# American Health Information Community

# Confidentiality, Privacy and Security Workgroup

# 

# Summary of Web Conference Held October 6, 2006

## Introduction of Meeting Participants

Kirk Nahra, Co-chair for the Confidentiality, Privacy, and Security
Workgroup, welcomed members to the call. The goal was to discuss the
hearing last week, which covered identity proofing and authentication.
Workgroup members received a summary chart of the testimony. The
discussion will focus on specific issues of interest, topics where more
information is needed, conclusions that can be drawn from the testimony,
and preliminary thoughts on drafting recommendations.

Before this discussion, however, there was one presentation that was
rescheduled from last week.

## Health Information Technology Standards Panel (HITSP) Presentation

LeRoy Jones, Principal at GSI and HITSP Program Manager, stated that
HITSP was formed by the Department of Health and Human Services (HHS)
Office of the National Coordinator for Health Information Technology
(ONC) to select a set of standards to achieve widespread
interoperability among health information technology. Since September,
they have worked through three different use cases from the American
Health Information Community (AHIC) breakthrough areas, both to choose
from a field of applicable standards that satisfy the use case and to
describe exactly how those standards might be used. In selecting
standards to ensure interoperability, they decided on an iterative
approach, focusing first on the nature of the information that needs to
flow to satisfy those use cases so that different applications can be
interoperable with one another. As the Panel now turns its attention to
the next iteration, each of the technical committees that prepared the
interoperability specifications for the use cases are more knowledgeable
and better prepared to collaborate on the cross-cutting issues around
security and privacy. Their task will be to identify areas within the
security landscape that have significant degrees of freedom so that
their standards selection will be compatible with various laws,
policies, and architectures.

Given that the various parameters in the security landscape will take
time to normalize, HITSP seeks to identify standards that can
accommodate decisions beyond the scope of their use cases. For example,
concerning patients' participation in information sharing, there is
debate over whether patients need to "opt in" or "opt out" of a
data-sharing paradigm. HITSP does not endorse any particular viewpoint
in these debates. They seek to identify and prescribe the use of
standards that will not preclude different paradigms from being
operationally implemented. This can be a "slippery slope." They will
select among competing ideas; however, they do not want those competing
ideas to overstep the Panel's boundaries and preclude certain
architecture, laws, and policies.

Their approach will be to reexamine the requirements laid out by each
use case, to select areas in which progress can be made, and then to
augment or potentially to develop new interoperability specifications.
Their ultimate deliverables are specifications that include the
selection of the standard, the context in which it is used, and detailed
instruction for its use. They have an October 20 deadline to finish the
amendments and finalize interoperability specifications from the
previous year. After that date, AHIC will inform them about their
charge, and they will begin planning for next year's efforts. In
parallel with their work on privacy and security issues for the existing
use cases, they will form a committee to examine the implications of
privacy and security across all of their interoperability
specifications, as well as to infuse those ideas into the standard
developing organizations (SDOs) that comprise their board and partners.

### Questions

Asked how the operations of HITSP and this Workgroup can interweave
without overlapping, Mr. Jones commented that HITSP is in its formative
stage. They had to build their processes while completing their
deliverables for the first year. This year they will be more focused on
developing relationships and building alliances. HITSP does not develop
standards and does not have the infrastructure to take on the more
substantive issues. Rather, they want to leverage the activities of
other groups, as they did with SDOs in harmonizing standards. Therefore,
while there has not been any explicit plan on how HITSP will work with
this committee, they are open to discussion. Mr. Jones stated that there
still is an opportunity for the two groups to educate one another about
their activities and to determine the best way forward.

Concerning the new security committee, Mr. Jones replied that over the
course of their work last year, one committee published a short white
paper on the foundational issues of standards harmonization and ways for
HITSP to be proactive instead of reactive. Last year, they took the
standards developed by other organizations and built integration around
it; in the future, they would like to instead influence SDOs so that
what they produce is naturally compatible. This paper was deferred until
after the interoperability specifications were completed, and they are
just now addressing the lessons learned. Security was identified as one
of these foundational issues of standards harmonization, and the
committee has not been formed yet. Allison Rein added that a message
will be sent out through HITSP channels soliciting interest in this
committee, and then there will be a vetting process to determine
membership. She also added that this committee is not intended to
address policy issues, but rather to select standards with respect to
areas where security and technology issues intersect.

## Workgroup Discussion and Debrief from the September 29, 2006, Hearing

Mr. Nahra asked the Workgroup members for general comments on the
hearing:

-   While the testimony was interesting and useful, it would have been
    helpful to focus more on the use cases.

-   Although there was time for questions to each panel, it would have
    been helpful to have time for Workgroup discussion immediately after
    each panel.

-   Because the kinds of privacy and security issues are the same across
    the breakthroughs, it was not useful to organize the panels by
    breakthrough area.

-   While they did hear good background information on what businesses
    are doing to address these concerns, they did not hear enough
    feedback on what actions the AHIC should take.

The ONC staff prepared a summary of the testimony from the hearing. The
first section is a working list of main themes. The second section
presents a chart of specific testimony that was heard on each issue, the
options to address those issues, and the pros and cons of the different
approaches. For example, testimony was heard on identity proofing
techniques, which included in-person and online methods. The other
issues on the chart include identity proofing governance, identity
management and user authentication, risk assessment and level of
assurance, government involvement, implementations, and common process
development. This chart was provided as a reference tool while going
through the discussions.

The Workgroup first discussed any changes to or issues that are missing
from the chart:

-   Each issue may need to be segmented by population -- patients, users
    of system, or strangers trying to break in.

```{=html}
<!-- -->
```
-   For issues applicable to more than one breakthrough area, each
    approach should specify which one it addresses. There may not be a
    consistent approach to all three breakthroughs.

-   This list of "pros and cons" is limited to what was heard during the
    testimony. There may be others to add based on Workgroup members'
    experiences.

-   More testimony from the financial services industry could be helpful
    to determine if this sector could serve as a good model for health
    care. Some witnesses stated that it is a good model, because it
    deals with a large volume of data; others stated that it was not a
    good model, because the industry is more concerned about
    authentication than identity proofing.

-   Identity proofing and authentication are being treated as separate
    issues; however, there may be times when this distinction becomes
    blurred.

-   More discussion is needed on the scalability of different solutions,
    in particular in-person identity proofing.

-   When scalability prevents in-person identity proofing, trust becomes
    the key factor. An organization will have to rely on the identity
    proofing done by another credentialing organization.

-   The issues of timing may determine what is feasible. When a system
    is phasing in a transition to electronic health records (EHRs), it
    is possible to identity-proof and authenticate each patient as they
    present for an encounter. When a system is converting all files at
    the same time, it may be necessary to rely on historical proofing.

-   Authentication of proxies also needs to be considered.

The following issues were raised about developing recommendations:

-   The Workgroup is under pressure from the AHIC to develop
    recommendations that can be implemented for the other Workgroup
    breakthroughs. They started with identity proofing and
    authentication because they were considered to be more discrete than
    other topics, and there is leeway about what issue to take on next.

-   The recommendations do need to have some specificity but can leave
    room for alternatives if the situation warrants.

-   The Workgroup will prepare a series of recommendations for the AHIC.
    It is possible to develop a recommendation that states that the
    group favors an approach but needs to continue soliciting input. In
    this regard, speed should not outweigh usefulness.

-   Recommendations may need to include a "calculus" for what approach
    will work most of the time; for example, if an approach will work 90
    percent of the time, it is still useful as a recommendation.

The Workgroup then turned to considering identity proofing for each use
case individually, starting with secure messaging (SM). Workgroup
comments included the following:

-   The difficulty of in-person identity proofing seems much lower for
    SM than for the other breakthroughs.

-   SM occurs in the context of an ongoing doctor-patient relationship,
    as opposed to a one-time or an initial inquiry.

-   Medical advice given over SM raises other issues, such as including
    that information as part of medical record, compensation for
    physician's time, etc. This group will narrow the focus to
    confidentiality, privacy, and security issues only.

-   If SM is linked to a personal health record (PHR) or EHR, there may
    need to be an increased level of identity proofing and
    authentication. Other issues, such as using the same password for
    access to a PHR and to SM, need to be examined.

-   The validity of in-person identity proofing procedures might need to
    be more closely examined. One speaker at the hearing stated that
    patients sign a consent form in the office and then a user name and
    password is mailed to them. It was unclear whether this was an extra
    measure of security or an administrative procedure. Others commented
    that most procedures currently in place are done by the front office
    staff, not the physician.

-   For chronic care patients, it may not be possible for the patients
    to travel to the provider's office to initiate SM. In this case, the
    physician's familiarity with the patient may serve as a preliminary
    identity proofing method until in-person validation is possible.

-   Procedures for in-person identity proofing may need to include sign
    up procedures for authorizing proxies.

-   In-person identity proofing may not have to be limited to the
    doctor's office; it also may involve a trusted source.

-   The patient in an established relationship who cannot authenticate
    until the next visit may constitute the 10 percent share of cases
    for which this method does not work; however, there may be 90
    percent of cases for whom in-person identity proofing is the most
    reliable method.

Mr. Nahra proposed that the group move towards a recommendation for
in-person identity proofing for SM. More information may need to be
gathered from testimony before the group is ready to expand that to PHRs
and EHRs.

Regarding in-person identity proofing for PHRs or EHRs, the Workgroup
had the following comments:

-   For PHRs offered through the health insurance plan, identity
    proofing already has occurred in terms of the process of being hired
    and receiving insurance benefits. Therefore, using the insurance
    identity card number to initiate a PHR would be an example of using
    a trusted source.

-   Vendor-sponsored PHRs or the individual insurance market may present
    challenges for involving third-party sources for identity proofing.

-   For SM, a physician is not going to enter into that relationship
    with someone whom they have not seen before as a patient. The
    hesitancy to expand this recommendation to EHRs and PHRs may mean
    that in-person methods need to include a range of trusted sources.

The group felt that it might be useful to seek more information from Dr.
Alterman, who spoke last week, about his experience with secure identity
proofing processes that are not in person. Ms. Daniel stated that this
information could be transmitted as written background research instead
of oral testimony.

## Statements from the Public

Christina Collins, from the American Medical Association, offered the
Association as resource for this group. She clarified a comment on
internet prescribing. Contact lens providers have an exemption that
permits consumers to mail, call, or e-mail a prescription; the provider
then contacts the prescribing optometrist, who has to respond within 8
hours for the prescription to be deemed valid. Internet prescribing is
predicated on a valid patient-physician relationship. A number of
physicians who were hired by online vendors are facing potential
liability and licensure issues. Dr. Collins urged the Workgroup to find
out how physicians are already authenticating patients and ensuring that
they are seeing the appropriate person. As HIT moves forward, it will be
essential to build off existing standards of practice. Additionally, for
physicians, patient authentication dealing with SM will be subject to
ethical obligations.

John Macaulay, who sits on a HITSP technical commission, stated that
many of these ideas about proofing and authentication standards are
being vetted among multiple vendors and agencies. They are working on
no-touch proofing and other means to authenticate consumers from a
remote standpoint. He urged the Workgroup to stay abreast of this
process.

## Wrap-up and Next Steps 

The Workgroup discussion focused mostly on the first topic on the
summary chart. Mr. Nahra stated the conclusion from this meeting is to
move forward with the second part of last week's hearing. This may
require a combination of questions and testimony, starting from the
premise that in-person identity proofing is useful for SM and exploring
how to include aspects of EHRs and PHRs. In addition to the
recommendation, the group may establish principles, such as a clinical
relationship needs to exist prior to SM. There also may need to be
further discussion before the group can reach consensus regarding
related issues, such as identity proofing procedures and not co-mingling
identity information with the medical record.

Mr. Nahra encouraged the Workgroup members to communicate with him
regarding any questions or concerns about a recommendation for in-person
identity proofing for SM. Lorraine Doo expressed concern that this
recommendation may be too prescriptive, that organizations may deserve
more flexibility in how they meet a criteria. The group will continue
this discussion during the next meeting.

The next meeting for the Workgroup is scheduled for November 2, from
1--4 p.m. Jodi Daniel also provided possible times for additional
meetings. The next AHIC meetings are October 31 and December 12. To
include materials for the December meeting, they would need to be
finalized by the end of November.

## Adjourn

Mr. Nahra thanked participants and adjourned the meeting at 2:05 p.m.

**Confidentiality, Privacy and Security Workgroup Members and Designees
Participating in the Web Conference**

**October 6, 2006**

*Attendees:*

Kirk Nahra Wiley Rein & Fielding LLP

Jodi Daniel ONC/HHS

Cindy Tanenbaum MedStar e-Health

(for Peter Basch)

Jill Callahan Dennis Health Risk Advantage

Steven Davis Oklahoma Department of Mental Health and

Substance Abuse Services

Elizabeth Holland Centers for Medicare and Medicaid Services

(for Tony Trenkle)

Sam Jenkins TRICARE Management Activity, Department of

Defense

Susan McAndrew HHS Office for Civil Rights

Allison Rein National Consumer League

Dennis Seymour Veterans Health Administration

(for David McDaniel)

Deven McGraw National Partnership for Women and Families

Paul Uhrig SureScripts LLC

Thomas Wilder America's Health Insurance Plans

**Disclaimer**

*The views expressed in written conference materials or publications and
by speakers and moderators at DHHS-sponsored conferences do not
necessarily reflect the official policies of the DHHS; nor does mention
of trade names, commercial practices, or organizations imply endorsement
by the U.S. Government.*