/31/05 only)

Absent

• Harry Reynolds

Staff and Liaisons

• Maya Bernstein, Lead Staff
• Beverly Dozier-Peeples, J.D., CDC
• Marjorie S. Greenberg, NCHS/CDC
• Susan McAndrew, OS/OCR
• Helga Rippen, M.D., Ph.D., ASPE/OS
• Antonia Spidero, Ph.D., CDC
• Marietta Squire, NCHS/CDC
• Michelle Williamson, NCHS

Others

• Laurie Badzek, ANA
• Darryl A. Beehler, American Osteopathic Association
• Mickey Bonk, Children’s Memorial Hospital
• Donna A. Boswell, AHA
• Joseph Conn, Modern Physician Magazine
• Prudence Gourguechon, M.D.
• Mary R. Grealy, Healthcare Leadership Council
• Patricia Hale, American College of Physicians
• Ronald E. Inge, ADA
• Brian F. Keaton, American College of Emergency Physicians
• Stuart Kersky, Walgreens
• Donna Maassen, American Health Care Association
• Timothy McNichol, American Osteopathic Association
• Pamela J. Miller, American Optometric Association
• Russ Newman, American Psychological Association
• Frank J. Pokorny II, ADA
• James C. Pyles, American Psychoanalytic Association
• Kenneth L. Riddle, National Community Pharmacists Association
• Patrick Simco, American Osteopathic Association
• Michael J. Simko, National Association of Chain Drug Stores
• J. Craig Strafford, ACOG
• Karen Stavenjord, APTA
• Michael Swiko, Pharmacy Health Information Technologies
• Kristin L. Welsh, AHA
• Susan Winckler, American Pharmacists Association

---

EXECUTIVE SUMMARY

ACTIONS No formal actions

All official NCVHS documents are posted on the NCVHS website.

Synopsis of Subcommittee Hearings by Mr. Rothstein The March 30 – 31, 2005 hearings, the second in a series on national health information technology, focused on testimony from health care providers. The first hearings (February 23 – 24, 2005, Washington, D.C.) heard from experts on privacy and confidentiality and representatives of consumer organizations. The third hearings (June 7 – 8, 2005) will hear from health systems, health plans, and health entities that have experience with EHR systems. A fourth hearing will direct attention to technical expertise and research. Details about future hearings are published in the Federal Register and on the NCVHS website.

PANEL I MENTAL HEALTH PROVIDERS

(NOTE: see transcript for all panel presentation background materials)

AMERICAN PSYCHOLOGICAL ASSOCIATON RUSS NEWMAN, Ph.D., JD

Mental health interests in privacy and confidentiality were described as unique and in accordance with the Supreme Court case of Jaffee vs. Redmond. The APA urges the preservation of mental health professional role in disclosure management to preserve the trusting provider-client relationship. The APA supports the ability of patients to access their health information, but is also aware of unintended adverse consequences if mental health professionals do not help patients to process sensitive material. The APA recommends that HIPAA provides increased protection of psychological test materials within the NHIN, as it does for psychotherapy notes. The need to better integrate mental and behavioral health into the overall health care system was noted. Protections must be established to address potential stigma and misinterpretation of materials. Therefore, the APA recommends that the NHIN adhere to the higher standards of privacy and confidentiality maintained by the mental health system. Historical tension between insurers and mental health professionals was noted as well as were their differences about “minimum necessary” for effective task completion. Recommendations are for the NHIN to exclude or place specific limitations on access to psychotherapy notes, psychological test materials, and raw data; recognize and maintain the role that licensed mental health professionals play in determining appropriate access to mental health records by insurers, patients, and others; and promote the integration of physical and mental health information in a cautious manner that preserves confidentiality of mental health records (by, for example, creating a two-tiered system with more limited access to mental health records).

AMERICAN PSYCHOANALYTIC ASSOCIATION JAMES C. PYLES, LLB

Questions about the NHIN include:

• Should individuals’ identifiable health information be included in an EHR system without notice or consent, or over objections; or should an electronic system be based on traditional principles of medical ethics that recognize some control of individuals in non-emergency situations?
• Can security of identifiable health information in an electronic system be assured?
• Are there adequate rights and remedies for individuals whose medical privacy has been compromised?
• Is there a clear evidence-based conclusion that electronic health information systems improve quality, achieve savings, and improve efficiency?
• Is there an accepted standard of reliability and care for EHR systems?

Recommendations: (see transcript for further elaboration)

1. NHIN should be ethics-based with no identifiable health information without individual consent (top priority).
2. No NHIN should be implemented until information security is assured.
3. Patients and individuals should be able to address violations of medical rights, including a private right of action for damages, corrective action, and injunctive relief.
4. No NHIN should be implemented without clear evidence-based reasons to believe that such systems improve quality, achieve savings, and increase efficiency.
5. No NHIN should be implemented without a nationally recognized standard of reliability and care.

AMERICAN PSYCHIATRIC ASSOCIATION

Highlights from written testimony The APA believes that the NHIN has the potential to decrease treatment errors, improve communication between health professionals, and assist psychiatrists with evidence-enhanced guidelines. An APA core value supports the Surgeon General’s report and the Jaffee versus Redmond Supreme Court decision that privacy is an essential requisite for effective mental health care (see transcript for further elaboration). The NHIN should be a decentralized system with voluntary participation that maintains records at the local level. Patient information must be exchanged over a secure system that strictly enforces rules for certified members. Patients should have recourse if medical privacy and security are violated in this country or offshore. The APA wants to ensure no downstream release of information to marketers. An estimated 60 percent of practices are small (i.e., 10 or fewer physician); and 35 percent are in offices with three or fewer physicians. The high cost of HIT is a barrier for small doctor groups, estimated at more than $30,000 per doctor (source: American College of Physicians).

Discussion Topics included what constitutes sensitive health care record information; better integration of mental and behavioral health; what should be maintained in the general record and the need for a voluntary NHIN. Statistics were cited about patient reluctance to seek treatment due to fear of disclosure. Different points of view were presented about an “ethics-based” approach to EHRs. Great Britain’s black box concept was raised as a way to enhance EMR patient privacy (except for emergencies). While state mental health laws require authorization, many state laws offer higher protection for health information than what is available through HIPAA. Physicians are concerned about medical liability when information is withheld. Could a separate system be developed for emergency situations? Concern was expressed about the fact that more access is currently given to payers than providers.

PANEL II OTHER PROVIDERS

AMERICAN PHYSICAL THERAPY ASSOCIATION ELLEN “MICKEY” BONK, PT, MBA

HIPAA Compliance and Complexities APTA provides HIPAA compliance seminars, training modules, and website information. The complexities of implementing HIPAA policies were described within a specific organization, noting the need for changes in administrative processes and physical layout. Due to the nature of physical therapy work, disclosure of protected health information to other parties is significant, especially within a legal context (see transcript for examples). Because physical therapists are often in a position to discover evidence of physical abuse, they must understand disclosure obligations in such cases.

Confidentiality and Privacy Concerns Movement toward a national database brings confidentiality and privacy concerns. APTA has co-developed a point-of-care EHR software called APTA Connect, which allows health professionals to share critical and sensitive information that is protected by passwords and other security measures. Mental health information can only be entered for emergency purposes. APTA Connect enables facilities to gather valuable patient outcomes information that can improve future patient care.

AMERICAN DENTAL ASSOCIATION RONALD E. INGE, DDS

The ADA’s Division of Dental Practice has distributed nearly 70,000 comprehensive kits that help dentists assess and comply with HIPAA regulations. The organization also regularly offers HIPAA seminars. Previously handling of privacy, confidentiality, and security issues by dentists was described. Dentistry is moving toward the electronic arena more slowly than general medicine, with the average electronic submission of dental claims at about 30 percent. The need to “catch up” technologically presents an even bigger challenge than confidentiality. In a 1994 survey, 67 percent of dentists had computers in their office. In 2000, usage rose to 85 percent, with 51 percent using EHRs and 40 percent using computers for monitoring and diagnostic purposes.

AMERICAN OPTOMETRIC ASSOCIATION PAMELA J. MILLER, OD, FAAO, JD

HIT Challenges and Privacy Concerns Noting the high cost and lack of financial return on the investment, the difficulty of solo practitioners and small practices have keeping up with technology was described. Areas of concern include: 1) implementation and training demands; and staff resistance; 2) “hard and soft” costs, including hardware, software, training, upgrading, maintenance, and staffing; 3) loss of privacy and increasing potential for inadvertent or even intentional dissemination. Threats include access to EHRs by employers, insurers, or others; fraudulent information selling; wireless technology interception; and hackers. Accountability is paramount. Three positive benefits to EHR implementation are: 1) improved levels of service and communication between providers and patients, resulting in improved treatment at a cost savings; and more rapid diagnostic and treatment alternatives; 2) improved consulting services between providers; and 3) improved documentation; quicker and correct billing and coding; and faster reimbursement. Three EHR privacy and security recommendations include: 1) development of HIPAA-compatible rules; 2) development of new laws, as needed, to safeguard EHRs and the NHIN; 3) development of laws with harsh penalties for those not approved to access EHRs who intentionally and fraudulently breach security.

Discussion The level of sensitivity of dental, optometry, and physical therapy records was discussed, as was the increasing recognition of the need to integrate medical and dental information into overall treatment. Within the field of optometry, there is no widespread implementation of new technologies. When a provider lays the groundwork for a referral, a patient rarely refuses the recommendation. Accessing information from other providers is more problematic due to privacy issues. The complexity of layered security for mental health records was stressed, noting the difficultly of deciphering distinctions and of following a complex audit trail and tracking system. Concerns were expressed about how providers secure confidential material from third-party carrier audits. Questions were raised about electronic terrorism. EHRs were seen as more vulnerable to unauthorized disclosures and less secure than paper records by some but not by others. Due to the potential of mass exposure, layers of security and staff training are recommended.

PANEL III INSTITUTIONAL PROVIDERS

AMERICAN HOSPITAL ASSOCIATION DONNA A. BOSWELL, Ph.D., JD

Complexities of HIPAA HIPAA is costly, complex, and disruptive to change policies and procedures that affect day-to-day activities of caregivers and administrative personnel (see transcript for example). Potential liability and risk to reputation from criminal prosecution and the possible loss of federal program participation mean that health decisions can no longer be subjective judgments about the best interests of the patient or the health care system. Decisions must be based upon compliance required to minimize risk and to establish compliance with the law. It is necessary to focus attention on systemic and systematic procedures for privacy rights and confidentiality to provide a foundation to the NHIN. On a day-to-day basis, preemption analysis is not useful for facilities and physicians trying to comply with the law. A system of laws to govern modern health care (with its hospitals, specialists, labs, pharmacies, and payers requiring communication and commerce across state lines) cannot be derived from a one-to-one relationship. A single predictable set of standards applied across states with a reasonable expectation of privacy should be the basis of the NHIN.

Major privacy concerns include 1) preemption: a uniform trustworthy national standard for safeguarding the confidentiality of health information must be developed; 2) accounting of disclosures: the requirement that providers and payers provide patients with an accounting that of the legal basis for third party disclosures must be lifted; and 3) liability: an individual provider cannot be held at risk under applicable state and federal laws for actions taken by those responsible for operating the regional or national infrastructure.

HEALTHCARE LEADERSHIP COUNCIL MARY R. GREALY, JD

HIPAA Impediments (see transcript for further information)

• Preemption of state law The NHIN will not be viable without a federal preemption that eliminates state variation in privacy standards.
• Accounting of disclosures of protected health information. A requirement mandating tracking of disclosures to public health and state entities imposes undue administrative costs and erects barriers to quality health care without significantly enhancing privacy protections.
• Minimum necessary HIPAA privacy rules minimum necessary standard may be unworkable within the NHIN because it creates legal uncertainties that restrict appropriate information sharing. HLC recommends eliminating the standard or creating safe harbors for health information transmission through a national or regional network.
• Research HLC believes that the translation of research into practice will be difficult to achieve under HIPAA, due to restricted access to health information for legitimate and necessary health research. The privacy rule should be modified.
• Patient Consent and Control For the NHIN to be used as part of care delivery, patients cannot selectively withhold information that may be relevant to treatment. Providers are concerned about liability resulting from reliance on incomplete information. Patients must have confidence in the protection of their information and providers must have confidence in the data provided.

AMERICAN HEALTH CARE ASSOCIATION DONNA MAASSEN

Although long-term care facilities still primarily use a paper-based process, providers are looking at the EHR as a short-term goal. Nursing homes and assisted living facilities use technology to create billings; generate patient assessments and progress; look at care planning; document staff activities, record the administration of medication, and generate electronic physician orders. AHC and NCAL urge ONCHIT to include the electronic needs of long-term care providers. The significant costs of long-term care contribute to the slow advancement of technology. The benefits of inclusion for long-term care in theCertification Commission for Health Care Information Technology initiative were mentioned. CMS must develop programs that allow providers to engage in these initiatives. Government subsidies are recommended for start-up expenses such as equipment and training, as are tax incentives for providers who purchase hardware and software and invest time and resources in EHR connectivity.

Concerns about Health Security, Privacy, and Confidentiality include: 1) data sets, including the minimum necessary, must be defined; 2) preemption: the system must discriminate between a legal guardian and a responsible party; and must prevent inadvertent and inappropriate disclosures; and 3) the security rule must be delineated.

Discussion The need for public education, a patient’s right to withhold information, and security and treatment concerns were discussed. For physicians, the question is not “can privacy be protected,” but rather “can a person who is unwilling to trust a physician obtain state-of-the-art care?” An example of “legitimate” withholding of medical information was given. Several agreed that the larger issue revolves about the need for uniform standards that define what goes into a shared health information system. The definition of “minimum necessary” and the need to streamline electronic exchange was raised. Disclosures were further discussed, to include whether public health mandated disclosures should be accounted for (note: accounting of disclosures is a topic of the fall 2005 hearings). Regulations must ensure encryption as a requirement for information exchange. Longitudinal use of information, which depends on the system users, was raised. It was suggested that the HIPAA provision that governs information access should be turned into a work rule. There was advocacy for physician access to hospital episode-of-care information rather than for downloading information to physician files.

STATEMENTS FROM THE PUBLIC

Dr. Gourguechon is a longstanding practicing psychiatrist who does not believe that record availability is important enough to compromise citizen rights to privacy. Her recommendation is for large organizations to develop electronic systems but she advocated against a national system (see transcript for further information).

Discussion Dr. Gourguechon retracted the absoluteness of her statement that records be kept confidential and private in public health emergencies. She believes that the only way to protect patients is to give them a choice about information privacy. Other providers support an EHR environment. As an emergency physician, Dr. Cohn refuted Dr. Gourguechon’s premise that past records are not useful in the emergency room.

SUBCOMMITTEE DISCUSSION

Future Hearings

(Note refinement of future hearings in Subcommittee Lunch Discussion of 3-31-05 below)

The need for evidence-based research about longitudinal health records was raised relative to benefits and risks of linking epidemiologic data with claims data, and of linking survey data with claims data and tax records. Relevant to population health, such research would also inform the Subcommittee on Standards and Security, the Executive Subcommittee, and the national Committee. An IOM study was also suggested. A review of results of NHII grantees (perhaps patient safety grants or grants from AHRQ) was suggested. Dr. Rippen and Ms. Dozier-Peeples will find out whether RFI participants will answer questions from the Subcommittee. A focus on innovative approaches from the RFI information was suggested.

PANEL IV PHARMACY SERVICES

NATIONAL ASSOCIATION OF CHAIN DRUG STORES MICHAEL J. SIMKO, R.Ph.

Challenges to an interoperable system include authentication and level of information sharing. Indicators must allow patients to authorize movement of personal health data between entities. Standards development will allow patients to choose what information to share. Patient use of multiple pharmacies or payment by cash to avoid incorporating sensitive medical information into their overall file was described. Patients at Walgreens can limit their profile to a single store. Recent adoption of NCPDP standards for medication history and compliance messaging from pharmacy to physician is creating new opportunities and challenges for security and HIPAA compliance. Pharmacies must address multiple types of data sets (see transcript for further information). Adoption of a national patient and prescriber identifier system (NPI) should not be required until May 2007 and then, only with adequate industry experience. A Master Patient Index may be needed. Challenges include information management from multiple sources and HIPAA compliance; and proper application and ability to provide information to other health care entities without violating HIPAA or the patient’s wishes. Pharmacies must address the Coordination of Benefits (COB) and Single Point of Contact (SPOC) efforts through CMS. A large national database of patient information is not recommended. Each provider entity should maintain their information and interoperability with accompanying provider agreements that include patient intentions.

AMERICAN PHARMACISTS ASSOCIATION SUSAN WINCKLER, R.Ph., J.D.

Focus Access, contribution, and integration are the key elements that pharmacists look for in their ability to protect and access information. Pharmacists must be aware that patients sometimes request limited access when securing controlled substances from different pharmacies because they do not want to get caught in diversion activities. The minimum necessary approach and HIPAA implementation do not resolve issues of payer access. Pharmacists can contribute valuable information to health records about why a patient has discontinued a medication. Information integration between systems is needed as is assurance that the overall system meets the needs of different practice environments. An integrated electronic system offers an opportunity to communicate additional information and provide additional support to patient care (see transcript for example).

Discussion

Pharmacist Role Pharmacists assume the role of medication expert because physicians don’t have time to assume all roles within a treatment team. Patient permission for information sharing, their ability to opt into programs monitored by pharmacists, and medication therapy management were discussed.

About Marketing APhA has created guidelines that state that marketing must be distinguished from patient care and that financial considerations must be disclosed. Information access for pharmacists is for their role as direct care providers rather than for marketing purposes (further information about these role distinctions will be provided to the Subcommittee). Association policy is based on three points of disclosure: distinguishing material as marketing; ensuring that no information is shared with anyone outside of the treatment system; and complying with HIPAA. At Walgreens, no therapeutic interchange marketing is done at any point in care. Marketing is intended to educate the patient about other cost effective products to discuss with the physician.

Disclosure and Minimum Necessary While concern about unauthorized sharing of personal health information is growing, disclosure requests must be assessed in order for pharmacists to protect against diversion or pharmacy practice concerns. Pharmacy tracking systems were discussed as was the need to communicate with the patient as some information found in pharmacy records is not found in PBM records. The distinction between a clinical pharmacist and one in a dispensing role was raised as were financial incentives for the use of new brand drugs. Minimum necessary is not as clearly established in the pharmacy environment, especially relative to NCPDP standards. Walgreens’ policy is shared information unless the patient opts out. The feasibility of special rules for different prescription medications was questioned.

NATIONAL COMMUNITY PHARMACISTS ASSOCIATION KENNETH L. RIDDLE, Pharm.D.

Benefits of EHRs include: pharmacists’ ability to review comprehensive patient profiles and prevent negative drug/drug or drug/food interactions; management of disease states and medication therapy regimens; identification of reduction of prescription fraud and illicit drug use; and prevention of duplicate therapy and non-compliance.

Concerns about EHRs include issues of privacy, confidentiality, security, accessibility, discrimination and prejudice, operational procedures, cost, and reimbursement. PBMs (Pharmacy Benefit Managers) commonly pull de-identified information for resale, which some pharmacies have no knowledge of and others have no control (see transcript for further information). Other questions include: how will measures used to prevent inappropriate entities from accessing EHRs allow patients and their caregivers to access their EHRs without impeding a firewall? How will health care providers be given access to EHRs? Will providers be charged for this access? Relative to standard operational procedures, what data fields will be required for inclusion in the EHR and how will record duplication be prevented and addressed? Who is liable for record transmissions that are intercepted or hacked into? What is the anticipated timeframe to submit and receive EHRs claims and how will they be transmitted?

DISCUSSION (cont.) Trends about consumer views were mentioned. Presenters addressed the question of what happens when a pharmacist opts out of serving a patient. The need for common patient identifiers was put forth. Dr. Winckler and Mr. Simko were invited to meet with the Quality Workgroup. The APhA and Walgreens are interested in having pharmacists elaborate on medication use. It is a natural evolution for pharmacists to access health information, dialogue with physicians, and make recommendations or referrals within an interoperable network. The NCPDP has recently approved standardization of how pharmacies send compliance information and fill history. In the near future, various network aggregators will handle bi-directional messaging that informs physicians of patient compliance. Pharmacists will update the medical record to let physicians know if and when medication was received.

PANEL V PRIMARY CARE PROVIDERS

AMERICAN NURSES ASSOCIATION LAURIE BADZEK, R.N., M.S., J.D.

Concerns and Questions Nurses want to know the specified purpose of developing a national network, how the system will be supported, and how it will support patient care. Will the cost be passed on to patients? Will the cost impact health care settings, in that fewer resources are available for direct care? How will the network cross state boundaries, relative to differing licensure requirements? How will nurses be impacted by breaches, failures, or deficits within the network? Accuracy of data is another concern. How will the system allow nurses to show that what they do is evidence-based? Who owns the record and who is its keeper? How do patients access their information and how do nurses allow them to access it? Will patients who do not want to participate be penalized? How will settings with few technological resources participate? Relative to confidentiality, the biggest concern from nurses has to do with password problems. Who controls the passwords in a national system? What happens to information on old hard drives? Will there be a federal level of accountability? Will the system require more energy that it gives back?

AMERICAN OSTEOPATHIC ASSOCIATION DARRYL A. BEEHLER, D.O.

On Health Information Technology The AOA has been involved in development of the NHIN and with the Physicians’ Electronic Health Record Coalition (PEHRC), which supports the use of affordable standards-based EHRs. The AOA has also developed a technical advisory committee (TAC) to advise the association’s strategic use of advanced information system technology. In July 2004, the AOA issued guiding principles on e-prescribing that also apply to the NHIN concerning safety, privacy, transparency, design, integration, scalability, and timing (see transcript for details). The AOA supports efforts to ensure that all patient populations, especially in rural and underserved communities, benefit from this effort.

Recommendations That the Subcommittee explore the following with respect to patient control of data; patient interactions with the health care system and physicians; and the security of patient data: authentication and encryption measures that ensure a secure network; assurance that patients have the most current information available; and clarification about increased risk of misinterpreting data. Although a valuable tool, the NHIN must not create undue external influence over clinical decision-making processes.

AMERICAN COLLEGE OF PHYSICIANS PATRICIA HALE, Ph.D., M.D., F.A.C.P.

The American College of Physicians (ACP) is very interested in the NHIN and the use of EHRs. While the benefits outweigh the risks, the challenge of HIT is to lower the risk and increase benefits to optimize patient care. In January 2005, ACP submitted a comment letter to ONCHIT about the RFI on the NHIN. ACP also participates in a collaborative on this topic.

Recommendations include the suggestions in each of the following categories: foster a trusting environment; patient control of information; physician role in managing patient information; authorized access to information; new models for data integration from disparate sources; consideration of a unique patient identifier (see transcript for further information).

Discussion The cost of implementing EHRs into small or medium-sized ambulatory care medical practices was discussed. ACP believes that reimbursement should be tied to quality of patient care rather than to time or procedures. Physicians should decide record content to ensure accurate patient care. The perceived gap between patient and physician views is not insurmountable if providers have the time to talk with their patients about the risks and benefits of information sharing and spend more time in patient care. Additional reimbursement is needed.

The need for clinician and patient education was again stressed. A big concern is where information goes outside of the physician-patient relationship. Within the NHIN, what is the potential for patients to be selected out of health plans? Decisions about information use for research or public health purposes should be transparently made by the patient and provider. Some thought that privacy rules should require more consent and authorization. Identification issues were raised. Concern was expressed about EHRs becoming huge data storage silos and about decreased communication between professionals.

Perceived benefits of the NHIN include: the ability to rapidly pull up information about the most effective treatment methods, (which supports an evidence-based practice approach); the ability of patients to carry pertinent data with them; the establishment of standards and common language within a reproducible, reliable system; and more efficient development of best practices. On the risk side, it was noted that EHRs carry the potential for tremendous conflicts, hidden agendas, and motivations.

SUBCOMMITTEE WORKING LUNCH DISCUSSION

June 7 – 8, 2005 Hearing Witnesses will include:

1. health systems with EHR systems experience (VA, Department of Defense, perhaps representatives of large clinics such as the Mayo or Cleveland Clinics; perhaps some international witnesses from countries that use integrated health networks [e.g., U.K., Australia, Sweden], although a lack of international budget was noted.
2. Health plans and PBMs (BlueCross BlueShield; Humana, among others).

A summary of the June meeting and a separate summary of identified participants will be ready for distribution by April 11, 2005, prior to a one-hour conference call in April to determine meeting specifics. A fourth hearing will gather testimony from IT experts and address research issues. A query list will be developed in advance of this hearing, to be held for two days in July or August 2005 (possibly to coincide with the August 2005 Executive Subcommittee Meeting).

The role of employers and others in EHR systems was discussed. A recommendation was made to review testimony from a January 2005 hearing of employers, the Work Place Rights Institute, the Society of Human Resource Management, employer help clinics, and other witnesses. What filters should be applied? A suggestion was made for the Subcommittee to be more concrete about criteria for minimum necessary in the interface between patient and employer. The ability of CMS, governmental agencies with broad access rights, law enforcement agencies, and country health officials to tap into patient records without the knowledge of providers or administrators was also raised.

PANEL VI SPECIALISTS

AMERICAN COLLEGE OF EMERGENCY PHYSICIANS BRIAN F. KEATON, M.D.

ACEP is concerned that certain unintended consequences of privacy measures for delivery of care by physicians. HIPAA has worked well because of the emergency situation exceptions.

ACEP’s Privacy and Confidentiality Principles: (see transcript for specifics)

1. Optimal management of emergency cases requires rapid access to patient data.
2. The assumption must be made that a patient who is unable to give permission for data access would have done so had they been able to.
3. Optimal management of emergency cases requires access to complete patient data.
4. Emergency physicians must be notified when a patient refuses permission to provide access to some or all of their data.
5. Public health needs, including syndromic surveillance, require reliable access to population-based data. Access to this data must be assured.
6. Some patients will refuse permission to access their data because they plan to injure themselves or others. There must be provisions to allow access to data critical to protecting patients and society from harm that could reasonably be expected to occur if critical data is not disclosed.
7. While not strictly under the purview of this committee, consideration must be given to the potential tort liability risks inherent to creation of the NHII.

AMERICAN COLLEGE OF OBSTETRICIANS AND GYNECOLOGISTS

J. CRAIG STRAFFORD, M.D.

Areas of concern about privacy include: political agendas about patient privacy (and how patient privacy can be protected); how adolescents can feel secure about seeking anonymous care; cost of implementation; and questionable financial benefits, which may not exceed costs. Security benefits and obstacles were articulated.

Concerns specific to medical records and external health care service sites: (see transcript)

1. Event logging versus auditing for security
2. Multiple layers of user identification
3. Fear of electronic versus paper signature

ACOG’s role is to support interoperability; a standard format that allows for ready information exchange; a uniform but fluid standard that defines a “continuity of care” record developed by all stakeholders;reasonable protection of EHRs including adequate sanctions; the development of new rules and regulations that are not overly burdensome that physicians see as positive changes; and systems certification, which could help providers who lack resources to investigate available vendors and systems.

Recommendations for privacy and security are to recognize that: EHR systems are more secure than paper systems; compliance with basic security measures and sensitivity to privacy and security can eliminate breaches from careless dissemination; any system can be breached as building overly complex protections is not efficient; and regulation must be focused on interoperability and legitimate information exchange.

AMERICAN ACADEMY OF PEDIATRICS

A written statement from The American Academy of Pediatrics was read by Mr. Rothstein.

The Academy advocates for a single national system of provider and practice authentication that leverages the DEA registration process and serves multiple data types. The need for national standards supported by audit tools was stressed. The Academy urges movement toward a single technology in which all interoperability partners convert to a common standard mode of data transport. The Academy also supports the development of a uniform unique national patient identifier, especially important in pediatrics because patients often present with no name (e.g., newborns), or with changing names. Recognizing the controversy of a national patient identifier, the Academy suggests that its use be restricted to communications covered by HIPAA. Substantial benefits for pediatricians from the NHIN include obesity management; recognition of developmental disabilities and improved services; improved immunization rates; and better management of ADHD.

SUBCOMMITTEE DISCUSSION

Current HIPAA regulations provide wide latitude for national security and public health concerns. Lack of uniform response to a patient who poses a public health threat is a big concern (see transcript for examples). Physicians generally do not get involved in whether a patient has been involved in criminal activity. The chaotic environment of emergency care was differentiated from routine primary care. Security breaches can be identified in an EHR from logging functions but there was a call to create a rule with consequences for unacceptable access (rather than ongoing audits) to unburden the system. Physician frustration with auto sign out was mentioned. The electronic system used by the U.S. military was suggested as a model. There was discussion about the use of regional or national registries for ambulatory or critical care patients; data points for surveillance; record access; and data examined for public safety or security reasons that would not be available without the HIPAA exceptions.

---

DETAILED SUMMARY

DAY ONE: MARCH 30, 2005

CALL TO ORDER, INTRODUCTIONS, REVIEW OF AGENDA, OPENING REMARKS

Opening remarks by Mr. Rothstein The March 30 – 31, 2005 hearings, the second in a series on national health information technology, focused on testimony from health care providers. The first hearings (February 23 – 24, 2005, Washington, D.C.) heard from experts on privacy and confidentiality and representatives of consumer organizations. The third hearings (June 7 – 8, 2005) will hear from health systems, health plans, and health entities that have experience with EHR systems. A fourth hearing will direct attention to technical expertise and research. Details about future hearings are published in the Federal Register and on the NCVHS website.

EHRs hold the promise of increasing the safety and efficiency of health care, lowering costs, and facilitating treatment for those with cognitive or communication impairments. Realizing the benefits of EHRs while protecting patient privacy and confidentiality poses a great bioethical and health policy challenge. What level of patient control over record contents should be permitted? Too little control provides insufficient privacy, while too much control can jeopardize health care quality.

PANEL I MENTAL HEALTH PROVIDERS

AMERICAN PSYCHOLOGICAL ASSOCIATON RUSS NEWMAN, Ph.D., JD

Background The APA represents over 150,000 psychologists in practice, research, and teaching. Dr. Newman noted that market-driven managed care techniques have had unintended negative consequences for reforming the health care system, especially vis-à-vis the extent to which business efficiencies have become an overriding objective. That a national health information network (NHIN) will create efficiencies and reduce administrative costs can be used in the service of business interests rather than in the service of improving the efficiency and quality of care. The purposes of use and the manner of implementation, which make a big difference to the realization of potential benefits, are as important as the network goals.

Mental health interests in privacy and confidentiality are unique in that breaches can prevent successful treatment. In the case of Jaffee versus Redmond, the Supreme Court said that the mere possibility of disclosure might impede the development of the confidential relationship necessary for successful treatment. Therefore, mental health professionals must make important decisions about treatment information disclosure. The APA urges the preservation of the role of mental health professionals in providing some disclosure management in order to preserve the trusting and confidential provider-client relationship. The APA supports the ability of consumers and patients to have more access to their health information, but is also mindful of the possibility of unintended adverse consequences if mental health professionals do not help patients to process sensitive material.

Recognizing the unique nature of psychotherapy notes, HIPAA has ensured greater protection. The psychotherapy notes exception to the general privacy rule states that when kept separately, such notes cannot be disclosed in the absence of specific patient authorization. The APA was disappointed when HIPAA did not handle psychological test materials in a similar manner (see transcript for definition), resulting in three major concerns: 1) the materials can be subject to misinterpretation; 2) future use of some materials may be invalidated by public disclosure; and 3) much of the information is as sensitive and confidential as anything that might occur within a psychotherapy session. The APA hopes that both psychological notes and psychological testing will be protected within the NHIN. The importance of the connection between health and behavior was noted as was the need to better integrate mental and behavioral health into the overall health care system. To date, there have been separate payment, administrative, and record keeping systems, which fortunately, is beginning to change. The NHIN could facilitate better integration of mental and behavioral health care into health services delivery but that information would have to be adequately protected. Integration would allow individuals not trained or experienced in the use of mental health information to access that information. Stigma might become more prevalent. Therefore, the APA recommends that the NHIN not move to the “lowest common denominator” when establishing privacy and confidentiality standards, but rather adheres to higher standards maintained by the mental health system. The VA’s EMR system was noted for its two-tiered construct, which allows for greater protection of mental health information.

The degree to which health insurers could access mental health information on the NHIN was raised. Noting significant historical tension between insurers and mental health professionals over information disclosure, concern was expressed about the intention of insurers to discourage patients from seeking mental health services. Dr. Newman noted stark differences about what insurers and mental health professionals believe to be the “minimum necessary” amount of information for effective task completion for a utilization review process.

Recommendations: That the NHIN:

1. Exclude or place specific limitations on access to psychotherapy notes, psychological test materials, and raw data.
2. Recognize and maintain the role that licensed mental health professionals play in determining appropriate access to mental health records by insurers, patients, and others.
3. Promote the integration of physical and mental health information in a cautious manner that preserves confidentiality of mental health records (by, for example, creating a two-tiered system with more limited access to mental health records).

AMERICAN PSYCHOANALYTIC ASSOCIATION JAMES C. PYLES, LLB

The American Psychoanalytic Association has 30,000 members.

Questions of concern about the NHIN include:

• Should individuals’ identifiable health information be included in an electronic health information system without notice or consent, or over objections; or should an electronic system be based on traditional principles of medical ethics that recognize some control of individuals in non-emergency situations?
• Can security of identifiable health information in an electronic system be assured?
• Are there adequate rights and remedies for individuals whose medical privacy has been compromised?
• Is there a clear evidence-based conclusion that electronic health information systems improve quality, achieve savings, and improve efficiency?
• Is there an accepted standard of reliability and care for EHR systems?

Recommendations: (see transcript for further elaboration)

1. NHIN should be ethics-based with no identifiable health information included without individual consent or against the individual’s will (top priority).
2. No NHIN should be implemented until security of information is assured.
3. Patients and individuals should have adequate rights and remedies to address violations of medical rights, including a private right of action for damages, corrective action, and injunctive relief.
4. No NHIN should be implemented without clear evidence-based reasons to believe that such systems improve quality, achieve savings, and increase efficiency.
5. No NHIN should be implemented without a nationally recognized standard of reliability and care.

The NHIN should be viewed as a possibly useful tool to be carefully tested and cautiously implemented in a manner consistent with traditional principles of medical ethics and practice. Medical privacy is essential for quality of health care and for quality government.

AMERICAN PSYCHIATRIC ASSOCIATION

Unable to attend today’s hearings, highlights from written testimony from the American Psychiatric Association (APA) were presented by Mr. Rothstein.

The APA represents more than 36,000 psychiatric physicians in the U.S. and other countries. The APA believes that the NHIN has the potential to decrease treatment errors, improve communication between health professionals, and assist psychiatrists with evidence-enhanced guidelines. Privacy and confidentiality protections must be built into the system from the ground up. An APA core value supports the Surgeon General’s report and the Jaffee versus Redmond Supreme Court decision that privacy is an essential requisite for effective mental health care (see transcript for further elaboration). Decisions to take part in the NHIN should be voluntary. The NHIN must not be a centralized storage of EMRs but rather a decentralized system that maintains records at the local level. Networks can “talk” to each other when authorized physicians and hospitals need information. Patient information must be exchanged over a secure system that strictly enforces rules for certified members. In short, the NHIN must not jeopardize provider/patient trust. Patients should have recourse if medical privacy and security are violated in this country or offshore. The APA wants to ensure no downstream release of information to marketers.

An estimated 60 percent of practices are small (i.e., 10 or fewer physician); and 35 percent are in offices with three or fewer physicians. The high cost of HIT is a barrier for small doctor groups, estimated at more than $30,000 per doctor (source: American College of Physicians).

Discussion

Mr. Rothstein wondered how to get a more precise handle on what constitutes sensitive information in health care records, citing two examples (see transcript). To better integrate mental and behavioral health, Dr. Newman noted the need for sufficient information exchange with other involved health professionals. HIPAA has recognized different kinds of information, some of which is more protected. Distinctions must be made to determine what information should be maintained in the general record. He suggested using current regulations as a guide. While agreeing with different levels of privacy in EHR systems, Mr. Pyles thought that patients should determine what is disclosed to the practitioners. Because of privacy concerns, 600,000/year do not seek cancer treatment; two million do not seek mental health treatment; and millions do not seek treatment for sexually transmitted diseases.

Mr. Rothstein thought that Mr. Pyles “ethics-based” approach would be the end of EHRs. Quick access efficiency would be lost as providers attempted to fill information gaps. The system would be “killed” without acceptable rules. Mr. Pyles suggested that patients would not disclose information against their will. Great Britain is experimenting with patients placing health information of their choice into an electronic “black box.” Mr. Pyles thought that the black box concept could enhance patient privacy of EMRs (except for emergencies).

Dr. Newman noted that state mental health laws require consent/authorization that is not always available for physical health information. Many state laws offer higher protection than what is available through HIPAA. Mr. Houston wondered how to achieve a balance between absolute privacy and the highest quality health care. What happens when a patient is unconscious? An evaluation in the absence of information takes much more time. By looking at a patient’s medication, a provider can get some idea of what is wrong. Mr. Pyles noted the emergency rule exception in most states and in the original privacy rule. Physicians are concerned about medical liability, which according to Mr. Houston, is a proven adverse outcome. With a full right to privacy, the doctor does not receive anything that the patient does not want disclosed, even when suffering from a heart attack. Stressing balance, Dr. Newman thought there might be an opportunity to develop a differentially accessible system that, in emergencies, would allow health care professionals to access information that would normally not be accessible. Mr. Pyles said that not all things have equal weight.

Reiterating that the NHIN is not ready for prime time, Mr. Pyles thought that it should be a voluntary system for patients. Experimentation should be on a case-by-case basis for the next three to five years (noting $34 million “wasted” on their system or the FBI electronic system that was “trashed” after years of development). The next five years will yield a better sense of what works and what information is needed to develop a set of national standards. Dr. Cohn thought that the VA, Kaiser Permanente, or other large organizations might indicate that EHRs are not such untested technologies. He and Dr. Newman expressed concern about the fact that the current system gives payers more access than health care providers. Different needs ought to mean different access for payers and health care professionals. Mr. Pyles agreed that insurers and providers are treated equally.

PANEL II OTHER PROVIDERS

AMERICAN PHYSICAL THERAPY ASSOCIATION ELLEN “MICKEY” BONK, PT, MBA

Background Ms. Bonk described the work of physical therapists, the many treatment settings, and the complexities of instituting HIPAA while working in open spaces with other patients nearby. Physical therapists must make extra efforts to ensure the comfort of patients in knowing that their privacy is being controlled. They must also submit reimbursement claims to third party payers.

HIPAA Compliance and Complexities APTA has been proactive in assisting members with HIPAA compliance via seminars, training modules, and website information. At Ms. Bonk’s facility, 32 HIPAA-related policies have been developed, 27 of which are relevant to her staff. Policies created for use by the Human Resources Department protect employee health information. Due to the nature of the work, disclosure of protected health information to other parties is significant, especially within a legal context. There are questions about when and to whom information is disclosed. For example, if a guardian parent does not want the non-guardian parent to have a child’s health information but it is the non-guardian parent who brings the child in, part of treatment consists of teaching the family about what to do at home. Also, when interventions include the use of supplies and medical equipment, contact with suppliers is more easily accomplished from hospital facilities than from private practice. These and other HIPAA-related complexities have required changes in administrative processes and physical layout. Further, because physical therapists are often in a position to discover evidence of physical abuse, they must understand their disclosure obligations in suspected abuse cases.

Confidentiality and Privacy Concerns Movement toward a national database is accompanied by confidentiality and privacy concerns. Core APTA documents reflect the physical therapist’s ethical obligation to ensure the patient’s confidentiality, safety, and well-being. Compliance with all laws, regulations, and licensing requirements is stressed. Students are taught about HIPAA and documentation policy from the start of their training. APTA has co-developed a point-of-care electronic patient record software called APTA Connect, which gathers critical and sensitive information that can be shared among health professionals. Passwords and other security measures are used within this software program. Mental health information can only be entered for emergency purposes (with a report sent to the privacy officer). APTA Connect enables facilities to obtain valuable information about patient outcomes that can improve patient care in the future. The challenges of protecting patient information continue to evolve.

AMERICA

N DENTAL ASSOCIATION RONALD E. INGE, DDS

The American Dental Association represents approximately 150,000 dentists in the U.S. Its Division of Dental Practice presents HIPAA seminars regularly and has distributed nearly 70,000 comprehensive kits that allow dentists to assess and comply with HIPAA regulations. Dr. Inge described how dentists previously handled privacy, confidentiality, and security issues with paper records. Dentistry is moving toward the electronic arena more slowly than general medicine. The average electronic submission of dental claims is about 30 percent. Dentists must catch up technologically, which at present is an even bigger challenge than confidentiality. In a 1994 survey, 67 percent of dentists had computers in their office. In 2000, usage rose to 85 percent, with 51 percent using EHRs and 40 percent using computers for monitoring and diagnostic purposes.

AMERICAN OPTOMETRIC ASSOCIATION PAMELA J. MILLER, OD, FAAO, JD

Background The American Optometric Association (AOA), which has more than 30,000 members, has submitted broad formal comments to HHS on the President’s goal of implementing use of EHRs nationwide within the next ten years.

HIT Challenges and Privacy Concerns Noting the high cost and lack of financial return on the investment, Dr. Miller noted the difficulty of solo practitioners and small practices in keeping up with technology. In addition, some professions grant no continuing education in this area. Areas of concern relative to privacy and HIT include: 1) the demands of implementation and training and accompanying staff resistance, which may lead to attrition from the field; 2) “hard and soft” costs, including hardware, software, training, upgrading, maintenance, and staffing; 3) loss of privacy with respect to patient information and increasing potential for inadvertent or intentional dissemination. Threats include access to EHRs by employers, insurers, or others; fraudulent information selling; wireless technology interception; and hackers. The issue of accountability remains paramount.

Three positive benefits to the implementation of EHRs are: 1) improved levels of service and communication between providers and patients, resulting in improved treatment at a cost savings; and more rapid diagnostic and treatment alternatives; 2) improved consulting services between providers; and 3) improved documentation; quicker and correct billing and coding; and faster reimbursement.

Three recommendations specific to privacy and security of EHRs include: 1) development of HIPAA-compatible rules; 2) development of new laws, as needed, to safeguard EHRs and the NHIN; 3) development of laws with harsh penalties for those not approved to access EHRs who intentionally and fraudulently breach security. Currently, when a provider distributes patient information to other providers, the provider does not receive information back and the patient has no recourse. The provider’s obligation to protect the patient’s right of privacy is not fully addressed by current HIPAA standards.

Discussion There was discussion about the level of sensitivity of dental, optometry, and physical therapy records. Ms. Bonk and Dr. Inge noted times when information conveys sensitive material, as is also true for sports medicine. While not a specific category, considerations such as elder or drug abuse may emerge. Within the optometry field, much information is elicited while gathering the case history. Often, patients who refuse to give information to a staff person will provide that information to a doctor. Patients are particularly concerned about where their information goes, in light of provider and insurance carrier changes. While more research now connects dental disease to systemic disease, approximately 75 percent of dentists are single (rather than hospital-based) practitioners. There is increasing recognition of the need to integrate medical and dental information for overall treatment planning as well as for specific dental treatment. It is important to access health information (especially when patients must be pre-medicated) but getting it from a physician can be a “daunting” task that sometimes delays treatment.

Digital signatures are not widely used at present but are being explored within the field of optometrics. The fifty percent of optometrists in private practice are generally slower to adopt new technologies than dentists, particularly as related to patient records rather than authorizations, orders, or billing. There is no widespread implementation within the field. The Optometry Association has a series of concerns rather than a particular directive to make to the Subcommittee about privacy and confidentiality.

Dr. Inge has had very few dental patients refuse to allow communication with their physicians. Dr. Miller finds that patients are susceptible to what their physicians communicate. If a provider lays the groundwork for a referral, it is rare for a patient to refuse the recommendation. Accessing information from other providers is more problematic. Privacy issues emerge, as in cases where street drug use might impede treatment. In the big picture, if security issues are satisfactorily resolved, it was agreed that an EHR system would aid treatment by allowing practitioners to understand the overall health environment and by providing easier access to more comprehensive information.

Ms. Bonk again mentioned the complexity of layered security for mental health records. Only some practitioners would have authority to break the lock and these distinctions would be difficult to manage technologically. She described a complex audit trail and tracking system but noted its potential for error. Since HIPAA, much improved logs are maintained and emails are no longer used to convey information. Dr. Miller added that accountability is more vigilant and that providers must now pay “100 percent attention all the time.” She raised concerns about what providers must do to secure confidential material from third-party carrier audits. The end result – a greater awareness of the patient’s right to privacy – is a “good thing.”

Dr. Harding raised questions about electronic terrorism a propos to 9/11, recognizing strong support and resistance to a NHIN relative to these concerns. EHRs were seen as more vulnerable to unauthorized disclosures and less secure than paper records by some but not by others. EHR is still uncertain terrain and because of the potential of mass exposure, layers of security and staff training are recommended.

PANEL III INSTITUTIONAL PROVIDERS

AMERICAN HOSPITAL ASSOCIATION DONNA A. BOSWELL, Ph.D., JD

Complexities of HIPAA Before HIPAA, providers’ protection of patient privacy was rooted in the medical relationship with medical ethics, best clinical practices, licensure, and accreditation standards playing a part. Nevertheless, patients were confused, concerned, and uncertain about the system of protections. HIPAA provides specific federal requirements for protecting privacy and ensures uniformity of rights and standards; predictability of procedures; and realistic accountability for meeting those standards. It is costly, complex, and disruptive to change policies and procedures that affect day-to-day activities of caregivers and administrative personnel (see transcript for example of documentation that provides patients with a record of disclosures to third parties). In addition, criminal penalties are a great “magnet” for attracting the attention of in-house compliance personnel but their interpretations are not always well received by patients and their families or by law enforcement officials, newspapers, or public health authorities. The potential liability and risk to reputation from criminal prosecution and the possible loss of federal program participation mean that health decisions can no longer be subjective judgments about the best interests of the patient or the health care system. These decisions must be based upon compliance required to minimize risk and to establish compliance with the law.

It is also important to note that HIPAA does not yet provide uniformity and predictability because federal standards were grafted onto an existing patchwork of federal, state, and local laws as well as accreditation and licensing requirements and standards. It is necessary to focus attention on systemic and systematic procedures for privacy rights and confidentiality to provide a foundation to the NHIN. As attractive targets for political factions, state legislatures can create more problems with compliance relative to interstate or multi-state situations. The result is an unsystematic thicket of laws with major legal and other hurdles to compliance of federal, state, and local laws. On a day-to-day basis, preemption analysis is not useful for facilities and physicians trying to comply with the law. A system of laws to govern modern health care (with its hospitals, specialists, labs, pharmacies, and payers requiring communication and commerce across state lines) cannot be derived from a one-to-one relationship.

Three Major Privacy Concerns Dr. Boswell called for a single predictable set of standards applied across states with a reasonable expectation of privacy as the basis of the NHIN. She noted three major privacy concerns:

1. Preemption: a uniform trustworthy national standard for safeguarding the confidentiality of health information.
2. Accounting of disclosures: the requirement that each provider and payer provide each patient with an accounting that explains the legal basis for third party disclosures must be lifted.
3. Liability: an individual provider cannot be held at risk under applicable state and federal laws for actions taken by those responsible for operating the regional or national infrastructure.

HEALTHCARE LEADERSHIP COUNCIL MARY R. GREALY, JD

Background The Healthcare Leadership Council (HLC) is comprised of chief executive officers of America’s leading health care companies and institutions, including hospitals, health plans, academic medical centers, pharmaceutical companies, medical device manufacturers, and pharmacies. In 1996, HLC began to chair the Confidentiality Coalition, a broad-based group of over 100 health care and employer organizations that support workable national uniform privacy standards, with effective safeguards that do not unduly burden providers and patients with unnecessary paperwork or treatment delays. The HLC and Confidentiality Coalition support the development of an interoperable NHIN because it will improve the quality and cost effectiveness of health care.

HIPAA Impediments While HIPAA has accomplished much, there are several areas which provide disincentives for participation and impede the establishment of the NHIN, to include:

• Preemption of state law Navigating a confusing maze of state laws, rules, and regulations represents great compliance challenges (note a $1 million initial study by HLC that analyses the relationship between HIPAA and state laws). The NHIN will not be viable without a federal preemption that eliminates state variation in privacy standards.
• Accounting of disclosures of protected health information. At present, substantial disclosures, which must be documented for six years, need to be tracked for disclosure to public health and state entities. This requirement imposes undue administrative costs and erects barriers to quality health care without significantly enhancing privacy protections.
• Minimum necessary HIPAA privacy rule’s minimum necessary standard may be unworkable within the NHIN because it creates legal uncertainties that have led to defensive information practices that restrict appropriate information sharing within the health care system (see transcript for examples). Consideration should be given to eliminating the standard or creating safe harbors for health information transmission through a national or regional network.
• Research The Office of the National Coordinator reports that an interoperable network of EHRs will eventually accelerate the translation of research into practice. HLC believes that this goal will be difficult to achieve under HIPAA provisions that restrict access to health information for legitimate and necessary health research (e.g., HIPAA’s prohibition against individuals granting authorization to use their health data in unspecified future studies). The privacy rule should be modified for consistency.
• Patient Consent and Control The privacy rule prohibits disclosure of identifiable health information for purposes other than patient care unless the patient provides specific prior written authorization. For the NHIN to be used as part of care delivery, patients cannot selectively withhold information that may be relevant to treatment. Providers are very concerned about liability resulting from reliance on incomplete information. Patients must have confidence in the protection of their information and providers must have confidence in the data provided. The ramifications of consent for health care delivery and public health must be considered.

The public needs to be better educated about how their health information is used and protected.

AMERICAN HEALTH CARE ASSOCIATION DONNA MAASSEN

Background The American Health Care Association (AHC) represents more than 10,000 non-profit and proprietary facilities. The National Center for Assisted Living (NCAL) is the nation’s leading long-term care organization.

Current Status of Health Information Technology in Long-Term Care Long-term care providers are looking at the EHR as a short-term goal. Currently, more than 16,000 Medicare and Medicaid certified nursing facilities must submit their minimum data set electronically to comply with state and federal certification requirements. CMS is studying efforts to enable information from the automatic population of the MDS from EHRs. Nursing homes and assisted living facilities use technology to create billings; generate patient assessments and progress; look at care planning; and generate electronic physician orders. Nursing homes use software packages and new devices such as palm pilots and touch pads to document staff activities and table PCs to record the administration of medications. Long-term care facilities still primarily use a paper-based process, which produces cumbersome records and information gaps. Chart information must be split due to volume, with the most current information in the medical record at the nurses’ station and the rest archived.

Benefits to Long-Term Care of EHR Information Exchange Key factors to success of the NHIN will be the inclusion and definition of all components of the spectrum of care, including a variety of staff, providers, and ancillary providers such as pharmacies, labs, and x-ray technicians. Interoperable health records allow for portable patient information that can move with consumers from one point of care to another. AHC and NCAL urge ONCHIT to include the electronic information needs of long-term care providers in all of its efforts. The benefits of improved care, reduced wasteful and redundant treatments, and the prevention of medical errors should be parallel benefits for varying populations.

Impediments and Potential Motivators for HIT Adoption within the Long-Term Care Industry The significant costs of long-term care, primarily reimbursed by the federal government, barely cover the cost of providing health care services. As such, technology has advanced slowly within the long-term care profession. One initiative that could reduce the risk of investing in EHRs is the Certification Commission for Health Care Information Technology. Inclusion of long-term care in this initiative would help to assure long-term providers that their software selections meet their needs as well as minimum security standards. It is critical for CMS to develop programs that allow providers to engage in these initiatives. Government subsidies are recommended for start-up expenses such as equipment and training, as are tax incentives for providers who purchase hardware and software and invest time and resources in EHR connectivity.

Concerns about Health Security, Privacy, and Confidentiality

• Data sets must be defined: the minimum necessary standard is a necessity; all industries are affected by the need for a professional judgment about the least amount of information necessary for disclosure. Because of liability, organizations now determine their own minimum necessary. The emerging standard, called the continuity of care record, can assist with minimum necessary by providing the most recent patient encounter in the full medical record. A sponsor of the continuity of care record, AHCA believes that the minimum necessary disclosure standard is a key component to the future success of the NHIN.
• Preemption is another challenge for everyone. In order to be successful, the system must discriminate between a legal guardian and a responsible party; and must prevent inadvertent and inappropriate disclosures. Extendicare and AHCA belong to the HIPAA Long-Term Care Consortium, which has worked for four years to identify preemption and state laws in order to create a tool for long-term care providers that identifies how the law should be applied in each state. These efforts have been unsuccessful. One way to meet the preemption requirement is to ask regional health information organizations (RHIOs) to identify appropriate disclosure and access levels in their area, and then to feed this information to the national network (with the understanding that long-term care facilities would be included in the RHIOs, which is not presently the case in most situations).
• The security rule must be delineated to ensure success of the NHIN. Currently, it is difficult for providers to identify minimum requirements for a secure environment. The HIPAA Long-Term Care Consortium has made reasonable progress in creating products that clarify confusing issues about privacy and security. But defined security protocols are necessary for patients and providers of tomorrow.

Discussion Asked about the degree of patient control over information, Dr. Boswell thinks that the question goes to public education and understanding of how health information is used by providers. That paper records are not necessarily available to a person’s past physicians is potentially more harmful than the illusion of privacy created by records stored safely in a box because the importance of that information to a current provider should not be underestimated. In treating the whole person, it is not an acceptable standard of quality care for a patient to say, “I don’t want to tell you anything about my past. Let us start from now.” The question is whether the physician is willing to operate in a vacuum. The question is not “can privacy be protected,” but rather “can a person who is so unwilling to trust a physician obtain state-of-the-art care?”

Mr. Rothstein pointed out, by way of a personal example, the legitimacy of a person choosing to withhold certain information deemed irrelevant to a medical problem at hand. Dr. Boswell believes that the issue is more about the need to use uniform standards to define what goes into a shared health information system. While AHA does not have a position on carve outs for certain information, Ms. Grealy thought that the HLC would support the notion that encrypted electronic records are more secure than paper files. A patient’s desire for control over information is really a desire to make sure that the information is not inappropriately disclosed. Ms. Grealy agreed that the discussion should really be about how to develop appropriate standards for what goes into medical records. Ms. Maassen could not speak to the issue on behalf on AHCA, although she thought that the organization would not support the patient’s right to withhold information. Mr. Rothstein challenged Ms. Grealy’s statement that health care providers do not share information with third parties such as employers, insurers, or mortgage companies. He estimated 20 million compelled authorizations in the U.S. annually. As a result, people are reluctant to have sensitive information in files that are broadly accessible. Ms. Grealy viewed Mr. Rothstein’s concern as an issue separate from that of an interoperable NHIN that improves the quality and efficiency of care.

Asked about the definition of “minimum necessary,” Ms. Maassen quoted the law: “For the disclosure of protected health information between health care providers for the provision of treatment and continuation of care.” Minimum necessary must still be applied for payment. Ms. Maassen advocated for a clear definition of minimum necessary for certain types of disclosures. For example, it would be useful to streamline electronic exchange between a hospital and nursing home at pre-admission to eliminate the need for a new determination about disclosure with every transfer. Standards could be set for initial admission information but significantly more information would also come along. Ms. Grealy emphasized the amount of staff resources used for compliance activities rather than direct care. She also mentioned hypercompliance, which prevents staff from getting needed information. The goal is to find a workable balance that protects privacy while ensuring appropriate information. Dr. Cohn pointed out that some things that seem unworkable might just need fine tuning. Mr. Harding wondered whether it is the information holder or the requester who determines what is “minimum.” Dr. Boswell noted that disclosures are always permissive for treatment purposes. If a dispute is with a patient, the patient “wins”. If a dispute is between providers and the holder of information has promised not to disclose information, s/he is obliged under penalty of law to respect that promise. Mr. Houston spoke of the risks of being given a minimum security requirement because “if they get it wrong, I am stuck trying to put a square peg into a round hole.” Ms. Maassen noted how difficult it is to define what information should be kept and what security should surround it. Today, encryption is an addressable element rather than a requirement. There is nothing in today’s security rule that says that protected health information can’t be transmitted through e-mail. There must be rules and regulations that state that encryption is a requirement for information exchange.

Mr. Harding asked whether public health mandated disclosures should be accounted for. Ms. Grealy thought that such disclosures could be addressed with the privacy notice. Dr. Boswell gave a burdensome disclosure example: a state official is required to conduct a survey by pulling a random set of anonymous data from records. The rule says that a note must be placed in the accounting of every patient in the database from which the information is pulled. As such, more information is required than is necessary to accomplish the intended purpose of notifying patients that their records may have been used for public health purposes. Mr. Rothstein noted that the issue of accounting of disclosures will be taken up in the fall 2005 hearings.

Concerned about the elimination of “consent,” Mr. Houston wondered about creating a workable environment with a master person index, an authorization, and an authentication scheme that would allow a patient to decide upfront what information to make available to whom and in what context (see transcript for example). Dr. Boswell pointed out ambiguity of terms (e.g. what is psych data: psychiatric notes or medication?) and the danger of unknowingly prescribing medication that might interact adversely with psychotropic medication. She questioned how a patient could decide what is medically relevant for efficient and accurate care. Referring to a discussion with David Brailer six months earlier, Mr. Houston countered by emphasizing the need for public confidence in the system, which translates into the patient having a level of control and accountability. Dr. Boswell replied that the regional authority operating the infrastructure would have to be accountable for who accesses data (and for some kind of credentialing process).

Fast forwarding ten years, Dr. Rippen wondered if there would be an exchange utilizing 40 or 50 years of an individual’s life or minimal sharing from a data set. Dr. Boswell thought that, longitudinally, one would want to query the record from different settings for what might be relevant to the current situation; thus the information request would depend on what the requester found useful. Other uses of the information would depend on the system users rather than kinds of queries. Dr. Boswell noted the importance of thinking through restrictions in the development of standards that govern accessing of information through the infrastructure. While a HIPAA provision already exists, it needs to be turned into a work rule with respect for how the system works. A physician’s trust in the system’s ability to portray information is a big part of whether s/he will download and copy it. She advocated for physician access to hospital episode-of-care information, as needed, rather than for downloading that information to a physician’s files (as the physician would then become responsible for disclosing to researchers and third parties).

Regarding policies about transmission or storage of identifiable medical information in offshore settings: Dr. Boswell did not know about AHA; Ms. Maassen did not know about AHCA; and Ms. Grealy said it would depend upon particular entities.

STATEMENTS FROM THE PUBLIC

Dr. Gourguechon is a medical doctor and trained psychoanalyst who has practiced psychiatry in Chicago, IL for 22 years. She was disturbed by the absence of practicing clinicians at today’s hearings, having heard little about medical ethics or patient experiences. Dr. Gourguechon does not find that availability of records is as important as has been indicated in the hearings (except in cases of nursing home transfers). It is certainly not important enough to compromise citizen rights to privacy. Noting that a fundamental premise of medical training is not to trust anything but one’s own history and physical, Dr. Gourguechon stated that she would never trust an electronic system. She could not think of a single instance in which she would need or value such a system. Her recommendation is for large hospitals such as Kaiser to develop electronic systems, but she advocates against a national system, especially in light of hearing no evidence to support quality improvement or efficiency of care. Realistically, doctors do not have time to review huge amounts of information and would not do so except infrequently for challenging cases requiring more background information. Dr. Gourguechon anticipates problems with physician compliance due to discomfort with breaking confidentiality, especially against the will of patients. Absolute control over the privacy of medical records (especially psychiatric) is essential to patient well-being and health. Conversely, threats to such control adversely affects patients, psychologically and medically (see transcript for examples). Citing the relationship between doctor and patient as “our most powerful drug,” loss of control over confidentiality weakens the healing bond. Noting that many of her patients complain of substandard care by physicians who have learned of psychiatric diagnoses, Dr. Gourguechon could not think of many crisis situations where a patient’s refusal to indicate their medications would really matter.

Discussion Dr. Gourguechon retracted the absoluteness of her statement that records be kept confidential and private relative to public health emergencies. She agreed that discounting patients with psychiatric conditions or psychotropic medications is an issue of education but she nevertheless defined it as a problem that would never be solved because of emotional reactions of providers. She believes the only way to protect patients is to give them a choice about keeping information private. Mr. Houston pointed out that the chief medical officer of his facility, a practicing clinician, is strongly in favor of an EHR environment and the need to access information. Mr. Houston raised the issue of patients trying to fraudulently obtain medication (which did not pertain to Dr. Gourguechon’s example).

As an emergency physician, Dr. Cohn refuted Dr. Gourguechon’s premise that past records are not useful in the emergency room (see transcript for example of left bundle branch block).

SUBCOMMITTEE DISCUSSION

Future Hearings The third round of hearings, scheduled for June 7 – 8, 2005, will gather information from a variety of staff from health systems, health plans, and health entities that have experience with EHR systems (e.g., VA; Department of Defense; large clinics or hospitals such as the Cleveland Clinic, Mayo Clinic, or Kaiser, Cedar Sinai, Vanderbuilt University Hospital; a state department of mental health/drug and alcohol system). Dr. Cohn noted a September 2005 national meeting sponsored by SAMHSA about mental health and NHII). He clarified that the issue is more about NHII and the external transfer of information rather than the use of EHRs within facilities. Ms. Greenberg raised the issue of longitudinal health records. She spoke of the benefits and risks of linking epidemiologic data with claims data, and of linking survey data with claims data and tax records. She questioned whether there is sufficient evidence-based research about how helpful longitudinal records are (as opposed to just-in-time information). Due to its relevance to population health, this research would also inform the Subcommittee on Standards and Security and the National Committee and would be a good discussion topic at upcoming Executive Subcommittee meetings. An IOM study was also suggested.

Mr. Rothstein emphasized that the moral justification for an EHR system is the improvement of patient outcomes. Mr. Houston thought that there was a strong argument for collecting cradle-to-grave medical data to improve quality of care but he did not think this area was the Subcommittee’s mandate. He suggested reviewing the results of NHII grantees (Ms. Greenberg thought he was referring to patient safety grants or grants from AHRQ).

IT experts could be vendors or representatives of academia and large companies. Mr. Rothstein suggested that the Subcommittee brainstorm questions (i.e., about such issues as mental health carve outs, work flow, and process redesign). Dr. Cohn pointed out a lack of agreement about the end point. According to Dr. Rippen, important questions to ask would include: What are the requirements? What are the technological implications of implementation? What is the timing? Much data has already been gathered. Mr. Houston wondered how much to leverage (from RFI, for example) and how much the Subcommittee should do on its own. With a focus on privacy, Dr. Rippen believes that the questions are essentially different. It is important to conduct hearings that are open to the public. Dr. Rippen and Ms. Dozier-Peeples will find out whether RFI participants will answer questions from the Subcommittee. Dr. Cohn suggested focusing on innovative approaches from the RFI information.

Dr. Rothstein suggested taking IT experts out of the third hearing and combining this topic with research for a fourth hearing. He also suggested adding health plans such as Blues, Humana, and others (perhaps Pharmacy Benefit Managers [PBNs]) for further testimony in the third hearings. A working lunch was set up for March 31^st to further refine future hearings.

The meeting was adjourned at 4:20 p.m.

---

DAY TWO: MARCH 31, 2005

CALL TO ORDER, WELCOME, INTRODUCTIONS, REVIEW OF AGENDA

PANEL IV PHARMACY SERVICES

NATIONAL ASSOCIATION OF CHAIN DRUG STORES MICHAEL J. SIMKO, R.Ph.

Background Founded in 1901, Walgreens has 4,700 locations in 445 states and Puerto Rico. Walgreens fills over one million prescriptions daily, or 14% of all retail prescriptions dispensed in the U.S. All pharmacies are linked by satellite. In 1990, Walgreens initiated electronic communication between pharmacies and physicians’ offices for refill authentications. Since then, Walgreens has developed the system, marketed e-prescribing under the PreScribe trademark, and subsequently sold it to ProxyMed, a network aggregator. Through ProxyMed and SureScripts, Walgreens’ connectivity is made through secure private data circuits using encrypted messaging and standards, firewalls, log files, audit trails, and authorized identification and certification.

Increasing availability of information for authorized caregivers in a secure, accurate, and timely fashion is essential to improving clinical care and the health system. Connections between pharmacies are secured by utilizing SSL and VPN connections, private data circuits, and encrypted messaging. There must be methods to correctly identify patient records across many entities including labs, clinical systems, third party payers, and pharmacies. Unique patient identifiers may be required to properly link patient information. HIPAA compliance issues must be addressed to protect patient confidentiality. Transactions that fail authentication are rejected.

A challenge in moving forward with an effective system that allows for interoperability between authorized providers is authentication and level of information sharing. Indicators must be created and managed to allow patient authorization for movement of personal health data between entities. The dispersion of information needs to be identified through standards development such that patients can selectively choose what information to share. In today’s paper-based system, patients often use multiple pharmacies to avoid incorporating sensitive medical information (such as mental health or a particular disease state) to their overall profiles. Sometimes, patients pay cash for medication to avoid chance discovery by employers. Patients at Walgreens have the ability to limit their profile to a single store.

Recent adoption of NCPDP standards about medication history and compliance messaging from the pharmacy to the physician creates new opportunities and challenges related to security and HIPAA compliance. Pharmacies have more information about medication history than what is provided by a PBM (such as prescriptions not covered by third party plans; prescriptions paid for in cash; workers’ compensation prescriptions and OTC medications; allergy and health condition information). Pharmacies need to address multiple types of data sets: those which adjudicate claims for payment; those shared among prescribers and pharmacies; and clinical information that must be identified through standards and business partner agreements. A dynamic patient information system allows patients to participate in managing information flow and gives participating entities a mechanism to identify specific information for sharing. Patients may opt for complete or selective sharing. Preserving privacy is essential to the acceptance of EMRs. Health records should be left with the providers who created them although there must be an ability to link to other entities.

Adoption of a national patient and prescriber identifier system (NPI) should not be required until May 2007 and only if there is adequate industry experience by then (NCPDP provider ID is the current and standard process for pharmacy identification today). What are today’s identifiers (name and birth date) may not be enough. A Master Patient Index may need to be created. There are currently successful efforts within HL7 and NCPDP to interface two systems for seamless movement of clinical information from one format to another. Challenges include information management from multiple sources and HIPAA compliance; and proper application and ability to provide this information to other health care entities in a way that does not violate HIPAA or the patient’s wishes. Pharmacies also need to address the Coordination of Benefits (COB) and Single Point of Contact (SPOC) efforts through CMS.

Recommendations A large national database of patient information is not recommended. Each provider entity should maintain their information and interoperability of information sharing with accompanying provider agreements that include patient intentions.

AMERICAN PHARMACISTS ASSOCIATION SUSAN WINCKLER, R.Ph., J.D.

Background The American Pharmacists Association (APhA) is the largest association of pharmacists in the U.S. Dr. Winckler expressed appreciation for the increased awareness of pharmacy as central to discussions about health information technology and EHRs.

Focus Access, contribution, and integration are the key elements that pharmacists look for in their ability to protect and access information. Dr. Winckler gave examples of why it is helpful for pharmacists (as “medication experts”) to access information from EHRs (see transcript). Patients sometimes request limited access when securing controlled substances from different pharmacies, not for privacy reasons, but because they do not want to get caught in diversion activities. Pharmacists must keep this in mind to complete their responsibility under the state practice acts and the controlled substance act. In some cases, a payer only needs to document that care was provided and medication dispensed. The minimum necessary approach and implementation of HIPAA does not resolve issues of payer access to information.

Pharmacists can also contribute valuable information to health records about, for example why a patient stopped taking a medication. Most pharmacies have computerized patient profiles but information integration in different settings is very different. There must be integration among systems and assurance that the overall system that integrates all of the information meets the needs of different practice environments. An integrated electronic system offers an opportunity to communicate additional information and provide additional support to patient care. For example, a prescription could provide information about intended use of a medication, which could reduce medication errors.

Discussion Mr. Houston thought that it was the role of the physician or the clinician rather than the pharmacist to monitor lab values or follow patients for medication compliance. Some patients might not want a pharmacist to have that kind of information. Dr. Winckler said that the pharmacist assumes the role of medication expert because the physician doesn’t have time to assume all roles within a treatment team. When a patient is paired with a pharmacist, the patient gives permission to share information (in treating cholesterol, for example, cholesterol testing is sometimes conducted at the pharmacy). The new Medicare drug benefit mandates that certain patients have medication therapy management services to ensure proper use of drugs. Patients can opt into programs in which pharmacists monitor lab values and test results based on dispensed medications. The pharmacist, then, provides additional support to physicians and others involved in a patient’s care.

Mr. Rothstein wondered if pharmacists would be willing to accept greater regulation and limitations on their ability to market products (sometimes in the guise of patient information and education) in exchange for greater recognition of their role in the health care delivery process and access to patient health information. Dr. Winckler said that APhA has the same concerns. In 1998, they created guidelines for manufacturer participation in patient incentive programs, which stated that marketing must be distinguished from the patient care environment and that financial considerations must be disclosed. Some say that compliance work should fall on the marketing side but APhA disagrees, even though compliance work yields more prescriptions. Information access for pharmacists is for their role as direct care providers rather than for marketing purposes (further information about these role distinctions will be provided to the Subcommittee). Association policy is based on three points of disclosure: distinguishing material as marketing; ensuring that no information is shared with anyone outside of the treatment system; and complying with HIPAA. At Walgreens, Mr. Simko said that no therapeutic interchange marketing is done at any point in care. When marketing occurs, it is done with the intention of educating the patient about other cost effective products to discuss with the physician. In many cases, patients compel their pharmacists to find less expensive medication and then physicians and pharmacists must decide the best course of therapy for them.

Mr. Simko said that only about five percent of patients (primarily those with sensitive disease states such as HIV) elect to have their medication history kept only within one Walgreens. He added that people have a growing concern about their personal health information being shared without permission. Dr. Winckler emphasized the need to assess disclosure requests relative to responsibilities to protect against diversion or pharmacy practice concerns because barriers could be created where information should really be shared. Mr. Simko clarified that PBMs only know about what gets sent to them and in many cases, patients do not allow all their prescriptions to be processed through a PBM. The pharmacy’s depth of knowledge and breadth of medication is generally much larger. When pharmacies adjudicate a patient claim, they receive DUR and medication information from a PBM so information is received about drug interaction between what is being dispensed and what a patient has processed through that PBM. Today, many pharmacy systems track medication that patients take from other sources, whether from OTC or mail order, and do drug utilization reviews against those medications. Dr. Winckler pointed out that even with EHRs, it is necessary to talk with patients because, for example, the new Medicare Part D benefit poses substantial limitations on what payers know about medication therapy. Because the new Part D benefit does not pay for benzodiazepines or barbiturates, these drugs will be in the pharmacy record but not in the PBM record. The same holds true for health conditions or allergies. If no one has the complete picture, it is important to ask where else to look for information.

Is there a distinction between a clinical pharmacist and one in a dispensing role? Dr. Winckler said that the difference in role depends on varying needs for access, whether for overseeing the fulfillment of an order, performing medication error observation, or doing medication therapy management. All pharmacy graduates acquire a doctorate of pharmacy. Mr. Simko added that Walgreens employs clinical pharmacists in a variety of practice settings for specialty pharmacy or to dedicated patient care centers for more complex medication and disease state management. It is helpful for dispensing pharmacists to have access to information like lab values and diagnoses to provide better advice or care although the information will not be intricate in every consultation. Generally, Walgreens is a closed system that contains patient information. Patients have access to their profiles and can monitor their personal information. An audit trail identifies who looks at files and when.

Dr. Tang asked how a person known to him received a solicitation for a new brand drug as a potential replacement for a generic medication. Mr. Simko replied that sometimes there are financial incentives for the patient (and the PBM). It is the payer or the PBM rather than the pharmacy that initiates such marketing and it is unclear whether the pharmacy benefits. There was further discussion about the May 2007 implementation deadline for adoption of the national patient identifier (NPI) in e-prescribing. Minimum necessary is not as clearly established in the pharmacy environment, especially relative to NCPDP standards. Mr. Simko described a code set that is generally the same across the predominant number of payers despite the fact that payers sometimes require more information. As pharmacies receive more information, payers may demand more information.

Does APhA or Walgreens have a policy of no information sharing without patient permission or is the default shared information unless the patient opts out? Walgreen’s policy is shared information unless the patient opts out. A discussion ensued about the feasibility of special rules for different prescription medications. Dr. Winckler and Mr. Simko thought this feasible but pointed to the practitioner challenge of deciding what conditions meet patient protection and protection against diversion or theft.

NATIONAL COMMUNITY PHARMACISTS ASSOCIATION KENNETH RIDDLE, Pharm.D.

Background The National Community Pharmacists Association (NCPA) represents owners of almost 24,000 pharmacies (42 percent of the retail marketplace) and 60,000 pharmacists that work in this independent or community setting in the U.S., generating $78 billion annually. There are 57,208 pharmacies in the U.S., with at least one in every county. The stringent educational requirements of a pharmacist were described. Pharmacists are resources for information on Medicare, Medicaid, private insurance, and OTC and prescription medications. They encourage patients to become more proactive in their health care treatment. They review medication profiles, answer questions, make referrals and recommendations, and confer with other health care professionals. The profession has been highly computerized since 1985. NCPA members use electronic transmission of new and refill prescriptions between pharmacies and physicians through SureScripts.

Benefits of EHRs include:

• The potential for pharmacists to review comprehensive patient profiles and prevent negative drug/drug or drug/food interactions.
• Management of disease states and medication therapy regimens including drug allergies and concurrent disease states.
• Identification of reduction of prescription fraud and illicit drug use.
• Prevention of duplicate therapy and of non-compliance, resulting in cost savings.

Concerns about EHRs include issues of privacy, confidentiality, security, accessibility, operational procedures, cost, and reimbursement. PBMs commonly pull de-identified information for resale. Some pharmacies have no knowledge of this and others have no control. Pharmacists must be assured that the information they transmit to an EHR collection point is secure and will not be used for commercial interests without the consent of the transmitting pharmacy. It is not clear who will be charged to transmit information to the EHR collection point. In addition, the possibility of discrimination and prejudice exists if, for example, an employer accesses a record that indicates use of methadone for treatment of previous heroin addiction. It is necessary for pharmacies to access EHRs not only for retrieval purposes but also to add pertinent information.

Other questions include: How will measures used to prevent inappropriate entities from accessing EHRs allow patients and their caregivers to access their EHRs without impeding a firewall? How will health care providers be given access to EHRs? Will providers be charged for this access? Relative to standard operational procedures, what data fields will be required for inclusion in the EHR and how will record duplication be prevented and addressed? Who is liable for record transmissions that are intercepted or hacked into? What is the anticipated timeframe to submit and receive EHR claims (as time is a significant issue for very busy pharmacists)?

Pharmacists are also interested in the infrastructure, or how claims will be transmitted. Will there be one or two pipelines; and will the activity be sequential or simultaneous? Community pharmacists can be significant contributors to compiling information for EHR transmissions.

DISCUSSION (cont.)

Dr. Rippen wondered about the implication of trends (e.g., certain pharmacists may now refuse to dispense certain drugs such as contraception) on consumer views about allowing pharmacists to access more information. Ms. Winckler said that in most cases, a pharmacist who opts out will have established a system to serve the patient. Problems arise when a seamless transition does not occur; in some cases, employers establish solutions when a pharmacist opts out. It is incumbent upon the profession to help consumers understand why pharmacists need access to their information and how that information might be used; and to help pharmacists understand the responsibility that comes with that information access. At Walgreens, there is a very detailed structured set of procedures to follow if a pharmacist has trouble fulfilling a medication order. Mr. Simko believes that the “vast majority of the public holds pharmacists quite high in trust and being able to provide objective information to the patient,” and as such, he does not anticipate patient resistance to providing pharmacists with more comprehensive information. Dr. Riddle concurred and said that pharmacists who refuse to fill a prescription are mandated to refer the patient to a willing pharmacist. Mr. Simko added that millions of people have accessed their patient profiles and that probably over 60 percent of patient profiles have been updated by patients, which provides a sense of control over the information.

The need for common patient identifiers was discussed. At present, there are effective mechanisms to link providers, pharmacists, and patients and yet, there is a call for a common patient identifier. Mr. Simko elaborated that there are currently various types of identifiers in place but that as interoperability grows there will be a greater need for unique patient identifiers to ensure accuracy and minimize errors. Mr. Simko believes that, just as the need for a national provider identifier (NPI) is recognized, the same will hold true for patient identifiers in the future. He noted that in 25 to 30 percent of Walgreens’ profiles, there is variation of patient registrations that may cause duplication.

Ms. Greenberg suggested that Dr. Winckler and Mr. Simko might return to meet with the Quality Workgroup, which is examining types of information needed to monitor quality of care and the need for more structured information on functional status and functioning. APhA members are very interested in better understanding the intended use of medications and the goals of treatment, information that is difficult to acquire in the current system. The APhA is working to articulate what information is most needed on a prescription and prescription label to help patients better control how they use their medications and better understand desired results. Ms. Greenberg and Dr. Winckler agreed that patients are more interested in improved functioning than diagnosis. It is important to consider what additional information from prescribers would help guide pharmacist and patient feedback for use by health care professionals. Walgreens, also very interested in having its pharmacists elaborate on medication use, is building internal systems that allow them to manage and monitor prescription use. Dr. Riddle added that it is a natural evolution for pharmacists to access health information, dialogue with physicians, and make recommendations or referrals within an interoperable network.

The NCPDP has recently approved standardization of how pharmacies send compliance information and fill history. In the near future, various network aggregators will handle bi-directional messaging that informs physicians of patient compliance. Pharmacists will update the medical record to let physicians know if and when medication was received. In the current system, PBMs receive the minimal amount of information necessary to adjudicate. Dr. Riddle noted that since pharmacists have been mandated by various state laws to compile information requested by physicians, it should not be very difficult to assimilate into a new process for EHR transmission.

PANEL V PRIMARY CARE PROVIDERS

AMERICAN NURSES ASSOCIATION LAURIE BADZEK, R.N., M.S., J.D.

Background The American Nurses Association (ANA) represents 2.7 million nurses in the U.S. in a variety of settings. Due to a nursing workforce shortage, the ANA is developing mechanisms to increase the number of nurses and to bring ex-nurses back to the field. Public polls indicate that nurses are the most trusted profession. They often serve as the “voice of the patient,” particularly for vulnerable patients. Nurses are committed to patients, to the right to self determination, and to the uniqueness of individuals. A primary role is that of advocate. Nursing would probably be in favor of an electronic record system if a strong purpose that would benefit quality could be shown.

Concerns and Questions In 1995, the ANA developed two position statements about computerized patient records that have not been universally adopted due to concerns about technology and cost. Nurses and the public would like to know the specified purpose of developing a national network, how the system will be supported, and how it will support patient care. Will the cost be passed on to patients? Will the cost impact health care settings, in that fewer resources will be available for direct care? How will the network cross state boundaries, relative to differing licensure requirements? How will nurses be impacted by breaches, failures, or deficits within the network? Accuracy of data is another concern because if data is not up-to-date and reliable, the system has no value. How will the system allow nurses to show that what they do is evidence-based? Who owns the record and who is its keeper? How do patients access their information and how do nurses allow them to access it? Will patients who do not want to participate be penalized? How will settings with few technological resources participate? Relative to confidentiality, the biggest concern from nurses has to do with password problems. Some nurses have up to ten passwords for different systems that can change or get lost. Who controls the passwords in a national system? What happens to information on old hard drives? Will there be a federal level of accountability? Will the system require more energy than it gives back, i.e., will it take five years to get everyone up to speed, only to have to begin again because of new technology?

Nursing is a profession that encourages teamwork. HIPAA and other confidentiality protections have placed some constraints on nursing practice by changing the way that nurses share information (see transcript for example).

Needs There is a need to develop a system that people can trust. It is crucial to educate patients and nurses about the purpose of the system and how it benefits and increases quality care.

AMERICAN OSTEOPATHIC ASSOCIATION DARRYL A. BEEHLER, D.O.

Background Founded in 1987, the American Osteopathic Association (AOA) represents more than 54,000 osteopathic physicians practicing in 23 specialties and subspecialties. Strong emphasis is placed on prevention efforts and the physician’s efforts help patients assume more responsibility for their well-being.

On Health Information Technology The AOA believes that health information technology offers great promise in reducing medical errors, enhancing quality, and improving efficiency, if properly developed and effectively implemented in conjunction with physicians and other stakeholders. However, this should not come at the cost of patient privacy, confidentiality, and the patient/physician relationship. The NHIN must enhance the trust and transparency of the patient/physician relationship. The AOA is involved in developing the NHIN. Many osteopathic organizations have joined the Physicians’ Electronic Health Record Coalition (PEHRC), which supports the use of affordable standards-based EHRs and HIT to improve quality, enhance patient safety, and increase efficiency. The AOA has also developed a technical advisory committee (TAC) to advise the association’s strategic use of advanced information system technology to enhance effectiveness of patient care and to promote public health (see transcript for description of Robert Juhasz’s participation in a panel with President Bush on the improvement of quality and effectiveness of care due to the adoption of new technologies). In July 2004, the AOA issued guiding principles on e-prescribing that also apply to the NHIN, including safety, privacy, transparency, design, integration, scalability, and timing (see transcript for details). The variable presence of HIT and EHRs in the current U.S. market is of concern. The AOA supports efforts to ensure that all patient populations, especially those in rural and underserved communities, benefit from this effort.

Recommendations That the Subcommittee explore the following with respect to patient control of data; patient interactions with the health care system and physicians; and the security of patient data:

• Authentication and encryption measures that ensure a secure network.
• Assurance that patients have the most current information available from all their health care providers. How will the data be synchronized, identified, and tracked?
• Clarification about increased risk of misinterpreting data. Will physicians be responsible for informing every patient or will public awareness campaigns be implemented?
• Although a valuable tool, the NHIN must not create undue external influence over clinical decision-making processes.

AMERICAN COLLEGE OF PHYSICIANS PATRICIA HALE, Ph.D., M.D., F.A.C.P.

Background The American College of Physicians is composed of more than100,000 internists and medical students.

The American College of Physicians (ACP) is very interested in the NHIN and the use of EHRs to enhance quality patient care; evidence-based medicine and its accessibility to patient care; education of physicians and patients; and the development of stronger and more useful relationships between patients, physicians, and colleagues. While the benefits outweigh the risks, the challenge of HIT is to lower the risk and increase benefits to optimize patient care. In January 2005, ACP submitted a comment letter to ONCHIT about the RFI on the NHIN. ACP also participates in a collaborative on this topic.

Recommendations include:

Foster a trusting environment

• NHIN should consist of a carefully planned network that has a formal standardized set of technical components, standards, and methodologies; explicit policies for their use; and governance to protect patients, physicians, and all involved in the health care process.
• Patients should control access in partnership with their providers.
• An extensive educational program that clarifies what the technology is as well as risks and benefits. Patients should have a choice but they should understand the risks and benefits of their choices.

Patient control of information

• The patient role in the control of their health information should be clearly defined and voluntary (see transcript for specifics)
• The health information environment should be built upon patient authorization and control.

Physician role in managing patient information

• Clinicians must maintain control over accuracy, access, and use of data for their patients.
• Clear rules and regulations must exist to protect emergency situations, especially when patients may not be able to give their permission or in cases where who speaks for the patient is unclear.
• Patients and their physicians should decide how patient information in regional network data repositories may be accessed and used for purposes other than patient care.

Authorized access to information

• Consideration of a regional, sub-network, or local institutional clinical database where information is aggregated, rather than a single repository that holds all of a patient’s clinical data.
• Development of a record locator service (RLS) that separates the function of locating authorized records from transferring them to authorized users. RLS would be operated by a multi-stakeholder collaborative at the regional or non-geographic sub-network level and built on the current enterprise use of Master Patient Indices. Thus, individual parts of information could be shared rather than the whole file (see transcript for more information).
• ACP supports the Connecting for Health Initiative’s principles on privacy and security (see transcript for specifics on confidentiality, authentication, integrity, wire security, perimeter security, and content security).

Data integration from disparate sources

New models are needed to:

• Delineate who is responsible for maintaining and correcting the patient record.
• Define clinician responsibility for searching for, obtaining, reviewing, and validating information from other sources.

Consideration of a unique patient identifier

• Development of a voluntary national patient identifier, accompanied by federal privacy protections (with no link to social security numbers).

Discussion Asked about the cost impact of implementing EHRs into small or medium-sized ambulatory care medical practices, Dr. Beehler said that the lowest amount he had heard per physician was $9,000 annually in a three to four person practice. The software is only a small portion of the cost and the figure does not include implementation costs. He believes that small practices will not benefit from EHRs financially but that the quality of care and ability to share information will improve.

Citing patient privacy concerns (see transcript for example), Dr. Beehler also indicated that only the patient and the primary care physician should have access to the entire record. He believes that patients should be able to comment on the record but not have total control over its content. ACP acknowledges that physicians have not yet had the time to educate patients or discuss risks and benefits of sharing information, which can result in a lack of understanding and communication. Dr. Cohn wondered what additional resources are needed for physicians to educate their patients about EHRs and information sharing. ACP believes that reimbursement should be tied to patient care and quality of care rather than to time or procedures. The current reimbursement system does not allow providers to talk with patients about disease management, or for clinicians to discuss patient care, or for physicians to educate patients about risks and benefits of information sharing. ACP supports HIPAA but believes that physicians should decide record content to ensure accurate patient care. The perceived gap between patient and physician views is not insurmountable if providers have the time to talk with their patients and spend more time in patient care. Therefore, additional reimbursement is needed.

In response to Ms. Bernstein’s question about how savvy physicians are about what happens to data, Dr. Hale stressed the need for clinician and patient education. She pointed out that evidence-based medicine allows for time to think about patient management and education. Generally, ACP supports HIPAA guidelines and believes that they work. Patients who refuse to share information must be told about the consequences to determine risks and benefits. A big concern is where information goes outside of the physician-patient relationship. Within the NHIN, is there potential for patients to be selected out of health plans? Decisions about the use of information (for research or public health purposes) should be transparently made with patient and physician involvement. The current HIPAA rule does not state who is designated to make these decisions. Dr. Beehler believes that summary data can be helpful for public health or experimentation purposes but thinks the individuals should have the right to say no. Mr. Rothstein and Ms. Greenberg clarified that there are unusual circumstances in which an IRB can waive individual authorization when various criteria such as minimal risk are satisfied or in public health, if required by state law regulation. Some think that privacy rules should require more consent and authorization.

In response to a question about a voluntary unique health identifier, Dr. Hale stressed that identification matches takes time, which is why, in her region in the Adirondacks, a central clinical data depository with an NPI has been formed. Differences in proprietary systems and other “little issues” can make health information inaccessible. The RLS is recommended for rapid identification because an open source system will not run throughout the entire network. Dr. Harding expressed concern about EHRs becoming huge data storage silos that could be misused; and about decreased communication between professionals due to the time commitment that EHRs require. Ms. Badzek agreed: nurses say that much of what goes into EHRs is not utilized; that a good deal of repetition is evident; and that much time that could be spent with patients is required for information input. Knowing that the information is permanent causes nurses to work more slowly due to fear of mistakes. Communication is decreasing due to time constraints.

Mr. Rothstein asked presenters about perceived benefits of the NHIN. Ms. Badzek stressed the ability to rapidly pull up information about the most effective treatment methods, thus supporting an evidence-based practice approach. In addition, patients can now carry pertinent data with them (such as orders for life sustaining treatment), which is particularly relevant to children and the elderly. Dr. Hale gave an example of the ill effects of lack of communication between facilities (resulting in problems such as adverse drug events) that the NHIN could ameliorate. Dr. Beehler thinks that the NHIN establishes standards and common language within a reproducible, reliable system. A national system will develop best practices more quickly. He advocated for a functional continuity of care record (CCR) as soon as possible. On the risk side, it was noted that EHRs carry the potential for tremendous conflicts, hidden agendas, and motivations.

SUBCOMMITTEE WORKING LUNCH DISCUSSION

June 7 – 8, 2005 Hearing Witnesses will include:

1. health systems with EHR systems experience (VA, Department of Defense, perhaps representatives of large clinics such as the Mayo or Cleveland Clinics; perhaps some international witnesses from countries that use integrated health networks [e.g., U.K., Australia, Sweden], although a lack of international budget was noted.
2. Health plans and PBMs (BlueCross BlueShield; Humana, among others).

A summary of the June meeting and a separate summary of identified participants will be ready for distribution by April 11, 2005, prior to a one-hour conference call in April that will determine meeting specifics. Ms. Dozier-Peeples suggested hearing from capitalist rather than the more protected socialist systems.

A fourth hearing will gather testimony from IT experts and address research issues. A query list will be developed in advance of this hearing, to be held for two days in July or August 2005 (possibly to coincide with the August 2005 Executive Subcommittee Meeting).

The role of employers in EHR systems was discussed and a recommendation was made to review testimony from a January 2005 hearing of employers, the Workplace Rights Institute, the Society of Human Resource Management, employer help clinics, and other witnesses. Patients might worry about employer discrimination resulting from access to EHR materials. The employer could be paying or cosponsoring an insurance plan or could actually be the plan (self-insured). Dr. Tang suggested exploring those areas of patient exposure that inspire fear, such as employers. For example, high cost users could be discriminated against. What filters should be applied? Mr. Rothstein expressed concern about staying within the jurisdiction of NCVHS’ core mission. Dr. Tang thought that as policy advisors, the Subcommittee might be more concrete about criteria for minimum necessary in the interface between patient and employer. Mr. Rothstein concurred and added that some version of minimum necessary should be applied for payment with a standard of “in the least identifiable form.” Ms. Bernstein suggested reviewing and possibly supplementing materials from consumer organizations from the February 2005 hearings.

Mr. Houston was concerned about the ability of CMS and governmental agencies with broad access rights to tap into patient records without the knowledge of providers or administrators. Law enforcement agencies in criminal investigations or county health officials doing disease surveillance might also utilize access rights without permission from institutions. Mr. Rothstein encouraged the Subcommittee to remain focused on producing a recommendation for HHS on privacy issues. Mr. Houston thought that, if not adequately addressed, issues of reasonable sensitivity for patients could inhibit the NHIN. Ms. Bernstein pointed out how much easier it is for law enforcement and other investigators to gather information remotely from the NHIN, despite HIPAA regulations.

PANEL VI SPECIALISTS

AMERICAN COLLEGE OF EMERGENCY PHYSICIANS BRIAN F. KEATON, M.D.

Background The American College of Emergency Physicians (ACEP) is a national medical specialty society with 23,000 members dedicated to improving the quality of emergency care through continuing education, research, and public education. In 2003, emergency departments in the U.S. took care of 114 million patients. Emergency care is often delivered without a patient’s vital past medical information. Emergency care providers provide a safety net for the country’s health care system and serve as the interface between inpatient and outpatient settings by providing acute episodic care for patients with no access to primary care as well as care for those acutely ill or injured. There is a lack of stable patient population and longitudinal data.

Patients in emergency settings will benefit enormously from improved health care information technology. The challenge is balancing the needs for timely data against the desires of some to access the data for nefarious purposes. ACEP is concerned that certain unintended consequences of privacy measures might dangerously impede the ability of physicians to deliver the best possible care. Network operations should be consistent with HIPAA guidelines, to include provisions to facilitate access to continuing care in emergency situations. HIPAA has worked well because of the emergency situation exceptions.

ACEP’s Privacy and Confidentiality Principles: (see transcript for specifics)

1. Optimal management of emergency cases requires rapid access to patient data.
2. The assumption must be made that a patient who is unable to give permission for data access would have done so had they been able to.
3. Optimal management of emergency cases requires access to complete patient data.
4. Emergency physicians must be notified when a patient refuses permission to provide access to some or all of their data.
5. Public health needs, including syndromic surveillance, require reliable access to population-based data. Access to this data must be assured.
6. Some patients will refuse permission to access their data because they plan to injure themselves or others. There must be provisions to allow access to data critical to protecting patients and society from harm that could reasonably be expected to occur if critical data is not disclosed.
7. While not strictly under the purview of this committee, consideration must be given to the potential tort liability risks inherent to creation of the NHII.

AMERICAN COLLEGE OF OBSTETRICIANS AND GYNECOLOGISTS

J. CRAIG STRAFFORD, M.D.

Background The American College of Obstetricians and Gynecologists (ACOG) has 35,000 fellows. ACOG stimulates improvements in all aspects of women’s care, establishes and maintains standards for practice, and promotes professional and patient education.

ACOG has four areas of concern about privacy:

1. Political agendas in patient privacy and the question of how patient privacy can be protected (see transcript for example).
2. Adolescents: if EHRs are in a database whose index can be penetrated, how can young women feel secure about seeking anonymous care?Cost of implementation: the costs are likely to be three or four times higher than the $9,000 quoted by Dr. Beehler, which makes it unaffordable for the majority of small practices. There must be a cost-benefit gain for practices to make this investment.
3. More accessible treatment data can simplify pay-for-performance (P4P) on medical treatment rather than claims data but the financial benefits may not exceed costs. Smaller practices will lose out and could see incomes decline as funds shift to P4P.

Dr. Strafford described the electronic history of Holzer Clinic in Southeastern Ohio, which has invested $6.4 million over the past four years ($350,000 to meet HIPAA requirements; $1 million for upkeep annually) to create a fully integrated EHR system that serves 500,000 patients annually. The system has crashed several times recently due to interface expansions, which has paralyzed the clinic. Nevertheless, the benefits of added functionality of EHRs (including electronic documentation, results reporting, dictating, structured notes, prescription writing, test ordering, charge capture, coding, scanning and tasking) have been recognized.

A medical record was defined as the diary of a patient’s health care encounters, which periodically includes lab or x-ray reports and consultations. Information from outside providers is scanned and filed. EHRs are useful to the initiation of preventive services and disease prevention. Today’s unaligned system does not work to help patients become healthier. What currently exists is an elaborate, expensive, and somewhat more efficient version of the paper record. Patient care benefits could be priceless in relation to avoidance of undesirable medication interactions and monitoring screening studies, but affordability will impact how rapidly such systems are adopted.

Three concerns specific to medical records and external health care service sites:

(see transcript for further information)

1. Event logging versus auditing for security: a requirement for event logging and the ability to investigate a suspected security breach (rather than regular audits) is recommended.
2. Multiple layers of user identification: some states (e.g., Ohio) require two or more forms of user identification for electronically transmitted prescriptions (not required for paper forms), which is burdensome.
3. Fear of electronic versus paper signature authentication: in some states (e.g., Ohio), the Board of Pharmacy rule requires paper prescriptions to be routed to doctors for signatures versus central printing with electronic facsimile signature (recommended), at a cost of more than $25,000, including time lost and circulation inefficiencies

An additional recommendation is that EHRs be designed to block patients from manipulating their records for drug seeking behavior or personal financial gain. Providers must have a means to detect forged prescriptions. ACOG believes that an EHR system will enhance patient data security and that it is important for physicians and hospitals to recognize the security benefits of EHRs. Accrediting, regulatory, and government agencies must not erect unnecessary implementation obstacles. Widespread use of EHRs will depend on cost, quality, and access to the system.

ACOG’s Role To support:

• Interoperability of systems.
• A basic standard format that allows for a ready exchange of information.
• Uniform but fluid standard that defines a “continuity of care” record developed by all stakeholders.
• Reasonable protection of EHRs includes adequate sanctions and interoperability.
• The development of new rules and regulations that are not overly burdensome that physicians see as positive changes.
• Systems certification, which could help providers who lack resources to investigate available vendors and systems (vendors would need to meet minimum standards of functionality, interoperability, and security).

Recommendations for Privacy and Security Recognize that:

• EHR systems are more secure than paper systems.
• Compliance with basic security measures and sensitivity to privacy and security can eliminate many breaches from careless dissemination.
• Any system can be breached. Building overly complex protections is not efficient.
• Regulation must be focused on interoperability and legitimate information exchange.

AMERICAN ACADEMY OF PEDIATRICS

The American Academy of Pediatrics was unable to send a representative to participate on this panel. A written statement was read by Mr. Rothstein.

Background The American Academy of Pediatrics is comprised of 60,000 primary care pediatricians, pediatric medical specialists, and surgical specialists who support the design of improved health care systems that help prevent medical errors while protecting patient privacy. Most pediatricians practice in small office settings with limited technology resources.

The Academy advocates for a single national system of provider and practice authentication that leverages the DEA registration process. A single method is needed to secure authenticated encrypted data transport that serves the needs of multiple data types such as immunizations, lab results, prescriptions, health record summaries, and multiple interoperability partners such as public health departments, school systems, labs, pharmacies, other primary care providers, emergency departments, and hospitals. Data sharing and transport require national standards for user authentication and verification of access rights that are supported by audit tools. National standards should also provide a governance process for data stewardship, with a transparent use of medical records data for practice profiling and quality improvement. Noting that there is much to be learned from the Public Health Information Network in Europe, the Academy urges movement toward a single technology in which all interoperability partners convert to a common standard mode of data transport. The Academy also supports the development of a uniform unique national patient identifier as originally specified under HIPAA, especially important in pediatrics because patients often present with no name (e.g., newborns), or with changing names. Recognizing the controversy of a national patient identifier, the Academy suggests that its use be restricted to communications covered by HIPAA. In the absence of a uniform national patient identifier, alternatives must be used to correctly link child health records and to correctly document adolescent privacy rights and changing parental or other custodial relationships.

There are substantial benefits from the NHIN for pediatricians. Obesity management will be improved if growth data can be shared. Recognition of developmental disabilities and provision of services to children with disabilities can be improved through coordination of care and sharing of diagnostics and therapeutic plans. Immunization rates can be improved and the management of ADHD can be advanced. Communication of medication and test results between pediatricians and specialists can prevent duplication of services and patient safety risks.

SUBCOMMITTEE DISCUSSION

In response to a question about overruling a patient’s refusal to provide information, Dr. Keaton said that psychiatric patients are the “toughest” patients. Current HIPAA regulations provide wide latitude for national security and public health concerns. It is important to understand that often, an overwhelming public need is greater than an individual’s right to privacy (i.e., terrorism, SARS virus). Most states have laws protecting emergency care workers. The bigger concern is the lack of uniform response to a patient who poses a public health threat (see transcript for examples). Physicians remain focused on the physical welfare of patients and generally do not get involved in whether a patient has been involved in criminal activity.

Asked about applicability of approach to primary care, Dr. Keaton differentiated the chaotic environment of emergency care from routine primary care visits (see transcript for example). Dr. Cohn wondered about the discrepancy in presentation comments about the high rate of security breaches versus the need for the NHII for public and personal safety. Dr. Keaton responded that breaches could be identified in an electronic record due to logging functions. Dr. Strafford concurred, and reiterated a plea to create a rule with consequences for unacceptable access (rather than ongoing audits) to unburden the system. Dr. Keaton mentioned physician frustration with auto sign out, which, if not done within a prescribed period of time, must be redone; and with using different systems with different passwords. He supported Dr. Strafford’s plea to not add to the complexity.

Dr. Harding wondered about the benefit of plugging a hospital EHR system into the NHIN. Dr. Strafford said his hospital made a deliberate decision to own all the necessary hardware and software due to fear of losing control within a big system. However, when the hospital system crashed, the physician becomes the culpable party if a patient has a bad outcome. A national network holds promise for patient management tools that are currently not available. He strongly recommended the electronic systems model used by the U.S. military. In Dr. Keaton’s “perfect world,” patient data would be registered in a regional or national registry and as such, would be available for confirmation by ambulatory or critical care patients. He noted that discreet data points make it easier to do surveillance (see transcript for example).

Dr. Strafford confirmed that some patients ask to limit disclosure of their information or choose to eliminate certain information from their health record but that with the onset of an electronic format, he knows of no patient who has requested elimination of a screen for HIV, for example (in contrast to such requests on paper records). A physician must talk with a patient who does not want something in the record in order to determine how to accurately document the patient’s medical condition. The question of how to protect sensitive information while ensuring privacy resurfaced. Mr. Rothstein wondered about an emergency information override. Dr. Keaton thought that access to a CCR rather than to the whole detailed chart would be preferable. Least desirable is a record that flags the deletion of sensitive material by the patient. Dr. Keaton emphasized the importance of knowing if a record is incomplete, for whatever reason. He has not personally taken advantage of HIPAA emergency exclusions. However, a good deal of data must be examined for public safety or security reasons that would not necessarily be available without these exceptions. Dr. Keaton mentioned his concern about a patient’s choice to withhold information because the most common occurrence in his department is that of drug seeking or potentially violent patients.

Mr. Rothstein adjourned the meeting at 2:55 p.m.

---

To the best of my knowledge, the foregoing summary of minutes is accurate and complete.

_____/s/__________________________

Mark A. Rothstein, J.D., Chair

___05/11/2005_____________________

Date