American Health Information Community

Consumer Empowerment Workgroup #13

January 10, 2007

[**\>\> Matt McCoy:**]{.underline}

Okay, you can go ahead.

[**\>\> Judy Sparrow:**]{.underline}

Thank you, Matt. And good afternoon, and welcome to the 13th meeting of
the Consumer Empowerment Workgroup and the first meeting in 2007. Happy
new year to everybody. Just a reminder that we\'re operating under the
FACA, Federal Advisory Committee Act rules which means this is a
publicly open meeting and there will be an opportunity to \-- at the end
of the meeting for the public to make comments.

Also, the meeting is being recorded and transcribed. So workgroup
members, please state your name clearly and distinctly before you make a
comment, for the recorder. Also, if you could keep your phones on mute
when you're not speaking, that helps greatly with any kind of background
noise.

And I think I\'ll ask Matt now to introduce the members that are on the
phone and then we\'ll go around the table here and tell you who is at
the table. Thank you. Matt?

[**\>\> Matt McCoy:**]{.underline}

Davette Murray, DOD. Kim Nazi, Department of Veterans Affairs. Robert
Tennant from the Medical Group Management Association. Jayne Orthwein
from the National Institute of Standards and Technology. Lorraine Doo,
CMS. Dan Greene, OPM. JP Little, RxHub. Marc Boutin, National Health
Council. And David Lansky of the Markle Foundation. Is there any members
or designees who I missed? Okay, Judy.

[**\>\> Judy Sparrow:**]{.underline}

And around the table, we have Rose Marie.

[**\>\> Rose Marie Robertson:**]{.underline}

Rose Marie Robertson, co-chair from the American Heart Association.

**[\>\> Justine Handelman:]{.underline}**

Justine Handelman with the Blue Cross Blue Shield Association.

**[\>\> Kelly Cronin:]{.underline}**

Kelly Cronin from ONC.

[**\>\> Christina Collins:**]{.underline}

Christina Collins, American Medical Association.

[**\>\> Steve Shihadeh:**]{.underline}

Steve Shihadeh, Microsoft.

[**\>\> Krista Carlow:**]{.underline}

Krista Carlow, Microsoft.

**[\>\> Kathleen Mahan:]{.underline}**

And Kat Mahan with SureScripts.

[**\>\> Judy Sparrow:**]{.underline}

That\'s it, Matt, from here.

**[\>\> Matt McCoy:]{.underline}**

Okay. We\'re all set, then.

[**\>\>**]{.underline}

All right, terrific. Let me welcome the group, and any in the public who
are attending as well, to this meeting of the Consumer Empowerment
Workgroup.

Our main focus today is going to be working on the letter of
recommendation that we\'ll be sending to Dr. Leavitt. But we have some
useful information that will help inform that to begin with, and shall
we begin with a presentation on research on PHR privacy policies by Dr.
Chin. That's your cue.

**[\>\> Stanley Chin:]{.underline}**

Thank you. This is Stanley Chin with Altarum Institute and I\'m
presenting our findings on a review of privacy policies on personal
health records that we carried out on a contract through ONC in support
of this Workgroup.

The slide package should be in front of you via either the web or the
attachments in the current handout.

First just an overview, we sought to understand the current state of
vendor privacy policies.

We focused on privacy not security. We\'ll talk a little bit about that,
what the difference is, why we took that choice. One goal was to see
whether or not a model privacy policy could be identified or developed
at this point. And to see what big questions remain unanswered now,
which, the fact is, big questions (indiscernible) model privacy policies
at this point.

So our overall scope, we looked at 30 publicly available privacy
policies and that's a question, if it isn't publicly available, is it
still a privacy policy, if you have to provide private information in
order to see the policy as to what the firm is going to do with private
information, there may be a problem there, so that's the first finding,
perhaps privacy policies should be available publicly for all PHR
vendors.

Our scoring tool, we developed a set of eight categories with 31
criteria, this is in the last slide of the package, a description of the
criteria we used. We didn\'t establish any weighting or any other more
formal mechanism. So it's an attempt to cover the most broad criteria,
we worked with the federal government to develop this list. It\'s not a
comprehensive, but the idea was to try to get a first pass through, what
do they look like.

So limitations to the study, obviously we used what was publicly
available, we did not solicit all the vendors to provide us with their
policies. The kind of information we received, we didn\'t attempt to
verify that a human answered the phone, or responded to an e-mail, we
took down that information, so to say it's generalizable
(indiscernible).

So slide 4 presents sort of the first finding which is that out of our
31 criteria we found that one policy covered 18 of them, and the rest of
them covered 15 or fewer, and you can see that we had, in fact, 8 of the
30 covered between zero and 5 of the criteria for privacy policy. The
lowest was one, but that was fairly generous, in some of the rankings,
including if they had any discussion, any mention of any of the areas
\-- it's not a characterization of the depth of the discussion or level
of detail but if they at least mentioned the idea, we scored them as
that idea being covered.

Another note is that most of the privacy policies we looked at
emphasized their security procedures and/or their Internet privacy
policies for that particular Website, rather than discussion of the PHR
data, protection on it, or the policies around PHR data itself.

Slide 5 presents, in tabular form, the overall for each of these
criteria, the number of these 30 policies that covered each of these
criteria. You can see it starts with the security, the 25 out of the 30,
it's a little hard to read because of \--

[**\>\>**]{.underline}

Would it be worth just briefly reading through the criteria?

**[\>\> Stanley Chin:]{.underline}**

Sure. For those either on the phone or are trying to follow this along
on the Web, that\'s \-- yeah. I\'m sorry, we've got hieroglyphics, but
that\'s okay.

So the overall set, of all of the policies, let me just talk about that,
the appendix, that's slide 11. We looked at areas where there\'s
communication between the vendor and user, in particular looking for
current contact information, when the policy went into date, and so on,
the freshness dates on them. Whether or not there\'s an indication to
when the privacy policy was changed. The second attribute we looked at,
major categories, readability, we had a couple of people take a look at
each one and try to give it a score based on is it easily comprehensible
or not.

[**\>\>**]{.underline}

When you have discrete items just as an example, in that, well, for that
one, one of the criteria \-- one of the \-- part of the scope is, is it
written in plain language that\'s understandable, having to do with some
sort of reading level, and then the other is \-- and one of the others
is, is it available in another common language. So if you have it
available and it\'s readable, but it\'s not available in a common
language, do you get full marks for that?

**[\>\> Stanley Chin:]{.underline}**

In this case, for each of these criteria, I mean there\'s 31 things
going down here, I conflated two things in my attempt to be
(indiscernible) rather than detailed here.

Each of these were done separately for this scoring so that \-- in fact,
none of the policies were available in another language. They were all
available only in English. Only a small number, frequently asked
questions document that access as well, all of them were scored for
plain language wording, and I don\'t recall how that broke out. But
there were a few that were identified as being wholly unreadable and a
few that we identified as \-- the rest, the balance on to
(indiscernible) generally understandable.

But so, yeah, for those, the scoring on these criteria were pretty
discrete and individual. For example, the coverage of inactive accounts,
we reviewed both whether or not there\'s a discussion, if the person is
no longer using \-- service and then the second question what would
happen if the company was bought or went out of business or some
disposition of data policy that was described.

The fourth area is collecting user data. Some of this is kind of \--
this was actually more about the Web part of it, which this is a matter
of scope we found many of them discussed Web privacy policy of their
company Website as opposed to the PHR privacy policies associated with
the PHR data.

[**\>\>**]{.underline}

I'm sorry. Dr. Chin, you may have covered this. Are there any ranking
\-- in other words, opt-out is a really important one \--

**[\>\> Stanley Chin:]{.underline}**

Yeah, we didn\'t come up with a scoring criteria and establish \-- but
in the unreadable slide, that slide 5, you can see, for example, only
five of the policies we looked at had opt-in to change it \--

[**\>\>**]{.underline}

But you didn\'t \--

**[\>\> Stanley Chin:]{.underline}**

We didn\'t come up with a way to scorecard \--

[**\>\>**]{.underline}

Okay.

**[\>\> Stanley Chin:]{.underline}**

We didn\'t come up with \-- we did not come up with a separate weighted
scorecard for each of the criteria, nor for the category. We elected
instead to just be transparent about which criteria we looked at. And
you can see there for what\'s covered most heavily, and what\'s covered
rather lightly.

So 25 \-- I\'ll just go down this list. Security policies, 20 had
notification for a change in policy. 19 had contact information, 19 out
of 30 again. 18 had a different policy identified, described for
identifiable versus de-identified data. 17 noted or said they did or did
not use data for marketing purposes. 15 described potential release of
data to law enforcement. 14 this is part of the Web part of it, the Web
privacy, noted use of Web service logs for access to the Website itself,
and 13 described the use of cookies. And 12 again, this is more part of
the Web privacy policy, described opt-out options for non-personal data
that was collected. Ten of the 30 scored good on the readable score, the
balance scored in the middle and all numbers scored very badly. Nine
described data sharing with business associates. None named the business
associates they shared data with.

Eight had a definition of personal health information. Eight noted their
relationship to or lack of relationship to HIPAA. Seven had an effective
date, freshness date on the policy. Seven talked about listing voluntary
presentation, for example for survey, or other work that the vendor
might do. Seven described data sharing research. Five described an
opt-in policy for \-- in this case that would be opt-in to changes from
the privacy policy. Five described a relationship with VeriSign. Four
talked about a definition for de-identified data, again sort of PHI.
Four talked about the security policies. Three talked about data sharing
potentially with other family members. Three talked about clinical
trials, three had some other data sharing description. Two talked about
what would happen to data in the event of the company being bought or
sold. Two talked about relationship to URAC or accreditation. Only one
we spoke with had a FAQ. One had a policy for deactivating account,
disposition of data. One had an opt-in policy for consent prior to any
data sharing. Out of 30. One mentioned the EU, U.S. safe harbor
guidelines for data privacy. One noted a relationship to AMA. And none
had alternative languages.

That\'s \-- of all the criteria, that\'s the overall scoring and again
we tried to be generous as to coverage.

[**\>\>**]{.underline}

Do you have a rough idea of what portion of the market you were covering
with this sample?

**[\>\> Stanley Chin:]{.underline}**

Because of the way we \-- this is primarily stand-alone PHRs. I don\'t
actually \-- we were unable \-- I can\'t give you exact breakdown of how
many of these are tethered or how many are insurance companies. The vast
majority of these are stand-alone PHRs. As was the case with the initial
vendor scan that we did.

[**\>\> Lorraine Doo:**]{.underline}

Rose Marie?

[**\>\>**]{.underline}

Yes, uh-huh?

**[\>\> Lorraine Doo:]{.underline}**

This is Lorraine. Thanks very much, it was helpful to have an advance
copy to follow along. And you may have answered this before. Are we
actually going to be able to see a list of the PHRs examined or is part
of that an issue of confidentiality?

**[\>\> Stanley Chin:]{.underline}**

For reasons of confidentiality, we did not deliver that to government.
So that is \--

**[\>\> Lorraine Doo:]{.underline}**

Okay. So we don\'t know how many of them were actually covered entities
and would have been really needing to mention something about HIPAA, for
example, or which ones, like you said, are tethered, we won\'t really
know that.

[**\>\>**]{.underline}

It sounds as though we could know that characteristic, although we
wouldn\'t know the name of the plan. Is that possible?

**[\>\> Stanley Chin:]{.underline}**

It\'s possible. The problem, of course, is that there are clear-cut
examples and then there are not so clear-cut examples. And rather than
make the determination, sort of blinded behind the curtain, we decided
not to bring it up at all. Yeah. We could come back and take a look and
see if there were ways, of those that are clearly HIPAA entities, did
they have \--

[**\>\>**]{.underline}

How many had.

[**\>\>**]{.underline}

For questions like that, I mean, it would be otherwise we\'re saying \--

[**\>\> Lorraine Doo:**]{.underline}

It makes a big difference.

[**\>\>**]{.underline}

Yeah. If people who have no reason to have it don\'t have it, that\'s
fine. But if they have a reason to have it, it would be \--

[**\>\>**]{.underline}

Right.

**[\>\> Stanley Chin:]{.underline}**

There's a further Catch-22 associated with many of the HIPAA covered
entities, which is that the privacy policy is implicit or was not, is
not publicly available, because it\'s a policy for their members rather
than for the public, so the public side of the portal may well have no
discussion at all about privacy because it\'s implicit that in the
business relationship the member has with the provider organization or
with the insurance company. So via \-- because of they have that
business and contract relationship already, presumably, although we
don\'t know, there\'s some discussion about the use of data that covered
entity has and the PHR portal is simply one expression of that overall
policy with the individual.

[**\>\>**]{.underline}

But certainly there are somewhere in relationships, in tethered
relationships where in fact the PHR very explicitly says, you know,
here\'s the privacy policy for this PHR.

[**\>\>**]{.underline}

Yes.

[**\>\>**]{.underline}

But I guess the presumably in your previous statement is a worrisome,
little bit of a worrisome word because to assume that\'s there means the
consumer is assuming it, and we don\'t \--

**[\>\> Stanley Chin:]{.underline}**

Well, in terms of scope, there\'s a \-- the presumption we had for those
who are engaged with a HIPAA entity, whether it\'s a provider or a
hospital or another organization that has a PHR, that presumably that
the rules, privacy of that health data was already signed and discussed
in that relationship. And the PHR as simply an expression of that, the
data that was captured in that business relationship, it\'s not new
data, right? It\'s nothing different than what\'s already been discussed
in terms of the HIPAA privacy.

**[\>\> Davette Murray:]{.underline}**

I just had a question. This is Davette. Just for my edification for
readability, I\'m very interested in that because I really do think that
that\'s going to be a pivotal area to get acceptance, help people feel
comfortable. And in your criteria, under your Appendix A-1, and you talk
about the plain language, was understandable to users of average
literacy, did you have like a grade level target when you say average
literacy, so that like if we got a PHR or a similar PHR that you
reviewed, we would understand that a certain portion of the population
would be more apt to be attracted and use it because they\'re in that
target zone of the scope of your literacy?

**[\>\> Stanley Chin:]{.underline}**

I think what we did is we had two people look at this and I think we
used Microsoft Word's technical language feeder button to \-- I don\'t
recall the numbers that we used on that. I can look at that, but I
don\'t recall.

[**\>\> Davette Murray:**]{.underline}

I just was sort of interested, like for the newspaper level, 7th to 9th
grade or something like that.

**[\>\> Stanley Chin:]{.underline}**

7th to 9th was certainly our target area but I don\'t recall exactly
what we \-- I think it was more of a verbal \-- and the speed carrying
it out, more of a verbal.

[**\>\> Davette Murray:**]{.underline}

And I mean that\'s a sidebar for me because I think it would be
interesting, you know, as these roll out, you know, what education level
are you attracting and who is more accepting to accept it, if you
actually had that figure, the people enrolled in these PHRs, their
education.

[**\>\>**]{.underline}

I think that\'s important in that one of our interests is trying to make
sure that these are available populations at risk are served, and so
knowing the literacy level would be, would be good. Okay.

[**\>\> Davette Murray:**]{.underline}

That would just be something I\'m interested from a personal and
organizational level. Thank you.

**[\>\> Stanley Chin:]{.underline}**

An in-depth analysis on the readability would be interesting and useful
but it really isn\'t in the scope of what we carried out here.

[**\>\> Paul Tang:**]{.underline}

Can I ask a couple follow-up questions, please?

[**\>\>**]{.underline}

Am I hearing a question there?

[**\>\> Paul Tang:**]{.underline}

Okay. This is Paul.

**[\>\>]{.underline}**

Hi, Paul.

[**\>\> Paul Tang:**]{.underline}

Hi. I\'ve got a couple of questions. One is a followup on the request of
seeing who you talked to. Since these are all publicly available
policies, I\'m not sure I see the objection of disclosing that.

And then the second question I had relates to this last discussion on
PHRs and HIPAA. Are we clear that PHRs, particularly when they\'re
stand-alone, are even covered at all in HIPAA? They certainly are when
it is integrated with a provider PHR, and the user consumer is viewing
data in the quote, medical record, that is covered by HIPAA. But in the
context of stand-alone PHRs, what is the official interpretation about
whether they\'re even covered at all by HIPAA?

**[\>\>]{.underline}**

Well, I don\'t think we have \-- and I\'ll look to staff to correct me
if I\'m wrong but I think that\'s an issue that we have remaining to
work on yet. I think we don't still have probably sufficient HIPAA input
to know that.

[**\>\> Kelly Cronin:**]{.underline}

This is Kelly, Paul. We\'ve had an amount of discussion at our last
meetings to recognize that we can assume right now under HIPAA that
these stand-alone vendors that don't interact with business associates
or covered entities that are clearly not really covered by HIPAA. So I
think that we haven\'t seen that definitive interpretation and guidance
or anything, but I think it\'s a safe interpretation of the law. And I
think the only thing from these results that I saw that were relevant is
that there\'s 8 out of the 30 that reported that they had policies that
were comparable to HIPAA or \--

[**\>\>**]{.underline}

Used HIPAA \-- they used HIPAA as a baseline or had some other reference
to the relationship to the law.

[**\>\> Kelly Cronin:**]{.underline}

Okay.

[**\>\> Paul Tang:**]{.underline}

So the other question was about the \-- why we wouldn\'t be able to
completely disclose who you talked to since these are all public \-- you
got your data from public sites.

**[\>\> Stanley Chin:]{.underline}**

That was based on the discussion that we had with government. If we felt
there was a difference. This is qualitatively different from the
functionality scan when we did do vendor interviews as well as the other
interoperability scan we're doing, it is qualitatively different in that
regard. We might \-- we could talk to government about that. But that
was sort of the basis of the stated task order that we had.

[**\>\>**]{.underline}

I think we didn\'t talk to you enough about it, to be honest. I think it
was how much can you get done, given your timeframe. We obviously would
like a lot more information.

**[\>\> Stanley Chin:]{.underline}**

Right.

[**\>\>**]{.underline}

So we can talk about how to get more information.

**[\>\> Stanley Chin:]{.underline}**

Right, okay. As you know, they are publicly available. We did try to hit
the major \--

[**\>\>**]{.underline}

Yeah.

[**\>\>**]{.underline}

It would be helpful and we\'ll have a further discussion.

[**\>\>**]{.underline}

That would be great.

[**\>\>**]{.underline}

Okay, we\'ll stop trying to distract you here. But we\'ll distract you a
little.

\[Laughter\]

[**\>\> Stanley Chin:**]{.underline}

The issue of \-- obviously an interesting one. We note that there was
not very much discussion on potential secondary uses of data, as we
noted in that list above, that 16 potential law enforcement access to
the data, three covered potential family member access. None disclosed
the names of any business partners who might receive the data. And none
disclosed what data elements either public \-- either individual
identifiable or not that were being shared.

And obviously given the fact when the evaluation was done in December,
January, there was no discussion about E-discovery.

There wasn\'t much attention to the end of the business relationship, as
we note in that list, that only two described as \--

[**\>\>**]{.underline}

I\'m sorry, let me just go back there. So there wasn\'t a discussion
about E-discovery, but there was law enforcement access?

**[\>\> Stanley Chin:]{.underline}**

Yes. In about half of them.

[**\>\>**]{.underline}

So, that law enforcement access wasn\'t in terms of E-discovery?

[**\>\> Stanley Chin:**]{.underline}

It varied. Some clearly said that data may be released as part of
court-ordered or other law enforcement activity.

Sorry. So as to the second main bullet is there wasn\'t much attention
to the end of the business relationship, as noted, that two described
disposition of, use of data should the vendor be sold, and one described
a policy for deactivated accounts. I mean, I just find this of interest
because in the \-- just the dot-com bubble burst, some companies, for
example, (indiscernible) dot com, in the disposition of their assets
included the sale of consumer data. That was owned by, that was
considered an asset that was sold to debtors. Okay.

Slide 7, as Dr. (indiscernible) noted, it\'s not clear that any of these
are HIPAA-covered entities. But the point we would make is the vendors
weren't particularly transparent about this. That there wasn\'t much
discussion about whether they were or were not and what being covered
might entail.

And that only 8 referenced HIPAA at all. That eight provided a
definition of personal health information, and four a definition of
de-identified personal information. So readability aside, some of these
terms which definitely have a specific meaning in the law were not
described.

And then I just note the enforcement, for the policies, (indiscernible)
so we have descriptions of the privacy policies to how, what any vendor
breach would occur \-- not merely a security breach, but in this case I
mean if they did violate that policy knowingly.

Okay. So all that said, slide 8 is to note there are big questions that
remain, appropriate role of government, which is true for Internet
privacy in general. Enforcement mechanisms, and then privacy policy
disclosure for provider-, hospital-, insurer-provided PHRs, those that
are not stand-alone.

We did feel that there was a role to give for the Community in general
to try and build this common privacy framework. And that some elements
might include, that we have under the third bullet, a privacy policy be
available, that it contain contact information, freshness date, that it
be transparent, and I'm not going to attempt to interpret the various
levels and meanings of that on secondary data use, but disclose that it
could happen or does happen.

It would be good if the business relationship to the vendor
relationship, especially to services that are sold, via or through that
PHR, were disclosed, that there might be protections for minors
described, although of course that may vary by state, that there ought
to be some discussion of the relationship of the policy to HIPAA, to the
organization, the vendor to HIPAA. Or other relevant policy or law, that
they ought to provide readable descriptions and glossary of technical
terms that could be shared. And that, more importantly, that this
privacy policy for the PHR data ought to be separate from Internet web
privacy which is important but distinct, as well as the security
procedures, because we found by and large what we had were descriptions
of the technical aspects of security rather than the business rules
regarding the release of data that may occur through business
transactions.

**[\>\> Lorraine Doo:]{.underline}**

Stanley?

**[\>\>]{.underline}**

Yes, uh-huh.

[**\>\> Lorraine Doo:**]{.underline}

Hi, again, this is Lorraine. And I certainly don\'t want to \-- just a
question. Did you happen to use the standards for the notice of privacy
practices from the privacy rule to guide your recommendations for the
components of a privacy policy?

**[\>\> Stanley Chin:]{.underline}**

Yeah, some of this is familiar from the fair information privacy
practices, the FTC document, some others from \--

[**\>\> Lorraine Doo:**]{.underline}

But HIPAA specifically also was used, because those are very clear
requirements. The HIPAA notice of privacy practices has their
requirements.

**[\>\> Stanley Chin:]{.underline}**

Right.

[**\>\> Lorraine Doo:**]{.underline}

Were those also used?

**[\>\> Stanley Chin:]{.underline}**

That sort of provides the basis for this the initial set of what might
be basic components.

[**\>\> Lorraine Doo:**]{.underline}

Okay.

**[\>\> Stanley Chin:]{.underline}**

This is intended to be the beginning of the discussion for this group or
whomever else you might want to \--

[**\>\> Lorraine Doo:**]{.underline}

Okay, thanks.

**[\>\> Stanley Chin:]{.underline}**

Not intended to be exhaustive, not intended to be \-- but clearly
sources for something like that would include HIPAA, would include fair
information privacy practices and so on.

**[\>\> Ross Martin:]{.underline}**

Stanley, this is Ross \--

[**\>\>**]{.underline}

Included actually \--

**[\>\> Stanley Chin:]{.underline}**

Yes, I believe it includes.

[**\>\>**]{.underline}

In the appendices.

**[\>\> Stanley Chin:]{.underline}**

Right.

**[\>\> Ross Martin:]{.underline}**

Stanley, this is Ross Martin. Just a question. You mentioned that a
couple of them mentioned URAC policies and I know they do kind of like
certification of Websites with health information, educational
information on them and that sort of thing. Do you have any examples of
any type of certification of privacy policies, either in this health
care space or in other industries that \-- where they have somebody
looking over their policy and saying, yeah, this kind of cuts the
minimum standard for what we\'d expect for this kind of information?

[**\>\> Stanley Chin:**]{.underline}

Well, that\'s a great question. My evasive answer, no, we did not find
anyone who was specifically citing a source that would provide that kind
of validation. We did see some mention for example of Better Business
Bureau or URAC, or others who had reviewed portions of their Website or
were involved in other portions of the business. But a review of the
privacy policy itself, by an external organization, which may well be a
great idea and a great service that could be provided, we didn\'t have
any specific examples of that.

[**\>\>**]{.underline}

How variable, compared to the privacy policies that are available on the
Internet for those technical aspects of your Internet privacy and
security, give me \-- I mean, I suppose we tend to flip through those
and sign things at the bottom, don\'t we? But give me a sense of whether
these are much more variable and less transparent.

**[\>\> Stanley Chin:]{.underline}**

The sense that we had was they were much more variable. For example the
Internet privacy policies tend to follow a specific format. And they
tend to actually follow the format of the OMB guidance on federal
Websites. In fact, they tend to follow it very closely. It\'s an easy
model to follow, it's got best practices, you can see what they\'re
supposed to look like and what the Social Security Administration does
on theirs, copy it, or less, and you\'re done. The same really cannot be
said on the PHR side, there\'s nothing like that. That the range of
scopes was so broad that some literally spent several pages describing
technical security and no description about any of the rules by which
data might be shared, or sold or transacted in general.

Others were quite descriptive. I mean, that's not to say it's entirely a
wasteland. There were a number that were quite descriptive and did go
into depth as to when data might be exchanged, what data that might be,
and so on.

Although, again, we do note some gaps. No one describes with whom they
actually might do transactions. But yeah, the breadth was really quite
wide, and that\'s really our main conclusion from this, is that there is
no standard, there is no consistent model which everyone is using. And
the analogy is that there\'s nothing like that OMB standard for
Websites.

**[\>\> Ross Martin:]{.underline}**

Stanley, another question from Ross. I\'ve been working on projects
lately that involve licensing of open source software and we\'re trying
to establish some licenses for some authoring tools that we\'re
releasing to the public, and have to choose among a bunch of different
open source software licenses.

Do you see an opportunity for \-- I\'m going to say an openly available
set of privacy policies that could be adopted. These open source
licenses have different rules around them that say things like if you
use this license, you can\'t change it at all. And so it\'s kind of an
all or nothing, some of them allow you to modify it. But is there an
opportunity for that kind of publication to be created that people can
adopt and by doing so can sort of self-certify or self-declare that they
are abiding by these things? Now, there\'s a whole execution part of it
that nobody is auditing them to make sure they\'re abiding by their
policies but as long as they\'re stating them up front, that\'s one step
to take.

**[\>\> Stanley Chin:]{.underline}**

I would agree. I mean, again this falls into the bullet of what is the
appropriate role of government, and really of groups like the AHIC here,
to provide support to a third party like an open source group to come up
\-- or an industry group, for example, among PHR vendors or among other
aspects of industry that might come together and come up with a minimum
set of standards or criteria, or a model policy or a set of best
practices associated around which major categories that ought to be
covered.

One could certainly imagine that. As opposed to a very prescriptive role
for government, which has been controversial in the privacy side for
quite a while. So yeah, one could certainly imagine that. In fact,
that\'s more or less the suggestion we have is that this group and those
like it may want to consider ways of engaging with industry, consumer
groups. And an unanswered question here is what does the consumer demand
for this kind of privacy policy and for this transparency? What are the
critical areas that consumers really want to have covered and what are
the areas which they don\'t \-- they have relatively less interest?
That\'s an unanswered question at this point.

But yes, I agree. Yeah, the last slide, then, is \-- I mean, this is
sort of motherhood and apple pie. We did extrapolate that \-- the idea
of the PHR data are not private. There ought to be a commonly understood
meaning to this idea, and that that\'s really a function of industry
providers, payors, users, to try and figure out a way to bring those
groups together in places like this, forums like this, to talk about
that and to begin creating that common picture.

That the other policies we looked at were incomplete, quite broad, quite
a lot of variation, so we didn\'t see any consensus what the
requirements for privacy policy were like and that therefore there could
be a role for people, for groups like this. In establishing \-- that
kind of \-- yeah, as Ross noted, an open source model. Nice metaphor,
not an exact statement \--

[**\>\>**]{.underline}

Thanks.

[**\>\>**]{.underline}

Yes? Did I hear a question coming from the \-- just a thank you, okay.
In your first statement there, the privacy of PHR data should have a
commonly understood meaning. Does that exclude \-- that doesn\'t
exclude, I think, from what you said, the concept that you would have
that there might be different meanings or different models in different
situations that you talked about the difference between HIPAA-covered
entities and such.

**[\>\> Stanley Chin:]{.underline}**

Sure.

[**\>\>**]{.underline}

Other questions for Dr. Chin? Comments?

[**\>\> David Lansky:**]{.underline}

This is David. I just wanted to make a comment. I was reading one
privacy policy of a new site, a very well-funded site. And it was about
13 pages long, I think, 6,000 words. And it was very comprehensive. I
think it would meet many of the tests that you used. But almost
perversely by being so comprehensive it became almost unreadable. And so
something we should all think about is what this readability or
usability really means when it comes down to a consumer\'s ability to
understand what promise they\'re getting.

And the second thing is this particular company had not only privacy
policy but a terms of service policy, and the terms of service basically
said we don\'t have to do anything we\'ve said.

\[Laughter\]

[**\>\> David Lansky:**]{.underline}

The only remedy a user has whatsoever is to cancel their registration.
They have no liability, no recourse, period. So on the one hand the
privacy policy may have been really eloquent and complete, but the
company is disavowing any obligation to fulfill it in a meaningful
sense. So this raises the question Stanley mentioned of enforcement and
I think whatever we decide to do in the future in this area we should
both look at the preferred policies, but also take a good look at what
the enforcement mechanisms will be for whatever policies we might
endorse.

[**\>\>**]{.underline}

This was a very helpful presentation despite the speed with which you
had to accomplish it, and I understand you and staff will have some
further discussions about whether there is a little more information you
could gather from it.

**[\>\> Stanley Chin:]{.underline}**

Sure.

[**\>\>**]{.underline}

I\'d just like to thank you on behalf of the Workgroup.

[**\>\>**]{.underline}

Are we going to react to his recommendations at all?

[**\>\>**]{.underline}

Let\'s \-- sure, let\'s take a few minutes and do that.

[**\>\>**]{.underline}

One, I also really appreciate the presentation, and I think a lot of the
basic components of the privacy policy on the next slide \-- next to the
last slide were right on. Maybe not complete, but really there are a lot
of good points there. I suppose that kind of recommendation which comes
out of the fact that you didn\'t find these principles in most of the
privacy policies is on the one hand disturbing because many of the
offerors of these PHRs may not be fully cognizant of the privacy issues
and the need for protecting information. On the other side it could be
alarming to (indiscernible) them and agencies that are promoting PHRs
without this kind of protection in place. Which I think gives us a sense
of urgency in trying to maybe not even \-- it\'s too late to be able to
get ahead of it but maybe to try to catch up with policies, to protect
information that are now in these products.

So I guess one question we have is his last point on the conclusions is
to help define a model privacy policy and I guess the question is
whether it\'s this Workgroup or the Privacy Workgroup or none of AHIC\'s
subgroups but rather, I don\'t know, maybe a NCVHS, the policy advisor
to the Secretary or some other group, it seems like we do need to make
some kind of recommendation about getting this work started so that we
can go back and protect some of the information.

[**\>\>**]{.underline}

That\'s a very good point and I think we\'ll come to that when we go
through the recommendations, because we do have a recommendation that is
\-- that might suggest a role for us or someone else in doing work in
that area and we\'ll address it at that point today.

**[\>\> Ross Martin:]{.underline}**

This is Ross. Just building on that and some of the comments that David
Lansky made a moment ago about describing that very comprehensive but
unreadable privacy policy. A role that we could play as well, or some
entity, presumably us, would be as you find that idealized language
about what the lawyers need to see to say yep, this is a policy that
does have consumer protections built into it, is for the major
components of that, create a language like Stanley mentioned in his
presentation that would be understandable concepts in the public
environment, what do you say, privacy should have commonly understood
meaning among all vendors and some phrase that says when it says your
data will be made available and in anonymized fashion for secondary
uses, that there\'s a phrase for that that can be in 4th-grade readable
kind of terms.

Because we\'re asking consumers of many different stripes, educational
levels, but we certainly have to target people who aren\'t going to
understand \-- they\'re never going to be able to read that document,
period, and they need to be able to know what generally they\'re getting
themselves into. And that way at least the vendors could then present we
align with this very rigorous privacy policy and then here\'s the upshot
of it. We\'re not going to sell your data. We\'re going to give you your
data back to you if we go out of business. We\'re not going to \-- those
types of things that a layman can understand. I know that gets tricky,
but I don\'t know how else to give this information to consumers so that
they can make any kind of informed decision.

[**\>\>**]{.underline}

But we clearly, although it is tricky, you know, we do do that in the
setting, for example, of informed consent for clinical research studies.
We say that those documents have to meet certain criteria, have to
include certain things. So it\'s not as if there\'s no experience with
doing that. This is just a new setting in which the experience has to be
brought to bear.

[**\>\> Ross Martin:**]{.underline}

There\'s a readability level of it and there\'s also a brevity level of
it. You can\'t \-- yeah, you could take all the stuff and put it into a
4th-grade reading level, perhaps, but it would then go from being 19
pages long to being 30 pages long. Of plain language. And so you have,
still have to be able to point to this is the part where we\'re not
going to steal your data. Or we\'re not going to give it away without
your permission, or whatever it might be. And have that header for that
section.

[**\>\>**]{.underline}

Ross, I think that within the clinical trials community, for instance,
we\'ve learned through the informed consent for clinical trials that
often they will be prefaced with an executive summary highlighting the
fundamental features to which you as a consumer are agreeing within that
clinical trial. This privacy policy once developed may indeed benefit by
having a consumer executive summary document that highlights what is
included with references to the larger document where there is further
detail.

**[\>\> Ross Martin:]{.underline}**

Right.

[**\>\>**]{.underline}

And I think Ross, I have to say as a consumer representative that indeed
our experience with consumers is they will indeed understand to the full
extent we need them to, matters relevant to their health in direct
proportion to the deliberate way in which we inform them.

[**\>\> Ross Martin:**]{.underline}

Yeah.

[**\>\>**]{.underline}

Whether it\'s in writing, whether it is in the conversation that we have
with them. So I think from the consumer perspective on the matter, I
would like all of us to feel confident that a well-described privacy
policy would be well understood by the consumers that would be served.

**[\>\> Ross Martin:]{.underline}**

The other part of it, one is readability and understandable about what
is being said. The other is to help put into more concrete terms what
the risks are. So we talk about \-- well, your data may move from point
A to point B, and expect, well, people should understand what does that
mean to me. It\'s interesting just two days ago in the L.A. Times there
was an article about how health plans use prescription and
non-prescription data to decide whether to reject an individual. And
what surprised me, for example, is a lot, in fact, eight of the top 20
selling prescription drugs, including Lipitor or some of the
non-prescription drugs like Allegra, Celebrex, well, not Celebrex, but
Prevacid are on the list that may lead to rejection based on taking
those meds alone.

[**\>\>**]{.underline}

We\'re going to have to \-- I want to get a couple of other people a
chance to make comments and then we\'re going to have to move along
because we have \-- we\'re a little behind our time to go on to what's
next. Let me make sure I have comments around the table.

[**\>\> Christina Collins:**]{.underline}

Thank you very much. Christina Collins, AMA. I'll be brief. I want to
heartily endorse the course that this conversation has taken over the
last few minutes. I truly believe that if we are indeed going to fulfill
our responsibility to consumers, we do have to have a widely articulated
generally understood policy on privacy, that\'s what our patients
deserve and that's what the American public deserves if indeed we are
going to empower them.

I think certainly with the experience that we have had with HIPAA, that
it has become very apparent that not only do we need to have these
things well articulated but it\'s also terribly important that there are
real simple, easily accessible remedies, not hideously expensive to
access by having to go to court on some sort of a high evidentiary
showing. So I think we do have a responsibility to do that and I don\'t
know if it\'s within the parameter or the purview of this particular
Workgroup but I would like to ask where within sort of the numbers of
Workgroups where this discussion can indeed move forward. Because I
think we all do have a responsibility around this table to ensure that
that discussion does indeed occur, somewhere, if not here.

[**\>\> Rose Marie Robertson:**]{.underline}

And I think we will come to that later as we go through the letter. Yes?

[**\>\> Steve Shihadeh:**]{.underline}

If I could, Steve Shihadeh of Microsoft. I think anybody listening to
this presentation can\'t help but think that we\'ve got lots of work to
do in the area of policy. So I want to very strongly endorse that our
group or perhaps another group should take a shot at coming up with
maybe the final 31 or the best set of policy criteria. And I want to say
out loud and in a clear voice, policy as differentiated from
certification, which I know we\'re going to discuss in a little bit. But
I think clearly it would help everybody if there was sort of a Good
Housekeeping seal of policies as it relates to privacy, as it relates to
personal health records.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. Let me thank Dr. Chin again, and let\'s just step back for one
moment and get the November minutes approved. Those are in your packet.
I assume you have leafed through them in the early moments of the
meeting, if you hadn\'t before. And can I have a motion for their
approval or comments?

**[\>\>]{.underline}**

You have a motion.

[**\>\>**]{.underline}

Second?

[**\>\>**]{.underline}

I second.

**[\>\> Rose Marie Robertson:]{.underline}**

All in favor?

[**\>\>**]{.underline}

Aye.

[**\>\>**]{.underline}

Aye.

**[\>\> Rose Marie Robertson:]{.underline}**

Any opposed? Okay. The minutes are approved.

Nancy, do you want to \-- okay. So we\'ll now move to the next section,
the Workgroup discussion of the next recommendations to AHIC. And we
have \-- we will present \-- we\'ll send a letter but we also will make
a presentation, and we\'ve broken down the presentation into slides that
we will be able to view both here in the room and those who are looking
at the Web meeting.

And we\'ve divided this up into looking at the findings section, the
section on interoperability and portability. That\'s recommendations
number 1, things listed under 1, privacy and security recommendations 2,
incentives for adoption 3, education and outreach number 4. And you have
a draft, the latest draft of the letter, but you also have seen e-mails
over the past several days from David, from Lorraine, and from Justine
just over the last couple of days. So we\'ll make the assumption that
people have seen those and that we\'ll discuss those as we go forward.

So first let\'s spend just a few minutes on the findings section. I
don\'t think we want to spend too much time here. We\'re a little behind
and we maybe can pick up a little time here. And this is the beginning
of the draft letter at the bottom of the page, after outlining the broad
charge to the Workgroup, and this is not actually on a slide. On the
slides, we have the title slide you have up there now, the next slide is
the, just outlines the broad charge for the \-- that is the charge to
the Workgroup, so not something we\'ll change. And then we\'ll move to
draft findings in a moment. But let\'s look first at the finding section
and see if \-- this has been expanded, a good bit. It\'s now about two
pages long, addresses the issues, many of the issues we\'ve been talking
about and have heard testimony on.

Do we have any comments, questions, about the findings section? Yes.

[**\>\> Steve Shihadeh:**]{.underline}

Yeah, again \-- not again, but as I kind of noted before, you know, we
just, from Microsoft\'s perspective, we think certification of PHRs is
premature at this point. You know, speaking candidly, Microsoft would be
as able as any company out there to get certified, so it\'s not a lack
of \-- we\'re not afraid of that. But the policy issues haven\'t been
hammered out yet, and certification is likely to stifle innovation. So
we\'ve spoken up on this, our comments and those of others didn\'t make
it into these findings, and so again, maybe louder this time, I want to
say that we are opposed to this, we don\'t think that it\'s \-- it\'s
the cart before the horse and it\'s premature at this point and I don\'t
think you can point to certification in other areas that\'s, you know,
saved the day or made the improvements that were hoped for.

[**\>\> Rose Marie Robertson:**]{.underline}

So I think we\'re going to need \-- we will need a formal vote on this
issue. And we had agreed in one of our previous discussions that if the
will of the Workgroup is that we continue to include a section on
certification, that we will agree to make certain that this was not a
unanimous opinion and that there are varying opinions. But I think we
need to see where the group is. So let\'s spend a few minutes getting
\-- having discussion about that.

**[\>\> Kathleen Mahan:]{.underline}**

I would just second the opinion of being a little cautious on certifying
anything where there\'s not set standards.

[**\>\> Rose Marie Robertson:**]{.underline}

And just for people on the phone \--

**[\>\> Kathleen Mahan:]{.underline}**

Kathleen Mahan with SureScripts. I need to be reminded. Thank you.

[**\>\> Rose Marie Robertson:**]{.underline}

We all do.

**[\>\> Kathleen Mahan:]{.underline}**

I run the certification department at SureScripts and I can tell you
quite frankly there would be no certification without a standard in
place and we have one on which we can operate with in electronic
prescribing and medication history, we don\'t have that with PHR. Now,
you know, we\'re trying to utilize some existing tools to date, but I
think it\'s okay if certification is discussed in the realm of when the
standards emerge, when they are recommended, a certification process
should follow suit as a natural progression.

[**\>\> Rose Marie Robertson:**]{.underline}

And in the \-- in your particular area, what did you do before the
standards were there?

**[\>\> Kathleen Mahan:]{.underline}**

I don\'t believe, quite frankly, before SureScripts was around, we
couldn\'t have done it without a standard. We have over a hundred
different vendors operating in the HL7, XML, all these different various
data types. We work with the standards, thank goodness, and it\'s pretty
tight. The script standard, there are going to be some improvements made
recommendations for some of these pilot projects going on now. The
standard is pretty tight. There\'s not a lot of ambiguity. And everybody
who wants to come through our network needs to certify on our
implementation guide which is, pretty much falls right in line with the
FCO\'s published standard.

[**\>\> Rose Marie Robertson:**]{.underline}

So let me ask the question of those who are opposed to certification,
that if the standards were \-- if there were standards available, if we
were at a different time point, if the evolution of this had come about
a little differently, if the standards were available, would you still
be opposed to certification, or really is the issue that there are not
sufficient standards to be utilized now? So let me \-- that\'s what
you\'re saying.

[**\>\> Kathleen Mahan:**]{.underline}

I would want to see an evolved standard. And what I mean by that is, it
needs some \-- you need to be able to kick the tires and run it on the
road for a little while, that's the way a standard emerges and becomes
tight, is its use in the public domain.

[**\>\> Rose Marie Robertson:**]{.underline}

But you didn\'t \--

[**\>\> Kathleen Mahan:**]{.underline}

I wouldn\'t be \--

[**\>\> Rose Marie Robertson:**]{.underline}

You didn\'t do that in \--

[**\>\> Kathleen Mahan:**]{.underline}

No, we had a standard that was being used, you know, very infrequently,
we took it and said this is what we\'re going to use. If you want to
transact with us or retail pharmacy, this is the way it has to be done.
We can\'t afford to have 35,000 different implementations of a standard.
You know, the standards can be loose.

[**\>\> Steve Shihadeh:**]{.underline}

Are we talking about standards or policies? If you want to certify
against a standard, once a standard is in place and agreed to by \--
boards, that\'s relatively easy. If you want to certify against a
policy, that\'s a little \-- you know \-- little looser, but nonetheless
\--

[**\>\> Rose Marie Robertson:**]{.underline}

Let\'s say standard, just make the language \--

[**\>\> Kathleen Mahan:**]{.underline}

If you have a policy framework, there\'s a generally, like you said list
of 31 items that need to be part of your \--

[**\>\> Steve Shihadeh:**]{.underline}

Well, I guess here\'s a concern that I would see, speaking on behalf of
Microsoft. You think about the work that CCHIT is doing on physician
EMRs and hospital EHRs, EMRs, they\'ve been around for 15, 20 years in
various shapes and forms, there\'s thousands of users of them. Okay,
PHRs have very, very low adoption today. There's not enough experience,
you know, the 31 criteria that Dr. Chin put together, you know, it's the
first time most of us have seen something like that. It needs to go
through several iterations, there needs to be some more real world
experience before you can create, in my opinion, a policy, a set of
policies that people could look at and say yes, that makes sense for us
to mark against those.

**[\>\> Robert Tennant:]{.underline}**

Rose Marie?

[**\>\> Steve Shihadeh:**]{.underline}

That's really the concern I'm raising.

**[\>\> Rose Marie Robertson:]{.underline}**

Comment on the phone, who is that?

**[\>\> Robert Tennant:]{.underline}**

It's Rob Tennant, with MGMA. A couple of points. CCHIT took as a subset
the HL7 functionalities standards, they looked at the HIPAA security
standards, but they really crafted their own. CCHIT is not a national
standard. They developed, through a very public process, the criteria in
which to certify. I\'m not sure CCHIT is even willing or able to start
certified PHRs, but what we can do in the recommendation perhaps is to
ask CCHIT to come back with a report on the feasibility and the
timetable to certify.

That, I think, gets at some of the concerns that there aren\'t the
standards. And it might ramp up the efforts by perhaps HL7 or others to
determine the criteria.

[**\>\> Rose Marie Robertson:**]{.underline}

And one question is whether they are looking for us to give them the
guidance to do that. And that therefore saying something about it in
these, in this document would move them in that direction. So there are
some things we might think others should do that we should nonetheless
make a clear statement about.

But let me see if there are other \-- David, surely you want to comment.

[**\>\> David Lansky:**]{.underline}

I think I communicated my views a while ago on this and I share the
views of Steve and others in this conversation, and Kat. The last point,
I would add that I don't think if we wanted guidance on when and whether
certification is helpful, I don\'t think we would turn to a
certification body to ask that question. They\'re essentially a
technical body made up of industry participants and this is really a
policy and strategy question as to whether the best way of advancing the
personal health record field involves some element of certification. I
think it\'s really our charge to take a first pass at that and
essentially poll ourselves or we could commission a white paper from
some independent expert or something. And obviously at this point I
don\'t believe and I don\'t think Connecting for Health feels that
certification would be a significant help in the marketplace, and it
could very well be a very significant impediment to a creative market.

I think we\'ve all agreed that we don\'t have any desire to certify
functions, and gradually we've reduced our conversation to security and
interoperability, and I think there\'s an argument in each of those
cases why certification would be inopportune now. So I think, back to
Steve\'s initial suggestion, I would like to see this paragraph in the
findings section removed and if we want to come back to this during \'07
as another point of discussion with additional evidence from the
marketplace, we certainly can, but I don\'t think we should be
recommending for \'07 any action on the part of AHIC.

[**\>\> Rose Marie Robertson:**]{.underline}

So shall we \-- let\'s see if we have comments on the other side of this
question, because we\'ve had some as time has gone along.

[**\>\> Ross Martin:**]{.underline}

This is Ross. Go ahead, Davette.

[**\>\> Davette Murray:**]{.underline}

I just want to say, maybe we don\'t want to maybe do certification for
the whole thing, but for the earlier comments that were made about
privacy being paramount, maybe a limited scope certification as people
are trying to choose their PHRs, that these PHRs at least meet the
minimum government requirements or whatever entity should be saying,
certifying what is appropriate privacy levels.

[**\>\> Rose Marie Robertson:**]{.underline}

Ross.

**[\>\> Ross Martin:]{.underline}**

This is Ross. I think the paragraph fairly accurately describes what we
heard in testimony, especially the end part, that we did hear from
several vendors and payors and others that have testified that minimum
certification for EHRs and PHRs for interoperability would help. That
\-- how do you declare that and help the consumer make choices about
what their expectations can be, whether or not when they invest in this
tool \-- and when I say invest, even if it\'s a sponsored tool that they
don\'t actually pay money for, they\'re going to have to do something to
enable it, and use it, and take advantage of it.

I don\'t think that anyone that I\'ve heard be pro-certification has
said that we want to do this in the absence of established standards or
in the absence of adequate field experience that says we can standardize
on an area and certify it. I don\'t think that\'s ever been a part of
the conversation.

I certainly wouldn\'t want any certification body to come out and start
putting stamps of approval on things when there\'s not adequate industry
experience and there's, in a way that would stifle innovation.

So I certainly would be opposed to not saying something about
certification. I\'m not opposed to working on this language just a
little bit more. I know that we\'re running out of time, but to indicate
that we think that there are precursors to certification. One being an
established standard, and we do have an interoperability specification
for the things that AHIC set out to do in this initial phase, which is
medication history and registration summary, that has been published by,
it has gone through HITSP, it's gone through the process, it's been
submitted to the Secretary. It would naturally follow that that is our
best pass on what it means to be interoperable for those minimum
functions.

Now, that said, there isn\'t a lot of field testing in that yet, and so
certainly we would want to see, before any certification would happen,
that field testing. However, even getting the ramp-up part of the
certification part done, takes, you know, years. It\'s going to take a
while for this to get in the queue and get up to speed, so I don\'t
think it\'s premature of us to talk about the role that certification
could play. And certainly if we say nothing, nothing will happen. And I
just don\'t think that\'s the way to approach it.

If we do say something, and it shows that the standards aren\'t ready,
the policies for privacy and security aren\'t ready, and the field
experience is inadequate, there won\'t be any certification of PHRs yet,
so there\'s, I don\'t think by saying something in our document about
the important role that this could play for consumers to be able to make
informed decisions, is premature. And I know that there have been others
who have shared that view. So I hope that we can come to some sort of
consensus about this without just saying an all or nothing about this.
Because I don\'t disagree with the voices from Microsoft and from David
about \-- and from SureScripts. I will say that SureScripts, their
certification process is for their own network, they\'re not certifying
things outside of their own network. And it does include things beyond
technical specifications, I mean it includes do you abide by our
policies. And so it\'s not just \-- SureScripts maintains those things.
And so it\'s a fairly broad, from my understanding, a fairly broad
certification process.

[**\>\> Rose Marie Robertson:**]{.underline}

Let me just \-- let\'s see if we can get everybody to comment who has an
opinion about this. So let\'s get \--

[**\>\>**]{.underline}

I would agree. I think that\'s what I heard as well. I think
certification we\'re getting ahead of ourselves here and particularly
while we have \-- HITSP has identified, I think as Ross as said, and
others, initial standards for PHRs, those have not been tested and I
think that Kat's point, you really do need to test things in the real
world and looking ahead to the recommendation of PHR to PHR
interoperability, we don\'t have the standards for that yet at all and I
think there\'s a lot more work that needs to be done from the HITSP and
some more pilot testing before we\'re going to get the benefit of these
products and for certification and the market is still evolving. So I
would urge caution as well going forward.

[**\>\> Rose Marie Robertson:**]{.underline}

Would you urge the sort of caution that Ross is describing where he\'s
saying we should mention that certification may potentially have a role,
but that it, but that currently we don\'t have enough information to do
it. In the meantime we should be thinking about who might certify, what
the processes might be, while we\'re gathering that information, or
would you say we should exert enough caution to say we really shouldn\'t
mention it at all.

[**\>\>**]{.underline}

The tough thing is, given this is the last meeting before we go to the
full AHIC \--

[**\>\> Rose Marie Robertson:**]{.underline}

Friday we have to have \--

[**\>\>**]{.underline}

And it depends upon how the wording is when you look at something and
what it says, it\'s hard to \--

[**\>\> Rose Marie Robertson:**]{.underline}

Okay.

[**\>\>**]{.underline}

I think it\'s okay but we may need to have more discussion.

[**\>\> Rose Marie Robertson:**]{.underline}

More cautionary language. Okay.

[**\>\> JP Little:**]{.underline}

Ken Majkowski and JP Little at RxHub.

[**\>\> Rose Marie Robertson:**]{.underline}

Yes?

**[\>\> JP Little:]{.underline}**

A couple of issues. We actually did do certification and implementation
prior to the medication history and formulary standard. We developed
specifications with industry consensus by holding workgroups of those
who would be participating in those processes to decide what those
specifications would be. Those specifications eventually through NCVHS
were taken to NCPDP, and X 12 to become standard. So we had experience
doing that. But it was only through consensus of the industry. Okay?

We think that\'s key. We would be more in favor of David\'s comments and
not having certification mentioned. I think he makes an excellent case
in that we don\'t even know what a PHR is. And frankly, if you think
about what it is we certify and implement in E-prescribing, it\'s
utility-type transaction sets and standards. And we don\'t know what the
utility parts of a PHR are going to be. And in order not to put a damper
on innovation that I think we need to see, I think we need to see what
the utility of PHRs are going to be at some point in the future before
we can even mention certification.

**[\>\> Ross Martin:]{.underline}**

This is Ross, just real quick. I would be happy to put that very
cautionary language in this section, and say, you know, certification is
not \-- it\'s not time for certification yet because these things, we
haven\'t observed these things happening yet. But to not mention it at
all, since we've spent so much time on it as an issue, and we recognize
the, you know, that some endorsement, the Good Housekeeping seal kind of
thing provides consumers with some level of potential protection. I just
think it would be \-- it would be sad for us not to be able to say
anything at all.

So I\'m not trying to push this issue of saying let\'s push for
certification. I think we need to talk about what the challenges are
with certification and what we need to get there, because this is a
consumer, I think it\'s a consumer need eventually.

[**\>\> Davette Murray:**]{.underline}

This is Davette. Would it be a good compromise to say that as this moves
forward there\'s a need to develop certification standards?

[**\>\> Ross Martin:**]{.underline}

Well, we say certification of PHRs may be a useful tool and that\'s
pretty soft. It\'s not saying we have to do certification. It\'s saying
it could be useful for giving consumers confidence to get into this.

**[\>\> Paul Tang:]{.underline}**

Rose Marie.

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

[**\>\> Paul Tang:**]{.underline}

I\'d like to piggyback on Ross\'s comments. This is Paul. I really like
the way Ross stated his sort of summary before this most recent
discussion, because I think it was well-positioned. With my public
consumer protection hat on, I just really feel this group, and the folks
who do push PHRs need to have some sort of fiduciary responsibility to,
over protecting things that the general public are not aware about. And
so certification as a floor kind of protection, and I\'m not sure I
understand the \-- how it impacts innovation because we\'ve completely
dispensed with certification of any functionality. But as a floor, in
terms of protection just like a UL protection against electrocution, is
that they have certain security and potentially privacy policy baked in.

So if we started it out, like Ross was saying, for like ultimately comma
certification of PHRs may be a useful tool and go through the logic that
he described, plus what are the steps, which include performing
standards and then if some of our recommendations said what the
immediate next step should be, we can start this ball rolling. But my
nervousness is that if we don\'t start this discussion and where we want
to go, along with Ross, I\'m nervous we\'re not going to act quickly
enough.

[**\>\> Rose Marie Robertson:**]{.underline}

Let\'s just take a process pause here for a second. I think that this is
something we will \-- so we can certainly, between now and Friday,
generate a new paragraph, a new description. We will have to have a vote
and not everybody who will vote, needs to vote is here at the moment. So
we probably will have to do this voting by mail. By e-mail.

[**\>\>**]{.underline}

If I could just make one comment.

[**\>\> Rose Marie Robertson:**]{.underline}

Sure.

[**\>\>**]{.underline}

If there\'s a natural flow, policy, standards, interoperability, I
don\'t think anybody would have a giant issue with kind of the wording
that Ross had at the end that says as these things naturally come
together, we should think through, consider, develop, whatever, you
know, some certification. I don\'t think you\'d have an electrocution
responsibility to it, okay? But so I think that if it\'s in the natural
flow and if it\'s a commitment to consider or to work on, you\'d get the
consensus you\'re looking for.

[**\>\> Rose Marie Robertson:**]{.underline}

I mean lack of privacy could electrocute your employability.

[**\>\>**]{.underline}

I\'m not even \--

[**\>\>**]{.underline}

Whether or not people think this certification would cause rapid
adoption, because I think \--

[**\>\> Rose Marie Robertson:**]{.underline}

Right, or not.

[**\>\>**]{.underline}

But I would pose we would support, and along that lines, and that\'s
natural flow, steps, and then consideration of, so that it\'s on the
record and we try figure it out.

[**\>\>**]{.underline}

And.

[**\>\> Rose Marie Robertson:**]{.underline}

Nancy?

[**\>\> Nancy Davenport-Ennis**:]{.underline}

I think Rose Marie, a point to support the position of Ross Martin and
also Paul, the comments that you were making and David certainly
recognizing those comments and the input that you have as well, as well
as those of you in the room that have shared comments around the matter,
I think all of us would probably agree that as policies and standards
are defined, that we would then anticipate adoption and approved usage
of those same processes. Which in and of itself would lend a first step
type of certification, moving forward, and then indeed would make an
ultimate process of defining certification far more appropriate, and
would probably engender a broader base of support from throughout the
country.

The caution, as we move forward, is I think Consumer Empowerment working
group has a responsibility to look at what are some of the concerns that
will need to be addressed across the country by everyone working with
providing PHRs to the consumer. And so we need to be universal in our
approach as we move through this process. And I think that\'s what the
whole team has been saying this afternoon.

**[\>\> Davette Murray:]{.underline}**

This is Davette, I would like to make one additional comment. I think
one of the pros of saying something in some format about certification,
that it would encourage the vendors to say, why \-- well, I can\'t work
in a box, so at least they would like partner with other people. To me
it would be an incentive for them to partner with other people and build
consensus, because they know eventually certification may come in some
format.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. So let\'s \-- I think we\'ll \-- we\'ve had good discussion of
this and I think we\'ve \-- and we\'ve had both written discussion of
this in e-mails and good discussion here verbally about the issues in
and around certification, the problems it could cause, the potential
benefits of it, the concern about timing, and what we\'ll do \-- Ross,
would you and Kelly and Michelle put together \--

[**\>\> Ross Martin:**]{.underline}

I\'m starting to type out something now for people to react to.

[**\>\> Rose Marie Robertson:**]{.underline}

That we can e-mail out to the group and get kind of an official approval
or not on it. And we\'ll take into account, we\'ll promise to take into
account the points of view of those who are on the side that doesn\'t
get the most votes. Whichever that turns out to be.

Okay. Let\'s move on to \-- I think that was really the main issue in
the findings area, we haven\'t had other significant comments there.

[**\>\>**]{.underline}

Rose Marie, I just had one small comment.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay.

[**\>\>**]{.underline}

At the phrase right before the certification paragraph I think it says
something about we will demonstrate the utility and value. I think we
should take a more humble tone in this paragraph and all these should
refer to learning, identifying, inform our understanding, et cetera, but
not presume that we know that these will be beneficial until the
evaluations are done.

[**\>\> Rose Marie Robertson:**]{.underline}

Potential utility and value?

[**\>\>**]{.underline}

Sure.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay, good. Good point.

We can be humble. The PHR vendors may not want to be so humble.

Okay, let\'s turn to interoperability and portability, and talk through
this section. Let me just look, in terms of \-- I think those were not
areas on which we got further e-mail comments. So \--

[**\>\>**]{.underline}

1.2 about the certification.

[**\>\> Rose Marie Robertson:**]{.underline}

Yeah, I guess \-- so that \-- so recommendation 1.2 is we\'re going to
need to include that in our \-- in this new paragraph that we\'re \-- so
we\'ll be voting on the paragraph in the findings, and the paragraph
here in 1.2.

**[\>\> Kelly Cronin:]{.underline}**

We may want to just focus a little more on the EHR/PHR portion of it and
talk about that and that\'s something that could be built on to an
existing process. People may have different opinions on that subset.

[**\>\>**]{.underline}

The one thing I\'ll point out on EHR to PHR portability, at least when
you look at CCHIT, I think the thing they need to think about as they're
working on that charge is the ability downstream to be interoperability
with PHRs, something we all want.

[**\>\>**]{.underline}

Right.

[**\>\>**]{.underline}

I would think we would all want and is important. I did, as I raised in
e-mail comments, have concerns about the addition of PHR to PHR
interoperability because I think it\'s premature and again you need
standards and what Steve discussed earlier, I have some real concerns
about. At this time.

[**\>\> Rose Marie Robertson:**]{.underline}

So talking about the EHR/PHR interoperability first, then, and we\'ll do
some rewriting of this paragraph, is there agreement that we think an
ideal, in fact, is to have EHR/PHR interoperability? We all think
that\'s a good thing ultimately, and \--

[**\>\>**]{.underline}

Rose Marie, I wouldn\'t support that as a blanket statement. There may
be some applications and users that that\'s valuable for but I think
others it\'s not and I think again it\'s premature for us to claim to
know that.

[**\>\> Rose Marie Robertson:**]{.underline}

You say premature to certify EHRs on their ability to provide that
interoperability? Would you \--

[**\>\>**]{.underline}

EHRs or PHRs? Sorry.

[**\>\> Rose Marie Robertson:**]{.underline}

EHRs?

[**\>\>**]{.underline}

E?

[**\>\> Rose Marie Robertson:**]{.underline}

E. E, as in Edgar.

[**\>\>**]{.underline}

I think the efforts of certification for interoperability by CCHIT are
very useful and if they are able to certify interoperability among
electronic health records, then the PHR market can certainly take
advantage of those data streams if they wish. But I don\'t \--

[**\>\> Rose Marie Robertson:**]{.underline}

So that it\'s a benefit to the \-- we want to be of benefit to both the
PHR market and its consumers, and so it would be of benefit to both the
consumers and the PHR vendors if in fact EHRs were asked to have their
data in a way that was interoperable.

[**\>\>**]{.underline}

I think EHRs are already being asked that question through a variety of
channels.

[**\>\> Rose Marie Robertson:**]{.underline}

Right.

[**\>\>**]{.underline}

The consumer marketplace, which is very different than the institutional
marketplace, I think it\'s a different issue to establish certification
for PHRs in this same set of tests. So I would be very hesitant to
assume that\'s a desirable path right now.

[**\>\> Rose Marie Robertson:**]{.underline}

But you\'d say it\'s a desirable path that the data streams should be
available to PHRs?

[**\>\>**]{.underline}

Yes.

[**\>\>**]{.underline}

So may I suggest a wording?

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

[**\>\>**]{.underline}

Now, this is reflected in the \-- one of those four key highlighted
things, because we did make a statement about, that bears on this.

[**\>\> Rose Marie Robertson:**]{.underline}

Which four highlighted thing?

[**\>\>**]{.underline}

Right under the broad charge, we listed four key issues.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay, yes.

[**\>\>**]{.underline}

And number 1 made a statement regarding the desirability or what is
ideal. And I think that bears on this conversation. And it seemed to say
one is ideal and one is desirable. May I suggest that this discussion
may sound like that it is \-- well, let me just \-- ideally personal
health data can be exchanged among PHRs and EHRs under the control of
the patient while preserving the meaning of the data. And what I tried
to do there is to address this movement of data between and among PHRs
and EHRs, which I think everyone just said they agreed with, while
preserving the controls for the patient, and the interoperability, which
is preserving the meaning of the data.

[**\>\> Rose Marie Robertson:**]{.underline}

And that \-- and you\'re proposing that as a substitute for the way
we\'ve said \--

[**\>\>**]{.underline}

Correct.

[**\>\> Rose Marie Robertson:**]{.underline}

Highlighted bullet number 1.

[**\>\>**]{.underline}

And then of course that then can be reflected in recommendations we
have. That\'s the reason for putting it up there.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay, so then how \-- do you have a proposal for the wording of
recommendation 1.2? Changes in that?

[**\>\>**]{.underline}

Well, I think it gets tied up in certification but I do think that the
EHR/PHR certification, interoperability is useful.

[**\>\> Rose Marie Robertson:**]{.underline}

So perhaps we should reiterate that bullet number 1 a little more
clearly here rather than tie it, since we\'re not going to be quite as
specific about certification.

[**\>\>**]{.underline}

Right.

[**\>\> Rose Marie Robertson:**]{.underline}

And what it will do, since we\'re saying it's going to need to be
tested, maybe we want \--

**[\>\> Lorraine Doo:]{.underline}**

Rose Marie?

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

[**\>\> Lorraine Doo:**]{.underline}

This is Lorraine. And maybe based on what Ross is rewriting, this
recommendation becomes more one of study. Because there\'s going to be
so much development over the next couple of years. And so rather than
choosing criteria, this is one where we are recommending that we
continue to monitor and develop a program where we could then look at
certification and prioritizing which areas should come first, when
appropriate.

[**\>\>**]{.underline}

I guess \-- I think Kelly\'s question was we don\'t necessarily all have
identical beliefs on EHR/PHR interaction.

[**\>\>**]{.underline}

Right.

[**\>\>**]{.underline}

I\'m trying to find a statement that could be accepted by all of the
group and then in the future \-- I mean, that\'s sort of almost like a
principle, and in the future we can design recommends that get
increasingly \-- increasingly move us toward that goal.

[**\>\>**]{.underline}

Right.

[**\>\>**]{.underline}

But the statement that exists now has one perspective that may not
include the other, and so I\'m trying to find something that includes
all. That\'s a little bit independent of the recommendation but the
recommendation would flow from a principle that we could all adopt.

[**\>\>**]{.underline}

Okay.

[**\>\>**]{.underline}

I have a question. We\'ve already talked about here the need that we
have to do more work in this area and aren\'t there supposed to be use
cases that are going to be coming out that\'s going to further define
HITSP work? And I think before we get to, I mean, when we talk about
whether PHR to EHR interoperability or PHR to PHR interoperability
there\'s clearly more work that HITSP needs to do and maybe that ought
to be more of a focus rather than the certification at this stage
because the standards development has to come before certification
anyway, and we haven\'t seen what that use case \-- or at least I
haven\'t seen, is going to be but shouldn\'t there be building upon
that? And if that use case is going to be presented at the next AHIC
meeting, I don\'t know if that\'s the intent. Do we just withhold until
we see that use case and we can build a recommendation around that and
the work that HITSP needs to do?

[**\>\> Kelly Cronin:**]{.underline}

I think we did talk last time that in this first round of
interoperability specifications there\'s actually quite a bit that does
relate to the exchange and portability of data that would be in a PHR
and would also be in an EHR and I think HL7 has done a lot of
performance criteria around that. So there is a baseline to build on
that may not be ideal for us, I mean we obviously want a lot more
standards and specifications named by HITSP to make this more robust
over time.

But I thought I remembered us talking over the last four months that we
would be starting off very small and then building on that. But that
there is this window of opportunity in the marketplace to try to get
something started, even if it is very small.

[**\>\> Rose Marie Robertson:**]{.underline}

And we did \-- you know, we backed this language down, we sort of
down-regulate how we look at the language each time, I think. We backed
this down to say support in developing and choosing criteria. So it\'s
not that we\'re saying they must do this now. We\'re saying we want them
to be \-- we want this to be being thought about. And that the two items
that seemed \-- that it seemed everyone was in fair agreement about, was
the fact that we want the data stream available so that that
interoperability seemed valuable to our broad charge of getting these
more adopted and having the market be facilitated, really. The PHR to
PHR part was really a matter of portability. That was a matter of kind
of, again, protecting the consumer by saying if you move from one place
to the other, you really want to be able to take that with you.

[**\>\>**]{.underline}

And it\'s interoperability here, not the portability.

[**\>\> Rose Marie Robertson:**]{.underline}

And the question is do you need to be interoperable to be portable?
You\'re right. We didn\'t \-- I mean, the reason for wanting that was
for ease of portability. Maybe that\'s \-- I don\'t know if that\'s \--
how would we make \-- we could make it portable by saying here\'s your
printout, you can go type it into the next PHR. But we thought that
really these would be much more \-- that the uptake would be greatly
enhanced by having people know when they went to the next employer or
the next health care system, they could basically push a button and have
the data come too.

[**\>\>**]{.underline}

It seems that \-- I mean, as I hear discussions too, there\'s more work
that HITSP needs to be doing and do we need to focus a little bit more
on that as well.

[**\>\> Kelly Cronin:**]{.underline}

I think, I mean, we\'ll have a lot of opportunity through the use case
process to weigh in on that. I think our recommendations, if we want to
be targeting or focusing HITSP's work, we probably have an opportunity
to do that outside of this letter of recommendation. Because it\'s going
to be the use case that drives their work. So I think that that\'s, over
the next six weeks, going to be a chance for us to contribute more.

[**\>\>**]{.underline}

Do we need a linkage or building on, the use case has to build on the
recommendations here, you don\'t want them separate.

[**\>\> Rose Marie Robertson:**]{.underline}

They wouldn\'t, would they? If HITSP \-- if we\'re going \-- if we would
be encouraging HITSP to do this, then this recommendation would follow
from that.

[**\>\> Kelly Cronin:**]{.underline}

Right. I mean, I think what we\'re saying is, we\'re more focused on the
output of HITSP. I mean, quite honestly our first letter of
recommendation around HITSP stuff is already in progress in May, we were
just sort of validating what\'s being funded and is ongoing. So we can
do a recommendation of support again but it doesn\'t have tangible
impact. There\'s contractual obligations that are directed by HHS.

So but to start something new that people aren\'t going to be supportive
of would be different.

[**\>\> Rose Marie Robertson:**]{.underline}

And this is going to come back to us over the next 24 to 36 hours. Okay.

[**\>\> Kelly Cronin:**]{.underline}

Yeah, we're going to have to turn it around pretty quickly.

**[\>\> Krista Carlow:]{.underline}**

Could I just \-- this is Krista Carlow from Microsoft. I guess you know,
when I think about interoperability, and there\'s been a lot of
discussions about downloading information into the PHR from the EMR, yet
we know that a lot of physician offices don\'t have EMRs. I just wonder
if the recommendation perhaps shouldn\'t be more general with respect to
HITSP focusing on standards that would allow importation of lots of
different kinds of data from payor systems, from pharma and not just so
much just on EMRs, because I think we all recognize that initially a lot
of that information is going to come from all this other data.

[**\>\> Rose Marie Robertson:**]{.underline}

From other data streams, yeah, that\'s a good point.

**[\>\> Robert Tennant:]{.underline}**

Rose Marie?

[**\>\> Rose Marie Robertson:**]{.underline}

Yes, uh-huh.

[**\>\> Robert Tennant:**]{.underline}

It\'s Robert on the phone. I agree with that last statement. I think
that makes a lot of sense. A couple of quick points. One, do we want to
consider putting in a timeframe for the Confidentiality Workgroup to get
back to the broader group? We have dates throughout the recommendations
but none here. Second, we want to call, we want to call the Office of
Civil Rights, it\'s actually the Office for Civil Rights. In
recommendation 2.2 and 2.3. And in 2.1.2 \--

[**\>\> Rose Marie Robertson:**]{.underline}

We were still finishing up 1.2.

[**\>\> Robert Tennant:**]{.underline}

Okay.

[**\>\> Rose Marie Robertson:**]{.underline}

So can I just get to you hold that thought for a minute?

[**\>\> Robert Tennant:**]{.underline}

Sure.

[**\>\> Rose Marie Robertson:**]{.underline}

Sorry, we\'re a little behind you. But we need to catch up. It's good
that you\'re trying to move us ahead.

So including \-- do I see nods around the table about including the
discussion of other data streams here and not just focusing \-- this
does seem, now that you bring it up, fairly obviously too narrowly
focused.

[**\>\>**]{.underline}

And I think the comment that\'s been made is very consistent with
earlier comments around the use cases that are indeed going to identify
standards that aren\'t identified. So they complement the recommendation
that you\'re making.

The only other question that I had is we commented about the use of the
word "portability", that the word "portability" is absent in the
recommendation, and the question becomes is there an appropriate process
through which that word could be integrated into that recommendation?
Because we\'re universally viewing those as complementary functions. So
if we could, in the rewrite, if that\'s appropriate, consider the use of
the word "portability".

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. So that \-- other comments about 1.2? And that will come back to
us and we\'ll hopefully get quick responses from everyone over the next
24 hours so that we can finalize this on Friday.

Okay. Now, now 2.1. So, the \-- the next slide, and let\'s just set
ourselves a little time limit here. Let\'s see if we can, not easily,
but let\'s see if we can work through this in the next 15, 20 minutes.
Okay? Give us until 3:00.

All right. So privacy and security, recommendation 2.1, which has two
items under it. Comments on these?

[**\>\> Christina Collins:**]{.underline}

May I?

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

[**\>\> Christina Collins:**]{.underline}

This is Christina Collins, AMA. Quickly, recommendation 2.2, OCR to
provide guidance to clarify the protections provided under HIPAA for
consumers\' rights. For timely release of this information. I think that
the timelines to contend with HIPAA are relatively clear, as are the
remedies that are available for lack of disclosure within that
timeframe. That is, you make a complaint to OCR. I don\'t know that
there needs to be any additional clarification. It is what it is, and I
think that\'s fairly well settled by the law. So I\'m not certain \--
I\'d love to hear what the kind of history of the group\'s thinking was
on that. Because I don\'t know that that \-- I guess I\'m not certain
why that would be a productive recommendations.

[**\>\> Rose Marie Robertson:**]{.underline}

So the part of that paragraph that deals with HIPAA-covered entities,
you think could come out?

[**\>\>**]{.underline}

Well, it only addresses HIPAA.

[**\>\>**]{.underline}

What about non-covered.

[**\>\> Rose Marie Robertson:**]{.underline}

But for non-covered entities.

[**\>\> Kelly Cronin:**]{.underline}

Is anyone from OCR on the call?

**[\>\> Susan McAndrew:]{.underline}**

Hi. This is Sue McAndrew, I just joined.

[**\>\> Rose Marie Robertson:**]{.underline}

Hi, Sue.

[**\>\> Kelly Cronin:**]{.underline}

Can you share your opinion on this?

**[\>\> Susan McAndrew:]{.underline}**

I just joined, so the it will have to be restated. I apologize.

[**\>\> Rose Marie Robertson:**]{.underline}

So we\'re looking at recommendations under privacy and security.

**[\>\> Susan McAndrew:]{.underline}**

Uh-huh.

[**\>\> Rose Marie Robertson:**]{.underline}

And we\'re looking in particular at recommendations 2.2 and 2.3. 2.2,
the HHS Office of Civil Rights should provide guidance to clarify the
protections provided under HIPAA for consumers rights to timely access
to health information requested from covered entities. And the comment
has been made that that really is already, that guidance is already
clear.

**[\>\> Susan McAndrew:]{.underline}**

Well, there is plenty of guidance. There is always, it's been my
experience, there is no amount of guidance that is totally clear. Or
that couldn\'t stand more.

**[\>\> Kelly Cronin:]{.underline}**

Sue, this is Kelly. I remember when we had this conversation a couple
months ago and Len Egan (ph) joined us. One of the comments that was
made and I think she was also sort of reflecting on some of the regional
meetings that were coming out of the RTI contract on privacy and
security.

**[\>\> Susan McAndrew:]{.underline}**

Right.

[**\>\> Kelly Cronin:**]{.underline}

And actually so I think she\'s also articulating something from her own
personal experience, in that providers are interpreting HIPAA in such a
way that they are often not allowing timely access to personal health
information, because they\'re particularly fearful of liability. And if
there is any ambiguity in their counsel\'s interpretation of current
guidance or current regulations with regard to what is appropriate for
timeliness, then perhaps there is a window to just make it more clear
that this is their obligation and there\'s no, there should be no
increased liability associated with making this information available.

[**\>\> Rose Marie Robertson:**]{.underline}

So we\'re really a particular case, I mean the PHR is a particular case
of the big general issue of how do you go get your health information,
and there were a number of anecdotes around the table of, you know,
people spending days and many dollars trying to wrest that information
from the medical care system.

So I think \-- you know, our issue about it has to do with PHRs, but it
might be an opportunity to clarify that more broadly.

[**\>\> Kelly Cronin:**]{.underline}

The other \--

**[\>\> Susan McAndrew:]{.underline}**

I mean \--

[**\>\> Kelly Cronin:**]{.underline}

I mean, we probably have not articulated clearly, is that currently I
think there\'s what the 30-day requirement, but that\'s under a paper
scenario. And if we\'re talking about electronic world, then it should
be much more readily available to share with patients if in fact it is
electronic. And should there be a more narrow timeframe, like a five-day
or one-week window, if in fact whatever type of provider does have that
data available electronically.

**[\>\> Susan McAndrew:]{.underline}**

Well, I guess this is, in part, the issue. With regards to a PHR, and
assuming an entity is using the PHR as at least one portal to fulfill
the HIPAA access to records requirement, you know, we would be in a
position of describing it in that way, and that's the role it fills, and
how the requirements apply to it. But as you note, it is, the standard
is 30 days and we would not through guidance be articulating a mandate,
at least, or a condition that would create a HIPAA violation, of a
shorter time period. We certainly could in that guidance recognize how
this electronic portal would make almost 24/7 access to the records
possible. And \-- but then we would be back struggling with an ultimate
question, as this thing rolls out more permanently, it would be one of
those questions is should there be some other standard, whether driven
through HIPAA or driven through processes inherent to a RHIO, that would
raise the expectation, or at least it could be, the more ready access
certainly could be a selling point.

**[\>\> Lorraine Doo:]{.underline}**

Rose Marie?

**[\>\> Rose Marie Robertson:]{.underline}**

Yes, uh-huh?

**[\>\> Lorraine Doo:]{.underline}**

This is Lorraine. And I'm trying to understand the problem a little bit
better. If we are talking about a PHR offered by a HIPAA-covered entity,
or any organization for that matter, I think the purpose behind an
organization offering a PHR is so that individuals do have access to
their data. That's why they've created it, by part of some business
definition. And if a PHR was offered then, let's say, by a HIPAA-covered
entity, Susan's right, that it is essentially available 24/7 because
it's probably Web-enabled. Or Web-based. And you wouldn't be asking the
health plan for that information, because it would be there.

**[\>\> Rose Marie Robertson:]{.underline}**

I guess you might be asking them for it if you wanted to move it to
another entity.

**[\>\> Lorraine Doo:]{.underline}**

Oh, is this \-- so the question is related to portability?

**[\>\> Rose Marie Robertson:]{.underline}**

Well, I guess the first \-- like I said, there might be an initial
question about how quickly data gets to the PHR, but that's really a
matter of how quickly can it be signed off on by, you know, the
appropriate level of person. So I don't think that's so much an issue.
It seems to me that the, you're absolutely right, that, you know, if
it's there, it's there, and you have access to it anytime. Did we, you
know, in the previous discussion when we were talking about portability
and interoperability, we were talking about being able to get your
records, if you will, out. Did we, were we thinking about that,
including that concept in here, that it was a matter of \-- so in
essence, the real benefit of PHRs in practices is it allows you to deal
with this obligation in a simple, straightforward way, because the data
is already, is always available.

**[\>\>]{.underline}**

And typically you can produce a report, even if it's printed, to then
take to your next provider, or plan, until we have portability standards
that have been tested and adopted.

**[\>\> Rose Marie Robertson:]{.underline}**

We have a question here \--

**[\>\> Christina Collins:]{.underline}**

Christina Collins. I'm sorry I sort of started us down this path, I'll
apologize, with my vaguely worded initial question. And I appreciate the
clarification, Kelly, that this is really directed to providers, and
their understanding of their turnaround times and whatnot, so thank you,
and I understand why this is in here and why it's worded as it is, so
thank you for your indulgence on that explanation. I guess though, I do
want to add in a little piece of caution, or care, here with the
expectation that because things are electronic, that they're going to be
processed more quickly through a physician's office. Because a personal
health care record is very, very different, in some instances from the
treatment records and the notes and the information the physicians
themselves keep. And the physicians keep those obviously for a number of
other reasons besides just a record of care. It's a legal document, and
there are some, physicians, of course, do have some heightened fiduciary
responsibilities, to ensure that everything that is disclosed is indeed
appropriate to disclose in that situation. So it's not just a situation
where you're just hitting forward because someone has asked for the
record. They then are tasked with the legal responsibility of going
through and doing legal analysis of all the parts of the record to
ensure that it is appropriate to release. That takes time, so even if it
is electronic that legal analysis still needs to happen before the
records go out.

**\>\>**

I wasn't assuming it was the whole legal record that the doctor owns, I
apologize. It's just the data in the PHR, whatever is there.

**[\>\> Christina Collins:]{.underline}**

But I guess my point being that the separation is going to have to
happen at some point \--

**[\>\>]{.underline}**

Right. Absolutely.

**[\>\> Christina Collins:]{.underline}**

Okay.

**[\>\> Rose Marie Robertson:]{.underline}**

And here we really do mean, because we said "personal health
information", I guess we meant by that definition the data that could be
placed in a PHR. So it wasn't things that were inappropriate to release.

**[\>\> Ken Majkowski:]{.underline}**

This is Ken Majkowski at RxHub. I think a point of clarification,
because I heard someone say the timeliness of getting the information to
the PHR, and I think we should make sure we concentrate on the
timeliness of getting the information to the patient, and not the PHR.
The patient may have to input the data, even if it's electronic, for
example, unless there's interoperability and that's way down the road.
So I think we should be clear on the definition here.

**\>\> Steven Posnack:**

This is Steve Posnack, I'm sitting in for Jodi Daniel today. I guess,
I'll go through my understanding of this issue, and I'm not a HIPAA
expert, but if those that are could help me understand this a little
better. I think the principle that we're trying to get to is that the
first time, when you ask for access, you need to get, you receive that
eventually, within 30 days, and it's not automatically in your PHR or it
doesn't automatically go to the patient, you need to ask for that, and
that request needs to be honored within the timeframe. So part of this
guidance, I'm guessing, would be part of the process of asking and then
the turnaround time, with it being electronic, would there be a
difference, and getting to the point of there's additional stuff in the
record, the guidance would also go down the road of determining if
there's a certain amount of access, or the data elements needed to be in
the PHR aside from the notes and other information that might not be
critical to starting the PHR, at least, and what that would mean, and
what that would look like.

**[\>\>]{.underline}**

Well. Okay. Let me \-- the current HIPAA rule defines a set of
materials, which we call the "designated record set" which encompasses
the complete medical record, as well as other important materials
maintained by a covered entity that are used to make decisions about
that individual. So it does give the individual, with certain
exceptions, rights to come in and ask for access to or a copy of their
designated record set that's maintained by that covered entity. They can
ask for all of it, they can ask for a portion of it, and then the 30 day
timeframe kicks in for the request to be honored. The request \-- and
the individual can, now, request that that information be provided to
them in electronic form, if that is how the material is kept by the
covered entity and it's easy for the covered entity to do that.

**[\>\> Rose Marie Robertson:]{.underline}**

And is there guidance about that? That sounds, "if it's easy for the
entity" is a sort of subjective \--

**[\>\>]{.underline}**

Well \--

**[\>\>]{.underline}**

They can charge money for it, too.

**[\>\>]{.underline}**

Well, there is a copying fee that they're allowed to charge, which is a
little difficult to translate into an electronic copy, but, I mean, that
may wind up with a different range of costs, anyway.

**[\>\> Rose Marie Robertson:]{.underline}**

Because the copying fee is based on not just the paper and the toner,
but the person it takes to go and do it. So the cost of the person, the
cost of someone who has to go and actually, you know, push send, if you
will, for that particular record set, there is still some cost to that,
so it\'s reasonable there should be some charge. But the time of doing
it for that data set should be shorter. Kelly, that\'s what you were
saying.

[**\>\> Kelly Cronin:**]{.underline}

Yeah.

[**\>\>**]{.underline}

Rose Marie, I think the preamble that talks about that in the privacy
rule and I think it says you can charge a reasonable cost-based amount.
So you can\'t charge a handling fee, for example, or something.

[**\>\> Rose Marie Robertson:**]{.underline}

Right.

[**\>\>**]{.underline}

Right, but you can charge for the time that it takes the person to
actually copy. And right now the application is largely in terms of how
long does it take you to Xerox the pile of paper.

[**\>\>**]{.underline}

But the other thing to keep in mind is a lot of states have their own
laws in regards to this.

[**\>\> Rose Marie Robertson:**]{.underline}

But I guess what we\'re, I think what we were asking for is the HIPAA
rules that would supersede state regulations. So the states can do what
they want, but HIPAA is a national \--

[**\>\>**]{.underline}

Well, to the extent the state law creates a fee that meets HIPAA\'s
cost-based standard, we would defer to that state law. At least in terms
of the degree of reasonableness. But in any event, we have the
individual\'s access right in general, as part of our consumer-oriented
outreach materials. We certainly can do a more comprehensive fee, but
you know, I do think because of the range that we\'re likely to
encounter in terms of how much information is really going to be
imported into a PHR, and therefore be accessible through a PHR, I\'m not
sure \-- in many places, in some perhaps \-- that in the majority of
places where having a PHR will completely fulfill your access
obligations to the individual under HIPAA.

[**\>\> Rose Marie Robertson:**]{.underline}

Let me just see if this question is right.

Perhaps we had a sense that both providers who are thinking of having
PHRs, you know, tethered or related to their electronic records, or
individuals who might be about to choose a personal health record, have
both heard of HIPAA. And they might wonder how HIPAA relates to that
personal health record. And so even though there is guidance about
access in other circumstances, it seems relevant to say that there
should be some clear guidance about what \-- I mean, because we\'re
asking you questions, we don\'t understand and we\'re pretty \-- we know
a fair amount about it, I would bet that consumers and providers don\'t
know either, and would benefit from some guidance.

So I guess the question is, is it reasonable for this Workgroup to ask
OCR to think about delineating what HIPAA means in the world of personal
health records?

[**\>\>**]{.underline}

It certainly is a reasonable request.

**[\>\> Krista Carlow:]{.underline}**

Krista Carlow from Microsoft. Not to complicate it any further, but I
think that we need to think about patients or their agents, because we
might imagine that their PHR application is sending an electronic
request to the physician\'s offices on their behalf.

[**\>\> Rose Marie Robertson:**]{.underline}

Right.

[**\>\> Krista Carlow:**]{.underline}

So we want to make sure that I think as we\'re looking at this area that
we clarify the agent\'s role.

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

So we might make \-- we might clarify that a little more, but we want to
be sure that it\'s okay with you if we make that request of you. Because
\-- and then we have another request. The recommendation 2.3 says that
OCR, in collaboration with CMS and private sector organizations should
develop policies and guidelines for authorization of data release from
PHRs to third parties, including the development of HIPAA-compliant
standardized authorization language for the HIPAA-covered entities.

And that\'s \-- those third parties might include some of these other
businesses, for example, that we talked about. They might include
another health care provider, they might include a family member that
you\'re giving access to.

So \-- and we might think of more examples. But there would potentially
be many examples. So there, again, in a new world where you have a PHR,
now the issue is how does, how does HIPAA relate to that, those
interactions? So we wanted to ask for, ask OCR to have, either develop
or clarify that there are or aren\'t policies and guidelines about that.

[**\>\> Susan McAndrew:**]{.underline}

And I guess we have a little more difficulty with that recommendation.
In two respects. One is, not sure about the collaboration with CMS other
than the fact that they, as a HIPAA-covered entity, the Medicare program
would be \-- I don\'t know, I\'m not sure why an authorization for the
release of data necessarily would involve collaboration with CMS.

**[\>\> Kelly Cronin:]{.underline}**

Sue, this is Kelly. I think when we initially started drafting and the
words changed, we were thinking that it might be CMS that would be
working with you because they will be releasing their own data and
pre-populating PHRs in their pilots, so if they could come up with a
standardization form even for those purposes, so it wouldn\'t
necessarily be to subsequent third parties but that initial really \--

[**\>\> Susan McAndrew:**]{.underline}

Okay, and that\'s the other part of the triangle here, is I mean right
now I would think it would \-- it would, like in the CMS situation, be
more of a concern of the need for an authorization to move the data from
a covered entity into a PHR, I\'m not sure where we are in terms of what
the HIPAA status is going to be of PHR \-- of entities that are
maintaining these PHRs, and to the extent they are not governed by
HIPAA, what, what a standard authorization would look like or need to
look like. That is \-- I guess I don\'t know really what we think the
problem is with the current authorization system.

[**\>\> Rose Marie Robertson:**]{.underline}

I guess the current authorization system doesn\'t involve \-- go ahead.

**[\>\> Kathleen Mahan:]{.underline}**

Hi. Kathleen Mahan with SureScripts. I\'m not sure either what this is
trying to say, but I certainly have a real-life situation where I could
see we want some guidance and policies and procedures set forth in terms
of us releasing data as a non-covered entity into a PHR administrator.
So I don\'t see that language. I only see "from" here, "of data released
from PHRs", where in my situation, data released from data source into
PHR. So that\'s one we\'re \-- I would like to see some guidance, you
know, SureScripts I think would like to see some government guidance
coming on that.

[**\>\>**]{.underline}

Although, you are acting as a business associate.

[**\>\>**]{.underline}

Yeah.

[**\>\> Rose Marie Robertson:**]{.underline}

So we\'ll include that other directional, that reverse directional
language in here. And I guess if there\'s a serious problem with our
asking you that, we would need to know it.

[**\>\> Susan McAndrew:**]{.underline}

Well, you know, I don\'t \--

[**\>\> Rose Marie Robertson:**]{.underline}

Let me say, because we have to move on to the next section, we don\'t
need to know it this minute. We could \-- but we do need to know it
before Friday.

[**\>\> Susan McAndrew:**]{.underline}

But the question is, what is the authority \-- what would be the
authority of our guidance on this outside of the world of HIPAA \--
those who are required to abide by HIPAA?

**[\>\> Lorraine Doo:]{.underline}**

Sue? Or Rose Marie. This is Lorraine. And I might be able to provide
some memory, if I recall our discussion on the rationale for this
recommendation, is because even though the HIPAA regulations do provide
the outline for what the required elements are in an authorization to
release or disclose data, the industry had a very difficult time
implementing it and really wanted a standard form so that every provider
and every health plan, and anyone who is going to be involved in that
exchange was essentially asking the question the same way so that
consumers understood what it was they were releasing. There were issues
related to how one would protect psychology records, for example.
Different diagnoses, some people use check boxes, some people use lines.
So there was industry confusion in the implementation just from a
regular HIPAA perspective. And I think part of this discussion involved
trying to get some sense of standardization for this part of the
process.

**\>\>**

Right.

[**\>\> Susan McAndrew:**]{.underline}

Okay, but that was three years ago.

[**\>\> Kelly Cronin:**]{.underline}

We\'re just entering into a world where we have one more intermediary,
so to speak.

**\>\>**

Right.

[**\>\> Kelly Cronin:**]{.underline}

And it\'s not a well-defined intermediary, but we know that some are
acting as business associates. Just that's not the complete universe of
interest, so I can understand your concerns about authority. But Sue,
perhaps we can work offline about how to make this more meaningful, and
consistent with your level of authority right now?

[**\>\> Susan McAndrew:**]{.underline}

Okay.

[**\>\> Rose Marie Robertson:**]{.underline}

Great.

[**\>\> Nancy Davenport-Ennis:**]{.underline}

Sue, this is Nancy Davenport-Ennis. I think one of the comments I would
make, perhaps, is certainly in support of Kelly\'s observations here,
but perhaps because of the expertise of your office on these particular
matters, at the very minimum you would be collaborating as a consultant
in this process based on your knowledge and your current
responsibilities in and around HIPAA. And so perhaps we can amend the
language of recommendation 2.3 to reflect more clearly that you would be
working as a collaborator with others in this particular matter.

[**\>\> Susan McAndrew:**]{.underline}

And that \-- that is a step in the right direction, I think.

[**\>\> Nancy Davenport-Ennis:**]{.underline}

Okay. Great, thanks.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay, recommendation 2.4 here, we talked about the State Alliance for
e-Health, creating a compilation of state privacy laws that could affect
PHRs, identifying differences between those laws and HIPAA. And
reporting back to the Community, there was some discussion about whether
there was a need to do that. There clearly are places where there was a
comment that we don\'t need to identify places where there aren\'t any
problems, we just need to identify places where there are barriers.
There clearly have been some substantial barriers identified, and we
left this in because we thought that knowing where, knowing where those
barriers were was important and it would be better to work on the
barriers ahead of time rather than just have them spring up as issues.
Is there any problem with leaving this in here? It\'s a rather \--

[**\>\> Steven Posnack:**]{.underline}

Not as is a little problem. This is Steve Posnack, sorry. The date is a
little bit of an issue. And this is a lot of work and resource-intensive
for this contract, and this is not the foremost priority of the State
Alliance for e-Health yet, because the task force that\'s going to be
\-- that would be responsible for this would be I think it\'s called the
health information protection task force. Is that the finalized name?
And they\'re going to be focusing on the output from the RTI privacy and
security \--

[**\>\> Rose Marie Robertson:**]{.underline}

Would two years be a more reasonable time frame?

[**\>\> Steven Posnack:**]{.underline}

We would probably be a little more comfortable with that. It\'s just a
matter of expectations and the resources involved in doing a study like
this.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay.

**[\>\> Robert Tennant:]{.underline}**

Rose Marie?

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

**[\>\> Robert Tennant:]{.underline}**

Hi. It\'s Robert. Yeah, I agree with that when groups started to do this
they were looking at bills of a million dollars-plus, to create these
lists of state privacy laws. I wonder if we want to craft it more to
direct them to review existing compilations first. To see if they don\'t
have to re-invent the wheel.

[**\>\> Rose Marie Robertson:**]{.underline}

I wonder about \--

[**\>\> Steven Posnack:**]{.underline}

Well, the existing part may fit in with a lot of the outputs that the
RTI contract will bring to the table. Because they\'re doing an analysis
from within right now of all the states. So you know, maybe it will tie
that in better. But like just what was echoed on the phone there, it
would incur a lot of legal fees involved in doing an analysis of all the
state laws, and to go \-- to make this 50-state and territorywide that
would be pretty intensive and take a lot of time as well.

[**\>\> Rose Marie Robertson:**]{.underline}

So we\'ll move out the timeframe.

[**\>\> Steven Posnack:**]{.underline}

It could be an \'08 or \'09 type of endeavor if that\'s what we\'re
looking at.

[**\>\> Rose Marie Robertson:**]{.underline}

Let's move to incentives for adoption and here\'s where we've had a
broader set of inputs than we had. David, I think we saw your last
e-mail, I think staff did try to incorporate, although not
word-for-word, the recommendations that you sent. They do look a little
different, a little different here, but they were trying to incorporate
the majority of it, and we can maybe work from the staff draft today and
then see what changes we think we need to make. Now, this has become
really quite an extensive process here. Where we\'re really asking for
\-- Robert, did we answer your thing about timeframes back \-- I\'m
sorry, I skipped over you before and then we didn\'t pause on you.

[**\>\> Robert Tennant:**]{.underline}

We certainly didn\'t have timeframes identified for the Confidentiality
Workgroup, but maybe we don\'t want to give them timeframes, I don\'t
know.

[**\>\> Steven Posnack:**]{.underline}

This is Steve Posnack again. I\'m the lead staff person of that
Workgroup, so it is appropriate that I\'m here as well. We had discussed
having time frames in it. The issue is, like with your Workgroup here,
there\'s another group of people that want to focus on their priorities
as well, and we\'re in the middle of our prioritization process, the CPS
Workgroup and some of that will probably encompass 2.1.1. I can\'t
guarantee that that would happen. But it may be as part of what we\'re
looking at, and that would include what\'s different because it\'s
electronic. That\'s kind of the theme of the group right now. So that\'s
why time frames would kind of pressure us to do things that the
Workgroup may not be willing. But we are \-- as one of our criteria, we
are taking into account recommendations from other Workgroups because
that\'s part of our charge.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. So we can include timeframes. Do we \-- does \-- what is the will
of the group in terms of whether we should try to encourage our
colleagues in the other Workgroup, or leave it to their \--

[**\>\> Kelly Cronin:**]{.underline}

I mean, I think, you know, we haven\'t talked enough, because we've been
so focused on getting to this point, of what we\'re going to do in the
next 8 months. But if everyone is comfortable, I think we probably could
end up taking on some of these issues in a much more thorough way and
come up with some of the components of the privacy policies, continue,
you know, on what we\'ve already discussed and heard testimony around.

Perhaps add some additional privacy expertise to our discussions. Or
HIPAA expertise. And then get to the point where we might really vet
something through the CPS Workgroup, or bring certain people in on our
process.

[**\>\> Rose Marie Robertson:**]{.underline}

So we might help out.

[**\>\> Steven Posnack:**]{.underline}

We haven\'t been able to hash through 2.1.1 quite so much in terms of
getting a lot of feedback from our co-chairs and our members, but we did
discuss a little bit about having \-- because you\'ve had testimony from
the Altarum work and all the other information that you\'ve gathered, at
least having CE start this task for us and then we\'ll pick it up, if
need be, for larger policy discussions, or in some type of collaborative
Workgroup discussion.

[**\>\> Rose Marie Robertson:**]{.underline}

So we might try to redirect those in the \--

[**\>\> Steven Posnack:**]{.underline}

Maybe make it more of a joint effort.

[**\>\> Rose Marie Robertson:**]{.underline}

More of a joint effort, and then we could \--

[**\>\> Steven Posnack:**]{.underline}

Then we can work out the details as we make our plan for next year.

[**\>\>**]{.underline}

Is it really a joint effort actually, it sounds like our privacy issues
are really surrounding PHRs, which require some knowledge about the PHR
side.

**[\>\> Kelly Cronin:]{.underline}**

Yeah, I think that\'s right. There are probably a couple of people on
the CPS Workgroup who have knowledge of PHRs. But at this point I think
we probably collectively have the stronger understanding. So we\'d have
to figure out that balance of maybe we do sort of do the formative work
and figuring out the components or the principles for policies, and
perhaps engage the people we need to, or the co-chairs to make sure that
they\'re in alignment with what we come up. But I think we might end up
doing a majority of the substantive work.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. Recommendations 3, 3.1, 3.2, 3.3, 3.4, and 3.5. Let me say this,
that a real question is whether this pretty extensive amount of work,
whether we should try to get this all \-- get this completed and
described and moved ahead into the letter we send Friday. And I think
that would be reasonable if we can do it. We do have another option a
little later in the game but not very much later, Kelly, in, would it be
in March?

[**\>\> Kelly Cronin:**]{.underline}

Yes.

[**\>\> Rose Marie Robertson:**]{.underline}

Where we could potentially come \-- we could make a general
recommendation here and come back with the details of it March 6. Would
that fit with AHIC\'s planning, or will that throw a monkey wrench into
the works?

[**\>\> Kelly Cronin:**]{.underline}

Now, I think that\'s possible.

[**\>\> Rose Marie Robertson:**]{.underline}

I mean, if we have it all done today, we should \--

[**\>\> Kelly Cronin:**]{.underline}

It would be preferable to push forward because we\'re going to move on
to other things and it would be good to close out as much as we could.

[**\>\> Rose Marie Robertson:**]{.underline}

If our discussion gets \-- if we can\'t pull it together, then we do
have another option. So it\'s always bad to put that option on the
table, but \--

\[Laughter\]

[**\>\> Rose Marie Robertson:**]{.underline}

I apologize for doing that. Shouldn\'t give you an easy out.

Okay, let\'s work through these recommendations and let\'s try to do
this within the next, maybe 20 minutes or so.

[**\>\>**]{.underline}

Rose Marie, I'm driving, so I can\'t see the document. Is this the one
where we talked a lot about December 28th?

[**\>\> Rose Marie Robertson:**]{.underline}

Yes, uh-huh.

**[\>\>]{.underline}**

So there was one towards the end where we recommend somebody doing
something by December 28th, built upon things that won\'t be developed
until December 28th. I think it was like perhaps CMS offering some
policy \--

[**\>\> Rose Marie Robertson:**]{.underline}

Right, the last one. 3.4, HHS, through CMS and the Indian Health Service
should develop plans to offer portable PHRs with privacy protections to
their beneficiaries and report back about the plans no later and it
should take into account the results of studies and best practices from
2 1 and 3 2.

[**\>\>**]{.underline}

Results which don't come out until the end of the year.

[**\>\> Rose Marie Robertson:**]{.underline}

So we ought to at least make that timeframe different. I think the
concept is still good.

[**\>\>**]{.underline}

Correct, just the timeframe.

[**\>\>**]{.underline}

We could just show as available.

[**\>\> Rose Marie Robertson:**]{.underline}

Yeah. Why don\'t we make that \--

[**\>\> Robert Tennant:**]{.underline}

Rose Marie? It\'s Robert. I wonder if we want to add something maybe to
3.2.1, nowhere in this document are we recognizing that there\'s a lot
of work being done in the private sector and I wonder if we wanted to
request reports back from, for example, the Blue Cross Blue Shield
Association and AHIP's PHR project and perhaps Intel, Wal-Mart, Stopdia.
Or \-- because I think we don\'t want to forget the fact that the
industry is moving forward. And we want to find out exactly what\'s
going on and the successes and challenges.

[**\>\> Rose Marie Robertson:**]{.underline}

So should we make that "HHS should assess" or should we make it be that
\--

[**\>\>**]{.underline}

HHS could request. I wouldn't say, we can\'t force them but we can
request.

[**\>\> Rose Marie Robertson:**]{.underline}

And they\'re right here, so they\'re going to tell us.

[**\>\>**]{.underline}

(indiscernible) with Blue Cross Blue Shield. As many of you may have
heard the announcement, at least, of our work with AHIP and the PHR
portability and plans to submit this collectively, using commercials to
put these in place by the end of 2008 but many of our plans I know are
looking at midyear this year, or perhaps after open enrollment and may
not get started doing it until next year, in reality, in terms of
bringing changes into the system. So in terms of the timing, and I know
we\'ve talked about extending that date but we have to be cognizant that
this all is going to take time and operational guidance. I just
wouldn\'t want to put anything in and I know we\'re talking to CMS and I
don\'t know if Lorraine is still on the phone, too, about some things we
can do together in terms of pilots but there\'s going to be time there
based upon where we are and when things get fully operational.

[**\>\> Rose Marie Robertson:**]{.underline}

So would the comment here Robert be we should include in this, in
addition to HHS assessing how this might be beneficial, we might say
including the results, as available, of private sector efforts?

[**\>\> Robert Tennant:**]{.underline}

Yes, exactly. Something like that.

[**\>\> Rose Marie Robertson:**]{.underline}

Something like this? I mean \--

[**\>\>**]{.underline}

Encompass them all.

[**\>\> Rose Marie Robertson:**]{.underline}

Do we want to name you or \--

[**\>\>**]{.underline}

No.

[**\>\> Rose Marie Robertson:**]{.underline}

All right. You want to remain anonymous.

[**\>\>**]{.underline}

I think we should \--

[**\>\> Robert Tennant:**]{.underline}

If I can add one more \--

\[Laughter\]

[**\>\>**]{.underline}

That\'s fine.

[**\>\> Rose Marie Robertson:**]{.underline}

Go ahead.

**[\>\> Robert Tennant:]{.underline}**

Yes. It\'s Robert again. On 3.2.3, we are focused on architectural model
and I think that\'s not exactly as consumer-friendly as delivery systems
as well. I think we want to assess the impact on quality and
satisfaction of various delivery methods as well. So Web versus CD
versus flash drive, or whatever. But I think we need to look at delivery
models as well as the architectural models.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. Yes? Okay so architectural models and delivery. So we've got
examples of those. And delivery \--

[**\>\>**]{.underline}

Architecture models of PHR.

[**\>\> Rose Marie Robertson:**]{.underline}

And delivery models such as Web, okay.

[**\>\>**]{.underline}

3.3, do we know that VA is not doing this?

**[\>\> Kim Nazi:]{.underline}**

Right, this is Kim Nazi. I\'d like to comment on that.

[**\>\> Rose Marie Robertson:**]{.underline}

Good.

[**\>\> Kim Nazi:**]{.underline}

We have embarked upon development of a performance evaluation framework
specifically for My HealtheVet using the RE-AIM framework. We have some
very ambitious plans that have been initiated. The only comment I have
is that because we\'re a federal agency, we are required to get OMB
approval for our survey instruments, so I would report back to you, in
reference to 3.3, that we have a framework developed, that we\'re adding
to. We have survey instruments either developed or in progress. The only
concern I have about the timeframe is that I\'m not sure the status of
our evaluation work will be completed by that December timeframe, only
to the extent that it takes time to garner OMB approval for the survey
tools.

[**\>\> Rose Marie Robertson:**]{.underline}

Could we ask for an interim report at the end of the year?

[**\>\> Kim Nazi:**]{.underline}

Absolutely, and in fact I\'d be happy to provide you with some of the
planning documents or a status report at any time throughout the year.

[**\>\> Rose Marie Robertson:**]{.underline}

Great, then we\'re asking for something you\'re already doing, which is
always good. We can ask for a report that will \-- that we may get the
final report later. It would be \-- and I think it would be useful for
the group to see what the planning for your evaluation would be.

[**\>\>**]{.underline}

Okay.

[**\>\> Kelly Cronin:**]{.underline}

I think AHRQ, in particular, or those who actually start doing some of
the other evaluation work would find it helpful to use a survey that\'s
already been developed and piloted, or any other methods that you've
thought through that make sense for PHRs.

[**\>\>**]{.underline}

Or more importantly already OMB-approved.

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

[**\>\> Kelly Cronin:**]{.underline}

Exactly, John.

\[Laughter\]

[**\>\>**]{.underline}

Hear hear!

[**\>\> Kim Nazi:**]{.underline}

Part of what we\'re very excited about right now, you know, we have had
the pilot in place for several years, and we\'re doing the national
roll-out. Once the same kind of functionality is released in the
national product, the pilot will be sunsetted. What\'s interesting about
the evaluation of the pilot is that we actually have patients who for
several years have been using the PHRs, so VA\'s in a kind of unique
situation to do that and we\'re committed to providing those results to
the public.

[**\>\> Rose Marie Robertson:**]{.underline}

Certainly the gentleman who came and testified to us was a real
ambassador for it. So you\'ve got some very happy customers there.

[**\>\> Kim Nazi:**]{.underline}

Great.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay.

[**\>\> Kelly Cronin:**]{.underline}

I had submitted just a couple of kind of wordsmiths to 3.2.2, that I
just wanted to raise, and I know there were some questions and I think I
clarified some of them. But just in the 3.2.2, we thought it would be
make sense at the end of that first sentence, the long sentence where it
says "based on the use of these data" at the end and the current
availability of each data source, because that\'s something I think you
want to look at, not all the data may be easily and currently available.
And then looking at the next sentence, because of the low rate of
adoption, we wordsmith it "the study should begin with an examination of
experiences with PHRs, based on claims and administrative data". Because
what we\'re talking about of course is PHRs and people\'s experience in
how that data fits in. And then we thought for example the claims
administrative data you could look at CMS pilots or KatrinaHealth.org to
put some context in. Those were just minor things, I don\'t think it
changes the context at all, just clarifies it.

[**\>\> Rose Marie Robertson:**]{.underline}

The examination of experiences with the currently available PHRs is a
little \-- expands the scope just a little bit. Do we think that\'s
still doable, is that a, I mean, it's not huge, but a little more \--
you think that\'s worthwhile \-- do we have someone from AHRQ on the
phone?

**[\>\> Jon White:]{.underline}**

You do. Hi, this is Jon White.

**\>\> Rose Marie Robertson:**

Jon, yes, right. So it\'s a small expansion of 3.2.2.

[**\>\> Jon White:**]{.underline}

Yeah. I don\'t think that\'s unreasonable.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. Great.

[**\>\>**]{.underline}

To the whole group, I\'ll address the question. Would there be value in
having any survey information included in that evaluation process, only
because survey information may give you more timely reflections of more
current PHR use when you, when we move back to administrative data and
available claims to review, that data may be a bit older. So I don\'t
know whether you\'re planning on using any \--

[**\>\>**]{.underline}

I think AHRQ would be the one that's doing this study.

[**\>\>**]{.underline}

So to AHRQ, I think that would be a question we would like to pose,
because we may \-- if you do both, a set of surveys in combination with
the auditing of claims and administrative data, you may have a more
balanced purview of what\'s really happening in the PHR world.

[**\>\> Rose Marie Robertson:**]{.underline}

Jon?

[**\>\> Jon White:**]{.underline}

A great comment. I think it\'s a great point. I think what we would do
is once the Workgroup is finished recommending to the Secretary that
this is what we ought to do, we would want to have a fairly tight
feedback loop with the Workgroup about what we designed, you know, kind
of set up and get your input. That\'s a great point of input, but we\'d
want everybody\'s input on it as well.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. Great. So we\'re actually making good progress here. So \--
because we\'ve really covered 3, most of 3.2, 3.3, 3.4. Let\'s go back
to look at 3.1.

[**\>\> Lorraine Doo:**]{.underline}

Rose Marie? This is Lorraine. And I have, I guess, yesterday\'s copy of
the letter and we had submitted comments again this morning.

[**\>\> Rose Marie Robertson:**]{.underline}

Right.

[**\>\> Lorraine Doo:**]{.underline}

In 3.4, we had suggested actually adding in OPM and HRSA, and then some
consideration in case there were other federal agencies that might want
to be working on plans. Because it only mentions CMS and Indian Health
Service.

[**\>\> Rose Marie Robertson:**]{.underline}

Right.

[**\>\> Jon White:**]{.underline}

And actually, this is Jon \-- I was being quiet but I\'ll speak up
again. As you probably know, we have a funding opportunity for grants,
one of which is about patient-centered care through health IT. We\'re
anticipating PHRs will, some of them will be PHRs, and could factor in
there. Could at least contribute information.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. So who should we include in there?

[**\>\> Lorraine Doo:**]{.underline}

The ones we had thought of was OMB, and HRSA.

[**\>\> Dan Greene:**]{.underline}

You mean OPM, I think.

[**\>\> Lorraine Doo:**]{.underline}

I\'m sorry, I have OMB on the brain because of the surveys.

**[\>\> Dan Greene:]{.underline}**

They get on your brain.

[**\>\> Lorraine Doo:**]{.underline}

Yes, sorry.

[**\>\> Dan Greene:**]{.underline}

This is Dan Greene with OPM. We\'re working this area, I\'m only
hesitant a little bit because of fitting in how we operate into the
structure of this particular recommendation. It talks about developing
plans to offer portable PHRs. We don\'t directly offer PHRs. It\'s
through our health carriers. We wouldn\'t want to be misleading in
saying that all carriers will offer portable PHRs. Some are offering
PHRs. How portable they are, we don\'t even know yet. That goes back to
some of the work that\'s going to be done under 3.1, in assessing them.

[**\>\> Rose Marie Robertson:**]{.underline}

You know, if we put in the \-- we put in the words "consider
developing", I guess we want to be more \--

[**\>\> Dan Greene:**]{.underline}

Yeah, that just makes it okay, we considered it.

[**\>\> Lorraine Doo:**]{.underline}

Right, and \--

\[Laughter\]

[**\>\>**]{.underline}

A little too wimpy, right?

[**\>\> Dan Greene:**]{.underline}

Yeah.

[**\>\> Lorraine Doo:**]{.underline}

Right, and even that phrase, the "develop plans to offer portable PHRs",
this goes to our other set of comments related to the timing, which
someone had mentioned at the beginning of this part of the discussion
that we had a lot of deliverables for the December of 2007, and then all
of a sudden we had to have plans.

[**\>\> Rose Marie Robertson:**]{.underline}

So this one we're going to change to "as available". So we fixed that
part. And so OPM wouldn\'t want us to say it exactly this way.

[**\>\> Dan Greene:**]{.underline}

Right.

[**\>\> Rose Marie Robertson:**]{.underline}

So we\'ll perhaps get language from you afterwards. Is that \-- would
that be okay?

[**\>\> Dan Greene:**]{.underline}

Yeah. Again, I don\'t know how it will fit structurally, I\'m just
concerned, I don\'t want to water down this recommendation because we
have a different process. I guess really my preference would be to stick
with our involvement in 3.1 and then see where that goes.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. That seems reasonable. And I don\'t know about HRSA we don\'t have
\-- I think we would have to ask other agencies, I mean you know, it\'s
okay for us to suggest but we know the Indian Health Service is
interested. We know CMS is interested.

[**\>\> Kelly Cronin:**]{.underline}

Perhaps what we should be doing over the next several months, as we get
more into our subsequent work, is think about how our work will then
inform what the federal agencies do in either providing or incentivizing
PHRs, because if we do have some consensus or recommendations that are
advanced to the Secretary related to privacy, then there might be some
teeth we could put behind it. And if that serves as a basis to provide
some protections for at least how we provide services to beneficiaries
of our programs, then that might be something more tangible to build off
of.

**[\>\> Dan Greene:]{.underline}**

I support that. Dan Greene again, in that you know, now we\'ve got a
good sense of where the workgroup is going, and we\'ll of course have
the AHIC adoption this month. Then we \-- a recommendation might be for
just we will work with HHS and HHS I think might want to work
bilaterally with the various federal agencies on how each one can
uniquely support the program, rather than having a list of agencies
doing the same thing. Having different agencies doing different things.

[**\>\> Rose Marie Robertson:**]{.underline}

Yeah, another sort of set of test sites.

[**\>\> Dan Greene:**]{.underline}

Yes. Exactly.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. So let\'s say that we\'ll leave that done that way and let\'s go
back to 3.1. Here we do group a number of agencies, IHS, CMS, the
Department of Veterans Affairs \-- we need to search and replace
Department of Veterans Affairs for Veterans\' Administration \-- and OPM
should develop an evaluation framework. Any problems with that? Any
changes in that wording? Are we okay with that one? I hear no problems.
Okay. Now \--

[**\>\> Dan Greene:**]{.underline}

This is Dan Greene again from OPM. This one is different, I think, from
the other one, in that we\'re talking about something that\'s sort of a
standard process, is doing an evaluation. And this is a framework for an
evaluation. You would want to do that on all your programs.

[**\>\> Rose Marie Robertson:**]{.underline}

Right.

[**\>\> Dan Greene:**]{.underline}

I think it\'s more appropriate that it be \-- have a broader impact.

[**\>\> Rose Marie Robertson:**]{.underline}

Great. And then 3.5?

**[\>\>]{.underline}**

Rose Marie?

[**\>\> Rose Marie Robertson:**]{.underline}

Yes, uh-huh?

[**\>\>**]{.underline}

I\'m sorry. If I could comment on that.

[**\>\> Rose Marie Robertson:**]{.underline}

Yes.

[**\>\>**]{.underline}

I didn\'t mean to cut you off.

[**\>\> Rose Marie Robertson:**]{.underline}

No.

[**\>\>**]{.underline}

I wanted to say to the Workgroup thank you for recognizing the barriers
within the business model that physicians frequently experience in
adopting PHRs. Thank you for including that.

[**\>\> Rose Marie Robertson:**]{.underline}

Now, we have a comment from Lorraine. Do you want to speak to that?

[**\>\> Lorraine Doo:**]{.underline}

Yeah, and I know \-- I guess, yeah, the current status. One of the
comments that we had made is that this focuses on payment mechanisms
that look specific to just providers. And you know, provider payment
incentives. And we think there are probably incentives that could be
addressed in \-- for consumers also.

Because of the delivery mechanism and who is going to be offering
personal health records. And so we weren\'t sure thus should be so
specific to provider incentives. You know, clearly there are issues from
a CMS perspective on reimbursement, provider payments for these kinds of
things. It doesn\'t mean it can\'t be studied.

**[\>\> David Lansky:]{.underline}**

Rose Marie, this is David. When I wrote some language last week I also
suggested broadening this one over a variety of incentives that the
study would report back, as Lorraine says, on how a number of different
types of incentives, including the provider incentives, might enhance
this option. And that wording is in my e-mail from last week if we want
to \--

[**\>\> Rose Marie Robertson:**]{.underline}

Right. Let me pull that.

**[\>\> Lorraine Doo:]{.underline}**

You had much more robust language.

[**\>\> Rose Marie Robertson:**]{.underline}

Right, so the language here says, by December \'07 AHIC will recommend
to the Secretary a range of incentives intended to increase adoption of
PHRs. These incentives might include financial benefits accruing to
providers or other PHR offerors, financial benefits accruing to patients
and consumers, or other forms of economic benefit of established
effectiveness, e.g., employee productivity, customer loyalty.
Recommendations will include any available evidence documenting the
effectiveness of each type of incentive and how that incentive might
best be deployed to encourage PHR adoption.

So Lorraine, you would favor that \--

[**\>\> Lorraine Doo:**]{.underline}

We would be able to support that.

[**\>\> Rose Marie Robertson:**]{.underline}

Broadening. You would be able to support that broadening. The rest of
the group? Do I hear opposition, any opposition to that? There are no
heads shaking in the room. Are there heads shaking on the phone?

[**\>\>**]{.underline}

Sounds good.

[**\>\> Rose Marie Robertson:**]{.underline}

Apparently not. Yes?

[**\>\>**]{.underline}

Would it useful to maybe just have \-- again I\'ll be brief. I don't
want to take us down a path, but would it be helpful or useful also to
assure that any incentives for providers to utilize these are indeed
positive incentives and if we look at the world of carrots and sticks as
we frequently do in physician economics, is it fair to emphasize these
would only be positive incentives?

[**\>\> Rose Marie Robertson:**]{.underline}

Well, it says financial benefits.

[**\>\>**]{.underline}

Okay, great, I\'m happy.

\[Laughter\]

[**\>\> Rose Marie Robertson:**]{.underline}

It does say "may include", so I suppose it leaves room for a stick in
there someplace but it\'s mostly \--

[**\>\> Lorraine Doo:**]{.underline}

Right, doesn\'t mean it won\'t be sub \-- subtracted from.

[**\>\> Rose Marie Robertson:**]{.underline}

Right. Okay. Well, gee, we did that one, terrific.

David any \-- now, I know the language was not exactly the way you had
it. Any issues here that we should address or are you okay with how we
have this?

[**\>\> David Lansky:**]{.underline}

I\'m okay with it.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay, great. Okay, education and outreach. And this is the single
recommendation in 2007, the Consumer Empowerment Workgroup should
continue to study public and private sector activities to increase
consumer awareness of PHRs, including the convening of an expert panel
based on consumer engagement and social marketing and report on their
findings to the Community.

That one is easy, huh? Okay. No objections to anything there.

Well, that\'s terrific. Actually, we caught back up. So we need to recap
our action items from today\'s meeting. We \-- and these actions will be
rapid and take place over the next 48 hours or so.

So we will send out for specific vote the issue about certification. The
two issues about certification. Both in the beginning, in the findings,
and in the recommendation itself.

We\'ll \-- Ross and you and Michelle and Kelly are going to work on the
part that you\'ve probably already \--

[**\>\> Kelly Cronin:**]{.underline}

Ross has already written it.

**[\>\> Ross Martin:]{.underline}**

I already sent it out. I don\'t know if anyone wants to comment on it,
if we don't have time.

[**\>\> Rose Marie Robertson:**]{.underline}

We have time. Seven minutes.

[**\>\> Kelly Cronin:**]{.underline}

I don\'t know if I can send this to the whole workgroup.

[**\>\> Ross Martin:**]{.underline}

I thought I send it to everyone on the invitation list.

[**\>\>**]{.underline}

Some people may not be \-- someone\'s driving.

[**\>\> Kelly Cronin:**]{.underline}

It\'s sent to everybody.

[**\>\> Rose Marie Robertson:**]{.underline}

Can we read it out loud?

[**\>\>**]{.underline}

Is it too long?

**[\>\>]{.underline}**

It\'s a little long.

[**\>\> Rose Marie Robertson:**]{.underline}

Let\'s perhaps include it in the document. So should we do the vote \--
you want the vote to happen first on the certification issue and then
send out the \--

[**\>\> Kelly Cronin:**]{.underline}

Send two separate e-mails. We can send the certification e-mail today
and then the revised letter tomorrow.

[**\>\> Rose Marie Robertson:**]{.underline}

And that will include the document that Ross has just sent us. And so
we\'ll send that tomorrow, we\'ll need back any comments very quickly
because we really must have this finished Friday at close of business.
Eastern close of business.

[**\>\> Ross Martin:**]{.underline}

If anyone has any tweaks on it, you know, today, because I did send it
out to the group and they want to send it \-- send those out and I\'ll
look at those and for what it\'s worth, give my two cents or whatever
and maybe that way we can get a cycle through of \--

[**\>\> Rose Marie Robertson:**]{.underline}

Sure, great idea.

[**\>\> Ross Martin:**]{.underline}

Any tweaking for the final vote.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay, that\'s good.

[**\>\>**]{.underline}

Tweak today and then go out tomorrow.

[**\>\>**]{.underline}

We\'ll have \--

[**\>\>**]{.underline}

A tweak today.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay, and then \--

**[\>\> Dan Greene:]{.underline}**

Excuse me, this is Dan Greene. I did not get that e-mail. If the ONC
could make sure it got sent to everybody.

**[\>\> Kelly Cronin:]{.underline}**

Sure.

[**\>\> Rose Marie Robertson:**]{.underline}

We will.

[**\>\> Dan Greene:**]{.underline}

Thanks.

[**\>\> Rose Marie Robertson:**]{.underline}

And then on Friday we\'ll have \-- on Thursday then we\'ll send out the
revised letter. We\'ll ask for your approval of that. And let you know
what we\'ll take forward to the Secretary.

[**\>\>**]{.underline}

Two kind of logistical housekeeping. Obviously it\'s \-- only Consumer
Empowerment Workgroup members eligible \-- and then second, is the vote
on the letter going to be an up and down vote? There will be a separate
vote on certification and then the overall recommendation letter based
upon the certification outcome. Will that be a up or down, yes or no?

[**\>\> Rose Marie Robertson:**]{.underline}

You know, with the certification issue, I think we decided that we would
not put in the letter \-- we\'ll try to make the certification language
something people can vote positively on. But it\'s possible that we
won\'t. We had said that we would \-- the letter would reflect the
consensus of the group. But we agreed that if there were \-- remaining
issues that we would present those at the time that we presented to
AHIC.

[**\>\> Kelly Cronin:**]{.underline}

Yeah. There is no requirement for subcommittees under full FACA
committees to reach full consensus and really the final decision making
is at the Community level. So if we don\'t have unanimous consent, it\'s
not a barrier for us to present recommendations, but I think in good
spirit, yeah, we talked a lot about last week and back and forth by
e-mail about how we would certainly address the concerns or any dissent
that was expressed.

[**\>\> Rose Marie Robertson:**]{.underline}

And try to reflect that.

[**\>\> Kelly Cronin:**]{.underline}

As they start to consider what they would want to advance.

[**\>\>**]{.underline}

Reflect those decisions.

**[\>\> Kelly Cronin:]{.underline}**

Yeah.

[**\>\> Rose Marie Robertson:**]{.underline}

Okay. Is that \-- any other comments? We\'re about to head to the public
comment time. Matt?

[**\>\> Matt McCoy:**]{.underline}

Yeah. There\'s a slide up on the Internet for people following along
that way to call in. And if anybody is already on the phone, just press
star 1 and that will put you through.

[**\>\> Rose Marie Robertson:**]{.underline}

And people in the room. So let\'s start in the room.

[**\>\> Amy Verstappen:**]{.underline}

I\'m Amy, I\'m \--

[**\>\>**]{.underline}

Excuse me, could you come closer to a speaker.

**[\>\> Amy Verstappen:]{.underline}**

I\'m Amy Verstappen, I\'m the President of the Adult Congenital Heart
Association. I\'m very honored to be here today. I just had a couple of
comments. One is on the issue of certification, and the conversation
here today, I think that it\'s clear that the language of standards and
certification is very complex. But I know we all share the same goal,
which is there needs to be a very solid bioethical floor on which this
all takes place. And we \-- we\'re talking about the primary users of
this kind of thing are going to be not just health care consumers but
people managing chronic, lifelong conditions. They\'re a very endangered
population, they're a very vulnerable population, and I\'m reassured but
not 100 percent confident that this will continue with that always at
the center. That that is the bioethical standard that needs to be held
here.

So the second thing to comment on is just the conversation about
incentives. One of the reasons I\'m here today is ACHA is taking on a
number of projects that have to do with personal health records. We
offer personal health records, like many organizations, to our members
and we\'re in the process of helping national adult congenital heart
clinics choose a data sharing tool. The huge incentive that I don\'t see
anywhere, and I imagine might be someplace, is research. As people
having rare disorders, we have tremendous incentive for research, we\'re
very interested in anonymized data. And I have an ongoing question for
this whole endeavor, which is I am very interested in how national
research initiatives are fitting into this. And that\'s our interest.

And then one last comment, which is that when we\'re looking at
timeframes, we talked a lot about portability, we talked a lot about,
you know, release of data, just to keep in mind that the timelines
involved in maintaining this data are huge. The two examples I give is
pediatric concept disease so we needed my 1965 medical records when we
did a 1998 surgery. The other \-- and this is again going to be more and
more of a trend in the future. Other population I would highlight is in
vitro babies for whom are being studied and we will need to know their
whole life, how they were in fact conceived, and that is something we
need to take into account in terms of maintaining this data. It\'s a
huge issue in chronic disease, and just the technologic challenges of
maintaining health data over the lifetime of a person. Thanks.

[**\>\> Rose Marie Robertson:**]{.underline}

Great, thank you very much. I think you would have been pleased over the
course of the last few months to hear us discuss the importance of
keeping this patient-centered, and having this really \-- this group
really does think about its task as being protecting the consumer in
this \-- in this situation.

So we\'re foursquare behind you in that circumstance. We also, you know,
one of the issues of secondary uses of the data is in fact this issue of
how one can forward medical science and allow people to participate in
research when that\'s available and appropriate. And that is going to be
an important issue moving forward as well.

It is true that a number of organizations, I know best the ones that
interact with the NHLBI, the most effective are ones that, in fact,
being relevant to a relatively circumscribed population have found ways
to link that population with investigators in that area so as to really
provide benefit to the members. So I think those are very important
topics.

Matt \-- anyone else? Matt, anyone on the phone?

**[\>\> Matt McCoy:]{.underline}**

No, there is not.

[**\>\> Rose Marie Robertson:**]{.underline}

All right. Very good. I think if we have no other comments, for the good
of the group we\'ll adjourn this meeting and thank you all for your
participation. Take care.

[**\>\>**]{.underline}

Thank you.