American Health Information Community

Confidentiality, Privacy, & Security Workgroup Meeting #3

October 6, 2006

**Disclaimer**

*The views expressed in written conference materials or publications and
by speakers and moderators at DHHS-sponsored conferences do not
necessarily reflect the official policies of the DHHS; nor does mention
of trade names, commercial practices, or organizations imply endorsement
by the U.S. Government.*

**[\>\> Kirk Nahra:]{.underline}**

Good morning, everybody. This is Kirk Nahra, one of the co-chairs. My
other co-chair is unfortunately out sick today and won\'t be able to
join us.

We\'d like to do a quick roll call of the Workgroup people, just to make
sure we\'ve got everybody. Why don\'t we start with those here in the
room. And if you\'re a Workgroup member or a substitute for a Workgroup
member, if you could identify yourself.

Why don\'t we start in the room.

**[\>\> Deven McGraw:]{.underline}**

Sure. Deven McGraw, with the National Partnership for Women and
Families.

**[\>\> Sue McAndrew:]{.underline}**

Sue McAndrew, Office of Civil Rights.

**[\>\> Sam Jenkins:]{.underline}**

Sam Jenkins, Department of Defense, Workgroup member.

**[\>\> Jodi Daniel:]{.underline}**

Jodi Daniel, ONC.

**[\>\>]{.underline}**

On the phone?

**[\>\> Tom Wilder:]{.underline}**

Tom Wilder with America\'s Health Insurance Plans.

**[\>\> Paul Uhrig:]{.underline}**

Paul Uhrig with SureScripts.

**[\>\> Jill Dennis:]{.underline}**

Jill Dennis with AHIMA.

**[\>\> Cindy Tanenbaum:]{.underline}**

Cindy Tanenbaum with MedStar Health, substituting for Peter Basch.

**[\>\> Steve Davis:]{.underline}**

Steve Davis with Oklahoma Department of Mental Health and Substance
Abuse Services.

**[\>\> Dennis Seymour:]{.underline}**

Dennis Seymour with Veterans Health Administration.

**[\>\> Elizabeth Holland:]{.underline}**

Elizabeth Holland, I\'m sitting in for Tony Trenkle at CMS.

**[\>\>]{.underline}**

Anyone else on the phone that hasn\'t identified themselves, Workgroup
member?

**[\>\>]{.underline}**

Okay, thank you. Our goal today is to do a sort of wrap-up and followup
and have some discussion about the hearing that was held I guess a week
ago today, covering two topics of identity proofing and authentication.
Workgroup members received the agenda this morning, along with a sort of
brief summary. We\'re going to try to use some of that and to walk
through some of the information and start some discussion that will help
us begin at least to try and start formulating some recommendations.
I\'m not sure how far we\'ll get on that today but we wanted to do a
good followup on the meeting and get a sense from the folks on the phone
and in the room, topics of interest, topics where you thought we needed
some more information, your conclusions, et cetera.

Before we get into that, however, we also were going to have a little
bit of a substantive presentation that was scheduled for last week, and
we just \-- timing was off last week so we\'ll try to do that this
morning.

Before we turn to that let me quickly see if folks in the room, if
there\'s any other points we want to try and cover before we turn to Mr.
Jones. Anything for Steve, anything?

**[\>\>]{.underline}**

Sure, sorry, I just took a bite of food here.

\[laughter\]

**[\>\>]{.underline}**

I said that before I turned and then I thought oh, that was bad.

**[\>\>]{.underline}**

Must have been a waiter in college.

I unfortunately wasn\'t able to be here last Friday. I apologize. I had
a death in the family. But I heard that the hearing went well, and I got
the debrief from the co-chairs and staff here, and what \-- what I think
would be helpful, and what I\'d really like to encourage is to see
where, in order for us to be able to kind of continue this discussion,
and be a drive toward recommendations, to figure out where there are
areas where the Workgroup feels like there\'s sufficient information for
us to talk about recommendations and approaches, where there are areas
where, yeah, we probably want to have some recommendations here, but we
still need information and what exactly would be helpful so that staff
at HHS, can try to work on getting those people in for the next meeting,
and you know, where there might be areas of conflict that we may need to
spend more time in and the like.

So really kind of do a little bit of a assessment, and try to see where
we can drive toward recommendations and where we need information in
order to go in that direction, and where something \-- if there\'s an
area that we were not going to address because it\'s not the right
timing, whatever.

So we were talking about these, the feedback kind of information would
be helpful and we\'ll talk about specific issues.

**[\>\>]{.underline}**

Anything else before we turn to our first presentation?

Okay. We have on the telephone LeRoy Jones, who is a principal with GSI,
and is I\'m not so great at the acronyms but the HITSP Program Manager
and is going to be giving us some information on some of the standards
panel activities that we hope will inform and give us some additional
background in terms of the issues we\'ve been looking at.

Mr. Jones, are you on the phone?

**[\>\> LeRoy Jones:]{.underline}**

Yes, I am.

**[\>\>]{.underline}**

Okay, the floor is yours.

**[\>\> LeRoy Jones:]{.underline}**

Thank you very much, and I am happy to be able to provide some
information about the HITSP program, as you say. HITSP stands for the
Health Information Technology Standards Panel. And its genesis came from
the Office of the National Coordinator as a part of the effort to bring
about widespread interoperability across the Nation, as I\'m sure all of
you are familiar with. And our panel has the portion of that broader
task that had to do with selecting and endorsing and prescribing the use
of standards with respect to health information technology. And so we
began last September, and have worked through three different context or
use cases and tried to do exactly that. To choose from a field of
standards that were applicable to satisfy the use case and to describe
exactly how those standards might be used.

The three use cases that we had were the electronic \-- had to do with
the electronic health record, the biosurveillance, and with consumer
empowerment. With the electronic health record, the primary task is the
exchange of lab information with electronic health records, and the
biosurveillance use case primarily deals with the transmission of
various kinds of information to public health entities to identify any
kind of epidemiological events, and the consumer empowerment use case
had to do with trying to insert the health care consumer or patient into
the flow of information that is needed for their care. Especially with
respect to electronic health records and pharmacy \-- I mean, medication
information, et cetera.

And so we have \-- when we started down that path to select those
standards and the ideas of ensuring interoperability, there was \--
there were a number of different areas that were germane to
interoperability. One of them being the idea about the kind of
information that it had and the structure of it, et cetera. Another
being the security of that information, and so forth and so on.

So we informally referred to this as our interoperability stat. We found
that to fully satisfy the use cases, we likely would require more time
than was allowed for in our initial phase of the ,so we decided to be
iterative with the selection of standards, and we deferred a number of
different things that were a part of that interoperability stack. And in
subsequent phases. So our concentration over the past year has been
focused on the nature of the information that needs to flow to satisfy
those use cases so that different applications can be interoperable with
one another and then from attendant details, about the way that
information is sent, et cetera.

Specifically, we chose to defer the \-- this topic of security standards
for a number of different reasons. We believe that privacy and security
is very important, and it\'s a topic unto itself in many respects. So we
thought that to ensure that the primary task of meeting the intent of
the use cases, to ensure that they were in fact realized in our first
phase, we needed to narrow our scope to express the nature and the
parameters surrounding the actions of the use cases themselves, and
defer some of the elements that got into the infrastructure or I\'ll say
tertiary kinds of details about the use cases, such as security, that
were more foundational and less specific to the task of use cases. So
that was our primary driver. We also had limited bandwidth being a
volunteer organization supported by a small contract staff.

We also felt that security is a shared concept across the use cases, and
now that each of our technical committees that prepared our
interoperability specifications for each of those use case areas, have
gained knowledge of their use case, and have fought through a lot of the
tough issues with respect to the data that is being transferred among
systems, they\'re better prepared, we believe, to collaborate from
positions of knowledge of their own use cases as we move into this
shared work of security.

Security is complex when \-- with respect to standard selection, because
it\'s really intertwined in many different venues that \-- and it\'s not
always clear where one starts and stops and another begins. There are
issues with law and with policy, and the interpretation of those laws
and policies, acknowledging, and IT capability. And our approach, as we
now turn our attention toward security and privacy by necessity, will be
to identify areas within the security landscape that have enough degrees
of freedom that our standard selection can work with various laws,
policies, and architectures. And so our \-- said another way, we want to
\-- given that we feel the understanding of all the various parameters
and variables that are in the security landscape will take some time to
normalize or at least be understood and compatible with one another, we
would seek to identify standards that can accommodate different
decisions that may be made beyond the scope of HITSP. And so one example
might be there\'s a sort of a classic debate in the privacy realm about
the patient\'s participation in information sharing and whether the
patients need to opt in to such a data sharing paradigm, or opt out of a
data sharing paradigm, or, you know, potentially not have as much of a
say directly at all, but it\'s implied in their receipt of care.

And we do not \-- we as HITSP do not have any particular viewpoint as an
organization, on that topic, but what we would seek to do as a standards
endorsing organization is, for a given context that will be defined by a
use case that is given to us by the American Health Information
Community, we would seek to identify and prescribe the use of standards
that do not preclude any of those different paradigms from being
implemented in an operational sense, but would support the secure use of
that information in a way that is compatible with the primary
operational or business paradigm that is active.

And so that will be our challenge now, as we turn to our \-- our
attention to security is to really look at what each use case needs with
respect to security, and then to identify those areas that have those
degrees of freedom so that we can make statements about them now, versus
other things that we may have to defer until we get information from
other places.

We\'ll need to be careful because the slope is very slippery. For
example, in the area of confidentiality, is it too prescriptive to
prescribe a role-based security paradigm with prototypical roles, or
would we then have to ensure various laws support the concept of the
role that we were prescribing?

And if we\'re more conservative and did not define prototypical roles,
can we say much about the distinctions among them, and enough to
prescribe how those security standards would be used? And so, it\'s very
\-- it\'s a slippery slope and we have to be very careful about how we
define our boundaries. And these are examples that might lend itself to
something we could select, could be drawn from integrity protection of
data in transit. There are plenty of security and encryption, rather,
standards that abound, and there are standard industry practices like
the one-way hash tokens that you could imagine we might prescribe in a
more straightforward manner.

So I think that our primary challenge, as we move forward with privacy
and security, will be to really clearly define where we stop and start,
what things we defer for further information, and what things we are
able to make statements on. We\'re not afraid to select among some
competing ideas, however, we don\'t want those competing ideas to
overstate \-- or rather overstep our boundaries, and preclude certain
architecture, laws, and policies.

Privacy, especially in the consumer empowerment use case, adds many
complications. This is a very nascent area when it comes to its
application or its manifestation in technology. The personal health
record, while there may be many companies that have built an application
with that moniker, does not really have a standard definition of what
does that really mean. And the use of a personal health record in the
delivery of care is very nascent indeed.

And so while we need to make statements about the personal health record
in our consumer empowerment use case, it\'s very unclear even about the
role of the user of the personal health record, i.e., the patient in a
delivery of care with respect to control of their own data. And so we
have to tread lightly and really examine the need of the use cases as we
go forward.

And so in general, our approach toward doing this is going to be a
reexamination of the requirements that each use case has laid out, the
selection of those areas that we think we can make progress on, and then
an augmentation or potentially the development of new interoperability
specifications which are our ultimate deliverable that includes the
selection of the standard, the context in which it\'s used and the
instruction for its use, detailed instructions for its use.

And so we plan to take up that immediately. We have an October 20
deliverable to finish out some of the amendments to our finalized
interoperability specifications from the previous year, and immediately
following that we will take some time over the ensuing weeks to get
organized for our next year\'s effort, as well as to hear from American
Health Information Community about their charge to us. And once we have
our team organized, we will then have a plan to march forward, and it\'s
been a unanimous sentiment among the panel that one of the first items,
if not the first item, that we need to take up is this idea of privacy
and security as they relate to our previous use cases, and we also have
been having discussions and just recently as this week had a board
meeting to discuss how this panel can have a more \-- rather a broader
view of security and other kinds of foundational issues, and so in
parallel with our work that we intend to do with respect to the existing
use cases, we will be setting up a committee that will be able to
examine the implications of privacy and security across all of the
interoperability specs that we produce, as well as trying to infuse
those ideas into the standard development organizations that make up our
board and our partners in this activity of standards.

So that essentially summarizes our immediate intent for moving forward
in particular with privacy and security, and some explanation of our
posture toward it over the past year, and I would certainly be happy to
entertain any questions you might have.

**[\>\>]{.underline}**

Thank you very much for that, Mr. Jones. Is there any questions either
from people in the room on the Workgroup, or people on the phone? Anyone
on the phone with a question?

**[\>\> Steve Davis:]{.underline}**

This is Steve Davis. I\'m just wondering how the operations of the HITSP
and our Workgroup are going to interweave or not overlap.

**[\>\> LeRoy Jones:]{.underline}**

I would say a couple of things there. One, we are \-- we, HITSP, that
is, are very much in what I would call a formative stage. We\'ve been
operational for one year, we\'ve had deliverables that were due at the
end of that year and so \-- but we were starting from ground zero and
had to build processes in place while we were using them to harmonize
standards. And so a number of things that we\'re faced with this year,
having been very focused on the task at hand last year, this year a
number of our activities are really focused on develop the relationships
and external alliances that make sense for us to move forward smartly.

We do not develop standards, we do not have the infrastructure to take
on a lot of the more substantive issues. We really want to leverage
things that other people are doing, and we try to do that in the case of
the FPOs and now, as we move into a new phase, for example as we need to
test our interoperability specifications, it\'s clear that we\'re going
to have to further make strategic alliances with others who are like
minded and can support our mission.

So I would say while I don\'t think that there has been any explicit
plan to date about how we might work with this committee, we certainly
are open to those discussions and I personally welcome anyone who would
like to dialogue about it. I think that it\'s not too late to educate
one another about what we\'re trying to do and to figure out the best
way forward.

**[\>\> Jodi Daniel:]{.underline}**

Lee, this is Jodi Daniel. Could you talk a little bit more about the
committee that you mentioned, the privacy and security across the use
cases, and who \-- how you\'re planning to form that. Is that really
from a standards perspective? Are you trying to look at the policy
issues? Can you explain a little bit more about your expectations for
that group?

**[\>\> LeRoy Jones:]{.underline}**

Sure. We have in the course of our work last year, one of our \-- one of
our committees identified and published a short white paper that really
got toward a \-- what we call \[indiscernible\] foundational issues that
have to do with standards harmonization, and in general, what the
premise was, how can we as HITSP be proactive about standards
harmonization instead of being reactive. In other words, what we have
done over the past year has taken what people have already done and
tried to integrate things in a way that is useful and impose constraints
in that sort of thing. but what we like to do ultimately is given thay
we have all of the standards, development organizations, at the table
and they are part of our board and you know, integral part of what we
do, we would rather \-- we\'d like to say how can we influence all of
those different organizations so that the things that they do on their
own are going to be naturally compatible. Can we be the fore where they
come together to agree to standardizing their approach toward their own
work? And in thinking about that, we overlay the idea that we have been
concerned with, with respect to standard harmonization and security was
one of those areas.

And so we\'re trying to represent that larger idea about how we are more
proactive about ensuring compatibility going forward, and a subset of
those issues that would be involved in that would have to do with
security.

But I will say, you know, our thinking about that in specifically in any
of the subareas that we have been \-- that have been named by that
committee, has been limited because when we presented the paper to the
board of HITSP, it was deferred until after we finished our
interoperability spec, so we\'re just picking that back up and the
action item was for the committee to now take that paper to apply the
lessons that we learned over the last year to prioritize those different
areas that we want to work in, and to come back to the board and then
ultimately the panel with a recommendation on which of these different
areas we should attack most urgently and what specifically we would be
aiming to do.

So the committee doesn\'t exist and it\'s really being thought through,
but I think the direction we want to go in is along the lines of that
larger idea that I expressed.

**[\>\>]{.underline}**

And Steve, just a followup to your question, I think that\'s something
we\'ll want to continue to keep an eye on and we\'re obviously trying
with this committee to gather information from folks doing somewhat
similar things. So your point is something we may want to just keep
revisiting as we move forward.

Alison?

**[\>\> Alison Rein:]{.underline}**

Hi, Lee. This is Alison Rein. I was on the board call and I wanted to
address a couple of points. One is although the Consumer Empowerment
group especially has been tied up trying to weave through all of this
privacy policy issues as well, they realize \-- the focus of this
foundational group is really security. And the other component to that
is just the process by which we\'ll be identifying folks, and I think
that the decision on the board call was we would be sending out a
message to the HITSP panel, alerting them to the fact that we\'re going
to be creating this Workgroup and soliciting interest essentially, and
then going through a vetting process to figure out who among those
volunteers would be most qualified to serve on this sort of small
overarching \-- so it hasn\'t been posed yet, and I think their mission
is largely going to be on these three angles and not the privacy policy.

**[\>\> LeRoy Jones:]{.underline}**

Yeah, I think that\'s a good clarification. And you\'re right, that we
don\'t intend to take up policy issues at all. We don\'t think that\'s
within our scope. But the expression of those various policies with
respect to privacy and maybe other things, in the technology and in this
case you know, we think it maps into security domain, would be the area
that we would seek to select standards for. And you\'re also right that
the committee is informed that we have to write the terms of reference
to define exactly what it will do and solicit membership from the panel.

**[\>\>]{.underline}**

Are there other questions from the Workgroup members for Lee at this
point? Thank you for joining us, we appreciate your help and your
cooperation and I know we have some scheduling issues last week, so I\'m
glad you could make it today and appreciate the information.

**[\>\> LeRoy Jones:]{.underline}**

Thanks for the time, and I\'m sorry to the extent that I contribute \--
last week, if you need any further information from us, feel free to
approach us again and we\'ll be back.

**[\>\>]{.underline}**

Okay, thank you very much for that.

**[\>\>]{.underline}**

All right, take care.

**[\>\>]{.underline}**

At this point why don\'t we turn to start our discussion of last week\'s
hearing. We\'re going to spend I think the majority of our time working
through the summary that Steve has prepared. But before we get to, that
let me just start with an open-ended question for the members of the
Workgroup. And to get your thoughts, I\'m not going to go around the
room and call on everybody, but to get your thoughts on generally how
the hearing went, was it useful, testimony productive? Was it the right
length, was it too long? Was it a good format? Any reactions that you
had to the hearing in general.

I mean, I\'ll just start off. I found most of the testimony interesting,
useful, I had a little bit of trouble targeting the testimony to the
particular use cases in some instances, and I think that\'s going to be
a big issue for us. I mean, we had talked about, for example, secure
messaging is one of the topics, and I heard lots of discussions about
privacy and security, in and various issues that didn\'t seem to focus
on that topic. And we have to decide if or how we want to focus on that
topic. But it gave me a lot of new information I have not seen and when
we get to some of the recommendations, there were a couple of topics
where it seemed to me that the information was consistent and useful and
maybe able to push us towards a couple of recommendations.

Let me open it up at this point, and again comments on the hearing
generally, both substantively and process issues. Why don\'t we start in
the room. Is anyone in the room that has any comments on that?

**[\>\>]{.underline}**

I agree that I thought it was helpful to hear from folks, and would have
liked a little more focus on the actual cases. But even though we had a
lot \-- allotted time for questions, you know, it was a week ago, and a
lot of the discussion would have been really nice to have immediately
after with the people there. So in terms of format, I don\'t know if
there\'s any way to do it in the future where we have sort of the
presentation and question period, but if it could be more of a lengthy
or discussion where we get to probe a bill because someone asked a
question that goes down a certain track, we could take all our
discussion time on that track and it may be relevant and may not be, but
there\'s an opportunity cost there.

That was sort of my takeaway. There were questions that I wanted to ask
the panel members after but I was the only one privy to the answer.

**[\>\>]{.underline}**

That\'s a good point. We had identified time for questions and
discussions and we filled it with questions. Which is fine, I think that
at a time way to do it differently, if we want to do it differently in
the future is probably to cut a panel out. You know, we had \-- I don\'t
know that we would have wanted to add another hour or two to that day,
that would have been a particularly long day. So it may be that we
should concentrate on having two panels in the future rather than three,
and try to in fact have some time. It was funny when we were with the
first panel, we turned to the question period and I guess this is not
too unusual, but it took a while for questions to get going. I thought
we were going to have no questions, and then all of a sudden everything
got going and we certainly had a lot of questions of each panel.

**[\>\>]{.underline}**

Coffee kicked in.

\[laughter\]

**[\>\>]{.underline}**

Other comments from anybody in the room at this point? Comments from
anybody on the phone about the hearing last week?

**[\>\> Tom Wilder:]{.underline}**

This is Tom Wilder. I\'ll start off. I thought you highlighted one of
the issues which is that the kinds of privacy and security things we
need to be looking at are really common across the breakthrough areas.
So I think in one respect kind of breaking the testimony out by
breakthrough area wasn\'t very productive. I thought the witnesses did
highlight a number of the issues that they\'re struggling with. I was a
little disappointed that we didn\'t get more kind of feedback on some
specific actions that they felt that AHIC should take in order to
address these concerns and maybe it\'s because they and their, you know,
business operations are actually taking care of these problems and
there\'s no need for AHIC to do anything. But I thought it was some very
good background on how they are handling these concerns, what are some
of the things that they\'re having to look at. I thought it was a little
less useful in terms of the actual end product that we, as a Workgroup,
need to come up with.

**[\>\> Kirk Nahra:]{.underline}**

Any other comments from anyone on the phone? Last chance for people in
the room. We have a number of people both on the phone and in the room
who weren\'t at the hearing last week, so that may explain some of that.

Okay, well, as people are \-- you know, as we\'re going through the
hearing today and going through the substance of testimony and as you
think about this going forward, if you do have comments about, again,
format or really any of those issues, please don\'t hesitate to shoot me
an e-mail or Paul Feldman, or any of the staff. We\'d be happy to field
all that stuff and make improvements as we move on to the next hearing,
or hearings in the future.

With that, why don\'t we turn to the summary that was distributed, I
guess it went out, what, late yesterday? People should have that. I hope
that you\'ve at least had a chance to glance through it. If not get
through all of the detail on it. I am at this point going to turn the
microphone over to Steve who put \-- sort of laboring on putting this
together. Along with some of the other folks here at the office. And
let\'s see, sort \-- let Steve walk through what he\'s done on this
document and some of the key topics of it.

**[\>\> Steve Posnack:]{.underline}**

Thanks, Kirk. So as you can see here, we kind of had a \-- I put
together this broad commentary part at the top, and this is an effort
just to give everyone a working list of the kind of buzzwords that we
heard at the hearing, so that everyone knows the general idea of the
main topics that people discussed and the issues that were brought up.

And then going into this, the specific testimony commentary section,
this is a highlighted chart of issues, the approaches, and the options
in those issues, and the pros and cons of the different approaches that
are available.

So starting first, you know, we heard about identity proofing, and I
mean identity proofing techniques, which basically there were two
approaches that we heard. One was in person, one was kind of an online,
and that took many forms that were \-- that was identified to the
Workgroup.

Next is the \-- the next issue is identity proofing governance. This is
basically where you go to get identity proofed and how the data is held.
So the two approaches is centralized. So you go to one location to do
the identity proofing. The scalability of that or a decentralized model.
The VA, for example, that anyone can go and get identity proofed at any
of their major VA facilities.

The next gets to identity management and user authentication. This has
to do with the system usage and interaction that the patient, the
physician, anybody that is interacting with the system has to deal with.
And we heard a lot of approaches, mainly the bubbling up one is was the
federated model. I think for our purposes it will be the federated model
and other things. This is a large section of pros and cons that we can
talk about as well. And I don\'t know if that\'s going to be a mature
enough discussion for us to make a recommendation on, but it\'s
something for the Workgroup to consider. Because that is kind of an
architecture issue and it has a lot of ramifications.

The next issue that we heard for a lot of the \-- of testifiers, one
needs to consider performing risk assessment. And trying to apply that
to the work that we need to use to go forward, it\'s about identifying a
perceived risk for the data that\'s being held, evaluating the
circumstances that each of the services that are going to be offered,
you know, through a Nationwide Health Information Network, or at
different levels, regional or local.

The next issue is government involvement, the next issue is government
involvement so the one of the questions was to ask what HHS could, do
ask them other types of regulation or statutory information that they\'d
like to see. So we\'ve got a few approaches there. Federal regulations,
State regulation, industry self-regulation, you know, there\'s always
different available approaches to go through.

But next to last issue we have here is implementation, and this is kind
of a broad category and what we heard here in terms of options is there
are new systems that could be developed and there\'s pros and cons so
you can start fresh and with a clean slate and analyze as it stands or
we can use the wealth of information that we have out there that\'s
available and the systems that we have that are currently being used and
modify them and adapt them to meet our confidentiality, privacy, and
security needs. So I would say we probably heard more of the testifiers.

And lastly, another larger overarching topic in terms of common process
development and that gets at standards that need to be developed and
criteria that possibly could be recommended for identity proofing and
user authentication. And that will encompass \-- run the gamut on
tokens, different types of certification criteria, is a possibility. And
things to aid in consistency.

That\'s a quick rundown. And like I said, this tool is created so that
everyone can use it as a reference while the discussion is going on, and
if there\'s a particular issue or approach that isn\'t represented here,
feel free to definitely bring it up. But hopefully this represents most
of what we heard last Friday.

**[\>\> Jodi Daniel:]{.underline}**

Thanks, Steve. This is Jodi Daniel. I just, what I would recommend we
do, unless anybody has a better suggestion is to walk through issue by
issue and have a discussion about what people heard, or did we capture
everything. Are there areas where there seems to be a clear approach and
we think we might be able to think about the recommendations or is there
more information or topic or the like.

I think before we do that, it would be helpful just to ask if anybody
thinks there\'s something that wasn\'t an issue \-- an issue that
wasn\'t captured on here that should be on the list from the hearing on
Friday.

**[\>\>]{.underline}**

The only thing missing seems to be segmenting each of these issues, in
terms of the population that you\'re talking about. Thing came up as
part of the hearing do we wind up in the same place as we\'re talking
about patients. If we\'re talking about the users of the system and even
a third group, if we\'re talking about strangers to the system, trying
to come in and access information in the system. And for each of the
three groups, there may be more subsets of that people can think of. Do
we, is that a separate area or do we overlay each of these topics with
each of the topics with the cross-cut issues.

**[\>\>]{.underline}**

To supplement that we may have different ways to slice it. Are we
talking about EHRs, PHRs? So secure messaging, something different from
that. So I think all \-- those questions and I think somebody used the
word overarching. Some of those questions will be applied to each one of
these topics. And I don\'t know that there\'s any particular, I mean
consistency is a wonderful thing, but I\'m not sure we\'re going to have
a consistent approach to that. There may be things where we say, oh,
we\'re going to treat EHRs and PHRs exactly the same. Maybe other areas
they\'re not. And we may start off with identity proofing on this where
there\'s going to be some kinds of issues that make sense for patients
and may make much less sense for health care providers, for example. But
that\'s definitely a variable we\'ll need to be thinking about.

**[\>\>]{.underline}**

Other thoughts on additional topics or ways that we should be thinking
about these before we get start on the individual issues?

**[\>\>]{.underline}**

I just have a quick clarification question. The option issues and
implication section, are those \-- have you clearly just bulleted the
ones that we actually heard about, or are there \-- because I can \--
you know, as I was reading through some of these, there may be other
pros and cons that aren\'t enumerated and I didn\'t know if we were
trying to flesh those out in this discussion even though we didn\'t
necessarily hear about them in the testimony, or \--

**[\>\> Steve Posnack:]{.underline}**

Yeah, I mean so for the most part \-- this is Steve. For the most part,
all these kind of pros and cons are what we polled from people\'s oral
testimony and written testimony, and that\'s \-- what is here is the
facts, basically. But it\'s open, if you have your own experiences you
have pros and cons that relate to these issues, definitely bring them
up.

**[\>\>]{.underline}**

I think as we discussed the specific issue, we should have a richer
discussion than just what we heard from the testifiers. If there are
other options, pros and cons, you know, this is sort of a central
approach of you can do A, or B, there might be an A. with a little bit
of B, and this other part of C. in there. So we can \-- I don\'t think
\-- wasn\'t meant to be \-- it was meant to be a starting point based on
trying to give us some \--

**[\>\>]{.underline}**

Summary of the testimony rather than summary of the issues.

**[\>\>]{.underline}**

Right, yeah, I mean this is mostly to be a CliffsNotes version of last
Friday so you didn\'t have to reach back in your brain to identify all
the issues.

**[\>\>]{.underline}**

And to add to that a little bit. It seems we\'re not only talking about
pros and cons but more when we\'re talking about additional issues or
additional \-- are things that were not covered. If there were points of
the issues that we need to hear before we can make a recommendation,
that we didn\'t hear about them, some of them are things that we can
sort of figure out ourselves, some maybe we need to figure out at the
next hearing to testify about X, whatever that is. I think that\'s very
much \-- you know, we obviously are under some \-- short-term pressure
to try to have recommendations. I think we should do what we can to
achieve that. At some level. We\'re not going \-- I was not finished on
all these topics, but I think \-- if the answer is we really have
nothing at this point that we can come to an agreement on, but we could
with a couple more witnesses, let\'s think about that. But I think
fleshing these out and trying to, particularly with some of the
variables Sue mentioned, trying to focus narrow recommendations that we
can move forward with, would be real helpful but again, I think we
heard, I mean we may have heard a panel too many last week, but we only
heard from a handful of people on very complicated issues.

**[\>\> Maya Bernstein:]{.underline}**

What is the \-- this is Maya Bernstein. What is the driver for,
flaunting my ignorance, but the short-term pressure that we have?

**[\>\>]{.underline}**

The American Health Community is looking \-- and the different
Workgroups that have charged the American Health Information Group in
forming this Workgroup are looking for recommendations on these issues
as they relate to the breakthroughs because we\'re starting to work on
those breakthrough activities and are looking for some input from the
group. So it\'s an expectation that we\'re getting from the AHIC \--

**[\>\>]{.underline}**

But this is only one topic of many that we\'re doing, so I mean are you
saying that any issue we take up we\'re going to be under pressure to
make immediate recommendations? Because there\'s also issues we could
have taken up first, it just so happened we took this one up first.

**[\>\>]{.underline}**

Yeah, it\'s a pressure to start getting some information and some
recommendations that can be implemented. I think we have a lot of leeway
as to \-- obviously we can\'t get through 20 issues in the short period
of time. I think that we have some leeway for what issues to take on,
where to go next and that sort of thing. But the pressure is coming from
the American Health Information Community and Judy, feel free to jump in
here \-- to have \--

**[\>\>]{.underline}**

Yeah \--

**[\>\>]{.underline}**

This Workgroup being able to start turning around some recommendations
that the other Workgroups \-- that feed what the other Workgroups are
doing and that can help with breakthrough pilots and activities that are
starting to take shape.

**[\>\>]{.underline}**

And also it seems this issue doesn\'t relate to any of the other issues
we might take up. Which is probably not correct.

**[\>\>]{.underline}**

Well, which is why we should, you know \-- we should work to see if
there are things we can make recommendations on. If it the answer is we
just can\'t come up with anything that\'s a possible outcome at the end
of the day, it\'s one of the reasons frankly, I think we started with
this topic. I mean this is a topic that while complicated and raising a
lot of issues, was viewed as somewhat more discrete than some of the
other topics we could have started with. So again, I\'m not sure where
we\'re going to end up, and we don\'t have to make decisions today, if
what we come up \-- for example, I\'m going to throw one out for
discussion when we get going. Identity proofing I heard a fairly
consistent set of recommendations about patient identity proofing in
person. I think there was one witness who had a little different view on
that. But, you know, everyone seemed to say these are people in the
facilities, they\'re there for treatment, we can get them in person,
in-person is a maybe a better way to do it, a little more certainty. At
this point when we\'re looking to build trust in the system, we don\'t
quite have to worry about the volume issues. Could I see us making a
recommendation in that regard. I\'m not sure we\'ll get there, but
that\'s something we could be narrow enough that we could go forward or
we say we really need \-- we want to have a witness next week really
talk about the scalability of that whether that\'s going to be a
problem.

**[\>\>]{.underline}**

I think it\'s also possible, you know, when we\'re talking about
recommendations, I mean, this can be somewhat nuanced and they also
don\'t have to be if in fact there is still some confusion or we think
this is the right answer, but we need more information on X, or we\'d
like this HITSP group to come back and give us some more, to look at
this issue. Those could be recommendations, too. So where we don\'t have
an answer because there\'s something missing or we need input from
somewhere else that is either within HHS\'s control or some other
Federal player\'s control, that could be recommendation to the AHIC as
well. So I think \--

**[\>\>]{.underline}**

Yeah, I just didn\'t understand \-- you\'re looking at a series of
recommendations as soon as you can get them out rather than one six
months from now, something. Okay.

**[\>\>]{.underline}**

Again, any other just big picture issues that we\'re missing, anything
like that that we should put on that list?

**[\>\>]{.underline}**

Is there anyone that we wanted to hear from that you think was not
represented, Steve, that we couldn\'t get, or is there some constituency
that you think wasn\'t \--

**[\>\>]{.underline}**

I\'ll have to look back at the list of potential people that we made \--

**[\>\>]{.underline}**

Obviously we couldn\'t fit everybody in one day that we might have
wanted to hear from.

**[\>\>]{.underline}**

Are there \-- is anybody in the Workgroup having any \-- are there folks
that or position that is people thought were not represented I mean by
stakeholder category, not by \--

**[\>\>]{.underline}**

Yes, that\'s what I mean.

**[\>\>]{.underline}**

One of the things that I thought about, I mean we heard some testimony
about the financial services industry, I mean sort of a vendor
perspective on that. And you know, that strikes me as an area, I mean it
may go, depend on what I said a minute ago about in-person identity
proofing. But that\'s a sector that often, one has a lot of volume right
now, it\'s further along than where the healthcare sector is on
electronics, and you know, has different kinds of privacy issues than we
see in the healthcare industry. But you know, they seem to be doing \--
I\'d be interested in hearing some more about their experience with
problems and where that \-- how often \-- they\'ve used almost entirely
at least in my experience for the online pieces, is almost entirely
online identity proofing. Although maybe they\'re piggybacking on
what\'s already happening. I guess you have to show up at some point. I
don\'t know if that\'s true.

**[\>\>]{.underline}**

Open a new bank account without signing something?

**[\>\>]{.underline}**

Yeah, online bank that\'s not \--

**[\>\>]{.underline}**

I\'m not sure \-- that strikes me as an industry that we could learn
from. I\'m not sure even if their experience is perfect, that would
change my current mind about patients are going to be in \-- you don\'t
tend to have patients at this point who aren\'t actually being treated
by somebody.

**[\>\>]{.underline}**

There are issues of telemedicine.

**[\>\>]{.underline}**

But they got to start somewhere. Your first treatment isn\'t
telemedicine. Or is that not the case? Do you have people whose first
experience with a provider is through \-- I guess \--

**[\>\>]{.underline}**

I think the issue there is that your first experience could be in the
ER, when you\'re not really in a place where you could be authenticated
in a way that we would like to, and you might be otherwise living in a
remote area, the VA deals \-- there\'s one VA in Montana, you know, what
are they going to do with all the people up there. So you might have
different issues in a rural area, or you might have different issues if
the first contact is not a time when you can do authentication and you
need to know who that patient is.

**[\>\>]{.underline}**

Can we separate, though, identity proofing and authentication, that\'s
critical because identity proofing, the rationale I heard from the
financial services guy was that you know, we don\'t really care if the
person isn\'t actually who they say they are. So long as it\'s a person
who is putting money in the bank, same one taking it out. Which is very
different from wanting to make sure that the person you are is the
person \--

**[\>\>]{.underline}**

Actually, the point that Pam Dixon was trying to make is the financial
services model is actually not a good model for the medical industry
because of that issue.

**[\>\>]{.underline}**

For identity proofing, and the potential for then commingling of data
which is potentially really serious \--

**[\>\>]{.underline}**

I think the consequences of having a financial loss is different than
having a medical loss.

**[\>\> Tom Wilder:]{.underline}**

Yeah, this is Tom Wilder. I guess the one thing I would add. I think we
need to be really careful as we talk about all of these issues to
presume we know what solution or fix will work in all cases for all
people. I heard a lot of discussion from the witnesses about
scalability, about keeping in mind the way their particular operations
work. I heard a lot of discussion about how the end user, whether
that\'s a patient or provider, may be different. I think in many cases,
in-person identity proofing is very useful, very needed. You\'ve got
patients, for example, who have relationships with their family
physician, so that\'s one way to handle it. But I think in a lot of
these issues it\'s probably more important for us to say you need to
have a process in place to identity proof. That process in many cases
could be in person here are some things that you know, are a good part
of an identity proofing process. Here are some ways that you may want to
handle assuring that that in fact is the individual who you\'re trying
to get set up with the system. But I want to caution that we not say,
aha, we have the magic solution that\'s going to work for everybody in
all cases.

**[\>\>]{.underline}**

Can I ask a followup question, from the ONC, and AHIC perspective, would
that level of recommendation be sufficient in because it seems to me
that the problem is that a number of groups have come up with that level
of recommendation, and you know, that we\'re chartered to do something a
little more that may not address the need for everybody, because that\'s
impossible. But that it satisfies the 80/20 or 90/10 rule. So is that
\--

**[\>\> Jodi Daniel:]{.underline}**

This is Jodi Daniel I would agree with that statement. I think we should
try to get more concrete recommendations. It may be this is the best
practice and not what has to be in all cases. I don\'t know that the
recommendation has to be absolute, you must identity proof all the time
with the same recommendation. But it might be that this is the
preference and wherever possible, do you this. And we could come up with
recommendations that at least from \-- that leave room or say that if
you have these factors, you should do it in person. Whatever it is. But
I think we should be trying to draw up more specificity even if there is
room for scalability or for folks to take a slightly different approach.
If the situation warrants.

**[\>\>]{.underline}**

And again, I think we can get pretty close on a lot of these
recommendations and have specificity. This probably is a horrible
example, but we all recall recently Medicaid went through this process
where they wanted people to prove citizenship and they had all these
rules about how you went about it. And then they found out, well,
there\'s people who don\'t have driver\'s licenses, and there are people
who are \-- they\'re chronically ill and can\'t get into an office to
prove who they are. So I think there\'s ways to do it. I think we can
fin he is it. I think we need to be careful that we not have any
absolutes.

**[\>\>]{.underline}**

Well, and Tom, that may be what I was saying about minute ago. We
shouldn\'t \-- we shouldn\'t favor speed over usefulness of the
recommendations. And you know, something quick is more likely to be less
precise. And so we do have to be a little careful about that. And I
think we\'re trying to find a reasonable balance. One of the other
things you said was something that I guess I hadn\'t really focused on
and it may connect up with something else. We have tried to think of
identity proofing and authentication separately, and I think they are
certainly at least in theory different concepts, but one of the things
that there\'s a lot of discussion about and Steve mentioned it with the
federated concept was really how does one group of people rely on
somebody else\'s identity proofing, and we talked about that in the
provider context, but I suppose that comes up in the patient context as
well. And at that point the line between identity proofing and
authentication blurs a little bit. I mean, if you\'ve gone in and been
identity proofed with someone once the right time, what\'s the next
person supposed to do? I understand if you have gone to a hospital and
you\'ve set up the equivalent or you\'ve gone to a bank and set up the
equivalent of a bank with that account, it\'s easy to go back each time
to that bank and prove who you are, but if you go to the next bank,
they\'re not going to rely on what the first bank did. So we\'ve got to
try to make that correlation again. I\'m not sure how we draw the line,
some of those examples, between authentication and identity proofing.

**[\>\> Elizabeth Holland:]{.underline}**

This is Elizabeth from CMS. A lot of it has to do with trust, and it\'s
one of the issues that we are very interested in, because of the size of
our communities, when we talk about trying to have PHRs for 42 million
beneficiaries, there\'s no way we\'re going to be able to do in-person
proofing. We\'ll have to do where we rely on bank credentials or
something like that. I think everything\'s going tooling to go toward
third party credentials and people trusting the proofing that\'s gone on
to say, okay, here\'s your credentialed firm fidelity and we will accept
it in Medicare.

**[\>\>]{.underline}**

Companies are going to the business of providing a service and they\'ll
have little outposts or something, and we\'ll hire, you know \-- or
something.

**[\>\>]{.underline}**

Well, but okay, that\'s a fair point. Maybe that goes to the next
hearing, which is I didn\'t hear much of the testimony that covered that
viewpoint. And basically said we can\'t do this in person. I heard
issues about scalability, and there were some questions raised about
scalability. But I didn\'t hear anyone taking the position particularly
that in-person won\'t work. For a large population.

**[\>\>]{.underline}**

No, but I think the lab came pretty close. They don\'t have necessarily
\-- they get a lot of their testing from the doctor. They don\'t deal
directly with the patient. And so they don\'t have this in-person
treatment relationship with their clientele.

**[\>\>]{.underline}**

Yes, that\'s a fair point, and maybe again another \--

**[\>\>]{.underline}**

They\'re also not \-- HIPAA deals with them not a direct treatment
provider. I\'m not sure that they need \-- they may need to have no
identity proofing. That may be entirely a new authentication.

**[\>\>]{.underline}**

Well, I apologize because I wasn\'t at the hearing but was there a
difference that talks about online versus in-person? If they were
talking like secure messaging with a doctor where you have a treatment
relationship versus a PHR, where anybody could get a PHR, it could be
through a provider or planner or just an independent PHR. Were there
differences based on the type of \-- based on like the type of \-- it
seems this one might break out differently depending upon the context.

**[\>\>]{.underline}**

Well, there was a lot \-- and I heard only a part of the hearing but
there was talk about the treatment relationship in particular where you
function as eventually you\'ll show up with your body. And then but the
other kinds of examples, pharmacy labs, PHR \-- you know, insurer,
whatever, where you don\'t necessarily meet somebody in person, would be
\-- would be different, I think.

**[\>\>]{.underline}**

And that was some of the clarification that actually was brought up, and
when especially started to develop an understanding of what a PHR is,
and there should also be some guidance on what a treating provider is
and non-treating provider and how do \-- and guidance on this.

**[\>\>]{.underline}**

I\'ll throw out one more aspect of this.

**[\>\>]{.underline}**

In-person identity proofing, and that is, you know, what do you do with
the converting provider, institution. If you\'re relying on in person,
then you\'re relying on a system where you know, you\'re phasing into
electronic record system, or a PHR system. Person by person based on a
treatment interaction. You\'re not \-- if you\'re a hospital, you\'re
not converting your back files. You\'re not converting \-- this time
sequence here. You know \--

**[\>\>]{.underline}**

Starting from scratch.

**[\>\>]{.underline}**

If I\'m a doctor and I\'m \-- I\'m a pediatrician and I see a thousand
patients in a year, am I going to have to phase into an EHR system
patient by patient depending upon visit, or do I want to sit down and
convert my entire patient caseload in.

**[\>\>]{.underline}**

That\'s different from user identification. That\'s just the generation
of electronic medical record system. It doesn\'t necessitate at that
point communication with external entities.

**[\>\>]{.underline}**

I\'m creating a record in my system, I\'m identifying that record with a
patient. At some point, you know \--

**[\>\>]{.underline}**

You\'re talking about the point where you have to match that record with
the existing record you may have on that patient and you do want to make
sure that\'s the same person.

**[\>\>]{.underline}**

But that still is different issue than these. It\'s actually an
important issue. But we \-- and I think it\'s on the list of issues that
we\'ve been tasked with. But it seems to me it\'s a different why the
identity proofing of the user \--

**[\>\>]{.underline}**

Well, except if I understand what she was saying, are you doing any,
quote, identity proofing if you\'re going to convert all at once?
You\'re essentially relying on your historic identity proofing, which
was done under whatever standard you decided to use. The person that you
saw does correlate to the record.

**[\>\>]{.underline}**

Maybe.

**[\>\>]{.underline}**

Well, your patient correlates to your record about that patient.

**[\>\>]{.underline}**

Maybe.

**[\>\>]{.underline}**

We heard from Pam Dixon, exactly what we heard from her is there\'s a
problem where if people steal insurance and they get treatment under
somebody else\'s name, and the records get commingled. You don\'t really
know if you\'re a surgeon and all you \-- you know, but then \--

**[\>\>]{.underline}**

That\'s not true of the \-- the example is in the doctor\'s office where
she sees a thousand patients.

**[\>\>]{.underline}**

You may or may not remember that you once saw that kid and what that kid
looked like.

**[\>\>]{.underline}**

Without that history, delivered safe and \-- because what you don\'t
have, if you don\'t make the conversion, if you don\'t have a complete
medical record.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

And so there has to be a concern.

**[\>\>]{.underline}**

You know, you wouldn\'t have a complete medical record if it were the
first time you treated a patient. Somehow physicians deal with that
issue now.

**[\>\>]{.underline}**

True.

**[\>\>]{.underline}**

History of the physical.

**[\>\>]{.underline}**

But if you \-- yes. But if you later \-- all I\'m saying is the
consensus is to push out an in had been person method of authenticating
patients, you know, it\'s not a complete solution. And you\'re going to
run into timing issues.

**[\>\>]{.underline}**

I think the example I\'m thinking of is the VA, because the woman from
the VA was specifically talking about the problems with them, say that
first of all, VA patients get treatment not just in VA hospitals. They
get them other places, too. So if a patient is getting treated somewhere
else and for a year, at the if the VA sponsors a PHR, for their vet,
they want the person to be able to take advantage of that PHR, but they
may not come in for a year or two to an actual veterans facility because
they may be getting treatment else. Where we still want them to be able
to have that access to that service, to that PHR, because we think it\'s
valuable. So there\'s sometimes we\'ll see them in person and sometimes
not. But we need to have them identity proofed before then anyway. We
might not actually see them in person.

**[\>\>]{.underline}**

I think one of the issues that came up in the language I think was
called a trusted source or a trusted agent. And I know many of the
testifiers actually mentioned that.

**[\>\>]{.underline}**

That gets back to what Elizabeth was mentioning, at CMS. They\'re
looking at trusted \-- looking at trusted sources as a way of identity
proofing.

**[\>\>]{.underline}**

Then you might have it \-- you would be able to reduce the problem of
transferability. You wanted to transfer from facility to facility, or
you know, whatever.

**[\>\>]{.underline}**

Can I push back a little on the question though from CMS, which 42
million people to give them access to a PHR. Do we really have an
expectation that overnight all these people are going to have a PHR, and
don\'t Medicare beneficiaries go to the \-- go to see a healthcare
provider on a somewhat regular basis? So is it really impossible to
suggest a notion that in order to start your PHR, you have to \-- one
encounter with a provider in order to identify yourself?

**[\>\>]{.underline}**

But is there a difference if the PHR is not a provider-based PHR?

**[\>\>]{.underline}**

Well, I don\'t know what CMS is doing, and I don\'t know how it\'s
integrated in. Most PHRs to my knowledge aren\'t provider-based PHRs. I
would need to know more about what \[indiscernible\] is planning but it
seems you would have some sort of identity proofing at the provider end
that then has to be authenticated potentially through a trusted source.
But I\'d like to hear more from CMS\'s perspective about why this seems
to be an impossible challenge if \-- I mean, I guess my assumption is
Medicare beneficiaries have fairly regular encounters with the
healthcare system.

**[\>\>]{.underline}**

I think part of it right now is Medicare beneficiaries can get their
claim information online. And they\'re authenticated through a mix of
sort of knowledge base and then we issue them a PIN and password so they
can continue to get into their account and look at their claims. That\'s
like the first step towards going towards a full-blown PHR.

**[\>\>]{.underline}**

So I mean, just to put that in terms we\'ve been trying to use, CMS for
the claims history does identity proofing online and subsequent
authentication online.

**[\>\>]{.underline}**

Yes.

**[\>\>]{.underline}**

Okay.

**[\>\>]{.underline}**

And what \--

**[\>\>]{.underline}**

Medicare.gov. That\'s the way you can get through. Mymedicare.gov. The
way they found it works for a lot of people, the beneficiary signs up,
but I could sign up for my mother if I knew her information, because
it\'s not in person. Just online. If you know the information, you can
get in. And so I could sign up for my mother, give her information, the
password when she initially signs up is sent to her Social Security
address of record. So I wouldn\'t be \-- she doesn\'t live with me so I
wouldn\'t get her password. But \-- and it\'s a one-time use password.
So once she gets it, she can log in and then change her password and
then give me the information and I can keep logging in for her to check
on her claims.

**[\>\> Sam Jenkins:]{.underline}**

This is Sam Jenkins. We recently and DOD had an issue involving an
ex-spouse, got into our eligibility system and changed the address,
phone number, and some other information about her ex-counterpart. And
changed his eligibility for care in our system. Now, I have a mother,
who my sister has power of attorney for healthcare decisions. And she
does that, but it\'s in a paper-based system. If we\'re going to go to
an electronic system that allows somebody other than a patient to go in
and have access to a system, we need to figure out a way to authenticate
that third party. Because there is liability.

**[\>\>]{.underline}**

And Social Security lets you change your address online. Do a direct
deposit changing online. That\'s being done now.

**[\>\> Deven McGraw:]{.underline}**

Maybe \-- this is Deven McGraw. Maybe we are thinking about identity
proofing in a very narrow and temporal way. Assuming we\'re starting
fresh and everyone will have to prove identity supposed to a form of
identity proofing that can take place over time through these encounters
with healthcare providers. For example, in the Medicare context, you\'re
getting all these people signing up online but they\'re going in to see
healthcare providers where they are presenting in person, those claims
are getting matched up centrally with the information that you have, and
so if \-- I mean, we have to think about how a misidentification
situation would get detected and then addressed if you had a problem
where the wrong claims were being sent in, and the person is really not
who they say they are. But we do have through encounters in the
healthcare system, a way to visually see a person at some point. Does it
need to be absolutely in the very beginning? Maybe it doesn\'t. And by
thinking of it having to take place in some sort of initial encounter,
we\'re freezing ourselves into a space where we can\'t go there when in
fact we can because everyone really, you know, except perhaps the
recluse who never comes out of the cave, sees a healthcare provider in
person at some point, and in their lifetime.

**[\>\>]{.underline}**

And I guess one of the difficulties with that, I suppose, goes back to
try to draw the line we\'ve been drawing between identity proofing and
authentication. If identity proofing becomes a process over time, I
guess it\'s sort of ongoing authentication that is not only
authentication but also part of the identity proofing.

**[\>\>]{.underline}**

I mean, one of the difficulties I think we\'re going to have today, and
this is obviously a good discussion and very useful and something I
think we\'re going to need to have, but it\'s good to go to what are we
going to be able to do quickly, if anything? And I mean that\'s
important. It may be this is just \-- you know, these are topics and
I\'ve certainly read some of the materials from NCPS, and others, people
have put a lot of time and not necessarily moved past the general
recommendations. I mean, we started talking about identity proofing this
morning, you know, mainly because it was the first issue on the list,
sort of by accident. I think it was also an issue where we had had some
preliminary discussions that maybe it was an area we could make some
recommendations on. I\'m hearing we\'re going it need to push and drill
down on this particular issue. We\'d need to define it, hear some
experiences with trying to do this. We\'re going to need to understand
some of these scenarios. I mean the scenario, the conversion scenario,
you know obviously a big issue, it\'s going to be \-- everyone\'s
starting from somewhere. Didn\'t hear anything about that particularly
last week.

**[\>\>]{.underline}**

Just one more point that goes back to the point about defining the PHR.
So what I heard about what CMS is currently doing, which I think \-- I
mean, I realize they perceive as a step toward a PHR, it\'s not specific
to the use cases at hand, which are registration and medication summary.
For the PHR, consumer empowerment one. And so you know, maybe we have to
narrowly define within this context what our recommendation is, and I
think, you know, one thing we heard again and again, and which Kirk
raises this notion of doing a risk assessment. So you know, what\'s the
risk assessment with respect to having claims data and the way they
authenticate and ID users in that. But what\'s the risk assessment for
medication and registration summary information? And you know, maybe if
we can try and narrow it down that way. There\'s so many notions of what
a PHR is and that, my knee-jerk reaction is that\'s not a PHR. But I
don\'t know \-- an evolution toward it, perhaps. But maybe in order to
try and make a little headway, we need to just keep narrowly focused to
the use case.

**[\>\>]{.underline}**

One of the other things when I was listening to Sam\'s comment about the
\[indiscernible\], I\'ve used that example with a lot of companies that
I\'ve worked with who are for example health insurers and they\'ve had
the situation where when HIPAA went into effect, they had all these \--
you know, who could call and get information about why a claim hadn\'t
been paid. And what I told them was look, you\'re going to have 99 times
out of a hundred when my spouse calls, I know my spouse is calling, and
she\'s supposed to call and she\'s the right person, and you know from
guaranteed certainty that one out of 100 is going to be a divorce or
child custody or whatever, and most of the companies started out trying
to deal with the one out of 100 and everyone fought it and resisted and
now they\'re pushing the other direction. And I\'m not sure what the
right answer is think we\'re going to have \-- I mean, talking about the
80/20, or 90/10 or even the 99/1. Are we trying to design the perfect
system or a system that works in most of the circumstances? I mean,
60/40 is not going to be good enough, clearly. But if something\'s going
to be 1 out of 100 or 1 out of a thousand, I think that\'s got to be
part of the calculus at some level. We can\'t \-- on one hand we can\'t
make identity proofing so perfect that it\'s not useful for everyone. Or
it\'s not useful for most people. We can\'t make it so easy that anyone
can get in the door.

**[\>\>]{.underline}**

Can we try talking about these based on a breakthrough? I\'m following
up on the comment because I think there might be some that are easier to
accept than others. It seems to me the conversation about in-person
identity proofing and every patient is going to show up at the doctor\'s
office in person at some point or 99 percent of the time. That for
secure messaging, for example, it is about communication \-- a patient
communicating with a clinician, about their care and their health and
their treatment, and that in that case, the difficulty is with
in-patient proofing. Identity proofing, seem to be much lower than maybe
in some of these other situations. Because that person will present and
say, you know, the doc can say you want to be able to communicate with
me electronically, I need this information from you to verify that you
are \-- that I can identity proof you and then authenticate you later.
And that one, it seems to me is sort of the easiest case. So trying to
parse these out and see where there\'s sort of the difficulty lies and
where there might be \-- it might be easier to think about these.

**[\>\>]{.underline}**

I think that\'s a very fair point. I mean, and I want to think about it
with two issues. One; is that a good answer. Two is, is it a useful
answer. One of the things I was struck with, listening to the testimony
last week, was if we were to come to a recommendation that says for
secure messaging you need to have in-person identity proofing, that\'s a
recommendation. It\'s not clear to me how far that \-- how far that gets
us in anything that\'s really going to be that helpful of the, I don\'t
know, does that raise the conversion issue? I mean, are we going to have
people who I want \-- I guess if I want to communicate electronically
with the doctor that I saw six months ago, I\'m going to need, you know,
I can\'t just say six months ago you asked me to do something, now I
weigh five pounds less, am I okay? You\'re going \-- we\'re going to
say, no, you got to go in. No, it won\'t be a overnight conversion. You
won\'t say all of a sudden here\'s an e-mail account for everybody.

**[\>\>]{.underline}**

\[indiscernible\] medical records \--

**[\>\> Cindy Tanenbaum:]{.underline}**

This is Cindy Tanenbaum representing Dr. Basch from MedStar Health. I
know on that particular issue he did have some concerns, and I think it
kind of ties back to someone\'s earlier statement about narrowly
focusing on each use case and then within those identifying the
potential risks and impact because with the secure messaging, if it were
able to be done with patients today who were new to a practice, that
conduct would not really be \-- it would be considered unethical by most
physicians, given currently how the guidelines are written with e-risk
recommendations, they violate the AMA, and AMIA guidelines of e-care
that should only be provided with existing patients.

So I think even though that may sound like it would be a easier agenda
to address, we need to vet, it I believe, at all levels to look at what
the impacts would be with current guidelines.

**[\>\>]{.underline}**

You have three categories of patients. You have new patients, or
patients who show up in person. You have \-- for people that aren\'t
there in person, you have existing patients but not people who are in
the office. People that have a history with you. And then you have new
patients. I mean, I think, does everyone agree you wouldn\'t have to
first \-- the first contact you\'ve ever had with the healthcare
provider be a secure messaging.

**[\>\>]{.underline}**

Well, I can think of examples where you would. Living in a rural area,
four hours' drive or five hours to get to my, the guy that I need to see
and I want to send a message saying is it worth it for me, given my
symptoms, is it worth it to come in? And are they going to say yes in
had every single case? That\'s the kind of thing the VA was talking
about. And maybe that\'s one of those one in 99 cases rather than \--

**[\>\>]{.underline}**

At some point, what is it, we can talk about privacy and security, none
of that matters in that context the somebody\'s calling and saying I\'m
trying to figure out if I need to drive to the emergency room, I don\'t
care. At some point it doesn\'t matter.

**[\>\>]{.underline}**

I think secure message something an ongoing doctor-patient relationship
as opposed to a one-time or an initial inquiry about gee, I\'m bleeding,
should I come in.

**[\>\>]{.underline}**

And providers will answer that question.

**[\>\>]{.underline}**

They will not say.

**[\>\>]{.underline}**

Chronic care.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

I think we can consider it in had the context of a chronic care
situation, I think we can consider it in the context where the doctor\'s
office has adopted some, already has some form of the capacity and wants
to participate in this electronic system. In that case I do think from
what I\'ve heard in most of these situations, there needs \-- this is
something that does lend itself to an initial conversation with the
individual and then in person the visitation setting as to their
willingness to participate, are they interested in this. I they have
their own capacity. And enable this. Do they agree parameters and all
sorts \-- other things that go with it that they usually sign up and
actually some have said they sign a consent.

**[\>\>]{.underline}**

Most of those things don\'t have to be done in person. What system I
have. I do agree to the terms. All that doesn\'t have to be done in
person. But even the chronic care context, but I think that still maybe
in this context the rule is, and the recommendation is you can\'t start
up such a conversation electronically unless you have one in-person
encounter beforehand. I don\'t think that\'s unreasonable.

**[\>\>]{.underline}**

I don\'t know it\'s a very interesting question, important question,
I\'m not sure if it\'s a tangent or not. Which was do you have to make
that link to the communications going into the existing medical records.

**[\>\>]{.underline}**

You have a provider in this case who is making a recommendation via a
e-mail to a patient for some form of treatment or another. And that
treatment is accountable. That\'s one of the AMA issues, is that these
e-mail constructs or e-mail arrangements between a patient with a Yahoo
account and a provider who is using either a personal or organizational
account, aren\'t captured as part of that medical history and so
therefore the patients treating themselves based on that advice and if
there\'s an adverse effect to that, some other reason for review on
litigation, there\'s a problem with capturing that as a component of the
record. In our system, and something we\'ve been playing with for years,
which allows a patient a face-to-face communication and authentication
and they\'re given an e-mail account within this secure portal. So all
communication that is go in and out between the patient and provider go
into the secure portal that requires either the patient or the provide
to log in to be able to open that message. Now, if the patient can
download the message to their own computer, but the documentation of the
messaging remains in the system and in that system part of the record.

**[\>\>]{.underline}**

And there\'s a visual encounter with the record that precedes the
establishment of that.

**[\>\>]{.underline}**

Face-to-face encounter that does two things. One is validate their
identity. And gives them the opportunity to opt in or out of this e-mail
service. And so they will in fact sign a consent to participate in this
structure.

**[\>\>]{.underline}**

In the context of the recommendation, is it possible to take \-- is it
possible in the context of the recommendation to take what you were
discussing then, and discuss secure messaging and PHRs and we\'re not
dealing with the exchange of medical advice or recommendations and
we\'re just dealing with consumer-driven or -populated and secure
messaging and kind of take that other really complex step of medical
advice exchanging directions out of it and just \-- and maybe look at it
in the context of just that.

**[\>\>]{.underline}**

What would your secure messaging entail if not treating medical advice?

**[\>\>]{.underline}**

Well, my secure messaging, has never been medical advice. It\'s always,
you have a secure message, I log in and they want me to update my
immunization records or they want me to update my medication history. My
appointments \-- stuff like that.

**[\>\>]{.underline}**

It\'s just appointment reminders and one-way communication from you to
them?

**[\>\>]{.underline}**

PHR information, not necessarily what would lead to EHR type of
communication.

**[\>\>]{.underline}**

But I think following on what Sue was saying, that looking at the
context of secure messaging, coming out of the Workgroup, the point is
it would be a ongoing clinical conversation with the provider, so I
think if we were not \-- to try to look at that time more narrowly, I
don\'t think we would be serving the needs of the breakthrough and the
Workgroup. So I think we need to think about it in the context of a
clinical conversation electronically.

**[\>\>\
]{.underline}**I guess my only concern was I wasn\'t sure where the
conversation was leading for reimbursement. When you bring in secure
messaging and, that\'s the only reason \-- because I know chronic care
is dealing with that issue.

**[\>\>]{.underline}**

I think there\'s a whole post host of policy issues associated with
having an online or non-in-person dialogue with a person that has
nothing to do with identification they want indication. But I don\'t
think those are under our purview for the moment.

\[laughter\]

**[\>\>]{.underline}**

I was trying to figure out what that nexus was and what Sam was talking
about. I think it\'s important that the \-- the communication or
anything that is in the nature of treatment advice, medical advice, is
documented, but I don\'t think that\'s different with whether it\'s a
large provider like DOD, or if it\'s your small, you know, practice or
whether it\'s on the phone or. I know in my medical records, I call my
doctor on the phone, I can look at my record and see she wrote a note,
talked to me on the phone. So it\'s still her responsibility to document
that, whether she did it over e-mail or whatever.

**[\>\>]{.underline}**

Here\'s I guess where my concern was. Again I\'m not sure of the
connection. But if what we\'re saying is we\'re trying to isolate secure
messaging, as a particular form of communication and a particular narrow
piece, but the secure messaging is going to be linked up to an EHR or
PHR or something else, have we bought ourselves anything on identity
proofing secure messaging? If it\'s going to get linked up to the back
end, do we have the same problem and need to get \-- figure out who is
the EHR it\'s going into? I\'m not sure. But I mean, that was the
connection that I was making was can you \-- I mean, if secure message
something a closed system, and all it is is a back-and-forth, we could
isolate it. But it can\'t be a closed system because it\'s got to link
up to \--

**[\>\>]{.underline}**

The problem is in the linkage, you\'re talking about is the e-mail
address. E-mail address is not fixed in stone. They change from time to
time. And so there\'s got to be some kind of way to link the e-mail or
any changes to that e-mail to the medical records itself.

**[\>\>]{.underline}**

Doesn\'t have to be an e-mail address. It could be a hash, a token,
could be \--

**[\>\>]{.underline}**

If you\'re talking about somebody who is out on a computer in their
spare room, and so \--

**[\>\>]{.underline}**

But do these different types of messaging, whether in EHR, not EHR,
change the threshold question of how we feel about identity proofing for
a messaging type relationship with a provider. And it\'s \-- I think
just rephrasing your question. Feel like we\'re getting slightly \--
we\'re wandering into different territory because I don\'t \-- unless we
start addressing how those distinctions play on the question of \-- does
that change our mind with respect to we want identity proofing in person
at some point, whether temporally it\'s before that relationship starts
or at some point \-- or there has to have been an existing relationship
where the person saw the patient \--

**[\>\>]{.underline}**

Maybe what we do, maybe what we do is if we try to isolate for
recommendation purposes, secure messaging, but we\'re aware that
there\'s this issue about how the secure messaging information is going
to get connected up with the EHRs and PHRs, we\'ve got to flag that as
saying we recognize that is an issue and we haven\'t addressed that yet,
but you know, it\'s seeming we don\'t want to make an explicit clear
narrow recommendation that has broader implications than we\'re
recognizing.

**[\>\>]{.underline}**

Yeah, because that actually was one of the questions I asked of, I
can\'t remember who on the first panel, but you know, he describes the
procedure they went through, for, you know, signing people up to do
secure messaging. And in his office. And then I asked, is that same
password, what they use to access their PHR, and he said yes. So that
system, whatever system they have where you sign them up in the office
and I think he said you send them a letter with their user name and
password information and that information doesn\'t just give them access
to have a dialogue with their provider. It opens up the entirety of
their personal health information that has some of their presumably
electronic health record information populated in it. So that was from
one person.

**[\>\>]{.underline}**

That\'s interesting. Is that link actually a helpful link in the sense
that you have done the in-person \-- I mean, we had a little bit of
question how effective in-person is. Put that aside for a second and
let\'s assume in-person is effective. And in that situation you had in
person, that\'s given them access to secure messaging, and there\'s a
connection to that person but that person\'s medical record. Maybe it\'s
\-- is it that link that would be the risk that the prior medical record
doesn\'t match up with the person who got the secure messaging? Or is
that sort of a back end into saying we get in-person identity grouping
for the EHRs also?

**[\>\>]{.underline}**

They send a letter to the person\'s house, you know, who opens it, gets
on, you know, it gets into that 90/10 or whatever rule. But you\'re
essentially saying that by authenticating ID-ing and authenticating at
the person\'s office for this explicit purpose, it is also giving you
access to a much broader range of features and functions, so I think
your point about flagging that, when \-- if we make a recommendation
with respect to secure messaging, is really important because there may
be other issues that surface.

**[\>\>]{.underline}**

But it seems to me there may be two different approaches that could
potentially be on the table and if you are identity proofed in person
for purposes of secure messaging, that could be sufficient for other
purposes. Then the question is, if the doc doesn\'t do secure messaging
or if you\'re getting a PHR through someone other than your doc, can you
use another method? Can you do online versus in person so I think
there\'s an issue of does this work for this purpose and once you\'re
identity proofed for one purpose, can it be used for another.

And there\'s a second question, well, if you\'re not identity proofed
for secure messaging, for your \-- through your physician because
you\'re getting your PHR through your insurance company or through a
vendor, can there be a difference standard for that, or does it have to
be the same in.

**[\>\>]{.underline}**

Well, another thing, I don\'t remember the context in which the question
came up, but the identity of sort of mailing the password back home is
usually a check on something that\'s not in person. I mean, that\'s
usually you\'ve signed up, you\'ve signed up online and they mail it so
that it\'s a check because they\'ve got your mailing address. It\'s a
little weird to think I go in in person, I\'m going to go in person and
you\'re going to mail something back to me at home. I don\'t know
whether the issue there is effective \-- whether it\'s an authentication
problem after the fact, or it was the front end identity proofing.
Again, if the goal of in person is to have effective identity proofing,
I would think up wouldn\'t want to go to the other steps. The problem
with the initial meeting and you sign the consent and because it may be
\-- you know, infeasible from an office practice perspective and I
don\'t know the secure speculation, then it triggers some letter that
goes out from the office after the fact and gets consent and that\'s
their user and password for accessing the system. Maybe just that you
don\'t want the patient to have to sit around in the office four hours
while they wait for a printer how to access.

**[\>\>]{.underline}**

Yeah, that makes sense.

**[\>\>]{.underline}**

It strikes me as a weakness. That\'s a flaw in the system.

**[\>\>]{.underline}**

But probably a pervasive.

**[\>\>]{.underline}**

Probably.

**[\>\>]{.underline}**

I would imagine, I don\'t know.

**[\>\>]{.underline}**

We were starting to go down a path I think that was moving us towards
in-person identity proofing or secure messaging, whether we make
explicit link to chronic care or not. Or assume that\'s the model. I
mean, should we take potshots at that? Is that useful, is that
effective, are there weaknesses, problems with that identity?

**[\>\>]{.underline}**

I think we have to flesh out a little more when we say in-person what
identity \-- what does that mean. That means it counts if the provider
has in fact a record of this person and those \-- knows who the person
is from an historic relationship. Does it mean before you can start the
secure messaging you have to actually have to come into the office and
show that you are you and then you either get it in the mail or you get
it in your hand when you leave. I think \-- I like the premise, I just
think we need to our push on through what \--

**[\>\>]{.underline}**

And one of the things, just to \--

**[\>\>]{.underline}**

Maybe there are sort of a bunch of different contexts. I would prefer to
see identity proofing in person and all of this qualify, like lots of
different options.

**[\>\>]{.underline}**

When you\'re dealing with chronic care patients, you may not be able to
get them in person to start this secure messaging or access to their
records. Because they aren\'t able to travel. And a lot of that might
have to fall back on a physician\'s familiarity with a patient. And the
in-person validation done at some later point.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

Or through another means. Through the exchange of a letter and a
response.

**[\>\>]{.underline}**

Right.

**[\>\>\
]{.underline}**I think what troubles me about that notion is that for me
there needs to be a strong dialogue between the healthcare provider and
the patient so they understand the terms and conditions and can then
provide educated consent for engaging in this process. That\'s my own
personal bias, but I don\'t \-- you know, I don\'t think by sending
someone in the mail, they necessarily understand the implications of
engaging in this practice.

**[\>\>]{.underline}**

For the chronic care patient population, I mean, are we talking about a
transition issue? I mean, there\'s going to be presumably if I\'ve been
to a doctor 50 times and the doctor starts secure messaging on Day 1 but
all my treatment was the two years before that and I have some question
I want to send in my secure messaging without having a visit, there\'s a
short period of time before I\'m going it need to have a visit,
presumably. And so I don\'t know how much of this is just okay, you got
to get your existing patient base over that transition hurdle and then
we go \-- we start forward.

**[\>\>]{.underline}**

Maybe we can \-- there could be a recommendation for a new patient, you
need to do X, for seeing patients, you need to do X. within a certain
period of time or something like that, if in fact \--

**[\>\>]{.underline}**

I think Alison\'s point earlier, the doctors presumably are not going to
say much to a patient they\'ve never seen before. They may say nothing
other than I can\'t help you or can\'t treat you. They presumably say a
little bit more to an existing patient that they know and have whatever
history they\'ve got with them, depend, they\'re not going to \--
they\'re not going to go too far but they may be able to give some
advice at that point.

**[\>\>]{.underline}**

Again, maybe what we do is we start with that identity as a premise and
figure out and fill in the gaps and holes. I don\'t know how many of
those are testimony points versus points we should discuss, or both. I
mean, if we need to bring people in and talk about experiences, pros or
cons, then we need another hearing that\'s got witnesses on it. I mean,
trying to identify that \-- even that narrow a recommendation to figure
out all the different issues that are connected with, that that\'s \--
is sounds like a risk assessment around the decision tree of the
hypothetical scenarios and moving forward to a certain point in time. I
mean, is that what you\'re describing?

**[\>\>]{.underline}**

\[inaudible\]

**[\>\>]{.underline}**

That\'s a whole level of quality control.

**[\>\>]{.underline}**

I\'m not going to do this. This is an administrative front office
function. A doctor is not going to be come close it. You\'re going to be
lucky if the doctor answers the message.

**[\>\>]{.underline}**

Someone from the doctor\'s office.

**[\>\> Jill Dennis:]{.underline}**

This is Jill. Keep in mind there is some form, as imperfect as it may
be, of identity proofing going on in these doctor\'s offices when
anybody shows up. They\'re signing in, showing their insurance card and
some practices they take a copy of my driver\'s license. There are some
of these activities in place now, and it isn\'t the physician doing
this. It\'s the front office person. But there\'s already some form of
this going in now.

**[\>\>]{.underline}**

And that raises a different set of issues about what we will require
people to present.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

Proof identity.

**[\>\>\
]{.underline}**That\'s another \--

**[\>\>]{.underline}**

Well, for another discussion.

**[\>\>]{.underline}**

I would agree.

**[\>\> Jodi Daniel:]{.underline}**

Before we go there, I want to \-- this is Jodi Daniel.

**[\>\>]{.underline}**

Don\'t go there. Remember that we have to be \--

\[laughter\]

**[\>\>]{.underline}**

A comment about the types of things that might qualify as in person. Do
we want to work that at all? It seems like maybe talking about apples
and oranges there or apples and oranges are okay, but trying to get what
does that mean in-person identity proofing and what might be okay or
might qualify.

**[\>\>]{.underline}**

I don\'t think I understand your question.

**[\>\>]{.underline}**

I had set up a scenario where there might be sort of multiple ways it
identity proof. One might be you show up in the office and are actually
\-- you know, you actually prove in some way that we\'ll decide later
what that \-- that you are who you are and you establish the
relationship for the secure messaging purpose. Whether that \-- and that
could be sort of right at the outset. You can\'t do it unless you do X,
so \-- until the next time that you can present yourself in to an
in-person encounter with a provider. So that might be \-- that\'s one
and then we have to decide whether that\'s really the only way, or
whether there are a range of ways to try to address you know that may be
good for 80 percent to try to address an additional 10 percent of
outlier situations that we think it would be okay for example you\'re
talking about a chronic care context. You\'re talking about a person who
has a long-standing relationship with the office. Where they see that
person, they have seen that person fairly regularly, they have another
reliable way of contacting them. Telephone. That that \-- and they will
see them again in the future, but they want to start the secure
messaging sooner than that face-to-face encounter. So would it be okay
to have a preliminary ID proofing to start secure messaging for a
pre-existing relationship that then gets validated the next time the
person comes into the office. Would want to hear how you feel about
that, given that\'s sort of a less of an opportunity for people to get
sort of a lot of information about what secure messaging means.

**[\>\>]{.underline}**

I think you could qualify it by saying that is the one time \-- you
really like you have a "gimme" like if you have an immediate urgent need
to transact some piece of information, then maybe you have a one-time
run, point of view that\'s not your consistent user name and password
and you haven\'t bought into the system. That\'s just an allowance for
permitting under this one \-- example.

**[\>\>]{.underline}**

Let me focus just for people more familiar with the provider side. I
mean, I guess I have trouble \-- I mean connecting. The idea of
emergency makes a lot of sense but I have trouble saying that a patient
would ever say I have an emergency situation, therefore I want to set up
a secure messaging system. It would seem to me almost all coming from
the provider side in that situation.

**[\>\>]{.underline}**

Well, I wasn\'t trying to describe an emergency situation, just like
maybe I know I can\'t come see you for three months. But I\'d like to
have a one-time dialogue \--

**[\>\>]{.underline}**

Again, I don\'t have a sense whether \-- would patients do that? I need
to call my doctor but I don\'t want to call \-- and I call my doctor for
my entire rest of my life. I don\'t want to call him now. I want to all
of a sudden start sending not only an e-mail be a secure message and
that\'s where I\'m going to start. I don\'t have a sense whether that
scenario is likely to happen.

**[\>\>]{.underline}**

The transition would have been in a face-to-face. This is \-- I started
doing this.

**[\>\>]{.underline}**

Or the doctor\'s office might want to roll it out. I could see dealing
on that end. If the doctor\'s office says he wants to send out a
communication including a letter to all their patients saying we have
this great new way to get in touch with us, but that\'s different. I
think we got to deal with that and the one-time Mulligan wouldn\'t
necessarily help on that one.

**[\>\>]{.underline}**

I was just trying to frame Deven's example.

**[\>\>]{.underline}**

Very helpful.

**[\>\>]{.underline}**

You think the one that comes to my mind is a person with diabetes who
physician sets up some sort of secure messaging program designed to help
the patient more closely monitor their blood glucose levels. So they\'re
in the office periodically for their checkups, but you \-- I\'m putting
out there you could start that messaging program or \-- where that
person is arguably getting care via an e-mail relationship to help them
with their glucose monitoring and diet and all the sort of things they
need to be doing. Without necessarily waiting until that person comes
into the office. So it\'s not an emergency situation, it\'s an ongoing
care need and a chronic care population that are we comfortable with
allowing it to start prior to a face-to-face encounter. We know they
happen regularly with a chronic care population. Maybe not every month.

**[\>\>]{.underline}**

The risk is do we really care how secure that one is? I don\'t know, I
mean that \--

**[\>\>]{.underline}**

I\'m not sure how much that information is getting there today through
how is that getting through telephone.

**[\>\>]{.underline}**

Yeah, it seems to me particularly in this \-- we did, in this
environment, that I mean, it seems to me that is kind of supposed to the
system forcing him to do. It is the doctor\'s communication relationship
with his patient. It\'s a different thing, I guess to me, in the other
environment where information, the EHR, may be accessed and relied upon
by others. PHR, where the information may be transmitted to others as
opposed to the people inside the dialogue. Which gets somewhat back to
be a point Jodi had to make in passing that the identity proofing and
\-- should be something \-- excuse me, should be something that\'s done
once for all of these use cases, as to that institution. I can\'t see
why would an institution \-- institute bury its identity proofing, you
know, make the patient come in three times, once for the PHR, once for
the EHR, and once for secure messaging? It would be an issue, I think,
in terms of whether we wind up in a federated system, or otherwise, how
other people may rely on whatever you\'ve done, with regard to identity
proofing, but I can\'t see you ever engaging in this more than once.

**[\>\>]{.underline}**

Which is a long way around the tree that well, I see this as a
doctor-patient communication, and you know, what he\'s comfortable with
identity proofing ought to be \-- it seems to me his decision. A
recommendation out of here. But unfortunately I can\'t see functionally
this system standing alone. And so it\'s always going to be \--

**[\>\>]{.underline}**

Secure messaging.

**[\>\>]{.underline}**

Secure messaging is going to be some functional component of either an
EHR, system, or more likely a PHR system. That\'s supported by that
particular office and because of that more \-- the use of those other
materials will probably back into identity \--

**[\>\>]{.underline}**

Let me ask a question on that \-- a followup question. We talk about
secure messaging, and I\'m not a computer person but it seems to me the
main difference between secure messaging and an e-mail today has to do
with security more than the private privacy component. The who \-- the
security of the transmission. I mean, are these communications happening
today by e-mail without \-- just regular e-mail without any doing any
particular proofing?

**[\>\>]{.underline}**

I\'ve e-mailed a doctor of mine. I have a long-standing relationship
with her, my allergist. She\'s been letting me breathe for 15 years, and
she knows me and whatever, and so we have a good relationship. So she
has given me her personal e-mail address and occasionally I write her.
It\'s like a one-off thing. Normally if I really need her, I in fact
call her. This conversation is making me think, how much does it really
matter if we can do secure messaging for your diabetic patient or for me
if I have a question that is urgent but not emergent for my allergist.
Truthfully, I can do it by phone until I get there in person the next
time. And I think the issue about \-- if the person can\'t get there,
for quarter we have other ways of doing it, so I\'m certain after this
conversation get to the point where it\'s not that important that we
have secure messaging during that \-- until the person gets there in
person next time, because we have other ways to communicate. With my
internist, if I really need her, it\'s impossible to get her on the
phone, I fax her. I accept a fax, I need this prescription refilled and
this is what happened last week. If you think you need to call me, call
me. If not, please just deal with it. You know. And it works. So we have
other ways and the question is how important is it for us to really deal
with those whatever we\'re call it \[indiscernible\] cases. Let\'s just
deal with the 90 percent cases. And I\'m really getting to that point,
frankly. You\'re all sort of talking me into \-- how much does it \--
how much do we care about that case and don\'t we really care about
generally establishing an ongoing relationship in secure messaging for a
patient over time.

**[\>\>]{.underline}**

One. Things with secure messaging is \-- I mean on the trust and the
sort of confidence building side maybe that\'s an easy way to ease
people into some of these other issues.

**[\>\>]{.underline}**

One of the difficulties is we have people that have been excluded over
the last \-- people could have jumped in but it\'s a little difficult.
Could we stop for a second and see if there\'s anyone on the phone that
wants to chime in on any of the issues we\'ve been talking about?

**[\>\>]{.underline}**

Do we have people still there? The phone still on?

**[\>\>]{.underline}**

We\'re still here. Is there anyone that would like to jump in on any of
these points?

**[\>\> Jill Dennis:]{.underline}**

This is Jill Dennis. I want to say that I sort of have been sitting back
and listening to the long and winding road we\'re taking on this. But it
seems like \-- it seems to me, in anyway, that whatever we do, in terms
authentication, the most important thing as far as identity proofing,
rather, is to get it right. So give than we\'ve heard testimony that the
\-- you know, neither way is perfect, but that there\'s some strong
advantages to in-person, and given that for at least 90 percent of the
cases, there will be the opportunity to go in and do that, I just kind
of come down on the frame of saying that that\'s weigh heard from the
hearing last week and I haven\'t heard anything today that really
changes my mind in terms of the advantages of having some sort of
in-person component for setting it up right the first time. Given that
it will be a one-team process. And if there is going to be trust
throughout the system, it needs to be done right. The first time.
Because of the implication of doing it wrong. That\'s where I come down
on hearing this conversation.

**[\>\>]{.underline}**

And Jill, was that your position both with respect to any \-- regards to
whether it\'s secure messaging or PHRs or EHRs?

**[\>\> Jill Dennis:]{.underline}**

Yeah, it was. I know there are some inconveniences associated with, it
but there are inconveniences associated with everything we do, related
to health information. I mean, when a patient wants to send information
elsewhere, they have to fill out a form. I mean, you know, is it perfect
in no. But it\'s our assurance that they really intended to flow that
way. So I mean, patients are accustomed to making these kinds of
tradeoffs and understanding gee, I can\'t get in for the next quarter so
I\'ll have to call one quarter before I can get in and set this up
right. That\'s where I come down on it.

**[\>\>]{.underline}**

Let me float, again just as a straw man. I think we\'re going to move
towards something that says that secure messaging can be in-person
identity proofing. I wonder whether we need \-- whether our next hearing
focuses on the question of how broadly that in-person can go. Can it go
to PHRs and EHRs. I will say when I was at the hearing last week, I
heard pretty much everybody say that in-person was going to work and be
effective for all of this stuff. I heard a number things today from CMS
and otherwise that made me question that. I haven\'t had the same
questions necessarily yet on the secure messaging. I\'m not \-- the part
I\'m not convinced on in secure messaging is how useful the
recommendation is. But I don\'t really hear people saying other than
some unusual examples that would be a problem, but I don\'t know at this
point, interested in other people\'s views obviously but I don\'t know
from my own perspective, whether we could make a recommendation that
says in-person or PHRs and EHRs as well. So we could view that as a \--
I\'d like to hear more from the CMS perspective and other big systems. I
mean, maybe DOD and the VA, we heard a little of the VA\'s experience
obviously, but that may be another way to start with a small
recommendation and see how much further we can take that.

**[\>\>]{.underline}**

Can I ask a question about that, which would be would that be EHRs and
PHRs generally, or just the scope in the use cases right now? I don't
know.

**[\>\>]{.underline}**

That's a fair question. I don't know.

**[\>\>]{.underline}**

We can ask the question either way. We can ask both questions, if we
want to, of the panelists. I think the focus should be on the
breakthroughs. That being said, of course, the breakthroughs are part of
a larger topic and charge, so it might be helpful to have that
information when making recommendations about the breakthroughs, how it
might have a broader impact. So I think we can ask both of those
questions of the panelists.

**[\>\>]{.underline}**

Okay.

**[\>\>]{.underline}**

Can I \-- were there others on the phone who had comments?

**[\>\> Paul:]{.underline}**

This is Paul. Not to focus on the chronic, the secure messaging issue,
but more PHRs in general, we discuss that, I guess I'd like to hear from
others about the issue I've asked about, because especially in the
context of PHRs that are going to have data feeds to pharmacies, and
laboratories, and others, where someone's going to request information,
where I still get troubled by the whole concept of in-person
identification and who's going to do it is the question of who's going
to stand behind it? And, not that I've asked doctors, but when people
have suggested that pharmacists will do the identity-proofing, I haven't
found a pharmacist who was willing to say that I'll be liable for it if
I make a mistake. And I don't see how people are going to start
providing information to a PHR unless someone stands up to that. And I'm
just wondering, am I the only one who's concerned about that, or is this
a legitimate point?

**[\>\>]{.underline}**

I think there will be a company hired out, there will be companies that
will go into the business of providing the service on behalf of
providers, whatever, and that those companies, like VeriSign, or
whoever, that are in the business of doing trusted ID, there are
companies who are now in that business for other purposes, could be
expanded to do it in the healthcare arena, that we would know who those,
you know, they would get a reputation for doing that sort of thing, and
that would be part of their business, to take on that, whatever
liability comes with that business.

**[\>\> Kirk Nahra:]{.underline}**

And Paul, I guess \-- this is Kirk. My sense is that it's a very
legitimate question, it may be a topic to include in, if we in fact have
a hearing on how far out we can take in-person identity proofing, maybe
a component down the road. It's presumably a limited issue in the
context of secure messaging, because, well, we haven't really talked
about sort of each downstream provider. I'm going to assume that if I go
into my doctor \-- and let me throw this out, maybe this assumption
isn't right \-- if I go into the doctor, the doctor says I've got this
secure messaging system, here's all the information you need, sign up
in-person, but the doctor sends a test out to the lab, I'm assuming the
patient's not going to be sending secure messages to the lab, or to the
specialist that the doctor refers him to, that they're going to set up
their own relationship with that person, so that the reliability point
that you're raising, I think, only comes up when we start to broaden out
that idea to EHRs and PHRs. But, so if that's the case, we'd say, okay,
we can make this recommendation on secure messaging, there are some
additional issues when you move out to EHRs and PHRs. Is that, I mean,
am I getting that right?

**[\>\>]{.underline}**

I would agree with that. Yeah, I would agree with that statement.

**[\>\> Steve Davis:]{.underline}**

This is Steve Davis. I have a question about, particularly with chronic
populations it seems like we're going to have to address the issue of
having a proxy or surrogate having access to the person's information. I
think somebody mentioned that earlier, but it seems like that will be
especially an issue with chronic care populations.

**[\>\>]{.underline}**

Is that the patient's responsibility, or would someone else be \-- I
mean, there's a couple of issues about it. If I'm at home and I want my
wife to have access to my e-mail account, I can certainly give her that
information. Are we talking about letting my wife communicate with the
doctor directly, or the wife seeing what the doctor sent, wife, or
mother, or child, whoever it is, seeing what the doctor sent to the
patient?

**[\>\>]{.underline}**

I was thinking that comes under the aegis of what Deven was describing
earlier, which is that once you have that in \-- well, during that
in-person identification and consent process, there's a list of things
that you need to go through with that individual, one of them being, who
do you want to authorize to have communications on your behalf? And that
might include \--

**[\>\>]{.underline}**

You mean other people who could communicate directly?

**[\>\>]{.underline}**

If that's the wish of the patient and the caregiver. So that's just one
example in a broader set of sort of hoops that you need to jump through
when you're setting up this type of system. And I was going to ask if
that could be one of the topics discussed by a panel, sort of what
people are doing now, versus what we think people should be doing when
they're doing in-person identification and signing people onto a secure
messaging system.

**[\>\>]{.underline}**

So we're going to have 11 panels, I think, for our next hearing.

**[\>\>]{.underline}**

Bring a sleeping bag.

**[\>\>]{.underline}**

Right. At the moment I think we're talking about sharing passwords and
children and parents and so forth who are, or Medicare patients and so
forth, but you could have those people also get identity proofed, and
have a separate authentication for those people, and then, or
permissions for those people. So that person has a separate account from
you, yet has permission to look at your information. And each of those
people could be identity proofed separately and then those permissions
could change over time in the case of divorce, custody issues, whatever
it is.

**[\>\>]{.underline}**

One issue that brings to mind and I will throw this out not because I
want to go off on this again. That\'s an issue that comes up today and
in the HIPAA context.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

A number of the things that we\'re hearing about and a number of things
we heard about at the hearing last week, as issues, for example, one of
the things we heard last week was hospitals don\'t seem to do a very
good job of defining who gets to see what and all \-- that\'s the HIPAA
issue as much as or even more than an EHR, PHR, who has permission to
look into my account and changing that and when the spouse gets
divorced, can I have her taken off of everything.

**[\>\>]{.underline}**

But I think the interesting question, though is if we\'re talking about
in-patient \-- in-person identity proofing, does that mean just for the
patient or does that include all processes? Because that actually would
be \-- could be in some ways you\'d want, if you\'re going to do it you
would want to do it with somebody who isn\'t a patient although that
might be a greater barrier because the patient could be \-- the island
child who is helping take care of that is in Massachusetts, and so there
may somebody real barriers to doing inpatient in-person identity
proofing for proxies.

**[\>\>]{.underline}**

But it may also be an issue and that\'s what I was trying to figure out
whether the issue is they \-- if I want to authorize my spouse or my
mother or my child who lives in another State, I could do that \--
that\'s much easier than electronically. Much easier than it would on a
phone call. You can\'t necessarily \-- if the person \-- I guess you
could look into the recorded message on the voice mail. But I could give
people access to my e-mail account but having that separate, if you want
to be able to communicate directly with the other person, without the
\-- you know, what that essentially means is you\'re communicating
without the patient also getting it.

**[\>\>]{.underline}**

Some of the things we\'re talking about make assumptions about how the
identity proof something going to happen. Which we\'re not going talk
about. But presume in 10 years or 20 years down the road, or whatever,
we don\'t have to solve the problem to that one but I\'m dealing with
the issue of identity proofing for all the new badges that the federal
government employees are going to get. They include biometric. It
includes a pin, an actual token and they think you have to carry around.
If it\'s news to you, we\'ll talk about it other times.

**[\>\>\
]{.underline}**It\'s expensive. Exactly.

**[\>\>\
]{.underline}**Right now you share your password, the doctor doesn\'t
have to get involved. There\'s problems with that but it could be that
the system that your doctor has requires a biometric. You can\'t just
share your password. You have to swipe your fingerprint. And that\'s not
going to work anymore. To have your daughter or your spouse do it,
they\'re going to have to have their own identity and show up in person
somewhere because we\'re really going to be doing good identity
proofing.

**[\>\>]{.underline}**

That doesn\'t help for the daughter who lives in Massachusetts.

**[\>\>]{.underline}**

Sure, because the daughter in Massachusetts gets authenticated in
Massachusetts.

**[\>\>]{.underline}**

And goes and can do it \-- yeah, can do it remotely.

**[\>\>]{.underline}**

There\'s lots of possibilities, exactly.

**[\>\>]{.underline}**

I\'m hearing two things.

**[\>\>]{.underline}**

I don\'t want to tie down to any technology. But what I\'m hearing is
that \-- I\'m hearing "in person," but \-- I\'m hearing "in person," but
not necessarily, it doesn\'t have to be \--

**[\>\>]{.underline}**

The doctor\'s office.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

In person.

**[\>\>]{.underline}**

At a trusted source.

**[\>\>]{.underline}**

Maybe it\'s the doctor\'s office, maybe it\'s okay to go to another
trusted source and then there\'s the question of \--

**[\>\>]{.underline}**

Right, but you sign up at a bank for first time you go and you sign your
signatures or whatever, you can go to any branch of the bank.

**[\>\>]{.underline}**

But I can\'t go at a time other bank.

**[\>\>]{.underline}**

Right, but I could go, for example, to verify and get a certificate to
do e-mail that is secure and I can go to any secure e-mail system on Web
and use secure e-mailing knowing my certificate was issued by a trusted
issuer of such things? Okay. They\'re in the business of issuing me a
certificate that says I really am who I say I am. Now, I only have to
show up once at VeriSign and my doctor and hire them to be the proxy for
doing identity proofing or something. So imagine easier and faster and
\-- person doesn\'t mean at your doctor\'s office.

**[\>\>]{.underline}**

Well, but \--

**[\>\>]{.underline}**

I want to say the banks have already done that in ATM card because that,
when you stick it in another bank\'s machine, verifies with your bank
that you have an account before it dispenses money. That already exists.

**[\>\>]{.underline}**

Two factors but not three.

**[\>\>]{.underline}**

Card and password.

**[\>\>]{.underline}**

And you still have to physically present at a bank, at some point.

**[\>\>]{.underline}**

Not necessarily.

**[\>\>]{.underline}**

Your online bank.

**[\>\>]{.underline}**

I have an online bank.

**[\>\>]{.underline}**

But you have an ATM card?

**[\>\>]{.underline}**

Yes.

**[\>\>]{.underline}**

So your bank is on the hook, if you\'re a crook.

**[\>\>]{.underline}**

But the risk is low and they have insurance and \--

**[\>\>]{.underline}**

They\'re bearing the risk. That goes back to Paul\'s question. Jodi\'s
bank bears the risk if another bank gets cheated and \--

**[\>\>]{.underline}**

And they have insurance that covers for that eventuality.

**[\>\>]{.underline}**

There\'s no FDIC \--

**[\>\>]{.underline}**

Exactly. Not just here\'s your money back. If this was protection \--

**[\>\>]{.underline}**

Sorry we took out your heart.

\[laughter\]

**[\>\>]{.underline}**

There are certain things that work in the financial context \--

\[multiple speakers\]

**[\>\>]{.underline}**

Let\'s go with that. We have technology is going to be here faster than
we know. Does it say "in-person" and then the norm is going to be
showing up face-to-face but in the future we encourage consideration of
whether there are vehicles for trusted sources? I mean, I couldn\'t make
recommendation about a trusted source. I don\'t really know. I
understand conceptually what that is but I\'m not sure how that
translates to a recommendation.

**[\>\>]{.underline}**

Somewhere you have to show up in person.

**[\>\>]{.underline}**

For me that\'s all about authentication with other parties at some point
in the future but for secure messaging, with a provider, I really feel
strongly it has to be in person, regardless of what futuristic
technology exists because there\'s no substitute for engaging in a
meaningful conversation about what it\'s going to mean for me as a
punishment.

**[\>\>]{.underline}**

That\'s a proxy issue.

**[\>\>]{.underline}**

I absolutely agree with that on the patient. I don\'t see any reason why
\-- other than those limit examples that we\'re sort of talking in the
10 percent, I think it\'s more like 1 percent but in the proxy\'s
that\'s a hard erred situation. Again, I wouldn\'t have a problem, I
think, saying \-- I mean, what do you do with the daughter who lives
somewhere else? There\'s \-- they\'re not going to fly to Florida to get
\-- well, we\'re not going to presumably make them fly to Florida. They
might fly to Florida sometime. I don\'t know what we do with those
people.

**[\>\>]{.underline}**

I think maybe the issue is that we can separate identity proofing from
\-- and I agree that conversation that you\'re talking about having
extremely important, it has to be in plain language and culturally
sensitive and all those things, depending upon the population or the
patient. You know, what the patient can manage and so forth. Maybe what
the patient\'s designated or legal care giver and so forth. But that
conversation, it should probably happen \-- but that conversation could
happen in person but could happen on the phone. Or if somebody had a \--
I want to use the right word. Had been identity proofed by the third
party, you can separate those things. So you know that you\'re calling,
the doctor is calling the phone of the daughter who really is in
Florida. And it really is the daughter because of some other thing.
Still that conversation can happen.

**[\>\>]{.underline}**

That\'s the one percent at this point?

\>\>

I guess I would want to hear from people what they\'re doing now what
process they do go through when they\'re signing a patient to
participate in one of these systems, and what allowances they make
currently for a proxy. I don\'t know \--

**[\>\>]{.underline}**

How many are out there? Is there many examples out there? I think Kaiser
\-- I know there exist some because we\'ve seen some demonstrations but
I don\'t \--

**[\>\> Tom Wilder:]{.underline}**

This is Tom Wilder. I can give you an example in the health insurance
plan context. Plan that I\'m with now has a personal health record. They
notified me that there was an opportunity to have a PHR, through my
employer. And so I logged on to their Website, I gave them my name and
address, and my insurance ID card number, and that\'s how they, gist
proved who I was. In one sense they proofed me when I enrolled in the
health plan through my employer. And that\'s how it was set up. And then
now to log on there, I\'ve got a \-- you know, a password and a PIN and
that\'s how I get access to it.

**[\>\>]{.underline}**

This is Jodi Daniel. This is my sense. On PHRs particularly, either ones
that are through an employer or a plan, or the vendor outside, that I
don\'t think \-- I haven\'t heard of \-- that the practice is in-person
identity proofing. Different from secure messaging. I was trying to
think about these things separately. That particularly in the health
plan context, there already is \-- they had to do some verification that
you are who you say you are. Point of view before issue you the plan to
begin with. And this is then supposedly you are already identity proofed
but not in person. And they use that same \--

**[\>\>]{.underline}**

It\'s an example of a trust that he came in person, got hired, showed
his I-9 information to get hired. He was eligible for benefits. He got
those benefits. Once he had the number for those benefits, it was
transferred to the insurance company that is sponsoring the PHR. So
it\'s like having the trusted source with the employer essentially in
that case.

**[\>\>]{.underline}**

Absolutely. And I think the one place where you may have a slight
difference is those folks who purchase coverage in the individual
market. They presumably are going to send in an application to the
health insurer and on that application they\'re probably going to give
some identification information of who they are.

**[\>\>]{.underline}**

What if it\'s WebMD?

**[\>\>]{.underline}**

Well, I can\'t speak to WebMD.

**[\>\>]{.underline}**

Imagine the hard case is a vendor case where there\'s no other
relationship that is established and \--

**[\>\>]{.underline}**

These individuals, they have nothing.

**[\>\>]{.underline}**

Okay, so the same case, example of our being Mr. \-- in an individual
market for insurance, where you have no accomplished relationship and
that insurer might be in a different State.

**[\>\>]{.underline}**

And you start talking about leveraging third party.

**[\>\>]{.underline}**

Actually, that insurer has to be in your State.

**[\>\>]{.underline}**

See what I know about insurance.

**[\>\>]{.underline}**

Could be a multi-State insurer.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

But by now they\'re not making you come in and \-- they\'re not looking
at you.

**[\>\>]{.underline}**

They\'re not all in Connecticut.

**[\>\>]{.underline}**

Right. And you know, their office may be the State capital which is 500
miles away.

**[\>\>]{.underline}**

Right, right, right.

**[\>\>]{.underline}**

I presume you\'re not saying the only way you can get identity proof is
if you get in your car and travel 500 miles. Maybe you are. This is
about third party, has to be convenient, maybe they have a set up at a
bank or something so that the people who are doing that third party, the
bank is \--

**[\>\>]{.underline}**

Well, \--

**[\>\>]{.underline}**

Certified or \--

**[\>\>]{.underline}**

The other part of it, though, again we\'ve got secure messaging, focus
on secure messaging and trying to figure out whether to broaden it out.
What I\'m hearing is it may be hard to take in person in the PHR setting
than the EHR setting.

**[\>\>]{.underline}**

And I think it depends upon what we mean when we say PHR.

**[\>\>]{.underline}**

That I think is where the risk assessment comes in, because we don\'t
know what \-- how is the information in the PHR, is flowing from and to
home. And that to me, those are the critical questions about what you
require in terms of identification and authentication. If it\'s just me
and my PHR, then that\'s fine.

**[\>\>]{.underline}**

Those on the phone, this will be an encouragement to come in next time.

**[\>\>]{.underline}**

Singing and dancing going on in the room. As a simple example that has
been in place for a long time that any time you have to sign a document
for \[indiscernible\] mortgages and notaries. Is the notary. And do you
have to show up in person to somebody. There are notaries everywhere.
There\'s going to be somebody that isn\'t 500 miles away. And you have
to show up in person and provide ID, or whatever you have to provide. To
prove who you are and they notarize that they have identity-proofed you.
I don\'t know the last time you went to a notary.

**[\>\>]{.underline}**

Terrible example.

\[laughter\]

**[\>\>]{.underline}**

All we know is people wander into our offices all the time.

**[\>\>]{.underline}**

Law firms usually have several.

**[\>\>]{.underline}**

Have them and they\'re not \--

**[\>\>]{.underline}**

Have a couple in our building.

**[\>\>]{.underline}**

Back up what \-- their bond \--

**[\>\>]{.underline}**

It\'s \-- fairly trusted source. Fairly trusted source.

**[\>\>]{.underline}**

My point is \-- it is a process, it is an in-person identity-proofing
process that has been used for years and years and years, and it sort of
gets there for \-- can find somebody that\'s not 500 miles away that can
verify your identity, in person. Whatever sense they\'re trusted or not.

**[\>\>]{.underline}**

Local health department or DMV, there\'s every community of a certain
size has some sort of \--

**[\>\>]{.underline}**

Notary on staff, the banks.

**[\>\>]{.underline}**

I think this raises that at least for me, that there may be a range of
acceptable identity proofing sort of trusted third party sources. But
the secure messaging piece, I\'m still \-- because I don\'t think
physicians would send \-- would enter into a clinical e-mail
relationship with somebody that they weren\'t treating if they hadn\'t
at least at some point physically seen. So I think it goes to what types
of identity and identity proofing is acceptable in other contexts and we
started to get to PHR, EHR. So it still doesn\'t take me away from
in-person with a provider.

**[\>\>\
]{.underline}**Again, we\'ve got a starting premise on the secure
messaging. I think we are having \--

\[multiple speakers\]

\-- whether we can make any recommendations beyond that secure messaging
environment. And I don\'t know the answer to that yet. I mean, I\'m
hearing \-- I\'m hearing a lot of hesitancy on the PHR side. Lot of
hesitancy may be that we more broadly define what in-person means rather
than in-person doesn\'t work.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

Can I ask a question in how does the online prescribing business happen?
Where I read an e-mail to somebody and get a Viagra or whatever it is.

**[\>\>]{.underline}**

I think more interested in getting your money than who you are.

\[laughter\]

**[\>\>]{.underline}**

Yeah.

**[\>\>]{.underline}**

I think your credit card number is what they\'re more interested in than
who you are.

**[\>\>]{.underline}**

It\'s not legal.

**[\>\>]{.underline}**

They\'re saying you have to have a valid prescription and I don\'t know
exactly how that is communicated. Because I\'ve never purchased
medication online, but \--

**[\>\>]{.underline}**

They have a physician who usually is employed by the company and you
submit like Web form and the physician \--

**[\>\>]{.underline}**

These are my concerns \--

**[\>\>]{.underline}**

You\'re medically approved.

**[\>\>]{.underline}**

They\'re diagnosing without seeing you?

**[\>\>]{.underline}**

Getting context over the Internet. I mean a prescription is issued for
that. So 1-800-CONTACTS and I have to type in my doctor\'s information
can they verify with the doctor who has identity-proofed me, giving me
new contacts.

**[\>\>\
]{.underline}**Does that happen in the \-- drug context?

**[\>\>]{.underline}**

It\'s required for prescriptions.

**[\>\>]{.underline}**

And it requires a check on the prescription. Doesn\'t require the
patient putting in. Sounds like in the drug context they don\'t do that.

**[\>\>]{.underline}**

Ophthalmology must be ahead of the game.

**[\>\>]{.underline}**

Their revenue depends upon it but they have an individual specific
product. Custom made for your eyes and your prescription and can only be
prescribed in person.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

As opposed to Viagra, which has many, many potential users.

**[\>\>]{.underline}**

Also all the same.

**[\>\>]{.underline}**

The spam guys aren\'t legal. They\'re acting illegally.

**[\>\>]{.underline}**

Are they drawing to you one of these sites that legal that requires you
having never responded one, I\'m saying, not really \--

\[laughter\]

**[\>\>]{.underline}**

Give them a call.

**[\>\>]{.underline}**

Its know, it\'s a public call.

**[\>\>]{.underline}**

I\'ve got to talk about something that couldn\'t apply to me. But as
Kirk says, neighbor could. Are they drawing you to a site where there\'s
a physician and doing some cursory review?

**[\>\>]{.underline}**

They argue that.

**[\>\>]{.underline}**

Okay.

\>\> The conversation about possibly identity proofing but maybe
"in-person" can mean many different things depending upon the context.
Maybe in some context like secure messaging I was hearing Alison say
it\'s important it be the physician, not just any in-person, any
in-person trusted source. Because that may be for other things like PHRs
that might not be feasible, and maybe there are other ways to do
in-person identity proofing and that maybe we could talk about different
approaches.

**[\>\>]{.underline}**

Also, is your concern about the in-person \-- the communication and
consent piece? Well, I think there\'s twofold. One that yes, that\'s a
process in the office that I think needs to occur so that patients
understand what it is they\'re about to engage in. I think the other is
that \-- which was raised by Deven and a number of other people. It is
highly unlikely that a provider is going to want to engage in secure
messaging with a patient with whom they don\'t have that sort of \--

**[\>\>]{.underline}**

Where I guess I was going with that, do we make the recommendation to
parts which is there needs to be a primary secure messaging account in
person, with the patient. Does that involve both the treatment issues
and the consent issues, and all of that stuff? But maybe something
different for the proxy?

**[\>\>]{.underline}**

Sure, as long as \-- as long as part of the process is signing on the
patient, is that they identify that proxy, then you know, I have \--

**[\>\>]{.underline}**

So I mean the reasons why support and in-person don\'t necessarily carry
over to the proxy themselves.

**[\>\>]{.underline}**

No, because I feel like the patient has had the chance to exert their
preferences.

**[\>\>]{.underline}**

I mean, that makes it a more nuanced recommendation.

**[\>\>]{.underline}**

The patient is a trusted source.

**[\>\>]{.underline}**

I wonder if we might go back to someone like Dr. Alterman that spoke
last week who has some experience with different levels before of
identification for different levels of security and ask if he has
knowledge or experience with non-in-person but secure kinds of
identifying processes or reliable identifying processes.

**[\>\>]{.underline}**

Yeah, we could just ask people how they do it now. Like how they
authenticate or identify proxies.

**[\>\>]{.underline}**

Well, that actually, the idea of asking people \-- we also have the
opportunity, I assume, to solicit answers to questions, rather than have
panels with testimony. Right? For example, we could reach out to various
people and get their experience in way that wouldn\'t require them being
one of the two panels we want to have on a day. Okay.

**[\>\>]{.underline}**

Questions and responses \--

**[\>\>]{.underline}**

Well, do we have to issue the questions publicly and allow anyone to
respond?

**[\>\>]{.underline}**

I mean that\'s a detail. We can figure that out. But I mean, what I\'m
saying, we have talked about a number of things we want to learn about.
We\'re not going to have 15 hearings between now and December. So if we
\-- if there are things, some of them that are precise and we can \-- if
we have precise sessions, you have a secure messaging system, what do
you use today, that might be something where the value is a one-page
letter back rather than 20 minutes of testimony. I think we can use that
as background research to bring in public sessions.

**[\>\>]{.underline}**

We are scheduled for about another 25 minutes, which includes some time
for public comment, although I don\'t know how much of that we will have
at this point. We also need to move from this discussion to a focus on
our next steps. So I guess my inclination is to maybe do the public
comment period and see what we have for a few minutes and then wrap up
and figure out our next steps. Do you know, Judy, do we have people
queuing up on the phone?

**[\>\>]{.underline}**

Matt can find out.

**[\>\> Matt McCoy:]{.underline}**

For members of the public that are following along, one more second,
you\'ll see a phone number on your screen to call in. If you would like
to make a public comment. And if we have members of the public who have
actually already dialed in to this conference you only need to press
star 1 on your phone.

**[\>\>]{.underline}**

We\'re going to \-- Matt, we\'re going to do one, is there only one in
the room? We have one in the room, why don\'t we do that while you\'re
queuing up others and then we can see \--

**[\>\>]{.underline}**

Okay.

**[\>\>]{.underline}**

There\'s a three-minute limitation on any comments from the public. Just
to be clear about that. All right. And if anyone is going to speak,
we\'d like you to give us your name and your affiliation, if any, and
then go ahead \--

**[\>\>]{.underline}**

That a mike or a speaker, too?

**[\>\>]{.underline}**

Okay.

**[\>\>]{.underline}**

Thank you. Christina Collins with the American Medical Association.
Great deal of interest, it\'s been fascinating to hear the robust
conversation that has been occurring here today. Very briefly, I would
like to offer the American Medical Association as a resource to you on
particular questions that you might have responses on. Certainly have a
wide variety of practitioners to be available to respond to you and any
questions you might have. Very briefly, if I could clarify on the
Internet prescribing, I know 1-800-CONTACTS, certainly is sort of a
vagary in the marketplace and they have a specific legal exemption that
permits them to drop or call them or e-mail them with your existing
prescription. And if they get your prescription, they then have an
opportunity to can\'t your optometrist. If they don\'t hear back within
eight hours, they deem that an invalid prescription. However, the point
that\'s critical is that it is valid prescription. And it gets to the
Internet prescribing issue, that is also predicated on a valid patient
physician relationship. And a number of the physicians have been hired
are facing disciplinary action or certainly opening themselves up to
liability. And disciplinary action by the State licensing board because
they\'re not prescribing through a valid physician-patient relationship.
I think that\'s \-- there\'s a critical issue and important issues
because they do hearken back to be what the central issue is on what
we\'ve seen as e-commerce or e-trade within the medical community. And
that is the valid compensating physician patient relationship. And what
has been so interesting is to hear that all of this, all of HIT, from
the relationship between provider, patient. And so as we\'re talking
about all of the things that may be available at some point in time
technologically for identification of patients, I would entreat you to
see what\'s really going on right now and in the patient care world.
Find out how physicians are already authenticating their patients and
how they\'re ensuring they are seeing the appropriate person. Because as
HIT moves forward, ongoing additional physician participation and
commitment to this issue, it is going to be essential that this work in
many ways off of what existing relationship with standards and practices
are. For example, on the patient authentication dealing with instant
messaging, it is going to be essential to realize that have an ethical
obligation to only deal in an existing physician patient relationship.
So I would ask to rook at the laws that physician resident currently
subject to and as well as their ethical obligations and formulating
policy decisions today. Again, happy to stand for questions and
certainly would like to serve as a resource if I can with any questions
as they emerge.

**[\>\>]{.underline}**

Thank you very much. Matt, is there anyone on the call?

**[\>\> Matt McCoy:]{.underline}**

No. If you would like me to leave the information up there and continue,
I can let you know if somebody jumps, but nobody is in the queue.

**[\>\>]{.underline}**

And they\'ve had a couple of minutes.

**[\>\> John McCauley:]{.underline}**

This is John McCauley.

**[\>\>]{.underline}**

Yeah, I guess that they dropped me in just because I mentioned I
happened to defend testify last week and I wanted to make a couple of
points of clarification because I \-- you know, and I\'m straddling a
HITSP technical commission so I\'ll make it very brief because a lot of
these ideas of proofing and authentication are and the standards, and I
certainly don\'t want to steer away from what Lee is mentioning, but I
don\'t want that to get lost in the shuffle, but a lot of these
standards of authentication and proofing are being vetted amongst
multiple vendors as well as well as some of the agencies and the
government like NIST and the VA, so I just, this work is in the midst
and I just strongly urge those of you that are making these critical
decisions to stay tapped into. That we\'re really working at a no-touch
proofing, and using more ubiquitous means to authenticate folks from a
more remote standpoint. That\'s my piece. I just wanted to reiterate and
I wanted to thank you all again last week for allowing me to participate
and contribute.

**[\>\>]{.underline}**

Okay, thank you very much. Matt, did anyone sign up while that was going
on?

**[\>\> Matt McCoy:]{.underline}**

No, they didn\'t.

**[\>\>]{.underline}**

Okay, why don\'t we \-- that I guess will conclude our public comment
opportunity. Why don\'t we spend a few minutes trying to wrap up.
Summarize, wrap up maybe, more than summarize. And then talk a little
bit about our next steps. We \-- I think it\'s fair to say that on
Steve\'s chart we talked about the first topic for the most part.

\[laughter\]

And that\'s okay, we had a very good discussion, I think that we
obviously focused on complexities to even one of the issues that seems
to be a little easier than some of the others. So I think that\'s been
very helpful in terms of moving us forward. I guess what I see as the
conclusion from today, and I certainly would be interested in people\'s
thoughts, is that we should push forward with a Part 2 of last week\'s
hearing, that might be a combination of questions going out to people
and actual testimony focused on the idea of identity proofing, starting
from the premise that in-person identity proofing will be a useful
component (indiscernible) a recommended component for secure messaging.
Maybe asking for testimony on pros and cons on that. But in addition
trying to explore how much we can push that out. Whether we can expand
that recommendation and that\'s if, whether we can expand that
recommendation, to include aspects of either EHRs or PHRs, and to really
focus on trying to make a recommendation related to in-person identity
proofing and just not sure how far that recommendation will go. Does
that \-- I mean, do people in the room and on the phone, does that \--
is that sort of consistent with what other folks were hearing today?

**[\>\>]{.underline}**

I would also probably put that in that we may want to in addition to
theorizing what our recommendation may be, is establish principles that
we want that recommendation to have like that the relationship needs to
exist or they need to present themselves into that, if that\'s what we
want to have part of the recommendation, I think that would probably be
useful to frame it. The procedural dimension.

**[\>\>]{.underline}**

All right. Any other \-- I mean, I guess my sense is that \-- and Jodi
I\'d be interested in your thoughts how it\'s going to tie in with the
AHIC and hearing from us. I mean, if we go down that direction, that
seems to me that\'s what we\'re really pushing towards as a single topic
for a recommendation. It may involve a number of components but a number
of components related to identity proofing, not covering \-- probably
not covering everything there is about identity proofing, but some
recommendation that\'s focused related to identity proofing that if we
have a hearing, you know, December 12, we can have recommendations
there, but probably not giving us an opportunity to touch on broader
topics.

Now, there\'s one other issue that\'s related to that which I will throw
out to see whether we can link it. There was some discussion last week
about if you do things \-- if you do in-person identity proofing, and if
that involves driver license, passport, there was some discussion, I
think, particularly in Pam Dixon\'s system and maybe some of the others,
about whether that identity proofing information goes into your records.
And I don\'t know whether we want to explore that point.

**[\>\>]{.underline}**

To me that gets into what\'s the process for identity proofing and then
what are the steps \-- the protocols surrounding what you do from there.
So I think that includes it. But maybe I\'m thinking of it \--

**[\>\>]{.underline}**

Not something that came up at all in the discussion, so if that\'s
something that we think \-- again, I could see moving towards a
recommendation that says something like don\'t put copies in the records
that \-- I don\'t know that we\'re going to get there but we probably
need to hear more about that topic in order to push that forward.

**[\>\>]{.underline}**

And I think related to the public testimony that we just received issues
to what goes on now with respect to how people prove who they are.
Because we\'re already presupposing there are some necessary documents
or photo ID that would need to be presented and I think that\'s a pretty
big leap and I would like to hear from immigrant groups about the photo
ID piece before assuming that is necessarily part of it. Especially when
you\'re talking about how the doctor-patient relationship or the
provider-patient rope gets formed, are those people all required to
present a form of ID that shows who they are? And if so, what photo. And
what forms of identification. We have a lot of patients who don\'t have
driver\'s license.

**[\>\>]{.underline}**

Or who need care and don\'t want to present that.

**[\>\>]{.underline}**

Exactly. And who would be shying away from care if they had to present
an ID to get it.

**[\>\>]{.underline}**

It\'s a public health problem.

**[\>\>]{.underline}**

We have to differentiate being this for care versus getting
authenticated or ID\'d to have secure messaging. As we start to public
it out to an EHR.

**[\>\>]{.underline}**

Maybe the way we bring that in is to talk \-- to figure out how that\'s
being done today, but also that may be a reason why we can\'t push that
recommendation out to EHRs or PHRs, I\'m not sure we get there but that
would be a hesitation. It seems to me at some point how do you identify
proof someone \-- everyone has a fingerprint \--

**[\>\>]{.underline}**

Not everyone has a fingerprint.

**[\>\>]{.underline}**

Or they\'re damaged, burned.

**[\>\>]{.underline}**

Yeah, there was one \-- the people that don\'t have fingers or a
driver\'s license, that\'s going to be a modest percentage certainly.

**[\>\>]{.underline}**

Right, but even under \-- without sort of talking about specific pieces
of identification, or even going down the biometric road, I would be
interested to know in the provider context. If we\'re limited to secure
messaging, a lot of these things come off the table. If we start to push
out to the other pieces, we do need to \--

**[\>\>]{.underline}**

It seems \-- let me rephrase what I was suggesting before to make sure
we\'re on the same page. My suggestion is the next hearing focus on can
we push it out beyond secure messaging. And maybe we need to test the
question of \-- I mean, we can do this after today, but a premise for
that is that we are moving towards a consensus that says in-person for
secure messaging. And I think we need to figure out if there\'s any
hesitations with that and frankly, I guess let me throw this out to the
group. I would be interested in hearing directly from any of the people
in the group, doesn\'t have to be on this call today, if anyone has
objections to that idea of a recommendation. Which would be at a minimum
a recommendation that talks about in-person for secure messaging.
Because if we do have issues with that, or there are people that have
concerns about that, I think we need to address that in the next hearing
as well. Absent that, and again I don\'t want to assume that, but absent
those concerns, that hearing should focus on whether that idea of
in-person can be broadened out to other contexts, involving EHRs and/or
PHRs. So and then we can start to talk about that. Now \--

**[\>\>]{.underline}**

Can I just ask you to clarify? The in-person provider ID \-- identity
proofing; that the provider or their designees, like administrative
staff, nurses, we\'re just talking about \-- someone who has some type
of provider office.

**[\>\>]{.underline}**

And then in-person proofing, are we \-- did we determine that means
going to the provider office, or can we also assume the provider or
their designee goes to the individual in.

**[\>\>]{.underline}**

Like in a nursing home situation where the individual doesn\'t leave the
institution, and the providers come there?

**[\>\>]{.underline}**

I guess we didn\'t talk about that. We talked about a little variation.
It seems to me that the provider needs to be \-- what we\'re saying is
the provider needs to do this face-to-face. Or someone who works with a
provider. The proxy question, and the trusted third party is \-- was the
other spin on that. But that\'s not your question. I don\'t think
you\'re going to make a nursing home patient get up and go to the doctor
office when the doctor comes to town.

**[\>\>]{.underline}**

For in-person we just meant in person wherever it happens. Just in
person.

**[\>\>]{.underline}**

I mean, that\'s my sense. Does anyone have a different view on this?

**[\>\>]{.underline}**

Yeah, did \-- maybe I keep plucking the same string but I\'m still
separating the difference between having an in-person, you called it
physician-patient relationship, which I do think is important, with the
identity proofing part. That the doctor doesn\'t necessarily have to be
doing that himself. Or herself. I mean \--

**[\>\>]{.underline}**

Well who \-- the only \-- I mean, you\'ve raised this trusted source
idea. I don\'t hear \-- I don\'t think we\'re there yet. We may get
there. I don\'t think that\'s part of where I\'m starting with the
secure messaging. I don\'t think it has to be the doctor versus the
administrative assistant who works in the doctor\'s office.

**[\>\>]{.underline}**

I don\'t care about that.

**[\>\>]{.underline}**

Then I\'m not sure what your point is.

**[\>\>]{.underline}**

Finish up.

**[\>\>]{.underline}**

You have to come in person to establish the relationship. But it\'s not
clear to me you have to come in person to do \-- I mean, you have to
somehow show \-- the doctor I\'m saying the doctor doesn\'t have to
initiate the identity proofing. The doctor just has to authenticate you
that \-- and create accomplish an in-person relationship because you
couldn\'t \-- you could have done the other identity proofing of some
third party.

**[\>\>]{.underline}**

I don\'t hear that being what everyone else is saying.

**[\>\>]{.underline}**

Again, one of my questions was, to we have people that are not \-- I
don\'t want to presume we\'re unanimous on this at this point. I think
where everyone else was we\'re talking about \-- well \--

**[\>\>]{.underline}**

That\'s the open question I asked people to communicate with me directly
is do we need to address the question \-- again, starting point
recommendation being in person in order to identity-proof or \-- for
secure messaging. If there are people that think we need to still debate
that, I want to hear about that so we can make sure that\'s covered in
the hearing.

**[\>\> Lorraine Doo:]{.underline}**

Jodi or Kirk?

**[\>\>]{.underline}**

Yes.

**[\>\> Lorraine Doo:]{.underline}**

This is Lorraine Doo. How do you do?

**[\>\>]{.underline}**

Hi, Lorraine.

**[\>\> Lorraine Doo:]{.underline}**

Hello. And I wanted to put in just a thought after listening today, and
again, it\'s a new group. It is feeling a little prescriptive to me from
the standpoint of making these kinds of recommendations. And a little
bit different than what the other Workgroups were doing. And I don\'t
know if that\'s your charge. But to begin to say how organizations
railroad tools should be doing their business, makes me a little bit
concerned because standards and technology are moving at very different
speeds. And so this is a bit of cause of concern for me, from the
standpoint of making that level of operational recommends.

**[\>\>]{.underline}**

And can you \-- can you say a little more Lorraine, give an example of
what \--

**[\>\> Lorraine Doo:]{.underline}**

Well, to say that one must to in-person authentication is an operation.
And that\'s prescriptive to say that in order to have a PHR tool or an
EHR tool, then you must do your authentication this way, and that again
feels like it isn\'t making enough allowances, particularly because
there\'s so much more work that\'s going to be going on \--

**[\>\>]{.underline}**

Lorraine, I don\'t know if you\'ve been on the whole call. The specific
focus that we\'re talking about is twofold. One is, I think the group
\-- again subject to people letting me know differently. On secure
messaging only, we\'re talking about in-person identity proofing.
Period. The hearing will then explore whether we can say and make
recommendations broader than that, on other means of identity proofing.
We have heard already from CMS that if you\'re going to \-- if a
recommendation were that PHRs and EHRs have to be set up in-person
identity proofing, that CMS has concerns about that. And so that\'s \--
we\'re going to want to hear about that. And what I hear you saying in
your example was we may not be able to go beyond secure messaging.

**[\>\> Lorraine Doo:]{.underline}**

Well, it\'s more actually the roles of the groups and we can talk about
it offline, as I was able to listen to most of the call today. It\'s
more the prescriptiveness, so even if it\'s for secure messaging, for
example. And again, I don\'t know if you\'re supposed to be giving a
list of recommendations for different means of doing it. You know, for
any of these projects, if you will. So let\'s say for each of the use
cases that we\'re working on. It has the feeling to me of being very
prescriptive.

**[\>\>]{.underline}**

And so for example, let\'s \-- just on this topic. What would be \-- can
you give an example of a flavor of recommendation that you think is \--
makes more sense from your perspective? Because \--

**[\>\> Lorraine Doo:]{.underline}**

Well, not \-- you know, not having had a lot of time to think about, it
because it\'s all just come up today, I guess the more kinds of general
guidance that we\'ve given on having appropriate policies and procedures
that will protect in such a way that you do X, Y, or Z. And I\'m
certainly willing to think about it more and to give some
recommendations. But I think organizations and providers and anyone
involved in this deserves a little more flexibility in how they do it if
it meets certain criteria. One of the things we could think about is the
criteria for what we think provides appropriate security for secure
messaging if that\'s the issue of the day.

**[\>\>]{.underline}**

Okay.

**[\>\>]{.underline}**

Yeah, okay. Thanks, and maybe we should talk some more. Some concerns
about the potential recommendation putting on the table. We\'ll talk to
you more and get more input on your \--

**[\>\>]{.underline}**

We did hear from Dr. McCauley and we could hear from others presumably
who are in favor of something that doesn\'t require in-person. And maybe
all we need is for the doctor to be assured, however that happens. You
know, whatever level of assurance, whatever the level of assurance, the
doctor has to be sure before the doctor engages in a secure messaging
relationship with an established patient.

**[\>\>]{.underline}**

Can I get in the discussion. I have a few minutes left and I want to
talk specifics and make sure while we have everybody together that we
have a plan for how we\'re going to have a hearing and any kind of
followup or whatever. Right now we have on the calendar a meeting for
November 2, from 1:00 to 4:00, I believe. Which is not an all-day
hearing. We can expand that to be an all-day hearing if that\'s what
I\'m hearing from folks that it sounds like there\'s desire from
testimony and hearing, even in a full day people only want to have two
panels. We may be able to try to schedule another call like. This maybe
we can have people come and talk at a shorter meeting or present
information in advance, and not necessarily present in person.

Just want to get a sense about people\'s schedules and whether we should
expand that meeting time. If there are other times we should try to
schedule another meeting. We have potential \-- policies, we have to put
notices in the *Federal Register*. If we\'re going to have other
meetings, we have to know now so we can schedule them. We can always
cancel them if we decide we don\'t need them so. I\'m going to turn to
you as far as any possible options \-- and I\'d like to hear input from
folks about more time together to discuss it, because I\'m hearing from
people that we still have a lot of thinking \-- testimony to hear, and
issues to resolve.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

One of the key issues seems to me is whether \-- and again, I think we
need to figure this out in the next couple of days. Whether we have
significant questions in the secure messaging context from people on the
Workgroup about that recommendation, about in-person. So we need \-- if
we need to hear testimony or get more information on that particular
issue, we got to focus attention on that. I think obviously the EHR/PHR
one will be much harder. Hearing what the discussion was today, I would
\-- I guess I\'m skeptical whether we\'re going to, in the next couple
of weeks, broaden out that in-person recommendation. But I\'m agnostic
on that at this point.

**[\>\>]{.underline}**

I want to point out you haven\'t gotten to all the \-- since we have
this topic we started on and mostly talked about the first topic, you
may want to flesh out those other ones. Which is why \--

**[\>\>]{.underline}**

I\'m feeling the need for more time together. And put options on the
table that people can react to.

**[\>\>]{.underline}**

Maybe the concern is the wording of the recommendations. Because you
mentioned earlier, Jodi, that it would be possible to make a little
less, you know, written in stone. And I think that we could probably
work with that, but one thing that I would like to learn more about,
when you have in-person identity proofing in a provider office, what are
the steps that you go through currently and maybe from that we can
recommend a set of issues or topics or procedures at the front end and
then at the back end. And I don\'t know if that fleshes out our
recommendation any.

And then, I sort of wonder if by November 2 is it realistic to have a
full panel? Are we giving people enough notice to do testimony?

**[\>\>]{.underline}**

Well, put it this way. I think if we were to do that in the next week
or, so we\'d actually be ahead of where we were with the last series.

**[\>\>]{.underline}**

That\'s not a recommendation for how to do things.

**[\>\>]{.underline}**

I understand that. But it\'s also not we can\'t do it.

**[\>\>]{.underline}**

So \-- I am going to turn to Judy to give us any options we have as far
as possible in time. There are some limits on that.

**[\>\>]{.underline}**

We could probably have a call meeting on the 27th of October, and
that\'s given the \-- you know, the *Federal Register* notification
strictures, and then the week of November 13 is pretty much open. And
then also the November 2 meeting.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

To expand the time on that one.

**[\>\>]{.underline}**

And what happens, the AHIC meeting in December is on December 12, which
means we would probably have to have everything kind of wound up by the
end of November In order to get the materials to the AHIC members.

**[\>\>]{.underline}**

Got changed.

**[\>\>]{.underline}**

Yeah.

**[\>\>]{.underline}**

Yes, as far as announcements, the next AHIC meeting is October 31.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

The one after that is December 12. All the other workgroups are on the
agenda for October 31 other than this one. We are tentatively on the
agenda for December 12. And the other announcement I wanted to make is
that there is the NHIN forum focusing on security. Some similar issues
that we\'re talking about, so it\'s open to the public, it\'s October 15
and 17 in D.C. You can sign up for it, I don\'t know if there\'s a
charge. You can sign up for it on our Website at www.hhs.gov/healthit,
you\'ll see on right a place where you can get information and sign up.
So if Workgroup members want to hear more discussion on this, it should
be a really interesting discussion in that day and a half from both
technology folks and policy folks on some of these security issues. So
encourage folks to attend and actually Paul Feldman and I are on the
agenda to give an update on what we're doing and what issues we\'re
looking at. So encourage to you attend. I think you were out of town.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

Okay, well, good, why don\'t we wrap up there. Again, I\'d be interested
in hearing directly from any individuals if you have particular concerns
about this. Only the secure messaging part of that recommendation. Also,
if you have other thoughts and suggestion is, on any other pieces,
certainly be interested in hearing it.

**[\>\>]{.underline}**

I think to hear back, if they want to try to meet on the 27th of
October, and \--

**[\>\>]{.underline}**

Maybe what we\'ll do is keep what \--

**[\>\>]{.underline}**

Okay, we\'ll try to talk with the co-chairs and figure out what may be
\-- may work and we may try to poll folks offline and ask folks about
availability and interest in adding some meetings or expanding that
meeting time.

**[\>\>]{.underline}**

If you put that November 2 on your calendar.

**[\>\>]{.underline}**

And that one is \--

***[\>\>]{.underline}***

It\'s already been assigned. Is I think the feature like a list type
polling thing instead of sending out a calendar appointment, I could
send out a check box and vote, I\'ll send out a vote.

**[\>\>]{.underline}**

You only have four days to get it in the *Federal Register* if you want
to have the meeting on the 27th. Either decide now or whatever.

**[\>\>]{.underline}**

Okay. So we\'ll be in touch offline by yes, ma\'am, to figure out the
schedules. And Paul we\'ll talk off line, and if it needs worked out
we\'ll try to add more time to flesh some of this stuff out. If folks
have any input on what\'s been included in the hearing or more
information that we can get for background or anything else, let us know
off line.

**[\>\>]{.underline}**

All right, thank you very much, everybody. That\'s it. That concludes
our meeting for this afternoon.

**[\>\>]{.underline}**

Thank you.

**[\>\>]{.underline}**

Thank you.

**[\>\>]{.underline}**

Bye-bye.