[This Transcript is Unedited]
DEPARTMENT OF HEALTH AND HUMAN SERVICES
NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS
SUBCOMMITTEE ON PRIVACY, CONFIDENTIALITY AND SECURITY
September 22, 2009
Washington Marriott Hotel
1221 22nd Street, NW
Washington, D.C.
Proceedings by:
CASET Associates, Ltd.
Fairfax, Virginia 22030
(703) 266-8402
P R O C E E D I N G S (3:30 p.m.)
MR. HOUSTON: This is a meeting of the Subcommittee on Privacy, Confidentiality and Security. The real purpose of the meeting today is to try to get this letter completed and back to the full committee tomorrow. As well as, if we do have some time, I guess really it is appropriate for us to talk about next steps because we will have accomplished the big thing we want to get accomplished this time. I guess we will have some open cycles in after that. With that said I think we should go around the room and formally introduce ourselves. I am John Houston. I am a Co-Chair of the Subcommittee and I have no conflicts.
DR. FRANCIS: I am Leslie Francis. I am a Co-Chair of this Subcommittee and I have no conflicts.
MS. CHAPPER: Amy Chappers, Centers for Medicare and Medicaid Services, and Staff to the Subcommittee.
MS. MILAM: Sallie Milam, member of this Subcommittee and no conflicts.
MS. BERNSTEIN: I am Maya Bernstein from the Office of the Assistant Secretary for Planning and Evaluation. I am Lead Staff to the Subcommittee.
MS. HORLICK: Gail Horlick, from the Centers for Disease Control and Prevention and Staff to the Subcommittee.
DR. SUAREZ: Walter Suarez. I am a member of the Subcommittee and I do not have any conflicts.
MS. BERNSTEIN: The first thing we need to do is create some kind of introductory paragraph.
MR. HOUSTON: Can I suggest there was a paragraph below a little bit that I thought had some really good information. It was more background than anything. I think it was like –- maybe under what was the value section even.
DR. SUAREZ: Yes, I think it was the third paragraph of the letter –- the second sentence.
MS. BERNSTEIN: Okay I am getting it.
DR. FRANCIS: That is what Marjorie mentioned but I think we should go back even a step before that. Since this is our first letter to Secretary Sibelius, it was suggested that we should have in the introductory paragraph a little bit about NCVHS. I would recommend we have a first sentence that says something like this –- The National Committee on Vital and Health Statistics is the Federal Advisory Committee charged with –- and then quote NCVHS’s website, what the Committees Charter -– just quote the Committee. I think we originally had a sentence to that effect at the beginning. Then the second sentence should say something about — the NCVHS has made a number of previous recommendations about health information privacy. In this letter we take up the important issue of protecting privacy and confidentiality in personal health records. Then go to what John was taking -– personal health records take many forms that are important –- this is where the worry that I think it was Mark raised and several others about benefits of PHRs.
MS. BERNSTEIN: Before we get there I would recommend we have a sentence that tells the Secretary what we are doing here. Like this letter recommends you –-
MR. HOUSTON: Well, it does.
MS. BERNSTEIN: It does not say that.
DR. FRANCIS: This letter contains our recommendations—-
MR. HOUSTON: But that is already in here.
MS. BERNSTEIN: Where?
MR. HOUSTON: If you look at the bottom of what I have as the first page after footnote number 2. The next sentence says this letter contains recommendations from the National Committee on Vital and Health Statistics about Privacy and Security of PHRs for HHS to consider when creating this report or considering other policy changes. That is the purpose of the letter. Now it is starting to get buried –-
MS. BERNSTEIN: Yes, that was my point. It needs to be really up front. You have got to tell the Secretary why you are writing her. In the past we put some basic one sentence up there and we could move that sentence up.
DR. FRANCIS: Okay so Maya here is the quote from our Charter -– The National Committee on Vital and Health Statistics is the department’s statutory public advisory body –-
MR. HOUSTON: Wait — time out — hold on.
DR. FRANCIS: –statutory public advisory body on health data, statistics and national health information policy.
MR. HOUSTON: Okay I would also say then after that sentence we need to make a single sentence about this Subcommittee then.
DR. FRANCIS: No, because this does not come from the Subcommittee it comes from the Full Committee.
MR. HOUSTON: But what we might want to say is that this letter was the –- do we want to say anything about the -–
MS. BERNSTEIN: No. We are working as the –-
MR. HOUSTON: Okay then we should say though then that NCVHS has made a number of previous recommendations about health information –- but rather than say that a number of –- no there is a long history of making recommendations. NCVHS has historically made recommendations about health information privacy, confidentiality and security.
DR. FRANCIS: Excellent.
MR. HOUSTON: And I hate to make it even longer but you could say something about its statutory obligations with respect to HIPAA. So we need to keep this brief but -–
DR. FRANCIS: Why don’t you say after health information privacy has historically made recommendations about health information privacy and has -–
MR. HOUSTON: Well, do we want to say comma security – confidentiality and security and is the –
DR. FRANCIS: — and has statutory responsibilities for HIPAA.
MS. BERNSTEIN: That is too broad. The responsibilities are to make recommendations regarding the statutory responsibility for HIPAA.
MR. HOUSTON: Briefly we want to speak -–
MS. MILAM: I like the idea of including a reference to HIPAA within this letter to set the stage –-
MR. HOUSTON: This is within our scope.
MS. MILAM: Right.
DR. SUAREZ: It is just that the circumstances jumps into –-
MR. HOUSTON: Okay but let’s-–
DR. FRANCIS: No, I like it.
MR. HOUSTON: I am not sure I see now what did you –-
DR. SUAREZ: Well, it goes from we are a statutory advisory body on health information statistics and it is almost like that is a different paragraph. That NCVHS has historically made recommendations about health information privacy does not –
MS. BERNSTEIN: Well, it is an advisory body. They make recommendations. That is what advisory –-
MR. HOUSTON: I do not see how the two are —
MS. BERNSTEIN: I mean to advise is —
MR. HOUSTON: I think it flows.
MS. BERNSTEIN: We could use that word again if –
MR. HOUSTON: I would strongly recommend that we let Harry and Marjorie and Jim decide the tone of this paragraph. Because honestly if they feel they need to say something here it is –-
DR. SUAREZ: I agree.
DR. FRANCIS: Let’s make a suggestion for them though because we need to have this and take up the important issue -–
MR. HOUSTON: That is what I am saying.
MS. HORLICK: You could take that last sentence in the original first paragraph that says this letter contains recommendations instead of saying in this letter –- just move it up there instead of the last sentence you have there.
MR. HOUSTON: That is fine. Move it up then. I think that makes sense.
MS. HORLICK: Then of course you have to write out —
DR. FRANCIS: Yes, take that.
MR. HOUSTON: Just move it up.
MS. BERNSTEIN: Well, it is now on my page two.
DR. FRANCIS: Take that sentence –-
MS. HORLICK: Yes, right there. This letter -– that is it.
MR. HOUSTON: But I do not think we are done with this first paragraph yet.
DR. FRANCIS: No. We need a sentence about the benefits of personal health –-
MS. BERNSTEIN: Yes, but that is going to be a new paragraph.
MR. HOUSTON: That is going to be another paragraph.
MS. BERNSTEIN: This wants to go here and do you want to axe the previous one –-
MR. HOUSTON: You just did it twice.
MS. BERNSTEIN: Do you like that one better?
DR. FRANCIS: About the privacy and security of PHRs period.
MS. BERNSTEIN: We know who we are -– that is why we are writing.
MR. HOUSTON: No, I still think we should have the whole sentence. We do not have to talk about this report yet –
DR. FRANCIS: Yes, we have not said the report so –why don’t we just say the privacy and security of PHRs.
MR. HOUSTON: Can I make a suggestion? I know this makes us – after ACT would you break it and make it into another paragraph. Just hear me out for a second. Now go down and grab the sentence where they talk about what –- go back down to that paragraph where you stole that sentence from and -–
MS. BERNSTEIN: Here?
MR. HOUSTON: Yes, grab that from there are substantial – just humor me — and go the whole way down. Just grab it and take it the whole way down to the end of the paragraph. And if you do not like it we will -– just trust me — Copy the whole thing. Now drag that whole thing up and put it above that sentence that we just started the other paragraph with.
MS. BERNSTEIN: Yes, I cut it. We are not going to write it twice.
MR. HOUSTON: I know. Then put it before -– this letter contains. Then we can start there a little bit and talk about –
MS. BERNSTEIN: You understand that this language has no benefits in it. We have not written that part yet –
DR. FRANCIS: Yes. We have to put down what the benefits are.
MR. HOUSTON: I understand. That is what we are going to do now.
MS. BERNSTEIN: But you have grabbed all the negative stuff, not the benefits.
DR. FRANCIS: Yes. We need to say something like this –- personal health records, a growing part of the health information landscape, have many benefits –-
MS. BERNSTEIN: Where do you want it to go?
MR. HOUSTON: Right there — right between those paragraphs.
MS. BERNSTEIN: Right there?
MR. HOUSTON: Yes.
DR. FRANCIS: Personal health records -– a growing part, of the health information landscape, have substantial benefits for patients, caregivers, healthcare providers and society more generally.
MR. HOUSTON: Yes. Now stop right there and say -– however –-
DR. FRANCIS: However they also raise –-
MR. HOUSTON: No, just read what is right there. Just take that thing. Consumers do not fully understand –-
DR. FRANCIS: No. That does not make sense yet. However, PHRs also raise important privacy, confidentiality and security concerns. This letter contains NCVHS’ recommendations about the privacy, confidentiality and security of PHRs for your consideration. Now let’s see that.
MR. HOUSTON: Can we read this? Can you do me one favor Maya? Go up to –- which version of Word are you using?
MS. BERNSTEIN: I have no idea.
MR. HOUSTON: Because in the new version of Word you can actually turn off all the formatting.
MS. BERNSTEIN: You do not want to see these little boxes? Is that what you are telling me?
MR. HOUSTON: The format boxes.
Ms. BERNSTEIN: They are off on the side.
MR. HOUSTON: I know but it is hard to read them. It makes it smaller on the screen.
MS. BERNSTEIN: Okay. Well, I can get you bigger screen if that is your issue. Tell me what your issue is?
MR. HOUSTON: I just wanted to read it easier.
MS. BERNSTEIN: Okay that is different because if I take out the balloons you are going to have strikeouts in the middle and you will not be able to read that either. That is why I put everything on the side. I just want to make sure I can get the whole thing on the screen. Is that better?
MR. HOUSTON: That is fine. Now we have two cases where you have this letter contains NCVHS recommendations –-
DR. FRANCIS: No. Then we go back to where the letter was. This is the introduction -– those first two paragraphs.
MS. BERNSTEIN: Okay but what he is saying is paragraph one and paragraph two both end with the same concept.
MR. HOUSTON: Yes — then in that paragraph two and three –- this letter contains –
DR. FRANCIS: That all goes and we put the other stuff back where it was.
MS. BERNSTEIN: Wait. That and that stuff is not going to work for me. You need to be more explicit.
DR. FRANCIS: Okay. Where you cut it, you need to restore and you need to get rid of the little tiny paragraph at the bottom after that.
MR. HOUSTON: You see I disagree with you. I think that paragraph needs to stay.
MS. BERNSTEIN: But it is here and it is here.
MR. HOUSTON: I think it is more meaningful if you took out the first reference –- this letter contains –
MS. BERNSTEIN: You want to take out this one here?
MR. HOUSTON: No — right starting there.
MS. BERNSTEIN: Yes? Okay
MR. HOUSTON: And then merge that paragraph with the one below it capitalizing Consumer.
MS. BERNSTEIN: Okay.
MR. HOUSTON: Wait — just hear me out.
MS. BERNSTEIN: The negative stuff does not belong there in this introductory stuff.
DR. FRANCIS: Yes. That is too much information.
DR. SUAREZ: Yes. I think in this paragraph we just need to say –
MR. HOUSTON: But you are trying to set the stage for what the recommendation letter is about and you do not want to say -– that single sentence paragraph is vital because you are setting the stage for the entire letter right there.
MS. BERNSTEIN: Well, you did. You said there are advantages and then in the next sentences you said there are important concerns.
DR. SUAREZ: The only think you need to say – otherwise you are giving the whole detail in the introductory paragraph. I would just say –- in this letter we address the issue of personal health records and privacy and security. Something very simple –-
MR. HOUSTON: Here is where I disagree. This letter is for a very specific purpose. We are trying to get it out this meeting for a very specific purpose which is to allow HHS to use it when creating a report that they are being told they need to create. So I do not think –-
MS. BERNSTEIN: So we should say that?
DR. FRANCIS: We do say that.
MR. HOUSTON: If we are trying to call attention to why this letter is being written I think we need to say that here and that is all I am trying to do is put it up front so people can say, Okay, now I know what you are sending me this letter for. A general statement about this letter talking about privacy is not sufficient.
DR. FRANCIS: That is what we were asked to do.
MS. BERNSTEIN: This part you want to capture.
MR. HOUSTON: If we want to capture that and we want to say that is why we are doing this letter, which is what that original sentence said.
DR. FRANCIS: So you can take what Maya has highlighted and put it after –– however, PHRs also raise important privacy, confidentiality and security concerns. Put it there —
MS. BERNSTEIN: Yes. Actually that works.
MR. HOUSTON: That is fine.
DR. FRANCIS: This letter –-
MR. HOUSTON: Now we just have to worry about what to do with the sentence that starts with consumer.
DR. FRANCIS: That goes back to where it was.
MR. HOUSTON: All right. We can do that. Though I am not sure whether that becomes –-
MS. BERNSTEIN: This needs to go after –-
MR. HOUSTON: See that is what I originally said and they said it was too much negative. I would prefer -–
DR. SUAREZ: Saying in an introductory statement such as an I agree button is way too much detail.
MR. HOUSTON: All right then we will put it back down there but I think the rest has to remain.
DR. FRANCIS: I am okay with that.
MS. MILAM: and we really, I mean, for the Full Committee to take this up tomorrow we are going to have to be solid on it.
DR. FRANCIS: We have to have it exactly the way we want it.
MR. HOUSTON: Well, that is why Leslie is not going to dinner tonight. She is going to Wordsmith all of this and then about one o’clock in the morning she is going to go to bed.
MS.MILAM: She can sleep on it, and churn it around and it will come out perfect.
MR. HOUSTON: No, we will get this done and if we need to we can work on it this evening. I can –- I am not worried about it. But I want to get the flavor of it and I understand Walter, I think we are okay with it.
MS. BERNSTEIN: So we are back at the beginning. So that is what the beginning looks like now. Are you happy with that?
MR. HOUSTON: I do not like the charged in particular. Under HIPAA we –-
MS. BERNSTEIN: Well, we just wrote that on the fly. Let’s change it.
MR. HOUSTON: Okay. What I said originally was I think we need to say it has statutory responsibility for making—
MS. BERNSTEIN: Okay. The reason I did that is because it says statutory in the previous ones.
DR. SUAREZ: One other think I would suggest is that I think it is confusing to — on the citation of the definition of EHR citing both the FTC and then citing the Recovery Act definition which is 90% identical.
MR. HOUSTON: You know I think the reason why is because we could not come to a conclusion on which one to use.
MS. BERNSTEIN: Actually I think the reason is that the HHS rule was not out when we did this.
DR. SUAREZ: The Federal Trade Commission rule was not out.
MS. BERNSTEIN: That was out or we would not have been able to quote it.
MR. HOUSTON: I do not disagree we might as well pick on or the other. I am sure somebody is going to have a little heartburn over the one we picked.
DR. FRANCIS: I think we should put it in the footnote but say by comparison.
DR. SUAREZ: Well, by comparison – it is the same so there is no point of comparing.
MS. BERNSTEIN: One of the reasons to take the Federal Trade Commission definition is because they cover things that are not covered by HIPAA and things that are which the letter covers. This letter is about both HRs that are covered by HIPAA and those that are not. And those that are not are regulated by the FTC not by the Department. The Department definition is going to stick to those that are covered.
DR. SUAREZ: No, but the definition at the bottom is not the Department’s definition it is the ARRA definition.
MS. BERNSTEIN: Yes, I understand.
DR. SUAREZ: The Department definition is identical in the FTC rule and the –-
MS. BERNSTEIN: For the lawyers in the room – it means compare the definition of the HR from the act.
MR. HOUSTON: Can we put this sort of on the issues list because I think we have more important things we need to address first and then we can come back to this. I mean I think we want to be clear on this but rather than arguing about it for 10 minutes now let’s get the other stuff done and then move back to it. Not that –-
DR. SUAREZ: Okay that is fine with me but I do not know if you caught that when it says PHR breach notification rule issued not issues by the Federal Trade Commission -– 3 lines above where you are.
MS. BERNSTEIN: Right.
MR. HOUSTON: By the way we are going to need to clean up when we start making acronyms here because we switched everything around so PHR now is defined –-
DR. FRANCIS: Why don’t we just be sure we are accurate about that right now -– Maya why don’t you go up to the top –-
MS. HORLICK: Also I raised this to Maya earlier, she has Recovery Act and then in the footnote we refer to the acronym as ARRA. I know she does not like it -– it is hard to hear, but I think I learn towards ARRA because that is what is in written materials. I am not even sure – well we could say ARRA for the footnotes but I do not think we use it again in the text. I do not think it just says Recovery Act in the text after that first paragraph.
DR. SUAREZ: I do not think they say ARRA anymore.
MS. BERNSTEIN: All right. The question is aside from the footnote are you happy with the first two paragraphs?
MR. HOUSTON: The only thing is that at the beginning of the second paragraph it says we should define PHR then wherever it is first used –-
MS. HORLICK: Put the acronym.
DR. FRANCIS: We should put PHRs—-
MR. HOUSTON: Right there.
DR. FRANCIS: Okay and make sure you have got the National Commission on Vital and Health Statistics -– right?
MS. BERNSTEIN: I will work it out.
DR. FRANCIS: And do HIPAA there too.
MS. BERNSTEIN: Yes, okay.
DR. FRANCIS: Then put NCVHS at the end of that.
MS. BERNSTEIN: I am getting there.
DR. FRANCIS: Then HIPAA after HIPAA.
MR. HOUSTON: Do we need quotations around any of that stuff?
DR. SUAREZ: No, we do not have to say –
DR. FRANCIS: I think HHS is fine.
MS. BERNSTEIN: She knows who she is. If she does not, we are in big trouble.
DR. SUAREZ: So personal health – you want to do H and R upper case?
MS. BERNSTEIN: No, it is not a proper noun.
DR. SUAREZ: We had it in the original letter.
DR. FRANCIS: Then you have to get rid of –- there is a Department of Health and Human Services -– just HHS there.
DR. SUAREZ: Generally speaking — actually personal health records is upper case just like electronic health records.
MS. BERNSTEIN: I see that we had it there before. Tell me how you want it but I do not believe it is a proper noun and I would not normally capitalize it. It is just that the first word is the first word of the sentence.
DR. SUAREZ: Since this one time –- I mean, I do not know –- I do not care.
DR. FRANCIS: And then when you get down you have got two r’s in four, one line up from the end of that paragraph Maya.
DR. SUAREZ: At the start of the next paragraph you say a personal health record –
MS. BERNSTEIN: What I want to know is if you are otherwise happy with all this.
DR. FRANCIS: Yes.
MR. HOUSTON: Yes.
DR. FRANCIS: Except -– changes –- yes. Then you go -– a PHR is –-
MR. HOUSTON: We know Maya, we still need to red line it because we need to be able to show this to the Committee in red line form so they know what has changed.
DR. FRANCIS: We will red line the whole –
MS. BERNSTEIN: Okay. I am going to take out the formatting.
MR. HOUSTON: That is fine.
MS. BERNSTEIN: –so that that does not distract them as you were saying, but I am going to leave the deletions and insertions. Yes?
DR. FRANCIS: A PHR is an electronic record of -–
MS. BERNSTEIN: I got it.
DR. FRANCIS: And then make sure you have got this right. Okay?
MS. BERNSTEIN: Okay.
DR. FRANCIS: Now we do not need to have the benefits in there because we have already done that.
MR. HOUSTON: Already done that –- so just delete that.
MS. BERNSTEIN: Well, we just stated that there are benefits.
DR. FRANCIS: No, we stated it to whom.
MS. BERNSTEIN: We have not described those benefits which is what I think they asked for. We have just stated that there are benefits.
DR. FRANCIS: No, I think what they wanted was just something general that made it clear that they are very important and you know this is not a general disquisition on PHRs. It was just that Mark was upset because it led with a negative and now it does not.
MR. HOUSTON: I agree.
MS. BERNSTEIN: Okay.
DR. SUAREZ: So are we going to keep it in the footnote or why don’t we decide and just say –- and drop the ARRA definition that is –. Right now the FTC rule –- the HHS rule -–
MR. HOUSTON: Let’s see here. Where is that footnote–what has happened to the footnote?
DR. SUAREZ: On the first page.
MS. BERNSTEIN: The footnote is now broken up between two pages on my copy so if I want to see it I have to go down to the next page. There is the beginning of it. It continues -– so do you want to just move the definition from the act into –
DR. SUAREZ: No, my recommendation is to erase completely the ARRA definition from the footnote. The definition that we are using is the FTC definition. I mean it is the same. I do not see what we gain by including it.
MS. BERNSTEIN: Right. So actually I understand that point. What I would recommend is just using the statutory definition because that one clearly applies both to HHS and to FTC whereas -– I think it asks the question -– why are we using the FTC definition when we have a Departmental definition? Explain the reason for that. So if we use the statutory definition instead which is very similar, unless there is a reason not to use it, no one will question why we are using that definition.
DR. FRANCIS: Yes, let’s use the statutory definition.
MS. BERNSTEIN: Okay.
DR. FRANCIS: Put it up in the text.
MR. HOUSTON: And we need to make sure that the proper citation on it then in the footnote.
DR. FRANCIS: Yes. We have the right citation there.
MR. HOUSTON: in the footnote -– I know but what happens is the footnote is going to be different.
MS. BERNSTEIN: Now the footnote –- we now need –
MR. HOUSTON: The footnote refers to the FTC definition.
MS. BERNSTEIBN: We are going to take that out.
DR. FRANCIS: Just take that out.
MS. BERNSTEIN: What we are going to leave though is a –- I will put it back in there –- we have this comment here –- you want to look at while I am doing that. We want it to be clear that it includes caregivers and legal representatives and so forth.
DR. SUAREZ: That is a different point not related to the definition.
MS. BERNSTEIN: Well, it is related to our definition in this letter –- how we are using this term in the letter. That was the point I think that was made in the discussion.
MS. HORLICK: –the definition for consumers.
DR. SUAREZ: Yes, it was a totally different –
MS. BERNSTEIN: It says ARRA for the individuals.
DR. FRANCIS: Make sure that you do the ARRA in the definition in the footnote first.
MS. BERNSTEIN: That is awkward isn’t it -– that statute.
DR. FRANCIS: Now put ARRA section 13 –
MS. BERNSTEIN: Really I am getting there. That kind of stuff I can do. I am more concerned about the substance.
MS. BERNSTEIN: Have we talked about EHRs yet -– somewhere? I do not think we did.
DR. FRANCIS: No.
MS. BERNSTEIN: So I have to spell this out.
DR. FRANCIS: –electronic yes.
MS. MILAM: Do we need a statement in between those 2 definitions that indicates that we recognize that this is something for use by consumers and their caregivers?
DR. FRANCIS: Well, I am trying to think where we should put –-
MS. BERNSTEIN: How is that? So now the footnote-—
DR. FRANCIS: I think the statement about EHRs ought to be up in the text Maya.
MS. BERNSTEIN: Okay. It was not –-
DR. SUAREZ: I like that and then add a new footnote. Refer to 134005 or footnote 3.
DR. FRANCIS: We work with that distinction a lot. Now put the footnote in and I am going to suggest that we add one more sentence to this paragraph which picks up on Sallie’s point. I am not sure exactly how to word it but let me try it okay? After you have done the footnote. Okay.
MS. BERNSTEIN: Hang on -– I have got to go put this on a different page.
DR. FRANCIS: So what I want to say there – I am waiting until you get back there.
MS. BERNSTEIN: Where are you now — back up here?
DR. FRANCIS: Yes, back up there. PHRs are distinguished from EHRs in that the latter are created, gathered, managed and consulted by authorized healthcare clinicians and staff.
MS. BERNSTEIN: Okay.
DR. FRANCIS: When PHRs –-
MS. BERNSTEIN: When?
DR. FRANCIS: No, not when just PHRs may be managed by the individual him or herself or by the appropriately designated personal representative, period. New paragraph – PHRs take –
MR. HOUSTON: Where do we define -– see down here, look below where there is a red line — consumers including patients – here is the –
DR. SUAREZ: Why do we need that?
MR. HOUSTON: Well, we are trying to set that up because we use consumers throughout the document.
DR. FRANCIS: Well, if you then say — by consumers themselves or by their appropriately designated personal representatives.
MS. BERNSTEIN: We can avoid himself or herself probably.
DR. SUAREZ: Yes, but why do we need to clarify that?
MR. HOUSTON: We were asked for –-
DR. SUAREZ: It points out that every time a consumer can either do it by themselves or do whatever through a personal representative.
DR. FRANCIS: We were asked to do that.
MR. HOUSTON: This was Blackford Middleton’s point and I think we talk about, first of all, if we go down to the next paragraph it says –- consumers including patients, because PHRs are not just for patients — often they are just consumers. I think we need to try and incorporate all of those concepts because when we use consumer throughout the rest of this letter we really are referring to individuals who either access a PHR for themselves or on behalf of somebody else. So I think we need to try to use the term consumer to encompass all of those individuals in this letter.
MS. BERNSTEIN: Right. We were talking to Larry sort of in between the break about that matter –- about the word consumer and what it means and he was saying he was not too comfortable with that.
MR. HOUSTON: But he also could not come up with t better word.
MS. BERNSTEIN: He was trying – he liked record subject -– I am not sure that captures everything because we are protecting the record subject but the users are broader than just the record subject — protections accrue to the record subject.
MR. HOUSTON: The reason why Larry did not like consumer was simply because a consumer consumes things -– at the end of the day there is nothing left. Like I consume a MacDonald’s cheeseburger I have eaten it, it is gone.
MS. BERNSTEIN: Right but we are also consumers of services and we do not –-
MR. HOUSTON: I am just telling what Larry’s point was.
MS. BERNSTEIN: I understand.
MR. HOUSTON: My point here is that we are using consumer throughout the letter so rather than put a separate sentence like we have done above with Leslie, below we define consumer as one including patients. Somewhere in here I think we can either do what we did in the sentence where you are typing right now or we can simply go down to where consumer in the next paragraph says — in parenthesis including patients -– we could have simply said including patients and designated personal representatives.
MS. BERNSTEIN: Okay.
DR. FRANCIS: So actually you could say consumers including –- yes when you go down there where there is that parenthetical including patients -– it could be including patients, their caregivers or their appropriately designated representatives.
MR. HOUSTON: That is all we need to do.
DR. SUAREZ: Well, let me point out that I think there is confusion about this personal representative. I think this is coming from the definition itself that says it is controlled by or for the individual. That is where it came – it means Microsoft managing it for the individual not a personal representative.
MR. HOUSTON: Let me say I think though that while that is in the definition I think you could reasonably infer, I think, that it could be a personal representative and frankly I can tell you right now most PHRs have the ability to proxy.
DR. SUAREZ: Well, we are talking about 2 different things again. One thing is a consumer, me a consumer, or my wife managing it for me. Another thing is me as a consumer managing itself or Microsoft managing it for me.
MR. HOUSTON: But all Microsoft is — is a custodian of your information.
MS. BERNSTEIN: That is what is supposed –
DR. SUAREZ: That is for the individual.
MR. HOUSTON: Well, I still think we need to define consumer in this letter to include other individuals other than simply the person –-
DR. FRANCIS: And we were asked to do that.
DR. SUAREZ: We were asked to do that because the people were confused about the — for the individual and who is the for the individual -–
MR. HOUSTON: I think it went further than that.
DR. SUAREZ: I do not think we explain that. I do not think that we explain that the –for the individual – -means either me managing it or me creating it in my own database or having Microsoft manage it for me.
MR. HOUSTON: I disagree.
DR. FRANCIS: No, actually what came up in the discussion was a specific reference to personal representatives.
DR. SUAREZ: No, I brought it up.
MS. BERNSTEIN: The statute is referring to what Walter is talking about.
DR. FRANCIS: That is right.
MS. BERNSTEIN: Okay.
MR. HOUSTON: I still think it is very important to put in this letter that it is just not the individual whose data is in the PHR which we are talking about here, but it is other individuals –-
MS. BERNSTEIN: No, one is disagreeing with that. What Walter is saying –-
MR. HOUSTON: Then put it in this -– say all we are asking to do is put consumer in here so that we can, under consumer say including patients, their caregivers and –
MS. BERNSTEIN: I hear you. It now is in 2 places. The question is where do you want it? Okay?
MR. HOUSTON: I think it is simpler if we put it in parenthesis.
DR. FRANCIS: I am fine with going along with John.
MR. HOUSTON: I think it is simpler to put it inside the parenthesis because we are adding less volume to this document and I think it gets to the same point.
MS. BERNSTEIN: –there are no parenthesis now, so tell me where you would like them.
Ms. BERNSTEIN: Is there a statement here?
DR. FRANCIS: No, next paragraph Maya. Okay consumers including patients –-
MS. BERNSTEIN: Okay.
DR. FRANCIS: –including patients, their caregivers -–
MS. BERNSTEIN: You want it down there and not up here?
MR. HOUSTON: Yes.
DR. FRANCIS: Yes.
MS. BERNSTEIN: And do you want this whole thing to be parenthetical?
DR. FRANCIS: No, we just want -– including patients, their caregivers or their appropriately designated personal representatives.
MS. BERNSTEIN: Okay so now it says the same thing as the –-
DR. FRANCIS: It comes out up above. But you need their before appropriately designated.
MS. BERNSTEIN: This statement is different than the one we just wrote. This one says who can manage a PHR and this one says who is a consumer.
DR. FRANCIS: Yes and –-
MR. HOUSTON: I think the first sentence starts with manage –- I do not think we -– first of all, when we talked to the Committee today –-
DR. SUAREZ: I do not think we need that paren there. I am really opposed to having that –- consumers simply saying consumers often do not fully understand –- that is sufficient. We already explained up there that PHR may be managed by them.
DR. FRANCIS: Well, we were going to take out -– PHRs may be managed by —- we were going to take out those two sentences and just put it in the parenthesis.
MR. HOUSTON: Yes. Take that one out and just leave the other one in.
DR. FRANCIS: Yes.
DR. SUAREZ: Who are we talking about when we say caregivers?
MR. HOUSTON: Caregivers could be individuals.
MS. BERNSTEIN: Family members, nurses -–
DR. SUAREZ: Providers?
MS. HOUSTON: No, caregivers being like an elderly person’s child that is setting up appointments or what else –-
MS. MILAM: I think it has to be broader than personal representatives because not all PHRs are governed by HIPAA. So it –-
DR. FRANCIS: You can also –-
MR. HOUSTON: Well, not only that but by the way some people are doing things like arranging for visits even though they are not officially designated as a person representative.
DR. FRANCIS: Somebody can share a PHR with somebody without –-
MS. BERNSTEIN: Sure I can give my password to my kid who is managing my care for me. Or I might give it to my attorney or my other legal personal representative -–
MR. HOUSTON: It happens all the time. Well, not only that but –-
DR. FRANCIS: I can do that even though I have not given that person advanced directive powers.
MS. BERNSTEIN: That is right.
MR. HOUSTON: Actually most –- we can typically proxy to those individuals anybody who wants to so we are just saying that there is that class of individuals. I mean is caregiver the right word Walter? I mean if it is something else, I mean is it –-
DR. SUAREZ: No, I am fine. Let’s just go on.
MR. HOUSTON: Okay.
MS. BERNSTEIN: Okay so -–
DR. SUAREZ: The way that last paragraph reads is like –-
MR. HOUSTON: That paragraph? You mean the one that is at the top?
DR. SUAREZ: The consumer including, in parenthesis including patient, caregiver, often do not fully understand the extent to which their information -– it almost gives the sense that it is the information about the caregiver, the information about the personal representative.
MS. BERNSTEIN: Out of place?
MR. HOUSTON: We could –- what are you reacting I am sorry I did not—-what are you reacting to?
DR. SUAREZ: The way it is written.
MR. HOUSTON: I meant specifically.
MS. MILAM: I think he was saying that because we added the other qualifiers, caregivers and other that it now is not necessarily referring to their information.
MR. HOUSTON: We could say –-
MS. BERNSTEIN: We are trying to do two things in this. We are trying to both define what a consumer is because we had a comment, a concern about that. And we are making a statement that these people who we are defining are having trouble understanding what PHRs are about. I think we should separate those two concepts because we are getting them all mixed up. We can say, in this letter we are using the word consumer to mean whatever word we like -– if it is not consumer –- to mean –-
DR. SUAREZ: Here is one suggestion though –-
MS. BERNSTEIN: and then we can say that these people do not understand what their rules are.
DR. SUAREZ: So here is one suggestion in that sentence, start with PHRs –-
MS. BERNSTEIN: Okay which sentence?
DR. SUAREZ: The consumer including patient -– before that is the sentence that we had in the previous paragraph that said PHRs may be managed by consumers including …da…da…da..—-and then say consumers and erase all of that including patients do not often fully understand.
DR. FRANCIS: Then consumers often do not –- yes that is good.
MR. HOUSTON: Actually, you know if we are going to do it that way we would say consumers in parenthesis including patients and then close parens their caregivers or appropriately designated personal representatives.
MS. BERNSTEIN: We just changed that. We just took that out.
DR. SUAREZ: We just deleted that.
MS. BERNSTEIN: That is exactly what we just took out.
MR. HOUSTON: No, I am saying -– what you just wrote up there managed by consumers and in parens including patients because it is a nuance. But I would say including patients. I would still put that back in parens and leave the rest. Their caregivers —
DR. SUAREZ: I see.
MS. BERNSTEIN: So the whole rest of the sentence you want in parenthesis.
MR. HOUSTON: No, I just want parens around, put another paren around patient.
DR. SUAREZ: Well, the problem is that we said –-
HR. HOUSTON: No, around patient.
DR. SUAREZ: No, no the problem is –-
MR. HOUSTON: Take that paren out. Just give me one second. Put a paren after patient. This is a little bit of a nuance here but the consumer could be a patient or it might not but then –-
MS. BERNSTEIN: It could be any of those.
DR. SUAREZ: Let’s clarify this point. It was the HR may be managed by consumers which may be patients themselves, their caregivers or appropriately –
MR. HOUSTON: We can say it that say. That is sort of getting to the same point.
MS. MILAM: I wonder if we could just have a different turn on this. The big benefit for the PHR is that it is consumer information and it is empowering and giving consumers tools to use this information and it is relatively new, it is exciting, it has issues that are mentioned there but I wonder if we could focus more on the empowerment at the same time recognizing the difficulties without just putting those difficulties right up there.
MR. HOUSTON: Here is what my concern is, that we are going to start making wholesale changes to this letter which I do not think were intended.
MS. MILAM: No, I do not mean that. I find that last sentence fairly negative that we have added and I do not think it is intended to be. I think it needs to point to the complexity, the inherent complexity, but I do not think it does it in a positive way.
MR. HOUSTON: I mean, I like what Walter said –- that is just my opinion. I am just afraid of putting too many words here that people are going to start to react to and de novo start to look at this letter over again. I mean, that is, I am trying to stop this from spinning into tomorrow’s meeting. So can we –- Walter what did you say here again? Managed by consumers —
DR. SUAREZ: Consumers — which may be managed by consumers –-
MR. HOUSTON: You said it really well the first time.
DR. SUAREZ: Oh I forget.
DR. FRANCIS: Who may include patients their caregivers or –-
DR. SUAREZ: Who may include patients themselves.
MR. HOUSTON: Themselves right.
DR. SUAREZ: The key word is themselves because it is really –- it is themselves or their caregivers or their appropriately –
DR. FRANCIS: So, who may include –- you need to go back to there.
MR. HOUSTON: Yes.
DR. SUAREZ: before patients, and who may include.
DR. FRANCIS: Consumers comma –
MR. HOUSTON: Give her the dash, Yes.
DR. FRANCIS: Yes.
MR. HOUSTON: Comma. I like that. I do not see where it is negative. I mean what is -–
DR. FRANCIS: It is good.
MS. MILAM: Talking about — the consumers do not fully understand the extent to which their information is protected by law. I guess I just would have a different spin on that — not different content but just a different approach to addressing that issue.
DR. FRANCIS: Why don’t we say PHRs may be very beneficial for consumers –- no, no, no. Next sentence, PHRs may be managed by — now go to the next sentence.
MS. MILAM: starting with consumers —
MS. BERNSTEIN: It just takes me a sec to get there.
DR. FRANCIS: Okay. Despite the important benefits of PHRs comma consumers may not fully understand -–
MS. MILAM: I like that but that does not add a lot. It changes the content.
MS. BERNSTEIN: Tone.
MR. HOUSTON: You all have another may here -–is protected by law and may inadvertently – so we need to come up with another word for may.
DR. SUAREZ: And then you need to add to information sharing and use, they did not want or they did not intend –- they inadvertently consent to information — they did not something.
MR. HOUSTON: What I was reacting to was there are 2 uses of the word may in the same sentence.
DR. SUAREZ: No, I know but I was reciting that last part.
DR. FRANCIS: Consumers might not fully –
MS. BERNSTEIN: Yes. I do not remember which one is correct.
DR. FRANCIS: Why don’t you say consumers might not fully, there we go.
MS. BERNSTEIN: That is more correct.
MS. MILAM: Okay.
MR. HOUSTON: All right. That is good. Is everybody happy with that?
MS. HORLICK: Yes, it is fine.
MR. HOUSTON: Did you say typo’s?
MS. BERNSTEIN: No, information sharing and use is bugging me because it is sort of hanging out there but –
DR. FRANCIS: Take HIPPA and make it –
MS. CHAPPER: You know the acronym because you used it already. You added it up in the —
DR. FRANCIS: I think we have also -– have we used EHRs already?
MS. BERNSTEIN: Yes, I am sure.
DR. FRANCIS: The privacy well promulgated under HIPAA.
MS. BERNSTEIN: Yes, there is a bunch of -–
MS. BERNSTEIN: I do not know why we did that but at this point it does not matter.
MR. HOUSTON: Why don’t we simply say not a HIPAA covered entity and get rid of –-
MS. BERNSTEIN: I do not like so many adjectives in a row but okay.
DR. FRANCIS: Now go up and fix the EHRs too.
MS. BERNSTEIN: Where are you?
DR. FRANCIS: Just right up above.
MS. BERNSTEIN: I mean this does not make sense. This sentence does not make sense anymore.
DR. FRANCIS: In some cases the PHR is a portal view into providers EHRs.
MS. BERNSTEIN: Okay. Where are you now?
DR. FRANCIS: Right up 1 line into — you have got to get rid of the a –- into providers EHRs.
MS. BERNSTEIN: Well, now you have to make the whole thing plural. PHRs are portal views into because otherwise there are plural.
MR. HOUSTON: No, you do not need –
MS. BERNSTEIN: No, there is not 1 portal into –
MR. HOUSTON: No, that was the point that Walter I think was making was that you could have a single PHR that actually accesses multiple provider EHRs so it is 1 too many. So I think that is correct. That takes into consideration I believe what your point is Walter. Is that correct?
MS. BERNSTEIN: Like that.
MR. HOUSTON: That is fine.
DR. FRANCIS: Actually it should be into 1 or multiple.
MS. BERNSTEIN: Do you like that better?
DR. FRANCIS: 1 or multiple. Not more, 1 or multiple.
MR. HOUSTON: Actually 1 or more would probably make –
DR. FRANCIS: 1 or more
MR. HOUSTON: Providers EHRs. Walter, that was your comment right?
DR. SUAREZ: Yes.
MR. HOUSTON: Are you okay with that?
DR. SUAREZ: Yes, I am fine.
DR. FRANCIS: Let’s go on.
MS. BERNSTEIN: Are you now thinking you are happy with this one?
DR. FRANCIS: Yes.
MR. HOUSTON: Yes.
MS. BERNSTEIN: I mean I -–
MR. HOUSTON: Leslie I was reading you took notes. I do not know what the next comment was.
DR. FRANCIS: Well, that was only a sentence Marjorie suggested we should move earlier.
MR. HOUSTON: Because it is a benefits issue.
DR. FRANCIS: Yes.
MR. HOUSTON: But I do not think we need to move it now since we already –-
DR. FRANCIS: Yes. Because this is just what the Committee noted and so this is fine.
MR. HOUSTON: Yes, I think we are okay.
DR. FRANCIS: But I would actually -– let’s look at because payers employers, let’s make sure we track the same thing in our first paragraph. So go up because payers and employers.
MR. HOUSTON: Well, caregivers –-
MS. BERNSTEIN: Well, we do not say that.
DR. FRANCIS: Well, we should say it at the front. Substantial benefits for patients, caregivers health —- well let’s leave it the way it is. Because we are talking about -–
MS. BERNSTEIN: Employers are part of society more generally in my view.
DR. FRANCIS: Yes. Let’s just leave it.
MS. BERNSTEIN: Okay.
DR. FRANCIS: So since we have got the beneficial point highlighted you can take that out.
MS. BERNSTEIN: Good. Do you want to now take all these things out?
MS. MILAM: Yes.
MS. BERNSTEIN: Okay. I will do that after but we do not have to take time to do that now.
MR. HOUSTON: Do we need to get rid of the footnotes or just the references.
MS. BERNSTEIN: No, the references that we said we were going to take out and the footnote –
DR. FRANCIS: And the footnote just says that these are –-
MS. BERNSTEIN: For example -– I am just going to take this out along with the footnote.
DR. FRANCIS: Yes, just take then out as we go.
MS. BERNSTEIN: I mean nobody had anything to say about this so if you do not want to take up the time -–
DR. FRANCIS: No.
DR. SUAREZ: So the footnote should really go on the previous line.
DR. FRANCIS: The footnote is gone.
MS. BERNSTEIN: The footnote is going away. It only –
DR. SUAREZ: The footnote is actually gone?
MS. BERNSTEIN: Yes, it described that we are going to take these things out?
DR. FRANCIS: Let’s just take them out now. Let’s be totally linear and take them all out while we are going.
MS. BERNSTEIN: We do not need that footnote anymore — interesting note to the Committee.
MS. BERNSTEIN: Okay.
DR. FRANCIS: Sorry because they show up a couple of other places and we might as well just be really scary.
MS. BERNSTEIN: Okay.
DR. FRANCIS: See there Haywood and you have got to get rid of —
MS. BERNSTEIN: Yes, that is another problem.
DR. FRANCIS: The next paragraph has Haywood and White’s –-
MS. BERNSTEIN: I see them. Okay. Do you want to rewrite this first bullet?
DR. FRANCIS: Yes. It should start out by saying computer literacy -– start the bullet as follows –- computer literacy varies among the population and the digital divide is well known. Some PHRs and then just go the way it is.
MS. BERNSTEIN: But that still does not –-
DR. FRANCIS: Then you say these populations -– for example, some PHRs are designed to address the needs of –-
DR. SUAREZ: What I was going to suggest was to flip the two existing sentences and then start with saying different populations may have limited familiarity with interactive and web technologies period. Some PHRs are designed to address the needs of consumers –-
DR. FRANCIS: The for example goes before some PHRs are.
MS. BERNSTEIN: I got it.
MR. HOUSTON: Yes.
MS. BERNSTEIN: Okay.
DR. FRANCIS: Now then I would say -– some members of these populations may have limited familiarity, because you do not want to stereotype all of them. So I want the limited familiarity sentence back where it was -–
MR. HOUSTON: But you already talk about -–
DR. FRANCIS: Computer literacy varies among the population and the digital divide is well known. For example, some PHRs are designed to address the needs of consumers who are older and have chronic diseases. Some members of these populations may have limited familiarity with interactive -–
MR. HOUSTON: Now I think Blackford was trying to stop that.
MS. BERNSTEIN: He was trying to get you just away from that point. He does not want you to stigmatize those particular populations.
DR. FRANCIS: No, I know.
MR. HOUSTON: I think if you leave it in this order with some Wordsmithing I think we can get where we need to go.
MS. MILAM: Would we want to just phrase it differently about how some PHR vendors have stepped up to address the needs of these special populations or these population groups?
DR. FRANCIS: Actually why don’t we just take that out entirely?
MR. HOUSTON: No. Actually for the moment just leave it in. I just want to make a proposal. It says for example, just take out that some PHRs are designed to address the needs of consumers for older –- for example, all I want to do is say -– for example, elderly and those having chronic diseases.
MS. BERNSTEIN: Plenty of teenagers have got chronic diseases.
MR. HOUSTON: What? I guess we can take it out Leslie.
DR. SUAREZ: Yes, we can take it out and just say some users may have limited familiarity with the interactive web technologies which is the base or most HER products today. The issue is really the web technologies are the base for PHR products.
MR. HOUSTON: Do we want to say some users or do we want to say –- because it may be that they might not even be users yet because they do not have enough familiarity with interactive web technology to use them.
MS. BERNSTEIN: Based on consumers speed.
MR. HOUSTON: There you go.
DR. FRANCIS: Yes. And then take out the extra among right above — one line up.
MR. HOUSTON: And by the way, is it true that the digital divide is well known?
MS. BERNSTEIN: Yes.
DR. FRANCIS: Yes.
MS. BERNSTEIN: I personally do not like the phrase because I think it has become kind of overused and trite.
MR. HOUSTON: I am almost saying -– I would agree. I would simply say computer literacy –
MS. BERNSTEIN: It has a meaning for us but —
DR. FRANCIS: Just say consumer literacy varies among the population and some may have limited familiarity with interactive web –-
MR. HOUSTON: And some consumers may have limited –- I think that gets the point across.
MS. BERNSTEIN: Do you want to limit it to web technologies because we also had the point made by one of the Committee members that we are not just talking about the web we are talking about all electronic -– and it is the same. Some people are more familiar with e-mail or other electronic technologies than –
MR. HOUSTON: We can say web and computer or computer technologies or -–
MS. HORLICK: Electronic.
MS. BERNSTEIN: Electronic. Communication or electronic –- I do not know.
DR. FRANCIS: Well, we have already said that computer literacy varies. So it is a separate point.
MS. BERNSTEIN: Yes.
MR. HOUSTON: No, I agree with Leslie. I think web technologies. We did not get an objection earlier — interactive web tech –- yes. And I agree.
MS. BERNSTEIN: I think that says it without stigmatizing it. It makes the point.
DR. FRANCIS: I think it is fine.
MS. BERNSTEIN: Okay.
MR. HOUSTON: Is there -– okay.
MS. BERNSTEIN: Anything else in that bullet?
MR. HOUSTON: No.
MS. BERNSTEIN: Walter?
DR. SUAREZ: So you do not need to have at the end of the sentence something that links it to PHR?
MR. HOUSTON: Say that again.
MS. BERNSTEIN: Well, we said -–
DR. SUAREZ: With interactive web technologies used by PHRs.
DR. FRANCIS: Yes.
DR. SUAREZ: Yes. –- it might be obvious but –-
MR. HOUSTON: Or we could say rather than interactive web technologies, PHR technologies, or technologies common in PHRs.
DR. FRANCIS: Yes, with interactive web technologies common in PHRs.
DR. SUAREZ: Exactly.
MR. HOUSTON: Yes.
DR. SUAREZ: There you go.
MR. HOUSTON: Okay.
MS. BERNSTEIN: I sort of want –- PHRs employed by something –
MR. HOUSTON: No, I think common in PHRs.
DR. SUAREZ: Common in PHRs is good.
MR. HOUSTON: All right move forward.
DR. FRANCIS: Move along.
MR. HOUSTON: If Walter says yes we are moving forward.
DR. SUAREZ: It is hard work. Move forward -– page 5 –- well most of the other is good enough.
MR. HOUSTON: Okay we have made recommendations.
DR. FRANCIS: Okay we are set on all this.
DR. SUAREZ: I did notice one –- oh maybe it is part of –- go ahead. No, I am sorry, go ahead.
MS. BERNSTEIN: Just a correction I made on the grammar. We are on 2B.
DR. FRANCIS: We settled on that. It should encourage — So here is what it should say -– to a different PHR. After a different PHR say, as a result if a PHR supplier changes privacy practices in a manner that is unacceptable to the consumer the consumers only choices might be either to remain with the supplier or to delete the entire PHR. The consumers only – sorry –- effective choices might be -– then after delete the entire PHR portability of PHRs thus is important—
MR. HOUSTON: Well, it is already in the recommendation.
DR. FRANCIS: — is important to protecting the consumer’s ability to select suppliers with PHR practices that are acceptable to them. With privacy, confidentiality and security practices that are acceptable to them.
MS. BERNSTEIN: It is going to get awkward.
DR. FRANCIS: Consumers ability –
MS. BERNSTEIN: Yes, but it is plural consumers –
DR. FRANCIS: — to select suppliers with privacy, confidentiality and security practices that are acceptable to them.
MS. BERNSTEIN: — that are acceptable. Let me solve that problem.
MR. HOUSTON: No. I have a couple comments after you do that.
DR. FRANCIS: Why are you taking out the plural?
MS. BERNSTEIN: Because that is the way you started but you put to them which is plural -– you started with singular but you put to them which is plural which is an incorrect match.
DR. FRANCIS: I am sorry
MS. BERNSTEIN: So I just took it out. So instead of adding to them which is incorrect grammar I just left it –-
DR. FRANCIS: Okay, okay, portability of PHRs thus is important, I do not want the commas around thus, is important to protecting the consumer’s ability to select a PHR supplier with privacy, confidentiality and security practices that are acceptable.
MR. HOUSTON: Okay now can I make some comments?
MS. BERNSTEIN: Sure.
MR. HOUSTON: — about what you just said. I do not think that it is remain with the supplier or delete the entire PHR. I think what we want to say is continue to use the supplier’s PHR.
MS. BERNSTEIN: Unhappily is the point, yes?
MR. HOUSTON: Well, continue I mean or delete their entire PHR record or something like that.
MS. BERNSTEIN: Yes.
MR. HOUSTON: And then I think the next sentence, their entire PHR record or the consumer’s entire PHR record. The consumer’s -– I would like to see consumer’s in there please. And I say the portability of a PHR is thus is important to protect any consumer’s ability to –- it is not important to protect the consumer’s ability to select a PHR supplier with a privacy, confidentiality and security practice they are acceptable, I think portability of PHRs is important to give consumers a –
DR. FRANCIS: — a choice of a PHR supplier.
MS. BERNSTEIN: Yes.
MR. HOUSTON: That meets their privacy, confidentiality and security expectations.
DR. FRANCIS: That is great.
MS. BERNSTEIN: I got a plural –
DR. SUAREZ: I think those are great and I think this should be moved into 1A and move 1A to 1B because 1B is consumer should have the right to an electronic copy that allows them to transfer directly to or reenter it into a different one. So this actually follows nicely with this first one which is more about portability. I mean I think this is probably more important –
MR. HOUSTON: I can take it -– Is that your only comment Walter in that respect?
DR. SUAREZ: Yes.
MR. HOUSTON: Yes, I could see moving 1 and 2 I mean I think they –-
MS. BERNSTEIN: You are talking about -–
DR. SUAREZ: You will need to delete, by the way, the last 3 sentences in that paragraph.
MR. HOUSTON: 2A and 2B I think.
DR. SUAREZ: All that part.
DR. FRANCIS: You know I am -– although I agree with you that it is more important — I would not make any shift just because we are so close and this one –-
MR. HOUSTON: It is less red ink I guess.
DR. FRANCIS: Yes, I want to eliminate the red ink.
MR. HOUSTON: I think they are both important and I think that they are close enough together that I think you will get that. I understand, Walter your point.
DR. SUAREZ: I am fine.
MS. BERNSTEIN: Okay. So we did this. Are we satisfied we did that? Do we care about certification?
DR. FRANCIS: No.
MS. BERNSTEIN: Or stifling innovation John? I think this was Harry’s point on certification.
DR. FRANCIS: I do not think we want to go there.
DR. SUAREZ: I do not that was a comment that we need to address in the letter. Particularly -– specifically address the privacy and security element.
MR. HOUSTON: I think we are okay.
MS. CHAPPER: So under 2A then there is no –-
MR. HOUSTON: There is no commentary.
MS. BERNSTEIN: Gail and I like this part.
DR. FRANCIS: Yes, that is fine.
MR. HOUSTON: Actually it is not the portability of PHR -– it is the portability of PHR information is important.
DR. FRANCIS: Yes, or ability of PHR –
MR. HOUSTON: Yes, I do not know how you would incorporate certification into this.
DR. FRANCIS: Yes, I do not think we should. I do not want us to touch it.
MR. HOUSTON: I think it -– it is an interesting thought but I –-
MS. BERNSTEIN: Are you worried about innovation?
MR. HOUSTON: Stifling innovation? No, I mean my concern over certification was by forcing certification it would stifle innovation but I do not think we talk about it.
MS. BERNSTEIN: So if we take out certification we are good?
DR. SUAREZ: Certification will probably happen on a volunteer basis already underway so there is no -–
MR. HOUSTON: Right. Yes, exactly.
MS. BERNSTEIN: Okay.
MR. HOUSTON: That is sort of a different animal which we will sort of leave to this recommendation 2B about interoperability.
DR. FRANCIS: Right.
MR. HOUSTON: Do you have anything else Walter? Do you have any other thoughts?
DR. SUAREZ: No.
MR. HOUSTON: Okay let’s move down then.
DR. FRANCIS: You have got an extra space in 2C –
DR. SUAREZ: I am sorry in 2C? Yes, 2C. In a couple of places we used this concept -– healthcare provider maintained HER. I think we can delete healthcare provided maintained and just say EHR.
MR. HOUSTON: Well, how do we define EHR above?
MS. BERNSTEIN: Healthcare provided maintained –-
MR. HOUSTON: Because if we defined it as a healthcare provider then I think Walter is correct.
DR. SUAREZ: Well, EHR is our healthcare provider.
MR. HOUSTON: No, I am saying if we define it at the top saying healthcare provided electronic health record or provided maintained electronic health record in parens in EHR at the beginning then we can take –-
DR. SUAREZ: I do not know how we or whether we defined the EHRs. I do not think we do.
MS. BERNSTEIN: We did.
DR. FRANCIS: We did.
DR. SUAREZ: We only say PHRs are distinguished from other –-
MR. HOUSTON: All I am saying is –-
MS. BERNSTEIN: Authorized healthcare clinicians and staff.
MR. HOUSTON: Okay now go up where it says PHRS are electronic health records – say a provider maintained electronic health record.
MS. BERNSTEIN: Created, gathered, managed and consulted. Maintained is managed? Created -– all those things together mean maintained I would think.
DR. SUAREZ: Well, the point is we use 14 different times EHR and 3 times provider maintain EHR. So there is no point. Do a search and erase if you do not mind healthcare provided maintained. Just search for the word maintained.
MR. HOUSTON: It is clear. I agree. Walter I think you should become the coach here for this Committee.
DR. SUAREZ: I should –
MS. BERNSTEIN: Yes, that is not going to work.
MR. HOUSTON: He is good.
MS. BERNSTEIN: I do not mean that –- I mean this. I mean maintain is used in many other contexts.
MR. HOUSTON: Or you should have been an attorney.
DR. SUAREZ: That is 2 in one afternoon.
MS. MILAM: I thought that was a complement.
MR. HOUSTON: Well, it depends on who you are.
MS. BERNSTEIN: Okay keep going.
DR. FRANCIS: There is not that much more to go John really.
MR. HOUSTON: What?
MS. BERNSTEIN: Yes, we are close.
DR. FRANCIS: We will get it done.
MS. BERNSTEIN: Okay we are supposed to be looking at the pink parts for clarity.
DR. SUAREZ: In 2C actually right there on the recommendation there is healthcare provided maintained.
MS. BERNSTEIN: I see.
MS. HORLICK: I do not know but I think in that case we might have really wanted to put that in there for -–
MR. HOUSTON: But it is already in –-
DR. FRANCIS: We wanted the emphasis. We really wanted that and that mattered to the clarity and that was discussed in the – and I recognize that it is redundant but I think people really care and that really mattered in the phone call and in some whose willingness to sign off and I would hate to take it out.
MS. BERNSTEIN: We are not talking about a claims record?
MR. HOUSTON: That would not be an EHR that would be a claims system.
DR. FRANCIS: We meant medical record.
MR. HOUSTON: I agree with that.
DR. SUAREZ: What is the difference between EHR and
Healthcare provided maintained EHR.
MR. HOUSTON: They are 1 and the same by our definition.
DR. FRANCIS: But people just wanted that -– to see it out there in lights and I do not want to take it out. The only risk is –-
MS. HORLICK: I agree,
MS. BERNSTEIN: Can I just throw a stick in this while I am thinking about the claims business. We have EHRs that are connected to claims records — right? — that are provided by plants. And nowhere in here did we talk about your ability to change your claim record. Or something where you have a view into your claims or if a plan should provide a parallel kind of PHR like a provider provides where you could look to your claims record, for example. So I do not think this was designed to take care of that problem but there is sort of a lack of parallelism here. And if we know why that occurred but just wanted to point out that the same exact thing could apply to the records held by other covered entities that are providing to other PHRs, like Kaiser, like –- think clarity. Pink part up here – the note says consider the clarity of this statement or how to make this more clear.
DR. FRANCIS: Well, I think there where you have the note –-
MS. BERNSTEIN: Yes.
DR. FRANCIS: The PHRs should be updated by following the process described in the HIPPA privacy rule.
MR. HOUSTON: Yes. You should have been an attorney.
DR. FRANCIS: I am.
MR. HOUSTON: I know.
DR. FRANCIS: Walter you need to go I guess so is there anything that matters down below?
DR. SUAREZ: Not really.
DR. FRANCIS: Are you sure?
DR. SUAREZ: I am sure.
DR. FRANCIS: Okay. We are all exhausted right?
MR. HOUSTON: Walter just wants to get out of here.
MS. BERNSTEIN: He has got a point. Do you want to look down the rest of this before you go? The next point has to do with use versus disclosure which I think was in fact your point Walter in 3B.
DR. SUAREZ: I am sorry.
MS. BERNSTEIN: Your point about use versus disclosure here on 3B.
DR. SUAREZ: Yes, there is another one actually now that you mentioned it. There is another place where we only refer to disclosure at the beginning –-
DR. FRANCIS: Yes.
MS. BERNSTEIN: Does that solve the problem?
DR. FRANCIS: I think with 3B we just meant disclosure.
MR. HOUSTON: I agree.
DR. SUAREZ: No, that is not the one I said.
DR. FRANCIS: That was Marjorie’s question.
DR. SUAREZ: I did not say that.
MR. HOUSTON: Yep.
MS. BERNSTEIN: So this is not the point we want to fix?
MR. HOUSTON: Nope.
DR. FRANCIS: Right.
MS. BERNSTEIN: Here it is the missed paragraph – though the discussion about uses and disclosures that was an issue.
DR. SUAREZ: No, there was another one where we –
MS. BERNSTEIN: Well, but we talked here about use, then we talked about disclosure, then we talked about –
MR. HOUSTON: Yes, but go down to the next paragraph because there –-
DR. FRANCIS: Well, we should say the disclosure of their information.
MS. BERNSTEIN: We will get back to it. Walter has a point before he leaves. Somewhere we are down here. Go back to 3B.
DR. SUAREZ: Where were you?
MS. BERNSTEIN: I am at 3C. So we talked about putting use and disclosure into 3C.
DR. SUAREZ: Oh yes 3C definitely. That is one.
DR. FRANCIS: Yes.
MS. BERNSTEIN: And we are okay with that? Just as it is?
DR. FRANCIS: Yes.
MS. BERNSTEIN: And nothing needs to change in the discussion below? No, I think that is right.
MR. HOUSTON: We need to clean up a paren there on the 4A.
MS. BERNSTEIN: We better clean up more than that here.
MR. HOUSTON: There needs to be some commas or something there because –-
MS. BERNSTEIN: I am working on it.
DR. FRANCIS: And with previous recommendations of NCVHS regarding EHRs –- and with previous recommendations.
MR. HOUSTON: No, you already have a with at the beginning. Do we need it again?
DR. FRANCIS: Yes.
MR. HOUSTON: But that sentence does not make sense. Something needs to -– there has to be something before established there. Established does not make sense absent a word or two in front of it.
MS. BERNSTEIN: Now I can put in – Yes, is does not make sense. Okay so —
MR. HOUSTON: It does not make sense.
DR. FRANCIS: I think that is just –
MS. BERNSTEIN: There is a word missing in here.
DR. FRANCIS: Let me see if I can find it.
MS. BERNSTEIN: It wants to say something like –
MR. HOUSTON: Something got deleted there.
DR. FRANCIS: Here is what it originally read.
MS. BERNSTEIN: Ah okay.
DR. FRANCIS: Okay we are going to 4A. No, I do not know.
MR. HOUSTON: Hey, Walter since you were the quorum you are okay with this then?
DR. SUAREZ: Yes, I am okay with the letter. I vote in favor.
MR. HOUSTON: Great thanks.
DR. FRANCIS: Walter, thank you so much.
DR. SUAREZ: No, thank you.
MS. BERNSTEIN: Is that right?
MR. HOUSTON: I think you can take out supposed.
DR. FRANCIS: Consistent with other -– here is the way it should read Maya. Consistent with the other recommendations provided herein and with previous recommendations of NCVHS regarding EHRs, national privacy, confidentiality and security standards should be established for PHRs in a manner that supports PHR innovation.
MR. HOUSTON: Can we take out the PHR before supports innovation because it –-
DR. FRANCIS: Yes, sure. In a manner that supports innovation.
MR. HOUSTON: Yes.
DR. FRANCIS: I kind of like it PHR innovation.
MR. HOUSTON: But I mean I think it is assumed -–
DR. FRANCIS: How about innovation in PHR design.
MS. BERNSTEIN: Right. I am just trying to figure out how that –-
MR. HOUSTON: I guess you can say PHR innovation=– never mind. That is fine. Sorry.
DR. FRANCIS: Let’s go back up where we were.
MS. BERNSTEIN: Some new technology. 3B? So I made little underlines here where we used — use disclosure use disclosure whatever because –
DR. FRANCIS: No, this is just disclosure. Yes, because we are just talking about disclosure outside the PHR. We are not talking about the situation in which advertising pops up on the PHR website.
MS. BERNSTEIN: And that is why I underlined it to highlight the fact that we used the word use.
DR. FRANCIS: I think it should be the disclosure of their information.
MR. HOUSTON: Use is back.
DR. FRANCIS: Yes.
MS. BERNSTEIN: Yes, it is. Just a moment please. I hate this passive voice –- living with it — anything else?
MR. HOUSTON: No.
DR. FRANCIS: Moving on?
MS. BERNSTEIN: The reason I am thinking about it is because say you go to the hospital, the example of use that people are concerned about, it might or might not apply to an HR so I am sort of trying to think about whether it works or not. You go to a hospital, you have surgery, three weeks later you get a nice note from the hospital saying we did good by you, send us the money — which is a use because it is internal to the hospital but not a disclosure and people may or may not like that and that use is actually prohibited by HIPAA without consent. But now we are talking in the PHR context and I am trying to figure out if that kind of a thing -– or can your PHR vendor say we have a new service that we are going to charge you an extra few pennies for.
MR. HOUSTON: This is all -– I think the differentiation here is –- this is a –- money would not even be a pop up, it is a banner bar, it is something that is within the PHR itself that no information is in anyway transferred outside the PHR, it is a result of the operation of the PHR software and so what you see in terms of use is simply that you get something within the PHR itself that might provide some marketing or some other type of information associated with services. That is differentiated from a case where information is actually extracted from the PHR, provided to a third party and as a result of it you get some type of information sent to you in some way, shape or form.
DR. FRANCIS: The analog to what Maya is talking about is if the PHR vendor actually mails you something.
MS. BERNSTEIN: Yes. Can they up sell you with their own data without making it a disclosure? That is the kind of thing that the hospital may be doing. Do we care about that? Consumers probably do care about that. I said up front, I want this service and this service and this service and I do not want these other services. Stop writing me about them. I said no.
MR. HOUSTON: But let me ask you a question – if I look at these two circumstances, the differentiation is that since the PHR vendor already has your information and the only person that they are sharing that information with is you, the privacy harm there, you may be annoyed by it, but the privacy harm in comparison to when a PHR vendor gives information to a third party is entirely different. Your privacy latter is much greater so are we talking about privacy or are we talking about annoyance here.
MS. BERNSTEIN: Well, I agree. I am just saying that within the HIPAA privacy rule, there is a similar rule that applies to hospitals and prevents them from annoying you. I mean people think –-
MR. HOUSTON: I think people were accepting of this unless I misunderstood the conversation. I think we should leave it.
DR. FRANCIS: Yes. Your use of disclosure was right.
MS. BERNSTEIN: We are on 3C.
MS. HORLICK: I have a note that we should put the language from the footnote in the text of the recommendation.
DR. FRANCIS: Yes, and that is -– go down to the footnote Maya. I have that note too. What I think we should say is –- we want to quote our letter and footnote it and say okay copy the quote -–
MR. HOUSTON: I think, can I say, that Harry’s concern here unless I misunderstood it was specifically the types of sensitive information not the whole quote but the categories he wanted to have restated, correct?
DR. FRANCIS: No, I thought he wanted the quote.
MR. HOUSTON: I thought he wanted the categories.
DR. FRANCIS: Go back up to where it is in the text and I have got a suggestion Maya. You are not where it is in the text — seek sequestering of certain – in a prior letter comma NCVHS recommended that –
MS. BERNSTEIN: recommended.
DR. FRANCIS: Okay.
MS. BERNSTEIN: You may recall Leslie that is the one where we had originally list to quote the compendium that was put together but it turns out that the compendium does not actually quote directly the recommendations from our letters unfortunately. And so I went back to the original letter to get the direct recommendation in quotation.
DR. FRANCIS: We should take out the first sentence.
MS. BERNSTEIN: Well, how about we just say, we said.
DR. FRANCIS: In a previous letter, —
MS. BERNSTEIN: How about we say like this –
DR. FRANCIS: Yes, okay.
MS. BERNSTEIN: Is that too –
DR. FRANCIS: Yes, okay that works.
MR. HOUSTON: I do not think we –-
MS. HORLICK: My note that I have and I might be wrong, but my note was that Harry or somebody wanted it in the recommendation. We are putting it in the text.
DR. FRANCIS: No, he wanted it in the text.
MS. BERNSTEIN: In the letter itself.
MS. HORLICK: Oh just in the body of the letter.
MR. HOUSTON: Harry wanted it in more prominence than where it had been.
DR. FRANCIS: Yes, and then you leave that down there. You have got an extra space after C.
MR. HOUSTON: Can I see that again once you get done?
DR. FRANCIS: Yes, we ought to go back up.
MR. HOUSTON: Should we say we recommended?
DR. FRANCIS: We have got recommended – I would actually give the title of the letter. I would say in individual control of sensitive health information accessible -–
MS. BERNSTEIN: You can say in a letter to the Secretary Levitt in February 2008 –-
DR. FRANCIS: Yes, that is good.
MR. HOUSTON: Let’s make sure because we do not have any other 2008 letters.—-
MS. BERNSTEIN: Trust me this is the thing.
MR. HOUSTON: I am wondering whether there are other 2008 letters. What was the date on that, February what?
MS. BERNSTEIN: Well, we are going to quote the title of the letter in the footnote.
DR. FRANCIS: In our letter of February 20, 2008 Secretary Levitt we said –- I think you need a comma after Levitt. That is good.
DR. FRANCIS: Okay we are done with that. Let’s keep on going.
MS. BERNSTEIN: Do you want to say we suggested examples of these categories or anything like that?
DR. FRANCIS: No, we have got it.
MS. HORLICK: I do not think you need the comma after 2008?
MS. BERNSTEIN: Yes. It is an appositive. You absolutely need it there. There you go. Most people do not know that one. You need it to separate numbers.
MR. HOUSTON: There was only one letter on February 20.
MS. BERNSTEIN: You want us to take out 20th?
MR. HOUSTON: No. I said there was only one letter on February 20 so it is okay.
MS. BERNSTEIN: Okay. So now we have a footnote.
DR. FRANCIS: The footnote is fine.
MS. BERNSTEIN: Okay.
DR. FRANCIS: Isn’t there an extra comma or something there after February?
MS. BERNSTEIN: No. There is a period there and then a comma.
MR. HOUSTON: You should probably spell out February.
MS. BERNSTEIN: Where is your blue book?
DR. FRANCIS: I threw mine away.
MS. BERNSTEIN: Yes, okay but I still know where mine is — alright. You have people for that now.
MR. HOUSTON: So we are on to recommendation 4A.
DR. FRANCIS: 4A which we fixed.
MR. HOUSTON: Let’s just make sure we –-
MS. BERNSTEIN: Are we happy with it?
MR. HOUSTON: Okay that is fine. We are cool.
MS. BERNSTEIN: Yes.
MR. HOUSTON: Yes. So do we have anything else below it?
DR. FRANCIS: Wait a minute.
MS. BERNSTEIN: Yes, it says that we were going to look as to whether we had previously made a recommendation about common national privacy confidentiality in security standards for EHRs and whether, the point was made that this looks like a new recommendation that we have not either recommended or discussed. It sort of popped up in the discussion that we are both recommending here standards for EHRs and PHRs and Harry asked whether we have previously made such recommendations –-
DR. FRANCIS: Yes, we have and we should say after the sentence as the NHIN develops the need for national uniformity is likely to increase period. NCVHS has previously recommended, and I will find the recommendation -–
MR. HOUSTON: Actually, but we have to be careful because it might have been a recommendation about NHIN and not EHRs themselves because NHIN is where we have the issue with -–
MS. BERNSTEIN: You know I would be surprised if it were not in that same letter in the early recommendations from that -– well either the NHIN letter or the letter on the February 20, 2008 letter that we just —
MR. HOUSTON: For some reason I do not think we –
MS. BERNSTEIN: or maybe it is in the NHII report.
MR. HOUSTON: I do not know how we quickly find it.
MS. BERNSTEIN: I do not remember but it sound, I mean I would be surprised if we had not made this recommendation before. It is kind of basic so.
DR. FRANCIS: I will find it.
MR. HOUSTON: I am looking for it right now.
MS. BERNSTEIN: Okay. So let’s assume for the minute that you can find it and we will put a site there. You were about to say that we previously recommended something like this. We will correct it. It would look something like that.
MR. HOUSTON: It is not in the 2006 letter.
DR. FRANCIS: It is the letter that recommended more on HIPAA. Maybe it is the update to privacy laws and regulations required to accommodate.
MR. HOUSTON: It is the one I am pulling up now.
MS. BERNSTEIN: It is not the HIPAA/FERPA letter.
DR. FRANCIS: No, it is the letter before that. Here it is – HHS should work with other federal agencies and the Congress to ensure that privacy and confidentiality rules apply to all individuals and entities that create, compile, store, transmit or use PHRs.
MS. BERNSTEIN: Use EHRs?
MR. HOUSTON: Where is it?
DR. FRANCIS: Create, compile, store, transmit or use personal health information in any form and in any setting.
MS. BERNSTEIN: Right okay.
MR. HOUSTON: Where is that?
DR. FRANCIS: This is R12 and it is the privacy and confidentiality in the nationwide health information network.
MS. BERNSTEIN: So that is the June 2006 letter.
DR. FRANCIS: June 2006 yes.
MS. BERNSTEIN: So how do you want it? We can paraphrase it here and then quote it in the footnote like we did before because it is a more general recommendation than just related to EHRs.
DR. FRANCIS: Why don’t you say, previously recommended a common national privacy and confidentiality and security standards apply to all individuals and entities that possess personal health information in any form.
MR. HOUSTON: Why don’t we quote it completely then and say create, compile, store, transmit or use.
DR. FRANCIS: Okay. Security standards apply -–
MS. BERNSTEIN: Wait.
DR. FRANCIS: Here is what you should do — that quote privacy and confidentiality rules apply to all individuals and entities that create, compile, store, transmit, or use personal health information in any form or in any setting.
MR. HOUSTON: Yes.
DR. FRANCIS: Including employers, insurers, financial institutions, commercial data providers, application service providers, and schools. And that is our 12 in the June 22.
MS. BERNSTEIN: Is that the letter to Secretary Levitt or Thompson?
DR. FRANCIS: Secretary Levitt.
MR. HOUSTON: Levitt, it ways Levitt at the top. It is the same letter.
MS. BERNSTEIN: No, the other one was from February 2008.
DR. FRANCIS: It is privacy and confidentiality in the nationwide health information network R-12.
MS. BERNSTEIN: They are not going to know what that is.
DR. FRANCIS: And then the date is June 22, 2006.
MS. BERNSTEIN: Okay.
MR. HOUSTON: Can we go back up to that then for a second please? I want to read it in context.
MS. BERNSTEIN: I think we are going to need another sentence that makes this specific to EHRs.
DR. FRANCIS: Then NCVHS has previously recommended -–
MR. HOUSTON: Can I just read it the way it is?
MR. HOUSTON: I think it is good as is.
DR. FRANCIS: Yes.
MS. BERNSTEIN: Yes, it is amazing -– I was impressed we got that past last round. We had some caveat about individuals because surely we did not mean it to apply to individual consumers on their own records and so forth. So that might be confusing to people out of context. And the other thing is that this does not specifically call out healthcare providers which are the ones who create EHRs in part because they are already covered by HIPAA. So –
DR. FRANCIS: Why don’t we do it this way – why don’t we say –
MS. BERNSTEIN: It does not say uniform rules either.
DR. FRANCIS: Yes, it does not.
MS. BERNSTEIN: It says some kind of rules some kind of national rules or it does not even say federal rules that I remember except that we are a federal agency. We are recommending to the Secretary. I suppose we could have uniform state law across –- you know we could summarize here and put this quotation as a parenthetical –
MR. HOUSTON: What is the issue?
MS. BERNSTEIN: The question was whether we had previously – where we say here in the last sentence that we believe there should be common privacy, confidentiality and security standards for both EHRs and PHRs. Harry was pointing out that seems to be a new statement with regard to EHRs because above here in the recommendation text that is in italics we are just talking about PHRs but the explanation talks about both EHRs and PHRs and he asked whether we had previously made that recommendation and could refer to it.
MR. HOUSTON: But -– and I think that recommendation we just typed in there I think, reasonably closely approximates the position of NCVHS in the past. I mean applies to all individuals and entities that create, compile, store, transmit or use personal health information. Okay, that could be an EHR that could be a PHR –
MS. BERNSTEIN: You know what – I think Harry was asking the wrong question actually because, because of HIPAA, HIPAA is a national standard for electronic health records it floor for the protection of electronic health records now. You know we have a letter that says it does not cover absolutely every entity, if you are paying cash, and you are not transmitting electronically and so forth, you might not be a covered entity, but on the whole it covers electronic health records. And so even without this recommendation, we can refer to HIPAA as the national standard. We may not want the same exact standard for PHRs but there is already, at some level, for EHRs.
DR. FRANCIS: What we do say in this letter, I have got the June 22nd, we do say consistently with some state variation. But we could say something like that a set of privacy and confidentiality rules. That is not necessarily that we do not allow for state variation, but we do think that there should be a common set.
MS. BERNSTEIN: Right and we said here as the NHIN develops, the need for uniformity will increase. If does not say it will be totally uniform, perfectly. So do we need to do this or do we need to tweek it or make the point a different way? — make Harry point a different way? Because –
DR. FRANCIS: We are getting very close to 5:30.
MS. BERNSTEIN: Yes. There is almost nothing left here. I do not think there is another –
MR. HOUSTON: What happens if we go back up there for a second please.
MS. BERNSTEIN: Yes.
MR. HOUSTON: Can we say rather than a common standard can we say a common framework?
MS. BERNSTEIN: I think the reason that Harry was concerned is because there seemed to be an inconsistency between the italics recommendation which refers only to PHRs and this sentence at the bottom that refers to standards for both EHRs and PHRs and we were missing a sentence that said we already have standards or we already recommended standards for EHRs.
MR. HOUSTON: Then where is the italics?
DR. FRANCIS: Yes, we fixed that in the italics.
MS. BERNSTEIN: So maybe we do not need to do this,
DR. FRANCIS: Yes, maybe we ought not to do anything.
MS. BERNSTEIN: Do you want a footnote here?
MR. HOUSTON: We could footnote that and put that other quote in there. But then again that other quote is sort of weird because it does not specifically talk about EHRs it talks about entities that manage personal health information.
MS. BERNSTEIN: There are standards for EHRs, we call them HIPAA. There exists a national standard.
MR. HOUSTON: But we would not have made that prior recommendation —
MS. BERNSTEIN: But the recommendations as you pointed out are not specific to EHRs. In fact, everybody who is not a covered entity is in that list. Anyone else who has health information, I mean including people who are now covered. But I think the point was to include other entities that are not now covered.
DR. FRANCIS: We also made that point somewhere.
MS. BERNSTEIN: So all individuals and entities that includes the ones now covered but we listed ones that are not now covered.
DR. FRANCIS: What we need to do is find where we made the recommendation to go beyond the HIPAA -– we have a recommendation that says we ought to add in everybody under the umbrella of the HIPAA privacy rule.
MS. BERNSTEIN: Well, but this is the recommendation that we go beyond that. You just quoted it here.
DR. FRANCIS: Right.
MR. HOUSTON: I think we just leave it like this and we can end up putting it in a footnote or take it out. I think we are fine here. So let’s go to the final thing we wanted to change.
DR. FRANCIS: I do not think there is anything more but let’s go down.
MR. HOUSTON: Let’s go down.
MS. HORLICK: I have a note for the last thing that we just wanted to make sure that the security was not meant to apply to the individual consumer.
MR. HOUSTON: We put suppliers in there so it extended to PHR suppliers.
MS. BERNSTEIN: Right but in the text – okay, is this covering –
DR. FRANCIS: Why don’t we say HIPAA administrative technical and physical safeguards provide a reasonable framework for PHR suppliers to use.
MR. HOUSTON: That is fine.
DR. FRANCIS: You have got PHR suppliers there, then go down into the text – right there, reasonable framework, go back a couple of spaces Maya –- for PHR suppliers to use.
MS. MILAM: I think that takes care of it. As I am sitting here thinking if I were a PHR supplier I would think about standards that consumers are held to and the risk they would put me at since I would have responsibilities with regard to any incident that might occur and any mitigation that needs to happen. So we really need to think through what we hold consumers to as opposed to providers.
DR. FRANCIS: We are using –
MR. HOUSTON: I do not think we were trying to make any comment about consumers at all in fact.
MS. BERNSTEIN: That is why we are fixing this so it does not apply to consumers at all.
MR. HOUSTON: That opens up another can of worms and Bills point is that I think does that mean that I have to do 3 factor and in all honesty I think that all the security is really on the shoulders of the supplier itself.
MS. BERNSTEIN: Are there any other comments on the letter that anyone else wants to make?
MR. HOUSTON: Is there a way to get copies of this early tomorrow morning?
MS. BERNSTEIN: Yes.
MR. HOUSTON: I mean it might be helpful if we could maybe do a –- I do not have anything before 9:30 do we?
DR. FRANCIS: I do not have anything before 9:30 either.
MR. HOUSTON: At least Leslie and I can sit down maybe at 8:30 tomorrow morning or something and go through it and make sure we do not have any typos or any –
DR. FRANCIS: Maya, can you copy that or can you e-mail that to me? I can go through it.
MS. BERNSTEIN: I can put it on a stick and give it to John right now or you right now.
DR. FRANCIS: I am up.
MR. HOUSTON: Well, you are still up, if you can e-mail it to me that would be helpful. Then I can read it tonight as well.
MS. BERNSTEIN: But we are going to want to provide copies of this mark-up to the Committee members so that they can vote on it tomorrow and see what we did.
DR. FRANCIS: Exactly. Yes.
MS. BERNSTEIN: And Jeanine and I are prepared to do that.
MR. HOUSTON: Can we make copies here or does somebody have to make copies somewhere else?
DR. FRANCIS: I would be happy to pay personally to have the copies be made here.
MR. HOUSTON: Because I think what I would like to do if nothing else, Leslie and I sit down tomorrow morning, make sure we have not missed something.
DR. FRANCIS: Absolutely clean yes.
MR. HOUSTON: And then from there get it copied because you know I think our hope is to get this through so Sallie do you have an objection to that?
DR. FRANCIS: I would like to bring up one other matter before we adjourn which is that –
MS. BERNSTEIN: Before we leave the previous point, I do not have the agenda right in front of me, but at what time are we supposed to discuss this letter
MR. HOUSTON: Well, first of all the Committee does not even reconvene until 9:30 –
DR. FRANCIS: Harry will give us time in the meeting tomorrow.
MS. BERNSTEIN: Yes, I am worried about getting copies to the Committee if you make changes between the time you make the changes and the time the Committee meets.
DR. FRANCIS: The only changes we will make, John and I, will be cosmetic and we will go to the hotel business center and have copies printed out for everybody tomorrow morning.
MR. HOUSTON: And can I suggest this, or even if we do not have time to do that, if we put it up on the screen and show people on the screen what changed, and read it to them and then-
MS. BERNSTEIN: And then say the Executive Subcommittee is going to clean it up. Okay that is fine. We are trying to provide service to you and to the Committee and we want to do it in a timely way so that you can use it.
DR. FRANCIS: No, I understand that. I think John and I just want to make sure there are not any typos and we will take care of that and print outs as needed. May I bring up another matter? — which is that we have not had any time to talk about new directions. I would like us to schedule a conference call and we were told that there was going to be a representative from ONC here. Could you identify yourself to us please?
Sure, I am John Panishy and I am from the Office of National Coordinator. I have been staffing the meeting since Morse Landow left back in November.
MS. BERNSTEIN: I did not see you hiding behind Gail from my line of sight but you are welcome to sit at the table with us and staff to the Subcommittee when we talk about this stuff. You should do that.
DR. FRANCIS: Yes.
MR PANISHY: Okay.
DR. FRANCIS: And I also hope that you will participate with us when we have a conference call on continuing directions which we are going to ask Jeanine to set up.
MR. PANISHY: Yes, I would be happy to.
DR. FRANCIS: That would be great because that way we can coordinate with ONC and the policy.
MR. PANISHY: Yes, I also do the policy –
DR. FRANCIS: So we will be able to do it in such a way that we are not stepping on each other’s toes or each treading the same water.
MR. HOUSTON: Let’s just coordinate for maximum benefit rather than stepping on toes.
DR. FRANCIS: Right, yes. I meant it to be friendly.
MR. HOUSTON: I am glad we did not say anything about ONC while you were in the room.
MR. HOUSTON: Great well again I think we took a little more time than expected, and obviously we want to talk about next steps and we are going to have a conference call as Leslie said. I am real happy that we got through this n the time frames that we did. We can go into other important work and again I think that this has been very well received and I appreciate everybody’s hard work and willingness to look for common solutions where there might be some disagreements. So, again I think it is great.
DR. FRANCIS: Let me underline that.
MS. BERNSTEIN: This is a record Leslie and John actually did most of this work on this letter. I am sitting here with the typewriter but actually they did a lot of the work. We are all going to be here tomorrow. Is it possible to circulate a calendar to those Subcommittee members who are present tomorrow and if they have their calendars available or can talk to their assistants, we can try to get something nailed down.
DR. FRANCIS: That would be great.
(Whereupon, the subcommittee adjourned at 5:30 p.m.)