American Health Information Community

Consumer Empowerment Workgroup Meeting #15

Friday, March 16, 2007

**Disclaimer**

*The views expressed in written conference materials or publications and
by speakers and moderators at HHS-sponsored conferences do not
necessarily reflect the official policies of the HHS; nor does mention
of trade names, commercial practices, or organizations imply endorsement
by the U.S. Government.*

**[\>\> Jennifer Macellaro:]{.underline}**

Okay, Judy, we\'re ready to get started.

**[\>\> Judy Sparrow:]{.underline}**

Great. Thank you, Jennifer. And welcome everybody to the 15th meeting of
the Consumer Empowerment Workgroup on a very cold and rainy day in
Washington. Just to remind you that we\'re operating under the auspices
of the Federal Advisory Community Act, which means that everything is
being broadcast publicly and we will have a transcript available of the
entire meeting in a few days after the meeting. Also, the public will be
allowed to make comments at the end of the meeting. And for those of
you, which are most of you, who are on the phone, please speak clearly
and distinctly and identify yourselves as you speak.

In the room today, we have one community member, Christina Collins is
here for the American Medical Association. And Jennifer, if you can
introduce Workgroup members who are on the telephone?

**[\>\> Jennifer Macellaro:]{.underline}**

Sure, both of the co-chairs, Nancy Davenport-Ennis and Rose Marie
Robinson are on the phone. Jason Bonander with CDC. Steve Downs with the
Robert Wood Johnson Foundation. David Lansky with the Markle
Foundation. Sue McAndrew for Office for Civil Rights. Davette Murray
from Department of Defense. Steve Shihadeh from Microsoft. Paul Tang
from the Palo Alto Medical Foundation. Myrl Weinberg from the National
Health Council and Kathleen Mahan from SureScripts, as well as Ross
Martin from Pfizer. Did I miss anybody?

**[\>\> Mike Kaszynski:]{.underline}**

Mike Kaszynski from OPM.

**[\>\> Jennifer Macellaro:]{.underline}**

I\'m sorry. I did miss somebody. Mike Kaszynski, from OPM.

**[\>\> Ross Martin:]{.underline}**

And Ross is on his way from the parking lot into the building. I\'ll be
cutting out on the call in a little bit when I get inside.

**[\>\> Judy Sparrow:]{.underline}**

And Justine Handleman just joined the group here at ONC.

**[\>\>]{.underline}**

Great.

**[\>\> Judy Sparrow:]{.underline}**

Rose Marie, we\'ll turn it over to you and Nancy.

**[\>\> Rose Marie Robertson:]{.underline}**

Very good. Thanks so much to everybody for being here and participating
in this next meeting. Just to let you know, that the, we did present
both the general group's recommendations and the dissenters'
recommendations to AHIC this past Monday, Tuesday, actually. And AHIC
voted to go forward and accept the recommendation of the overall group.
We very much appreciate everybody\'s hard work in elucidating the issues
that came forward in that discussion. The Secretary actually pointed out
he had read both letters in detail more than once and felt that he had
been educated and illuminated by both. So we want to thank everybody for
their participation there and we have a busy agenda today moving forward
with some issues around that. Nancy.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Yes, Rose Marie, I certainly join you in thanking all of the members of
the working group for the heavy lifting that have you done in trying to
fully inform all stakeholders around the matter of certification. I
think you did a magnificent job and the Secretary was certainly generous
in recognizing the hard work of all the members of the Consumer
Empowerment working group and the positions that were shared. I would
also like to share that, today, one of the first matters of business
that we would like to do is to get an approval of the prior meeting
summary that was distributed prior to this call so that everyone would
have an opportunity to review those minutes. So, would I like to ask if
there are any comments or if there is a motion that we accept these as
presented.

**[\>\> Rose Marie Robertson:]{.underline}**

Hello?

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Hi, Rose Marie, I was just asking for acceptance of the summary of the
14th web conference of the work \-- Consumer Empowerment working group,
the minutes from February the 16th, to see if anyone in the working
group had any comments, additions, or amendments to those or can we
accept them as presented?

**[\>\> Paul Tang:]{.underline}**

I\'ll move acceptance, Paul Tang.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Thank you, Paul. I appreciate that. Is there a second to that?

**[\>\>]{.underline}**

I\'ll second that.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Thank you so much. And all of those in favor of doing that?

**[\>\>]{.underline}**

Aye.

**[\>\>]{.underline}**

Aye.

**[\>\>]{.underline}**

Aye.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Any opposed? Thank you so much. And that being done, Rose Marie, I\'ll
turn it over to you for introduction of Stanley Chin.

**[\>\> Rose Marie Robertson:]{.underline}**

It sounds as if someone is dialing from their phone. We have a number of
items on the agenda today, primarily focused at beginning our
discussions about the processes related to developing policies around
privacy. And we have, as a beginning, an additional testimony to us on
privacy policy research, additional privacy policy research, done by the
Altarum Institute. In response to our request, they added seven
HIPAA-covered entities to the research that they had presented to us in
January. And so this presentation will include that and help us to look
at a more detailed and engage in a more detailed discussion of the
privacy policy components we need to think about. So Stanley, are you
there, and cab you proceed?

**[\>\> Stanley Chin:]{.underline}**

Yes, I am. Thanks so much for the introduction. Just to second, we \--
this is revision of a document that was first delivered at the beginning
of January on privacy policies. And on the basis of that presentation, a
number of questions were raised about who was included in that, in
particular, whether we had looked at HIPAA-covered
entities, organizations that would be covered by the federal privacy
rule, we reviewed and found we had not. We did a subsequent scan of an
additional seven policies and had a comprehensive review of all of
those. So the first slide shows that initial analysis. We looked at 30
publicly available privacy policies and as additional analysis we
reviewed an additional seven policies from medical centers, integrated
health organizations, and plans. Again, it did not change our
conclusions. We noted that these policies in general had better
readability, communications, and other components, but not, were notably
not better in sharing discussion about how user data was shared or on
the use of external guidelines. Three of the seven did mention HIPAA,
but all seven were HIPAA-covered entities. You can look at that as half
full or half empty, as you will.

The next slide shows a bar graph. This is an update of a graph that was
presented in January. And it shows of the 31 criteria on which we
evaluated policy \-- all 37 policies were counted \-- of the 31
criteria, among, in each criteria of the 37 policies how many covered
each criteria. Thirty-one of the 37 mentioned security policies, in
addition to their privacy, and then it tails off very rapidly, 24 with
contact information, 22 notification of change in policy and so on. The
main point is that the general shape of this graph is not radically
altered by the addition of the seven HIPAA-covered entities. HIPAA is a
little better covered than it was before. So that\'s, there\'s a lot of
information on that. It\'s basically to say that most of the policies
covered \-- most of the criteria were covered by relatively few of the
policies.

The next slide, matrix of all 37 privacy policies, shows you pretty much
all of the data for all 37 policies, so they\'re tagged as A through AK
running across the top. Running across the side, we have all of the
criteria we used to evaluate them. So a policy with a lot of things
covered, reading vertically, would have a lot of dots. One that
is, again, this was a subjective assessment of readability that the
numeric score provides that, as well. What you note is that there are a
number of policies \-- sorry, go ahead.

**[\>\> Kelly Cronin:]{.underline}**

This is Kelly. I was just wondering for the subjective interpretation on
readability and the poor, moderate, or good, did you have other
guidelines that you used to categorize those?

**[\>\> Stanley Chin:]{.underline}**

Um, I think we were evaluating based on \-- I mean, it was a couple of
readers and it was simply did it seem on a 8th grade kind of level
whether or not this was something to be understood.

**[\>\> Rose Marie Robertson:]{.underline}**

It was not so much literacy levels, for example.

**[\>\> Stanley Chin:]{.underline}**

It\'s worth thinking about in a number of other
dimensions, readability, understandability.

**[\>\>]{.underline}**

But the primary dimension is would it be readable on an 8th grade level?

**[\>\> Stanley Chin:]{.underline}**

Yes, I believe we were looking for short sentences.

**[\>\> Kelly Cronin:]{.underline}**

Clarity?

**[\>\> Stanley Chin:]{.underline}**

And clarity.

**[\>\> Myrl Weinberg:]{.underline}**

This is Myrl, it sounds to me like if we were going to get really
serious about this particular component we would want to have those that
are experts in plain language actually do a review, because they have
very specific criteria that are somewhat objective measures.

**[\>\> Stanley Chin:]{.underline}**

I would I recommend that, as well. The other dots are indicated whether
or not the concept was covered, whether there was any description about
\-- excuse me \-- sharing data, for example, which is a large component
in the how information is shared. And, again, you can note there\'s a
great deal of variation. Other questions on this matrix? There is alot
of data here.

**[\>\> Paul Tang:]{.underline}**

I do have one. This is Paul Tang. And I learned something from this. But
there\'s also an insight that is maybe not apparent to an external party
coming into let\'s say a HIPAA-covered entity. So as a HIPAA-covered
entity that provides PHR services that becomes actually a subset of your
patient population. And as a subset, then, all patients have to go
through the HIPAA disclosures, all the communication and the signatures
by the patient. That is not going to be apparent on the Web. See what
I\'m saying?

**[\>\> Stanley Chin:]{.underline}**

Correct.

**[\>\> Paul Tang:]{.underline}**

So it\'s not surprising and actually what we\'re doing right now is to
go ahead and put that, it\'s on our Web for general patients. It\'s not
on let\'s say for the PHR. And I think it\'s a fair criticism it should
also be there. But from your perspective, looking, reviewing whether
policies exist, what\'s invisible to you is, yes, not only do they
exist, but they had to be executed by the patient. And that\'s not going
to be on the Web, unlike a third party that has no relationship with the
patient, the consumer patient already. See what I\'m saying?

**[\>\> Stanley Chin:]{.underline}**

Absolutely. That\'s not reflected and we did note that in January. We
expected that those were covered by the privacy rule had already engaged
those patients with the HIPAA waiver and the rest of the communication
regarding their right and responsibilities.

**[\>\> Paul Tang:]{.underline}**

See, then, if you accepted that, then it\'s probably not true to say
that privacy policies were not as public and transparent and shared as
with the third-party standalones. Because by definition, they almost
have to be, by law.

**[\>\> Stanley Chin:]{.underline}**

Right, but the privacy policy for the PHR itself was not transparent.
Whether or not it\'s a distinction without difference is \--

**[\>\> Rose Marie Robertson:]{.underline}**

Paul, your comment would suggest that the subgroup of patients enrolled
in a PHR in a covered entity, must have that re-done, if you will, in
the, for the context of the PHR, is that correct?

**[\>\> Paul Tang:]{.underline}**

Let me make sure I understood your question. So my point is that, so if
you look at PHRs of, commercial PHRs with no covered entity
relationship, then everything \-- the only way they can present
themselves in the policies to the patient is through the Web.

**[\>\> Rose Marie Robertson:]{.underline}**

Right.

**[\>\> Paul Tang:]{.underline}**

For a covered entity, actually by law, they have already gone through
not only the exposure but the signature that they received and
understand the policies and agree to be, receive care from this
organization. So a lot of that has happened already in a mandatory
fashion and it is not necessarily transparent on the Web. So it\'s a
different criteria, it's a difference of circumstances. And so although
I think it\'s an interesting point, so should we re-expose that on the
Web, I think the answer is probably yes. But I would not interpret the
lack of it being on the Web is the same as in the non-covered entity not
having policies exposed.

**[\>\> Rose Marie Robertson:]{.underline}**

Right. So my, actually, I was asking kind of the next question based on
what I thought I heard. But I might have misheard it. So I thought I
heard you say that if you develop a subset of patients, that that subset
being, in this case, those covered, those who are going to enroll in the
PHR.

**[\>\> Paul Tang:]{.underline}**

Right.

**[\>\> Rose Marie Robertson:]{.underline}**

You are then required to expose them again, to get another signature.

**[\>\> Paul Tang:]{.underline}**

No, we aren\'t

**[\>\> Rose Marie Robertson:]{.underline}**

You\'re not? So the original signature covers this \--

**[\>\> Paul Tang:]{.underline}**

Correct.

**[\>\> Rose Marie Robertson:]{.underline}**

\-- insofar as it deals with many of the components, I think, that
we\'ll talk about.

**[\>\> Paul Tang]{.underline}**:

Correct, and that\'s not apparent in this analysis.

**[\>\> Rose Marie Robertson:]{.underline}**

So they may actually be better, in fact, they almost \--

**[\>\> Paul Tang:]{.underline}**

They have to be by law.

**[\>\> Rose Marie Robertson:]{.underline}**

They have to be better than they look here.

**[\>\> Paul Tang:]{.underline}**

Right, that was my point.

**[\>\> Stanley Chin:]{.underline}**

Any other discussion on that? If not, I\'ll go into the next slide.

**[\>\> Rose Marie Robertson:]{.underline}**

Is the question there then, is the PHR part, is there an unfair
competition, I suppose, between them and the, and vendors, or an unfair
requirement between them and commercial vendors, you know, they can
offer it and they don\'t have to go through that additional
step, whereas the commercial vendors do. That\'s not
unfair, necessarily, it\'s just, it\'s, we just have to think about that
as an additional step one group as to do and the other doesn\'t.

**[\>\> Paul Tang:]{.underline}**

In a sense that\'s the core distinction and one that we want to
emphasize. Because if, so speaking as a consumer, if your information is
being housed in a PHR that is operated by a covered entity, all the
rules that you signed up for apply. You know, what they are by law you
have to have been exposed to them, they have to be accessible to you,
and it has to be transparent. In contrast to, if you\'re with a third
party, as Stanley said last time, I think it was something like half of
them are even accessible to you.

**[\>\> Rose Marie Robertson:]{.underline}**

Right. Okay. I think that answers my question Stanley, carry on.

**[\>\> Stanley Chin:]{.underline}**

Thank you. The next slide reemphasizes the point saying that when we
looked at the policies of those that were \-- there\'s a typo on this,
it's seven on the HIPAA-covered entities and there\'s 37 overall, in the
category title, correct, there\'s eight categories \-- so looking at
that, we saw that when we looked on the left-hand side for all
policies, these are the large categories, was there any coverage in any
dot in any criteria in any category, so it\'s broadly spoken, if there
was anything there, you get counted in. So of all the categories, you
can see 75 percent had something covered communications between vendor
and user, whether it was an item in the contact information, effective
date, notification ofchange in policy, or opt into changes, it\'s
didn\'t matter. If it had one dot there it counted.

The 75 percent there and 85 percent had the coverage of the seven that
we looked at. So you can see, there are some differences. Readability
scored better. Coverage of inactive accounts scored better, selecting of
user data scored better. What scored worse was sharing with
non-healthcare entities and the adherence to published guidelines or
codes. That is not to say that they \-- although, as Dr. Tang has noted
they must be covered by HIPAA, they must have \-- the fact, that fact is
simply not noted in the policies. So we just note that \-- it's
surprising, since it would have been a matter of just a couple words to
put in. Definition of terminology is somewhat better, and bundled with
security policies is about the same. So it was just, it was a surprise
to us because we expected that they would all simply mention that they
were under federal privacy rules. That did not turn out to be the case.
Comments or questions on that slide?

Okay. So that doesn\'t change the last slide, which is conclusions,
doesn\'t change any of the basic questions and conclusions that were
drawn in January that the policies are, appear incomplete and there
isn't consensus on the requirements to them. We simply note that those
HIPAA entities did not all state the protection of consumer PHI data.
Some did. Not all did. And continue to believe that privacy of PHR data
should have a commonly-understood meaning.

**[\>\> Paul Tang]{.underline}**:

Stanley, it\'s Paul again. I'm sorry, I cut myself off right as you were
explaining the differences between the HIPAA-covered and non-covered.
And your statement here, HIPAA-covered entities has less coverage than
other vendors for describing user, sharing user data?

**[\>\> Stanley Chin:]{.underline}**

Yes.

**[\>\> Paul Tang:]{.underline}**

The reason I stated earlier, by law, they have to have done that. And
so, that statement is actually inaccurate.

**[\>\> Stanley Chin:]{.underline}**

Within the context of the policy, within the context of the privacy
policy, it is a description of what is present in the privacy policy
that is available to the user.

**[\>\> Paul Tang:]{.underline}**

I know, but I sort of explained why it\'s not available on the Web.
It\'s because they\'ve already gone through the process.

**[\>\> Rose Marie Robertson:]{.underline}**

I think it\'s a matter of clarifying in the data, clarifying perhaps in
the presentation, that statement, that statement needs to be noted or
you know, or I guess really, I think Paul is saying, and I think I would
agree, that the statement perhaps needs to be modified to reflect what
the, to reflect that situation.

**[\>\> Paul Tang:]{.underline}**

So in a sense \-- yeah, I really say the conclusions are inaccurate for
the HIPAA-covered entities, so point two, HIPAA-covered entities did not
state their protection of consumer PHI data. They have to. And they did.
Otherwise, they were out of compliance. And I realize that it was not
transparent to you. But I explained that reason. So I think it\'s more
than a footnote. I think the conclusions with respect to this subset are
inaccurate.

**[\>\> Rose Marie Robertson:]{.underline}**

If the item read that they did not identify that within the, within the
PHR itself, and but by law would have had to do that prior to patient
entering the PHR, then that would be the correct thing to say.

**[\>\> Paul Tang]{.underline}**:

I think it\'s confusing in the case of a HIPAA-covered entity, we\'re
talking about basically an integrated PHR.

**[\>\> Rose Marie Robertson:]{.underline}**

Yes.

**[\>\> Paul Tang:]{.underline}**

Then the data in the PHR is same thing as the data in the EHR. And
privacy protections and security provisions covering the EHR slash PHR
are the same.

**[\>\> Stanley Chin:]{.underline}**

I guess that\'s a question. Is it, it\'s not clear to me that it is only
the data that is in it \-- not to argue the point. Obviously it\'s
correct that the HIPAA-covered entities have already enrolled and have
already worked through, with their clients, the coverage and the rights
that the individual has. What is also true is that on the policies we
observed that that was not described. There is an additional question as
to whether or not a patient enters, alters, or otherwise interacts with
the PHR data through the PHR portal independent of the EHR information.
It\'s just a question to my mind, to our mind on this of clarity and of
transparency. So it\'s not \-- I don\'t know.

**[\>\> Paul Tang:]{.underline}**

I think there\'s a clarity question, but there\'s no transparency
question. And I guess the reason to make, stress this point is that is
one of the main reasons we\'re making that distinction between a covered
and non-covered operator.

**[\>\> Rose Marie Robertson:]{.underline}**

May I ask a clarifying question about the, about the data? So if the
covered entity has in its electronic health record the data that also
populates the PHR, but by virtue of running a PHR enterprise, also
gathers data from other places, does that data necessarily go into their
EHR as well, or could it in some cases only go into the PHR? But could
your university PHR have data put into it that they would gather for
you, because they\'re a PHR business, but would not include in your
medical, in your EHR? Probably they would include it in both places.

**[\>\> Paul Tang:]{.underline}**

Correct. Because I can\'t speak for a future model, because I think
there are future models where they could provide additional services.
But the ones I believe we\'re talking about now all are integrated, so
that it\'s one and the same. So if there were outside information, which
does happen routinely, coming into the EHR, it would be exposed in the
PHR as well.

**[\>\> Rose Marie Robertson:]{.underline}**

And if there were data, for example, data that the patient might want to
have in the PHR, but not open to other physicians, so say they wanted to
have their psychiatric records in the PHR, but they didn\'t want that
visible, you could have a model where the, where the covered entity
would run a PHR like that that would allow that barrier to be put in
place?

**[\>\> Paul Tang:]{.underline}**

You could imagine, yeah, that could happen. I don\'t think it\'s
happening right now.

**[\>\> Rose Marie Robertson:]{.underline}**

Yes, right. Right. Okay. And if you had a model in which there was, you
know, that more commercial type of handling of data, then, in fact, it
would be critical for this piece to be transparent and it would be
different from simply what\'s in your EHR. So I guess, Stanley, that\'s
the argument, I guess, just to be very explicit as we have this
report, as we incorporate this report into it.

**[\>\> Ross Martin:]{.underline}**

Stanley, this is Ross. If I can ask, if the HIPAA-covered entity, it
said on their Website, the data that are here are covered under the
HIPAA disclosure agreement that you signed at the time of care?

**[\>\> Stanley Chin:]{.underline}**

Some did.

**[\>\> Ross Martin:]{.underline}**

Some did that, that would have meant that they got an A plus on that
issue of sharing user data with non-healthcare entities. Even if they
didn\'t explicitly say what the policy was, they would have said refer
to whatever you signed when, the disclosure form you signed earlier.
Um, Paul, does that address your issue, because I don\'t think this is,
I agree with you it\'s not trying to say they\'re out of compliance with
HIPAA, because technically they covered it, But the clarity issue, a
patient may not realize as they interface with this personal health
record, that that thing I signed two years ago at the doctor\'s
office applies here.

**[\>\> Paul Tang:]{.underline}**

I think that\'s the fair point that is raised, that it, the policy
should restate that. And that is a fair conclusion. But the conclusion
that they did not state their protection of PHI data is not a fair
conclusion, because they had to have. You can say it was not on the Web.
You know, they didn\'t state the point you just said, Ross, they
didn\'t, I mean, that\'s all fair. I think that\'s a good thing to do.

**[\>\> Ross Martin:]{.underline}**

Okay.

**[\>\> Stanley Chin:]{.underline}**

We can certainly alter that.

**[\>\> Paul Tang:]{.underline}**

And so, in point, just to complete that, your first point that existing
policies are incomplete, again, the same thing, it can\'t be, unless
they're out of complaince. So you\'re drawing a conclusion that isn\'t
justified by the study that you did, for HIPAA-covered entities.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Paul this, is Nancy Davenport-Ennis, and I guess I have a question for
you. As I\'ve listened to the discussion, I think the points you\'re
making are very elucidating for me. But the question is this: do we need
to have a summary set of conclusions relative to the HIPAA-covered
entities from this report and a separate set of summary conclusions
relative to the non-HIPAA-covered entities from this report?

**[\>\> Paul Tang:]{.underline}**

I think that would be very helpful, Nancy, and then a third, sort of
tying them together, and so, why is it different would be very useful.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Okay.

**[\>\> Paul Tang:]{.underline}**

Yes, I think lumping them together, I think it\'s really hard to draw
conclusions. And the original reason they went back to do this
additional supplement is to try to elucidate what are the differences.
And it\'s not always apparent just by reading the Website, because
there\'s a different relationship and different requirements that were
already present that were behind the scenes.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

I think if we do that we have complete transparency with both
types, they\'re both fully identified.

**[\>\> Paul Tang:]{.underline}**

I think that would be much more constructive and also give clearer
instruction to both kind of groups what they need to do to make it even
better.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Yes, I think. And Stanley I guess that would bring us right back to you
to ask, indeed, if that would be a modification that we could request
and that would be something that could you provide to the committee?

**[\>\> Stanley Chin:]{.underline}**

I think we have all that information so that it would be relatively
straight forward to pull it together.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

I think that would be very helpful to the discussions we\'re having.

**[\>\> Rose Marie Robertson:]{.underline}**

Absolutely. That would be great. Are there other questions for Stanley?
Terrific. Well, we really appreciate your doing this. We understand that
you took this on as an extra effort after hearing our requests at the
last presentation. And I just want to express our appreciation for your
willingness to do that. I think that was \--

**[\>\> Kelly Cronin:]{.underline}**

This is Kelly. I actually do have one follow-up question. The category
of bundled with security policies. Is there anything that you noticed
about internet privacy policies in general or in your review of the
policies that gave sort of a good rationale for why they should be
bundled together?

**[\>\> Stanley Chin:]{.underline}**

No, I mean, my reaction, our reaction to that was, since they are
separate ideas, that there seems to be some conflation on the mind of
the vendors as to what characterized a complete policy. And because they
had a lot to say about security, they said a lot about security. And
because it was relatively straight forward of what to say about a
Website, for example, cookies and so on, they said a lot about that. And
because t was not particularly clear to them what to say about privacy,
or perhaps for other reasons, they said relatively little about that.
And that was the main thing we noted about the privacy policies, that
they are in fact mis-named. Most of them are security and Web policies.
And that\'s potentially problematic.

**[\>\> Kelly Cronin:]{.underline}**

And for the way that other Internet service providers or other
Internet-based services, is it common to lump together privacy and
security policies?

**[\>\> Stanley Chin:]{.underline}**

I don\'t think I can answer that.

**[\>\> Kelly Cronin:]{.underline}**

Yeah.

**[\>\> Stanley Chin:]{.underline}**

It's a good question.

**[\>\> Kim Nazi:]{.underline}**

And this is Kim, I have a comment. It would seem then that part of what
could be useful is sort of a standardized lexicon on terminology so that
we standardize when we refer to something what that means across the
board?

**[\>\> Rose Marie Robertson:]{.underline}**

That would be critical to the work that we\'re going to talk about in a
moment of the subgroups and to all of our understanding as we go
forward. How do we best \-- do we need sort of a glossary there or \--

**[\>\> Stanley Chin:]{.underline}**

We also did note the lack of glossaries and FAQs associated with the
privacy policies.

**[\>\> Rose Marie Robertson:]{.underline}**

It could be that those, that there has been definitional work from the
Confidentiality, Privacy, and Security Workgroup. Kelly, do you know if
that\'s \--

**[\>\> Kelly Cronin:]{.underline}**

I don\'t think I have taken on a lexicon, but I think certainly it would
be really helpful to standardize a lot of the language in this area.

**[\>\> Rose Marie Robertson:]{.underline}**

Right. So maybe that\'s something we can take forward to that group so
as they work on things \--

**[\>\> Kelly Cronin:]{.underline}**

Yeah.

**[\>\> Rose Marie Robertson:]{.underline}**

And it may be that as items come up that we need definitions for that
would be the time and place to do it. If there are no other questions
we\'ll move on to the next section. Stanley, thank you so much for the
extra work and coming and presenting it. And we\'ll look forward to
receiving the final report, written report to the group.

**[\>\> Stanley Chin:]{.underline}**

Thank you so much.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Thank you, Stanley.

**[\>\> Rose Marie Robertson:]{.underline}**

The next item that we wanted to cover, and we have here, we have a great
majority of our time today, to a discussion of the components of privacy
policies that seem to be most important. And, as this group had
discussed before, there\'s clearly a need for policies and best
practices to be in place before we can hope to move to anything that
would make those best practices be disseminated, certification, one of
those concepts. And there was clearly a discussion at AHIC and actually
in the presentation by CCHIT there, about the, if you will, sort of the
waterfall approach to what they\'re doing, a discussion about, you
know, do you wait until everything has been, you know, set in stone, and
then move forward? Or do you begin those processes in parallel, and
there was no question that having policies developed and discussed and
agreed upon was critical, although, they could begin thinking about the
process, a process for certification, as could other entities in the
meantime.

And as this group discussed before, it seems most appropriate for us
to, if we\'re going to take this on, which I think we accepted was part
of our charge in as a consumer empowerment group, there\'s a critical
need for to us work with the Confidentiality, Privacy, and Security
Workgroup as well. Nancy and I and Kelly and Michelle had a preliminary
conversation with leaders of that group and they\'re certainly willing
to do that. And the process that we\'re proposing is that these two
Workgroups will form an ad hoc subgroup of members from both to perform
a risk assessment on the components of privacy policies. And I know you
all have done a lot of work before I joined the group on what items were
felt to be most important in privacy policies. We\'ll talk about those
in a moment. But that subgroup would look at those, see which ones were
most critical, that sort of is the risk assessment to the system. And
prioritize those components according to the principles sets forward and
a risk assessment. And then the, that would go back to the CPS Workgroup
to consider how HIPAA rules apply to those components and how those
components fit with their Workgroup's agenda and tasks so that we can
validate what seems to be most important there. The joint subgroup would
develop for us criteria for the priority components that we would want
to encourage as documenting and indicating best practices. And we
actually think we will need to bring the, we might have a joint meeting
at one point, because we\'ll certainly need to have those two working
groups, working together to develop recommendations to AHIC based on the
criteria that are set and one way to do that would be to invite one
Workgroup to the other Workgroup\'s meeting and probably CPS would take
the lead on those recommendations, but we would have important input.
The subgroup, could actually start meeting in April and we\'re
hopeful, I think, we\'re optimistic but hopeful, that over the course of
May and perhaps some of June, the work could be by and large completed
at least to the extent it would come back to the two Workgroups, our
Workgroup and CPS. So questions about that, thoughts?

\[dog barking\]

**[\>\>]{.underline}**

I second that.

\[laughter\]

**[\>\>]{.underline}**

One question I have, I think it sounds like a great idea. Are there
issues, would that be a FACA subgroup or are their issues that we have
to worry about in that area or could that group be more informal?

**[\>\> Kelly Cronin:]{.underline}**

I think we\'ll certainly have more than one public meeting on this to
deliberate whatever is done, sort of in a research mode or, you know, in
a background discussion mode. But I do think, you know, we\'ll probably
have some work that is done offline just to really get a lot of details
worked out. So, yeah, I would imagine we\'ll have both a combination of
closed and public meetings. But enough public meetings that people
really feel like they can weigh in.

**[\>\>]{.underline}**

I think it\'s a great idea

**[\>\> Christina Collins:]{.underline}**

Christina Collins with the AMA. Certainly privacy and security is
something I've been harping on whenever I catch an opportunity to attend
these meetings and I think it\'s tremendous to (Inaudible) Workgroup.

**[\>\> Paul Tang:]{.underline}**

And this is Paul. I think the plan sounds wonderful.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Thank you, Paul.

**[\>\> Rose Marie Robertson:]{.underline}**

Other thoughts or concerns, questions about that? It\'s a, no question
it would be a, you know, a busy time for that subgroup, but it is such
an important area, we want to be certain that it gets, that we move
ahead in a brisk sort of way but also so that it has the careful and
appropriate oversight that it deserves.

**[\>\> David Lansky:]{.underline}**

Rose Marie, it's David. My question is really, maybe not for our
conversation right now, is the mechanics of the process of coming to,
collecting information or perspectives and then resolving, looking
for, you know, contentious practices. In our experience so far in our
work, some of these issues are very difficult and take some time and
need a fair amount of input and review. So I guess setting a timeframe
and a process for that, that is realistic or prioritizing areas that are
more or less urgent, would be challenges.

**[\>\> Rose Marie Robertson:]{.underline}**

Yeah, no, that\'s a great point, David. And I think one thing that
we\'ll need to do is to have, you know, both Workgroups have input into
that. We\'ll spend a big chunk of time here in a few minutes looking at
the previous work that\'s been done and getting the input of this group
out to take forward so that the subgroup can then chew on that in more
detail. So there\'s been some previous work done. But I anticipate
that, you know, this is a complicated issue, and that the subgroup will
have, will add to that body of information considerably.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

David, this is Nancy, and would I also like to share that I think to
your credit and that of the Markle Foundation, as well as the input of
Blue Cross Blue Shield in earlier discussions that the Consumer
Empowerment working group had months ago around these privacy
principles, I think much of the work that both you and Blue Cross Blue
Shield did, we can now utilize as a template in many instances for
moving forward. And one of the things that we do want to do this
afternoon is to have a scan review of those draft privacy proposed
principles that you and Blue Cross had worked very hard with the CE
working group to advance several months ago. And so that body of work
will become a very integral part of what we\'re doing moving forward.
And I think you and Blue Cross will be able to bring great value to the
future discussions as we\'re looking at the processes that are going to
help us make those very decisions that you have said today you would
like to understand better what the process is going to be, because I
think, to some extent, you\'ve already moved through that with a lot of
the work have you done.

**[\>\> David Lansky:]{.underline}**

I appreciate that. I am also increasingly aware there are many groups
around the country working on these same questions. And I think the
staff will, you know, be, have some work to do to collect what is going
on from both State efforts and private efforts and some of the new
umbrella groups that are emerging.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Yeah, we agree.

**[\>\> David Lansky:]{.underline}**

And certainly, speaking for our work we really have not even gotten to
substance of the policies yet. We\'re really still at a kind of
cataloging the challenges level. So I think it\'s important to set some
targets for ourselves of where we think we can make the biggest
difference most quickly and make sure we do a very good job on a couple
of areas, as well as, I hope, laying out the overall framework within
which all of this happens. A number of States asked us for help with
just what is the framework, not even what are the answers, but what is
the scope of the body of work that is needed. So perhaps we can come up
with that fairly quickly and then start filling in some of the blanks.

**[\>\> Rose Marie Robertson:]{.underline}**

And so I\'m particularly glad hear Paul be enthusiastic about this
plan, and, David, your interest in it, because we had anticipated asking
both of you to be part of that subgroup, wanting to hand you more
work, as well as Kevin Hutchinson, if he\'s willing to do that. And we
certainly would open this up to others who might have an interest. I
think we, with the understanding that we do want to keep the, we
obviously have to keep this at a kind of workable level. So if others
are interested in participating, you might e-mail your, e-mail that to
us and we\'ll try to make sure we accommodate kind of as many people as
possible within the context of not making it so large that it can\'t be
an effective working group.

**[\>\> Kelly Cronin:]{.underline}**

Rose Marie, this is Kelly. I also just wanted to follow up on one of
David\'s comments about prioritizing components or aspects that we can
really take on in a thorough way. I think our risk assessment, although
it\'s going to be more qualitative than quantitative, will let us do
that. I think we\'ll have a better handle based on what we know
now, where we think the real risks to consumers are and perhaps focus in
on those areas based on that.

**[\>\> Rose Marie Robertson:]{.underline}**

Other comments or thoughts about the process? Okay. Then hearing
none, we\'ll proceed with that as our goal, and we\'ll be hearing a lot
more from that as we go forward. So the initial step there, then is to
review the draft privacy principles that we have from Markle and Blue
Cross and Blue Shield that I think this group looked at in the past
before I came on board. And the idea here is that we want to look at
these as a guide to see if we think the privacy policy components of
this support and are in sync with our consumer-oriented focus. So there
are lots of reasons to have privacy policies and to have various
components to them, keeping our hat on as the voice of, you know, of
empowering the consumer and encouraging the consumer to use these
valuable tools. We just want to make sure there aren\'t things that have
been left out, and that the general principles we\'re in agreement with.
So we wanted to see if we have any significant changes to these
principles and I think we\'ll have those on the next slide. Is that \--
moving to the next slide. Here we are.

So there will be several here. So first, the principles that are related
to privacy, and these are from the proposed PHR principles for the
Consumer Empowerment breakthrough project in February of last year, so
here in terms of HIPAA-related issues, all entities that provide or
manage personal health information, whether or not they\'re defined as
covered entities, should follow the privacy and security rules that
apply to HIPAA-covered entities and at a minimum, the structure and
rules, there we said of the breakthrough, but here we would say in
general, have to facilitate the ability of people to exercise their
personal health information rights under the federal privacy regulations
mandated by HIPAA. Thoughts about those statements?

**[\>\>]{.underline}**

Can you tell us what document you\'re working off of? Is it the last
page \--

**[\>\> Kelly Cronin:]{.underline}**

Yeah, the most comprehensive or concise list of the principle is the
last page of our packet.

**[\>\>]{.underline}**

Okay.

**[\>\> Rose Marie Robertson:]{.underline}**

So for those of you on the Web meeting, the slide is up there. For those
of you looking on paper, it\'s the last page of the packet, I guess.
Let\'s take a moment to look at that and see if there are
comments, thoughts, questions, any modifications, significant changes?

**[\>\>]{.underline}**

I think it\'s a good principle.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. I don\'t hear any, leaving it, of course, open, I don\'t hear any
disagreement with that principle. The next slide, I\'m doing this a bit
from memory, okay, as to how many slides, but in terms of disclosure and
accountability, here that people should be informed of the ways their
information may be used, and have to be able to choose whether to make
that data available for such use in various systems. So that would have
to do with certainly secondary uses, but would also have to do with how
their information flows in and out of various entities. And, do we think
this is, so that is one issue in terms of the clear statement of that.
And then the second is that, and we talked about that this
morning, communications with people about the uses of and policies
protecting their electronic health information have to be conducted in
simple, easily understood language for purposes, and there we said for
purposes of the breakthrough, but here let's put a period after
language.

**[\>\> Christina Collins:]{.underline}**

Rose Marie, this is Christina Collins from AMA. I wonder is this an
appropriate venue to discuss or consider the concept that contained
within privacy principles might be some articulation around the value
that, if, indeed, there is some sort of disclosure that was not
anticipated or explicitly authorized by the PHR owner, that there is a
responsibility to disclose that to the PHR owner.

**[\>\> Rose Marie Robertson:]{.underline}**

Is that on the next slide? I\'m sorry, I don\'t have the whole pack of
slides. I am seeing them one by one as you are. Let me just see if
that's on the next slide.

**[\>\>]{.underline}**

There is \--

**[\>\> Rose Marie Robertson:]{.underline}**

Right so, one of the issues here \--

**[\>\>]{.underline}**

Yeah.

**[\>\>]{.underline}**

Access control where people should have the ability to review who has
had access to the personal health information. You are getting at the
breach, the laptop that gets left somewhere or stolen, versus this is
the log of who looked at your, who looked at this\--

**[\>\> Rose Marie Robertson:]{.underline}**

This is the sort of audit trail, but that is, that is different. So
let\'s go back then to that previous slide. Because I think that does
sound like the right, that does sound like the right place to add,
perhaps add a bullet there after communications. It is an accountability
issue. What would we want to say here?

**[\>\>]{.underline}**

I think the wording of it can be worked out later. But the principle
about, you know, notification of breaches, unintended information
loss, certainly all the stuff that the hearings are going on now in
another part of D.C.

**[\>\> Rose Marie Robertson:]{.underline}**

So there must be timely notification of any breach of the information,
privacy and then we can add words if we think we need to.

**[\>\> Christina Collins:]{.underline}**

Thank you.

**[\>\>]{.underline}**

Okay? Does that, is everyone in agreement adding that?

**[\>\>]{.underline}**

Yes. That sounds good.

**[\>\>]{.underline}**

Thank you.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. So anything else on this page? That was a great addition.

**[\>\> Kim Nazi:]{.underline}**

This is Kim Nazi. And I\'m not sure if it belongs here, but I\'ll put it
out to the group. One of the things I was thinking about was sort of the
principle that consumers may, in fact, want to change their status or
opt-in, opt-out. So somewhere along the way I would propose that we add
something to the effect of are consumers instructed on how to enact a
change, who to contact or what the mechanism is or what the policy
considerations are.

**[\>\> Rose Marie Robertson:]{.underline}**

Right. And I don\'t, I\'m trying to remember, again, I don\'t think
that\'s \--

**[\>\>]{.underline}**

It seems like some of that is covered under disclosure and
accountability, the second bullet where it says people should be
informed of the ways their information is used and must be able to
choose whether to make their personal health data available.

**[\>\> Rose Marie Robertson:]{.underline}**

But I think the \--

**[\>\>]{.underline}**

For such use in various systems

**[\>\> Rose Marie Robertson:]{.underline}**

This is sort of a bullet under that, isn't it? It\'s an issue of they
should be able to alter that.

**[\>\> Kim Nazi:]{.underline}**

Yes, that\'s exactly right. So if their health status changes, for
example, and they choose to change the way in which they interact with
the organization, then they should have knowledge of efficiently how to
do that.

**[\>\> Rose Marie Robertson:]{.underline}**

Right, or if their relationship with the person they previously allowed
access changes. Many circumstances could change what you would do.

**[\>\> Kim Nazi:]{.underline}**

Right.

**[\>\> Rose Marie Robertson:]{.underline}**

So that would be an important additional item there as well, I think.

**[\>\>]{.underline}**

Can I ask a question? If these principles were drafted surrounding the
breakthrough is this getting at the use of, maybe it\'s a secondary use
of de-identified data that could be in databases to do trend
analysis, benchmarking, modeling where you can try and improve practices
by being able to be use good data to see standards of care when you have
very good data you can kind of close in those gaps to see where we\'re
meeting the standards of care, and often those databases they are
de-identified. I don\'t want to open a can of worms here, but are these
principles getting at that? There\'s a whole host of issues.

**[\>\> Rose Marie Robertson:]{.underline}**

That\'s \--

**[\>\>]{.underline}**

Data in that if it becomes an opt-out even though it is de-identified
and I wanted to ask the question, is this going to apply to that kind of
use as well, or is it more around the use case of personal health
records?

**[\>\> Rose Marie Robertson:]{.underline}**

That\'s a great point. And there was discussion at the AHIC on Tuesday
on basically the use of information for, if you will, public health
surveillance on the one hand, so sort of by public health entities, but
likewise, one could have de-identified data. There are many groups, both
commercial and non-commercial, who would like to have access to
de-identified data. And that clearly is going to need to be dealt with,
and it was recognized that PHRs are a part of that process. Kelly, tell
me where that will fall in the, is that something we should be making
specific here as a bullet under this one, a second bullet under there?

**[\>\>]{.underline}**

If I can clarify, I think it would be a problem when you look at
biosurveillance, if you gave everyone an option and too many people were
able to opt out of that, important public health tracking or other
important things that could be problematic and the context of where I\'m
coming from is why I raised it.

**[\>\> Kelly Cronin:]{.underline}**

My sense is that this bullet under disclosure and accountability
principles, for people to be informed of the ways their information may
be used, I would think, not only for treatment, payment operations but
for other secondary uses of the clinical data, I think we would not
likely want to get into defining those secondary uses and the parameters
around them. I think the spirit of this is that people just know that
their information will be used for those purposes. And I think we\'re
going to have an awful lot of discussion and debate over many months
around secondary uses and Amy and other organizations already have
ongoing work in this area. And we could be engaging NCVHS on this as
well. I think that\'s one of those issues that will require quite some
time to work out and you need considerations for qualify, for research,
for public health. And we don\'t necessarily want to get bogged down
with that now. But I think that the spirit of this is that people should
be informed of the way their data is being used. If we can agree on that
\--

**[\>\>]{.underline}**

I agree it\'s kind of public health and other quality. It could become
problematic.

**[\>\>]{.underline}**

I don\'t think we need to get into that big of a discussion. Being
informed, absolutely.

**[\>\> Rose Marie Robertson:]{.underline}**

Yeah, you know, I think an important point there, although our focus has
been in this group on kind of almost an absolute control of your
personal health data, of course, there\'s obviously not absolute control
of that even at the moment. And there is important public health
surveillance that is critical to the health of the society. So, you
know, one wouldn't want to undo the, our abilities to conduct
surveillance effectively in those methods, in those circumstances as
well. So I guess, Kelly, although we don\'t want to get bogged down in
it, maybe we just want to make sure that we note the areas in which, you
know, questions have been raised.

**[\>\> Kelly Cronin:]{.underline}**

Absolutely.

**[\>\> Rose Marie Robertson:]{.underline}**

And so we want to make sure that they get carried forward there.

**[\>\> Steve Downs:]{.underline}**

This is Steve Downs. Just one thought I had on this. I don\'t know if
there is a way to finesse it, choose whether they want their data to be
used in those ways and as you point out with a lot of public health
surveillance it\'s not a choice, it\'s a law. And I was just wondering
if you could say something you must be able to choose, except were
prohibited by law, whether their data should be used in that manner.

**[\>\> Rose Marie Robertson:]{.underline}**

Yeah, I mean, right, that\'s a \--

**[\>\>]{.underline}**

That\'s a very good suggestion.

**[\>\> Rose Marie Robertson:]{.underline}**

It is. It is a slightly scary phrase, I think.

**[\>\> Steve Downs:]{.underline}**

Yes. That\'s true.

**[\>\> Rose Marie Robertson:]{.underline}**

Maybe except as required for public health surveillance. Maybe we should
just be explicit about that. That is really the one that would be
required by law, I guess. Isn\'t that right?

**[\>\>]{.underline}**

I think we have a fundamental question where there\'s maybe a
discrepancy between what some of the earlier principles about personal
health records in this document, and then what we\'re talking about
now, because the very first one is that as somebody mentioned, this
person, each person controls his or her own personal health record, and
can decide who has access which parts of his or her PHR. Now, you
know, many would define the personal health record as being something
very distinct from the other records that reside in physician offices,
in the payer community, where there are HIPAA rules under those
things, and this gets, let\'s separate out the question about whether
it\'s a PHR tethered to a payer or HIPAA-covered entity for a moment.
The notion that this is a equivalent of the paper copy that would I get,
that I have a HIPAA right to get from my provider and now it\'s in my
position and under my control. This is that electronic version of that.
If we have that definition, there is no public health law that says I
have to go hand this thing over to the Public Health Department because
I have a copy of it. The provider has that obligation. And others do
have that reporting obligation. But I certainly don\'t have to
incriminate myself, if you will, if I don\'t choose to. At least \--

**[\>\>]{.underline}**

Right, I think that\'s a very good point actually and it does raise the
issue of when the PHR data is synonymous or overlapping with the EHR
data.

**[\>\>]{.underline}**

If we do establish that what we\'re talking about is this copy of the
information that is now in the control of the patient, we get out of
those, I mean, questions about some of the secondary use questions
because then the opt-in and opt-out becomes if they want to share this,
and I think there can be compelling reasons for people to share their
data for secondary uses in this, and I think actually the PHR represents
a very powerful tool for that. But those other public secondary health
uses and process improvement, quality uses within both the payer
community and provider community can still be managed through their,
already the data that they already have access to through their records.

**[\>\> Rose Marie Robertson:]{.underline}**

So, Ross, that\'s a great point. And I do think the, you know, comparing
it to the paper thing is a helpful way to think about it. The one place
where I guess I would see that they might be different would be that, in
terms of post-marketing surveillance. So what if the concept that these
become a rich repository of, you know, I think Nancy pointed this out at
a previous meeting, of adverse reactions to things, adverse events, and
granted, we have had some, you know, I think it\'s complicated to know
how, you know, how those are adjudicated and such, and the value of the
data, but, if one decided that, you know, there was sufficient value,
that the FDA, for example, thought it was of value for post-marketing
surveillance, would you want to have that accessible or not? So you
know, it\'s not a current use. And it wouldn\'t be what you would do on
paper. But since it is going to be electronic and so since it is now
becomes a potential data source, so I guess this is one of the things
we\'re getting bogged down in that Kelly warned us not to do, and so
perhaps we shouldn\'t talk about it much further. But, you know, you can
think of circumstances where it might, we might want to think about it
differently just because of its form. So you know, maybe there\'s not a
good answer to that question at the moment and we\'ll leave that to let
other people be bogged down by it later.

**[\>\> David Lansky:]{.underline}**

Rose Marie, this is David, one place this same distinction takes us, I
think Ross really characterized it right, the flip of it is going back
to Paul\'s environment, what we might be calling in our kind of rough
language a PHR, but if it\'s simply a portal view of the EMR, and it is
not actually a distinct copy of the patient\'s records that are under
the patient\'s control, we have two worlds in which we\'re
operating, and we tend to commingle them in our language and even our
principles. If we\'re going to call a view of a provider portal\'s
EMR, a PHR for the purposes of this discussion, a whole different set of
considerations come in. Which are largely the patient actually has no
control over it, and it is still subject to the legal requirements and
other factors about modification, portability, et cetera, that are part
of the medical legal record. If, on the other hand, there is let
literally a digital copy of the record which is put into the control of
the patient, the user, through some other kind of a technology
platform, then these principles apply pretty well. So I guess I\'m sort
of turning this on its head. We have to ask ourselves whether these
principles apply to the portal model of the PHR at all, or maybe
they\'re modified in some way when they apply to the portal
environment, or are we only talking about essentially copies of records
under the patient control, in which case we might want to have a preface
somewhere that says that and doesn\'t mislead people into thinking that
these principles necessarily apply to the portal model.

**[\>\>]{.underline}**

You know, that\'s one of the exact reasons why I brought it up. Because
if needing to make that distinction, not that one is bad and the other
is good, at all, but being able to have consumers understand, and I
don\'t, I don\'t think that it\'s prohibited for a provider, for
example, for a payer to provide something beyond just a portal window
into the record but actually manage a personal health record, but at
that point, when they establish that copy that is kind of, has, is tied
to but is distinct from the electronic health record, that that copy of
it, that the patient does have control over, has some different rules
around it. And when I start adding in my own personal information in it,
those personal health record rules are the ones that apply. And even my
own, even the provider of that PHR, who might be a healthcare
provider, would need permission from me to get that stuff into their
electronic health record, even though they\'re kind of mirror copies on
the clinical record side, they\'re, one's owned, one is the legal record
of the clinician\'s care of that patient, and the other one is the
record under control of the patient that\'s got the tags that show where
the data came from and all the auditing things this talks about but they
get to have a lot more say about what happens with that.

**[\>\> Rose Marie Robertson:]{.underline}**

Boy, these are very important points to consider at this next group,
work. So we\'re capturing all of this and want to be sure that it gets
taken forward to the subgroup, because these will clearly be important
distinctions and, of course, we\'ll see this information back and forth.
I think our first slide on the HIPAA-covered, HIPAA issue is still okay
here, because I think we\'re saying that is sort of a
floor, right, for, you know, for accountability and for functions. This
issue of, you know, the rules actually change once this becomes a
PHR, is an issue that ought to be listed here and I guess, the question
is, where do we, do we put it on that previous slide? Can we look at the
previous slide for a second?

**[\>\>]{.underline}**

Rose Marie, I think we\'re, somewhere we're going to draw a line and it
would be wonderful to have an operating definition that we could test
the places that we draw the line. So as an example, if we dealt with,
there are a lot of PHR principles for privacy. But for this small
group, work, activity, are we, shouldn\'t we be looking at the sort of
the floor as we talked about before? And there probably are a good
number of floor principles that would apply equally well no matter where
the information is stored, such as, um, the access control, the
audits, the immutability, you can think of a number of things before we
even get into the details that we\'re talking about now in terms of,
what architecture are we talking about, and that would change the rules.
Because indeed it would, but it creates such a big set of issues that I
don\'t know that we have any hope, as David alluded to, of solving all
of those within a small amount of time.

**[\>\> Rose Marie Robertson:]{.underline}**

Well, that\'s a great point. And I guess would I agree, maybe the issue
is to have these other topics, you know, kind of placed on the parking
lot so that they\'re there and have to be dealt with eventually but
there may be exclusions for the moment. Let\'s move forward in that
first slide. Let\'s not put another item on that first HIPAA slide.
Let\'s go to the slide we were on a moment ago. We\'re okay that we've
completed this, we\'re okay with this one, with the things we've added?
Hearing no voices raised, let\'s go to the next one. Is this the last of
these principles?

**[\>\> Kelly Cronin:]{.underline}**

We don\'t have a view. Our projector is down here.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. So this is information access and control. And I think this is the
last. And this deals with patients having the ability to control who has
access to their PHI over an electronic health network, either directly
or through the action of a designated proxy or by choosing not to
exercise the control, you can exercise it in whole or in part, that you
should be able to look at the audit trail and review who has had
access, and each individual or anybody accessing it has to have access
authority and be authenticated. Are we okay with these? I think what
we\'ve been saying in the last few minutes suggests we think these are
important and that we would agree with them. Any significant changes?

**[\>\> Christina Collins:]{.underline}**

Rose Marie, this is Christina Collins again, and I don't want to venture
too far afield, but I guess a question that I would have, is this an
appropriate venue to discuss perhaps the value of, in an emergent
situation, a provider being able to have at least limited access to
certain amounts of data in the event a patient is unable to consent to
the access of this information?

**[\>\> Rose Marie Robertson:]{.underline}**

Well, that will have to be covered. That is a very interesting question.
And we should bullet that as an important topic for the subgroup to
think about.

**[\>\> Kelly Cronin:]{.underline}**

Rose Marie, this is Kelly. We did actually made a notation at the bottom
of our first page of the proposed principles, that the PHR should
include a break the glass capability that would permit providers under
very strict circumstances, like if they're unconscious in the ER, that
they could access without consent.

**[\>\> Rose Marie Robertson:]{.underline}**

Great image, break the glass. Very good. So the, I think these really,
this was terrific conversation. And I think we can move these forward to
the subgroup. We actually want to spend the majority of the rest of our
time, the next hour, we have some other things to do at the end, but
really focus on for the next hour on reviewing the privacy policy
components here. And we have, we\'ll have a list of those. And the issue
is whether this list of components and their attributes is complete and
accurate. You\'ll see here a crosswalk of the principles and components.
I wish this were in bigger print. I\'ll blow it up to cover my screen.
We want to see if this is accurate and complete, see if there are any
new components or attributes, or attributes of the current components
that we\'ve left out, and then, this revised list will go forward to the
ah hoc subgroup. So I can keep time, do we know how many slides we have
on this? Let me find my e-mail from yesterday and pull it up.

**[\>\> Kelly Cronin:]{.underline}**

We have three pages to get through. I think they\'re cut up in the
slides. I\'m not sure.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. I think that\'s right.

**[\>\>]{.underline}**

Rose Marie, Can I ask a question about this table?

**[\>\> Rose Marie Robertson:]{.underline}**

Sure.

**[\>\>]{.underline}**

Just glancing at it, and hopefully people have it from the e-mail, just
glancing at it, the first two pages except for one item are all
disclosure and accountability.

**[\>\> Rose Marie Robertson:]{.underline}**

That\'s right.

**[\>\>]{.underline}**

And then there\'s one other on control and then the HIPAA one at the
end. And I want to get people's thinking about you know, put it the
other way, the question of what should be disclosed is an important
question and we could perhaps render a service by coming up with a list
like this of recommended or required disclosures. But the question of
what the policy itself should be is not necessarily addressed by the
mere act of disclosing a bad policy, is it the sentiment of our
Workgroup that our product here should be essentially a risk of
recommended disclosures, or is it our intention to recommend policies?

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. That\'s a great question, David. Let\'s just hear some discussion
there. Obviously, a policy would include issues to be disclosed. You\'re
asking the question of, you know, what beyond a list of disclosures \--
so disclosures are a part of this. They\'re clearly under the HIPAA
issues and under the issues of the other principles will cover some of
the other pieces that would be part of a policy. But I think the
assumption is that this is, these are components that would be included.
The subgroup would have the ability to construct, you know, to add to
that and to construct it, you know, including these but perhaps adding
other, adding other issues.

**[\>\>]{.underline}**

Well, let me just say a couple more things about the problem I think
we\'ve run into with this one. There are well established fair
information practices that cover a number of areas of policy. One of
which is transparency and disclosure. The others cover much more
substantive areas. And because I think we all understand that many
things can be disclosed and still the user does not really understand
what is being done, the disclosures are typically long and complex and
legally drafted for obvious reasons. There is no successful short notice
form that has worked to communicate, even though we said usability and
understandable language is important, which is probably true, I don\'t
think anyone's ever accomplished it in this field. It\'s a nice
idea, but probably not practical. We have two paradigms to consider, one
is the elegant idea of the informed consumer who can look at all these
policy statements and know that service X is more protective than
service Y. And then the reality is, is there a body of recommended
policy that people either are or are not conforming to? And my own view
is if we don\'t tackle the actual policies, this will be moot. And if
you read many of the current disclosures they are written in language
which obfuscates what will actually happen to a person\'s data. So the
disclosure by itself I don't think is adequate. It may be a first step
and we want to simply enumerate, this chart says what some of the
disclosures could be. But I think we will not do very much to create
public trust if we just do that.

**[\>\> Rose Marie Robertson:]{.underline}**

I certainly agree with that. I would assume that we all would, that, you
know, simple disclosure, as in many areas, is not sufficient, and the
extent to which we can, you know, talk about things beyond that will be
important. So other\'s thoughts on that?

**[\>\> Myrl Weinberg:]{.underline}**

This is Myrl, and I certainly agree.

**[\>\> Kelly Cronin:]{.underline}**

Yes, David, this is Kelly, I think one of the things we really wanted to
make sure we covered today is that, you know, looking at these
categories of these components of these privacy policies are clearly
inadequate in some way, which I think you just articulated they are,
that\'s a good starting point for us, to make sure that they are more
specific, or they do actually cover, you know, what actually happens to
the data.

**[\>\> Rose Marie Robertson:]{.underline}**

And we may not have answers for all of that now. I mean, we may not have
answers for all of that forever, but to begin the process we want to
make sure that we get, let's look through these and see if there are
chunks missing, either in things that would fall under these categories,
or if there are items we can identify that we think would be important
to add right now. And we could add things about which we would want the
subgroup to get more information. Again, understanding that the product
here is not going to be, is not going to be perfect, but we hope it will
be better than the current situation.

**[\>\> Ross Martin:]{.underline}**

Rose Marie, this is Ross. I just finished a project, well, not finished,
but went through this process of selecting a license for releasing some
open source software, and one of the things that was useful in that
whole process, where there are lots of open source software licenses
that have different flavors of how you, what they need, and, but there's
a general, because you can't change the license, once you've adopted one
of these licenses, you know, I don't have to have my lawyers, every time
someone says they've got a license, this is available by a certain
license, I can understand what that one is because at some point the
lawyers went through it and said that it was okay. And so having some
standardized language around some policies that I think could be
something that we could offer. In the areas in which there are ways to
do it differently, maybe offer more than one. And that way you'd have
something of an endorsement where I don't have to read all the legalese
of the document to understand that a third party, or a commission, or
whatever you want to call it, that doesn't have a stake in this, isn't
going to be using the data directly, but wrote this license, or wrote
these policies, and somebody took them word for word and adopted them
and said here's the policy we use it's the same that you'll find on a
bunch of other sites, or where it's changed we've highlighted that very
specifically. And that way it can serve, I think, maybe David's question
about how do we make sure that consumers who may not be able to slog
through all this legalese, know that there's, that their interests are
being \-- David, would that be a way to meet that interest?

**[\>\> David Lansky:]{.underline}**

I think so. I think we've got several tasks, and Rose Marie alluded to
one of sharpening our enumeration of the categories, and then looking
for the best practices or alternative approaches that satisfy those, and
then somehow vetting or commenting on which ones do the best job of
addressing the public interest objectives that we have as a committee.

**[\>\> Rose Marie Robertson:]{.underline}**

Other thoughts there? Okay, great points, as always. Let's dig into, we
have 45 minutes to walk through these pages and the principles and their
components and see if there are items or attributes or components that
we think are not there. So the first issue of people being informed of
these policies in place and the uses of information and being able to
choose, the issue here is that we have, the component here, the category
of the component is communication. So the vendor is telling the user
something, and the attributes we felt were important to this, that were
felt to be important, were that there has to be someone to contact so
you can pass the information on, there has to be an effective date, here
included already is a notification of a change in policy, so you have
to, if the policy, and this is sort of the obverse of what we were
adding, here if the policy changes you have to let users know, and they
can opt-in to a new policy if they wish. I guess we've talked about
another attribute being that the user can change, there can be a
notification of change in this policy by the user to the vendor. Other
attributes of this component, do we have to, I think we\'ve covered most
of the issues on this one here. Okay. I\'ll move along if I don't hear
things, so if you think of something later, it\'s okay to come back.

Disclosure and accountability, communications have to be conducted in
simple language. This has to do with readability. And this does address
that, it talks about users of average literacy under readability, and I
would think that\'s one that needs to be addressed by the subgroup
because if you\'re talking about average literacy, almost by definition
you\'re leaving out some of the population. So you would want a pretty
low level of literacy to, I don\'t know if there would be the concept
that you would want to be able to address 90 percent of the population
should be able to understand it, you know, I don\'t, others may have
thought about that more.

**[\>\> Kelly Cronin:]{.underline}**

This is Kelly. I think Myrl\'s point is relevant to this first category
of readability. If we are talking about policies written in plain
language, and there are agreed upon measures for plain
language, um, then just to be consistent, with, you know, whatever those
measures are.

**[\>\> Myrl Weinberg:]{.underline}**

And there are. And I think that would, some reference would be
appropriate to that field of professionalism because there are specific,
there\'s specific characteristics, there are specific measures, and then
they have been documented to relate to the amount of the population
covered. So my understanding is that this, whatever might be
recommended, would apply to the privacy, to the policies, not to the
Website, because I think that would go way beyond our jurisdiction and
also, you know, there\'s certainly going to be, all the vendors are
going to be competing on how user-friendly in some ways their sites are
and how readable and easy to use. That\'s where they have competitive
advantage. I wants to be clear what we\'re talking about here is the
part of the personal health record that is conveying privacy, security,
et cetera, policies, that that\'s what we\'re describing as having to
potentially meet these literacy issues.

**[\>\> Rose Marie Robertson:]{.underline}**

Yes, I think that\'s a good point. One could hope they would write the
privacy policy in language that would be at least as readable as the
rest of the document. But that\'s always tougher and is a real
challenge. So, no, absolutely this is limited to how the privacy policy
is written.

**[\>\> Myrl Weinberg:]{.underline}**

If it\'s helpful I could give you an individual, after the call at some
point, that is one of the people very well known in this area, you might
want to have a discussion with her.

**[\>\> David Lansky:]{.underline}**

Rose Marie, this is David. I would just add in this category there\'s a
lot of work done on short notice privacy formats, especially in Europe
and the data protection commission in Europe has standardized a short
notice form and I know some of the American companies, I\'ve been told,
have done some field testing, focus groups and filed testing with short
notice format. What they ended up with is what they call a multi-layered
format that there\'s a short form, and in a sense you hyperlink into
more detail of the topic that the user cares more about. And I think
referencing the standardized work and consumer testing that has already
been done rather than obviously reinventing it would be a valuable step.
I can refer back to the staff some of the people that have been doing
that

**[\>\> Rose Marie Robertson:]{.underline}**

That\'s great, if you, Myrl and David, would both e-mail that
information to Michelle, that would be great. Other concepts in this
readability area? Okay. Let\'s go to the next slide. First on this
slide, so here the concept that a user should be informed of policies in
place and how things are used. And here\'s the issue of being able to
choose whether the data is made available. We know we've made some
modifications here. One of the issues here had been, and there were, one
of the components here had to do with what happens with an inactive
account, in one circumstance, the issue of whether you deactivate an
account, you don\'t pay up your contract, the contract has lapsed in one
way or another, how is that information dealt with? And the other is,
how is your information dealt with if the company is bought or sold or
goes out of business?

And this sort of, you know, this obviously is critical information, and
it may or may not be available currently. But issues there? This really
is focused on the inactive accounts. What do we think in terms of
privacy, are there other components that should be included here? We\'re
going to talk in a minute about the other uses of information. So, okay.
We think this is an important area, and it needs to remain here.

The next issue, it does deal with collecting user data, that is, both
things like the cookies, which really is really more a security issue
than a privacy issue, well, it is both. It\'s here because it\'s both.
And then issues where you\'ll be solicited about voluntary participation
in surveys, or whatever, that there may be Web service logs to track
your activity. And then is there an opt-out option for various ways of
gathering that personal information? This. it seems to me, is a highly
complex area that we talked about in some detail. And I would expect a
subgroup is going to have actually more discussion of this. I\'ll try
not to get bogged down.

**[\>\>]{.underline}**

Would this cover the issue that you always hear whenever you go on
somebody\'s, you call up for help or customer service and they say, this
call may be monitored for quality and training purposes? Is that covered
in this? Or is that an additional issue that needs to be addressed?

**[\>\> Rose Marie Robertson:]{.underline}**

Does that get covered when, I mean, I guess the issue of monitoring,
much, so I guess if you said, I\'m willing to take this survey, then the
survey, per se, would have the

\[dog barking\]

**[\>\>]{.underline}**

I\'ll take the moment to clarify a little bit. I\'m sort of talking
about the online equivalent of that customer service phone conversation
that you know, somewhere it discloses that for data integrity and
quality purposes on the site, we may have, you know, internal secondary
uses of the data that might have to do with optimizing the speed of our
site and whatever it might be but it\'s technically using stuff about
you, stuff about your access to the system that could be construed as
personal information in nature. But it\'s not leaving the company, or
even if it is it\'s for a specific purpose of another company coming in
and doing analysis on the site, those sorts of things. I don\'t know if
that\'s covered anywhere or if it needs to be.

**[\>\> Rose Marie Robertson:]{.underline}**

Is that personal health information that\'s being used or other, you
know, I guess one might feel differently about that if it was the actual
personal health information that was being \--

**[\>\>]{.underline}**

Well, cookies aren\'t personal health information, either.

**[\>\> Rose Marie Robertson:]{.underline}**

Right.

**[\>\>]{.underline}**

But it\'s here. That\'s kind of why I\'m \--

**[\>\> Rose Marie Robertson:]{.underline}**

Uh-huh.

**[\>\>]{.underline}**

\-- wondering if it fits in this category. It\'s not about personal
health information, it is about their activity on the site. And I don\'t
know \--

**[\>\> Steve Shihadeh:]{.underline}**

This is Steve Shihadeh. I don't know whether anyone saw today, but a San
Francisco company today announced they are going to provide EHRs for
free, sponsored by \-- I\'m not trying to impinge this
company, sponsored by another company\'s search engine \-- and they\'re
going to look for key words as you use that EHR and provide you with
advertising. It\'s well beyond, the topic goes well beyond cookies.

**[\>\> Rose Marie Robertson:]{.underline}**

You know, my guess would be that the CPS Workgroup has considered some
of these concepts and do we want to pass those along to, in to the
subgroup to have them consider which of these issues relate, I
mean, because here we\'re really talking about privacy of personal
health information issues. So we want to, I do think we want to, you
know, limit it to that. That\'s going to be a complicated enough topic.
And perhaps leave overall security issues to, you know, to another, to
the other subgroup, to the other Workgroup. Kelly, it seems to me
that\'s a little out of our charge.

**[\>\> Kelly Cronin:]{.underline}**

I\'m sorry. I just stepped out for a second. But I think there are a lot
of security issues that could come up either in the subgroup or CPS. I
think clearly when we were talking about the criteria for certification
down the road, 18 months to 24 months, that there probably would be
criteria for both. Our primary focus today would be around the privacy
components.

**[\>\> Rose Marie Robertson:]{.underline}**

But we should log these issues and make sure that they\'re, you
know, part of the, as the subgroup meets and begins to discuss, that it
knows that we've thought about them. So great point to bring forward.

**[\>\>]{.underline}**

For the record, I think we should all be impressed that Kelly was able
to walk into the room not having heard any of that conversation.

\[laughter\]

**[\>\>]{.underline}**

That\'s right. That\'s right. It\'s important to be able to do that.

\[laughter\]

**[\>\> Rose Marie Robertson:]{.underline}**

She hears us all in her head no matter where she is. That\'s great.
Um, okay, so perhaps enough on that area. Anything else there? Okay.
Let\'s look at the last slide in this section. Okay, so here
again, under information access and control, people must be able to
choose whether or not their information is shared and should have the
ability to review who has had access to it. The component here was
sharing of user data with non-healthcare entities. So secondary uses and
the issue that you brought up earlier about de-identified data versus
identifiable data and the concept that there should be a different
policy for those, surely the answer to that is yes, and the issue is
whether the policy addresses that difference and which kinds of data and
which kinds of entities it gets shared with and what consent is required
prior to sharing that and that will have to do with a number of
secondary uses. Anything \-- we think that component's important. Any,
from our prior discussion, any attributes or alterations we would like
to make here in the way we\'ve stated this?

**[\>\> Kelly Cronin:]{.underline}**

I think although users' family members are mentioned, there might be
other care givers or proxies that would be relevant.

**[\>\> Rose Marie Robertson:]{.underline}**

Oh, yes, absolutely.

**[\>\> Ross Martin:]{.underline}**

Rose Marie, this is Ross. And just, Steve Shihadeh just mentioned
another use of, a secondary use that doesn\'t necessarily require data
sharing, but it\'s, for example, serving up an ad, I can send an
instruction to say, if somebody had this diagnosis and is of this age
and these are the parameters, serve them up this ad, I never get the
data, but the data is used for that commercial purpose, disclosure of
that, it's another level down from kind of the risk, what Justine was
mentioning, should the same level of control be used for de-identified
data as identifiable data? Well, probably not, if the question is do you
have check boxes for those different levels.

**[\>\> Rose Marie Robertson:]{.underline}**

Right. That's a great point. Particularly if your pop-up software,
pop-up control software is not adequate. I think that's an important one
to add.

**[\>\> Steve Shihadeh:]{.underline}**

If I could just be clear on that example I made \-- this is Steve
Shihadeh \-- in that example I made a few minutes ago, in that scenario
where I decided to opt into, well, as a physician I decide to use that
free EHR, right, I guess at some point I've got to tell my patients that
I'm using that EHR, I've got go get their consent, right, to throw ads
at them. Just like all of us have the ability to opt out today, on ads.
It's a big complicated issue, I think we've really got to get this all
written down and look at it carefully.

**[\>\> Rose Marie Robertson:]{.underline}**

So you would be a HIPAA-covered entity and you'd be covered by all those
things, but I guess there's not another place where that would be
covered. That's an interesting question. HIPAA doesn't cover, I guess,
whether you can send ads to people.

**[\>\> Steve Downs:]{.underline}**

This is Steve Downs. One thought on this, to be that raises a whole
variety of issues around possibly when your privacy is not being
violated, because no one's looking at your information, or can see your
information that's not supposed to, but that your data's, other people
are extracting value from your data, and you are not. And that goes
actually to a lot of sort of voluntary participation in research studies
and a lot of things like that, which in many ways I think is separate
from a privacy issue, but it is an important issue to consider at this
point.

**[\>\>]{.underline}**

What we're talking about here is the disclosure of those things, so you
say, I might not derive the value, but in this case, a free PHR, that in
a similar way, analogous way to the EHR that Steve mentioned earlier, is
supported through advertising or some other mechanism. The analysis of
data where the data is not explicitly shared with another party, but
value is derived because data is analyzed at some level. That just needs
to be disclosed. And the user has to make that decision. Is the value
I\'m getting from this free tool or this subsidized tool worth seeing
those ads along the side or getting those pop-ups or getting mail every
once in a while or whatever the thing might be.

**[\>\> Rose Marie Robertson:]{.underline}**

And the consumer needs to know that at the outset.

**[\>\>]{.underline}**

Right.

**[\>\> Rose Marie Robertson:]{.underline}**

Although I suppose the policy for something like that could change as it
goes along. I mean, you could easily have a product that, you
know, decided after some period of time, that it really needed to do
that a lot more. And all of a sudden, you know, and would you really, is
that really just a functionality that is kind of a, you
know, competitive edge for the people who don\'t do it too much and it's
annoying to some users who then will just opt out is that a, I guess the
issue is whether you\'re being targeted. Is that the issue that we\'re
trying to get at? If it were sent to everybody who opted into this free
PHR attached to the free EHR that your physician had, then you
might, you know if it does it too much people will be annoyed and they
won't like it. It the question is really only, and so that\'s not a
privacy issue I think in terms of somebody\'s personal health
information.

**[\>\> Steve Shihadeh:]{.underline}**

This is Steve. I\'m sorry, I don\'t want to, I hope I didn\'t derail
this conversation. I just think that it\'s a broad topic. Because I
might choose to write a check for my PHR, the person next to me might
choose to get it for free but be subject to ads, the person next to them
might choose to, I don\'t know, pay for it some other way. So I just
think we need to carefully go through some of the recommendations we
make, there are going to be different monetization models for this, and
I think in general if we\'re all for promoting PHRs we\'re going to have
to be realistic there are going to be different monetization models.

**[\>\> Rose Marie Robertson:]{.underline}**

And the issues to be considered by the subgroup, I just want to make
sure we hand things on to them clearly, the issue are the ones that deal
with privacy. So whether you get it for free or get a lot of ads.
That\'s only an issue, I mean, that really is separate from us. That is
kind of a, that\'s a competition area and you know, we don\'t want to
get in the way of that. If those things are based on targeting you via
your personal health information, then it becomes a privacy issue. And
then it\'s something that this subgroup needs to think about. Is that
right?

**[\>\>]{.underline}**

I guess, unless I said it\'s okay to target me.

**[\>\> Rose Marie Robertson:]{.underline}**

Yes, I mean, but, so we can have a category here where we say, you
know, targeted information, sharing of user data that is
identified, because you\'re going to be targeted, and it\'s, and the
issue is, do you have to have the ability to know that that\'s targeting
is happening and that you can opt in or out of that targeting, so that
would be, that would fit under the definition and attributes here, it
would actually fit under the first attribute of policies for identified
data, identifiable data, and then we would just put something in the
definition to say, it you\'re targeted you would have to be able to opt
in or out.

**[\>\>]{.underline}**

That makes sense.

**[\>\>]{.underline}**

The category is disclosure of data use. The interest for the subgroup is
the disclosure issues, not necessarily in what manner is the value of
that data use monetized. I think we should remain pretty neutral about
all those things. But we want to, we want to come down on the side of
disclosure, of transparency, that the user understands what\'s they\'re
getting into when making those choices.

**[\>\> Rose Marie Robertson:]{.underline}**

Right, so I think that would be covered under the attribute of this
category, so the category is sharing of user data with non-healthcare
entities, and the attribute is consent prior to sharing and the
definition there is is consent required prior to sharing information
and, you know, obviously I hear us saying yes, if it\'s identified,
identifiable data and that\'s where we \-- so I think we have it
included here. We can, you know, both share that to the subgroup members
exactly what we\'re thinking about

**[\>\>]{.underline}**

My original point is that it's the sharing word, I think is incomplete
there. Because there are other things where the data technically isn't
shared with anyone, but it is used.

**[\>\> Rose Marie Robertson:]{.underline}**

So that the actual targeting of the person, don't they have to have the
information to target the people?

**[\>\>]{.underline}**

Okay, so an example: a PHR vendor that has the data, and they don't
share them with anyone, but someone gives them the rules by which they
want their ads served up, for example.

**[\>\> Rose Marie Robertson:]{.underline}**

Absolutely. Okay, I get it. Yes. So it's not only sharing of your data,
but it's also sharing of, using data, using personal health data to
allow targeting, I suppose, in some way. Okay. That's great. That's an
important addition to our definition. Good.

**[\>\> Stanley Chin:]{.underline}**

Just one additional. I wish, in retrospect, we had made a distinction
not \[dog barking\] not health data and de-identified data. I wish we
had a third category in there. Certainly, name, address, so on. So it\'s
its own category.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. Then the last item, communications must be conducted in, and this
is under disclosure and accountability, communications must be conducted
in simple and easy to understand language. And here the category is the
definition of terminology. And the attributes are both personal health
information and de-identified and this is really a matter of does the
policy include definitions of what those are. It seems to me this is
covered in some of what we discussed before. It\'s an additional way of
looking at the policy. Okay. Hearing no volunteer, let me just see the
next slide?

Okay. So now we\'re at the HIPAA, the last of these, so here we\'re
talking about the principle here is the HIPAA issue that we talked about
in the beginning. So HIPAA-related entities, whether they\'re \-- now
this is interesting. This is HIPAA-related. So the entities that provide
this, whether they're HIPAA-covered or not, have to follow the same
privacy and security rules, categories, the first being adherence to
public guidelines and codes and, not really an attribute here, but in
the definition of this is whether the policy addresses its adherence to
these. Thoughts about this one? Do we think this is a good way to, an
issue that the policy, I mean the subgroup will bring back to us advice
about what they think about this. Do we think this is an important area
that we do want to have addressed?

**[\>\> David Lansky:]{.underline}**

This is David. My only comment, I think it\'s okay and fine to have. I
think it would be, my only worry about it it\'s a little bit misleading,
it tends to sound that we think that's an adequate basis, by bringing it
forward. And I\'m not sure it\'s a significant solution to the issues
that we\'ve all been talking about today. It\'s just, it is an
appropriate minimum standard. But we shouldn\'t be interpreted as
saying this is how we address the issues of PHRs and personal health
information.

**[\>\> Rose Marie Robertson:]{.underline}**

Yeah, these may be there, but some of these might be there but not be
sufficient. So, but okay to leave in for the subgroups.

**[\>\> Christina Collins]{.underline}**:

This is Christina Collins. I\'ll just jump in very quickly because, of
course, the AMA guidelines for policy, for privacy and security are
involved here. I think that certainly from the consumer empowerment
standpoint it probably isn't as meaningful, but for physicians
determining the appropriateness of utilizing a particular PHR, the fact
that the AMA ethical guidelines, that are sort of a basis for the
privacy and security guidelines, are included or referenced somehow is
helpful and useful. So again probably something that should go to the
Workgroup. But I do think there\'s value, certainly for physicians
looking at a particular privacy policy, in having that nomenclature
there.

**[\>\> Rose Marie Robertson:]{.underline}**

You know, I think that is actually an important comment. Because the
issue then is, does the mention of these enhance or provide reassurance
to either individuals or the healthcare providers or others who would
provide information to this? Because if it does, then it will tend to
enhance the use. Whereas if it doesn\'t, it won\'t. So it\'s, that may
be an important way in which the group ought to think about this. Does
it offer value in that particular characteristic?

**[\>\> Christina Collins:]{.underline}**

I guess if I can tease this out again for just a second. I think as we
look at everybody in the landscape we are dealing with privacy and
security and confidentiality and certainly in the arena of consumer
empowerment, I think certainly physicians are in a different position in
a marketplace look at what is going on. It\'s not only a business
decision for them, maintaining privacy of individual health information
but few indeed have ethical guidelines and that being the case it can be
a valuable tool to look at in sorts of fashioning what other
responsibilities other parties might have in dealing with the
information. So probably something better suited for the Workgroup that
is going to be tackling these issues but certainly something I did want
to raise here.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Rose Marie, this is Nancy and I certainly concur with the observations
that both David and Christine have made. I think there\'s another value
to citing these as they\'re presented here and that is that when you
look at an established privacy guideline or code or recommendation from
any of these sources, I think the consumer is immediately going to feel
there\'s also some degree of regulation that assures greater compliance.
And I think for consumers when we look at the issues of privacy and
security, we are immediately thinking of how will those things be
regulated and what will happen if there is noncompliance? So referring
this to the Workgroup with the encouragement that they do look at each
of these bulleted areas as organizations and policies that are already
in place, I think will lend itself well on behalf of consumers who are
seriously looking for that type of protection.

**[\>\> Rose Marie Robertson:]{.underline}**

And then to close up, we have a number of , there\'s some things in the
miscellaneous category, and some of these we\'ve talked about, how long
is the privacy policy and how does that affect whether people read it or
understand it? Is it bundled with a published security policy? I think
that will, that may or may not be helpful depending on how those
policies are described. That\'s something the Workgroup can certainly
address and the issue of other additional comments about the features of
that is really more a data gathering thing I think than, that\'s
certainly not something that we thought was an important feature to have
there, that was really by way of under understanding it better. So if
we\'re okay with this piece, I\'d like to move on to the next section,
and \-- are we okay here?

**[\>\>]{.underline}**

Okay.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay? Okay. Good. To a review of the privacy policy components. So
we\'ve talked about these components. And now we would like to talk
about the risks if the components aren\'t included. So here the CPS
Workgroup has asked us, you know, we certainly want to discuss from the
point of view of our Workgroup, the Consumer Empowerment Workgroup, what
risks there would be to consumers if a particular component or
attributes of it aren\'t included? And this is to, again, give some
information and guidance to the subgroups. We want to have a sense of
how important we think these are. The CPS Workgroup has asked that we
also consider, as we look at this, what the risks might be to vendors
and the marketplace. And, you know, the subgroup can primarily dig into
that. But the idea there is that it is important to give a balanced view
to the impact of these components because if we say, well, it\'s, this
is of a little risk to the consumer, but it turns out that including it
is, in some way produces high risk in the marketplace or to the
marketplace or to the vendor, you know, that would be an important
consideration. That can be mostly done by the subgroup. But I think we
want to think about it here as well. And so we would like to go through
those over the next perhaps 20 minutes or so and begin to get, begin to
discuss our ideas about these risks, again, primarily from the point of
view of the consumer but also the other. And then before we
finish, we\'ll have an update on the use case process by Dr. Loonsk. If
we can go to the next slide, then.

**[\>\> Jennifer Macellaro:]{.underline}**

I don\'t have anymore slides for this section.

**[\>\>]{.underline}**

You would go back to the slides we were just in.

**[\>\> Rose Marie Robertson:]{.underline}**

Oh. I'm sorry. We'll go back to the other slides we just did. So
envision that have you now some additional columns on the right-hand
side of these spots. So if we can go back four slides I think. Ah,
perfect. Okay, good. So now let\'s envision an extra two columns on the
right. What we would like to do for each of these categories, and in
some cases it will be by attribute, what we think the risks to the
consumer would be if they\'re not included and then think about the
risks to the vendor and/or marketplace. Now, let\'s think about how we
want to grade this and maybe a simple low, medium, high.? Do we want a
zero, low, medium, high. I suppose. Let\'s have there be a zero category
so if there are things we think are of no risk, then we\'ll identify
those as well. And let\'s start with the first one. So now we\'re back
to talking about informing people about the policies in place and uses
of information, being able to choose, and now this is really just the
initial conversation, communication between the vendor and the user and
how that is controlled. So contact information not there. Anyone just
shout out a letter?

**[\>\>]{.underline}**

I think it would be a high risk if they didn\'t have the contact
information.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. So and risk for the vendor or the marketplace.

**[\>\>]{.underline}**

For them it\'s a risk if it's, it\'s a high risk if it\'s not there. I
guess \--

**[\>\>]{.underline}**

I\'m finding this, I have to say, difficult.

**[\>\>]{.underline}**

I agree.

**[\>\>]{.underline}**

It feels awkward to just try to think this through and, you know, right
at this moment for me \--

**[\>\>]{.underline}**

I wonder if the subgroup needs to work around this.

**[\>\> Rose Marie Robertson:]{.underline}**

Are we hearing that this is, that these may be tricky, that we want to
think about them and send them back in?

**[\>\> Myrl Weinberg:]{.underline}**

This is Myrl, again, what use will these ratings be put to? What will
they be used for?

**[\>\> Rose Marie Robertson:]{.underline}**

The idea here was that the, so the other Workgroup that is providing
part of the subgroup wanted to understand, because they\'ve not been
part of all our discussions, they wanted to have I think a feel for how
important we felt these were, how critical these components were. And so
it will be, obviously, our members on the subgroup could communicate
that, but we wanted to make sure we had the view of the whole Workgroup
on this so that that will help them, I think, in prioritizing which
things need to be part of the policy and which things may be less
important.

**[\>\> Myrl Weinberg:]{.underline}**

And to me, some of them are, which do we have the right to sort of
insist on? You know, I look down at frequently asked questions and
alternative languages, those are nice, but they would certainly not be
in the category where I think they should be mandated, where having it
in language that can be understood with the end user is pretty
important.

**[\>\> Rose Marie Robertson:]{.underline}**

So that\'s a great point. Perhaps we, and we can certainly do this as we
go through, either now or later. So we could point out things that are
of whatever risk level, and then the question of whether we are allowed
to mandate them, I think is an issue, you know, in some ways that\'s a,
we\'re talking here about a voluntary certification process. So, and
Kelly, or Michelle, correct me if I\'m wrong on this, so let me just
give you, or Nancy, let me give you a read out. We\'re talking about a
voluntary certification process. We\'re not really saying we\'re going
to mandate any of this. We\'re saying we would suggest these as
important and then, you know, a vendor can choose to follow that to
apply for that certification or not.

**[\>\> Myrl Weinberg:]{.underline}**

I think, though, there\'s a whole other level. And when you look at
certifications that become meaningful in whatever marketplace, then
whatever is in that, even if the certification itself is voluntary, what
is in it to be certified is required. And so, you know, they either have
to buy the whole shebang or none of it to be certified. So if we\'re
talking about certification and whatever winds up at some point being in
there, um, if any entity feels that it is to their benefit or
competitive edge to be certified, then everything in there is required.
So I think we have to be very careful about this. That was the point I
made, is that there might be something that either David can help with
or I can to have some measure of actual readability, whether it\'s
understandable and actionable, that would be important. And that might
be in a voluntary certification process of which, if you\'re going to do
it, all the items are required. I would not put in, as a
requirement, that there be frequently asked questions or that it be
required to be in specific other languages.

**[\>\> Kelly Cronin]{.underline}**:

Yes. Myrl, this is Kelly. I think that\'s a great point. I think it
might be helpful. We have talked internally in the last week about
trying to be clear about what the Workgroup would think would be
essential. So if there\'s some of these attributes that are so important
that they be essential for any privacy policy, then we should probably
indicate that. And that can be more carefully considered when the
subgroup gets into many more of the nuances around these. But I think if
we feel strongly for example, around readability, then that could be
considered to be something essential that should be, you know, down the
road, potentially \--

**[\>\> Myrl Weinberg:]{.underline}**

You know, to me the question here, risk, is not what I\'m personally
comfortable answering. And I don\'t know that I\'m \-- I\'m not really
comfortable now saying what is essential in our minds or not. But
certainly that is a better way for me to approach it. But I would also
say, I feel like, as I do often, that when the other group gets into it
and they've collected information from entities that have been working
on this and what, I feel like I can\'t say unless I knew in general what
others that have spent a whole lot more time working out what is
essential and not, that would I rather react to what they\'ve already
done than kind of make it up as we go along.

**[\>\> Rose Marie Robertson:]{.underline}**

And you raise really good points there. So let me try something out. So
I think the concept of, you know, essential or not essential perhaps is
a better way to think about it than a more finely graded kind of scale.
And perhaps the, you know, I think the other Workgroup is also kind of
sitting there saying, well, gee, we really need to know what the
Consumer Empowerment folks are thinking, you know, we\'ve got data,
they\'ve got data. So I think both groups want there to be a first pass
kind of straw man piece of information that will come to the subgroup.
And I, so I guess this is \-- so filling this out does not, it doesn\'t
really tie the hands of the subgroup to say, okay, one group thought
this was essential. If the subgroup in talking with the people from the
other Workgroups say, you know this, is really, there are reasons why
you might have thought it was essential but let\'s us tell you it can\'t
happen, then they\'ll come back to us. So this is going to be an
iterative process and even something we mark as essential, they might
come back and say, we think this was wrong or we think it should not be
essential. And we\'ll then have the opportunity to react to it again.
Does that make you or others who are thinking about it the same way feel
more comfortable?

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Rose Marie, you did a nice job of summarizing basically what everyone
envisions is going to be the relationship between our working group and
that of the privacy and security. And, Myrl, to your concern that you
would rather be reacting to what the experts have deemed to be most
essential or most appropriate, I think probably all of us on the call
would share your enthusiasm in that regard. I think the purpose of
today, as I understand it, was for the Consumer Empowerment working
group team to be able to look at each of these privacy policy principles
and components and to fundamentally create a memorandum that can go over
to the privacy group that captures some sense of importance from our
group in each of these categories. And Rose Marie to your point, I think
you're completely right when you say we could mark something essential,
which I think, Myrl, the word essential characterizes a lot better what
we\'re trying to do here than defining risk, I think you\'re right, but
I think what we want to do is we may say that something is
essential, they may come back to us and say, well, we\'re not really in
agreement with that. And then the CE working group is going to have to
put their heads around that and say, is it really essential to us, or
based on new information would we move away from that position? I think
for the discussion this afternoon, this column we\'re trying to go
through now is one where we\'re just trying to give some indication to
the privacy group of the level of importance that each of these areas
has for the members of this CE working group.

**[\>\> Myrl Weinberg:]{.underline}**

Okay.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. And taking it, and you know, so risk both to the consumer as a
consumer, but also risk to the adoption of personal health records by
consumers, which is the charge.

**[\>\>]{.underline}**

Yup, that\'s it.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. Let\'s give it a try, and see how we can do with using essential
or non-essential.

**[\>\>]{.underline}**

Can we also include as essential, non-essential but valuable.

**[\>\>]{.underline}**

That\'s good.

**[\>\>]{.underline}**

Because non-essential, you know \--

**[\>\>]{.underline}**

Yes.

**[\>\> Rose Marie Robertson:]{.underline}**

Non-essential but valuable and non-essential.

**[\>\>]{.underline}**

Don\'t, I would assume if it\'s not essential it wouldn\'t be on the
chart, unless we already thought it was valuable. I can\'t think
there\'s anything here that wouldn\'t be valuable. And if we think so,
we should take it off the top.

**[\>\> Rose Marie Robertson:]{.underline}**

Well, and that\'s the reason to do this. If we come up with one we think
is non-valuable we\'ll take it off. And it\'s fine if we don\'t find any
of those.

**[\>\>]{.underline}**

Let\'s dispense with those first. Is there anything that is not valuable
on this list?

**[\>\>]{.underline}**

I think the part where it\'s bundled with the security, do we \--

**[\>\> Rose Marie Robertson:]{.underline}**

Let\'s start on the slides, the first slide. So let\'s do them one page
at a time so we can keep track. So we\'re on that first page where
we\'re talking about the disclosure and accountability and the first
item there, communication between vendor and user. And all of those
issues about contact information, effective date, notification of change
in policy, and opt in to changes and then we had added the, opt, the
patient being able to opt in, or person being able to opt in to their
desired changes. Does that seem \-- I mean, let me just throw out that I
might think all of those were essential.

**[\>\>]{.underline}**

Yup.

**[\>\> Rose Marie Robertson:]{.underline}**

Anyone disagree with that? Okay. And so if we\'re saying essential we
don\'t have to make a value judgment. Then communications have to be
conducted in simple, easily understood language. Here we have three
items, we have readability, is it written in plain
language, understandable, and we\'re again going to take into account
the input of Myrl and David about specifics there. Do we think that\'s
essential?

**[\>\>]{.underline}**

Yes.

**[\>\>]{.underline}**

Definitely.

**[\>\>]{.underline}**

Yes.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. Frequently asked questions?

**[\>\>]{.underline}**

No.

**[\>\> Rose Marie Robertson:]{.underline}**

Do we think that\'s \-- no \-- do we think it\'s essential?

**[\>\>]{.underline}**

No.

**[\>\>]{.underline}**

No.

**[\>\>]{.underline}**

No.

**[\>\> Rose Marie Robertson:]{.underline}**

Do we think it\'s valuable?

**[\>\>]{.underline}**

Sure.

**[\>\>]{.underline}**

Depending on what \--

**[\>\> Rose Marie Robertson:]{.underline}**

Okay, depending what they are. Good ones. Okay. But I guess frequently
asked questions maybe the assumption there is that they are frequently
asked questions. We all make up frequently asked questions at the start.
But the idea is that if people are really asking, then those are the
things you\'re providing answers to.

**[\>\> Davette Murray:]{.underline}**

This is Davette Murray. I guess you would have to get some sort of
trends. I mean, personally, for me, sites that do provide frequently
asked questions, if I'm having an issue at a site, and they have that
section and I can go to it and it's well-formatted. I find that saves me
frustration of trying to call their help desk or something. If it\'s
something that maybe is not intuitive of the site, but if you go to that
section, then you understand it, and then you can do what you need to
do.

**[\>\> Rose Marie Robertson:]{.underline}**

Without having to go make a phone call.

**[\>\> Davette Murray:]{.underline}**

Yes.

**[\>\> Rose Marie Robertson:]{.underline}**

So should we call it non-essential but valuable.

**[\>\>]{.underline}**

I think so.

**[\>\>]{.underline}**

Yup.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. Any opposition to that? Okay. Privacy, should it be available in
another common language? Is this essential?

**[\>\>]{.underline}**

Same as the other, last one, non-essential but valuable in that if
someone alluded earlier, it depends on who your target audience is.

**[\>\> Rose Marie Robertson:]{.underline}**

Right.

**[\>\>]{.underline}**

And I was going to add that for some populations it may be more
mandatory than others. So I think we just have to have that caveat.

**[\>\> Rose Marie Robertson:]{.underline}**

Right. So we would say this is, we have a footnote that depending on
population, and I mean, actually that might also include a lower,
targeting might include a lower literacy level as well, but readability
I think should be footnoted by population as well. Okay. Good. So
non-essential, valuable. Next page. So this is the issue of coverage of
inactive accounts. Do we think that it\'s important that the policy
addresses treatment of accounts whose contract has lapsed?

**[\>\>]{.underline}**

Both these next two issues are essential

**[\>\>]{.underline}**

I agree.

**[\>\> Rose Marie Robertson:]{.underline}**

Essential. Thank you. Then policy issues, then the next one is
collecting user data and we have a number of attributes here. So
cookies? Do we think that\'s essential?

**[\>\>]{.underline}**

If we\'re prioritizing, I think this whole section is less higher
priority for the security, privacy and security workgroup, or the
subgroup, only because it\'s addressed in so many other ways, this is
not unique to personal health records. These are known issues that
there\'s lots of prior art about these kind of things.

**[\>\> Davette Murray:]{.underline}**

This is Davette. Even though it\'s known we as a group should say, by
saying it\'s essential that we think it is key that people understand
they need to trace where their information is in a cookie.

**[\>\>]{.underline}**

Is there a way we can just express it that, I agree, these are all
important. But that this subgroup doesn\'t necessarily need to spend all
of its time working on these, they should work on the other one, first.

**[\>\> Rose Marie Robertson:]{.underline}**

So would we say these are valuable but of secondary importance for this
subgroup?

**[\>\>]{.underline}**

I would agree with that.

**[\>\> Rose Marie Robertson:]{.underline}**

And let\'s just say, let me just ask the question in one other way to
make sure we\'re all, we\'ve captured it all. In terms of if there\'s a
flaw in this, how risky do we think it is, even though we\'re not
thinking about risk too much, how risky do we think this is to consumer
adoption and maintenance of that adoption of personal health records if
there\'s a problem in one of these

**[\>\>]{.underline}**

It depends on how invasive the cookies are.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Totally.

**[\>\>]{.underline}**

Yes.

**[\>\>]{.underline}**

Uh-huh.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

And that can become very essential.

**[\>\> Rose Marie Robertson:]{.underline}**

Do we want to make the cookies part, do we want to have that one be
separate, leave the others as \-- no, I guess, so if we said that these
don\'t have to be dealt with or could be dealt with, we\'re saying these
could be dealt with at a secondary level, so it would mean that, you
know, you could be asked to voluntarily provide information. I guess
there\'s no, I mean, it wouldn\'t be a disaster if you were asked. If a
policy doesn\'t say whether you\'re given an option to opt out about
solicitation, that\'s not so important as whether you actually, whether
the policy says it, it's whether the policy says it as to whether you
actually are getting that option. So whether it\'s stated in the
policy, is maybe not so important as whether it\'s in the policy.

**[\>\>]{.underline}**

I think the most important thing with cookies are these companies that
they\'re pulling down your information and the customer doesn\'t know
it. The people that ask you up front, that\'s okay. But the ones that
are taking your information and you don\'t even know they\'re doing it.

**[\>\> Rose Marie Robertson:]{.underline}**

So cookies and opt out options might be essential, and the others would
be non-essential.

**[\>\>]{.underline}**

Yes.

**[\>\>]{.underline}**

The customer needs to know if they\'re taking any information at all.

**[\>\> Rose Marie Robertson:]{.underline}**

Right. Okay. Good. Go to the next page. Here we are again in information
and access controls, sharing using data with non-healthcare entities.
The attribute here that we're talking about is is there a different
policy for identifiable versus de-identified. Does the policy address
whether or not the user data is shared with multiple different entities
and what kind of data are shared? Essential?

**[\>\> Nancy Davenport-Ennis:]{.underline}**

It\'s very essential from, I think, from the perspective of the
consumers we deal with. I think this is a very key issue and
particularly because there is so much discussion in the United States
about is there genuinely a way to de-identify information so it stays
de-identified.

**[\>\> Rose Marie Robertson:]{.underline}**

Any argument with making this essential?

**[\>\>]{.underline}**

No.

**[\>\>]{.underline}**

No.

**[\>\> Rose Marie Robertson:]{.underline}**

Consent prior to sharing sounds pretty essential.

**[\>\>]{.underline}**

Yup.

**[\>\>]{.underline}**

Yup.

**[\>\> Rose Marie Robertson:]{.underline}**

With the exception of that break the glass part that I like the image of
so well. Okay. Good. So those are essential. Then here again under
disclosure and accountability, communications must be conducted in
simple, easily understood language. Here the category is the definition
of terminology and that means does the policy really tell what personal
health information is? Does it define it and does it define what
de-identified personal health information is?

**[\>\>]{.underline}**

Essential.

**[\>\> Rose Marie Robertson:]{.underline}**

Essential essentially for both, right?

**[\>\>]{.underline}**

Yup.

**[\>\>]{.underline}**

Next slide. So the adherence to published guidelines or codes, this is
whether or not you\'re following the same rules that apply to
HIPAA-covered entities that address adherence to published security and
privacy guidelines, codes, and recommendations and are any of the
following specifically mentioned. Do we think this is essential or
non-essential but valuable?

**[\>\>]{.underline}**

I think the only essential is HIPAA because that was \-- I came back
from an hour absence, so I hope I\'m not \--

**[\>\>]{.underline}**

Good to have you back.

**[\>\>]{.underline}**

In our very, very first principle we said everybody should be treated
with, the same as HIPAAcovered entities. So that part is essential. The
other things I think are not essential. You can take them with input.

**[\>\> Rose Marie Robertson:]{.underline}**

So the others would be valuable but not essential?

**[\>\>]{.underline}**

Yeah.

**[\>\> Rose Marie Robertson:]{.underline}**

Is there agreement with that, we marked part essential and the others
valuable but not essential? Do I hear ayes all around?

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Rose Marie, I can agree with that

**[\>\> Rose Marie Robertson:]{.underline}**

Any nays? Okay then, here we might actually find, see if we can get to
Myrl's is anything not important, I\'m not sure. Is the published
privacy policy bundled with a published security policy. Can someone
explain to me why that was thought to be important?

**[\>\>]{.underline}**

I think it was a finding, I think it was a finding of the survey tool. I
think we should talk about whether it adds benefit by being bundled or
not.

**[\>\>]{.underline}**

I almost would say there isn\'t any benefit. I think it was probably
confusion by people who aren\'t used to dealing with privacy and
security.

**[\>\> Rose Marie Robertson:]{.underline}**

And maybe we think it\'s actually not valuable.

**[\>\>]{.underline}**

No, it\'s confusing.

**[\>\> Rose Marie Robertson:]{.underline}**

Here is one we can take off the list.

**[\>\>]{.underline}**

Oh, good.

**[\>\> Rose Marie Robertson:]{.underline}**

We found one. Okay.

**[\>\>]{.underline}**

Leave it off.

**[\>\> Rose Marie Robertson:]{.underline}**

It\'s on the list. We\'re not, we don\'t think it\'s something they
should be aiming to make happen. Okay. I\'m sorry. Somebody \-- go ahead

**[\>\>]{.underline}**

I was going say with the next one, I\'m not sure the same thing, is long
good or bad?

**[\>\> Rose Marie Robertson:]{.underline}**

Well, David would say, wouldn\'t you David, that long was not so good?

**[\>\> David Lansky:]{.underline}**

Right.

**[\>\> Kelly Cronin:]{.underline}**

To me, it seems like what David talked about before, which probably
should be flushed out in more detail in the concepts of maybe
readability. If there is a short notice is it consistent with what the
EU data protection commissioners or whatever they\'re called, that have
already put forth, and is there a longer version with probably more
legalese available for those who do want to dig into it?

**[\>\> Rose Marie Robertson:]{.underline}**

We might suggest this actually be moved back into the, I guess it\'s not
necessarily readability, because both could, long and short could be
readable, but really efficacy. Maybe this one, maybe this is pretty
important. Do we think that is, I mean, it\'s not just the issue of how
long it is and we want to count the pages, but is ther data that says
length makes a difference. If there\'s data that says it makes a
substantial difference in understanding, then it would be at the very
least, highly valuable and maybe essential.

**[\>\>]{.underline}**

The notice of privacy practices had to be a certain font. Well, I was
going to say I thought it had to be limited to a certain number of
pages, but I think actually that\'s not true.

**[\>\> Rose Marie Robertson:]{.underline}**

What if we said that this was essential for the subgroup to look at?

**[\>\>]{.underline}**

Yeah.

**[\>\>]{.underline}**

Yeah.

**[\>\> Rose Marie Robertson:]{.underline}**

How about that? Okay. I didn\'t hear any no\'s on that one. Okay. And
then does the vendor provide any additional comments regarding features
or functionality? Can we drop this one off?

**[\>\>]{.underline}**

It just speaks to the principle we've already shared that the subgroup
is going to learn a lot from the process, I\'m sure they\'ll find some
things in the process of working through these various options.

**[\>\> Rose Marie Robertson:]{.underline}**

So this is non-essential in our perspective?

**[\>\>]{.underline}**

Yes.

**[\>\>]{.underline}**

Right.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay I think that\'s it for that part. And we did that right on time.
Terrific. And our next \-- that was great. That was terrific work,
everybody, and I really applaud everybody for hanging in there and
continuing to think about the issues.

We have an update, I think this would be very useful for us, an update
on the use case process, Dr. John Loonsk, there will be a release to the
public as soon, of the consumer access to clinical data prototype use
case, and Dr. Loonsk is going to explain the process and what type of
comments would be most helpful from us during the comment period. There
will be both a first comment period and then a second one or a more
detailed use case. So this one gets released for comment, comments come
in, it gets modified. Then there\'s a second comment period. But our
comments in the beginning we think are important. We hope. And
Dr. Loonsk \--

**[\>\> John Loonsk:]{.underline}**

Thanks. And absolutely your comments are important. What I\'m going be
talking about a little bit, to give a little more detail on where things
are and how you can contribute to the next steps of the process. So I
think most of you have had some level of exposure to what these use
cases represent. They\'re a communication tool and a starting point for
a lot of other activities. HITSP certainly looks at them from a
standardization standpoint. The NHIN contractors and the next steps of
the NHIN process will use them as part of their activity. CCHIT uses
them, and a variety of other discussions and, around policy and
considerations and such are spawned at times from them.

We strive to get them to be as detailed as possible. But there\'s a real
challenge here, which is that we\'re talking about high-level
activities. And these, they also strive to be not particularly
descriptive as a single architectural approach or a single approach to
things, but really to enable these types of activities, set up the
questions that need to be addressed, and allow for some of the
subsequent discussions to occur.

So in that context, we have, I think, as most of you know, we did three
use cases last year, consumer empowerment, registration and medication
history, EHR labs, and biosurveillance. We also had one use case that
was advanced sort of mid-cycle from the EHR working group for an
emergency responder EHR and we sort of tried out a new process for how
to get to those use cases where what we did was we had a, two public
comment periods and we got over 400 different comments. We dispositioned
those comments in that process and made that dispositioning available.
And worked from, through a prototype use case to a detailed use case. So
the two public comment periods correspond to these two different steps.
And what\'s going to happen in the next week's time is we\'re going to
be sharing with you all, and others, the prototype use case for these
next three, which are consumer access to clinical information first and
foremost here. Also medication management, and quality. A few more
things about this, in the general context, we\'re striving to try to
coordinate these. So we now have seven AHIC working groups, we have
seven use cases, there\'s, do another round this and it becomes even
more complicated. We\'re trying to have this to they\'re not all
stovepipes.

So the organizing principle here is to look at things that face the
consumer, things that face the provider, and things that face the
population. And try to, we\'re going to be in an on-going way trying to
coordinate these things and to actually, even, go so far as to update
the previous use cases so that they can fit into this more coordinated
structure. Um, overall, we had over 120 different priorities that came
from the working groups in the last round. Thank you very much. And so
what we tried to do was to cluster them and put them into logical
clumpings that could best, so we could do as much as possible and have
that be coherent from a use case perspective. And those were presented
to the AHIC and that\'s how the AHIC came up with its conclusion.

So I\'m going to talk a little bit about the consumer access to clinical
information and just give you a bit of a flavor for what\'s coming in
that regard. And then I\'m going to talk a little bit about the kinds of
comments that are most useful and where we would find it most helpful
for you to contribute. So, we did cluster a bunch of your priorities
into this consumer access to clinical information. It is certainly
worked with some other areas as well. Some of the other working groups
had things that were, touched on this and this area as well. What we
basically came down to was a series of priorities from the working
groups and then some enabling technology priorities that also are
necessary that were identified here that also tend to correspond with
health information exchange and some of the needs of the NHIN and health
exchange activities moving forward. The scope of this clinical access,
consumer access to clinical information is information flows needed to
support consumer\'s access to clinical information and the consumer
capabilities for controlling access to their PHR information. The roles
of the consumer, the provider, and health information exchange in the
processes of consumer access to information, preliminary data exchanges
that support interaction between those entities, the overall information
flows necessary to allow ca onsumer to transfer their health information
between PHRs, so portability of PHR data. And support, and the support
role filled by various health information exchange services and other
entities to support those activities. Those are the broad contours of
the scope of what this is looking like. And that\'s derivative of the
priorities that you largely put forward and went up through the AHIC
process. Breaking that down into how to lay that all out, we have three
high-level scenarios. One is consumer retrieving clinical data, how a
consumer might access information for reviewing and other purposes. It
includes the possibility for s consumer having ability to receive
notification of the ability of new information. Includes capabilities in
the area of their, the consumer\'s ability to annotate information and
request changes to data in this, in that overall exchange process. If
there\'s data coming from external source, that issue of being able to
request changes in that. That\'s scenario one. Consumer retrieves
clinical information, clinical data.

Scenario two is around provider lists and permissions, and this includes
how the consumer could create and/or update and manage provider
permissions allowing provider access to information based on those
permissions. It includes how the provider permissions could be forwarded
to a health information exchange. And that\'s really for several
different purposes. But this concept of exchange of access permissions
is one of the things that we think is a critical component of this
moving forward from an enabling technology standpoint. It includes how
the consumer may retrieve and access logs. So who, and access to their
information, access logs for that. And that\'s all in the broad clump of
provider lists and permissions.

And then the third scenario is transfer of PHR information from one PHR
to another PHR. It includes the consumer identifying, and this is one of
the core technologies as well, is the consumer being able to say, this
is my PHR. I\'m identifying this PHR as my PHR where I want to store my
data. Because it\'s fundamentally a component of that kind of transfer.
And it\'s not presumptive that this exchange will be done in a network
form. Obviously there are times it may be done on a key fob or some sort
of physical transfer device as well. And then in addition to the ability
to move, the portability of data, there\'s the portability of access
permissions that need to be considered in that context as well. So those
are the three high level scenarios where these things are mapping out.
It, you know, basically includes perspectives for the consumers and
perspectives for data providers of information and then some things
around health information exchange and you know, a list of different
stakeholders that are involved therein.

So, um, one of the challenges we face in these is that when we start to
layout the specificity, a lot of \-- either it\'s \-- everyone sees
themselves in it or no one sees themselves in it. We tried earlier to
not be prescriptive to the specific approach and part of the way we do
that is by defining roles. And so these perspectives are really roles.
They\'re roles or perspectives that can be played at times by different
groups or entities. And it\'s important to keep that in mind. We\'re not
trying to define organizations that are doing this. We\'re trying to
define and describe the activities that need to be carried out and to
attempt to define some of these information flow relationships so the
subsequent work can be pursued. It\'s important to consider that as
you\'re making comments, that what we try to do is to, and at times this
is awkward, but we use a term that is a little more general that people
are comfortable with because not infrequently all the language is taken
up with someone who has said that\'s the particular approach or that
represents this other approach. So we try generalize the function and
then in the text of the use case, which is not always apparent, we try
to identify the list of those who could be fulfilling that role. And we
try to make that an inclusive list. That\'s something to look for as
you\'re making your comments. And that\'s really the rationale for doing
that. We\'re trying to make sure that people, we're not precluding
different approaches and we\'re trying to just enable the different
approaches under broad guidance moving forward. So we\'re anticipating
that this prototype use case, this is the next step, is a prototype use
case. They will have information flows, they\'ll have some text
description of that. They\'ll have the roles of the stakeholders. Those
will be, these will be available at the beginning of next week. We will
e-mail them to the members of this, certainly the consumer access to
clinical information, if not all of them, to this working group.

We are planning on having a first comment period that is roughly two
weeks long, maybe eight to ten working days, eight to ten working days
in that, and I know that\'s going to be a challenge. But we\'re, the
whole schedule has been set back a little bit by the time to get these
out, the priorities out of the AHIC, so I can point my finger to someone
else. And then we\'re \--

\[laughter\]

If you're on the phone, you didn\'t see Kelly pointing at me. But we\'ll
just ignore that. And then we\'re going to then create a detailed use
case, which will, and we\'ll also disposition all the comments that were
given in the first round and we\'ll put up the detailed use case, the
dispositioning of the comments will also be available and then we\'re
going to ask for a second round of comments and then we're going to go
to publish, close the process in April.

**[\>\>]{.underline}**

That will be the same, quick turn around, eight to ten working days?

**[\>\> John Loonsk:]{.underline}**

Yes, I think the good part about this is the prototype use cases are
further down the road in terms of the amount of information. We did some
of these with ER EHR use case and the prototype was not as inclusive of
all the information. This is, it\'s not included but there\'s more
information there for to you comment on. I think most of the comments
should be teased out in the first version. And then the second
one, second comment round hopefully we\'re getting into smaller details.

**[\>\>]{.underline}**

Is this going to be disclosed in the *Register* or more like published
on the ONC site and then people on the listserv, that\'s how they find
out about it.

**[\>\> John Loonsk:]{.underline}**

We\'ll publish them on the ONC site and then we're going to blast it out
to, we've developed stakeholder lists that are pretty inclusive and we
blast it out to them and try to tell people to share them. But we don\'t
really have the *Federal Register* time period in here. So that\'s how
it would work.

**[\>\>]{.underline}**

Can I just ask how does this tie in? I assume this gets use by HITSP and
others, and they have maybe a draft statement of work or I\'m not a
HITSP representative. But will they then go back and revise, I know
they\'ve put some priorities out already and how does that \--

**[\>\> John Loonsk:]{.underline}**

They are waiting for this.

**[\>\>]{.underline}**

Okay.

**[\>\> John Loosnk:]{.underline}**

Anxiously waiting for this. And so they want to get started. They think
they can get started on the draft use cases because they are large
scoping, you know, or the prototype use cases, that is. But it\'s part
of their statement of work to accomplish, to work through these. It also
has been part of the NHIN statement of work and CCHIT statement of work
as well. So they\'re all, they all have, they\'re built into those
activities to consider them

**[\>\>]{.underline}**

And then you mentioned that some of the previous ones may have to be
revised. Will that go out for public comment or will those just be
revised?

**[\>\> John Loonsk:]{.underline}**

I think what we're going to try to is to bring these together. Some of
these, what you see when you\'ve done more, we actually named two of the
new use cases extensions of old ones. So quality actually shares a lot
with biosurveillance, because it\'s secondary use, a lot of the same
issues are there. This one, the consumer access to clinical
information, shares a lot with the consumer empowerment one from last
time. I\'m not sure we're going to have those completely reconciled for
these coming out. But what we hope to do is bring these out and point to
some common capabilities. In secondary use there are these issues of how
do they know what information to provide. How do they know the list of
data to filter, to send forward? And that should, this is essentially
the same technology, same capability for biosurveillance or quality. So
what we hope to do is come out with this round and then update those
other ones, mostly to point to a shared, some shared modules. It won\'t
be a major changing of them as much as it is teasing out the common
pieces and making those clear to so they can be used for multiple
purposes.

**[\>\>]{.underline}**

I don\'t mean to dominate. Does this have to go back to AHIC once,
April, or it\'s done or \--

**[\>\> John Loonsk:]{.underline}**

Chances are we\'ll update them on the use case process. But not for,
they\'ve approved these use cases moving forward. What they also did was
essentially when these were approved, was said go ahead, and make the
next round after that. So when these are done, we're going to start to
create the next round. They will, it is not definitive that that next
round will be the next round.

**[\>\>]{.underline}**

Right.

**[\>\> John Loonsk:]{.underline}**

But it\'s a high probability we managed to, you know, fend off the
Secretary from trying to get them to do them all at the same time, all
now. And there\'s probably going to be personalized healthcare use case
added to that sort of next batch to be considered as well.

**[\>\>]{.underline}**

I\'m glad that HITSP is already thinking that they're going to look at
this for a finalized version. One initial reaction to proposed use cases
in thinking about the standards landscape is in contrast to I think the
first personalized or the consumer empowerment use case where we already
had a lot of that stuff done standard-wise. We had to pick what we were
going to harmonize and put in the interoperability specifications. There
are some issues in that, in these scenarios that I don\'t think we have
good standards. There may be more standard gaps than we've had in prior
ones. And I guess the question for you is about the (inaudible) time
cycle if there are significant gaps, things that aren\'t ready to be
harmonized and they haven\'t yet gone through the standards development
process and will we be able to get to a full-fledged interoperability
specification. I'm thinking specifically about sharing of
permissions, how do you, in a standardized fashion, transfer those
elsewhere. I\'m not aware of any good ready-made standards for that.

**[\>\> John Loonsk:]{.underline}**

If I answer this question, now, Ross, do I have to \--

**[\[]{.underline}**laughter\]

It\'s always been part of HITSP's role, defined role, to identify gaps
and to work with the SDOs to try to fill those gaps. I agree with you,
there is more here of that nature than with the last one and that\'s a
valuable part this process. So clearly with the NHIN, next round of
trial implementations of the NHIN, we\'re also going to want to start to
do some of this. And so we\'re going to try to tie that in as much as we
can. And to try to tie them to HITSP as best we can so they don\'t go
off in a dis-coordinated way as they do it. They\'re going to start to
implement some of this from the standpoint of at least trial
limitations.

**[\>\> Rose Marie Robertson:]{.underline}**

Terrific that was very helpful to the Workgroup. And we\'ll be eagerly
awaiting the opportunity to get some input there. Any other questions
for Dr. Loonsk? If not, I think in terms of \--

**[\>\> John Loonsk:]{.underline}**

Thank you.

**[\>\>]{.underline}**

\-- the action items from today\'s meeting, we all worked very hard to
get material for the subgroup, that material will go forward if those of
you who would be interested in serving if you let us know, we
will, again, try to keep that group at a reasonable size, but include
enough people to make it work well. And by our next meeting, which is
May 2nd, Kelly, we should have, at least we\'re hoping to have the
meeting of that first teleconference of that group in April so we should
have at least thoughts back from them.

**[\>\> Kelly Cronin:]{.underline}**

Yes, we should have at the minimum an update. We want to make this a
careful process. So to the extent we need to allow for a longer
timeline, we can certainly do that. We thought a two to three month
period would be ideal if we could advance something in that timeframe.
But you know, I think once the subgroup convenes they\'re going to have
to determine what is feasible. So we\'ll be able to probably report back
with more specificity once they have gotten into their work.

**[\>\> Rose Marie Robertson:]{.underline}**

Very good. And we\'ll, and I\'m sure we\'ll have a discussion at that
next meeting of the use case as well. Shall we open this for public
comment?

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Rose Marie one note before we went to that in the follow up areas we
were also going to ask Stanley Chin to provide us with two separate
conclusions as part of the follow up work from today\'s session.

**[\>\> Rose Marie Robertson:]{.underline}**

Great point. Thank you for including that.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

You\'re welcome.

**[\>\> Ross Martin:]{.underline}**

And Rose Marie while waiting for people to give public comment, I have a
personal announcement to make. So did \--

**[\>\> Judy Sparrow:]{.underline}**

Why don\'t we open the lines for public comment?

**[\>\> Jennifer Macellaro:]{.underline}**

I've just put the slide up. There\'s a number if anyone is listening
over the Web and not dialed in. If you are dialed in press star 1 to
alert the operator, and there's an e-mail address. You can write
comments in after the meeting. So I'll check back with you in a few
minutes.

**[\>\> Rose Marie Robertson:]{.underline}**

Okay. Ross.

**[\>\> Ross Martin:]{.underline}**

Thanks, so today is my last day at this meeting as a Pfizer person. My
last day with Pfizer will be Wednesday the 21st, after 6 years in
informatics there. And I\'ll be starting on the 26th working for Bearing
Point which is a global consultancy. Now the reason I particularly
wanted to make this announcement here is, as it happens, I found this
out kind of in the process of making this decision: Bearing Point has a
contract for staffing or project management for ONC. And so this could
conceivably present a perceived if not actual conflict of interest in
that. And so I asked Kelly and Michelle if it wouldn\'t be, if it
wouldn\'t make sense to have some feedback from the group if they felt
there was any problem was that or concerns that would prevent me from
being able to continue working on the Workgroup, which would I very much
like to do.

**[\>\> Kelly Cronin:]{.underline}**

This is Kelly. One consideration, if you all have do some thoughts
around this, and we do have a conflict of interest policy with AHIC.
Ross will be working in a business unit that is distinctly separate from
the business unit that holds our contract right now. That\'s just FYI.

**[\>\> Ross Martin:]{.underline}**

And the caveat with that is I\'m the life sciences division of, or
business unit, however, part of my job is to work on convergence with
health information technology. And so, in that capacity, I might, in
fact, be working with folks who do have responsibilities with the
contract. So I just, I certainly don\'t plan on changing all my opinions
that I\'ve been sharing for the last year or so because I have a new job
and I hope you won\'t notice, have any perceptible notice about
perspective, but, you know, in the interest of transparency and full
disclosure I wanted to talk about that and get people\'s feedback.

**[\>\> Rose Marie Robertson:]{.underline}**

And clearly we would, you know, we would need to comply with policies
that AHIC has. But we would like to get the groups comments as well.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Rose Marie I would like to begin with a comment here. Ross, I think I
would like to share with the group that I feel through the time that you
have been involved with Consumer Empowerment working group, that much of
the counsel that you have given to us, if not all, is born of personal
experience within your own family dealing with health issues that could
be greatly benefited with a personal health record. And so while you
bring academic excellence to these discussions, you also bring a very
personal perspective from the patient. And that\'s not going to
change, because you have gone to work at Bearing Point. I think, Kelly,
if we can simply affirm that it would not be a conflict to have Ross
remain with the CE working group, even though he is at Bearing
Point, certainly, I, as a co-chair, would welcome his continued and
sustained association with the CE working group.

**[\>\> Ross Martin:]{.underline}**

Thank you, Nancy.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

You\'re welcome.

**[\>\> Rose Marie Robertson:]{.underline}**

Thoughts or comments from other members of the group?

**[\>\> Davette Murray:]{.underline}**

I echo the preceding comments, that f it can be confirmed there\'s no
conflict of interest I think Ross should stay on the group, this is
Davette.

**[\>\> Kelly Cronin:]{.underline}**

Okay, I think that\'s really helpful. I think we\'ll probably need to
just clarify Ross\'s potential future role in any other competitive
procurement processes, since he has not been or will not be involved
with the current contract. I think we need to clarify what the future
role might or might not be.

**[\>\> Ross Martin:]{.underline}**

And I would certainly commit to, if I become aware of any potential, you
know, conflict in that regard, like we\'re going after a contract that
is related to something that I might have any kind of influence on, I
would certainly recuse myself from anything that would be impacted by
that. And at some future point if that became a distinct conflict, even
if that meant would I have to resign, but I don\'t see that being an
issue right now.

**[\>\> Rose Marie Robertson:]{.underline}**

Very good. We\'ll hear back on a final resolution of that, but, Ross, no
question your input to this has been, your input and work ethic with
regard to this work process has been extraordinary and valuable. And I
echo everybody else\'s comments. Do we have public comments?

**[\>\> Jennifer Macellaro:]{.underline}**

I don\'t have anyone dialing in over the phone, no.

**[\>\> Rose Marie Robertson:]{.underline}**

All right. If that\'s the case then I think we are ready to adjourn
unless there are any comments from the group? Hearing none, let me thank
you all for really a terrific, terrific meeting and thanks so much for
taking the time and working so hard.

**[\>\> Nancy Davenport-Ennis:]{.underline}**

Thank you, Rose Marie.

**[\>\>]{.underline}**

Thanks, bye-bye.