[This Transcript is Unedited]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
National Committee on Vital and Health Statistics
The Subcommittee on Privacy, Confidentiality, and Security
September 20, 2012
Hubert H. Humphrey Building
200 Independence Ave., SW
Washington, D.C.
Proceedings by:
CASET Associates, Ltd.
Fairfax, Virginia 22030
P R O C E E D I N G S (4:45 p.m.)
Agenda Item: Welcome
DR. FRANCIS: Welcome to this breakout subcommittee meeting of the committee on Privacy, Confidentiality, and Security. I’m Leslie Francis, one of the two co-chairs, and I’m delighted that everyone is here. And we’re going to go around the table and introduce ourselves first.
I’m from the University of Utah and have no conflicts.
And, Linda.
MS. KLOSS: Linda Kloss, co-chair, member of the full committee, member of the subcommittee, co-chair of the subcommittee, and no conflicts.
DR. MAYS: Vickie Mays, University of California, Los Angeles, member of the full committee and member of this. No conflicts.
MR. BURKE: Jack Burke, Harvard Pilgrim Health Care in Boston. Member of the full committee, member of this committee, and Population Health. No conflicts.
MS. BERNSTEIN: I’m Maya Bernstein. I’m the privacy advocate of the department. I’m the lead staff to this subcommittee.
MS. MILAM: Sallie Milam, West Virginia Healthcare Authority, member of this subcommittee, and no conflicts.
DR. TANG: Paul Tang, Palo Alto Medical Foundation, member of the subcommittee, no conflicts.
(Introductions around the room)
DR. FRANCIS: So in light of the discussion this morning, Maya has been working all afternoon to do our very best to make sure that we captured the comments and that the goal of this letter is not seen as being prescriptive. What we’re doing is identifying issue areas rather than telling people how to resolve them. But we think it’s really important to identify those issue areas. And second, that this is about the comings of community health data uses that we heard about that were the basis of the community health data report that came out a little over a year ago now.
And so what Linda and I were just huddling out in the hall with Maya, and trying to work through the very valuable changes that she’d made, and we thought the thing to do is just to go at it with the committee and see if we’ve done everything that we needed to do.
Maya took notes on the discussion. Some of the notes are now in comments in the margin, so we’re going to need to make sure that we can see those comments and then take it from there. So let’s just get going.
MS. BERNSTEIN: So here, I made the argument that we should take out this first paragraph, because I figure either the Secretary knows who we are, in which case this doesn’t really add anything to her knowledge, or she doesn’t know and this isn’t enough. And in fact, I thought that the second paragraph was a really nice framing of where we are and it started off in a nice way.
So even though other letters have started that way, I just didn’t really they were very compelling. So this is where the letters is proposed to start. It’s not a substantive change to the letter. It has nothing to do with the discussion this afternoon, by the way.
DR. TANG: I think the letter goes to the Secretary, but it’s also hopefully read by more people.
MS. BERNSTEIN: Yes.
DR. TANG: And hopefully read by let’s say some of the communities that are interested, and I don’t think they know who NCVHS is.
MS. BERNSTEIN: I’d be surprised if they found our letter then. Maybe, but I mean this doesn’t tell them enough, to explain who we are, really.
DR. TANG: I mean all I care is that that we exist, we’re a statutory public advisor body, and we make recommendations on the subject. That’s what I think there’s two sentences say in it. It really helps, to me.
DR. FRANCIS: Okay. Let’s leave them in. Let’s leave them in.
MS. BERNSTEIN: Fine.
DR. FRANCIS: Let’s just go on along.
MS. BERNSTEIN: So this is a change I just made, so that it was more explicit that the original fair information practice was actually a result of work from this department, back when it was HEW in 1973. It’s picky-oon, but it’s like, you know, justifies my existence.
But also I thought it was useful because the concept of fair information principles was an American idea that in fact came out of this Department, and I think it’s useful for us to register that since we are also — I almost said a later advisory committee. Marjorie would kill me. It’s not later because we preceded 1973, but in 1973 that’s where the concept of fair information principles came from.
I gave you a cite. Do you want to go back?
DR. MAYS: Yes.
DR. FRANCIS: All it does is just add that reference.
MS. BERNSTEIN: It just adds the actual original first one. It used to say fair information practice principles, generally, and now it says that these are all based on the original one that came out of this department. I think it’s nice to say that this Department had a role in creating that concept. Also it had nothing to do with the conversation this afternoon.
DR. FRANCIS: I do too.
MS. BERNSTEIN: — this department had a role in creating that concept. Also, it has nothing to do with the conversation this afternoon.
DR. MAYS: It was just that there’s a “must” in there. So I think we’re trying to —
DR. FRANCIS: Where? Where’s the “must?”
MS. BERNSTEIN: Oh, here. Here.
DR. MAYS: That they “must” be coupled with —
DR. TANG: “Should.”
DR. MAYS: That we should?
DR. FRANCIS: I don’t care one way or another. It’s not saying that there’s anything that you have to do about stewardship, it’s just saying you have to couple
MS. BERNSTEIN: It says making data more widely available to the public how to be coupled with appropriate stewardship practices. That’s very general, yes.
DR. FRANCIS: And the objection to the “musts” was about where — people wanted to be sure were weren’t saying you have to do A or B. All we’re saying here is that community data use and stewardship have to go hand-in-hand.
DR. MAYS: It’s just a tone thing.
MS. BERNSTEIN: Okay.
DR. MAYS: — either way.
DR. FRANCIS: If it should —
MS. BERNSTEIN: Do you want to change it to — if you want to change it.
DR. FRANCIS: Let’s just take the “must” and make it “should.”
DR. MAYS: “Should.”
MS. BERNSTEIN: Okay. So let me see if I can get it all — hang on one second. I’ll get it for her on one screen.
DR. FRANCIS: Now here the change was instead of to try to not suggest that we have a particular view about appropriateness, but that goes back to the language of the stewardship report of the community health data report, that what was crucial was trust. And so we said a stewardship framework enabling communities to use data to improve health in manner that fosters trust.
MS. BERNSTEIN: I’m hearing no objection.
DR. FRANCIS: That’s all we were saying there.
MS. BERNSTEIN: Okay.
DR. FRANCIS: And then the next change is to target these communities are very different, so we can’t do a one size fits all, but that the kinds of — but what we’re interested in are ways communities use data to improve health, of the kind that we reported on in the earlier report.
MS. BERNSTEIN: Right. And so this is where Bruce had asked us to add some language in here that would help, and so Leslie added here, and then just adjusted the last sentence as well.
DR. FRANCIS: Recommendations that may help HHS to facilitate and support effective stewardship.
MS. BERNSTEIN: Are we good?
So here we are in the background part. We haven’t changed the first paragraph here, but here, where we’re talking about — right. There was a section here that talked about different ways that data could be protected. So by consent, by de-identification, and there was an addition in here about limited datasets. But since we have acknowledged that we’re talking here about data that’s not covered by HIPAA, limited dataset is a term of art in HIPAA.
So we took that out and what we said was basically existing structures for data protection rely on things that pre-existed HIPAA at the goal things, which include consent, and include de-identification and there was have in the case of federally funded research, institutional, because we mentioned institutional review boards, but those are a creation of the common rule.
So I just made more explicit, where these things come from. We were asked to kind of take out reference to HIPAA, in particular, and to make it seem like we weren’t — as I understood what the committee wanted, make it not seem like we were suggesting that those things not covered by HIPAA now should be covered by HIPAA, although this committee has said so in other places. But for this purposes of this letter, to talk about — here I put things that may not be in law or regulation, but that are — we didn’t call them, you know, generally accepted practices, but just these are ways of approaching structures for data protection.
MS. KLOSS: So that takes care of the question of —
MS. BERNSTEIN: Actually, let me see if I can move this over just slightly, to see the comments.
DR. FRANCIS: Vickie has a comment.
DR. MAYS: I just want to ask, one of the things that I think Bruce was asking, is for a little bit more either a definition – not a definition, but an example of the community. And I think in the earlier part you have like many communities, but I don’t know if we know, yet, kind of the — you know, some parameters of what you’re talking about. And if we come here and we start talking about the specific data it actually seems like it’s more like research data. So at some point earlier, I think we need to say a little more about community, so that people have the bigger sense of it.
Where is it? Yes, different types of —
MS. BERNSTEIN: This is the paragraph before, where we talked about many different types of communities.
MS. KLOSS: And we’re referencing back to the CHIP report which is what led to this. It defined it as geographic.
DR. MAYS: Well, can we take the CHIP definition then, and just put it here? I mean I think without the CHIP report, I’m not sure — whatever the sentence is in the CHIP report, can we do it? A sentence.
DR. FRANCIS: To be candid, we did not have web access here, and there wasn’t a copy of the CHIP report over there. I don’t actually remember a definition of community in the CHIP report. I think what the CHIP report said, was that there are lots of different kinds. But Sallie may know that better.
MS. MILAM: And that’s my point. And I think we need to be really — I think we can add specificity. However, when we look at how we dealt with communities in the CHIP report, they ranged from a neighborhood to a local health department, to a state, to a research project, to anybody looking at health data. And at the same time, when we have had discussions around these principles, I’m not sure that we would want to say that they apply to one aspect of the community and not to others.
I think, as Leslie’s point earlier, like the HIPAA security rule, it’s scalable. You want to have notice whether you have the seven mothers looking at health data, or you have a state looking at health data. If you’re going to be dealing with health data you need to have some level of notice, the first principle in the stewardship framework.
So I think we need to say that community includes all these things, and what you do about it will be vastly different, the application is vastly different, based on the size of the project, or even the secondary use.
Today, we didn’t hear this in the testimony, but just from my experience you see public health doing some really interesting things with notice, even around secondary use of data.
DR. FRANCIS: So here is the language from the CHIP report. “A community is an interdependent group of people who share a set of characteristics and are joined over time, by a sense that what happens to whatever affects many or all of the others.”
MS. BERNSTEIN: A sense that what affect?
DR. FRANCIS: Okay. And I think we should just quote it, say the CHIP report defines community as.
MS. MILAM: And, you know, Susan Kanaan crafted that definition herself, after hearing after hearing the testimony of all of the —
DR. FRANCIS: Just say that. Yeah, that’s great. “The CHIP report defined a community as an interdependent group of people who share a set of characteristics and are joined over time by a sense that what happens to one member affects many or all of the others.” Period. And you can cite that to page 8.
MS. BERNSTEIN: “What happens to one member affects –”
DR. FRANCIS: “Many or all of the others.” Period.
The CHIP report also noted — ” Okay. “Also focused on geographic communities, in which member are connected through place and noted that these communities are not homogenous.”
DR. MAYS: See, I think I like what Sallie said, as opposed to this very last sentence we just put in. Because I don’t know it gives some clarity. And the examples that we’re talking, as small as a neighborhood and as large as a state. And then one more sentence that says, what you would do would be vastly different from one to the other. So everybody’s calm at the end of that. You know, they don’t feel like it’s prescriptive.
DR. FRANCIS: Right.
DR. MAYS: It includes everybody, and they get to fine, and that’s how you make it a heuristic thing, as they then go off and start defining it, based on just using those couple of sentences. So I think if you could give what you said, so eloquently again.
DR. FRANCIS: Yes. Put it in. Let’s see.
MS. BERNSTEIN: I don’t know if I captured it but Sallie said something here, like — depending on. I lost you after that.
MS. MILAM: I would think you would want to be positive. The stewardship framework — while all principles of the stewardship framework are equally applicable to communities regardless of size, it is also scalable.
DR. FRANCIS: I don’t want it to sound like — when you say “equally applicable” it sounds too much the same.
MS. MILAM: Are important to?
DR. FRANCIS: Are important.
MS. BERNSTEIN: You said it was vastly different, depending on the community.
MS. MILAM: Important to communities, regardless of size.
MS. BERNSTEIN: Yes, that’s it.
MS. MILAM: Not “equally.” Take that out.
DR. TANG: Are we making something complicated?
DR. FRANCIS: I would just say the report also focused on — let’s go back to, “The report also focused on geographic communities, in which members are connected through place, and noted that these communities are not homogeneous. They may be as small as a neighborhood or as large as a state or region. Stewardship issues arise for all of these, but may take very different forms.”
MS. BERNSTEIN: Stewardship —
DR. FRANCIS: “Principles apply to all of these, but may take very different forms, depending on the community.”
MS. MILAM: And the research topic. Right?
MS. FRANCIS: And the community and the data use.
DR. MAYS: My only comment about this is it really seems to be community as size, and we have community as culture, it’s just a little narrow. That’s why I like the notion of what you say diversity.
MS. BERNSTEIN: Is a community adjusted geographic place or it also a —
DR. FRANCIS: Do we want to just take out the focus on geographic?
MS. BERNSTEIN: That is the way we described it before though.
MS. KLOSS: Yeah. I don’t think we should go to that second sentence, the definition.
DR. FRANCIS: Okay. Get rid of the geographic —
MS. BERNSTEIN: Can I just play a little Devil’s Advocate, which is when we talked about place I think I recall a conversation about how if we define communities by other characteristics than place, we over in the population study area, and not — which may be applicable, but I mean this was specifically, when we were doing the CHIP report, having to do with place. I think people connected by —
MS. MILAM: Well, no, I don’t know if it was place. But not all of it was place.
MS. BERNSTEIN: Okay. Okay.
DR. TANG: A very simplifying phrase to describe I think what Susan’s sentence says eloquently. It’s really an organized population. It’s different from a population. You know we talk about population health and population report. And organized population means there’s some affiliation that has designated representation and leadership. And so that crosses the geographic — it expands it, from just being a geography. So I guess I would support what I think some said, which is also focused on geographic communities. I think the interdependent group of people share a set of characteristics, is a really nice definition.
MS. BERNSTEIN: Of this thing. Okay.
DR. TANG: Yes.
MS. BERNSTEIN: So when we say, here, it also focused it, not to — but that’s a specific instance.
DR. TANG: Right.
MS. BERNSTEIN: This is the main definition, and this is sort of a specific instance. If it’s wrong, it’s just a — okay.
DR. TANG: And that Sallie’s point could be summarized almost as — just as community are sort of diverse. So are the something.
Okay, while the stewardship principles remain the same across communities, just like communities are diverse, the rendition of the principles can be different. Something like that.
MS. MILAM: Right. The applicability of their implementation.
MR. BURKE: To what?
MS. MILAM: The applicability of the implementation.
DR. FRANCIS: Implementation. Yeah.
DR. TANG: But I think the more we get down into the granular specification the more we start excluding. Every time you get granular you exclude.
DR. FRANCIS: Okay.
DR. TANG: And what we’re trying to just — I think.
DR. FRANCIS: So let’s go back up. After it says page 8, instead of —
MS. BERNSTEIN: I left that in there for a reason. Just I want to capture all this before I take that part out.
DR. FRANCIS: Okay.
MS. BERNSTEIN: Just in case we have a discussion that wants to capture a piece of that language. But we can add this other language in the meantime. So you want to say — I understand this is planning to go away.
So just as — Paul, you were saying just as communities are diverse —
DR. TANG: Well the —
MS. BERNSTEIN: — or something like that. You want to say the way that the principles apply to the community may be take different forms, depending on —
MS. KLOSS: Don’t we say that in that last answer?
MS. BERNSTEIN: Yes. I’m going to combine these two ideas.
MS. KLOSS: I think you’ve already written that, in that last answer, “While all principles are important.”
MS. BERNSTEIN: It’s not size.
MR. BURKE: Right.
MS. KLOSS: “The way they are applied –”
DR. TANG: “The way they are applied may be different, depending –”
MS. KLOSS: On the community, and the data use. “Community,” comma, “data and data use.”
MS. BERNSTEIN: I’m only hesitating about use, for the same reason that we talked about before, which is I like to think of creation, collection, and use.
DR. FRANCIS: Why don’t you just say data, collection, and use?
MS. KLOSS: Yes.
MS. BERNSTEIN: Right.
MS. KLOSS: Community, and data, collection, and use.
MS. BERNSTEIN: There’s a lifecycle of data that use doesn’t capture in the whole thing.
DR. MAYS: I’d also just take out “vastly.”
DR. TANG: Yeah. It’s a bit too —
MS. BERNSTEIN: That was Sallie’s nice word over there.
DR. FRANCIS: Or just how about “may differ?”
MS. BERNSTEIN: Differ.
DR. MAYS: Yeah.
MS. KLOSS: Yeah.
DR. TANG: Yeah.
MS. BERNSTIEN: Better?
DR. TANG: Right.
DR. FRANCIS: The data — and the data collection and use.
MS. KLOSS: No. Community, and the data collection and use. And it’s collection —
MS. BERNSTEIN: “Their?” Do you like “their,” if you’re talking about data? Nobody knows that’s — data is pleural.
DR. SUAREZ: But there’s a sentence above that is redundant, I think.
MS. KLOSS: Right. We haven’t taken that out yet.
DR. TANG: They haven’t taken it out. So maybe this is an opportunity to describe to describe what it — because up in the introduction, I think, still.
So this letter covers a set of unifying principles applied to community health data. And then we go on to say that just as the communities are diverse, the way we apply these principles may differ, based on the law.
DR. FRANCIS: Yes. And the paragraph before really says the unifying principles and this is about the communities.
DR. TANG: Okay.
DR. MAYS: Yeah. Okay.
DR. TANG: Right.
DR. FRANCIS: And let’s scroll down.
MS. KLOSS: Maybe that needs to be broken into two paragraphs probably.
DR. FRANCIS: Well, no, I think this was the one about communities. Instead of saying the report also focused on. You could say the report highlighted geographic communities. Noting that these communities are not homogenous.
MR. BURKE: Aren’t we dragging them through the mud?
DR. FRANCIS: Okay. Take all that out. Just take everything.
MS. BERNSTEIN: I think it’s a nice turn of phrase.
DR. SUAREZ: And that next sentence is redundant with the next one. So just as the committees are diverse the principles apply to all of them differently.
MS. BERNSTEIN: Right.
MS. BERNSTEIN: That was a boarded attempt to get the idea down.
DR. TANG: But the other pieces of the principle — the principles apply uniformly to all communities. It’s like the principles are the same, but how you apply them depends on the community and how you use it.
DR. MAYS: So while the principles are important and apply uniformly, the way that they are applied.
MS. BERNSTEIN: They’re not applied uniformly. That’s the point. Right?
DR. SUAREZ: While all principles are important to all communities.
MS. BERNSTEIN: You can’t use that word. Relevant.
DR. TANG: I know what you’re saying, just as communities are diverse, applying the principles may take different forms, depending on the type of community and the use of data, the intended use of data, or something.
MS. BERNSTEIN: Yes.
DR. TANG: And actually, a way to shorten it, just as the community is diverse, application of the principles may differ. It just gets more credible, a bunch of the words.
DR. SUAREZ: I wonder if it’s the way the principles apply to a particular community, or whether it’s really how the principles are operationalized by a community. In other words, a principle is all really applied to all communities. This is how they operationalize each principle.
MS. BERNSTEIN: How would you like my new preposition? Does it take care of your problem?
DR. FRANCIS: Yeah. That’s fine.
DR. SUAREZ: Yeah. The application of the —
MS. BERNSTEIN: In the particular community. How you apply it in a —
DR. SUAREZ: Yeah. I think that sounds fine.
MS. BERNSTEIN: And that doesn’t necessarily depend on place.
DR. BURKE: Well, I think you have to change “their collection use” to “it’s collection use.”
MS. BERNSTEIN: How many people would disagree with that?
MR. BURKE: I’m going on the notion that there is a personal pronoun.
MS. BERNSTEIN: Okay. But I mean —
DR. FRANCIS: Just you can take that out to —
MS. BERNSTEIN: That doesn’t read right to me, but —
DR. TANG: Use a diverse application of —
MS. KLOSS: Application of the principles in a particular community may differ.
MS. BERNSTEIN: How about we just say the type of project. The type of initiative. The undertaking.
MS. KLOSS: Circumstances.
MS. BERNSTEIN: Circumstances.
DR. SUAREZ: And I don’t know if it’s the application of the principles in a particular community, rather than the application of the principles by. Because it’s really how they apply the principle.
MS. KLOSS: Yes.
DR. FRANCIS: There were communities whose efforts were highlighted in the report.
MS. BERNSTEIN: So now we have to highlight it again.
DR. FRANCIS: I don’t think we need a comma after report.
DR. TANG: So we took out the “the” before “application.”
MS. BERNSTEIN: We did. Okay.
DR. TANG: I think it’s just to make it a verb.
DR. FRANCIS: Yeah. Take out the “the.”
MS. MILAM: Leslie, that next sentence, I’ve been thinking about that for a while. We did receive requests from some of the communities, but many of them, largely the majority, did not identify that they had a privacy insecurity gap. They didn’t have a lot to say about it. They may not have had a lot of practices. But they didn’t say, “This is inadequate and we see a problem, and please help us fix it.”
DR. FRANCIS: What I was actually thinking is we want to take out “including privacy and security.” But they shouldn’t call that out because a lot of communities wanted help.
MS. MILAM: They did, but they didn’t ask for privacy and security when they were —
(Cross-talk)
DR. FRANCIS: To govern, to help them manage and govern information practices, period.
MS. BERNSTEIN: Right.
DR. FRANCIS: Take out the “there.”
MS. MILAM: Yes.
DR. FRANCIS: That’s stronger.
MS. MILAM: That’s better.
MS. BERNSTEIN: Stronger. Agree.
DR. FRANCIS: And then we change the last sentence of this paragraph, to try to capture the idea that these are recommendations to help facilitate stewardship, not about specifically to be a good steward, you have to do this.
MS. BERNSTEIN: Okay.
DR. SUAREZ: Can I point on that, the statement, the sentence? Just where the letter sets out a framework on recommendations for stewardship of health information used by a community, is the framework and recommendations or is it health information? In other words, this letters sets out a framework and recommendations for a stewardship that may be used by communities.
MS. KLOSS: Or for use by communities.
DR. SUAREZ: For use.
MS. BERNSTEIN: How about collected from communities?
DR. SUAREZ: But we’re saying these are recommendations to be used communities.
DR. BURKE: Collected from and used by.
DR. SUAREZ: I know that the statement is a little confusing, because you know, the “used by communities” really relates to the health information. The stewardship of health information used by communities.
DR. MAYS: Can we change the word “help” to something else? I mean it just sounds a little paternalistic. Instead, guidance to facilitate their abilities to manage and govern. So that it’s something where we’re giving them something to turn it over, as opposed to the help. That just bothers me.
MS. KLOSS: Well, just put guidance in managing and governing information practices.
MS. BERNSTEIN: Okay.
DR. SUAREZ: Here’s my suggestion. You know, this letter sets out a framework on recommendations for health information and stewardship that may be used by communities to improve health.
DR. FRANCIS: That’s good.
MS. MILAM: Yeah.
DR. SUAREZ: So it’s really for health information and stewardship.
MS. BERNSTEIN: Yes, it really goes over here, actually. Because you want this to be attached to the recommendations maybe used, right? Not the information may be used.
MS. KLOSS: Right.
DR. SUAREZ: Well, that’s what I’m saying, that the framework and recommendation is the one that may be used by communities. Wait. No. I think it worked better the other way. So let me read it the other way. “This letter sets out a framework and recommendations for health information stewardship that may be used by communities to improve health.” Because it’s really the framework and recommendations that may be used by communities.
MS. BERNSTEIN: It’s ambiguous, as to whether it refers to health information or for —
DR. FRANCIS: I think we’re saying too much in that sentence now.
DR. SUAREZ: No, if you type health information and stewardship, instead of a stewardship or heath information.
MS. KLOSS: Why don’t we combine the sentence with the next one?
DR. FRANCIS: Yes.
MS. KLOSS: We only need one sentence. “This letter sets out a framework and recommendations that may help HHS to facilitate and support effective stewardship.”
DR. FRANCIS: Okay, so moving on along, we’ve got 15 minutes.
MS. BERNSTEIN: This is not going to work, but okay. We’ll work on it. I’ll make a flag.
MS. KLOSS: I like that.
MS. BERNSTEIN: But this is awkward.
MR. TANG: We really do have much more to —
DR. FRANCIS: Yes, what we’re going to do now is you see the topics are here, but we’re taking out “musts.”
MS. BERNSTEIN: Here’s background. Did we go — we talked about this already.
MS. KLOSS: We did.
DR. FRANCIS: We’ve talked about this.
MS. BERNSTEIN: So those are gone. Do you want to talk about this part? This last paragraph?
MS. MILAM: In that paragraph above, that we just skimmed through, where we referenced the IRB and everything else, that reminds me of Ob’s comment. Which is sort of similar to this but at a higher level, such that this letter would be useful where you have a gap, where you don’t have an existing regulatory framework. Would we want to just say that, instead of identifying all of these specifics?
MS. KLOSS: But here we’re describing existing paradigms. Not the use of the new framework.
MS. BERNSTEIN: We in fact do that. We say, just below we say, where did my part go, about —
DR. FRANCIS: I think we should take out this paragraph that’s here. I think we’ve said it in the earlier one.
MS. MILAM: I do too.
DR. FRANCIS: Yeah.
MS. BERNSTEIN: Which paragraph?
DR. FRANCIS: “A successful stewardship framework,” that one right there.
MS. BERNSTEIN: That?
DR. FRANCIS: Yes, I think we’ve said all that.
MS. MILAM: And was this talking about the scalable? About governance of a particular community. About using the existing structures in a community.
DR. FRANCIS: Yeah. I think that’s good.
MS. KLOSS: There is some redundance.
DR. FRANCIS: So the idea of this paragraph sounds, see if you’re okay with it, is to say that the framework, some of them actually may apply, but they’re not enough. They’re just not a particular group that fit, for some of the uses at issue.
MS. MILAM: I was wondering if we would want to take it at a higher level and not get into the detail of it, just to say where there are inadequacies today, whether you have no regulatory scheme or an inadequate scheme, instead of getting into these specifics.
DR. TANG: So I was just guessing that you guys got pushed back, about trying to expand HIPAA. Whereas, what I read was the reason we’re even working on this problem is because HIPAA doesn’t cover it, not that we’re trying to —
MS. BERNSTEIN: Right. Some people read that as implying we would like people to apply.
DR. TANG: Couldn’t we just fix that piece, rather than take out — I’m worried that somebody who wants to use this stuff doesn’t really understand what we’re trying to say and why we’re saying it. And if we — then it’ll just look like –
MS. BERNSTEIN: Well, it’s true. In fact, if HIPAA applies it’s consistent with this framework, in fact. I mean there’s nothing in here that would, as far as I know, conflict with HIPAA. It’s got a structure. If you’re governed by it, you’re governed by it. Similar principles are in there.
DR. MAYS: But I think what we’re trying to do is to — the community is likely to have situations where HIPAA doesn’t apply.
MS. BERNSTEIN: That’s right.
DR. MAYS: I think we want to excite them about the fact that this is something that they can take and try and, you know, go through and utilize, in order to be better stewards. So I think it’s like putting in the positive, in an exciting way.
DR. TANG: Right.
DR. FRANCIS: So how about, if after IRB process, we say, some of these data uses may be covered by HIPAA, but not all may not be.
DR. MAYS: But some of these are ones we said were covered. Right?
MS. BERNSTEIN: Data uses – these are processes for how to use data, consent, and the identification. Is that what you mean?
DR. FRANCIS: — the data uses may be covered by HIPAA, but all may not be.
MS. BERNSTEIN: Can we just say —
DR. FRANCIS: Existing frameworks have gaps. Or say all of these frameworks. Or just say none of these frameworks are adequate to — none of these frameworks are completely adequate.
DR. TANG: So, Instead of focusing on that, we’re saying — we’re working in an area that wasn’t even envisioned by HIPAA.
MS. KLOSS: Right.
DR. TANG: And we’re not prescribing, we’re not — we’re not prescribing regulations. We’re providing communities with guidance on how to work with this data — how to collect and appropriately use this data, as a good steward. I mean that’s the concept.
MS. KLOSS: Yeah, that is the concept.
DR. MAYS: How about something like —
DR. TANG: We should just say it.
DR. MAYS: Where it says “some,” to start out with — let’s see, “Waiver consent, through the IRB process.” “Over the years there have been an increase in uses of data previously not covered under HIPAA. Communities may find that this document might provide useful guidance for that data, when it’s not covered by HIPAA.” Something like that.
MS. BERNSTEIN: I am not sure it’s increasing. It just wasn’t covered, it wasn’t addressed.
DR. TANG: It just wasn’t — yeah.
MS. BERNSTEIN: Like just wasn’t —
MS. MILAM: Well, we’ve lobbied so that it wouldn’t be cover. They were well aware of the scope. I think we need to be careful how we write this in there, so that we don’t — you know the concerns that were raised earlier, this language causes me more concern. I would read this and think that we’re suggesting that HIPAA be expanded cover.
MS. BERNSTEIN: That’s the problem we’re trying to solve by taking it out. That was the problem the committee was trying to address.
MS. MILAM: Yeah. That collection, use and dissemination, I would not get into all that.
DR. FRANCIS: I’d would take the HIPAA stuff out. And I would say, “more existing frameworks are completely adequate.” And I wouldn’t say “none of these frameworks” I would say, “No existing frameworks are fully adequate to the evolving kind of data use.
MS. KLOSS: But we wanted to keep it — then starts feeling scary.
(Cross-talk).
MS. KLOSS: I would just suggest a new set of regulations.
DR. TANG: Right.
MS. MILAM: Because we’re starting to enable. We’re trying to —
DR. TANG: So state what they’re doing. Communities are trying to use this data to improve the heath, the health of their population. This framework helps provide guidance on good stewardship of that data, which includes the collection, management, and the perfect use. You know, something like that. So we start with the positives.
Communities are out there trying to improve their health. And we’re just providing an additional set of tools.
DR. FRANCIS: For good stewardship when they do so?
DR. TANG: Yeah, yeah.
DR. FRANCIS: And then take out all of the criticisms.
DR. TANG: Right. Right. That’s the one.
MS. BERNSTEIN: Yeah.
MS. MILAM: We could end with good stewardships of –
MS. BERNSTEIN: Publish? I don’t want to get the — I want to leave the idea that it’s only use of data and not collection and not — we’re talking about the life cycle of the data.
DR. TANG: Right. It’s the collection management and appropriate use.
MS. BERNSTEIN: Okay.
DR. MAYS: Inappropriate use.
DR. TANG: Inappropriate use. Yeah, that’s one word.
MS. BERNSTEIN: Which you include disseminate and use.
DR. TANG: Well, disseminate just looks like you’re spreading it around.
MS. BERNSTEIN: I mean appropriately it’s — you’re supposed to publish it so people can use it. That’s like the —
DR. TANG: Well, you publish aggregate.
MS. BERNSTEIN: — the purpose of research, right? Is to make it public so that people can make use of it. So people can learn from it.
(Cross-talk)
DR. TANG: Right. The results. Right.
DR. SUAREZ: Well, they might actually release data as well.
MS. BERNSTEIN: Public use of data sets. I mean we’re pushing for that in the department.
DR. SUAREZ: Use and disclosure of data.
MS. KLOSS: Well, can we just use “use?”
DR. TANG: Yeah.
DR. SUAREZ: Well use is a specific aspect of what is done with data —
MS. BERNSTEIN: We did say good stewardship, right? I mean that’s the point.
DR. SUAREZ: And some of these communities actually do disclose data to others, to do work.
MS. BERNSTEIN: We had a boolean discussion earlier. All right.
DR. FRANCIS: So I do think we need to say something about these approaches and we ought to say something about how those approaches may not always be good ones. You know. Or all the problems with the assistance — is the communities can’t use data under those circumstances.
DR. SUAREZ: The only concern there, though, is that we’re saying if it doesn’t apply there’s no law or good structure, so we’re doing this. And so it’s almost like we’re equating or creating a parallel between these principles and some regulation that protects that. And so I think it’s good to mention that there’s no regulatory framework to protect this data. But I would not try to equate the principles we’re giving with regulatory framework or some sort of a — since there’s no regulatory framework, then these are these principles. And that’s the risk, is we’re framing all this around the fact that there’s no laws or regulations, apparently, that protect this data.
MS. BERNSTEIN: There might be, but we’re saying there might be state law, there might be — there’s ethical principles, sometimes, sometimes the common law applies, but we’re saying none of these things, by themselves, is adequate. Sometimes they’re not practicable.
DR. SUAREZ: Oh, and so we’re saying that these principles are —
MS. BERNSTEIN: Are helpful in sort of filling the gaps I think, or giving, where there’s nothing, giving a framework, and where there’s something, maybe — you know, filling in gaps. That’s my sense of it.
MS. KLOSS: I would suggest we take maybe another ten minutes and scroll through —
MS. BERNSTEIN: Yes. Thank you for saying that.
MS. KLOSS: — the rest of it, and just at a high level, and see if we’ve got the titles or the labels on each, the headers right.
DR. FRANCIS: Maya, Linda and I will make sure we figure out how to make that particular paragraph not offensive.
MS. MILAM: I’m going to have to run.
DR. FRANCIS: We understand what to do there.
MS. BERNSTEIN: All right. This is part of the same — I want to get beyond this part.
MS. KLOSS: Yeah.
MS. BERNSTEIN: You want to just go look at these now.
DR. TANG: Can I add one thing, and I don’t know whether you —
MS. BERNSTEIN: How strongly do you feel about it?
DR. TANG: Well, I guess strong.
MS. BERNSTEIN: I want you to look at the rest of this thing.
DR. TANG: My thing was the definition of stewardship, which I think is critical.
MS. BERNSTEIN: Are we going to quote it from that document? Because then I could just copy it.
DR. TANG: What’s entered is ensuring appropriate use, and I don’t know that that does enough to capture — so I added two things. One is — so ensuring the appropriate —
MS. BERNSTEIN: Can you tell me what paragraph you’re in?
DR. TANG: It’s right under “stewardship framework.” “The community defines stewardship as –”
MS. KLOSS: The problem with changing it is that that’s a quote.
DR. TANG: I fully understand that.
MS. KLOSS: Okay.
DR. TANG: And I just think that we missed it.
MS. KLOSS: Well, it was five years ago.
DR. TANG: Right. That’s why I’m saying I think — I think we understand a lot of it. So appropriate use of meaningless data is just not useful. So we have to have data integrity, appropriate use, and protection.
MS. BERNSTEIN: Well, we have that in the second sentence.
MS. KLOSS: But we added it as another sentence. Because you indicated that —
DR. TANG: I know. But —
MS. KLOSS: Did that help?
DR. TANG: No. Because it doesn’t — it’s in the definition. You’re writing about something — you’re just writing about this thing we call stewardship.
MS. BERNSTEIN: Okay, so here’s how we —
DR. TANG: So that’s just my sentiment.
MS. BERNSTEIN: That’s how we changed it here. Have you even — have you looked at what we did here?
DR. TANG: Where does it say —
MS. BERNSTEIN: Sorry. We changed around the organization of this paragraph, specifically.
DR. TANG: Well, I’m just reading it define stewardship and — that’s a quotable quote.
MS. BERNSTEIN: Yes. And the next sentence says —
DR. TANG: It doesn’t matter what the next — Merriam Webster doesn’t say here’s the definition and then — but you ought to read what else I have.
MS. BERNSTEIN: Do you want to paraphrase it instead?
MS. KLOSS: But we can’t quote the committee.
DR. TANG: Correct.
MS. BERNSTEIN: So we can — no we can say the committee originally said — however —
DR. FRANCIS: In 2009 the committee —
MS. BERNSTEIN: In 2009 the committee said “x.”
MS. KLOSS: Yeah. Yeah.
MS. BERNSTEIN: But we now —
MS. KLOSS: That’s good.
DR. TANG: And we’re expanding the definition to include —
MS. BERNSTEIN: Understand that this is more fullsome —
MS. KLOSS: Yeah. Yeah.
DR. TANG: — data integrity and — because that’s part of what we heard too, is they’re worried about what’s in there and whether it’s true.
MS. KLOSS: Okay.
MS. BERNSTEIN: Right.
MS. KLOSS: That works.
DR. TANG: And then we’ve added — I mean the whole reason it’s in this committee is —
MS. BERNSTEIN: Is that better? If we say —
DR. FRANCIS: In 2009 the committee defines —
MS. KLOSS: Stewardship as —
MS. BERNSTEIN: Stewardship as this blah, blah, blah. However —
DR. TANG: We now understand —
MS. BERNSTEIN: Ensuring the integrity of data is a complementary stewardship responsibility or —
MS. KLOSS: Yeah.
MS. BERNSTEIN: Or stronger words if you like, but it makes clear that that’s not enough.
MS. KLOSS: Is another key. The way we had it is, is another key stewardship responsibility.
DR. TANG: But how do we want people to quote our definition of stewardship?
MR. DeCARLO: (off mic)
DR. TANG: No, we’re not changing, we’re just creating a new definition, a more —
MS. KLOSS: So we could add another sentence, so a more complete —
DR. TANG: So you guys can decide that, how to write that, if you agree that —
MS. BERNSTEIN: A more complete definition.
DR. TANG: — if people are agreeing that we need to add these —
MS. KLOSS: A more complete definition would —
DR. FRANCIS: Include matters such as —
MS. BERNSTEIN: We can include ensuring.
DR. TANG: Well, you don’t want to have it too lengthy. But really what we’re talking about is it’s got to be good data, so it’s data integrity.
MS. KLOSS: Right.
DR. TANG: It’s got to be protected and it’s got to be used appropriately. And those, I think, are the main things that our principles try to ensure.
DR. FRANCIS: Right. However —
MS. BERNSTEIN: – is protected and used appropriately. So integrity is the piece you’re missing. Right.
DR. TANG: You just not put in the definition. We want our definition to be quoted from now on as this.
MS. BERNSTEIN: Write me a sentence and I’ll it.
DR. TANG: Leslie can work on the things — we just agree on what it is in the definition.
DR. FRANCIS: And expanded definition.
DR. TANG: Right.
MS. KLOSS: A comment from the morning was to take out the “musts.”
DR. FRANCIS: Let’s see if we’ve done it.
DR. TANG: Fine, you guys can do that. I mean fine you guys do it. I suggested a couple of combinations. Did that — does that help?
DR. FRANCIS: We did make a combination. MS. KLOSS: In what you sent yesterday?
DR. TANG: Yeah.
DR. FRANCIS: We didn’t get that. We couldn’t open any of your –
MS. KLOSS: I opened it and there were no corrections in it.
(Cross-talk)
DR. TANG: Okay. So the only two other points that can help us, I mean in my — so number 9 we say that data —
MS. BERNSTEIN: Number 9?
DR. TANG: It’s the principle number 9. Couldn’t we combine — so we’ll talk about the impact and burden. And couldn’t that be put into number 4, which is — it’s really considering — it’s considering communities, when you deal with their data, and everything that has to do with the communities. And you’re involving them in decision-making, taking them into account. And maybe that’s not — when I look at it now.
MS. BERNSTEIN: Number 4 has to do with governance and decision-making processes.
DR. TANG: Okay. I’ll withdraw the motion. Number 10 was — could we combine that with number 8? So we’re talking about —
MS. BERNSTEIN: Stigma and discrimination in number 10, and in number 8, enhancing datasets. The risk of enhancing datasets, so that’s the mosaic effect. Mash-ups, we call them here, but —
DR. TANG: But isn’t that about risk?
MS. BERNSTEIN: There are different kinds of risks. One is a risk of identification of individuals and one is a risk of improper inferences.
DR. FRANCIS: About the entire community.
DR. TANG: And stigma.
DR. SUAREZ: Okay.
DR. FRANCIS: That’s why we have that.
MS. BERNSTEIN: Does that help? Okay. But if that’s not clear we should make that more clear. Okay. Do you want to go — so one is messy but you know what I could do is take out — just hide the changes for the moment, so you can just look at it clean?
DR. FRANCIS: Yes, let’s read it clean and see if we can read through it.
MS. BERNSTEIN: It’s going to have the comments, still, for the moment. So here’s the openness and transparency. Here’s how it reads now. There might still be spacing and other errors. I don’t know if anybody’s on the phone. Do you want me to read it? Not really. It takes too long, but —
DR. MAYS: I take it we’re going to get this tonight, right?
MS BERNSTEIN: I’ll see you at 9. I’ll see you for dessert.
DR. FRANCIS: If I have it on a —
MS. BERNSTEIN: I’ll just sit at Marjorie’s living room and do it.
DR. FRANCIS: Yeah.
MS. BERNSTEIN: That’s fine.
DR. FRANCIS: I’m going to take my laptop out to Marjorie’s.
MS. BERNSTEIN: Yeah. Okay.
MS. KLOSS: I always take my laptop to a picnic.
MS. BERNSTEIN: Okay. So this is the first one. Are we — this is just all a bunches of comments. It doesn’t — this is how it reads.
I just attached the comments to here. That’s how it reads now.
MS. KLOSS: That is fine.
MS. BERNSTEIN: Let me go on to the second one.
DR. FRANCIS: We took out newspapers, by the way, just (indiscernible).
(Cross-talk)
MS. BERNSTEIN: Boy that was read really broadly by a lot of people in the room earlier today. That was surprising. The idea that Leslie should suggest regulating newspapers was really great.
Leslie doesn’t really believe in the First Amendment. (Laughter)
DR. FRANCIS: I don’t want any flashpoints.
MS. KLOSS: Maybe it needs to be — well, we still have some parallel phrasing, because we’ve got some verbs.
MS. BERNSTEIN: “Significantly.” We don’t like this word, right?
MS. KLOSS: And “some.”
MS. BERNSTEIN: Okay. Do you want to make a note about this one? A little awkward.
MS. KLOSS: Yeah.
DR. FRANCIS: Yeah.
MS. BERNSTEIN: Okay, what’s 3 say?
DR. FRANCIS: And then it should be communication with the community, not — because again, we’re not —
MS. BERNSTEIN: Sorry. It was intended to be that.
DR. FRANCIS: The committee heard testimony that communities want to know — so just start the sentence, it says “The committee heard testimony that — ” Start the first sentence with a reference to testimony also.
MS. BERNSTEIN: You don’t want to delete this sentence.
DR. FRANCIS: No. I want it to start with, “The committee heard testimony that communities –”
MS. KLOSS: “Want to know.”
DR. FRANCIS: “Want to know.” “The committee also heard testimony that –” Okay. That’s all.
And then it just says that they should consider —
MS. BERNSTEIN: “It” is giving me trouble.
MS. KLOSS: The data.
MS. BERNSTEIN: Yes. Because they’re plural, you know.
MS. KLOSS: Yeah. Data have
DR. FRANCIS: Have had.
DR. TANG: And you say used frequently. I don’t know that you need that, right? “Object when their data are used without any effort.”
DR. FRANCIS: Okay.
MS. BERNSTEIN: Yeah.
DR. TANG: There’s no need for that.
MS. BERNSTEIN: That’s right.
DR. FRANCIS: Without the “but.”
MS. BERNSTEIN: Right. Agreed?
DR. TANG: “Used.”
DR. FRANCIS: Without — take out the “but.”
DR. TANG: Yeah. Take out the “but.”
DR. SUAREZ: Yes, this one and number 1 are the two that I thought were quite overlapping. You know. Number 1 is all about open and transparent and is all about communicating with the community.
MS. BERNSTEIN: I think the idea is that number 1 was intended to deal with up front, before a project begins, what’s going to happen to your data, how are we going to collect it, sort of notice stuff, and the transparency up front. And this is intended to deal with communication after — of results of data.
MR. BURKE: So 1 is the outcome and 3 is the output.
MS. BERNSTEIN: Yeah. Yes. Well 1 is —
MR. BURKE: 1 is the process, 3 is the output.
MS. BERNSTEIN: Yeah.
DR. FRANCIS: Yeah.
MS. BERNSTEIN: I think that’s right. And we haven’t really been clear about that, I think. But I think that was the intention. I think we could combine those and say you need to communicate with people, both at the beginning and at the end of a — you know, or throughout the project, to be fully transparent.
Openness continues throughout the life of a project. We could make something like that and combine those two if that’s what the committee wants to do.
DR. FRANCIS: We might also want to eliminate the last sentence, because we raised the stigma stuff in the — okay?
MS. BERNSTEIN: Yes. So it looks like it’s gone but it’s actually going to show when I —
DR. FRANCIS: Right.
MS. BERNSTEIN: It’ll show here.
MS. KLOSS: Well, I’d be in favor of combining those. I think it strengthens number 1. No? Okay.
MS. BERNSTEIN: No, you don’t want to combine them and talk about communication throughout the project? Because number 1 is where we’re talking about outreach and where you cut off the journalists. Engagement.
DR. FRANCIS: Yes, you could just move that.
MS. BERNSTEIN: Engagement and — ways of engaging the community and —
MS. KLOSS: Yes, I think it works.
MS. BERNSTEIN: This is 1, you know people are pissed when they don’t know what’s going to happen with their data, and people are pissed when they don’t find out after the fact either, right? That’s sort of what this says.
DR. FRANCIS: Yes.
MS. BERNSTEIN: Okay. So we’ll figure out how to combine those eloquently.
DR. SUAREZ: Part of this is really basically saying, okay, we tell the community beforehand what we’re going to do with the data. The way it’s phrased right now, the community wants to know their data have been used. Well, it is more about whether the data was used according to what they were told it was going to be used for. So that’s why the two are connected. It gives the impression that this is an afterwards kind of a thing.
MS. KLOSS: But I think — I think it — to combine them would underscore that openness and transparency is —
DR. SUAREZ: Exactly. (Indiscernible)
(Cross-talk)
MS. BERNSTEIN: Continuing.
MS. KLOSS: A continuing issue.
MS. BERNSTEIN: Okay? Very good. We’re moving on to number 4. I will show you what it says.
DR. FRANCIS: Okay. Keep going.
MS. BERNSTEIN: Is this more of 4? Yes. This is more of 4. This is interesting, the way it’s –
DR. FRANCIS: Yeah. We need to clarify that we’re not saying you have to involve individuals. You might say sometimes it is appropriate to involve other individuals. Appropriate alternative approaches. Alternatives to informed consent, for involving individuals, may include —
MS. BERNSTEIN: You need like a — How about a semicolon? How do you feel about that?
DR. FRANCIS: One thing we could do at this point is conclude the formal committee process, because we’re at our end and so that anybody who wants to stay for the next 15 or 20 minutes, to help Maya and Linda and myself, work on this. And then we can head out to Marjorie’s.
MS. BERNSTEIN: Are you coming — going directly from here?
DR. FRANCIS: Yes, I’m going to go directly from here.
MS. BERNSTEIN: Okay.
MS. KLOSS: Yeah. At this stage I am.
MS. BERNSTEIN: We’re good.
DR. FRANCIS: Everyone okay?
MS. BERNSTEIN: Great.
DR. FRANCIS: Thank you. I want to thank the staff for all your hard work and make sure that that the meeting is adjourned.
(Whereupon, the subcommittee adjourned at 5:48 p.m.)