[This Transcript is Unedited]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS
SUBCOMMITTEE ON PRIVACY AND CONFIDENTIALITY
Wednesday, June 16, 2004
Hubert H. Humphrey Building
Room 800
200 Independence Avenue, SW
Washington , DC
Proceedings By:
CASET Associates, Ltd.
10201 Lee Highway, Suite 160
Fairfax , VA 22030
(703) 352-0091
TABLE OF CONTENTS
Welcome and Introduction – Dr. Harding
Follow-up on Feedback from Full Committee Regarding Draft Letters on Banking, Law Enforcement and Schools – Subcommittee
Plan for July 14-15 Privacy Hearings on Marketing, Fundraising, and Media Access to PHI – Subcommittee
Subcommittee Schedule for the Remainder of 2004 – Subcommittee
P R O C E E D I N G S [2:50 p.m.]
Agenda Item: Welcome and Introduction – Dr. Harding
DR. HARDING: I’d like to call this subcommittee meeting together and I’m not Mark Rothstein, I’m Richard Harding and on the committee as well as the two other members on the committee. Mark is not here today and we look forward to his return soon. We’ll go around and have everybody introduce themselves real quickly, I’m Richard Harding, I’m a child psychiatrist at the University of South Carolina School of Medicine.
MR. FANNING: I’m John Fanning from the Office of the Assistant Secretary for Planning and Evaluation of HHS.
MR. HOUSTON: I’m John Houston with the University of Pittsburgh Medical Center, member of the subcommittee.
MR. REYNOLDS: Harry Reynolds, Blue Cross and Blue Shield of North Carolina, member of the subcommittee.
MR. RODY: Dan Rody, American Health Information Management Association.
PARTICIPANT: [Inaudible.]
MS. JONES: Lynn(?) Jones, NCHS.
MS. TRENTE(?): Nancy Trente, American Psychiatric Association.
MS. KAPPELER: Evelyn Kappeler, Office of Public Health and Science.
PARTICIPANT: [Inaudible.]
MS. WILLIAMSON: Michelle Williamson, CDC NCHS.
PARTICIPANT: [Inaudible.]
MS. SERTZ(?): Katherine Sertz, representing the Association of American Physicians and Surgeons.
DR. HARDING: Welcome everybody. We just went around and introduced ourselves —
DR. BICKFORD: Carol Bickford, American Nurses Association.
Agenda Item: Discussion: Follow-up on Feedback from Full Committee Regarding Draft Letters on Banking, Law Enforcement and Schools – Subcommittee
DR. HARDING: Welcome. Well we have one hour today because of the going over a little bit and I think that that will be enough time however to carry out the business that we have. We have several things that we must do, one is to make corrections to the letters that we had proposed to the full committee to go to the Secretary, the one letter involving banking was passed intact as I remember, and then we had the school letter which was mainly to just change children to students as I recall. Was there one other issue?
MR. FANNING: Yes, it was also to put into the recommendation on outreach and education reference to working with the states and doing it in a timely fashion because the health officer among us new the problems and details of state health departments working with the school system.
DR. HARDING: And to add some kind of an urgency about the third bullet.
MR. FANNING: Yes, that it needed to be done in a timely fashion to take account of their cycle. I have not yet written that.
MR. REYNOLDS: Richard, I have one question on that third bullet also, in the fourth bullet we reference school health personnel, in the third bullet it’s just school officials, and I thought in most of our discussion we had on the conference call, and I may not, that we really tried to focus in that not just any school official could get it and I wanted to make sure whether those purposefully are different.
DR. HARDING: In the third bullet it says disclose this information to school officials and the fourth bullet —
MR. REYNOLDS: We focused very much on school health personnel, we didn’t want just anybody getting it, up here we just call it school officials and I was trying to decide whether or not that was a purposeful differentiation —
MR. HOUSTON: Where is the immunization information in the student record? Is there a separate student health record or is there a general, I don’t think we ever asked that question did we?
MR. FANNING: No, I don’t —
MR. HOUSTON: You see the issue because if there was just a generalized student record going to be in the student record and therefore I guess it’s open to school officials where I would suspect that there’s not, discrimination between the two types —
MR. FANNING: I guess my off hand reaction is that the distinction is appropriate, I don’t know that we consciously made it when we had the discussion the other day but we consciously changed health information to school health personnel because that was pursuant to the discussion of much more detailed health information about specialized needs and so on. Immunization perhaps is a more administrative matter, is the paper there saying the child has been immunized or is the paper not there —
MR. REYNOLDS: And again I’m good with that explanation, I just wanted to make sure we at least touched on it.
MR. HOUSTON: And if you think about it for a second immunization information, if it’s a yes/no, if it’s a matter of, if you’re not immunized you don’t go to school then in theory every child that’s in school is immunized. And if you’re a school official you’re going to recognize by the fact that that child is in the school that therefore they had to have been immunized. So it’s not like you’re hiding any information from, you’re trying to avoid, on the face of it —
DR. HARDING: Administrative non-medical —
MR. FANNING: However there may be issues, I’m not suggesting that this has to take them into account but are there not instances where the requirement is waived for some health reason and the fact of the waiver may telegraph something. However, it may not be possible to refine a text like this to take account of all of that.
DR. HARDING: I think that in bringing up the topic we’re doing, we’re asking them to look into that —
MR. HOUSTON: Could we say after school officials as appropriate? Or does that just open up yet another can of worms?
DR. HARDING: We could say appropriate school officials.
MR. FANNING: Appropriate school officials. That’s sort of a corollary to the minimum necessary.
DR. HARDING: We’d like to welcome a former subcommittee member, Jeff Blair, to the subcommittee —
MR. HOUSTON: I think he was nominated again to be on the committee —
DR. HARDING: Was he drafted back? We’re always glad to have you Jeff, official or unofficial, and please contribute to whatever you feel the urge, glad to have you. Simon, welcome.
DR. COHN: Thank you.
DR. HARDING: So with those two corrections and with the timeliness issue and as well as direction to the states we’ll have something ready by tomorrow at show time which would be at 1:00.
MR. FANNING: Right, it will be ready well before that, I’ll give it to you in the morning.
MR. HOUSTON: Well there’s probably three or four cases where there’s children identified in the body of this letter, I don’t think there’s any danger in changing that to simply to say students because even if it’s specific to children by saying student the context is still —
MR. FANNING: It’s all about schools.
DR. HARDING: And there wasn’t any issue about minors versus adults.
MR. HOUSTON: I don’t recollect seeing that. But even if there was a child versus a university age or college age student I think if you simply said student I think the context would still be inferred —
DR. HARDING: The other letter was law enforcement and the fourth paragraph where we were talking about diversion, we were asked to kind of tone down a little bit on the definition of diversion by some of the committee members and John do you want to kind of present to us what you have done in the meantime?
MR. FANNING: The fourth paragraph there does describe the functions of that office and that is taken basically from the testimony, I don’t know that it’s literally word for word but that is from the testimony of the witness from that office. However, in view of the questions this morning about what’s categorized as diversion and the like I found the website of the Diversion Office of the Drug Enforcement Administration and copies out a portion of that which may illuminate this issue. According to the DEA diversion cases include physicians who sell prescriptions to drug dealers or abusers, pharmacists who falsify records and subsequently sell the drugs, employees who steal from inventory, executives who falsify orders to cover elicit sales, prescription forgers and individuals who commit armed robbery of pharmacies and drug distributors. At present the DEA points out the largest problem results from the criminal activity of physicians and pharmacy personnel. Yes, that’s instructive by itself but that’s what they say in their presumably official statement. Now does that illuminate this sufficiently for the purposes of this letter?
DR. COHN: Well I think it does though I’m not sure about the last sentence, I think that’s more general, we might do a little better.
PARTICIPANT: That’s not based on fact —
DR. HARDING: If you could please address, the issue of should we add that as a paragraph or just put in some of the footnote and make an asterisk or something —
MR. FANNING: I guess we’re wondering why we should have anything in there and let’s look at what we say at the end. What you proposed to say was to say on certain matters we don’t have enough information to make a recommendation, then it says based on the all written testimony presented at the hearing NCVHS recommends that HHS work with the DEA to educate providers that communicating information about drug diversion or complying with state reporting requirements are permissible under the HIPAA privacy rule. So that’s another recommendation to work closely with another agency and prepare guidance material and the like. One wonders how much substantive background need to be in the letter to support a recommendation of that degree of specificity.
DR. COHN: Well I think the real question was is whether we were describing this as an additional part of paragraph four.
MR. FANNING: Well, it’s background for what this whole thing is. People asked this morning what is diversion, what is the program —
MR. HOUSTON: May I make a simple suggestion as part of the first sentence of the fourth paragraph, they talk about responsible for diversion of controlled pharmaceuticals and controlled chemicals and then rather then ending it there after the period before the by just say physicians, pharmacists, and just simply indicate who is the focus of the drug diversion program.
MR. FANNING: Well, I mean that’s from his testimony and, well, I wasn’t looking for that because I assumed that was to be a fair description. And it’s relatively complicated because they deal with such things as controlled chemicals and that’s not relevant here so I’m not sure —
MR. HOUSTON: But this is a background paragraph, I mean this has nothing to do with the testimony, we can put in there whatever we feel is appropriate so that people understand what diversion, Office of Diversion Control is, so I think it’s fair if you want to identify who the individuals are that this program focuses on —
DR. HARDING: In the form of an asterisk you mean and —
MR. HOUSTON: We could do that, or a footnote, or even just add it to the end of this sentence that indicates that, I think it belongs in the sentence.
MR. FANNING: Again, what’s wrong with the paragraph copied out of their description of themselves?
DR. COHN: I didn’t think there was any problem, we were just trying to figure out where to put it. I thought what you said was fine with the exception of that very last comment about the focus of the activity, doctors and pharmacists, I don’t think that was necessary, but other then that we’re just trying to figure out where to put it.
MR. FANNING: I inserted the phrase the DEA points out, quoting from their website, and this is the bulk of their activity. So yes, we could restructure the fourth paragraph to stick this in the middle but I’m not sure where that would get us —
DR. HARDING: It’s a whale of a couple sentences there. Do we have a suggestion from —
DR. BICKFORD: My concern is that you’re focusing on what the DEA Office of Diversion Control does but have not provided equal opportunity to describe the other folks who testified that were of concern about law enforcement, so my recommendation would be just delete that paragraph and talk about what the testimony actually addressed. Because you’re not talking about National District Attorney’s Association and their discussion, so it’s sort of like it doesn’t fit with the rest of the letter’s content, it’s just sort of plopped in there.
MR. HOUSTON: I think that was put in there because we had concern when we were drafting the letter that diversion wasn’t adequately understood.
DR. FANNING: That’s right, and in fact the paragraph four is basically from the testimony, I don’t know that it’s literally word for word but that’s how the man described the program.
DR. BICKFORD: Well then include that and some of that discussion where it talks about the DEA Office of Diversion Control testified that they’re responsible for, so that it’s imbedded with that discussion rather then standing alone because it’s like well why are you explaining this one and not the others. It’s giving so much weight to this one and that may have been all the testimony was about but I would expect to hear the discussion but would you have similar weight for the other presenters and what their law enforcement initiatives encompass, whether it was diversion or some other initiative.
MR. FANNING: I think one reason for that is that it’s only with respect to this matter that there’s a substantive recommendation, there was no need to have a lot of background to support a recommendation because there are no other recommendations —
MR. HOUSTON: Wasn’t the question this morning though simply asking for clarification as to what the scope of Office of Diversion Control?
MR. BLAIR: Definition of diversion?
MR. HOUSTON: Well, I think the definition of diversion was okay, I thought that we subsequently then discussed what was the focus of that office’s efforts, who or which was as you indicated was physicians, pharmacists —
DR. COHN: Even this was confusing enough without a little more statement, remember some people were saying oh it has to do with people getting 20 different prescriptions and utilizing them which is I don’t think really the —
DR. HARDING: That’s one of the things.
DR. COHN: No, that isn’t, or actually —
MR. FANNING: That is correct, that is not listed here.
DR. COHN: I mean a patient who might go doctor shopping is not included, is not considered to be a diversion, and that I think that was part of the confusion going back and forth.
MR. REYNOLDS: We did hear testimony on that.
MR. HOUSTON: I remember asking the question about —
MR. REYNOLDS: We did hear testimony on that and that testimony and some of the doctors brought up the question that if they said something about their patient would they be putting themselves in jeopardy —
MS. SERTZ: Well, that’s correct, I was saying that first of all the correction is that the acronym is AAPS, you just have an inversion for correction, AAPS as opposed to AAPS. I don’t think this is a fair representation of my concern because the dual concerns, I realize that what you’re trying to get at in the letter were the dual concerns, number one is that doctors are reluctant to do the pain treatment because the information, it’s not a question of whether the information that’s placed in the medical records will be kept confidential, we know it will not be kept confidential, and that the DEA has full access to it basically. The other side of it that you’re bringing up is correct, that the other side of it is then if they have a patient that they suspect is doctor shopping what are they allowed to do, what disclosure are they allowed to make, because in some states they’re required by law to disclose this, to inform law enforcement, but there’s isn’t a procedure on how do they do it and what are they okay doing so those were the dual concerns, that is an accurate, I think that is an accurate representation of our concern about the concern over doctor shopping. As in addition to the ethical issue of do you rat on your patient but that’s not this committee’s concern.
MR. REYNOLDS: But back to the letter I don’t think we were making the recommendation on the ones we just discussion, we were talking about the DEA situation.
DR. HARDING: Well, I think that we’re very close, I mean everybody was in agreement, if we reopen the whole thing, one of the suggestions was that the DEA officer control testified that and then we could then include most of that upper, that fourth paragraph, because that’s what they testified, I think that is a good point.
MR. HOUSTON: I hate to say this is from a stylistic, don’t we want to say a witness from the DEA Office of Diversion —
MR. FANNING: Yes, that’s correct, I noted that.
DR. HARDING: But then how, do we need to define diversion in some way more brief then that paragraph?
MR. HOUSTON: Can we just take the first sentence and move that below the first sentence in paragraph five? And just leave the rest of it out, I mean I think that at least does give you a glimpse into what the Office of Diversion and Control does but it doesn’t really get into that —
MS. SERTZ: May I make a suggestion? You could just insert the phrase prevention the diversion along with that other, with that or you could just put diversion as defined by the DEA Office of Diversion and get out of it that way by just leaving it to their, by making reference to their definition. And also that way it’s fluid should they change it rather then you putting in a concrete definition.
DR. HARDING: With permission, we could editorialize this for a while, would it be okay if John and I come back by morning with a way of trying to smooth that out?
MR. HOUSTON: I think the way this paragraph came into being was it was even bigger as I recollect and we narrowed it down to try to make it even less —
DR. HARDING: I think those comments have been helpful and I think we will try to get that honed down by tomorrow instead of trying to edit —
MR. FANNING: May I just remind the committee again that the recommendation is rather general and does not depend on this or that definition or the activities of the DEA so there’s not a whole lot riding on this, it does have to be informative of course —
MR. REYNOLDS: Richard for purposes of the committee tomorrow we still may want to have on hand what John read off the website to let them understand, whether it ends up in the letter or not it at least puts them in context to what they’re agreeing to.
MR. FANNING: I can even print off their own program description.
MR. HOUSTON: For my own sanity, the committee asked for a specific change this morning, again —
DR. HARDING: What I have down is to define diversion —
MR. HOUSTON: Right, but my concern this morning, I thought they were talking about wanting to have clarity as to who diversion control was focused on, I thought that was —
DR. HARDING: That paragraph has those listed.
MR. HOUSTON: But we’re making it even more general as we’re cleaning this up it sounds like rather then addressing the specific request out of the committee.
DR. HARDING: So we should just define diversion as they asked us to?
MR. HOUSTON: Well, I’m just thinking, I’m trying to remember what was asked this morning and it was —
MR. REYNOLDS: I think what they were asking was on this, they did not understand and they did not understand who it pertained to so what we had in the letter they weren’t ready to go on with it.
MR. HOUSTON: And who it pertains to, we still aren’t answering who it pertains to I guess —
MR. REYNOLDS: But I don’t think they were necessarily asking that they go in the letter, they were asking that before they could agree that what we put in here was okay, that’s why I was recommending John bring, if John brings the paragraph, says this is what it pertains to and that’s why we make this recommendation and see what they say.
MR. BLAIR: I thought the question was a diversion.
MR. HOUSTON: That came from a non-member.
MS. SERTZ: Mr. Chairman, a question. Did you consider in your deliberations on this letter a recommendation that there be additional hearings on law enforcement?
DR. HARDING: We did consider that as one of the things that we would be doing in a cyclical way but not the first thing because we had some other things that we felt were important —
MS. SERTZ: Are hearing before then?
DR. HARDING: Yes, there will be, I think the intent that I’ve assumed and understood is that there will be a cyclical nature to the monitor.
Okay, well I’m glad we got that settled in short order, next issue, let’s see if we can go after another one here.
Agenda Item: Plan for July 14-15 Privacy Hearings on Marketing, Fundraising, and Media Access to PHI – Subcommittee
DR. HARDING: The next is the plan for the July 14-15 privacy hearings and that cyclical nature that we were just talking about, we’re coming up on marketing and fundraising and media access to personal health information which is dynamite kind of stuff actually.
MR. FANNING: Well we are looking for appropriate witnesses, let me just indicate one other event that is to occur at that meeting and that will be a briefing on the security regulation, that will be included too. But we are looking for appropriate witnesses, there have already been hearings on marketing and fundraising and we may, we may look to get those witnesses back to say well you said such and such before, how has that actually worked now that you’ve had some more practical experience. Again, we’re still exploring this and we’ll be in touch with you and the chairman about it but that’s one approach.
DR. HARDING: An example would be the woman from Johns Hopkins who was the head of their fundraising, what’s her name?
MR. FANNING: Well, the woman I remember was Joanne Pollock from Council’s Office. And the media one is brand new and somewhat complex and we are looking for representatives from media organizations but also someone to point out the privacy dimension of a thing and possibly some analysis of the ethical rights and interests of the patients that might be worked into this.
MR. REYNOLDS: I’ve spoken in California about this when it first came up on a panel and there’s a group of health care journalists and they were very, that’s the group I spoke to, they were very focused and had a real good set of questions —
MR. FANNING: Is there a named organization?
MR. REYNOLDS: I don’t know the whole part of it but it’s health care journalists, National Association, she’s going to be able to get you the name. But I think they really, they had put a whole program together and they asked lots of questions and many reporters attended.
PARTICIPANT: John, you may also want to check with George Washington Hospital, prior to the rule coming out all the media folks met with the District of Columbia to talk about this and they were one of the hospitals that most likely gets the local VIPs and were concerned about how they were going to deal with the press, so as a group that gets VIPs they are Washington Center or George Washington, you may have a local center that could relate to that.
MR. FANNING: I was once on a panel in the suburbs of Detroit about this and their issue was professional sports figures and the intense interest in them and this would be at least as intense as political —
PARTICIPANT: This would be the PR person within the institution who has to respond to the media, so it would be no only the people seeking health care information but the people who have to respond to it.
MR. FANNING: Yes, thank you.
DR. HARDING: And anybody who has heard someone talk on this like that panel just let us know, we would like to hear. John, you had a question?
MR. HOUSTON: Yeah, it was related to fundraising. I had sent to Mark some suggestions —
MR. FANNING: A list, yes.
MR. HOUSTON: A list of individuals for fundraising I thought might be appropriate —
MR. FANNING: Yes, we have that and we’re working on that.
MR. HOUSTON: If you’d like I can try to assist and make contact as necessary but I think there were four, five, six people on that list, I went back and queried my own fundraising organization, they sort of did some brainstorming and thought those people might be good candidates to talk.
MR. FANNING: Okay, so we’re looking for witnesses, I don’t know whether each topic is worth two panels, I think we’re going to have to talk a little bit about what’s the correct volume if you will of testimony that we need to make a panel —
DR. HARDING: We’re talking about a day and a half of witnesses and then a half of day of discussion or is that, this is kind of Mark’s decision here, I can kind of speculate —
MR. FANNING: Yes —
DR. COHN: Remember we don’t, we don’t go to 5:00 the second day.
MR. FANNING: That’s right, it’s 8:30 t0 3:00 the second day is what we do if you will and we do have to fit into that the security briefing and there might conceivably be other things that have to be reported on —
DR. COHN: And it might be very good if we have time during the day to sort of think about what it is we’ve heard and try to put that in a little bit —
DR. HARDING: Agree, a little more time.
DR. BICKFORD: Does this chapter encompass the vendors who are providing the web space for personal health record repository? Does that fit in this queue?
PARTICIPANT: No.
DR. BICKFORD: Will that be coming up as a topic in the future? Because as you’re looking at these administrators and the technicians and so on have access to that information in theory with the database and they’re marketing to those individuals to put their health information on their website and what’s the sales behind that and so I think from the perspective that’s another topic in the future.
DR. COHN: I brought that up earlier today and I think the issue of that is obviously a lot of it’s beyond HIPAA, it’s really the issue of whatever, both websites, some of which are HIPAA covered, a lot of them aren’t, I think it’s an important issue but it’s not an issue for July, but if we decide we want to, if we can find some bandwidth to get off on another issue I think that would be an interesting issue to at least understand what’s going on because there’s a lot of self regulation going on out there. So I don’t know if it’s an issue or not, I do know there seems to be a lot of discussion going on.
MR. FANNING: Yes, in my view it’s well worth looking into, it’s not a HIPAA matter and it certainly is not for July.
Alright, that’s the report, thanks for suggestions, send them along if people would care to put them in writing, it simplifies it for me and we have working on this three new staff members, helping me, Evelyn Kappeler, Sarah Wattenberg, and Catherine Lorraine.
DR. HARDING: I was just trying to think of some of the, to have maybe a “victim”, what’s the Congressperson’s name who went through having all her medical records exposed during a campaign in Detroit? Somebody like that who has had a media catastrophe happen about personal medical records would be just interesting to see if we’ve got that covered now in some way or how we should be looking at that. It’s a Congresswoman from Detroit who had a bipolar disorder and in the midst of the campaign in September just before the election the Detroit Free Press ran an expose on her medical records that she’d been hospitalized at one point and it was pretty interesting.
MR. FANNING: I don’t know that story, there was an equivalent one in New York but that, the press got it by an improper disclosure from the hospital although it may raise an issue of journalistic ethics that would be worth discussing.
DR. HARDING: That may be beyond our —
Okay, we’ll keep moving here and then we’ll have some time for discussion if we can get through a couple more things.
Agenda Item: Discussion: Subcommittee Schedule for the Remainder of 2004 – Subcommittee
DR. HARDING: We wanted to talk a little bit about the schedule for the remaining of 2004, additional hearings, and again this is the kind of thing that I hate to do without Mark being here. Kathleen is not here and John has been gracious enough to fill in for Kathleen while she is on special assignment with the, what is the name —
MR. FANNING: The Office of the National, Dr. Brailer’s Office —
DR. COHN: I wish that you had been part of this conversation but we were talking at least potentially there was a date that had been reserved by the Subcommittee on Standards and Security, it was graciously vacated in September and those dates I think are September 22nd and 23rd, and I think the intent was that at least part of that would be taken over by a look at Security, this is obviously an area where the Privacy Subcommittee is willing to lead, it would be John taking some of the lead on that, and the question will be is whether that’s a full day, a full day and a half session or whether or not that might be an opportunity to marry that with another topic. I mean maybe even this the whole website exploration. I don’t know, John, what do you think, I mean these were conversations that Mark and I and John sort of tried to have, I think that that date was okay —
MR. HOUSTON: I don’t think there was an issue with the date, when I saw the emails talking about canceling I thought geez, I know we had talked about using that time for some security, I’m wracking my brains on what we need to do for security because the last go round we really found that security wasn’t as much of an issue as privacy in terms of outcry from industry and others though I think what you asked, what you brought up before I think is really, I’m getting more inquiries about relates to medical equipment and issues with security compliance with regards to FDA controlled medical equipment, things like that, and I think we could put together a panel or two and get some good input there. In fact I got some feedback from individuals that might be good people to talk and have come before that committee.
DR. HARDING: Is the transmission of, transcription to India and coming back into the country, is that security?
DR. COHN: That’s privacy.
MR. HOUSTON: There’s a security component to it —
DR. HARDING: The Markey(?) bill that’s just been, the California bill —
MR. HOUSTON: Well actually there’s other, there’s more then just that bill, in fact I just pulled it up and I asked about it, there’s a bill that Clinton is sponsoring too. I guess the Clinton bill says that if you’re going to send if offshore you have direct responsibility —
PARTICIPANT: Markey requires that the Federal Trade Commission certify that the privacy rules in the country its being transferred to be done, if you’re going to deal with outsourcing then you’ve also got to deal with the workforce shortages that are creating outsourcing and the economics between outsourcing so if you want to zero in on just the privacy thing I’ll warn you there’s going to be a bunch of, from our experience in California you’re going to have a lot of there things coming at you on that particular issue.
MR. HOUSTON: Well I think we need to at least respond, I’m looking at the Clinton Bill now and it says notice to consumers, consumers could opt out of transmission of their data to foreign sources, we couldn’t condition the opt out, there’s a variety of bills and I’m not sure whether we weigh in on them or we stand silent.
DR. COHN: That’s a privacy topic unless you consider the actual transmission there’s something wrong with the wires.
MR. HOUSTON: And by the way, I don’t want to say it’s a trivial security issue but you’ve obviously from a business perspective if you decide you’re going to send data over to India one of the requirements is encryption, everybody is going to go in and encrypt their data. I think that the privacy issue is more of an issue that the public is concerned with.
PARTICIPANT: It’s also an administrative issue to administrate some of the bills that have come forward would be almost impossible —
MR. HOUSTON: It would effectively preclude sending it offshore from what I’ve read.
PARTICIPANT: It could eliminate your ability to do some electronic transactions.
MR. HOUSTON: It doesn’t mean we shouldn’t consider this —
DR. HARDING: — look at that in some way.
MR. HOUSTON: Well let me ask you a question again, what’s the committee’s position with regards to providing opinions on bills that are simply before the Senate or the House? I mean do we make statements about that?
DR. HARDING: We generally try to stay out of the business of Congress, they direct us.
MR. FANNING: I think traditionally the committee has not addressed individual pieces of legislation, I mean it’s conceivable that after hearings and deliberation you may conclude that there’s some gap in the law but I think that’s quite different from a taking up a particular bill. The Administration will express itself on the bills and if the committee had some view on the underlying substance without reference to a particular bill that might be an appropriate item for your recommendations to the Secretary.
MR. HOUSTON: Maybe we should then discuss offshore transmission of patient information as this is a privacy issue —
MR. FANNING: Might it be a topic for hearings in the future?
DR. HARDING: Steve, you were wincing over there when we were talking about this —
DR. STEINDEL: I think it’s generally that we’ve tried to stay away from issues in front of Congress, from the committee making a point on that.
DR. HARDING: But is that tradition or is that wise? Self preservation wisdom.
MR. FANNING: This shows the danger of coming without the statute, the proper thing to do is to go back and find the provision of the Public Health Service Act that governs this, however, the custom does seem like a wise one and again, one reason that it doesn’t work is that things move too quickly for a committee of this sort to begin working on individual bills. If after deliberation you conclude that there’s some gap in legal protection that needs to be filled you can give that recommendation to the Secretary who may want to go to the Congress and say we need thus and thus —
MR. BLAIR: I think there’s another reason also and that is that Congress is a political body and we’ve always been non-partisan, and if they’re debating something and we wind up weighing in one side or another on an issue then we’re no longer non-partisan.
DR. HARDING: I was thinking more of recommending principles to basic legislation as opposed to backing the Markey Bill versus the —
PARTICIPANT: I think the committee could greatly serve the industry and the committee and the privacy rule to look at the different aspects that are creating the problem and what are the positives and negatives and some of the solutions that have been suggested. We had 12 legislatures this year attempt to entertain rules on this, conceivably if one of them passed the rule it would be under the preemption clause of HIPAA, it would be the more stringent rule, and create some significant problems for organizations within that state. So it does point to one of the preemption issues associated with privacy, I don’t think you necessarily have to look at the legislation that’s out there but you could certainly look at the issues and what the problems are and if there were conclusions they’d be available to not only Congress but to legislatures they consider legislation.
MR. HOUSTON: Maybe what we need to do is based upon that is ask Jim or Marjorie their opinion as to whether this is something we should get involved in as Dan indicated or should we simply entirely stay out of the —
DR. HARDING: Or if there’s an appropriate format.
MR. FANNING: Yes, but again, I think we’re back to the same point, you don’t want to get involved in commenting on particular bills but the bills are there because there was an underlying issue and this committee has been very useful to the department in the past in marshaling facts about what’s going on and existing practices which can then be used either in some administrative choice within the department or in composing legislation or in reacting to legislation. So the committee performs a very valuable function in that regard.
PARTICIPANT: Part of the other reasons the committee has stayed out of it as well is because your charter is that you advise the Secretary, which keeps you from sending direct letters to the members of Congress, so that’s just procedurally that’s one of the reasons actually in your charter and you can write the letter saying that any bill passed would include or be concerned with so it doesn’t have to be partisan if that’s the way to go but I think that that probably is what has prevented the committee in the past was that part of the charter.
MR. REYNOLDS: I think at retreat time we are going to talk about marketing, media, and everything else, to me this is information, in the free enterprise world, in other words businesses are setting up arrangements for data that they receive or are custodians of to go somewhere else to be dealt with, that’s a subject that you could have hearings on regardless of whether California passes this, Congress passes, and, because most of in the real world that have done this have assumed that business associate agreement, which are part of the law, give you that protection. So it wouldn’t hurt, just like we know marketing is going on now, we know fundraising is going on now, now we know that data is flowing around which it always has but to try to evaluate whether or not business associate agreements versus whole new ways of doing business versus other countries versus other states, that’s what’s going on in the legislation around the country, not, back to the point, not whether there’s a bill out there we care about. It’s that we know how business is actually going on, business has attacked the privacy bill and put together business associate agreements, is that now enough or does there need to be some changes that we recommend to the Secretary that they do some things that would allow our companies throughout the United States to line up behind it or change their practice so that they would protect themselves, not necessarily be the case.
DR. BICKFORD: What I’m hearing described is sort of tele-health and the committee has not necessarily framed its work in relation to tele-health and the implications in the scenario because in essence, you’re talking about offshore transcription but in essence you’re talking about offshore diagnostics, offshore review of radiology studies, and then to send the transaction back, offshore laboratory, offshore pathology, offshore diagnosing, or distance, so it’s in essence tele-health. So what does that do and a bigger perspective is we’re looking at the National Health Information Infrastructure, it ain’t no more this little box right here.
DR. HARDING: It should be international health, that’s a good point, that’s something that we really should consider for September or the next —
DR. BICKFORD: The federal government has put millions of dollars in further demonstration projects with the military as well as Alaska and the Pacific Rim, its set the precedence.
MR. FANNING: Let me just point out as a matter of information that we funded a study of the special privacy issues involved in tele-health and that’s reachable from the website of the HHS Data Council if anybody is interested.
MR. HOUSTON: How long ago as that?
MR. FANNING: Oh, two years ago perhaps. The principle that we’ve operated under is that doing things long distance does not present any new theoretical issue, the principles governing the use of information are the same regardless of the sequence of their collection or the storage or location. However, it does present a specialized new security and security type problem and this study outlines some of those —
MR. HOUSTON: Well I don’t think the security issue would be an overarching issue, I think it’s in the case of offshore, my example of offshore transcription in India there was a concern over loss of control of the data. That has nothing to do with security, it’s people that otherwise have a right to get at the data for the purposes of providing a service is in question, it’s misappropriating the data for financial gain and that because of the fact that these people are out of the country, the long arm of the law wasn’t long enough to get at them, and so even though there were potentially contractual remedies because these companies had so little relation, these companies were only, there was only a shell that related to their operations in the United States, that it was difficult if not impossible to try to enforce any of our laws on them. I mean again, it’s only a shell in the United States and the transcription companies is sitting over in India, somebody goes to sue them or go after them for criminal basis this company just simply folds and vanishes into the midst, I mean that’s the reality, that’s the real problem here is that how do you reach these companies that really don’t have an existence in the United States other then via the Ethernet.
MR. FANNING: I think we have a lot of ideas here for future hearings, I don’t know that we were necessarily without ideas before but we have a great list of them now.
DR. HARDING: — if anybody has then please forward them to Mark and Kathleen and John.
MR. HOUSTON: I think this is something we do need to address, I agree that, I spoke before a HIMSS panel once on this issue and it’s here.
DR. HARDING: Many, many parts of the tele-health are here and licensing and so forth. Okay, other items for the agenda —
MR. REYNOLDS: John and I both asked, John Houston and I both asked the question today of the Office of Civil Rights and I don’t think it would hurt this committee to hear more from them, we’ve talked about statistics and other things, to understand what’s really going on in the privacy world, what really is happening, what really people are stumbling over because I personally don’t get, this is a personal statement, I don’t get a sense of any urgency that we’re going to get data back, I mean I really don’t. And it may take talking about it more, setting up hearings to do it or at least, because I think there’s a great service that could be done to all the industries right now if they could start, there’s no case law on privacy, zero case law on privacy, and seeing where people are tripping right now is going to help people adjust before somebody trips and falls bad or really trips and gets themselves because there’s no clear definition of what’s happening.
DR. HARDING: I guess you’d have to define what, I mean are the complaints about tripping —
MR. REYNOLDS: We don’t know what their complaints, in other words we haven’t been able to get the, I don’t know, John and I both asked the same question and we’ve asked it numerous times and we don’t seem to be getting, let me say one thing. CMS, let’s take two exactly government agencies, CMS has come out with frequently asked questions, they have really done a good job on the transactions and code sets of helping you not trip yourself or hurt yourself as an industry. It goes quiet when it goes into OCR right now so that’s my concern, it’s not that I want to know the details of anything, I don’t want to know the PHI of the situation, I do want to understand here’s what’s happening, doctor’s offices, here’s the general thing that’s going on in doctor’s offices, I know some of the people in the room would love to know that, and these are the ones that we don’t think really are kind of understanding the law. Here’s what insurance companies, here’s what hospitals are doing, here’s what somebody else is doing, we don’t get that.
DR. HARDING: And here’s what they’re being, what the complaints are about.
MR. REYNOLDS: Again, we don’t want to know specifics, you just want to understand it.
DR. HARDING: Just the input.
DR. STEINDEL: What I’ve heard in the past from OCR was that they really didn’t have a queryable system which I will not comment on what I feel about that. But what I heard this morning was that they put together a queryable system. Now whether they do or not I don’t think we should say anything about the quality of information that we can get from OCR until the group puts together a set of questions that they would like them to answer and let’s see what they can.
MR. HOUSTON: Two things, first of all I think two meetings ago I asked specifically and provided to them a list of things that I thought would be interesting to understand, and I asked that again and then today I actually after she said well I’d like to understand I wrote down on a piece of paper eight or ten things that I would like to see and I handed it to them. So the court request is in.
DR. STEINDEL: The request is in and they claimed this morning they have a queryable dataset. Prior to this when John asked, and I’m well aware that John has asked for these at two meetings in a row, the impression that I got from them was that they didn’t have a mechanism to get at it and now they claim they do. When they come back at the next meeting and they say they can’t answer your questions I think then is the time to react.
MR. HOUSTON: I just wish somebody had said in the beginning geez, it’s going to take us some time and we have a little bit of an issue, rather they said sure, yeah, no problem, and you hope at the next meeting they’ll come up and tell you something and it doesn’t happen. I don’t want to be the one that goes to OCR, I really would have preferred if simply somebody said, at least on the side they said —
MR. REYNOLDS: And one other thing I’d to what John’s saying, there is basic information on a complaint, that’s all we’re asking back for is the basic. The entities that are doing it by category, what they’re finding out, and what’s the misunderstood, what’s the most misunderstood stuff. I mean it really, this is really simple, this isn’t getting into give me by state, this is just getting into what are the issues.
MR. HOUSTON: By the way I did ask for a variety of other things they stated information otherwise, I agree with you, even if I had basics, by section, how many complaints, how many of them, what were those complaints, what was the resolution of them. And then going out and by entity the same thing, how many complaints by entity type and —
MR. BLAIR: One of the things that I would like to see almost piggybacking on your questions, I would like to, there’d be a mindset at OCR of trying to turn around this view of being on the defensive about the privacy regs and coming out with information about what the benefit that these privacy regs have provided to patients. And I sort of feel like your questions, both of your questions, really could lead to the foundation of here’s a good deal of data of the types of issues that have now come up that the privacy regs have enabled us to be able to do to protect personal health record information, because I guess I believe that the privacy regs are a really good thing, they’re not perfect, they’ve got flaws and they’re complex and I understand all of the difficulties but you just don’t, at least I just don’t see anything winding up saying this is really a good thing.
MR. REYNOLDS: The reason I’m a little passionate about it right now is in North Carolina we have put on seminars for our largest employer accounts and they are group health ones since they are self funded, and we’ve put on four so far that have represented probably 900 large companies and there has not been a single question asked by a single one of them during that discussion, absolutely flat out lost, not negative, not positive, and so my point is, my point is that one of the things that we can in this committee is we can make sure that the basic information that will one, alert them, if group health plans are starting to get questioned, standing there reminding them of the law, we actually purchased a tool that they can get a very cheap price to get ready, they’re lost. And so I think we can help the whole industry because the industry really doesn’t know and when it pops somebody, you heard her say, there’s already, I know the exact number of cases because I sat in a session yesterday where they said the exact number of cases that have gone to the Department of Justice. And so the point is there’s frequently asked questions by CMS that help the industry, we just need a similar kind of thing to help the industry.
MR. BLAIR: See my thinking is while that is a good thing that 80 have gone to the Department of Justice, right now a lot of the focus is on the part of the health care industry, the payers and the providers, about feeling on the defensive, that gee, we might get in trouble with the privacy regs. And I just don’t see anything at all about how this is a benefit for patients, it just, I feel both sides of the story are needed and —
MR. REYNOLDS: Jeff, I totally agree, that’s why John and I are asking what are the issues. Because I would say to you, I would somewhat disagree in that I don’t feel at all defensive as a payer, I feel that if I am not giving people what we should give them whoever they are and there have been concerns issued on other payers or other people and they say here’s what should be going on, everybody misinterpreted the law, hot dig, then I’ll change and do what I’m supposed to be doing. So I don’t believe there’s nearly the defensiveness that you think there is, we don’t know yet because it’s going up here and it’s not coming out.
DR. HARDING: And what would be the speculation as to why it doesn’t come out? What’s the defensiveness?
DR. BICKFORD: From my perspective it’s the consistent thinking of the legal system, it’s confidentiality and it’s long drawn out discussions as well, they have to multiple views and excessive investigation and so there may not be any new closure.
MR. REYNOLDS: But they have closed 50 percent of the cases, just give me the ones that are closed.
PARTICIPANT: The resolutions in some of the cases, I mean going to the institutions and having them change their practice, and when we did our survey some of the stuff we didn’t report that was too anecdotal was generally that situation. I’m very surprised that some of the numbers of privacy notices that had to be changed because they weren’t worded correctly. I think that helps because it says okay, privacy notices is one of the keys, but I think they’ve, the dialoguing that they’ve done which is I think in a way a very positive thing is probably the same thing that’s preventing them from doing some of the reporting that you’re looking at. But I think it’s been a very positive one and I think it would help people to know that they were able to go out and get practices changed and I think that’s what you’re asking for —
MR. HOUSTON: Let me say this, NCVHS is here to provide sort of oversight and I think it’s one thing for OCR to decide, I understand that this is all public information that comes out of this committee but it’s one thing to prepare a document expressly for public consumption, it’s another thing to report back to the committee that has accountability for oversight. And I think in that case you can be able to be, I don’t want to say less precise but you can work on data that isn’t, Steve is shaking his head —
DR. STEINDEL: I’m shaking my head because once it gets to this committee it’s public.
MR. HOUSTON: I know, it’s public —
DR. STEINDEL: The same care as reporting to the public.
MR. HOUSTON: It’s one thing to release it to the public, directly to the public, it’s another thing to speak to this committee and provide data. I understand your point, it all ends up —
DR. STEINDEL: The information that’s presented to this committee gets out to the public just as fast as if it’s presented to the public. I mean the key issue there’s somebody in the room who’s probably listening to it and will get it out.
MR. HOUSTON: There’s people in the room now, it’s a fair point.
DR. HARDING: Could we as a subcommittee recommend that the committee be briefed or have some kind of way to ascertain things that are generalized, non-identifiable, something that we could kind of keep up with things in a general way? You’re asking for specifics that you give them a handwritten note, that’s not doing it.
MR. HOUSTON: I’m not sure what you mean.
DR. HARDING: I’m just trying to think of a way to keep things relatively private or if they feel the need to keep that close to the chest for whatever reason —
DR. HARDING: One thing to determine, Richard, is lessons learned. What are the lessons learned? I really don’t care whether it’s 15 of those or one of those, what are the lessons learned out of the privacy bill, with 6,000 complaints, I want to know the lessons learned. I don’t care who they are, I don’t care where they were, I don’t care whether one state is screwing up and another is not, it’s lessons learned. And somebody owes that to the people who are under the jurisdiction of the rule, that’s a fact.
MR. HOUSTON: It’s interesting, if I could ask for one piece of information, I was only allowed to ask for one piece of information, I’d ask for a matrix, a grid, across the top see section of the reg, across the side it’s the type of covered entity. And then in each grid point there’d be the number of complaints, finding, by section. If that’s the only thing I could ask for I’d like just to see that.
MR. REYNOLDS: That’s a huge lesson learned.
MR. BLAIR: John, one of the pieces, obviously they’re gathering some data because they have complaints but I think just as significant as the complaints might be the fact that 4,700 hospitals have now complied with the privacy regs and out of that, of those 6,000 complaints there’s been 700 from those 4,700 hospitals or related to those, and of the, I’m not sure how many practices there are out there but more then 100,000 practices, so I guess part of what I’m trying to indicate is, when I say comply I mean you could also have a statistic, given an estimate of how many people have signed that they have received the privacy information before they’ve received care, that probably is in the millions. And there’s probably certain basic information in that that the American public now has received maybe many times, many more times then they wanted but nevertheless —
MR. HOUSTON: And they never read it though —
MR. BLAIR: That’s another issue, and then maybe, I’m just broadening it beyond just the complaints.
MR. LARSON: I would make the, I think what you’re asking for is very valuable but it’s certainly a two edged sword. My impression most recently as yesterday is particularly in the physician practice area privacy rules are being misinterpreted and what you’re seeing is probably a lot of false negatives because they’re going to great lengths not to run afoul so you’re not going to see the complaints. The link that’s going to come up probably in the next session is to have a national health infrastructure, one of the things that the Brits found and that Dr. Brailer is dealing with, is the question of trust in privacy and balancing whether the system works if you have extraordinary amount of privacy. So in releasing things from OCR I guess knowing is better then not knowing but there will be an impact on see I told you so, there are people getting into trouble.
DR. HARDING: We have about five more minutes and then we have to end. I’d like to open up the rest of the time to public comments or statements, so those in the room, we have a number of people, if there are issues that any of you would like to bring up in a succinct way because of the time limit we’d like to open it up here in these last five or ten minutes. Anybody would like to address a topic that we talked about or a new one that we haven’t talked about here today?
MS. SERTZ: I just have a very brief comment on this. OCR has been downright hostile when I’ve asked for information because I had asked, I had requested information, I was trying to find out within the category of providers about fines levied to get to the end stage and they’ve been hostile as though that were not public information.
DR. HARDING: Today in public representative Susan McAndrew said that there had been no sanctions yet taken by OCR but that they had referred to the Department of Justice 80 cases for knowing violations.
MS. SERTZ: And I was not able to find that out going directly to OCR and asking about it. So I’m just, I’m going to vet that it’s not just the committee’s problem, it’s the people effected by HIPAA who have been unable to get that information because we want to know how doctors are doing with compliance.
DR. HARDING: Others with questions or thoughts. Yes.
PARTICIPANT: I did take a note earlier in the discussion that she said that the GAO Office was going to do a survey on the privacy bill one year out. Is that somewhere that you can maybe find the information or is that going to be as known public as the OCR is giving?
MR. HOUSTON: My understanding was the GAO was really, because of the GAO request they were going to be in a position to do some of the statistics that we had asked for I thought was really what they said, maybe I misinterpreted her statement but it was sort of in conjunction with that they could provide the stuff that we wanted so I’m assuming it’s available.
MR. FANNING: Yes, GAO reports are typically made public, especially if asked for by a full committee of Congress, but they are probably still analyzing the data, it may not be something —
PARTICIPANT: My understanding is it seems in mid-June they were to end their question sessions about now and then that would take them, usually it takes them about a month or a month and a half to put it all together.
MS. SERTZ: And one more comment on the July 14th, 15th on marketing, you raised the issue of internet sites again and actually the internet, the websites do fit into the marketing parameters because most of the websites are driven by commercial backers such as Web M.D. which are really even though they’re informational websites those are marketing websites. So when your information goes in there you will end up getting marketing information from a visit to Web M.D. so I think it would be appropriate to include the websites in the marketing here, they provide personal web space for the personal health record or their health benefits —
DR. BICKFORD: And then they pull from those because that’s part of your contract when you go to the website is that you’re letting them use that information and they’re using it for marketing. And I think that’s hidden to the public, even if the committee just had that on the table that that would be very beneficial to the public to have that on the table.
MR. HOUSTON: If these people are signing up, I mean didn’t expect, they’re authorizing their use of information for marketing, that causes it fall out, frankly causes it to fall, even if, any type of information that’s gathered by non-covered entities, how do I say this, unless the information is collected by covered entities it’s really not marketing data that’s covered by HIPAA I guess is the way to say it.
MS. SERTZ: Yes, but the information then goes to a pharmaceutical company or somewhere else that eventually makes it down the chain to a covered entity.
MR. HOUSTON: Even in that case it’s not, that’s not considered data that’s subject to HIPAA, I mean it’s like if I go do, let me say this, if I go out as a covered entity and buy a mailing list of people in the community for purposes of fundraising that data is not considered to be subject to HIPAA and I can do with it as I please, I have none of the restrictions that otherwise would attach itself.
DR. HARDING: Our time is about up, I appreciate everyone’s input, we will work on the refinements of the letters for tomorrow, hopefully they’ll be short and sweet and get that passed and then we will be meeting here in June. Thank you all for coming and for all that you’ve contributed, I appreciate it. They’ll be probably a two or three minute break and then the Subcommittee on National Health Information Infrastructure will be meeting in this room. Thank you.
[Whereupon at 4:00 p.m. the meeting was adjourned.]