[This Transcript is Unedited]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS
SUBCOMMITTE ON PRIVACY AND CONFIDENTIALITY
February 20, 2008
Hilton Garden Inn
815 14th Street, NW
Washington, D.C.
Proceedings By:
CASET Associates, Ltd.
10201 Lee Highway
Fairfax, Virginia 22030
(703) 352-0091
P R O C E E D I N G S [3:37 pm]
MR. ROTHSTEIN: Good afternoon everyone. I would like to call to order the meeting of the Subcommittee on Privacy and Confidentiality of the NCVHS. For the record, very quickly, we will go around the room and have everyone introduce themselves.
[Introductions around the table.]
MR. ROTHSTEIN: So thank you everyone. We have two agenda items for this afternoon. When we dispense of those then we can break for the day. The first is to reach closure on that introductory paragraph in the approved centennial sensitive health information letter. The second agenda item is to try to figure out what is next on our agenda.
Let us take a look at the word on the board. I will read it for you. It now says with the proposed insertions: Dear Secretary Leavitt, individual control of sensitive health information accessible by the NHIN for treatment purposes is a matter of concern to practitioners, patients, insurers, policy makers, and other entities. It is not currently addressed comprehensibly in current law or policy. Over the course of several years, NCVHS has heard testimony in over fifteen months has deliberated.
MS. BERNSTEIN: I haven’t finished drafting this yet, but yes. That was the idea.
MR. ROTHSTEIN: It was deliberated on this issue. Then it goes basically with what was in the draft before. This letter recommends that you adopt a policy for the NHIN to allow individuals to have limited control in a uniform matter over the disclosure of certain sensitive health information for the purposes of treatment.
MR. BLAIR: Friendly amendment? Maybe we could consider instead of saying not comprehensively it implies that it is addressed. What if it said directly instead of comprehensively?
MS. BERNSTEIN: What is addressed in certain discreet areas for example like substance abuse information has a law that sequesters information on that particular topic for a particular purpose. I think state by state you will probably find various and particularly sensitive information. The VA for example has a special law that now only for substance abuse but for HIV and like cycle cell anemia is still on the books and other topical areas.
MR. BLAIR: I think maybe we are talking about two different things. I was relating it to NHIN in that we do not have federal law that has directly addressed NHIN.
MS. BERNSTEIN: We could just take out the word.
MR. BLAIR: You say currently? I was just thinking that there are some folks that might – there are aspects that could relate to it. That is why I was suggesting the word not directly addressed.
MR. REYNOLDS: Should we say law, policy, or practice to make the point there is no consistent way of being – there is a lot of stuff being implemented, but no consistent way that it is actually being done.
MS. BERNSTEIN: I think that is a good point but a different point than what is made here where it says not directly addressed. Obviously rio-by-rio has addressed the policy. We have to say –
MR. HOUSTON: In that context, policy and practice are roughly equivalent I would think. You could say both.
MR. ROTHSTEIN: You think the word policy implies the private sector?
MS. BERNSTEIN: Do you want to say federal policy?
MR. HOUSTON: Federal policy is the law though in my mind. I think a lot of what HHS does is based upon or as a result of some statutory authority or obligation.
MS. BERNSTEIN: In this case we do not have one, and that is part of the point of why we are struggling with it. There is not anything that tells us what to do about this problem.
MR. HOUSTON: I am not arguing the point that we do not need the word. I was only questioning whether policy and practice are synonymous. That was my only point, not that we do not need policy.
MS. BERNSTEIN: What I am getting out of this is we are talking about the federal level. Right? There is a lot of things happening in the state and in private practice. So do you want to say federal law policy and practice?
MR. BLAIR: Yes. This is addressing things at a federal level. Yes.
MR. ROTHSTEIN: Well, that implies that it addresses other states, which it is not. It is more likely —
MS. BERNSTEIN: Is there no state that has any law or practice or policy?
MR. ROTHSTEIN: Well there are some state laws like the genetic nondiscrimination laws at the various state levels require express authorization before the disclosure of genetic information.
MS. BERNSTEIN: In terms of NHIN, I think that is the point Jeff made.
MR. ROTHSTEIN: There are no NHIN laws. Maybe we aught to just take it out. We could say, individual control of sensitive health information accessible by the NHIN for treatment purposes, and I would add of great concern. I would put patients first. Practitioners are not leading this charge, as you may have noted, and policy makers and other entities.
MS. BERNSTEIN: I chose that word. I don’t think it is the right word that I put there. All of these other people type things and entities are institution type things.
MR. ROTHSTEIN: Instead of trying to parse whether it is federal or state or policy or whatever – we took out the words we couldn’t figure out what to do with. It would now read, individual control of sensitive health information accessible by the NHIN for treatment purposes as a matter of concern to patients, practitioners, insurers, policy makers, and others. Then we put: over the course of several years, we have studied this et cetera.
MR. HOUSTON: I think that works. The only question could be – someone might immediately say, doesn’t HIPAA cover that? We all know that it doesn’t. Somebody might say to ask the question.
MS. BERNSTEIN: Since it is just introductory, I mean, I know that this for treatment purposes, I know that this is what this letter is confined to, but it is very awkward to have the introduction be that sort of way.
MR. BLAIR: Let me clarify why I mentioned it in the first place is all of us are looking at this, and we know that there hasn’t been legislation or regulation regarding privacy in the NHIN yet. When someone in my office read this not knowing that background, they actually looked at this and said we were trying to water down the law.
MR. ROTHSTEIN: We were trying to water down HIPAA?
MR. BLAIR: Yes. That is the reason I wanted to say no there is no law in this area. You can see that in fact is we are trying to strengthen privacy protections. That is the reason I suggested that we make some statement that there is no federal law that directly addresses this issue at this point.
DR. FRANCIS: That is actually why I preferred comprehensively because comprehensively is consistent with having it be addressed in some contexts.
MR. ROTHSTEIN: Well, why do we not specifically say that HIPAA does not apply to many of the entities being developed or the emerging NHIN?
MR. BLAIR: Instead of apply – that one that does not specifically or directly address or something.
MR. HOUSTON: It doesn’t apply because they are not covered entities necessarily.
MR. BLAIR: Let us get those words in there.
MR. REYNOLDS: The reason comprehensively bothers me is because when I read it, it sounds like there are a lot of people doing a lot on it, but nobody has really done it comprehensively. I don’t think that is what we are saying. I agree it needs to be dealt with comprehensively, but it is not because it isn’t already. Nobody is doing it.
MR. BLAIR: I would rather say as you said, either not addressed or not covered.
MS. BERNSTEIN: You want to say that no federal law or policy that covers this issue as opposed to directly addresses?
MS. HORLICK: Even the substance abuse, the part two, that just allows the sequestration of information. It doesn’t really address the NHIN at all. I do not think there is anything that specifically addresses the NHIN.
MS. BERNSTEIN: Although the fact that HIPAA for example does not address it means the same rules apply to NHIN as would apply under HIPAA. It is the same treatment, payment, whatever. It is not that – I do not want to leave the implication that there is no coverage for anything on the NHIN either.
MR. BLAIR: What if you say does not directly cover?
MR. ROTHSTEIN: I think if we are talking about HIPAA we need to use the covered entity.
MR. HOUSTON: We may want to keep HIPAA out of this, and I will tell you why. Some people argue that this is a business associate. It opened up a can of worms for a debate that we are really not trying to start.
MR. REYNOLDS: I would take HIPAA clear out of there.
MR. HOUSTON: My concern is that if you get to that sentence, there could be an argument over whether HIPAA applies or not. That is not what you want to have happen.
MR. REYNOLDS: I would add one other sentence there.
MR. ROTHSTEIN: Let us see if we can reach agreement on this. How does that sound?
MS. BERNSTEIN: It says individual control of sensitive health information accessible by the NHIN is a matter of concern to patients, practitioners, insurers, policy makers, and others, and there is no federal law or policy that specifically addresses this issue.
MS. KHAN: Somebody mentioned of great concern.
MR. ROTHSTEIN: Is everyone comfortable with that? Does that do what we were charged to do? We aren’t done.
MS. BERNSTEIN: We said specifically addresses instead of comprehensively. We took out for treatment. We will get to it in a minute, but it is awkward here.
MR. ROTHSTEIN: Does that make sense?
DR. FRANCIS: I would take that out, and I would recommend that the way we say that is over the course of the past two years NCVHS has deliberated extensively about how best to address this issue.
DR. COHN: The original way may actually be fine, but let me just ask everyone because I’ve always been personally embarrassed that we reference the letter that all of this is related to one set of hearings, which is currently how we have it at this point.
MS. BERNSTEIN: That is the reason I said over the course of some years. Exactly for that point is that I think this is building off not just the hearings from the last few months, but the ones that came before the 2006 letter.
DR. COHN: You are going exactly where I am going. I heard from Marc today that they ran across it during the initial report, and this is something we came back and refreshed and deliberated on.
MS. BERNSTEIN: My understanding was that the 2006 letter was sort of the seminal document which was about a variety of issues that we are now plucking off more detailed versions of them, but all of them are jumping off of the hearings that preceded that 2006 letter also. Is that right?
MR. ROTHSTEIN: Over the course of nearly four years?
MS. BERNSTEIN: At least. I don’t know how many it is.
MR. ROTHSTEIN: Actually it is over four years. The first hearings we started in January of 2004.
MS. BERNSTEIN: I am just looking at my watch because it is my three year anniversary in two days of being at HHS and I know it was happening longer than that. It is at least four years.
DR. STEINDEL: I was just trying to hide in the back until we read the first sentence. I am not comfortable with saying and policy in the first sentence.
MR. HOUSTON: Why were you not at the table when we talked about it?
DR. STEINDEL: I am not sure – they have used the phrase in statements and executive orders and stuff preserving the privacy of health care information. I do not know whether we can consider that a policy statement or not. It is very vague and it is not specific, but somebody might say we did make policy statements in that area. I do not think that removing it detracts.
MS. BERNSTEIN: It does detract, and the reason is that if you say there is no federal law that addresses the issue, you are implying that the letter is going to start recommending federal law, which is not what we are doing. You do not want to say that this is about legislation. It is about something broader.
DR. STEINDEL: Instead of that, why do we not say something like statutory guidance? That would include some regulations as well instead of law.
MS. BERNSTEIN: It implies – it has the same implication that we are about to recommend either regulatory work or a statute or a legislative something. That is not what this letter is doing.
MR. BLAIR: I don’t think that implication is necessary. I think it is a statement in and of itself. I do not think it is reasonable to draw that implication. There is a whole eleven pages of letter that follows this to wind up saying that if you have that sentence there, it makes the implication that is reaching too much.
DR. FRANCIS: Instead of specifically addresses this issue, it addresses this issue fully. That is a little weaker than comprehensively. There isn’t anything that addresses it fully.
MR. BLAIR: That is not the issue that we were trying to fix.
MR. REYNOLDS: I’m not sure there is anything that addresses it partially.
MS. HORLICK: So you said the word specifically there, doesn’t that sort of – if they made some broad statement about protecting privacy, then this would still say policy that specifically addresses that issue. Those broad statements do not specifically address the NHIN.
MS. BERNSTEIN: They don’t.
MR. BLAIR: The problem was that some folks – get forth the point that this letter is trying to move forward the protection of private health information because there is people that begin to look at this whole letter. Without that background of not knowing that federal law wasn’t there beforehand to provide this protection. They thought that the objective was completely different.
MS. BERNSTEIN: What if we skip that whole phrase and just said it is a matter of great concern to all these folks? NCVHS has been deliberating it extensively for over four years.
MR. BLAIR: You’re ignoring the point I am making.
DR. STEINDEL: I’m very comfortable with that.
MR. BLAIR: I don’t know if there is any point in all of the editing.
MR. ROTHSTEIN: If we could have: and others.
DR. FRANCIS: How about instead of how beset to address this issue, say how best to move forward protection of privacy in the new environment of the NHIN. That would make it clear.
MR. ROTHSTEIN: I do have a question on the third line. I would take out insurers. They don’t really care about this issue.
MR. BLAIR: I think you have someone who represents the insurance agency who might disagree with you.
MR. ROTHSTEIN: You are going to get all the information you need to pay bills, and sequestration is not an issue for insurers, is it? I withdraw that. Let me read the first two sentences and see if that is okay, and then we can get to Harry’s addition. Individual control of sensitive health information accessible by the NHIN is a matter of great concern to patients, practitioners, insurers, policy makers, and others, and there is no federal law or policy that specifically addresses this issue. Over the course of four years, NCVHS has deliberated extensively about how best to move forward protection of privacy in the new environment of the NHIN.
MS. BERNSTEIN: I think it is a little awkward.
MS. HORLICK: Could we say expand protection in the case that it is not already there?
MR. BLAIR: Assure, to provide. We are talking about something that doesn’t exist, a new environment. So you can provide appropriate privacy protections within the NHIN.
MS. KHAN: I think John said to provide appropriate privacy protection.
MR. HOUSTON: The appropriate privacy protections through the course of the development of NHIN. Something that says – maybe it is assure. To assure that appropriate privacy protections are incorporated into the NHIN. What you are talking about is making sure that actually as we create NHIN, they are implemented as part of it.
MR. BLAIR: Can I suggest everything that John Paul said, which is fine, just in front of NHIN can we say the emerging domain of the NHIN or the emerging NHIN?
MR. ROTHSTEIN: I think we need how best to assure that appropriate privacy protections are included in the emerging NHIN?
MS. BERNSTEIN: That is good.
MR. ROTHSTEIN: In the course of four years NCVHS has deliberated extensively about how best to insure that appropriate privacy protections are included in the emerging NHIN. Okay?
MS. BERNSTEIN: I’m reading this and I’m going well we are not really arguing about how they are going to be included. We are just saying that somehow they should be included, and this is what they should be. Somebody has got to figure out how to design it in. That isn’t what we did. Is that right? We didn’t really say how to insure it.
MR. BLAIR: What words would you suggest that we use?
MS. BERNSTEIN: I think I would say something more like the types of privacy protections that are appropriate or to the types of privacy protections that are appropriate for inclusion in the NHIN. It is the client we are talking about and not the implementation.
MS. HORLICK: Isn’t it also that we should have the incorporate it up front – incorporate privacy protections in case they are not thinking about it?
MS. BERNSTEIN: I think it is how best to insure that is giving me an issue because we are not really getting into how. We are saying it needs to be there. These are the types of content or the type of policy that we need, but we are not saying how it should get in there except to say it needs to be up front.
MR. ROTHSTEIN: Has deliberated extensively about insuring that appropriate privacy protections include – is that better?
MS. HORLICK: How about we say deliberated extensively about this issue to insure instead of how to do it.
DR. FRANCIS: The reason I had originally suggested to move forward because we aren’t – we have been agonizing about two things. One is the substance, but the other is how to get us into the process.
MR. ROTHSTEIN: I have a better idea maybe. The purpose of our new addition is to show that we spend a lot of time working on this, not necessarily setting out exactly what we are doing because that comes with the rest of the letter. How about the second sentence instead of saying over the course of, just say NCVHS has deliberated about this important issue for over four years.
DR. COHN: Over sensitive health information except individual control since the health information and deliberated over the broader issues of privacy in the NHIN.
MR. HOUSTON: Why don’t we simply say what Simon just said? We have deliberated for over four years over – you said that very articulately.
MR. ROTHSTEIN: Jeff, do you want to comment?
MR. BLAIR: As long as we have within the emerging.
MS. BERNSTEIN: Marjorie was suggesting more fact about what exactly we had done. Part of it is deliberation over a long time. Part of it is we have had bunches of hearings. Part of it is we have meetings and conference calls before we go to this point.
MR. REYNOLDS: On this matter for the last two–
MR. ROTHSTEIN: Do we need to list how many hearings we have had?
DR. COHN: What were some of the earlier versions of this sentence? I feel like we have taken steps backward at this point. I mean a couple of versions ago I thought it was fine. This sounds strange.
MR. HOUSTON: We decided this letter should stay. We have screwed around with this letter for too long now.
MS. BERNSTEIN: Originally we hadn’t finished the sentence when we left the committee meeting. It said over the course of several years, NCVHS has heard testimony in over 15 months, has deliberated –
DR. COHN: I guess I am not looking for when we started this conversation. I was talking about – I though it was just fine even if it wasn’t completely.
MR. ROTHSTEIN: We need to put something together that we are satisfied with. Tell me what is – is the first sentence okay with you Simon?
DR. COHN: Yes.
MR. ROTHSTEIN: So it is the second sentence that bothers you.
DR. COHN: Why don’t you stop for a second there.
MR. ROTHSTEIN: That looks like the version.
DR. COHN: Yes.
MR. ROTHSTEIN: We can go back to that version.
DR. COHN: Okay explain to me what is wrong with this sentence. I think this is better than what we have there.
MR. ROTHSTEIN: I don’t think we need to mildly do anything. I will take it as it is.
MS. BERNSTEIN: Okay, now it reads over the course of four years, NCVHS has deliberated extensively about how best to insure that appropriate privacy protections are included in the emerging NHIN.
MR. ROTHSTEIN: Okay, Harry.
MR. REYNOLDS: In other letters, we have discussed how – if I read those first two sentences and I am in a busy office, I don’t jump on that. We had made statements previously where there is so much development going on currently of systems of capabilities of grants of ONC and others that are actually implementing it. Along with what we are hearing and along with what we think, the industry is moving full speed full speed and implementing these things, which then gives me another degree of they thought it was a good idea and they heard concerns, but things are moving. We said it in other letters, so I am not going to try —
MR. ROTHSTEIN: Well, we actually tried to state that at the very end of the letter. It wouldn’t hurt to put in the first paragraph and maybe the third sentence our feeling of sense of urgency.
MR. REYNOLDS: Leave it like that. It doesn’t make me want to jump on it.
MS. BERNSTEIN: At the end of the letter, it is complex. They have to be developed before local and regional components and finalizes accordingly. NCVHS respectfully urges HHS to begin addressing these issues expeditiously. You would like to put something at the beginning?
MR. REYNOLDS: That is what I am referencing. We had come up with language before.
MS. BERNSTEIN: Okay. Where would you like to put it?
MR. REYNOLDS: We need to say something that says, if this is not addressed now – there is no structure under which is being handled at all.
DR. STEINDEL: I have a little bit of a structural problem saying it there. When we said we just talked about this for four years, then our statement is that we have to move this forward quickly.
MR. REYNOLDS: During that four years, the industry has also begun moving forward and created –
DR. STEINDEL: Well I think we should say it that way. Industry motion has accelerated this to a point of criticality or something like that.
MS. BERNSTEIN: That will work to. I was thinking that we could put the point in the second sentence saying that if the issue wasn’t addressed now, bad things will happen. We have been deliberating for this for four years, and the time is now to act.
MR. ROTHSTEIN: I would think that that would be the last sentence of a first paragraph and then start a new paragraph, which this letter recommends.
MS. BERNSTEIN: The blue part works. I just accepted the previous two sentences we already discussed and agreed on.
MR. ROTHSTEIN: I would move that to the end and make that the last sentence. Take that out and put something at the very end of the first paragraph.
MS. HORLICK: Can we say certified without explaining what we mean?
MS. BERNSTEIN: We can just say systems are being developed.
MR. REYNOLDS: Give me words. I agree. You can debate the words. That is why I am not putting them out there.
MS. HORLICK: I agree with what you say about certified.
MS. BERNSTEIN: We have been deliberating this for over four years. During that time, you want to say the market is doing something.
MR. ROTHSTEIN: Here is a starting point. The increasing rate at which health information exchange is being developed in the public and private sectors makes it imperative to address these issues now.
MR. REYNOLDS: That is what I wanted to say and let Mark say.
DR. COHN: Well I guess the question is, is this health information exchange?
MR. REYNOLDS: How about the rate at which health information is being exchanged?
DR. COHN: I thought the issue was not – we are talking about the NHIN.
MR. REYNOLDS: That is why I switched it.
MS. KHAN: Do we want to say electronic health information?
MR. ROTHSTEIN: Do we need to say during that time?
MS. BERNSTEIN: I was trying to get to the point that somebody said, which is we have been bouncing around for four years.
DR. STEINDEL: I think this adequately addresses that.
MR. HOUSTON: I would say with the increasing rate at which health information is now being exchanged.
DR. COHN: I guess I am getting confused here because there is a lot of data that HIPAA provides for data exchange. That has nothing to do with the NHIN. I think what we are talking about – isn’t the issue here is not health information exchange, it is the acceleration of the development of the NHIN.
MS. BERNSTEIN: For a health information infrastructure more generally. We don’t like that term anymore.
MS. HORLICK: I think it is more than the infrastructure. We are really talking about the NHIN.
MS. BERNSTEIN: So the increasing rate at which the electronic health —
MR. ROTHSTEIN: No, Simon what did you say?
DR. COHN: I was using the NHIN term.
DR. FRANCIS: It is being developed. It is imperative to address these issues now.
MR. ROTHSTEIN: Or it is imperative to address these issues at the beginning of something.
DR. FRANCIS: Before it becomes —
MR. HOUSTON: NHIN is being – the increasing rate of development, I am thinking with advancements.
DR. FRANCIS: How about pace of development of the NHIN?
MR. HOUSTON: NHIN is being established. We know. I do not know if you can argue that there is a pace as much – I would argue – I do not know if there is increase in pace though.
MR. REYNOLDS: Yes there is.
MS. BERNSTEIN: We are arguing speed versus velocity?
MR. HOUSTON: It is status of development. That is my point.
DR. STEINDEL: I think we all realize that the NHIN is kind of an amorphous concept right now. Some of it exists. I was thinking why do we not say with the increasing recognition of the NHIN?
MR. ROTHSTEIN: One of the things that I tried to get in that we seemed to have lost is that the private sector is moving ahead before any sort of controls or regulation. That dropped out.
MR. REYNOLDS: John put a slide up there. They have nine pilots going right now. He has a website that says come on down. Come on down and build what you want.
MR. HOUSTON: Is it the NHIN or is it a —
MR. REYNOLDS: When he says the NHIN is the network of networks, you will have the NHIN when four networks hook together. You will have the NHIN, and none of them will look like the NHIN.
MS. BERNSTEIN: Electronic health records and the development of the NHIN?
MR. ROTHSTEIN: Electronic health record networks?
MR. HOUSTON: Yes.
MR. REYNOLDS: I’m good with that. I would get rid of is being developed. We have an issue in about every sentence.
MR. HOUSTON: These are not issues we are trying to address. It is functionality of requirements.
MR. REYNOLDS: I like requirement.
MR. ROTHSTEIN: It is not policy. It is requirement.
MS. BERNSTEIN: Well it is a policy before it gets to be a requirement. We say to adopt or incorporate privacy? That is more prescriptive than we are being. It implies that we are imposing on the private sector. We are not there yet.
MR. HOUSTON: It is how you are going to handle sensitive data. These are requirements.
MS. BERNSTEIN: I was going to get back more to what Harry was getting at.
MR. REYNOLDS: How about imperative to include this functionality in the ongoing development or something like that?
DR. FRANCIS: How about just saying addressing these issues is a matter of some urgency?
MR. HOUSTON: Can we use the word concern rather than issue since it is the word that we used in the first sentence?
MR. REYNOLDS: Why don’t we say it is individual control of sensitive reference?
MR. ROTHSTEIN: Then the rest of the letter – you read the very next sentence. If we use imperative, it has to be it is imperative to address these concerns now.
MR. REYNOLDS: It is singular up above. We are saying address them. We are not saying you have to do it. We are saying address it and make it affirmative that it is going to happen.
MR. ROTHSTEIN: Everyone okay with that?
DR. COHN: What concern are we addressing? Individual control of sensitive health information accessible by the NHIN is a matter of great concern to patients. That is the very first opening sentence.
DR. FRANCIS: The word we actually use though is matter. The parallel word would be matter.
MR. HOUSTON: Address this matter now.
MR. ROTHSTEIN: The last question I have before we quit on this is, do you think we have satisfied the charge that we were given?
MS. BERNSTEIN: I was recalling the conversation that happened before Larry said he liked the context. What was happening was several members of the committee were describing meetings that they had been to at which these issues were raised. John raised something. Jeff talked about something. These issues are arising in a variety of different meetings. People are talking about them. I think it was in response to Marc Overhage’s comment that we do not have any evidence that this is the issue yet. They were saying it is arising, and what I got out of it was there must be a concern because everybody is talking about it. I do not think we have captured that exactly, but maybe other people took something else from that conversation.
MR. REYNOLDS: No, Larry’s charge to us was – we each went around the room and we said we know this is going on. We heard it. We have seen it. Before in the letter it just kind of says, do this.
MR. ROTHSTEIN: I personally think – as long as we have reached an agreement now I think the next step is to get a clean copy to the executive committee.
DR. FRANCIS: I just want to say if anyone raises any concerns about this at the executive committee about this paragraph, I am happy with any version of this paragraph including no version of this paragraph because I want the letter out.
MR. HOUSTON: I believe the way the motion was approved was it was now up to the executive committee based on his wording to approve it and modify it as necessary.
MR. ROTHSTEIN: Correct. So the Executive Subcommittee may chose not to do anything with it and just to approve it. Simon, are you okay?
DR. COHN: I’m not sure about the last sentence we were working on.
DR. STEINDEL: Just a point of information, does this count as Justine’s 100th letter now or after?
MS. BERNSTEIN: It depends on whether you give double credit as someone suggested for the other uses letter.
MR. ROTHSTEIN: I have another issue that I want to bring up in the last few minutes of our meeting. We now having dispensed with this have no currently pending items on our agenda. I think there is another letter that we need to produce in parallel with this that I didn’t want to bring forward for obvious reasons until this was approved. The other letter deals with the issue of the disclosure of sensitive health information by the NHIN for uses beyond healthcare. We have recommended here that there should be a way for individuals to control their information by sequestration when the health record is disclosed to another provider. Suppose an individual applies for a job or a mortgage or a life insurance policy or something else and they are required as a condition to sign an authorization for disclosure of their health records and the have previously elected to sequester some of that information. The issue now rises to, does that sequestered information automatically go to the requestor by the authorization, or does the sequestration remain in place? I think that is a very important issue. We may not be able to get action on the issue of sequestration unless there is some comfort level on how we resolve that issue.
So, for discussion purposes, I have prepared a draft letter that deals with this issue. This is just so we know what the concerns are.
MR. REYNOLDS: Leslie is the only one on the committee who will have been here three years.
MR. ROTHSTEIN: So this is a much shorter letter. I would say it is much less controversial. I know more than to say that. Let me just direct your attention to page two where I have the three recommendations beginning at the bottom. Rules developed for the NHIN should permit authorizations for the disclosure of health information by the NHIN to include sequestered information to the extent otherwise permitted by law. Sequestered information disclosed by the NHIN should be specifically identified and included information should be a notice indicating the sensitive nature of the information. Three, any entity receiving sequestered information by the NHIN for authorization should be prohibited from redisclosing the information without an additional authorization from the individual.
Obviously this just being sprung on you, it is not appropriate to do anything with this other than to ask the members of the subcommittee whether they think this issue is worthy of our next round of attention. The position I am suggesting here is that the people who are the entities requiring the release of information. Let us say an employer should be able to condition the job on the release of information including sequestered information to the extent that it otherwise is permissible under law for them to do that. If they cannot get access to that information, people hide all sorts of stuff that insurers and employers and others wouldn’t get access to and might erroneously hire people who have all these health conditions that could screw things up. That is why I think this important. I think it is a companion to the first letter.
One of the objections to the first letter in the larger community might be access by the NHIN to information for other purposes.
MR. HOUSTON: Have we decided that other uses of information for purposes other than treatment decided what the rules should be generally?
MR. ROTHSTEIN: No. We have had a hearing on this, but we have not decided yet.
MR. HOUSTON: How do we then make a jump to talking about sensitive information in drawing conclusions about how it should be managed for treatment purposes when we have not necessarily made recommendations about uses generally of health information for non treatment related purposes?
MR. ROTHSTEIN: We did address those issues in the 2006 letter. That is where our discussion of contextual access criteria came in saying that when you have an authorization to release information, there are no limits on what is released and all of that stuff. We recommended at that point that the secretary undertake efforts to determine whether there are ways in which only relevant information could be released. This is sort of a follow-up of that.
MR. HOUSTON: We are still talking pursuant to an authorization though?
MR. REYNOLDS: I would like to be able to tell you tomorrow what I think. I see your recommendations, but I am struggling to put them into context. You wrote it, so you went back and studied it. I am less interested in your recommendations and more interested in how you build up to them.
MR. ROTHSTEIN: All that I really care about now is whether you think and you may need a night to think about it as to whether this is an appropriate topic to take up next or whether we should wait and let the new committee or new chair come up with the agenda.
MR. HOUSTON: To mature my point a little bit, this is all discussed in the context of authorization. There are currently today permitted uses under HIPAA of data for purposes other than treatment that do not require authorization. I guess my question would be do we generally need to study those other uses that do not require authorization in the context of NHIN to determine whether they would also be appropriate? We sidestepped the issue in the last letter that we did.
MR. ROTHSTEIN: I think that is a very good point. The choices are including that in this letter, or come out with a third letter.
MR. HOUSTON: I think there is a third letter. The question is which one comes first? I suspect that you might argue that what I described needs to come first.
DR. FRANCIS: What I am stewing about a little bit about is whether this in fact has too much in it already. I think that the question of if there is sequestration, then there is a question of disclosure to third parties. It may matter what the third party is. For example, when I am applying for a gun permit or a public safety, it seems I shouldn’t be permitted to sequester certain kinds of information for public safety reasons. That is different from the question of what is permitted by law. For example, when I apply for life insurance.
MR. ROTHSTEIN: It is a fair enough point.
DR. FRANCIS: Part of it is to the extent permitted by law. There is also to the extent required by law. That is different.
MR. ROTHSTEIN: There are certain requirements. If you apply for a job as a schoolteacher, for example. A preschool teacher, they want to check your record to make sure you are not a child abuser and so forth. On the other hand, if you apply for a life insurance policy, you are not required to do anything, but they are permitted to do lots of things.
MR. HOUSTON: In thinking about this and reading this letter a bit further, I wonder if the letter is even appropriate and I will tell you why. Were these types of disclosures pursuant to an authorization to entities for the purposes you described? The question I immediately have is, if someone wants this information they should go to the source. I will give you a great example. It does not necessarily directly apply, but it is a good example to use. If law enforcement wants to go and inquire about your medical record for some law enforcement purpose, they need to go to the entity that was the originator of the record with a subpoena or whatever documentation they need. By being able to go to anybody that can access that record, it does two things. One, it circumvents an important process that exists. Secondly, you may not get all of the information that is relevant. It is still up to the source of the information, I think, to make these types of disclosures that you described. If an employer wants to know something about an employee, they should go to the source.
MR. ROTHSTEIN: Let me just very quickly contrast the way things are today under the law versus the way they might be next year within NHIN. Today, I apply for a job doing whatever and as a condition of employment after a conditional offer, the employer can require that I sign an authorization. Today, that authorization probably would go to my PCP who would send my file and it can be the entire file to the employer.
In the future when we have networks, they can require that I sign an authorization to disclose all the information that is disclosable via the network.
MR. HOUSTON: That is the more fundamental question. Should they be required to disclose that information? I do not know that that is the case. I would argue to the opposite. I would argue that if your employer has an authorization, your employer should go to the sources of information in order to request the record.
MS. BERNSTEIN: That means ten to fifteen sources. In order to know who they all are they have to go to the pointer system that tells you where they are.
MR. HOUSTON: I have a real problem – I am not comfortable with saying –
MR. ROTHSTEIN: Let me just bring this to a close because other people need this room. Based on what I hear, there is not a groundswell of support for taking this up immediately. Therefore, I will leave this to you as a parting present to consider at the appropriate time if you so desire.
MR. HOUSTON: This doesn’t mean that we shouldn’t bring this up. I just don’t think this is a slam-dunk.
DR. FRANCIS: Will we have a little time tomorrow to do a little trolling about issues for the subcommittee?
MS. BERNSTEIN: Between 12:00 and 1:00.
DR. FRANCIS: Could we do that?
MS. BERNSTEIN: We are going to adjourn early.
DR. FRANCIS: It seems to me we should spend a little time employing the collective wisdom of those who are here to in particular go back to the secondary uses. It is of course what you are raising is a secondary use. There are other secondary uses as well that raise extraordinary privacy questions also within NHIN.
MR. ROTHSTEIN: I think tomorrow is going to be hurried. What I would like to suggest is that we arrange a conference call of the subcommittee and charge people in advance of the conference call to be thinking about what our agenda and projects should be.
DR. CARR: I would like to suggest that we make a grid of each subcommittee and each topic that are being entertained and try to see what groupings and what prioritization because having just come from populations, there is a lot of topics out there. To our point this morning of the finite resources that we have and the need to prioritize in terms of our resources, expertise, and alignment. I think we need to pull this together because where we leverage —
MR. ROTHSTEIN: Good point. Thank you, and the subcommittee meeting is adjourned.
[Whereupon, as of 4:52 pm, the Subcommittee on Privacy and Confidentiality meeting was adjourned.]