# American Health Information Community

# Confidentiality, Privacy, and Security Workgroup

# 

# Summary of 6th Web Conference of this Workgroup

# Monday, November 13, 2006

## PURPOSE OF MEETING

The primary purpose of the meeting was to review and refine the draft
recommendations on identity proofing.

## KEY TOPICS

### 1. Acceptance of the Summaries of the September 29 and October 16 Meetings

The process for the production and distribution of meeting summaries was
clarified. The entire proceedings of Workgroup meetings are transcribed.
A summary of meeting highlights and decisions is prepared by a
contractor, and reviewed and corrected by the Office of the National
Coordinator (ONC) staff. Then the summary is distributed to members.
Members were asked to review the summaries of the September and October
meetings, which were distributed November 9, and to e-mail any
corrections and additions to the staff. These meeting minutes were
approved by the workgroup.

### 2. Workplan Preparation

Co-chairs and staff members have been working on a workplan. The other
Community workgroups have undertaken a priority-setting process. The
Confidentiality, Privacy, and Security (CPS) Workgroup needs to have a
mechanism to identify its progress. There is also a need to coordinate
scheduling with the Community. For the immediate future, the CPS
Workgroup will continue to focus on its specific charge, which is to
consider the CPS issues raised by three other Workgroups.

It was noted that insofar as the Workgroup's role is to react to issues
raised by the other Workgroups, a planning horizon of less than 1 year
may be appropriate. The Workgroup likely will continue to focus more on
policy issues rather than those of a technical nature. The Co-chairs
asked members to review the draft recommendations, to think first about
what the Workgroup should do next and then about a broader plan, and
finally to suggest topics to address in the longer term. Suggestions
should be sent to the staff by November 20. The staff will work with the
Co-chairs to prepare a workplan for submission to the Community prior to
the December 13 meeting.

It was mentioned that Health IT Standards Panel is waiting for policy
guidelines before delineating security and privacy standards. It would
be helpful for the Workgroup to have access to the issues enumerated by
the technical committees. This information would help to focus the
workplan.

##### Staff Action Item #1: Receive and incorporate members' suggestions into the workplan, review and finalize the workplan with the Co-chairs, and submit it to the Community.

### 3. Identity Proofing Recommendations

The most recent version of the draft identity proofing recommendations,
prepared by the staff and Co-chairs, was circulated to Workgroup members
on November 11. The group's discussion was expected to focus on
Recommendation #2, which had been added to an earlier version on the
basis of the discussion at the previous meeting; however, members sought
discussion of and suggested changes to the entire document.

During the discussion of the introduction section, several points were
made as members reached agreement that the recommendations constitute
minimum expectations. There is a difference between the Health Insurance
Portability and Accountability Act (HIPAA) privacy rule, which sets a
floor, and the HIPAA security rule, which arguably does not spell out a
floor because of scalability issues. There are no regulations requiring
physicians to increase communications with patients or engage in secure
messaging. The Workgroup is trying to create an environment conducive to
the increased use of secure messaging. Recommending that organizations
conduct a needs assessment would constitute a barrier for many
organizations.

Members agreed to incorporate language that the Workgroup's
recommendations pertain to a floor or minimum expectations or standards
and that where the recommendations suggest flexibility, organizations --
including providers -- should examine their own environments and
situations. Members agreed to add the Community's definition of identity
proofing to the document. One member suggested adding that the risk to
be avoided is identity theft. Members agreed that the document should
*not* convey the message that organizations may select procedures below
the minimum acceptable level.

Next, the group considered the draft "general statements" section. A
lengthy discussion ensued as to whether a statement should read "all
health data," "all personally identified data," or some variation of the
two phrases. It was agreed to add language that all data should be
considered sensitive, "contemplated to be used in any of the three
breakthroughs described herein."

During deliberations on Draft Recommendation #1, one member suggested
that Future Discussion Recommendation (FD) #1 be integrated, but it was
eventually agreed that Recommendation #1 should stand alone. The group
discussed numerous examples of documentation for identity proofing and
the extent to which such information typically would be a part of the
clinical record. It was eventually agreed that Recommendation #1 should
say that any document (or copy thereof) used solely for the purpose of
identity proofing should be, if maintained, stored in a secure manner
separate from the individual's clinical data.

The group recognized that the issue of how identity proofing information
is to be stored must be considered at a future date.

The group accepted #3 as drafted: *Converting from a paper-based
practice to one that uses EHRs should not require a health care provider
to identity-proof their patients. However, when presenting data to
patients from an EHR (such as via flash drive, Internet, or remote
access), health care providers should follow the identity proofing
recommendation schema noted in Recommendation #2.*

Members agreed to add "secure messaging" to Recommendation #4 (*All who
provide personal health information to patients via a PHR (such as via a
flash drive, populating data records stored on the Internet, or remote
access) should follow the identity proofing recommendation schema noted
in Recommendation #2*). They agreed that the phrase "as well as
underlying compliance with existing regulatory and statutory
requirements" was unnecessary and could be deleted from #5 (*The
Certification Commission for Healthcare Information Technology (CCHIT)
should ensure that criteria for the certification of health care systems
support the identity proofing practices suggested in these
recommendations as well as underlying compliance with existing
regulatory and statutory requirements*).

The Workgroup considered whether FD#1 should become Recommendation #6.
Members agreed that it was one of many topics for future consideration
and should be reflected in the workplan. But because other future topics
were not being listed in the recommendations, they agreed to delete FD#1
(*Given that the health care community is comprised of many affiliated
organizations and each may depend on identity proofing performed
elsewhere, the establishment of a consistent identity trust model is
necessary. The CPS workgroup recommends that further work be performed
on distributed identity architectures and trust establishment
procedures)* from the recommendations.

The group turned to the consideration of Recommendation #2, which had
been newly drafted as a result of discussions at the previous meeting.
In a response to a question about the reasons for an explicit reference
to secure messaging, personal health records (PHRs) and electronic
health records (EHRs) in the recommendation, staff members noted that
these are the three areas identified by other workgroups as requiring
work on CPS. Several members suggested expanding the reference to
include "electronic communications." Another line of thought was that
the reference to secure messaging, PHRs, and EHRs should be moved to the
introduction or general statements. They eventually agreed to retain
"secure messaging, EHR and PHR" in #2 as well as to add clarifying
language to Recommendation #1 and the general statements.

Recommendation #2 sets forth four versions or methods (R-1 through R- 4)
of identity proofing, arranged in order of preference. They are not to
be viewed as a menu of equally appropriate options. Members agreed that
in-person proofing is the preferred (and possibly the only acceptable)
method for the patient-clinician context. Members considered the need
for specifying the qualifications of the person who carries out identity
proofing (for instance, the clinician, the office clerk, or the clerk
from the temp agency). Although identity theft might be a risk, the real
issue is that the clinician is communicating with the patient that she
has seen and is treating.

In-person verification of a government-issued ID may be the best method
of identity proofing, but members discussed concerns about undocumented
persons. It was noted that the recommendations deal with identity
proofing for secure messaging, PHRs and EHRs, but not as a requirement
for receiving health care. An undocumented patient may not be able to
receive secure messaging, but this should not affect access to care.

Institutions reportedly are expressing concerns about being able to
identify and authenticate patients as well as sharing information based
on identity proofing by other organizations. Members cautioned against
an identity proofing process so onerous that it presents a barrier to
communication via the three methods.

Members eventually agreed that #2 R-1 reference a current, valid,
government-issued ID, with examples to include a passport or driver's
license issued by the United States or another government. Members
agreed not to include the Federal I-9 as an example, given its
sensitivity in immigrant communities. They discussed the possibility of
recommending that providers make alternative means available when
government issued IDs are not available, such as in the case of lost or
out-of-date documents.

Recommendation #2 R-2 was accepted as drafted (*A provider/entity
willing to attest to the patient's identity on the basis of a known,
established, and durable relationship through in-person confirmation,
telephonic recognition, or some other means (e.g., faxed signature)*)
with minor changes. However, there was not sufficient time to reach
consensus on R-3 and R-4. Of particular concern was the need to agree on
the standards for first party identity proofing before delineating the
role of any third party. The Co-chairs and staff members will attempt to
revise the recommendations and distribute them to the Workgroup for
comment and agreement.

##### Staff Action Item #2: Incorporate the agreed-upon changes into another draft of the recommendations, and work with the Co-chairs to revise #2 R-3 and R-4 and distribute to members for agreement prior to submission to the Community.

### 4. Next Steps

See staff action items. The date of the next meeting was not announced.

### 

### 5. Public Comments

No member of the public asked to speak.

### 6. Adjournment

The time allocated for the meeting having expired, the meeting adjourned
at 4:05 p.m.

## SUMMARY OF RECOMMENDATIONS AND ACTION ITEMS

The Workgroup considered and refined draft recommendations on identity
proofing. The recommendations were not finalized.

##### Staff Action Item #1: Receive and incorporate members' suggestions into the workplan, review and finalize the workplan with the Co-chairs, and submit it to the Community.

##### 

##### Staff Action Item #2: Incorporate the agreed upon changes into another draft of the recommendations, and work with the Co-chairs to revise #2 R-3 and R-4 and distribute to members for agreement prior to submission to the Community.

### Meeting Materials:

Agenda

Summary of September meeting

Summary of October meeting

Draft Recommendations

Posnack's Comments on Draft Recommendations

**[Confidentiality, Privacy and Security Workgroup Members and Designees
Participating in the Web Conference]{.underline}**

**[November 13, 2006]{.underline}**

[Attendees]{.underline}

Kirk Nahra Wiley Rein LLP

Paul Feldman The Health Privacy Project

Jodi Daniel ONC

Peter Basch MedStar e-Health

Zinethia Clemmons DHHS, Office for Civil Rights

(for Susan McAndrew)

Steven Davis Oklahoma Department of Mental Health and

Substance Abuse Services

Jill Callahan Dennis Health Risk Advantage

Flora Terrell Hamilton Family and Medical Counseling Service, Inc.

Elizabeth Holland Centers for Medicare & Medicaid Services

(for Tony Trenkle) (not able to be heard until the public comment
period)

John Houston University of Pittsburgh Medical Center, and

National Committee on Vital and Health Statistics

Sam Jenkins TRICARE Management Activity, Department of

Defense

Deven McGraw National Partnership for Women and Families

Allison Rein National Consumer League

Paul Uhrig SureScripts

Thomas Wilder America's Health Insurance Plans

**Disclaimer**

*The views expressed in written conference materials or publications and
by speakers and moderators at DHHS-sponsored conferences do not
necessarily reflect the official policies of the DHHS; nor does mention
of trade names, commercial practices, or organizations imply endorsement
by the U.S. Government.*