[This Transcript is Unedited]
Department of Health and Human Services
National Committee on Vital and Health Statistics
Subcommittee on Privacy, Confidentiality and Security
June 19, 2013
National Center for Health Statistics
Hyattsville, MD
Proceedings by:
CASET Associates, Ltd.
Fairfax, Virginia 22030
caset@caset.net
P R O C E E D I N G S
MS. KLOSS: So Bruce, you turned it back to us.
DR. COHEN: Yes.
MS. KLOSS: It think we have dispensed with all formalities of introducing, convening, and adjourning and declaring no conflicts. Consider this the Population Subcommittee – whatever – Privacy, Confidentiality and Security Subcommittee is now in order.
Our first, we have four items on the agenda. One was the themes and outcomes from the April/May Joint Roundtable Meeting, which I think we have beaten to death. So let’s just move right onto our second item, which is a practical item and I think we will all appreciate that, but we will appreciate your input on it too.
Walter brought this to our attention and he is a member of this subcommittee. He had a discussion with Leon Rodriguez recently at one of the meetings that they all go to. Leon Rodriguez indicated that OCR would have an interest in having NCVHS provide input or assess the status of progress toward compliance with the Omnibus Privacy Rules.
Now it sounded like we had a lot of data gathering going on with OCR, but compliance with the privacy is really part of the charge of NCVHS under its HIPAA set of charges. So we wanted a little bit of time of the subcommittee to think about whether there are some areas that might make a contribution. Two of them kind of were top on our list, not so much how providers are moving along towards the September 23rd deadline, because I don’t think we could gear up to have a hearing to do anything substantial in that short window, but there is the accounting for disclosures issues still hanging out there. I don’t think this committee has had a substantive discussion on that for some time.
Then the second, which we touched on earlier, could we help frame some guidance, some practical guidance, on minimum necessary. Just helping to interpret that because I think as soon as something comes out about claims attachment, this issues is going to raise its head. For some reason it hasn’t been prominent. So maybe there are some practical work that we could do on areas that are out ahead of this Omnibus.
I feel, and It think Walter agrees with this as a member, our subcommittee has come obligation to work on some of these other areas of privacy, beyond what is suggested through our initiatives regarding community. We wanted to take some time to think about where we might have some opportunity. I am looking particularly at Jack because I think you will help us a lot in that discussion.
MR. BURKE: Is the accounting of disclosure issue both the two-parts, the acknowledgment of permitted practice – permitted disclosure, which did not require consent, as well, the unintended disclosure?
MS. KLOSS: I am not sure what you mean by that.
MR. BURKE: What I mean is there are two kinds of disclosures. There is the inadvertent disclosure – did something you should not have done.
MS. KLOSS: That is a breach.
MR. BURKE: And then there is the disclosure which is permitted, which does not require advance consent.
MS. KLOSS: But you still have to account for.
MR. BURKE: But you are still obligated in an accounting of disclosure requested by an individual to disclose both kinds. So we are talking about both.
MS. KLOSS: We are talking specifically about the accounting for the routine disclosures.
MR. BURKE: Those permitted without consent.
MS. BERNSTEIN: Treatment payment, operation, the treatment disclosures that are now under the law, have to be accounted for.
MR. BURKE: Non-TPO. Is the request from government agencies? TPO, there are categories of TPO’s that are typically government requests, investigatory requests, things that we are not required to seek and receive an authorization from the member or an individual to disclose.
MS. BERNSTEIN: Right, but there is a change in the law though that are going to require those treatment ones to be accounted for. But Rulemaking has not come out yet.
MR. BURKE: Those are the ones we are talking about?
MS. BERNSTEIN: We are talking about anything in the upcoming rulemaking, I assume.
MS. MILAM: So we are evaluating writing a letter to help inform that rulemaking to provide information or suggestions. I want to make sure I understand what is on the table.
MS. KLOSS: We have not talked about a specific action. It is really a question, is there something we can do to contribute. This is a very high stress point in provider organizations. They don’t know what that is going to mean. They certainly anticipate the workload from that to be substantial. It has just been one of those unknowns that has been hanging out there for some time.
DR. FRANCIS: It seems to me that we would need to know what the status is of the rulemaking. If there is a rule that is just about ready to come out, there is no point, or at least unless we –
MS. KLOSS: We would not be able to say anyway, right?
DR. FRANCIS: I know you would not.
MS. BERNSTEIN: I think if Susan McAndrew were here, which she hasn’t been today, I don’t know if Rachel would be able to say if she were still here, they could give you a sense of whether something that the committee would do in the time period that the committee could do it, would be helpful or would not be timely or would not be –
MR. BURKE: Give us some guidance.
DR. FRANCIS: Recommendations with respect to TPO and accounting for disclosures.
MS. KLOSS: Is that something that you could help us with Maya? Have that conversation.
MS. BERNSTEIN: I can get an answer to that question whether they think it would be helpful. I guess we need to know in what timeframe you thought that the committee could act.
DR. FRANCIS: Minimum six months.
MS. KLOSS: If they have a draft of this – I guess it can’t be shared for comment before it is made public.
MS. BERNSTEIN: It cannot be.
MS. KLOSS: This is a high priority.
PARTICIPANT: Can I add a little dynamic to this which is that from the Health Information Exchange and Meaningful Use objectives, at least in one state that I am aware of, that there is a centralized function related to accounting of disclosures being considered and that is built on a framework of leveraging the TPO principles of HIPAA in a clinical exchange environment. So there is an added flavor of complexities that we probably need to be thinking about here.
MS. KLOSS: As a revenue stream?
PARTICPANT: No, as doing the right thing for the patient in an overarching manner in a centralized fashion even when the data is not centralized.
MS. MILAM: Another thing to think about. There are all sorts of operational issues that we could flesh out with respect to the new requirements in the Act to help inform the reg. But another piece of this is the patient end. Patients don’t really understand that they have the right to request these accounting of disclosures.
So as OCR, part of their charge under HITECH is to educate consumers, as we have heard about today. As they start to educate consumers about requests for accounting, people will start to get these accountings with all sorts of disclosures that they had no idea about. They will need to understand them and understand what is out of the ordinary. Incidents should be listed even if they don’t rise to the level of a breach. They won’t be notified if it is an incident and not a breach probably.
So how to deal with it from the patient perspective, might be helpful.
MS. QUEEN: Sounds like another video.
MR. BURKE: I think one of the bigger surprises will come from accountings which are driven by a privacy board waiving an obligation for consent because it was deemed to have minimum risk. Nonetheless, that is a disclosure. That is a good example.
MS. KLOSS: So as an action, could we pose the question whether the NCVHS could do anything to assist with clarifying any aspect.
MS. BERNSTEIN: I am staring at my supervisor to see if she is nodding at me or going that is crazy. I think we will work it out for you and we will get you as much information as we can, appropriately do about whether it is useful for the committee opine on accounting of disclosures future rulemaking.
DR. FRANCIS: It would also be helpful on the question of minimum necessary because that has come up with respect to the earlier discussion and public health. It is clear that we have plans to do some thinking about it in the scope of the community health data use but the reasonable scope – any thoughts that anybody has on that would be very helpful.
MR. BURKE: From a practical perspective, the rule we have been following is to respond to the question that was posed, resist attempts to be overly helpful by disclosing information beyond that.
MS. KLOSS: That has been the guidance from time immemorial but it has gotten away from that as standard practice. In some ways it would be useful to move back toward that. Now there are so many release of information operations that just are taking a lot more information than – disclosing a lot more than is being asked for.
Okay, there was one other idea on a privacy topic of some import that the question was whether there was anything that our committee should do about it. Ob, again, this was part of the Standards carpool discussion.
The privacy implications of the new health insurance marketplace. Are there any issues there that the committee could be contributing to?
DR. TANG: Do the people actually – I think they put in stuff so they can see comparisons, right, but does anybody actually store that and it goes somewhere to view?
MR. SOONTHORNSIMA: Yes, the FFM, the Federal Facilitative Marketplace, the state exchanges. So keep in mind in our conversation, we are saying these are some of the things we want to think about down the line, but right now to act on these things are changing so rapidly. I am not sure if we would be effective to gather enough –
MS. BERNSTEIN: Are you talking about the exchanges?
MR. SOONTHORNSIMA: We are talking about the health insurance exchanges.
DR. TANG: Health information stored that is identifiable and who has access to that.
MR. SOONTHORNSIMA: Well, you have got the Federal Facilitative Marketplace – this is the FFM.
DR. TANG: Do all the plans –
MR. SOONTHORNSIMA: The plans are going to have the eligibility information, yes, when the government sends it back. But the question was really a little bit more general. Yes, that they will have the data, the information about the people who are purchasing. They have to collect a lot of information in order to run against the hub, this hub is going to ping the Treasury Department, the Homeland Security, IRS, and magically comes back and say, you are qualified for subsidy. So that information is collected in a nutshell.
MS. BERNSTEIN: There are several kinds of matches that have to happen in order to establish eligibility. One of them is income match, one of them is prior health insurance, some of that data is going to come – income data either from the IRS or even from the Administration for Children Families, which has something called, National Directory for New Hires. It is not clear whether there is access – whether the department can use the data there. It is controlled by statutes in the similar way that IRS data is controlled. It is not clear as to whether they could use that source of data.
MS. KLOSS: I don’t think that is part of the Marketplace, though. I thought it was IRS and Homeland Security.
MS. BERNSTEIN: Homeland Security for immigration status – whether somebody is legal. So income component, a health insurance component, an immigration component, several components that all have to be matched to establish somebody’s eligibility.
MR. SOONTHORNSIMA: That is a hub.
MS. BERNSTEIN: Both for the part that is not subsidized and for the part that is subsidized – there is a means tested part. And yes, there are lots of privacy implications in that.
DR. TANG: Does a plan get access to prospective customers and/or –
MR. SOONTHORNSIMA: What is supposed to happen – and there are different ways to do this – but one way is for the consumer to go online and enter their information and start filling out the application. Then once they click a button, wherever that is going to be, it is going to be sent to this hub in order to check, like Maya said, all these different entities in order to come back and say, yes, you are qualified for subsidy. Then when they submit that application, page 34 will be sent to the issuer.
MS. KLOSS: And you have signed some kind of consent.
MR. SOONTHORNSIMA: That is right. I left out a bunch of stuff like selecting the plan that is appropriate for you. Listing all the health plans that post the products out there at various levels(?) but I just want to touch on those key points that have implications.
MS. BERNSTEIN: I think that we might – the next meeting of this group – are we meeting in September?
DR. FRANCIS: Yes.
MS. BERNSTEIN: By that time there is supposed to be – by October we could get somebody to make a presentation on that.
MR. SOONTHORNSIMA: Let me tell you how the context came up, the last two days we were talking about standards and we raised the question about the 834/820, and these come within our purview, and asked a question around when are these changes – are they anticipating changes coming down the pike. The answer was right now we are going to be leveraging the existing 834. Now 820 is new – that is morphing.
But it is likely down the line they will have to adjust that but that won’t be – way down the road. Again, the conversation kind of morphed.
MS. BERNSTEIN: Are you asking whether there is a timely opportunity for the committee to weigh in on that because that is much harder, everything has to be done by October.
MS. KLOSS: I was kind of leading to exactly where you ended up. I think it would be useful for the committee to get a higher level overview of that because it is one area that down the road it has some potential impact and opportunity.
DR. FRANCIS: Can I bring one other up? We were talking at lunch today, and I want to make sure that people don’t forget about this, the wellness programs and the potential privacy implications there. Because the employer won’t know the details of why you either did or did not qualify for the wellness discount but they will see your paystub and if the deduction in your paystub does not include the wellness premium they will know, for whatever reason, whether it was that you chose not to participate or that you did not qualify, they will know and that is a big privacy question in my mind worth being aware of. We might want to think about that – I don’t know.
MS. KLOSS: Okay, it is 5:30.
MS. BERNSTEIN: I was just going to follow up on what you were asking Linda, about getting an overview looking forward. It doesn’t sound like it is necessary to do right in September, because they will be scrambling at that time. I just want to know could we do it in November.
MR. SOONTHORNSIMA: To be honest with you, I think we probably should wait until next year.
MS. BERNSTEIN: If you wait a little longer you will have a better sense of how it actually fell out. What actually happened and how things are moving along. If you don’t need it right away my sense is it would be easier not to ask them.
MS. GREENBERG: Just one comment here from the executive secretary’s point of view, is tomorrow when you report out it would be very helpful to know whether any of the subcommittees – well, we have two subcommittees here, well we have Standards represented, too – so any of the subcommittees have any desire or need to meet this summer before the September meeting.
I think Standards is planning to have a tag-on subcommittee meeting with the September NCVHS meeting. Because the fiscal year ends September 30th so we need to know now whether anyone else in planning to meet.
DR. COHEN: We haven’t talked about it yet. Sally and I will talk about it. When is our Executive Subcommittee? When is that scheduled for?
MS. GREENBERG: We aren’t, right now, planning an in-person executive subcommittee. We will have a conference call. We haven’t polled for it but we will.
DR. COHEN: If we have one of those soon maybe we can talk about it in there. But I will talk with sally about it.
MS. KLOSS: Our earlier discussion had been doing something in the fall, and it would be after October 1st. We are not going to have a meeting this summer.
MS. GREENBERG: I am not encouraging it I am just asking.
MS. KLOSS: Anything else?
We are adjourned.
(Whereupon, the subcommittee adjourned)