[This Transcript is Unedited]
Department of Health and Human Services
National Committee on Vital and Health Statistics
Subcommittee on Privacy, Confidentiality, and Security
November 13, 2012
National Center for Health Statistics
3311 Toledo Road
Hyattsville, MD 20782
Proceedings by:
CASET Associates, Ltd.
Fairfax, Virginia 22030
caset@caset.net
P R O C E E D I N G S (4:00 p.m.)
DR. FRANCIS: This is a meeting of the Privacy, Confidentiality, and Security Subcommittee. On behalf of Linda Kloss and myself, who are the co-Chairs, welcome. We should go around and introduce ourselves. I am Leslie Francis, and I am at the University of Utah and I am a member of the full Committee and I co-Chair this Subcommittee.
MS. KLOSS: Linda Kloss, a member of the full Committee and co-Chair of the Subcommittee, no conflicts.
DR. TANG: Paul Tang, member of the full Committee and Subcommittee, no conflicts.
MS. MILAM: Sallie Milam, member of the full Committee and Subcommittee, no conflicts.
DR. GREEN: Larry Green, member of the Committee, no conflicts.
DR. MAYS: Vickie Mays, member of the Committee, member of the Subcommittee, no conflicts.
MS. CHAPPER: Amy Chapper, CMS, staff to the Subcommittee.
MS. KAHN: Hetty Khan, NCHS, staff to the Subcommittee.
DR. SOONTHORNSIMA: Ob Soonthornsima, member of the full Committee, no conflicts.
DR. SUAREZ: Walter Suarez with Kaiser Permanente, member of the full Committee and member of this Subcommittee and no conflicts.
MS. GREENBERG: Marjorie Greenberg, National Center for Health Statistics, CDC, and Executive Secretary to the Committee.
DR. FITZMAURICE: Michael Fitzmaurice, Agency for Health Care Research and Quality, liaison to the full Committee, staff to the Subcommittee on Standards and Subcommittee on Quality.
MS. KLOSS: We thought we would proceed with our brief time, even briefer now, to work together and just take 30 minutes, no more than that, and work through the recommendations to this letter. Then we will circle back and show you the changes that we have made throughout the body of the letter.
And then we want to take the balance of the time and talk as a subcommittee about what recommendations we might make and how we might lead the discussion of where we go next. So if that is a game plan, we will try to limit ourselves to 30 minutes to finalize the letter.
DR. SUAREZ: What recommendations we make in the letter?
MS. KLOSS: In the letter.
DR. SUAREZ: In the letter, or in addition to the letter?
PARTICIPANT: Then you meant what you are going to recommend doing next.
MS. KLOSS: Yes, the work of the Subcommittee.
DR. FRANCIS: We have been working through the letter starting at the beginning, and we have made, we think, all the changes that were recommended, and we will run through those very quickly with the Subcommittee. This is with Maya’s help, and Maya will be up here in just a minute. We didn’t get to the last, to re-writing the recommendations section very much. And so we are now going to work on that.
MS. BERNSTEIN: I await your instructions.
MS. KLOSS: The red insert in the second sentence is that reprise, if you will go back to this morning’s discussion. We were going to reiterate the importance of innovation at this time because of community initiatives. So we reprise that issue in the lead in to the recommendations.
MS. GREENBERG: I didn’t understand what you said. You as a group did, while Standards was meeting, you did work on these recommendations?
MS. BERNSTEIN: We worked on everything but the recommendations. We worked on all the issues in the text of the letter itself, some of which ended up in the recommendations.
MS. GREENBERG: So way up there is not really language that you are recommending?
DR. FRANCIS: Yes, we are. Shall we start at the beginning? Is that going to be easier than jumping into the recommendations?
DR. SUAREZ: That is what I what I thought would be helpful.
MS. BERNSTEIN: Here we are, back at the beginning. And either there are changes or there are comments over here in the margin that explains what we did. Some of these comments are ones that we had from Vickie that had not been incorporated, so we incorporated them as we went along. So some of these small changes you will see were Vickie’s recommendations. Here we had some.
Justine and Jim and Marjorie, I think, put their heads together offline after the meeting and suggested we expand this discussion at the beginning to make a more fulsome discussion about changes that are happening now that underpin the reasons for this report now. And so we expanded that here in this section a little bit.
MS. KLOSS: Do you want to read that? I think we should stop and read that.
DR. FRANCIS: We should say this is language that came from Justine
MS. BERNSTEIN: After the first sentence in the third paragraph, it says dramatic changes are occurring in the use of data about communities, digital data are growing exponentially, and data formerly stored in static documents are now being made accessible in manipulable formats. Communities are eager to leverage these resources to increase understandings about themselves and opportunities for improving their health.
MS. GREENBERG: Can I ask a question? You will have to go back. You moved beyond. Do you really want to say dramatic changes are occurring in the uses of data about communities or within communities? What are we talking about, data about communities or communities’ use of data.
DR. FRANCIS: Why don’t we say community data?
DR. SUAREZ: The use of community data. I think that is right.
MS. GREENBERG: Some of their data they are using isn’t even about their community.
DR. FRANCIS: How about by and about communities, then?
MS. GREENBERG: Okay, whatever.
DR. SUAREZ: By and about, yes. The one word I thought, did you say manipulable? That sounds off.
DR. MILAM: Flexible formats?
MS. BERNSTEIN: The idea is that they are digital, I think.
DR. SUAREZ: Accessible and usable.
DR. FRANCIS: I don’t even know if that is a word.
MS. BERNSTEIN: It is a word.
DR. SUAREZ: It is a word, but it is a word associated with manipulation.
MS. KLOSS: Do you think that sentence does what it is intended to do? These sentences, to add more punch?
DR. FITZMAURICE: I like the digital aspect of it.
MS. BERNSTEIN: That is the operable issue.
DR. SUAREZ: It is simply in electronic formats.
MS. BERNSTEIN: It is not just electronic any more. We are talking about optical data, we are talking about other kinds.
DR. SUAREZ: That is electronic.
DR. MILAM: In flexible electronic or flexible digital formats?
DR. FRANCIS: Just say flexible digital formats.
MS. BERNSTEIN: Anyone else? Moving on. This sentence, here, this is where we were in the recommendations. These developments should be cultivated and guided by responsible data stewardship, that concept about new things happening and we want to cultivate that and promote it, we were asked to reprise that in the recommendations, so that is where we were before. We did this in the recommendations. I just made a note here because that is where it came up in the discussion. And then we were asked also to drop. Are we good with that? I can go down and look at what we did there.
MS. GREENBERG: Why can’t you just say that they need to be cultivated and guided by responsible data?
MS. BERNSTEIN: We are not changing the language here. We are writing similar language to introduce the recommendations. That was the suggestion, not to change the language here. This is the language that is already there. The pink just indicates there is a comment associated with that language. Here, I will go down and show you what we did.
At the beginning of the recommendations we added similar language to what we just read that says communities are innovating in their uses of health data, and governments at all levels are increasing efforts to disseminate their data. These efforts can help communities promote improvements in health, health care and other meaningful quality of life issues. So we were asked to put that idea at the beginning of the recommendations. We did that there. Okay, back up to the beginning.
DR. SUAREZ: That sounds good.
MS. BERNSTEIN: The second comment was, Vickie suggested that we put more emphasis in here by citing an IOM report, which I didn’t have a citation for. But if you do, we can drop a footnote in there, if you want to send it to me. And then Dr. Cornelius also agreed with that, so we are going to do that. We dealt with this in the recommendations, but if we want to put a footnote in there, we can put a footnote in there.
MS. GREENBERG: I am confused by here, on page two. What it says here is, these developments should be cultivated and guided by responsible data stewardship practices. Is that what it still says?
MS. BERNSTEIN: Yes. We have not changed this language.
MS. GREENBERG: So what is this but they need to be guided thing.
MS. BERNSTEIN: That is the language that is in here.
DR. SUAREZ: They need to be guided by responsible data.
MS. GREENBERG: This letter said these developments should be cultivated and guided by responsible data stewardship practices. And that is what I think it should still say.
MS. BERNSTEIN: That is what it should say. Sorry, I probably just messed that up in —
MS. GREENBERG: Practices, after stewardship.
MS. BERNSTEIN: I will fix that space later. If we are good with this, I am going to take out the comment. And if we are good with this — I am going to correct these as we go ahead, if you are good with them.
PARTICIPANT: Unless you want to show them tomorrow to the full Committee.
DR. FRANCIS: I think you want to show that one to the full Committee. But correct the —
MS. BERNSTEIN: I will take out the comments.
DR. FRANCIS: And do correct this and accept the change so we don’t screw this one up here.
MS. GREENBERG: So it should say cultivated and guided by responsible data stewardship practices.
DR. SUAREZ: The word practices is missing.
MS. BERNSTEIN: Did we decide that we are satisfied with what we did in the recommendations section, Leslie? And that we need the IOM footnote? I thought we decided — we might not need it since we beefed up the language. And I think that is what Justine was trying to do there. Her language here was to beef this section up so it had a little more oomph. She may have actually gotten that language from that report, frankly.
So moving on to the next, we took out the word principles and we are using the word elements.
DR. SUAREZ: What page is that now?
MS. BERNSTEIN: I am on page six. So Bruce recommended language to deal with — I will show you where it is — at the end of this section, which is purpose specification, there is a sentence, there was a sentence, which is not showing here because we took it out. At the end of this section somebody read me the sentence that is on the paper.
MS. KLOSS: I can. It was: Stewards also need guidance about types of data uses that might be considered significantly different from the original purpose of data collection, such as when non-clinical uses are made of data originally collected in clinical care. That is how the letter read this morning.
MS. BERNSTEIN: I didn’t mean to accept that, so that you could see what that language was. But that sentence, Bruce had a correction to it. And what we decided was, we had the very same or very similar sentence here in the first paragraph. And instead, we used a completely different example here so that it wouldn’t raise some of the issues that were brought up in the last committee meeting in September.
So instead of dealing with clinical and non-clinical uses, or data collected in one context and used in a totally different context much later, we chose a different, more straightforward example of that where the data initiated, the collection initiated in the community and then was later used.
So here, an initiative to study children with asthma, and later used in combination with air quality data to explore allergens and toxins, instead of using clinical and public health data. So he had an issue with the clinical and public health data. We just took that example out, so we didn’t cause that problem.
MS. KLOSS: We did that after the Executive Subcommittee call. We inserted this sentence, so it appeared in the letter you had. But we had failed to take the old example out.
MS. BERNSTEIN: Exactly. So Bruce was still trying to correct that, but we took it out. I am going to delete this comment.
MS. GREENBERG: You just deleted the example at the end of that sentence.
MS. BERNSTEIN: So what I should do is put back in here, so that we can see that this got deleted.
MS. GREENBERG: So you can show that you deleted it.
MS. BERNSTEIN: I will copy it from the other file. I am not going to do it now. This is just a note to myself. So going on to Section 3, I think the first change was suggested by Vickie, to improve the language that we had there, to be more appropriate. And then this is just a conforming language to make that work essentially.
So now it reads however many communities do not have an obvious governance structure, the Subcommittee heard testimony about a variety of methods for collaborating effectively with such communities and decision making and their examples. Just to differentiate between the Indian communities where there is a governance structure that we work with.
Then on the data integrity and security section, Sallie and Ob, we had a discussion that arose in the next section on accountability about accountability, security and mitigation in particular, and we decided that it was more appropriate, that change was appropriate but more appropriately fit into Section 4 on data integrity and security. And so we did add some language about responsible stewardship including the evaluation of risks and figuring out appropriate mitigation for those risks.
And we also expanded a little bit to be more accurate about what security is. That is, including confidentiality, integrity and availability. And we are in the middle of reformulating this section. But basically it doesn’t say anything new except to add the concept of evaluating risks and then mitigating those risks. I don’t think this section was particularly controversial. It looks like there is a lot of writing here, but it is mostly because we moved paragraphs in a different order.
MS. KLOSS: That gets at both Sally and Ob’s comments.
MS. BERNSTEIN: Yes. This was the sentence here: Responsible data security starts with an evaluation of risks that can be anticipated, and a plan to mitigate those risks by including protections that prevent loss of confidentiality, alterations of data that would make the data unreliable, or the unavailability of data when needed.
And then we talked about mitigation techniques including physical, administrative, and technical safeguards. And that language comes from the original letter. It just got moved around. And then we still have the idea of integrity. Where is my integrity section? Here.
DR. MILAM: Do we mention that this is ongoing? That you would have periodic assessments? That it is not something that is done at the beginning?
MS. BERNSTEIN: I don’t think we have that exact concept in there. We say that it starts with that, but I don’t think that we say that it is an ongoing activity.
DR. MILAM: I guess when I read it, it says that it starts with an evaluation and so I just want to make sure we don’t imply that it is a one-time activity.
MS. KLOSS: Would the group be comfortable with keeping that at more of a summary level rather than getting too deep into process? I worry about talking about this is what you do at the beginning, and ongoing. I think maybe it connotes a level of complexity that we don’t —
DR. MILAM: Maybe if we just took out “starts with.”
MS. BERNSTEIN: I think that the idea was trying to be worked into this sentence where we say that at the time you are making some kind of intended use, or you are making a decision about somebody that might harm them, then that is an opportunity for you to make sure that the data are not misleading or untrue, and appropriate for their current use and so forth. It is implied but it is not explicitly stated what you are asking.
MS. KLOSS: I think up above, Maya, where it says data security starts with an evaluation of risks that can be anticipated and a plan to mitigate those risks. That kind of leads to the concept, then, that if it starts with that, what does it continue with, and that it is ongoing. And maybe that is too much detail about a process, the security process.
MS. BERNSTEIN: We could probably satisfy that with one sentence.
DR. SOONTHORNSIMA: So start with encompasses or something.
DR. MILAM: Includes.
DR. SOONTHORNSIMA: Includes, yes, that is a lot easier to read.
MS. KLOSS: Data security includes evaluation of risks. So it can be anticipated. A plan to mitigate those risks and ongoing monitoring or something.
MS. BERNSTEIN: My only problem with that is that if you don’t do it at the beginning you don’t bake it in. So I have an issue with the implication that it can happen somewhere other than at the beginning of the process.
DR. FRANCIS: A way to do that is to have it starts with, but then as you go to the next paragraph you could just say ongoing mitigation techniques.
DR. MILAM: It is really the assessment process that is the ongoing part. You react with your techniques.
MS. BERNSTEIN: That’s sort of the idea, that you are going to re-evaluate periodically. We can just say these should be re-evaluated periodically. Period. Or re-visited periodically.
DR. FRANCIS: You could conclude that paragraph by saying these should be re-evaluated periodically.
MS. KLOSS: Much of the other elements are kind of kept at the principal level and not getting as much into process. That is my concern here. We are getting in the weeds.
MS. BERNSTEIN: Is that too much?
MS. GREENBERG: You are talking about that paragraph or the next one?
MS. BERNSTEIN: This sentence, right here.
MS. KLOSS: I think that level is fine.
PARTICIPANT: So Maya, you need to include start back again where it says responsible data security. Starts.
MS. KLOSS: Then do we need the mitigation techniques include physical, administrative and technical safeguards?
MS. BERNSTEIN: That was in the original discussion. That is up to you.
DR. SOONTHORNSIMA: I think that is fine. Let me see if I can articulate this. This works from the data integrity and security perspective. The context I was coming from had more to do with, as a data steward I need to think about how else this could be used or misused. It has nothing to do with data integrity. Make sense? That is why I was thinking of putting that risk identification.
MS. BERNSTEIN: Can you say more about that?
DR. SOONTHORNSIMA: Yes. For example, I am gathering some data for this specific purpose, but I need to also be mindful, from this data set that I have could also be used for other things, and try to figure out what those potential usage might be.
DR. MILAM: But how does that differ from the purpose specification elements?
DR. SOONTHORNSIMA: You are right. Maybe it doesn’t.
DR. MILAM: I think it is within it. And I think your data steward is accountable in a different way to each of these elements. But I think you are highlighting, though, the challenge with the purpose specification.
MS. BERNSTEIN: We have a section in Section 8 about inappropriate discrimination against community. But maybe it is inappropriate uses are broader than that. Or is what you are trying to say would it fit in this Section 8?
DR. SOONTHORNSIMA: It could fit in that Section 8. The point is, as a data steward, it is a good practice to anticipate beyond what you are currently intending the use of the data.
MS. BERNSTEIN: That is purpose specification.
DR. SOONTHORNSIMA: That is fine.
MS. BERNSTEIN: And it is the later uses that are something else, right? They differ from the original purpose.
DR. SOONTHORNSIMA: Then I think it will work. I think we don’t have to change it.
MS. KLOSS: So I don’t think we need to change purpose specification. That is clear.
DR. SOONTHORNSIMA: That is clear, and that takes care of what my issue was.
MS. BERNSTEIN: So we are okay here with data security?
DR. SOONTHORNSIMA: Yes.
MS. BERNSTEIN: And we had a discussion of integrity. And then I tried not to use the word de-identified for the reasons that we already stated in a long footnote. So I have made it not identifiable. Here. And here, Ob, was your original point. I am going to erase this, so we dealt with it. And Paul asked us to add something about enforcement, which we didn’t want to do too heavy handed.
So what we said was, in Section 5 on Accountability, we said that it requires identification of a person or entity responsible for stewardship at each point in the life cycle of data. And we followed by adding these responsible entities should consider mechanisms for enforcement and redress, in cases of failure to meet data stewardship responsibilities. Does that satisfy your concern?
MS. KLOSS: We started putting it in the recommendations, and then we thought it really was starting to be negative, and like okay, this really is about cracking down on use. So we didn’t want to —
MS. BERNSTEIN: Now I want to see where it went.
MS. KLOSS: It is the balance that Marjorie talked about.
MS. BERNSTEIN: So this is how it reads now in this paragraph here right under accountability. Is that right? Okay, moving on. We had nothing in those sections. I think inappropriate discrimination. We added this word. So some discrimination is —
MS. GREENBERG: Discrimination is always inappropriate. I don’t think there is appropriate discrimination.
MS. BERNSTEIN: There is, of course, appropriate discrimination. You can make differences on characteristics that are legal and appropriate. It is illegal or inappropriate discrimination that is not —
MS. GREENBERG: It depends on how you define the word discrimination, I guess.
MS. BERNSTEIN: I am a discriminating person. How is that? The point is to understand differences among populations and so forth. Sometimes you don’t want to make decisions based on immutable characteristics unless they are relevant to health, for example.
We have specific examples that we talked about in the letter. We talked about the case of the Havasupai Indians, who were — I guess discrimination isn’t exactly what happened to them, but yes, by the community, the stigmas about that community were raised because of the research that was done on them that was considered to be inappropriate by that community. And they won a big lawsuit as a result of it.
MS. GREENBERG: I maintain that to the lay reader, and I think there will be some lay readers, discrimination is a pejorative thing. I am not talking about the lawyers.
MS. BERNSTEIN: So now we are back to recommendations. We have until 5:30. So we had some question about whether we should — so this is a section that the few of us that met during the Standards meeting have not gotten to. We had a question or comment about whether we should put some more emphasis on timing, on when we want the Secretary to do something. We don’t often do that.
We don’t generally tell the Secretary, when we give recommendations, we don’t give her deadlines normally. But what we did here, as I recall, was to try to put some more emphasis at the beginning about the urgency. So if we have dealt with that by emphasizing the urgency at the beginning, with some language from Justine and others, maybe we don’t need this any more.
MS. KLOSS: I don’t think it hurts. I would leave it in. The same reason that we put the urgency —
MS. BERNSTEIN: No, I am just saying do we need to put something specific about timing in here?
MS. KLOSS: Oh, no.
MS. BERNSTEIN: Thank you. I can get rid of this comment. This language, we already talked about this language at the beginning, which is where we reprise the conversation to hearken back to our beginning discussion talking about innovation in a summary fashion, using kind of similar language. And then just to introduce the recommendations.
DR. MAYS: I do want to go back to the issue of time. I was one of the people that talked about it, and I think in general it was talked about. Unless the recommendations have changed in a way in which it has more teeth about it, there is a reason to be doing it now.
And so if you leave the beginning the way it is, where it says NCHS believes this is the right time, I think if you put more why it is the right time, then I think it can be seen that now is the time to do it. But it is like it just says to advance, to guide the many uses of data that fall outside of HIPAA. But I think when we were talking we talked about doing it relative, and we gave some other examples. Am I not seeing that yet?
MS. KLOSS: That was the rationale for adding that paragraph right at the beginning.
DR. MAYS: We said the beginning and the end.
MS. KLOSS: This is where we added something.
DR. MAYS: We want to include something in the recommendations as well.
MS. BERNSTEIN: This is the language inside the recommendations that you are looking at here. This is recommendations. And here is some language here that hearkens back to the beginning part. And we dropped a footnote here saying that different entities are exploring these important developments now, and we are looking for your IOM report site here where we made a place for it.
So we were trying to re-emphasize what we had started off the letter saying. Here we are. This is the very beginning of recommendations talking about the developments that are happening now, and the importance of those now.
DR. FRANCIS: Maya, how about saying NCVHS believes now is the right time? Believes now.
MS. BERNSTEIN: Do you like that better? That is stronger? Okay. Does that satisfy your issue, Vickie?
(overlapping voices)
MS. BERNSTEIN: The purple part, you will see the red part is from my computer. It has my name on it. The purple part is from this computer, which was also me, but these are my notes from the meeting, which I didn’t take out. I left them in.
We had a conversation here about whether we should have the Department apply this framework to all of his activities. You remember I questioned that and Jim responded saying no, we really shouldn’t do that. That we should not imply that the federal government is not doing these things, because they are.
DR. MAYS: One of the things Jim said was about congratulating the Secretary for what is being done. And maybe it is after that, we think now is the time, and then to say some things. This is where I am not good. Too bad Joe is not here. To say what it is that the Secretary has been showing great leadership on. I think that is where that goes, because it then fits with the now.
MS. BERNSTEIN: That is this idea of praising HHS? And supporting our efforts where they are lacking, and so forth?
DR. MAYS: So whatever those things are. Maybe you can say what we should be saying, appraise.
MS. BERNSTEIN: It won’t go right there, but —
DR. FRANCIS: How about the Department is playing important roles in facilitating the use of data? And —
MS. GREENBERG: Because actually the Department is making unprecedented efforts.
DR. MAYS: I agree. I even said during the campaign they should tell them all the data stuff we did. Nobody took me seriously. It’s a talking point.
MS. BERNSTEIN: We have nothing to say about the campaign from here.
DR. FRANCIS: In facilitating the use of data, period.
MS. BERNSTEIN: No, we are going to say to facilitate. I just don’t like the gerund.
DR. FRANCIS: The use of data, period.
MS. BERNSTEIN: And this part?
DR. MAYS: To improve community health. The use of data to improve community health.
MS. KLOSS: It is more than that.
DR. FRANCIS: The use of data, period. Then I was going to suggest the Department is also playing a leadership role.
MS. BERNSTEIN: Modeling good stewardship behavior, blah, blah.
DR. MILAM: I was wondering about something else. It is also pretty unusual that they are engaging with the entrepreneurs and the app developers. That is an unusual partnership, an unusual marriage, and through that they are liberating the data. I am not sure exactly how to say that. But it is pretty unique.
DR. TANG: It is almost like you should start off with the kudos, and then move to why we are — because it is a little bit going back. Scroll up again please?
MS. GREENBERG: Actually that would make a nice transition. Start with the kudos and then say that is what makes this —
DR. TANG: NCVHS congratulates the Secretary on making available health information.
MS. GREENBERG: I don’t know if I can congratulate. I wouldn’t congratulate. I think you don’t want to come on too strong. But you could say that NCVHS recognizes the Department is making unprecedented efforts to facilitate the use of data. And if we could pull in Sally’s idea, and to expand partnerships within —
MS. BERNSTEIN: Public-private partnerships.
MS. GREENBERG: And to expand public-private partnerships.
DR. TANG: And then along with the increased access to data, NCVHS recommends that these stewardship elements — the stewardship framework would help.
MS. BERNSTEIN: Who are we establishing our partnerships with?
MS. GREENBERG: Public-private partnerships. In establishing public-private partnerships to this end, or something.
PARTICIPANT: To advance data use.
MS. GREENBERG: I think that third sentence is good also.
MS. BERNSTEIN: But greater use is not the only way that we are modeling responsible stewardship.
MS. GREENBERG: That is true.
MS. BERNSTEIN: I would just end it there, maybe. But we are doing a lot of things that are responsible stewardship. We might want to say incorporating these eight elements of a framework into daily work, or something like that. And our goal is to expand the reach of these things. I am thinking out loud.
MS. GREENBERG: I don’t know that makes sense so much there.
DR. TANG: Why do we need that sentence?
MS. BERNSTEIN: We don’t. If you don’t like that sentence we can make it go away. Do you want a different sentence?
(overlapping voices, off mic)
MS. GREENBERG: I like the way it flows now, Paul.
MS. BERNSTEIN: Do we like this? I am going to accept it. The next thing was whether we should make a recommendation asking the Department to — we just said they are exercising a leadership role. We already did all that.
DR. TANG: Saying in addition to supporting the development, we recommend that you support the development. The leading word of the leading sentence is —
MS. BERNSTEIN: The committee recommends in addition to supporting —
MS. GREENBERG: It is the development of models. But wait. Have you already recommended?
MS. BERNSTEIN: No, this is the first recommendation.
MS. GREENBERG: It needs to be number one, so that it is clear that that is a recommendation.
MS. BERNSTEIN: That is the recommendation. Development of models and promulgate.
MS. GREENBERG: Is two. Wasn’t it that the Committee recommends that HHS support the development and promulgation of a stewardship framework
DR. TANG: Along with making health data available, comma, the NCVHS recommends. I almost had it.
MS. GREENBERG: We don’t want to sound like they aren’t doing anything with stewardship.
MS. BERNSTEIN: You liked facilitate. That was your word, Paul, before.
DR. TANG: No, I was trying to get your lead in sentence. And tie it with above. We said hey, thanks for making it available. People are using it. In addition to using it, we recommend that we —
DR. MILAM: How about recommends that HHS advance these stewardship elements in the following ways?
MS. BERNSTEIN: Are you talking about the introductory sentence that would go here? So what you just said is the same kind of as this, right?
MS. GREENBERG: No. It’s models. First, you recommend the development and promulgation of a stewardship framework, building on the elements that are in this letter, right? Then the second thing is —
MS. BERNSTEIN: Wait. The elements in this letter are the elements of a framework, right?
MS. GREENBERG: Yes, but we are not saying they are the only elements of a framework.
MS. KLOSS: And we are not saying they are fully defined, fleshed out.
MS. GREENBERG: You can’t start by saying in addition to supporting. I hadn’t realized this before, but that is the first recommendation. You are into recommendations now. So number one.
MS. BERNSTEIN: Here is what we said before. In addition to its efforts to promote uses of data and its leadership role, and whatever.
MS. GREENBERG: That is the right time. So no, you don’t want to say in addition, because you haven’t made it as a recommendation yet. First you have to make it as a recommendation.
MS. BERNSTEIN: I wasn’t planning to put that in there. I was planning to use the language from up here, not the language in the recommendation. That we are making efforts to facilitate the uses of data, the dissemination of data. All those things are already true. Right?
DR. MILAM: The committee recommends that HHS advance stewardship elements in the following ways.
MS. BERNSTEIN: That seems like the first recommendation to me. That is my problem with that. I will show you what it looks like now. We are going to take out enforcement, right?
DR. FRANCIS: We were going to put in the whole series of illustrations there that we were talking about in discussions with Paul.
MS. BERNSTEIN: But we were going to take out enforcement because we have that elsewhere.
DR. FRANCIS: Right. We have that earlier.
MS. BERNSTEIN: What we have is, those elements, or those examples, are here in this comment in the side — funding, research, guidance, pilot projects, demonstration projects, private sector, whatever, all that stuff.
DR. FRANCIS: I don’t know that we are intending to recommend that HHS do something like produce the document that is the framework.
MS. GREENBERG: You aren’t recommending that?
DR. FRANCIS: I don’t know whether we are or not. We are very careful in this letter to leave it open ended. Now maybe what we want is for HHS to develop a complete stewardship framework. But I think we actually think they could spend all year deciding whether A and B are part of a stewardship framework. And we would want to get out of that business.
MS. BERNSTEIN: We made the point that in different communities these things are going to be implemented differently because of the nature of the community, their resources, their values and so forth. And so there could be multiple stewardship models for those different communities, depending on what their characteristics are. And we don’t want to have one that we publish that applies to everyone.
MS. GREENBERG: How about saying in order to support the development and promulgation of a stewardship framework, without saying who is going to do it? The Committee recommends that HHS do all these things. Do you want to say something about the development and promulgation? Or do you want to take that out completely ?
MS. BERNSTEIN: We took it out.
DR. MILAM: The committee recommends that HHS support community data use through stewardship, colon. Something very general that sets up your specific recommendation.
MS. BERNSTEIN: Why is this not enough?
MS. GREENBERG: Maybe it is just enough to say models for stewardship.
PARTICIPANT: That is what I want.
MS. BERNSTEIN: Why is that stem not enough now?
PARTICIPANT: It’s all right for me.
DR. FRANCIS: It’s fine with me.
MS. GREENBERG: Okay, so you didn’t want to recommend that the department develop and promulgate a stewardship framework?
MS. BERNSTEIN: That is the first recommendation here, facilitate development of models, plural.
MS. KLOSS: We don’t want a stewardship framework because —
MS. GREENBERG: Okay, fine, good. Then that sentence had to go, obviously.
DR. FRANCIS: Number one there, Paul had suggested that we include some descriptive examples. Facilitation might include —
MS. BERNSTEIN: I am trying not to lose that comment while including this.
DR. MAYS: Can I just ask is it really only models? I guess there are activities that are part of stewardship that doesn’t require that. So is it activities or models?
MS. KLOSS: I think the activities come in other recommendations, where we are talking about different kinds of guidance and education.
DR. MAYS: I don’t see those as models. I am trying to make sure, I don’t want them hung up on a model, when there are a lot of things they could be doing as they develop these different models.
MS. KLOSS: I think one of the concepts that we have had is that these are going to be evolving models because new community types and initiatives are going to continue. So it would be very helpful to have — I can see an array of six, figure out what you come closest to, and you might want to think about these things. If you are this kind of a community initiative, or you are this kind of a community initiative. Or you have a governance that you can rely on. That is, I think, what we were thinking about models. Because it would show a range of possibilities and it wouldn’t make it seem like it was a fixed, static.
DR. FRANCIS: Hopefully, the other recommendations do capture some of the activities. Let’s see if they do. But we need to say under facilitate the development and promulgation of models, we need to say some ways that facilitation might occur. Include pilot projects.
PARTICIPANT: Funded research, pilot projects, case studies.
DR. FRANCIS: Training materials.
DR. MAYS: This is where it gets the earlier discussion about a lot of that stuff is already covered to some extent. So you are getting into the researcher’s territory now, where they are covered for researchers but they are just not covered for others.
MS. BERNSTEIN: There are places where it is not happening now. That is one of the points of this letter.
DR. MAYS: Say non-federally funded research. Since you know, then, if that is the case, because if a person takes this, they take it as the big research agenda.
MS. BERNSTEIN: The idea is that this is going to be funded research to look at places where it is not currently covered, right? It is not talking about the funded research that already has these principles. The point is to look at communities which are not covered by a federal structure right now.
MS. KLOSS: Why not just take funded research out of this example set? So we don’t confuse in any way.
DR. SUAREZ: I am just thinking clearly development and promulgation of models, but the facilitation doesn’t really necessarily talk about the models. It talks about some other things that might help someone else working with somebody else to develop models. But it seems to me that we need to be more direct to in the expectation or the recommendation, that they should be developing and promulgating models.
MS. BERNSTEIN: We said facilitate the development of, not develop. If you mean develop, we could say that.
DR. SUAREZ: I was going to suggest taking a more proactive position and say lead, or take a leading role in the development, or some way of elevating the sort of recommended expectation.
MS. BERNSTEIN: Earlier, I was suggesting in our small group that we could have just said develop models for stewardship of community health data. And the federal government has many ways of doing this, one of which is to contract it out, to give a grant to do it, to promote somebody else doing it. Not necessarily to do it in house.
But people didn’t like that idea. It was too strong, too direct. But better to say we could facilitate it and use all those same techniques for promoting the idea of its development, without implying that we are going to do it in house. The Secretary has many tools at her disposal for making guidance or training or whatever.
MS. KLOSS: I think this is fine.
MS. BERNSTEIN: Why don’t I suggest that we move onto the others ones, and come back to this one and see how we feel about it after you look at what the other ones said.
DR. FRANCIS: Just put an “or” in front of training materials.
DR. SUAREZ: I would add best practices someplace there. That is a critical aspect of the model.
PARTICIPANT: I would take training materials out and use that in a subsequent —
DR. FRANCIS: Or best practices.
MS. BERNSTEIN: You want training materials gone?
DR. FRANCIS: We could say best practices and the like. I would have it as open ended as we can.
MS. BERNSTEIN: That is good.
DR. FRANCIS: Facilitation might include, or such facilitation might include.
MS. KLOSS: Or HHS might facilitate.
MS. BERNSTEIN: Thank you.
MS. KLOSS: Or through pilot projects. Through.
MS. BERNSTEIN: Let’s revisit that after we go to the other ones. So these all say support. Remember we changed the word support to facilitate in the other one.
MS. KLOSS: But we probably don’t have to change every word to facilitate.
MS. BERNSTEIN: This is my question. It is up to you.
MS. KLOSS: I like to vary. I like to have different verbs.
MS. BERNSTEIN: Right. I am with you.
PARTICIPANT: Wait, you like them all the same?
MS. KLOSS: No, different ones. I like that.
MS. GREENBERG: So you don’t want to say facilitate in every one?
MS. BERNSTEIN: I don’t. And I don’t want to say support in every one either.
MS. KLOSS: Now that I look at the support in every one, that is kind of boring.
DR. FRANCIS: We have two more supports.
MS. BERNSTEIN: Three more, frankly.
DR. FRANCIS: Are you going to stick with support?
MS. BERNSTEIN: We will stick with support. They all said support before we changed the one to facilitate.
DR. FRANCIS: Number three should be encourage. And number four should be promote creation of.
MS. GREENBERG: No “considers,” right?
DR. FRANCIS: Too weak.
MS. GREENBERG: I agree.
MS. KLOSS: It could just be create, instead of promote the creation.
DR. FRANCIS: Well, except I am not sure we want the HHS to view it —
MS. KLOSS: That is true.
MS. BERNSTEIN: Unless you want to say that because some of them are institutions. I just don’t like the gerund. Dynamic guidance resources. This sentence is bugging me, I have to say. I want to say it this way.
MS. GREENBERG: We are talking about best practices in both of these? This is the guidance.
MS. KLOSS: The other one was models, and this is guidance resources.
MS. BERNSTEIN: We said guidance and best practices up here, too.
MS. KLOSS: Cut guidance in the first —
MS. BERNSTEIN: We can take that out.
MS. KLOSS: That’s fine.
MS. BERNSTEIN: Do you like that better? Then we can put them over here. How do you like that?
PARTICIPANT: That is better.
MS. BERNSTEIN: Areas include. I don’t like that word. Could we say —
MS. KLOSS: You could say high priority areas.
MS. BERNSTEIN: NCVHS recommends that the highest priorities are — give it a subject.
MS. KLOSS: Go ahead. We agree.
MS. BERNSTEIN: Something like that?
MS. KLOSS: Sounds kind of passive.
DR. MILAM: Maybe has identified the following high priority areas.
MS. KLOSS: Yes. That is better. Thank you.
DR. FRANCIS: I take it – just to segue to our second topic for today, noticing that we only have a few minutes, what we are going to be doing as a Subcommittee is considering which of these we are best equipped to take on in the context of the overall tent.
MS. KLOSS: Not just in this recommendation two but across all four.
MS. GREENBERG: Some of them might be done in conjunction with what Sallie and Bruce had talked about. One possibility was re-convening those communities with some additional communities maybe. So just like from the beginning, then you could address a few streams with that, one of which is models, or some of that. Examples, case studies. We already have some initial case studies.
MS. KLOSS: Those are changing rapidly, too.
DR. MILAM: Some of the possible next steps are fairly technical, more technical than this committee has recommended in the privacy area and security area in the past. So do we want to go there? Or do we like to keep it at a higher level?
DR. FRANCIS: That is part of what we are going to need to talk about. For example, just resources concerning methods and best practices for openness and transparency, community engagement, and closing the loop of communities may be at the high level that is very much in our bailiwick, dealing with de-identified data. Dealing with the risks of data aggregation and small cell protection may be a much more technical issue.
That one may not be the one we are well equipped to take on. But practices for openness and transparency may be exactly the right one for us. I don’t know. But that is the kind of thing I think we need to consider.
MS. BERNSTEIN: If I saw this I would immediately call my colleagues at NCHS and say bite it up. I would call Eve and I would say Eve, find the experts in that, right?
MS. GREENBERG: Isn’t ASPE doing some work there too?
(overlapping voices)
MS. GREENBERG: Obviously we have people here who work on this all day.
MS. BERNSTEIN: Some.
MS. KLOSS: Is there anything other than those three bullets that should be highlighted as high priority areas?
DR. MILAM: I think there are ways to think about data linkage at a high level without getting into the detailed components of it. When we look at convergence, and communities are doing linkage. There are probably some elements or things that they should think about.
MS. BERNSTEIN: I think Sallie has a point. Before I get to the idea of how to do it, I have to be able to identify the problem. I have to even be able to identify that I have a potential problem, that I am linking data or that I need an expert on de-identification. And if I haven’t identified that, I am in trouble right there, without having to know how to do it myself.
MS. GREENBERG: The committee has made some recommendations on linkages, but they are more about linking federal data, I think.
MS. BERNSTEIN: AHRQ is doing a bunch of work on this stuff too, actually.
DR. MILAM: So now we have some interesting opportunities with linkage occurring in the electronic health record, bringing in some population health measures, and to clinical data. So we have that linkage occurring. But what happens then with our administrative data sets? And what are people doing with those?
MS. GREENBERG: This really is part of the convergence issue.
MS. KLOSS: Do we want to add a fourth bullet?
MS. BERNSTEIN: Can I ask a question about the first two? These seem kind of similar or different sides of the same coin to me. That is, aggregating data is one method for ensuring that data are not re-identifiable.
DR. MILAM: You know, we could say after downstream, something about the statistical disclosure limitation techniques that would include your aggregation and any cell suppression, and anything else.
MS. BERNSTEIN: This seems like a specific instance.
DR. MILAM: It is.
DR. FRANCIS: Downstream protection is one problem. Aggregation even at the first user is a different problem.
MS. BERNSTEIN: That is correct.
DR. FRANCIS: So we ought to separate out those two.
MS. BERNSTEIN: Right. If you think about it in the HIPAA context, de-identification is just looking at raw data elements of a particular dataset before you do anything with it necessarily.
MS. KLOSS: We have consensus then that we need to break the two concepts in the first bullet. So you separate the de-identification and protecting it downstream.
DR. MILAM: Downstream would go with your data use agreement, though.
DR. FRANCIS: So protecting downstream data uses, including through data use agreements and their enforcement.
MS. BERNSTEIN: But data use agreements can be used for completely different purposes than de-identification issues. Those are two unrelated items.
DR. FRANCIS: That is why I was saying, data use agreement —
MS. BERNSTEIN: We already said these are important topics up here.
MS. KLOSS: Two examples in case studies about de-identified data. Is that one, period?
DR. FRANCIS: Yes.
MS. KLOSS: And then —
DR. FRANCIS: Downstream protections, including data use agreements and their enforcement.
DR. MAYS: When I edited it earlier, I tried to take out the word downstream because you were using a life cycle approach. And downstream doesn’t tell you really where I think for most people. Downstream is getting to be, there are arguments with the epidemiologist about how far down and where. So I think if you could just find another word for downstream. If you are using life cycle, you really should probably specify.
DR. SOONTHORNSIMA: Subsequent use? Is that one, regardless?
MS. KLOSS: Maybe it is life cycle management, including —
DR. FRANCIS: Yes.
DR. GREEN: Are you guys sure that you are improving this letter?
MS. BERNSTEIN: A good question.
DR. MILAM: Not at this point. We are tired. You know that when we look at this information about data aggregation, it is really the risks of disclosure and data reporting. That is where you would apply your statistical disclosure limitation techniques, that would include your data aggregation or other techniques.
MS. BERNSTEIN: Is that separate? I wanted to capture that. But does it go with one of these other things?
DR. MILAM: It goes with that data aggregation. That is part of that.
MS. GREENBERG: Are you trying to make sure that you have things in here, some of which you might do?
MS. KLOSS: No. We are just trying to make sure that we aren’t putting two different —
MS. BERNSTEIN: A lot of the focus of this is — the whole focus of this section is on dynamic guidance resources. And the focus seems to be on de-identification, reporting that kind of stuff, rather than — which is only one element of the many things. And you could have guidance on the many other parts of —
MS. KLOSS: Like governance.
MS. BERNSTEIN: Yes, or like openness. That is totally different than these ones here. If you go back to the — it could be security, although there is plenty of advice about security. It could be about accountability mechanisms. It could be about redress. It could be about — what else did we have up here?
MS. KLOSS: This short group kind of came out of the hearings. They are kind of points of pain, and they aren’t the only ones. But maybe we just head up that recommendation, the following illustrate some of the areas where guidance might be needed. And then we don’t have to cover everything. Would that work, Maya?
MS. BERNSTEIN: Maybe you want to, for example, break this out. Because we had these in two separate — we had openness and transparency as a separate element than community engagement. And so maybe those are two different things. I am going to make these semicolons because it makes me happy.
DR. FRANCIS: You want to take the comma out after engagement.
MS. KLOSS: Okay. We now have NCHS has identified the following high priority areas for resource development: how-to examples, data use agreements, risks of disclosure and data reporting, resources concerning methods and best practices for openness and transparency and resources concerning community engagement. I think that is really good.
DR. FRANCIS: I do too.
MS. KLOSS: I think it is great.
MS. BERNSTEIN: That’s what it looks like now.
DR. FRANCIS: It is fantastic.
PARTICIPANT: Fantastic.
DR. KHAN: Maya, if I can make a comeback — we are not sure that you need resources concerning the enforcement of the last two bullets because we are really talking about resource development.
PARTICIPANT: Yes, it just methods and best practices.
MS. BERNSTEIN: Right. It is just methods and best practices.
MS. KLOSS: Okay. Now, it is great. Let’s do three and four. That is a very distinct recommendation. We want to track what is being achieved by the communities, somehow. Is that clear?
MS. BERNSTEIN: Do we want to encourage compilation? Or do we just recommend that she compiles case studies?
MS. KLOSS: I don’t care. Compile.
MS. BERNSTEIN: That is a recommendation. It’s an even better word. Promote the creation of training materials. As opposed to produce training materials, right? Or create training materials.
DR. FRANCIS: No, we don’t want the implication that HHS does it.
MS. BERNSTEIN: Yes, but as I say, HHS has many ways of getting things done.
MS. KLOSS: We have one more thing we have to do here.
DR. FRANCIS: Sorry, take out the community is. We have to finish the last paragraph.
MS. BERNSTEIN: We were talking about what came out of the conversation this afternoon, if we know what the next steps are can we put them in here. That was what this was about. And maybe we don’t know the next steps yet.
MS. KLOSS: I don’t think we should try to bake that in.
MS. BERNSTEIN: We already dealt with that comment. And Marjorie recommends against this, so we took that out.
MS. KLOSS: If you take out that sentence, the Committee is organizing its work around —
MS. BERNSTEIN: Those are just notes. Maybe that idea.
MS. KLOSS: Where it says NCVHS is committed to this agenda, and rather than saying and stands ready to help, and will be considering how it might contribute, would that be stronger?
DR. FRANCIS: And is considering how it can help the department study and implement these recommendations.
MS. GREENBERG: But does this last sentence really make sense? I don’t know that that working group on data access end use is going to do any of that.
MS. KLOSS: Let’s take it out.
MS. GREENBERG: I would take that out. That could fit in, move up a little. One of the things you had there I thought was related. No.
MS. BERNSTEIN: These recommendations? I don’t think we should specify how the Committee will go about it. If it is appropriate for that data use worker to take it up, perhaps they will.
MS. GREENBERG: As long as you say NCVHS, it’s the working group. So that is fine.
MS. BERNSTEIN: We don’t usually tell her specific subcommittees are going to do things. We just say the committee is going to get it done. However we get it done is up to us. Or you, I should say.
MS. KLOSS: Let me just say that last sentence one more time and see if it is strong enough.
MS. BERNSTEIN: It says, there is much to be learned as uses evolve, and the NCVHS is committed to this agenda. It is a run on sentence. Forget that. Let’s start here. Stewardship underpinnings remain weak. NCVHS is committed to this agenda. Well we are not committed to a weak agenda.
(overlapping comments)
MS. BERNSTEIN: via stewardship agenda, and is considering how it can help the Department study and implement these recommendations, period. We look forward to working with you if you like, or something like that.
PARTICIPANT: You have “this” in there. Is committed to this advancing. See “this,” Maya?
MS. BERNSTEIN: Is this really the phrase that we want? Maybe.
DR. SOONTHORNSIMA: Just say data. Just take although out.
MS. BERNSTEIN: Yes, we don’t need although.
DR. FRANCIS: But stewardship underpinnings remain weak.
DR. SOONTHORNSIMA: NCVHS is committed to advancing.
MS. BERNSTEIN: Thank you. A stewardship agenda? The stewardship agenda? This stewardship agenda?
DR. FRANCIS: Stewardship. Don’t even say agenda. Just say stewardship. Or if you want to say something, say framework.
MS. KLOSS: How about and is considering how it can continue to help the department?
PARTICIPANT: Yes, we have already helped.
MS. BERNSTEIN: We have already been helping the department with these recommendations? You don’t like this or you do like this?
DR. FRANCIS: Just say stewardship.
MS. BERNSTEIN: Good stewardship? Bad stewardship? Responsible stewardship?
MS. KLOSS: Effective stewardship?
DR. SOONTHORNSIMA: Maya is right. This stewardship in particular.
MS. BERNSTEIN: It is this agenda we just set out, right? That is the whole point of setting out a framework. That is why I put it in. Thank you.
DR. SOONTHORNSIMA: Maya, do you want to say advancing community stewardship? That seems to be a focus of the letter.
MS. BERNSTEIN: That is up to them.
MS. KLOSS: I would prefer it be more general, because this is such a moving target. If we make some breakthroughs on different models they may help other —
DR. SOONTHORNSIMA: Even though we focus on this framework?
MS. BERNSTEIN: I mean, we just set out this framework. Do we not think it is a good thing after all that?
MS. KLOSS: Advancing this.
DR. SOONTHORNSIMA: Yes, this one.
DR. MILAM: And we heard the Department is coming out with guidance on de-identification, which is intriguing. It will be technical, but there may be some interesting work to do with communities around that.
MS. BERNSTEIN: Yes, but it will of course have to be related to HIPAA.
DR. MILAM: Theirs will be.
MS. BERNSTEIN: Yes. It may be applicable to other things, but it will be de-identification for it is going to be —
DR. MILAM: Maybe someone would want to recommend it applies to communities.
MS. BERNSTEIN: Yes. We could use the same models for other things. Potentially. Anything else? I have to go back and figure out where I took out stuff.
DR. FRANCIS: We need to congratulate ourselves and adjourn. (applause) Thank you everybody. We need some small wins.
MS. BERNSTEIN: I need to go through and make sure I didn’t take out a note or something that shows where we made an important change, which I wrote over.
DR. MILAM: I think the Subcommittee should recognize Leslie and Linda for their unwavering support and attention to this letter. (applause) It has been huge. And what a rollercoaster for both of you.
MS. BERNSTEIN: Rollercoaster is a good description.
DR. SUAREZ: We should include all those in the letter, too. This is the longest letter we have written.
MS. BERNSTEIN: Oh, no it isn’t. June 2006.
DR. FRANCIS: It is very much like the June 2006.
(Whereupon, the meeting was adjourned.)