## AMERICAN HEALTH INFORMATION 

## COMMUNITY MEETING

## MARCH 13, 2007

## \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

## Computer History Museum

## 1401 N. Shoreline Boulevard

## Mountain View, CA 94043

**List of Participants:**

**[Members:]{.underline}**

-   Secretary Michael Leavitt, Chair

-   David Brailer, M.D., Ph.D.,Vice-Chair

-   Robert Kolodner, M.D.

-   Craig Barrett (represented by Colin Evans)

-   Robert Cresanti (represented by Bettijoyce Lide)

-   Nancy Davenport-Ennis (in DC)

-   Julie Gerberding. M.D. (also represented by Steven Solomon)

-   Gail Graham

-   Daniel Green (in DC)

-   Douglas Henley, M.D. (participated via teleconference call)

-   Kevin Hutchinson

-   Charles Kahn, III (in DC)

-   John Menzer (represented by Linda Dillman)

-   Leslie Norwalk (represented by Tony Trenkle)

-   E. Mitch Roob

-   Scott Serota (represented by Justine Handelman)

-   Lillee Smith Gelinas, R.N.

-   Phillip Swagel (represented by Nada Eissa)

-   William Winkenwerder, Jr., M.D. (represented by Stephen Jones and
    Ron Pace)

# Presenters:

-   Mark Leavitt

-   Rose Marie Robertson

-   David Lansky

-   Carolyn Clancy

-   Steve Solomon

-   Kirk Nahra

-   Jodi Daniel

-   Susan McAndrew

-   Linda Dimitropoulos

-   Rex Gantenbein

-   William O'Byrne

-   James Golden

-   Andrew Croshaw

-   Peter V. Lee

-   Jeffrey Rideout

-   Chris Nohrden

-   Kevin Herglotz

### TABLE OF CONTENTS

-   Call to Order: Secretary Leavitt

-   Introductory Comments: Secretary Leavitt

-   Comments: Dr. Brailer

-   Certification Commission for Healthcare Information Technology

    -   Mark Leavitt

-   Workgroup Recommendations

-   Consumer Empowerment Workgroup

    -   Nancy Davenport-Ennis, Rose Marie Robertson, David Lansky

-   Quality Workgroup

    -   Carolyn Clancy

-   Population Health/Clinical Care Connections Workgroup

    -   Charles Kahn, Steve Solomon, Kelly Cronin

-   Confidentiality, Privacy, Security Workgroup

    -   Kirk Nahra and Jodi Daniel

-   Privacy and Security Panel

    -   Jodi Daniel and Sue McAndrew

-   Privacy and Security Solutions for Interoperable Health Information
    Exchange

    -   Linda Dimitropoulos

-   Health Information Security and Privacy Collaboration (HISPC)

    -   Rex Gantenbein, William O'Byrne, James Golden

-   Employer Panel

    -   Andrew Croshaw, Peter Lee, Jeffrey Rideout, Chris Nohrden, Kevin
        Herglotz

-   Public Input

**[PROCEEDINGS (8:00 am PST)]{.underline}**

SECRETARY LEAVITT: Good morning everyone, both to those here in Silicon
Valley, and also to those colleagues who are in Washington, and I
believe there may be some joining us otherwise. I want to want thank all
of those who have worked so hard to establish this technologic
connection, and those who have traveled. Obviously no more appropriate
place to be talking about health IT than the area that practically
invented the IT industry, and for us to be meeting in the place that
commemorates that progress.

A special thanks to the Computer History Museum for hosting our meeting
today. I'd also like to congratulate Dr. David Brailer for the 12th
meeting of AHIC. He finally succeeded in dragging us out to his turf
\[laughter\] as opposed to him having to make that long flight out.

I admire David and the commitment that he has made over the last several
years to this. And I've got to say that the weather here is at least
better than it has been in Washington over the past month, though I
think things are clearly improving there, and spring has come.

As you may suspect, there is another reason that I have been traveling
out here as well. Over the past several months, I have been visiting
healthcare purchasers around the country. In fact, California will be
the eighth state I have been in since Wednesday.

Around the country, close to 700 of the largest purchasers of healthcare
have committed themselves to support the principles of value driven
competition, as expressed in the President's executive order of the 22nd
of August last year. All together they have covered more than 82 million
lives. We are getting very close to half of the top of the largest 200
purchasers. By the end of tomorrow and today, we'll meet with purchasers
in San Jose and Los Angeles, and those numbers will have grown a lot.
This is an area of healthcare where there is consensus and a desire to
create change, and I'm happy to report the change is coming.

I've talked to you before about CEOs with their hair on fire for change.
I can tell you that they're motivated, but their success is all being
driven by what we're doing here, with driving health IT adoption and
transparency. The higher quality at lower cost will depend on the
successes that we create entirely. Unless we succeed, so many of the
things they aspire to do cannot happen.

We've got to continue to identify the interoperability standards that
will ensure health IT to meet its full potential. We've got to assure we
have the ability for providers to measure and report on quality, so that
consumers will be able to look for value in their healthcare. Neither of
those things is going to be able to happen unless they are able to
securely exchange clinical data where and when they need it. Making sure
that robust privacy and security measures are in place, so that end
users of those systems have the \[capacity\] to use them.

As we move into the second phase of our work on the nationwide health
information network project, we'll further advance ways to protect
privacy and to ensure security. But as the report indicates, if people
do not believe that their sensitive information is appropriately
protected, we will be peddling little more than expensive paperweights.
Creating a sustainable business model for producing those standards so
that they can encourage rather than impede innovation as technology
advances over time is crucial.

We have completed one full turn of the standards crank, and now we're
well into a second. But if we stop there, while we will have done a good
thing, we will not have succeeded. We've got to create a sustainable
process for this. Our work will completely become outdated if we're not
achieving the goal of interoperable health information exchanges.

So today, I'll return to a very familiar theme that you've heard me
repeat over and over, and that's urgency. I'm looking forward to hearing
the Workgroups. I know there has been a huge amount of work that has
been undertaken, to this point, in making the recommendations we'll hear
today, and I want to express appreciation for those of you who are
leading the Workgroups, but also to those who are on them. I also
welcome the employer panel that will give us today, some insights on the
needs and concerns of the purchasing community.

So as we begin, we begin with an expression of gratitude for your hard
work and dedication. I know it goes beyond the scenes of the meetings
that we'll see today, but now, Dr. Brailer, I'd like to ask you to lead
us through the agenda.

DR. BRAILER: Great. Thank you, Mr. Secretary, and let me welcome you to
California. You can see how strong my commitment to public service was
by what I left every week when I came to Washington \[laughter\].

This is the 12th meeting of the American Health Information Community.
And this is the first of several that will be occurring in different
parts of the United States. Call it the AHIC road show, if you might.
This is also the second meeting where we're using telecommunications to
help us facilitate the meeting. This, obviously, with the Washington
connection still being webcast across the United States. We have a very
busy meeting, and before we turn to the agenda, let me introduce Gary
Malone, who is a trustee of the Computer History Museum. Gary? Thank you
for having us today.

MR. MALONE: Well, on behalf of the staff, the board, and the volunteers
of the computer history museum, we are very honored and grateful to have
you here today. I'm not going to pretend to know the intricacies of
everything that this Committee does, but I do understand that it deals
with healthcare and information, and as you will see at the museum, part
of our mission is to understand the impact of information age and its
positive results on human society.

So with that, I want to, once again, thank you for being here. I
encourage you, if you have the opportunity to visit the museum, to look
at some of the exhibits, and I wish you very good luck and a productive
meeting. Thank you very much.

SECRETARY LEAVITT: David, I wonder \-- thank you, again, for allowing us
here. We've got some who are here representing others. I think it might
be a good idea to let everyone introduce themselves. Most of us know
each other extremely well, but some may not know all of the players,
given the fact that we're divided by two coasts.

Maybe we ought to start in Washington DC. Nice to see all of you there.
I hope you can see us as clearly as we can see you. Why don't we start,
just go around the table and have everyone say hello, make certain all
this technology is working.

MS. McANDREW: Hi, Sue McAndrew, Office for Civil Rights.

MALE SPEAKER: We're muted.

SECRETARY LEAVITT: We can hear you.

MALE SPEAKER: Can you hear us?

SECRETARY LEAVITT: Yes, we can.

MALE SPEAKER: Okay, okay.

MS. McANDREW: Hi, Sue McAndrew, Office for Civil Rights.

MR. JONES: Steve Jones, Health Affairs, Department of Defense.

MS. DAVENPORT-ENNIS: Nancy Davenport-Ennis, National Patient Advocate
Foundation.

MR. GREEN: Dan Green, the Office of Personnel Management.

MR. KAHN: Chip Kahn with the Federation of American Hospitals.

MS. LIDE: Bettijoyce Lide, Department of Commerce.

SECRETARY LEAVITT: Chip, I'm going to name you the hall monitor in
Washington.

MR. KAHN: Okay \[laughter\].

SECRETARY LEAVITT: And you're responsible to keep order there. If there
are \-- if there are dynamics happening there that I'm not picking up on
or Dr. Brailer is, please just interrupt us, and tell us somebody needs
to talk, and we'll let you \-- you're the relay man.

MR. KAHN: Okay. I won't be shy.

SECRETARY LEAVITT: All right. That's why you were chosen \[laughter\].
Very good. Colin, let's just go around here.

MR. EVANS: Colin Evans, I work at Intel. I'm responsible for
\[inaudible\], and I am representing Craig Barrett.

MS. GRAHAM: Gail Graham, Department of Veterans Affairs, Veterans Health
Administration. I'm representing Dr. Robert \[inaudible\].

MS. DILLMAN: Linda Dillman with Walmart. I'm representing John Menzer.

MR. ROOB: Mitch Roob, I represent all the states in my role.

MR. HUTCHINSON: Kevin Hutchinson, SureScripts. \[inaudible\] So I
surprised everyone with \[inaudible\] \[laughter\].

MS. HANDELMAN: Justine Handelman, I'm with Blue Cross Blue Shield
Association, representing Scott Serota.

MR. TRENKLE: Tony Trenkle, CMS, representing Leslie Norwalk.

MS. GELINAS: Lillee Gelinas, VHA, the other VHA.

MR. KOLODNER: Rob Kolodner, Office of the National Coordinator.

SECRETARY LEAVITT: Let me just add, those of you who are here
representing others, we need your perspective. We recognize you haven't
been part of every conversation, but if you've got a point of view, say
it. We need you to be \-- to weigh in on these things. If there is
something that you don't have some background on and still have an
instinct, all right, say it. We'll forgive you if you're a little off
point. But chances are you won't be. So \-- Dr. Gerberding, nice to see
you. All of you have had a chance to sort of introduce everyone again,
and welcome to the left coast.

DR. GERBERDING: Little embarrassed to get lost \[inaudible\].

SECRETARY LEAVITT: Wait a minute. I thought that was North Dakota.

DR. GERBERDING: \[inaudible\].

SECRETARY LEAVITT: I went to North Dakota with Dr. Gerberding. We had a
great time, and she was welcomed home.

DR. BRAILER: Before we start, let me turn to tab two of the agenda
books. These are the January 23, 2007 minutes. I will ask for a motion
to approve and a second to approve these minutes as stated in the book.
Moved, second. \[inaudible\] Any opposed? The minutes are approved.

With that, let me turn to tab three and ask Mark Leavitt, no relation to
Mike Leavitt, to come forward to give us an update on the Certification
Commission for Healthcare Information Technology.

Many of us know that this is one of the significant accomplishments
that's occurred over the last few years that results from the
significant amount of work by people across the healthcare industry.
Mark, thanks for being with us, and we look forward to your comments
today.

MR. LEAVITT: Thank you, Dr. Brailer, Mr. Secretary, Dr. Kolodner,
distinguished Committee members. Thanks for inviting me. I'm really
happy to be here to give you an update on the progress of CCHIT.

I'm the chair of CCHIT. I see that some of you are probably more
familiar than you would like to be with CCHIT, but some of you are new,
so if you can bear with me, just a brief summary of our background.
We're an independent, nonprofit organization, with the mission of
accelerating the adoption of health IT, robust, interoperable health IT.
It's that simple.

We have four goals of certification, four ways that we think
certification can accelerate adoption. First, to reduce the risk to
providers who are considering buying health IT. Second, to make sure
that these products are interoperable, they can connect over networks;
and maybe even ultimately more important, so the data can be shared,
compared, and measured, which will enable the emergence of a market
driven value based purchasing mechanism for healthcare.

Third is to unlock financial incentives and regulatory relief, to break
the deadlock of health IT adoption, the issue that the providers
investing don't see the majority of the benefits can be unlocked, if we
can free up incentives for those who do benefit, such as payers and
others.

And finally, and this is not last because it is least important. It's on
the bottom because it's the foundation of everything we're doing in
health IT. We need to make sure that as we move from paper to a digital
world, health information privacy actually can be increased, not kept
the same, increased rather than diminished. And that's a very important
goal for certification.

I would like to be the first to say that CCHIT is only one element in a
larger strategy. It's a piece in the puzzle. I use this diagram. It
works well for me. And I like to describe CCHIT as a coupling mechanism.
It's a coupling mechanism between the standards, and the architectures
and the policies, and \-- on the left of the slide. On the top of the
slide. And the private sector health IT marketplace. People creating
software, people buying software, and we connect those two. And the
mechanisms for which we connect it is a voluntary, market-based
mechanism. That's important to keep in mind. Because of that, the
primary asset of CCHIT is its credibility with stakeholders, and we
treat that with great care and do a lot of our work basically in the
interest of meriting that trust.

Okay. Our scope of work, just to review, and this is the last review
slide. Three primary areas delivered in three successive years; to
develop certification for ambulatory, which is office based EHRs; in '07
to develop the lung certification hospital EHRs; and in '08 to develop
and test a mechanism for certifying the networks through which these are
going to interoperate.

There's three other elements to the scope. One is to not stop after
developing the criteria and domain, but to update that annually. And
that's an important capability so that this isn't a static mechanism.
And second, and this is a new addition to our scope, to expand
certification to address more specialized areas of practice. And I'll
describe that more. And finally, an element of our scope is to
transition to become an independent, self-sustaining organization by the
end of the contract period. Basically, that's September of 2008.

So now I'd like to go through each of those scope areas and give you a
brief progress report. The first, obviously, is ambulatory EHRs. That
was our first year's work. It took 18 months, involved over 150
volunteers, representing a wide variety of stakeholders. And we drafted
the proposed criteria. We published, circulated for public comment in
the process, received and responded to over 2,000 public comments. And
then we pilot tested and launched certification in May of 2006.

And an important note here, besides the criteria, we published a forward
looking road map, which lists expected criteria one and two years in
advance. And that's a very important mechanism because it gives us a way
to guide the marketplace, without undo disruption to it.

Okay. Not loud enough? Sorry. I'll bring it closer.

Now, what we have been doing is testing certification, testing products
for certification in quarterly batches, so we have been through three
cycles so far. And as you can see from the slide, we've had \-- there it
shows a total of 51. There are actually 57 products that have been
certified in nine months. The difference is that a few products are
marketed under two different labels, same product, different
organizations.

So 57 products have been certified. That's over 25 percent of the total
number of vendors we believe are in this space. And if you adjust for
the market shares of the vendors, I would estimate that certified
vendors represent over 75 percent of the marketplace. In this quarter,
we're in the midst of testing, but we've received 35 applications, which
was the highest number ever; and if our percentages hold up, we'll
probably have over 80 products certified. And of course, then, that will
be the last batch of the 2006 criteria, and we'll move to 2007 the
criteria.

So if I could borrow a line from a movie, we have built certification,
and the vendors will come. But the real question is, are you having an
impact on adoption? And with only nine months of work, we can't give you
robust statistics, but we do have examples that I'd like to share. And
let's go through those, for each of the four goals.

First, are we reducing risk? In order to have an impact, we need to know
that physicians considering buying systems, are paying attention to
certification. As you can see on the slide, pretty much all of the large
professional associations associated with primary care, have endorsed
our work. Not just endorsed it, they bring us to their conferences, we
give town halls there. We meet with physicians there. And we \-- they
also help us distribute, in written form, our materials.

And I believe that if you check out there now in the real world, in the
doctor in the small town, they know certification exists, and in fact,
"are you certified" is now a standard question in RFPs that are coming
out in physicians and groups. So I think that's real evidence of impact.

The next question is what about those incentives you said you would help
unlock? Again, I have given you examples, not statistics yet. For
example, not long ago, HMSA, Hawaii Medical Service Association, which
is basically the Blue Cross Blue Shield plan in Hawaii, announced a 50
million IT incentive program for both EHRs and e-prescribing. And the
EHR portion is linked to certification. They will only offer the
incentive for certification. So let's say that's 25 million. That's \$25
million in purchasing money that has now gotten into the market to buy
EHRs.

SECRETARY LEAVITT: Mark, I would point out, I mentioned in my early
remarks, that I'm spending a lot of my time asking large purchasers to
include in their 2008 RFPs, a criteria that includes "are you
certified." Are you insisting upon those that you're purchasing from,
and if we are anywhere near our estimate, our aspiration of 60 percent
of the marketplace, I would think that this question of can you be in
the market without being certified will be resolved.

MR. LEAVITT: I appreciate that. We appreciate the support that you've
given, so I think that reinforces the point. So I think we're seeing
acceptance there.

There is an interesting question, then. Are we fostering
interoperability? Well, our new criteria for 2007, which will go into
effect in basically six weeks, include mandatory ability to send
electronic prescriptions and do electronics refills, as well as
receiving electronic lab results; both based on standards.

There is another interesting point. Although we haven't started
certifying networks yet, we're actually having a positive impact on
their work. For example, I recently spoke with the manager of the New
York City pilot project. It's a Medicaid pilot project to share
medication information with physicians caring for Medicaid patients. And
he said they were basically relying on certification to ensure that
these peripheral systems in the offices had sufficient security. And
that we'd solved a major problem for them.

And a couple of weeks ago, we gave a town hall at the HIMSS conference,
and a network executive voluntarily offered that we had saved them one
to two years. We had moved their project forward one to two years,
because they would have spent that long trying to qualify EHRs,
determining whether they were secure enough to be on their network.

So without even certifying the networks we're having an impact. I think
that increases, when we certify networks, to make sure that they're not
just trusting the EHRs, but exchanging data in an efficient way.

And I guess the last question, the last goal area is the privacy
question. I'll tell you that we have over 40 criteria. They appear as
both security criteria and functionality criteria that support privacy.
For example, you have to maintain an audit trail of all accesses. You
have to manage consents from patients. You have to be able to track
where the record has gone. You have to encrypt the data before it leaves
your facility.

We've learned that quite a few vendors have had to enhance their
products to meet our criteria, and, you know, the few products that have
come through and tested, have not necessarily passed. This has actually
been the issue with security and privacy. So I really do believe we're
raising the bar. There is some kicking and screaming, but they're
getting over it. They're getting over the bar. And we have a significant
focus on this, and we think it's very important.

Now, I'll be the first to say, technical security is only one part of
privacy. You obviously need the laws, the policies, and the training;
which we're probably finding the most important thing. But if we don't
do this, then the technology can become a weak link in the chain. We
want to make sure it isn't anywhere near the weak link in the chain.

Now, it sounds like I'm delivering a lot of good news. But I don't want
you to think that our work has been without some controversy and debate,
and one of the issues we heard most loudly and frequently was the worry
that certification would favor large companies, lock out small vendors,
and stifle innovation. And the commission took this quite seriously,
because we know we're here to help solve the adoption gap problem with
small practices. And we didn't want to lock out small companies that
serve them.

So we went ahead and did a survey of our certified vendors. We had a
response rate of 55 percent, and we'll keep working on this. This was
done in February. So there were only 55 or 57 vendors when we did this.
But if you look at their annual revenue profile, only a quarter have
annual revenues over \$10 million. More than half have revenue in the
one to \$10 million range, and 17 percent have below \$1 million in
revenue. That's a small company.

I have learned that the Small Business Administration uses \$23 million
as the benchmark for a small business in the software vendor
classification. So by that measure, I think three-quarters of companies
probably fall under \$23 million and qualify as small businesses. So we
also thought, well, definitely we're not creating a disadvantage for
small companies, well, small doctor's offices. Are we decreasing the
availability of products for them? So we asked the vendors to identify
what size practices they serve. That's the graph on the right. Fully a
third sell to and have customers who are solo physicians and the vast
majority serve the small, two to five and six to fifteen doctor market.
Actually, if you look at this, it's a profile of the sizes of practices
across the country. It's representative. It doesn't show any bias
against small practices.

So I think the conclusion we would suggest is rather than creating a
barrier, certification has created a level playing field, on which a
wide diversity of vendors, \[inaudible\] and we're pleased to see that.

Now I'd like to update you on the status of our certification
development going forward. We are just now finishing up our work for
2007, ambulatory criteria. The commission approved them yesterday. They
will be published shortly. They'll go into effect May 1. And I mentioned
that this one has those two new forms of interoperability, as well as
many of the new requirements that are essential to security,
interoperability, and making sure that the systems deliver benefits.

The inpatient area, we're now about midway through development. It was
definitely more complex than ambulatory care \[inaudible\]
organizations. Patients have more acute problems. We added staff, and we
actually added an extra test. The technical people will recognize the
name alpha test, before our pilot test. And that's taking place Thursday
at a medical facility in Chicago. We will pilot test in May, and should
be able to launch this in August, August 1, 2007.

And finally, on the networks, we are in a preliminary information
gathering stage, and we naturally participated in the National Health
Information Network forums, but we're also holding informal
conversations with networks, and we have spoken with networks in New
York, in Maryland, in Illinois, Washington State, and Oregon; plan to do
many more. And later this month, I'll actually be chairing a round table
at the State Alliance for E-Health. And we'll actually open a call for
Workgroup members in April, and start formal work on the network
certification development in May.

Now, that covers those three domains. Now, what those other areas of
scope. What about this certification expansion? We received feedback
from stakeholders, kind of the opposite kind of feedback. They said, "We
want you to go faster, not slower, and we don't want you to go away. We
want you to come to our practice area and focus on it, and deliver
certification for it."

And we found that this was not limited to professional specialties.
There were actually three dimensions, professional specialties, care
settings, and specific patient populations. And there was a lot of
interest. So we decided we would have to do some prioritization so that
we went where we could deliver the most benefit. And we did, in asking
for data, ask what's the potential benefit of certification in this
setting or for this population or specialty, how ready is it with
standards, and how much effort is required for development? The roadmap
that we came up with is shown here. This has been modified slightly at
the commission meeting yesterday, but not really all that much.

And we're going to address at least one of each of these three
dimensions. In populations, we're going to address the issue of the
capabilities of these features in caring for children. The issue came
up, when we were developing the ambulatory system, there are some
special features you need to care for children. One is a growth chart.
I'm sure everyone is familiar with that concept. And yet some vendors
said, "I make systems for this specialty that doesn't" \-- geriatrics,
let's say \-- "doesn't care for children. We don't need a growth chart.
You're driving up costs." The pediatrician said it has to be there, and
we had a debate. It came out.

That isn't the way it should be. So that's why we said one size no
longer fits all. So we'll have features in the criteria for caring for
children. If their product meets it, it will get a sticker saying
"certified for care of children." If it doesn't, it has a label saying
"not certified to have the extra features for the care of children." So
we can satisfy both.

A little more complexity for us, but we've matured a little bit. In the
care settings, we're going to tackle the emergency department first.
This is going to give us a nice opportunity now to tie in with the use
cases better. Some of the use cases involved areas of practice that we
didn't touch very well, and this is going to get us closer contact.
We'll start that one soon. The other that came up is long-term care. We
just had a very convincing call. That industry came together very
coherently and gave us a convincing call. There is very low adoption,
and a very great need. And so we'll address it. It will take a couple of
years to do that.

In specialties, we couldn't do them all. We picked cardiovascular
medicine, first. When you look at the disease burden of heart disease,
the cost to the system and the potential benefit, we decided to address
that one first. All together, we think this is going to help make
certification even more relevant, and help us couple these initiatives
more quickly and more efficiently.

Last slide, is to comment on our scope of work to become independent and
self-sustaining. We have actually completed our governance transition,
so we are an independent, not for profit organization. Our 501 C3 status
is pending. We have applied and are waiting. And our financial
transition, we have mapped out a plan, and the board of trustees. We
have a new board of trustees as part of this governance shift, which has
fiduciary responsibility. They've approved the plan. It's a rough plan,
but as of this year we're on track. We think we can become
self-sustaining after the federal contract is complete.

So just to sum up, before I close, I just want to say that CCHIT, it's
really \-- it's a vehicle to collect and organize the work, the
knowledge and wisdom of many people, mostly volunteers. Workgroups,
commission, trustees, jurors, every stakeholder who has commented on our
work and spent time, and so we want to thank them, because this is their
work that I'm presenting today. Thank you for inviting me. And I really
look forward to answering any questions you have.

DR. BRAILER: Thank you, Mark. We do have a few minutes for questions,
and I will ask everyone, regardless of location, to speak into the
microphone, particularly myself since I'm recovering from laryngitis, a
glorious state for my family for me to have been through that. And also
I will ask Chip to continue his duties as \-- I think hall monitor is
the Secretary \[inaudible\] him in Washington.

Let me just start with a quick question, Mark, about the results. Is
there a process, underway to evaluate whether or not a certified
electronic record delivers better outcomes, better results in the
various dimensions of certifications in any other product, and when will
we know what the real outcome measures of these technologies are?

MR. LEAVITT: There are some outcomes that you can measure literally
using the technology itself. As an example, when the machine \-- the
machine, the computer checks for drug interactions, it actually records
the fact that it found one. So you can get a statistic out of computers
that will tell you how much drug interactions they've caught. Or miss
\-- or a bar coding system will tell you how many wrong patients,
administrations they caught. And you can see statistics from that fairly
easily.

The bigger outcomes are the coupling of an EHR with the actions of
people, and you need a more comprehensive study. I think that there is
now the possibility for that research, and I think we're going to start
to see data. It may be a year or two.

We are going to do an impact study of the impact of our work, but we
expect it may take some time before you are able to clearly measure
clinical outcomes, like reduced hospitalizations or complications.

DR. BRAILER: Thank you. Any other questions for Mark Leavitt? Tony
Trenkle.

MR. TRENKLE: Yes. Mark, can you talk a little bit about the work you're
doing with HITSP to kind of bring the two efforts closer together?

MR. LEAVITT: Yes. Very good. As you know, HITSP is the organization that
harmonizes standards. Standards are the substrate of our work. We need
to certify against standards. And because the organizations started at
different times, and they are separate, our schedules didn't
automatically synchronize. So we have a joint Workgroup that's working
on that.

For example, it would be a shame if we need data in May, to move forward
for certification, and their schedule says we'll have it ready in June.
We're working to resolve that. So I believe that we can actually work
together very well. There is a slight difference in the perspective of
the organizations, and that is a healthy one.

We're very focused on the market and adoption of both the EHRs, and
also, you know, paying attention to certification so people buy
certified products. And their focus is more on this ultimate body of
standards that works together in a comprehensive way.

So there is always going to be some tension between the organizations.
We might say we need something sooner than you're planning it, because
the market needs it. And I expect they'll listen, and they may say to
us, we need you to go to the emergency department. We've got a use case
and a standard ready, and we can't \[inaudible\] that area, can you get
into that or can you incorporate it. So I think that dialogue will go on
and I think it's healthy.

SECRETARY LEAVITT: Mark, what are the rate limiters on your ability to
accelerate?

MR. MARK LEAVITT: Well, each marketplace has a speed. The vendors have
what's called a product development cycle, and they typically run \-- in
the small company they might be as short as three, six months, but any
medium to large company, that's a one year, 18 months, sometimes two
year cycle.

You simply can't introduce a change and say we're going to require this
next month, and expect any vendors to be able to meet it. Especially
when they don't do it now. So you have this natural one to two year
cycle. You signal them two years ahead, get serious one year ahead, and
then do it. I believe that's the natural rate-limiting step.

Now, that's assuming we don't create a sequential model. That would be a
problem. If we said, "Don't do anything until you finish your work and
create use cases. Now do standards harmonization," we wouldn't do
anything until that's completely done. Then we've got to put it on the
roadmap for two years. That's a long cycle.

So we run in parallel and we communicate. We say, what's coming in
standards, what's coming in use cases. Let's put it on the roadmap in a
rough form so people know what's coming, and work in parallel rather
than in sequential waterfall.

DR. BRAILER: Linda?

MS. DILLMAN: Yeah, Just a quick question. Being new to the Group so I
apologize if this is something everybody else is always familiar with.

DR. BRAILER: Use your microphone.

MS. DILLMAN: I'm just curious about the process for accommodating
changes in business and changes in technology as they occur. Can move
pretty rapidly, and how do you bring that into the certification process
and allow people, the early adopters, to move quickly?

MR. MARK LEAVITT: Good question. Well, one way is that the certification
criteria are intended to be kind of a floor of \-- on top of which the
vendors innovate. We believe vendors will innovate with new ways to have
humans interact with computers. Is that voice, is that handwriting \--
we don't get into that at all. We just say, has to capture patient
consent, has to be able to capture \-- we don't tell them how. So there
is lots of room for that flexibility.

Also, we actually use a juror process, an expert juror process when we
inspect the products. One has to be a practicing physician, two are
experienced in medical practices, and they interpret. They say, does
this meet the intent of the criterion, rather than say does it do it in
this prescribed way with this size screen and did it all appear. So we
build the flexibility in there, plus but we have this one-year update
cycle, so we can advance the standards. We can also drop one that seems
to be irrelevant or not working or change it.

DR. BRAILER: Lillee Gelinas?

MS. GELINAS: If I can get over here. Thank you. Mark, first of all,
great job. I just want to go on record saying that. And I was really
glad to see that you're going to be dealing with this harder issue with
coupling EHR with people, and in doing this impact study.

As you know, we just have quite an awesome nursing shortage in this
country, and one of those issues is this amount of time registered
nurses have to spend in documentation, which in some of the time, in
motion studies that are underway right now, show an RN will spend 40 to
60 percent of their time just pushing paper. And I think consumers would
be very, very surprised at that. So whatever the nursing community can
do to help you get at this gnarly issue of the interaction between EHR
and people, I think you'd have a tremendous amount of support.

MR. MARK LEAVITT: Thank you. This is the topic of usability of the
systems. How smoothly do they interface with people and not slow them
down, and not make them make more mistakes. And we didn't step into that
right at the start, because it's very hard to define usability in a
quantitative way, but we know it's there. And we \-- actually, we see a
little bit of it now.

If a vendor \-- if the typical time to do our inspection, which is just
a demonstration, is four hours, and a vendor takes eight, they passed,
but it's a little bit of a hint. And this year, for the first time, if
they \-- if they need extra time, by the time they take double the
expected, we're going to cut off and say that doesn't pass.

And there is the possibility in the future to get more serious and
scientific about usability, and begin to say, you know, if it's really
going to be confusing and slow them down \-- so you need to do it in
this time and still allows enough room for different styles. Consider it
very, very important. Yes.

DR. BRAILER: Mitch Roob?

MR. ROOB: Thank you, David. Mark, I think that your focus on care
settings is really important, and kind of the right way to approach it.
I would make a couple of suggestions, particularly in your efforts on
long-term care and mental healthcare.

In the case of long-term care, as you are probably aware, between CMS
and the states, we fund, together, almost all of that long-term care;
right? And to say there is little nursing home EHR is an overstatement.
There is none. I've never seen one. I've visited dozens of long-term
care facilities across our state, and I'm not \-- I've never seen one.
There is no integration occurring, at least in our states, between what
goes on in the inpatient environment and what goes on in the outpatient
environment.

Tremendous opportunities, but here again, an indication that the cost
and benefits don't accrue, because that goes through our funding
mechanism. We basically write the rules and regs for the nursing homes,
and Tony's organization writes the rules and regs for the hospitals. So
there is a \-- there is an issue there of cost benefit, but here, only
between two rather than more.

Secondly, when you look at mental healthcare, nothing is more
integrated. We run \-- I run mental health hospitals and most states run
mental health hospitals. But the outpatient is all done by third party
vendors. So there is a \-- that continuity of care is absolutely
essential. Not to say it's not essential in other areas, but in
long-term \-- in mental healthcare, it's absolutely essential, that we
move that data more effectively than we are today.

MR. MARK LEAVITT: We heard from that group, both that challenge of
seamless transfer of data between settings, and also they emphasize
privacy in mental healthcare; so, you know, we weren't \-- this was not
part of the original contract scope, but we have a mission, and if there
is a need there and benefit, we're going to try to do everything we can.
We look forward to working with you.

MR. ROOB: Are you dealing with the seriously mentally ill here or are
you \-- is your focus going to be on the seriously mentally ill, or more
outpatient focus?

MR. MARK LEAVITT: It's the entire category. The Group that came to us,
called the behavioral health in the very broad way, so it's mental
health extending out into the \-- it's not limited to the inpatient
setting. It's clearly also the outpatient setting. We're in a
fact-finding mode. We need to find that out, and find out where is the
need, and where can we have a practical benefit reasonably soon?

DR. BRAILER: We have only a couple of remaining moments. Kevin
Hutchinson.

MR. HUTCHINSON: Mark, one of the I guess misnomers of CCHIT is, since it
is so tightly aligned in the government, I think something that gets
lost in that process is the amount of involvement of the private sector.
And I think a few things for the Committee that \-- how do you build in
the flexibility in workflow design? You put a lot of things out that
actually impact workflow design, EHR, as an example. And what degree of
participation is there in this CCHIT process with the private sector?

\[break in audio\]

MR. MARK LEAVITT: ...I think we're able to find those. But I don't think
anyone would suggest that our work is dominated by the government, when
you come down to people writing the criteria, and checking them, all of
that. We only have two government representatives on the commission. 21
members on the commission, two government representatives.

DR. BRAILER: Julie Gerberding?

DR. GERBERDING: I'll take it offline \[inaudible\] \-- thank you.

DR. BRAILER: Chip Kahn, are there any questions in Washington?

We may have lost Washington. With that, Mark, let me thank you very much
for your very hard work and your talent in coming to be with us today.

SECRETARY LEAVITT: I'm told that Doug Henley may be on the telephone.
Doug, I just want to acknowledge you, if you're out there. If you're
not, we caught you. \[laughter\].

DR. BRAILER: With this, we're now turning to Workgroup recommendations.
We have recommendations from four Workgroups today. As all of you know,
by the time something comes to us here, as a recommendation, it
represents a significant amount of work by the chairs, by the members of
the Workgroup, by the public at large, and those who are doing work to
support the analysis. This will be substantive discussions in each area,
and we will ask the Community members to act on these recommendations at
this meeting, where you believe action should be taken.

We will rotate comments through Washington, again. And we'll turn now to
the Consumer Empowerment Workgroup with \-- here in Mountain View. Rose
Marie Robertson and David Lansky, hello, and in Washington, Nancy
Davenport-Ennis.

DR. ROBERTSON: Thanks very much Mr. Brailer and Secretary Leavitt.

DR. BRAILER: Just speak very much into the microphone for the people
outside of here. Thank you.

DR. ROBERTSON: We were pleased to present on behalf of the Consumer
Empowerment Workgroup. I'll reassure you that we have fewer
recommendations to bring to you than the last time, and \-- however,
they are complex, and I think will need some consideration by the group.

First I want to thank the members of the Workgroup, who have provided
both enthusiastic and sophisticated discussion of the items we're going
to bring forward today. We have two recommendations, and this group has
worked very hard to bring forward the complex concepts that are embodied
in them.

Of course, you remember our broad charge of recommending to the
Community mechanisms for gaining widespread adoption of a personal
health record that is easy to use, portable, longitudinal, affordable,
and customer-centered. And clearly, the areas that are critical to that
are being certain that this personal health information, which should be
owned by the patient, can be exchanged among PHRs, and the sources of
personal health information, that is, the many different sources such as
electronic health records, payers, pharmacy systems, and keeping that
under the control of the patient.

We have also addressed issues of appropriate incentives to encourage
both consumers and providers to adopt personal health records, and to
bring that forward in the \-- in the public. And thus, the first
recommendation that we are going to bring forward, which interestingly,
does build on some of the information you've just heard. I noted a
number of the areas that are common to electronic health records and
personal health records in the discussion and presentation by CCHIT.

Clearly, the issues encouraging physicians and healthcare providers to
invest in electronic health records, providing regulatory relief for the
\-- for those who are \-- for those who need it as these are developed,
those issues are applicable to personal health records as well. And we
believe that certification has to be considered in the setting of
developing personal health records. David Lansky is here with me, and
we'll both discuss this issue.

Actually, let me pause just for a moment, and ask Nancy Davenport-Ennis
in Washington, if Washington is still with us, if she has any comments.
Just introductory comments here.

DR. BRAILER: I think we've lost video and audio.

SECRETARY LEAVITT: What is the status of our video link?

\[low audio\]

DR. BRAILER: Can we get an audio connection just over a conference call?
Just as a backup?

\[low audio\]

SECRETARY LEAVITT: I wonder if we ought to take a short break. We'll
take a short break.

DR. BRAILER: Five minute break. Don't go far, we're just going to wait
for this technical problem to be solved.

\[break\]

SECRETARY LEAVITT: I think our technology is back on. Rose Marie, thank
you for your patience. Let's drive forward.

MS. ROBERTSON: Thanks very much. Let me just ask Nancy, Nancy, we said
words of welcome at this end. Did you want to add any words of welcome
from Washington. Is the audio on? Are they on mute? They're also not
hearing us, because they're not looking as if they wish to speak.
\[laughter\]

\[low audio\]

Nancy, I said words of welcome from the group if you wanted to add
anything \[inaudible\].

MS. DAVENPORT-ENNIS: Yeah. Rose Marie, thank you for the opportunity to
give words of welcome to the group today. I think that I would like to
begin by thanking Kelly Cronin, Michelle Murray, and Judy Sparrow for
their work and coordinating the Consumer Empowerment Working Group
meeting on February the 13th, during which time we did have a
presentation from a CCHIT representative.

We had asked that representative to come before our Committee, and to
fundamentally discuss with us basic questions about certification. And
as we begin the discussion there in California today, Rose Marie, I
simply would like to review, for all parties, what those questions were
that we were having answered on that day.

Fundamentally, we were answering the question, what is certification,
how is certification actually going to be completed around a personal
health record, what is the time involved for the certification process,
what will the cost be for those innovators that are trying to get into
the personal health record area. How will the certification help to
protect consumers, and what impact, in any, would certification have on
innovation.

So as we begin our discussion, today, I would like to say that as a
result of the meeting on February the 13th, we had a very robust
discussion. We had a great many questions, and at the end of that
discussion, we came away using a consensus forum for that discussion,
with the reality that we had a nucleus of groups that descended from the
position of certification, but we had a large consensus of members of
the CE Working Group who, indeed, felt that moving forward with
certification was appropriate.

So by way of introduction to today, thank you for the opening remarks,
Rose Marie, and I think now we will go to the slides. Thank you.

DR. ROBERTSON: \...the letter in your packet, and I believe that the
reason for the difference between them is primarily that we are \-- that
both groups are trying to predict into the future, and to say which
actions would lead us to the best future state. And there is always some
uncertainty in trying to predict the future.

This \-- the majority of the Group was convinced that enhancing and
assuring privacy and security, as well as interoperability, would lead
to greater adoption of personal health records. That this was important
to do, and that it was complicated. That we needed to have standards,
and expectations and policies, that we needed to derive that from the
appropriate bodies. That we needed to be certain that we would not
stifle innovation, and in particular, that we would not stifle
innovation and entry into the market of groups providing services to
those who are disadvantaged, so that small vendors who might aim at a
targeted population that we very much want to be involved in, and able
to access personal health records, in particular, should not be
disadvantaged. We were reassured that sliding scales or perhaps even
government grants or other \[inaudible\] could be found, so that
\[inaudible\] as well as an electronic health record, one could level
the playing field.

And we ultimately came to the \[inaudible\] that health and
\[inaudible\] should support certifying entities \[inaudible\] other
certifying entities, and we carefully worded it. In identifying a
pathway and a timeline, so not in certifying, now, but in identifying a
way and process for doing this, for voluntary certification of personal
health records. So again, not mandatory certification, but voluntary
certification that would provide, if you will, the underwriters' code,
that sort of assurance for the public, after adequate industry
experience has been achieved in the market to know best how to do that.

That certification would include, we think, most importantly,
specifications for privacy and security, and we plan to, as you see
there, work with the confidentiality Privacy and Security Workgroup. We
have begun those discussions, and will have actually another meeting
with them on \-- a meeting to discuss that on Friday.

It should also include issues of interoperability between personal
health records and sources, because otherwise, those records
\[inaudible\] are ineffectual. And portability. We think it's quite
important for patients to be able to take this information from a
tethered system \[inaudible\] or one employer, and be able to bring that
to another system.

We think that this process should take into account practices for those
policies, as identified by our Workgroup, DDS Workgroup, and other
relevant groups, perhaps; including the Privacy and Security Solutions
Group. Not functionalities, as you'll notice, but privacy and security
interoperability and portability.

Let me turn to David Lansky and let him present the views of the
dissenting group, whose letter you have in your packet as well.

MR. LANSKY: Thank you, Rose Marie. I want to first thank both Rose Marie
and Nancy for leading a very vigorous and open discussion about a
complex area. It has been a very constructive discussion, and I think
all the parties to our Workgroup have felt that we have learned a lot by
going through this discussion, and I hope some of you will participate
in that with us today.

I think a key point, as I come to you, is that we do not have consensus
about this issue. There is, across the industry, across healthcare,
across the consumer sector, not yet enough experience or understanding
to achieve a unified recommendation regarding how to proceed.

The reason, I think, we don't have a consensus about the industry at
this time on this question is that it's frankly too early. We simply
have not done enough work in the policy development area, in developing,
and marketing and using these products, and in testing the relationship
between those policies and those products, to know exactly the best way
to more toward implementing the policies to help more forward.

I'd also say there is no question, as Rose Marie has said, that we all
share the same objective, building a trustworthy, reliable environment
where people share their health information, is what we're here for. And
finding the appropriate mechanisms to develop the right policies and
enforce those policies is the task we need to have in common.

In some of the ways, I think we are premature in moving the
certification process forward. First, we don't actually know what a PHR
is. We can't yet define the "it." Secondly, the industry has felt it's
new and improved \[inaudible\]. Not really talked to each other
\[inaudible\] enough experience to know what can be applied and
enforced. Thirdly, frankly, this is one of the first steps most of us
have taken, marketing to 300 million Americans with an enormous array of
needs and requirements, in health situations, is new for all of us in
this environment; and how to evaluate and validate product in the
consumer stage is a new challenge that we have not yet done.

And lastly, in terms of the prematurity of the work, while we have all
identified, I think, some of the areas of privacy, and other policies
where we have a significant need to establish public trust, we haven't
yet developed a policy. We have identified the problem; we have not yet
recommended solution. So we don't have, even as Mark said earlier, the
standards yet against which to certify. So we feel that discussion of
certification is premature, until we understand what those standards and
policies should be, and then determine whether certification is an
appropriate tool.

In the letter that you received we've identified a number of
\[inaudible\] whether the logic that has supported PHR certification as
we're seeing, does that apply equally to the consumer marketplace? Do we
know that certification will enhance privacy and security and trust in
the public minds? And what is the risk of impeding innovation in the
consumer marketplace, which may be different than the risk in the
\[inaudible\] or physician marketplace.

But the good news, I think \-- I want to close with, is that there is
tremendous areas of agreement across all the Workgroups, which are
highlighted in both letters, and I hope we'll take some time today, and
see if we can move forward in areas of very strong agreement.

We all agree that we need to establish the standards and specifications
for both private and \[inaudible\] PHRs. We all agree we need to gain
more industry experiences in the real world with these products and
services. And we all agree that we need to develop privacy and security
policies that can be used as \[inaudible\].

So I hope you will undertake efforts to address those three objections
that we all share, and defer the question of certification until we
understand what are those policies which must be enforced in the
environment we're working in.

The last point I want to make, is really to distinguish this idea of
enforcement and policy development, the way we, and those who are
\[unintelligible\] here, have seen the question, certification is one
tool among at least half a dozen by which we can implement or enforce
good policies. The others include a wide range, health certifications,
statutes to \[unintelligible\]. There are a number of tools available to
implement good policies. Certification is one.

I would hope that we would first do the hard work of developing the
policies \[inaudible\], and then determine which method of
implementation or enforcement would be appropriate. If certification
proves to be one that is helpful at that point, I think we will have a
very strong consensus to support it, once we have done the work of
developing the necessary policy.

Again, I want to thank both you, Mr. Secretary, and the Community here
for letting us be part of this vigorous discussion.

DR. BRAILER: Let's turn to Nancy Davenport-Ennis in Washington for
comment.

MS. DAVENPORT-ENNIS: Thank you, David. I appreciate the opportunity to
share a few observations. First, I'd like to thank David Lansky and the
Markle Foundation for their role in presenting the dissenting view. And
certainly, I think the letter that has been drafted and presented to the
Community does reflect the nature and scope of the discussions that we
had on February the 13th.

That being said, I would like to also advance for consideration, by
those at AHIC today, the fact that the GAO, on February the 5th, did
recommend a national strategy to ensure privacy of medical records. HHS,
within that citing and publication, did reaffirm that they currently
have contracts in 33 states and Puerto Rico, where they are, indeed,
testing grounds to assess organizational level privacy and security
related to the policy concerns and laws that have been cited today, as
part of their concern for the dissent.

I would also like to reflect that within the discussions of the Consumer
Empowerment Working Group, we continue to call to the attention of
everyone, that consumers will be migrating between inpatient and
outpatient programs. Consumers have fundamentally four concerns, as we
look at personal health records. Certainly, that they are private and
that they are secure. Secondly, that they are, indeed, transparent.
Third, that they are, indeed, affordable; and that they are, indeed,
interoperable.

The presentation that was provided to us around the issue of
certification affirmed, repeatedly, that certification would establish a
floor that would assure the consumer of those fundamental features. That
floor would become the foundation from which additional innovation could
be developed and implemented within the PHR.

And so as part of our continued discussion, I would just like to offer,
to the Committee for consideration, those alternative points of view
that were cited, within the meeting of February the 13th, and thank you
for your consideration of the same.

DR. BRAILER: The floor is now open for the Community members to see
discuss the recommendations from the Workgroups. Justine Handelman.

MS. HANDELMAN: Thank you.

DR. BRAILER: Please, speak very close to the microphone.

MS. HANDELMAN: I do want to commend the process of the Consumer
Empowerment Workgroup to discuss this issue, because there were a lot of
concerns, and it was a very fair process. And moving forward, we do
support this angle \[inaudible\]. We're very pleased that the
recommendation recognizes \--

MR. KAHN: David, we are having a very hard time hearing.

MS. HANDELMAN: We do recognize, though, that this is a tiny issue, and
we're happy that the recommendation letter does lay out certain steps
that need to take place, standards and policies. And I just want to
underscore what David had said, that we do need to work on those issues
and look forward to doing that moving forward.

DR. BRAILER: Thank you. Gail Graham.

MS. GRAHAM: Mr. Lansky, I just wanted to clarify with you, the position
of you and Markle. Is it your position \-- it sounds like they are very
close, that the recommendation and your position are just very close,
but that it's just saying work on these things, but not through a
certification body at this time? Can you just clarify that a little bit?

MR. LANSKY: Well, I should distinguish the Markle organizational
position from the group that we're representing here, today. Speaking
for Markle, I think we have a great concern, as Justine just said, that
we don't yet understand what the policies are that will be helpful to
create public trust in this new set of services. Any decision about what
tool to use to enforce those policies or implement them, across an
industry, must wait until we know what they are. Certification may or
may not be an appropriate approach.

In the area of privacy, for example, which we've all talked about. An
awful lot of privacy doesn't depend on what a product is or does. It
depends on a lot of human behavior, which has to be addressed in a
variety of ways. We need a complete framework, to look at that set of
issues, and then find the right set of tools to administer them. And
it's just too early to say that as we propose here, it's too early to
say that certification is one of the correct tools. We don't know that
yet.

DR. BRAILER: Kevin Hutchinson.

MR. HUTCHINSON: Just a couple of comments. One, we do support, also, the
recommendation of the Committee to go forward with certification of the
PHRs, thank you; and primarily for a few reasons. One, as you recall
from the last AHIC meeting, I had made comments about, is this really
CCHIT's role, in taking on additional workload, as associated with PHRs
outside of the EHR realm.

And in fact, in looking at recent presentations of CCHIT, and their role
of protecting the personal health information as associated with it, I
do, in fact, feel that it is their role, and they do have the capacity
to be able to do this.

The limit to security, and confidentiality and interoperability, I think
is very key for this recommendation. We are not talking about certifying
end user functionality, how labs are displayed, how medication lists are
displayed, how an interaction or scheduling a visit with your office
physician may be displayed or utilized. It is simply the underlying
infrastructure of how levels encryption, levels of password protection,
associated with protecting personal health information, is associated
with that.

There is the heavy involvement, as we heard from testimony from Dr.
Leavitt, on the private sector, as associated with the CCHIT process;
and I think that's also very key, that the private sector be involved in
establishing the requirements, as associated with certification of these
solutions.

And the fact that we are still, even if we start today, by CCHIT's own
testimony to the Consumer Empowerment Workgroup, 12 to 18 months away
from even beginning the first certification of the first PHR solution.
It will take that much time to organize the Group, to organize the
requirements, as associated with PHRs, in making sure you have the right
people at the table.

And the fact that they're working collaboratively with the Privacy,
Security and Confidentiality Workgroup on those policies. I can tell
you, from personal experience, we've had every PHR vendor in the
industry, practically, in our offices, wanting to certify for access to
pharmacy medication history information, and the wide variety of
security and confidentiality inside those products is very scary.

So there may not be a sure definition of a PHR system that's out there,
and I would agree with that, but there is such a wide variety of
implementation of security features inside these products. It will only
take one product that is broken into, and personal health information
shift there, much the same way electronic banking would run the same
risk, if those products weren't secure, which is why that we would
support the recommendation as well.

DR. BRAILER: Thank you. Lillee Gelinas?

MS. GELINAS: Thank you, David; and I really want to commend both Marie
and Nancy. I think you did a terrific job. We do stand behind this
recommendation.

A couple of things that I'd like to talk about here. And I listened how
many times the word "complete" was mentioned, and how many times it was
referred to in the letter. And I just want to go back to the very first
opening remarks of Secretary Leavitt, when he opened AHIC, and said,
"perfection can't trump progress." I want us to reflect on that.

Just a few questions that maybe you can answer, and one more comment.
The first is, it's my understanding that PHRs exist in the Veterans
Administration, and I would really want to have a little bit more
information about that. But it would seem to me that we don't need a use
case. The case is already out there, and it's how PHRs already exist in
the Veterans Administration.

Secondly, I'd like to know what percentage of the Workgroup was actually
for this recommendation and what were not. I deal with those squirrelly
issues with John Perlin every day in our EHR Workgroup, and it's very
important for me to know what was the degree of consensus. That would
help inform comments going forward. And we just heard from CCHIT,
details of success of certification, how it's sped the market adoption.
And I would certainly hope that that would be considered, as we
contemplate when we get down to the vote.

But I'd like to end by talking about the practical versus the policy
issues. And when I talk about practical, that is the market being ready,
consumers being ready for PHRs. And we just can't forget the experience
in Louisiana and Mississippi, where I would tell you, the consumers
there are ready to have their own personal health record, because for
many of them, they don't have one anymore.

So it's a very practical market we need to consider when we think about
adoption in the market, and I would urge you to think about the
difference between practical and policy-based dissent. So back to my two
questions, just to make that clear. PHRs exist in the VA. I just wanted
to get that clarified; and secondly, what percentage of the Workgroup
were actually for this recommendation?

MS. ROBERTSON: Of the members listed there as Workgroup members, five
signed the dissenting letter, and the rest are for the general
recommendation.

MS. GELINAS: Thank you.

DR. BRAILER: Can someone speak to the question about the experience of
personal health records in the VA?

MS. GRAHAM: Yes. This is on the fairly new process for VA, and much
recently in addition to the recording of Veteran's own information, they
have been able to add information from our electronic health record,
which is the substantive part of this recommendation.

I can tell you that the policies and \-- around this were as intricate
as the technology around it, so that's, I think they're both correct
here, that \-- and I reflect back to a meeting that Dr. Kolodner, Dr.
Brailer and I were in, that Harvard hosted with those of us that have
experience with personal health records, Dr. Tang from Palo Alto,
representatives from Vanderbilt, VA were there, and actually, this was
continually one of the issues, was how did you get to the policies and
the practices in which this operates? And it was not really very much
about the technology. So I reflect back to that.

And so it was assurances to those whom you're providing this
functionality, to, that certainly that's \-- their highest level of
concern is the confidentiality. So I agree that those are the most
important things to tackle in the beginning; are these privacy, security
policies. So from that perspective, I think it really reflects our
experience and experience that was voiced by others.

DR. BRAILER: Thanks. We have a number of other comments. I'll turn to
Colin Evans.

MR. EVANS: Thanks, David. I feel like a meal has been served in a very
fine restaurant, but I feel like sending it back to the kitchen. You
know, there is a lot of fine work gone into the effort and all the great
contribution of everybody, but it seems like a little bit \-- it seems
like \-- so one of my first questions would be would more time in the
oven actually make this group actually come closer to agreement or are
they driving away from it? Because when I look at this, I saw
\[inaudible\] with two hats on.

One is representing the tech industry that would be part of, you know,
that would certainly be affected by the idea of wanting to create
products and services that would be certified. And when I look at the,
you know, the lack of immaturity in the \[inaudible\], I contemplate
those very hard.

Also in the area of privacy, certifying around privacy issues, I think
there's yet \-- seems to me there's yet to achieve a consensus to what
those privacy rules might be. Seems in both those areas, more experience
about the needs that we would like the industry to actually comply with
would be pretty important.

But the other hat I'm sitting on is part of the leadership team of an
employer effort that is trying to pull together the infrastructure to
create and deliver a personal health record dated to our employees. So
we have been working on for that for two years or more now. I think
we've got a lot of experience as to what the needs of the end users are,
and what some of the barriers are.

And so far, certification \-- the capability isn't really one of the
barriers to adoption. One of the \-- one of the major barriers is the
degree to which data can be automatically assembled on people's behalf,
because they don't really \-- nobody \-- even the most motivated people
really find it very hard to get that information together, themselves.
So, you know, I'd probably put a higher priority on some of the
interoperability requirements, to make sure data can be assembled.

Now, having said that, you know, we also recognize the privacy of that
data is paramount to everybody's concerns, and we have gone to
extraordinary lengths, in our effort, our employer effort, to make sure
that the way that's being built \[inaudible\] and independent and
\[unintelligible\] based.

So I guess my question is, is this group heading towards consensus or a
problem. Secondly, as a comment, it sort of appears to me that the
comment of adequate industry experience, and the time required to get
that, is critical to the recommendation.

So I find myself reading the recommendations, sort of agreeing with it,
in a sense, but it seems to me there is a lot of work yet to be done, to
get to what adequate industry experience would be, and what those
agreements on policies would need to be for us to really believe that we
could agree on certification of products and technology.

DR. ROBERTSON: If I could answer for the \-- for where I see the
Workgroups discussion being, I think the Workgroup has gotten input from
multiple vendors. Everyone, that I have been present for the testimony
of, has said that they would be in agreement with \-- with limited
certification, not certification of all functionalities, but limited
certification in and around privacy and security. That certainly is not
true for all vendors, but it is true for many vendors.

And, in fact, most vendors have some \-- some say that they have some
security or they have some privacy policies, but less than half of them
actually tell the user what it is. So it can't be seen by the public. So
we were reassured that the vendor community didn't seem opposed to this.
And by the strong input of industry, into CCHIT, so it seemed to us that
industry was recommended, and was representative, and would continue to
be.

We were also heard from surveys of consumers that patients who are
seriously ill, are perhaps not quite as worried about privacy and
security as they are about interoperability, but the broad range of
people we think could benefit, and who were charged to foster the
adoption of personal health records with. For them, privacy and security
is very important, because it potentially affects their employability.

Our reason for bringing this forward now, as opposed to waiting for
things to happen, waiting for this data to be gathered, is the waterfall
concept that was mentioned in the CCHIT presentation, that is, that it
takes a long time to make this \-- to begin to make this happen. And our
\-- the concept of the broad range of people represented in the
Workgroup was that if we didn't begin that now, it would take a very
long time. And the Secretary's plea for urgency rang in our ears. So the
sense that we should begin this, but not \-- begin the process, but not
actually undertake it, was important.

I don't think the Group is probably going to come closer together on
this. I think we've had a lot of discussion. We've had many
presentations, and I think we each have a slightly different view of
this crystal ball of the future and what's the best way to do this.

MR. EVANS: I would comment, I think that the two areas of diversity; one
is, I think, certainly when we look at it from the \-- thinking about
our employee needs, we hope there is an opportunity for a large amount
of innovation in this. There are hundreds of different companies and
ideas that we want to encourage to flourish in this area, that people
use this data for; by the same token, there is also, as you say, a
massive range of opinions about what adequate privacy is that varies
both politically, as well as your situationally, depending on how
concerned you are about your data. So \--

MS. ROBERTSON: Let me say, there is not much \-- I don't think there is
so much variety about what privacy is. There is variability about how
much people care about it. I think people understand that they want to
own \--

MR. EVANS: That's what I mean. But trying to pick a target out of those
big variables, I think, is very hard, from a technology vendor
perspective.

DR. BRAILER: Thanks, Colin. David, could you speak to any other
information on Colin's question about the ability to converge the
Workgroup, continue to work on this?

MR. LANSKY: I would agree with Rose Marie's conclusion, that there are
profound disagreements, I think, across the Committee at this point, of
the immature market state. With a year, or two or three experience; we
may find agreement in a yet unpredictable arena. But I do think there is
great concern that certification is a strong intervention in a private
marketplace, and for a federal advisory committee, or a federal agency
to say that is a necessary step to influence this market, at this stage,
is a very strong statement that we haven't seen evidence for yet.

DR. BRAILER: Thanks. Let me turn to two people in Washington.

MR. KAHN: I was going to talk to Chuck, your hall monitor is about to
burst. \[inaudible\] He has a plastic knife in his hand. \[laughter\]

\[low audio\]

DR. BRAILER: Dan Green, do you have comments?

MR. GREEN: Chip.

MR. KAHN: Oh, okay. And Doug wants to speak also, whenever you put him
on the list. I just have a couple things to say. First, I mean it's my
impression that we're talking about personal health records that are a
personal choice, so I think this issue of radiation concerning privacy
and confidentiality, people can make their own decisions. And I just
wonder whether not moving towards certification is really letting the
perfect be the enemy of the good here, and that if we're also moving
towards interoperability, to not move towards certification here with
all there is out there, I think would be problematic.

So I personally think we ought to go ahead with the recommendations. It
doesn't sound like any more discussion in a Workgroup is going to get
anywhere, so \-- I know there is always this issue of consensus, among
the group, but maybe this is a time in which it may have to be vote.

MALE SPEAKER: I, too, think we ought to move ahead with this
recommendation, that \-- a lot of discussion, the recommendation has
been revised to the extent it can be, I think. I think we ought to move
ahead with it, primarily because certification has already been
considered an integral part of adoption for health information
technology, overall. The idea of maybe certification of privacy,
standards is good. Maybe it isn't.

I think it flies in the face of general agreement that certification is
going to drive the market, ultimately, for all aspects of HIT. I
certainly think that one thing that hasn't been addressed is the idea of
portability of EHRs, which I think is critical to the adoption of PHRs
and consumer involvement. And I don't think you can have
interoperability, unless you have a standard, a certification
\[inaudible\] of standards, and how that \-- how privacy is managed,
when you move from one PHR to another, or from one organization to
another. And I just \-- I simply don't see what the harm is for moving
forward now towards certification, at least the technical aspects of
certification. Thank you.

MS. DAVENPORT-ENNIS: And Dr. Brailer, this is Nancy Davenport-Ennis, and
just two comments, one to Colin's point. I would like to affirm that the
consensus that we did have in the committee for advancing the
recommendation to the Secretary within this letter was clearly a
majority consensus among the CE Working Group members.

And I would also like to call the attention to the written
recommendation, that has been proffered in the letter to Secretary
Leavitt, that does identify that we are discussing voluntary
certification. And I think that's a very important point to be
considered today, as we're looking at this matter.

In terms of the future of the recommendation, I think our Committee
feels this is a very appropriate time to advance it to you and the
Secretary, based on the five previous discussions that our Committee has
had, concerning this particular matter. So we thank you.

On behalf of patients, we also, I would like to contribute, feel that
certification is yet a very logical step for consumers who are used to
being in a healthcare delivery system, that has informed consent as a
practical part of everyday life. And certification is another mechanism
to ensure the consumer a fundamental safeguard is in place for them
around PHRs. Thank you.

DR. BRAILER: Thank you, Nancy. Let me turn to Linda Dillman.

MS. DILLMAN: Good morning. I would like to \[inaudible\] a different
concern. Having been involved in building lots of systems and going
through lots of certifications with various organizations, I believe in
the certification process, and I would focus \-- strongly encourage
everyone to focus \-- on interoperability first. If you want to drive
adoption, that will do it.

A concern I had is that there are a number of organizations today, that
already exist, that have defined standards for consumer \-- for privacy
and \-- or security on consumer data. And I fear that this will become
just one more that may or may not coexist with the other standards.

And I'm not sure how we create an environment that prevents that from
happening, but a worse nightmare for me would be that if you happen to
ever take a credit card from the same location that you take \-- have
PHRs, you'd have conflicting standards and you couldn't comply with
those.

MS. ROBERTSON: You know, that's an excellent question, and was one we
didn't address. We clearly did think about the concept that the Privacy
and Security Solutions Group, that HHS is currently funding, would
provide \-- that would be an appropriate place for that to be looked at.
The Confidentiality, Privacy and Security Workgroup would be an
appropriate place to take that, and I think that's a very important
issue to take forward. We certainly don't want to complicate the arena
of privacy and security further, speaking as a mother whose kid was in
the emergency room in another state the other day. We don't want to make
it any more complicated to get health information.

MS. DILLMAN: I guess if there is a way to include, you know, definition
of success could be adopting a standard that already exists, instead of
creating our own. I think sometimes we feel compelled to create our own,
or we haven't succeeded or added value.

DR. BRAILER: I think it's a point well taken. We will ask the Workgroup
and others to take that into consideration. With that, let me turn to
Secretary Leavitt.

SECRETARY LEAVITT: I read the \-- both report letter and the dissent
letter with great interest, and I \-- and I read it \-- both of them a
couple times. AHIC's responsibility is to advise the Secretary. May I
say that the Secretary gratefully would receive this report. I think it
has been a very productive conversation, and I think it represents, as
well as could be, the state of agreement or the lack thereof.

There are many parts to this puzzle we're trying to assemble. There is
the adoption part of the puzzle. There is the interoperability part of
the puzzle. There is the privacy part of the puzzle. These will not move
forward in perfect symmetry. They will come together in different
pieces. We'll get a corner piece, then we'll get a piece of the cover,
then we'll start to build on it. We'll be assembling this in many
different ways.

AHIC is \-- I'm routinely asked about adoption, for example, and whether
or not we're moving fast enough on adoption to warrant our focus on
interoperability. Well, frankly, we have to be working on all of these
at the same time. AHIC will have more influence on interoperability than
we will on adoption. Likewise, under privacy, it's very clear to me that
there are policy debates that have to be ongoing, that we have not
resolved yet. We have to keep wearing away at those until we find
whatever combination of things we will. But frankly, our influence in
AHIC will be greater on the technical side than it would be on the
policy side, and that doesn't mean we don't keep working on both of
them.

I would say that from my view, PHRs would clearly play a major part of
this puzzle. I agree that we don't know with exactness what they'll look
like. We don't know with exactness, what part they will play. But I do
believe that Colin is right. If you're going to have PHRs, ultimately
you've got to have a way to populate them, independently of me putting
in my information. I long remember Kevin's point about \-- Kevin
introduced himself at our first meeting saying he's one of those guys
that manually put his checks into \--

MR. HUTCHINSON: You remember that, do you?

SECRETARY LEAVITT: I do remember that, and there are a few Kevins
around, but not very many. \[laughter\]. Thankfully there are early
adopters, and we are blessed with them in this whole health IT debate.

I would just like to say thank you, to the hard work that's been done
here, and I think it has made a great contribution. And I will
appreciate both sides of \-- I learned as much from the dissent as I did
from the committee's report. And I'm better informed now, on my ability
to begin to wrestle with these policy issues, as well as the technical
issues.

I would like to ask or suggest that this won't be the last time that the
Privacy Workgroup comes back with disagreements, but I hope that \-- I
hope they'll come back. I hope that they will be expressed as skillfully
as these have been, and I'd like to suggest that the report will be
appreciated.

DR. BRAILER: Thank you. With that, let me turn to the question of the
recommendation. This is a recommendation that does have a formal
dissent, so we're going to ask for a vote on this. So I'll just ask for
those that are in favor of the adoption of Recommendation One from the
Consumer Empowerment Workgroup, particularly say "aye."

COMMUNITY: Aye.

DR. BRAILER: Those opposed to Recommendation One, please say "aye."

\[silence\]

DR. BRAILER: Recommendation One passes. Thank you both very much. Rose
Marie, can we turn to Recommendation Two? And just take a few minutes on
this, please.

MS. ROBERTSON: Yes, we'll be quick here. This is a recommendation that
we brought back after further discussion with the various federal
agencies affected by what we had recommended before. The recommendation
and \-- so we're hopeful that this meets the spirit and needs of
everyone. Here we recommend now that HHS, through CMS, the
\[unintelligible\] Health Service, and in collaboration with the Office
of the National Coordinator, should develop plans to offer \-- so
develop plans, not should offer \-- to offer portable PHRs with adequate
privacy protection to their beneficiaries, and report back as available.

That follows, obviously, on some of the work that's already been done,
for example, in the VA. We hope that those plans would take into account
the results of the studies and best practices that we talked about in
January. As they become available, that should take a little time, and
should build on work underway at the agencies. And I leave that to
discussion and comment by those who know more about this.

DR. BRAILER: Okay. Discussion is open on Recommendation Two.
Recommendation Two, Tony Trenkle?

MR. TRENKLE: Yeah. Rose Marie, I'd like to make just one slight
modification and suggestion. Instead of offer, make available, because I
think what we're trying to do at CMS is make the PHRs available to our
beneficiaries, but not create our own PHR. And I think there is a very
important distinction. And when you say offer, it sounds like we're
actually getting into the business of it ourselves. What we'd like to do
is make sure we fully support PHRs, as they develop, and make our data
available to ensure that the proper privacy and security protections are
in place, but not offer a CMS-specific PHR.

MS. ROBERTSON: And I would certainly accept that amendment. I don't
think that there was a sense that we meant you had to build one.

DR. BRAILER: Other discussion on Recommendation Two? In the absence of
discussion, we'll accept this declaration as being approved. Thank you
both very. Thank you Nancy, Rose Marie and David, thank you very much.
With this, we'll turn to the Quality Workgroup with Carolyn Clancy.

DR. CLANCY: Thank you and good morning. Let me just test the sound
system. Chip and Doug, can you hear me?

DR. BRAILER: They said yes. \[laughter\].

DR. CLANCY: I see the nod, but not hear the words. Let me first say that
we have a terrific Workgroup here. My co-chair, Rick Stevens from
Boeing, asked me to communicate his very, very clear sense of urgency,
and since he'll be meeting with you in the near future, Mr. Secretary, I
wanted you to hear that as well. But he's very excited about where we're
going and has been in close touch with our work.

As is typical with many of these Workgroups, our work has also been
informed by others who participate in these public discussions, and
support from the Office of the National Coordinator through Kelly and
others has been wonderful.

Let me just say I believe that you're getting copies of this letter
distributed right now. And in the letter, the context for our work is
laid out, I think reasonably clearly. So I will touch on that at various
points in this presentation. But the one point I wanted to make is that
our guiding premise is that the \-- in this case, the quality enterprise
should drive our recommendations to you about how the capabilities of
health IT can help make data capture for quality reporting more
efficient, and help to improve that care, at the point of care when
patients are receiving care.

So our broad charge here is to make recommendations to you so that
health IT can provide the data needed for the development and
application of quality measures useful to patients and others, automate
the measurement and recording of a comprehensive current and future set
of quality measures, and very importantly, to accelerate the use of
clinical decision support that can improve performance on those
measures. In other words, this is not just about making faster or
spiffier report cards. This is also about literally helping clinicians
and healthcare organizations improve the care that they're providing.

The specific charge is to make recommendations to you that specify how
certified health IT can capture, aggregate and report data for a core
set of ambulatory and inpatient quality measures. Now again, in the
spirit of the quality enterprise driving this, we are building on the
work that's already ongoing through the Hospital Quality Alliance and
the AQA, which focuses on assessment of physician performance. These are
broad multi-stakeholder alliances that have achieved consensus about
prioritizing the implementation of measures that have been standardized.

So to put this in picture terms \-- and you can see that down to the
south, Hollywood has nothing to fear, since they're \-- given our use of
names like Mr. Jones and so forth. But Mr. Jones experiences typical
symptoms of a heart attack and is rushed to the local emergency where he
was given aspirin by his nurse. Now, the receipt of aspirin at the time
of admission is, indeed, one of the measures that hospitals have been
reporting on for several years now, and it actually derives from very
strong clinical evidence linking the use of aspirin to better outcomes.

Now, the clinician is prompted by an electronic health record that
includes clinical decision support. That information is also transmitted
to the hospital quality data store, or internal to that hospital
repository; and ultimately, the performance information, not the patient
data, is transmitted to a quality organization which could be the joint
commissioner or other accreditor.

Dr. Smith reviews the electronic health record for Mr. Jones' past
medical history, which, because of effective health information
exchange, is all available, even though he's moved a lot in the recent
past. Dr. Smith is also prompted not to give this patient a beta blocker
because he has asthma, and that is one of the contraindications for beta
blockers.

Very importantly, that Mr. Smith and \-- Mr. Jones, rather, is not
included in the denominator when the hospital is reporting information
on quality, because he shouldn't be. A patient who is not eligible to
receive this treatment should not be counted as someone who didn't get
it.

At the time of discharge planning, Mr. Jones' doctor, Dr. Smith, answers
questions electronically, gives his prescription information and
completes required fields in the discharge module. For those
organizations, and I know this the very relevant for Lillee's
organization that have been struggling with the issue of reconciling the
patient's medications when they are admitted to the hospital, with what
they get when they're discharged from the hospital, making sure that
they don't go home and take both sets of medications. This turns out to
be a very, very tough lift right now for hospitals.

Back at home, of course, Mr. Jones uses his personal health record to
understand, and he's got good information that is understandable by him,
about what happened during the hospital; and he also goes online to
select a new doctor, and he does this on the basis of quality ratings,
and also ratings on what the physician charges.

He picks Dr. Thomas, who actually has access to what happened to Mr.
Jones in the hospital, reinforcing Mitch's earlier point about the
importance of continuity of care between the inpatient and the
outpatient setting.

Interestingly, just as Dr. Thomas is getting ready to exit this review,
he is actually prompted, again, by clinical decision support, about
whether he's actually counseled Mr. Jones about quitting smoking. And
Mr. Jones is well on his way, now, to becoming a much more active
participant in managing his health and healthcare.

I'm going to just hit a few high points on this slide, which is actually
showing you where the recommendations fit into a flow of quality
information. The upper left-hand corner, part of our charge ultimately
is to try to figure out how to improve what might be called the quality
supply chain. Right now, we have out a very good clinical practice
guidelines based on the best scientific evidence, and in general, we're
getting a much greater supply of performance measures that are derived
from those clinical practice guidelines.

As a rule, most of these performance measures are not sufficiently
specified to incorporate into electronic health records, and that's an
area that needs to improve. If you start with the patient, down at the
bottom in the middle, intersecting with the healthcare team, again,
reinforcing this point that what we're describing as a future state
makes medication reconciliation much, much easier, and may actually free
up many nurses and others to \-- who will be liberated from the task
that they currently encounter trying to get this straight.

The one other point I wanted to make here was, again, the data reported
for aggregation and reporting on quality is simply information on
performance. It is not creating, yet, another mega-repository of patient
level data.

So our first recommendation is to build on work that has already been
started by the Quality Alliance Steering Committee. This is a group that
brings together leadership from the hospital quality alliance in the
AQH, who identify points of synergy, again, reinforcing the importance
of continuity of care between the outpatient and inpatient settings.

They have begun work on harmonizing measure specifications across
settings of care. We're going to ask them to convene an expert panel
that would accelerate current efforts to identify a common set of data
elements that have to be standardized in order to enable automation of a
subset of AQA and HQA measures.

This steering committee, with support from HHS and other relevant
federal agencies, would establish the priority order for the measures.
Just a word on this issue of priority right here. I think many of you
are acutely aware that physicians have the opportunity, as of July 1,
2007, to be reporting in exchange for which they will get a
one-and-a-half percent increase in their Medicare reimbursement.

To say that this has stimulated a lot of interest in developing quality
measures among multiple physician specialties would be an
understatement. Some of these we expect will be more transitional. They
will be used in the first round, and then improved over time. So to that
extent, we thought it was very important to have a prioritized subset.

Some of the criteria for prioritization, for example, might include
alignment between what physicians are doing and what hospitals are
doing, by way of one example, but I wouldn't presume to dictate what
they are doing. So that is the very first recommendation, and I believe
it is the wordiest and longest.

The second recommendation derives from this, 1.2, and that is that the
\-- this expert panel would actually deliver the work to the health IT
standards panel so that they could identify data standards to fill
identified gaps for data elements required for automation of a core set
of AQA and HQA quality measures.

And Recommendation 1.3 says that the certification commission should
then develop appropriate criteria necessary to support the reporting of
core sets of measures in the next round of criteria developments. We
believe this is very, very important to accelerating the Secretary's
vision for value driven healthcare, because right now, investments in
electronic health records do not make this feasible.

Should I just keep moving through all the recommendations?

SECRETARY LEAVITT: Yes, let's just go through all of them.

DR. CLANCY: So the second recommendation is to gather and deliver key
information to providers to help drive improved care outcomes. Coming
back to the point that this is not just about making faster and more
accurate report cards, but is actually about figuring out how that same
aggregation of information can be used to support providing quality of
care in the first place.

What we're recommending is that this expert panel should also gather
synthesizing refined clinical work flow amounts, focusing on care
processes related to care underlying the conditions targeted by this
prioritized set of measures. And the results of this analysis should be
reported to the Community by mid September, 2007. I have neglected to
say that the first recommendation, we would bring back our first
findings in June.

The third recommendation is titled, "enable data aggregation to allow
public reporting of quality measures." And this actually speaks to the
reality that over the next several years, we are probably not going to
reach 100 percent, in terms of penetration and adoption of electronic
health records across all settings. And I should say certified
electronic health records.

What that means for the quality enterprise is that in order to
efficiently capture data required, we're looking towards both the use of
claims data, enhanced by clinical IT elements where we've got good
standards; for example, lab results and pharmacy. So this recommendation
says that HHS, working with relevant public and private sector leaders,
and the current six pilots, one of which is right here in California,
that came out of the AQA, these are called the better quality
information for Medicare Beneficiary Projects; should identify and
articulate key challenges associated with linking claims data for
multiple sources.

In other words, what these pilot projects are going to be doing is
reporting on physician performance by pulling data from multiple private
insurers with Medicare. It turns out all of those have their own
internal rules about identifying physicians, claims adjudication
processes and so forth. And since this recommendation is to learn from
that as rapidly as possible, so that we can identify for you the
benefits of linking clinical data to other data sources, including
claims data. And this report will be submitted to the Quality Workgroup
by the end of June.

The second part of this third recommendation is that HHS should enable,
through the NHIN contracting process and value exchanges, efforts to
combine clinical and nonclinical electronic data for quality measurement
and timely reporting of results. And we discuss the use of this as a
possible use case for the next round of NHIN contracts at the last
meeting of this Community.

The fourth recommendation speaks to improving the supply chain of
quality measurement or aligning quality measurement with the
capabilities and limitations of health IT. A point I made to you last
time is that when people develop quality measures today, they are very
focused on what's the right evidence, what's the right thing to do. And
it doesn't even cross their minds to think about how are we going to get
the data to know if someone, or an organization actually did the right
thing.

So the first part of this recommendation says that HHS, through CMS, are
working with other major measurement developers, should identify
opportunities to enhance development by considering data needs at the
time a measure is developed, especially from measures targeted for
public reporting. Some work has begun in this phase already,
particularly with the AMA's physician consortium, but we think there is
an opportunity to accelerate that.

And then the second part of this recommendation recognizes that the
national quality forum, through its endorsement process, should apply
criteria that reinforce the use of standardized data elements and
measures to allow quality measures to be embedded in electronic health
records.

So a lot of information to be presented, and now I look forward to your
questions.

DR. BRAILER: Thank you, Carolyn. The floor is now open for discussion on
these recommendations. Julie Gerberding.

DR. GERBERDING: Thank you. I can see that there has been an enormous
amount of thinking and progress, and I really appreciate it, because I
know how hard this is. In listening to this, I have two kinds of
conceptual questions, and I mean them very respectfully.

One is that we're talking about quality measurement and reporting, but
what we really want is value; and how will we link the cost information
to the quality information, in terms of a set of measures that we can
really get ourselves around. So we've put a lot of \-- because that's
where the evidence faces, that's what we know, that's where we can
develop our scientific expertise. Fundamentally, what we really want is
the best value for our patients.

And the second is a harder one for me, and it probably \-- reflects my
lack of recent experience in a system, but when we think about quality
traditionally, we're thinking about either something that happens to the
patient at an encounter, or set of encounters, provided by provider, a
team of healthcare providers in an organization or set of organizations,
but ultimately, we're so networked now that it's really the quality of
the system, and who owns that.

And I'd like to say that it's probably the public health department who
owns it. Others might say it's the payer who owns it. But somebody
ultimately has to be accountable for the help within that whole set of
networked organizations and entities. And I just wonder whether or not
our thinking is getting there fast enough to really take that into
consideration.

DR. CLANCY: Sure. Just a couple of comments. The question about value,
we have framed the recommendations very much in the spirit of the
idealized \[inaudible\] Secretary Leavitt and others often use in terms
of people making informed choices about what is the quality of a
particular provider, how far is this person or this organization from my
home, what's the total cost, what's my out of pocket cost. So we won't
be working specifically on that, but are pointing to a future vision
where that information would be available to people.

I think ultimately, the real test for the quality enterprise is going to
be can they develop measures and implement them that actually speak to
misuse and inappropriate use. We're starting to see some of this in work
on patients \[inaudible\] as you know, haven't been very much involved
with that. But I'd have to say it's not an area that's terribly well
developed right now.

The alliances have begun more to focus on efficiency in episodes of
care, recognizing that most of the enterprise right now is tightly
linked to silos. We've got hospital measures, we've got physician
measures, nursing homes, and so forth. But ultimately, as our future
vision, notwithstanding lack of originality with names, was contended to
convey, it's very much about the entire episode and how do those pieces
come together. I think it's fair to say we don't have, at this moment, a
model of shared accountability that begins to say who is accountable and
\--

\[break in audio\]

MALE SPEAKER: We're back.

DR. BRAILER: Carolyn, were you done?

DR. CLANCY: Yes.

DR. BRAILER: Okay, Mark, do you want to just come to microphone and make
any other comments?

MR. MARK LEAVITT: I think those are correct time frames, I think the
ambulatory electronic health records, we require \[inaudible\] that they
start collecting structure data. You have to actually begin collecting
the data a year or more before you can begin to get statistics.

MR. KAHN: David, we were down from here. We have questions.

DR. BRAILER: Okay. We're coming to you.

MR. MARK LEAVITT: So I think we can move reasonably quickly to \-- we've
been waiting for the measures to be standardized. The Workgroups are
waiting for that, so we're very much poised in the ambulatory field. In
the hospital, it's a longer reach for this, because we \-- we're
focusing on the medication chain, where there are a lot of quality
measures, indeed, but there are some that we don't touch yet, so it
would be a couple years.

SECRETARY LEAVITT: I want to make sure that I understand the sequence
here. You're proposing that by June, you would identify \--

DR. CLANCY: Prioritized set of measures from the workgroup.

SECRETARY LEAVITT: Test set of measures, and then by September, a
criteria to support reporting. This is on the ambulatory side of the
house. What I hear you saying is that inpatient it's going to take
longer, because we're not as far as long with that.

MR. MARK LEAVITT: Right.

SECRETARY LEAVITT: So if that occurs on schedule, we're out creating
value exchanges who are hopefully going to have the capacity ultimately
to bring that data \-- at first it would in a manual form, but it sounds
to me as though perhaps a year after June?

MR. MARK LEAVITT: Yes. What would happen is June is the perfect time for
input to the Workgroups on the '08 cycle, for what will be available in
May, \-- what will go on the standards for 2008, the criteria. They may
decide the market is ready enough to include it, literally, so we would
require it for the 2008 criteria for May, or they may say it's a little
too far beyond where people are to put it on their road map, which means
it would be required one year beyond. But that doesn't mean it doesn't
encourage vendors to include it when it's on the road map. It just
doesn't force them to have it on for certification until it actually
becomes \--

SECRETARY LEAVITT: This will happen in one system at a time, but
theoretically, you would have \-- in June, you would have \-- you would
have data standards and a criteria to support its collection. It would
go into a certification that would begin to happen at the end of that
year \--

MR. MARK LEAVITT: In May of 2008, right.

SECRETARY LEAVITT: And then theoretically, people would begin to buy
systems that would be certified to that, and the doctors could get their
one-and-a-half percent by buying them, and they would start to collect
the data. And the data, then, would be a way that ultimately could begin
to screen to \-- in some form, to a value exchange where the information
could begin to be assembled. And that's where it would connect, at least
in my mind, Julie, with the price.

Again, theoretically, we will have, by that time, have episodes of care
pricing that could be \-- where it could be connected up. So if you
allow a year for that to begin to mature, for the system to be
populating with data, you're really looking at something like maybe the
year 2010 before you'd start to see automated collection of data
connecting into \-- or being aggregated with the value exchange and
ultimately, some kind of product falling out the end of the pipe. Is
that \--

MR. MARK LEAVITT: Sounds reasonable. I want to point out that the fact
that you've coupled that one-and-a-half percent reimbursement, makes it
\-- it looks much easier for the vendors, when their customers are going
to recognize extra reimbursement, so I think that's a very good
accelerating factor.

SECRETARY LEAVITT: That's the point, I think. If we are able \-- I said
earlier when we came, that our ability \-- the ability for us to make
this vision happen depends on \-- is dependent on our capacity to
deliver. This one-and-a-half percent would become a pay cut, if we
haven't got a way for people to actually collect the data and make good.
Or it would be an enhancement, if we are.

And if we're able to, by mid-year 2008, to have a system certified and
people can begin to spend their one-and-a-half percent on a system in
2008, then that becomes a very serious incentive.

DR. BRAILER: Let me turn to Chip Kahn in Washington for comments there.

MR. KAHN: With all due respect, and I guess I'd hate to be the skunk at
the garden party. And I'll support 3.1 and 3.2. But I think that \-- and
I'll speak from the hospital side, but I'd be interested in Doug
Henley's thoughts from the doctor's side.

The federal legislation regarding reporting is federal legislation. We
report from hospitals nationally. So I don't know what the ultimate
relationship will be between hospitals and these local value exchanges.

I can tell you from my point of view, and the people I represent, we're
more than happy to participate in value exchanges and make them work in
terms of being change agents and providing information to people. But at
the end of the day, what's implicit in these recommendations is that
somehow data is going to be collected locally, and at least on the
hospital side, that is \-- not only is it a nonstarter, it is completely
different from what's happening today with the Iowa QIO, collecting the
information, and being reported on a CMS website.

I think that we can improve what's happening today, but it can't be
local. The information can, of course, be used locally, but I think
implicit in here is policy that is counter to current practice and is
problematic, if we go down that road.

All that being said, the connectivity to the data vendors who help us
process our data, all the things that are assumed here, is great, but if
we \-- but if we assume that there's going to be any kind of local
collection of data, that's a problem.

And I'd like to hear from Doug, because I think on the physician side,
too, the notion of local or regional collection of data is a big
problem. Standardization is a problem.

And let me say one other thing before I conclude. I'm all for efficiency
measures, and those efficiency measures can be connected to length of
stay, to other kinds of activities. But if you want to connect those on
the hospital side to the monetary side, or even on the physician side
connecting it, you got \-- you've got tremendous technical issues that
go way beyond records.

When a claim is submitted, or when a metric is submitted, is not the
same time. The processing the claim isn't the same time. Whether
Medicare says they actually would pay for something, at what rate, isn't
the same. And then you get into the issues of, well, what is the cost?
Are they Medicare costs, are they private sector negotiated rates? Are
they actual charges?

So I think that we are dealing with issues that can ultimately be worked
out, but tying these payment issues to reporting of measurements, I
think, is problematic. And I think when we look into efficiency, we're
going to find activities within the episode of illness, rather than
connection to cost data that's going to be most useful, because we don't
know the cost data in the same timeframe, however you calculate it, as
we would the clinical side or the experience side, even for a whole
episode of illness. I don't know if Doug wants to say anything.

DR. HENLEY: David, may I speak?

DR. BRAILER: Please, Doug. Go ahead.

DR. HENLEY: Well, thanks very much. I, too, had a bit of question mark
next to 3.2, but just to the point of asking Carolyn to clarify the
intent of 3.2.

Let me first say that in general, I support all of these recommendations
very strongly, particularly Recommendations 1.1 through 1.3. Mr.
Secretary, as you alluded to earlier, if there is several points along
the continuum that will speed the adoption of electronic health records
by physicians, it's Carolyn Clancy's dream that all you have to do is
push F7 on your computer, and out comes that quality data reported, or
wherever it needs to be reported, so it's seamless and easy for the
physician, the practice, et cetera, to do that in those first
recommendations, and indeed, perhaps all these recommendations point us
in that direction.

But I did want to ask Carolyn to clarify 3.2, because I had some of this
\-- similar concerns that Chip just noted, but again, more in the sense
of a question, I guess, more so than \-- the need for clarification more
so than true concerns.

Clearly, we need to aggregate data across all payers in order to be able
to feel comfortable with the public reporting of data. So Carolyn, could
you clarify that?

DR. CLANCY: Right. Let me try to speak to both sets of issues raised. I
think what you're both asking, particularly Chip, is how do we
transition from a world where we've got measures very tightly linked to
the site of care, where we know what we're doing, and on the hospital
side, we're reporting those to a national repository. They go up on
hospital compare, and you can look and see what hospitals are doing. How
do we get from there to this future vision, and sort of picture that I
tried to paint for you about the future of Mr. Jones.

At the end of the day, Chip, your folks cannot get to a much more
efficient way of getting the data required for quality reporting, if
they don't have some connection with what happened to the patient in
other settings. Often times, right now, I'm guessing that some of your
members are inaccurately held reporting lower rates, say, for
performance and beta blockers for people who have had a heart attack,
because the information that should have excluded that patient from the
denominator for that measure is missing, or it's sitting in a piece of
paper in a doctor's office.

So I think getting from here to there is going to be a bit challenging.
We're not prescribing the solutions. What we're trying to do is figure
out what the requirements are. That has been one of our guiding
principles from the outset.

Value exchanges are not going to be doing data aggregation themselves.
They're going to be using \-- there will be a central contractor that
does that for them, and they will be buying those services to aggregate
data from private payers and from Medicare. And they will be hopefully
using data about local hospitals and data about local physicians. So
people begin to get a sense of this picture, but that's still several
steps removed from the future vision that we're showing you.

Yes, right now the hospitals are doing national reporting, but at the
end of the day, to get to a place where it's very efficient for your
members, for hospitals across the country to report on quality, and to
improve that quality at the same time, they're actually going to need to
have some linkage with a nationwide health network, which is going to
make all of the policies for local health information exchange activity
very, very easy to \[inaudible\].

DR. BRAILER: Thank you, Carolyn. Secretary Leavitt?

SECRETARY LEAVITT: I wanted to reconcile what I've heard Chip, and some
extent, Doug saying. My sense was, Chip, you were saying if you are
going to link reporting to payment, you've got to make it direct and
efficient, and we've got to be able to report one place, not a whole
bunch of places? Am I \--

MR. KAHN: Yeah. That's part of it. And I understand Carolyn's point. You
can use the network to do the reporting, but I think this is not going
to be done on a local basis. At least as far as \-- the near future.

SECRETARY LEAVITT: As I \-- I visited, I don't know how many, dozens of
these collaboratives now, and underpinning consistency in the whole
thing is that it's the local hospital that's the, sort of, foundation
piece of it, and that in many respects, the intellectual fire power
behind it and so forth. And it's also clear to me, when I talk to
physicians, that they don't want CMS to be the \-- or the government to
be \-\-- the place where this data gets publicly disclosed. They want to
have it on a local basis, where they can get a hold of the people and
say, this is wrong. There is something going on here.

And so it appears to me that things aren't inconsistent. If you're a
hospital, that would be one place that you can send data, but there then
ought to be a way to parse that data out to these value exchanges, where
it can actually be combined with \-- combined with the cost data and
value judgment data produced. Is that inconsistent with your \--

MR. KAHN: I understand. I understand your notion of the hospital being
the driver, and I'm sympathetic with that. I guess my point is, at least
in terms of the clinical \-- the clinical data, just having the data
from a hospital isn't really sufficient. You need to be able to compare
that hospital to all other hospitals, and thus, you need to have \--
across the country. And you need to have comparable data, collected in
the same way, with all the same standards, in the same timeframes. And
in a sense, with hospital compare, that's what we have now. And it's
actually \-- I don't think it's user friendly for consumers, but for
those who are professionals, it actually is a fairly useful database to
make comparisons on a number of \[unintelligible\] conditions.

I think over time, I think on the use of data side, I see the value
exchanges doing what you're describing. But we have not really rectified
this whole issue of cost, because it's cost to whom at what point, and
that's different across payers.

And our CMS data is actually all payer data, because it covers all
patients that hospitals deal with. And I'm more than happy to continue
the dialogue to figure out sort of how to connect the two, but I think
right now, we have \-- because no one who walks into the hospital has
the same amount paid for them, unless they're a Medicare beneficiary or
Medicaid recipient. Everybody else gets a negotiated rate. I think it's
more complicated.

And when we talk about basic cost, you know, there's Medicare cost,
according to how Medicare defines it, but that's also sort of an
ephemeral issue.

So I hate to sort of get caught up in the quagmire of the payment side,
but I think connecting those two is going to be very difficult. And we
still haven't figured out how to do that, despite the fact that HCA has
now come up with a program to provide certain pricing data to people who
are coming in the hospital, and others have, getting that data
prospectively, based on assumptions about certain kinds of care, and
getting that data on what was actually paid or spent on a patient after
the fact is actually quite different.

And that latter part is not something that we technologically know how
to do, beyond maybe for Medicare. And there it's because Medicare has
rules that have been set in place for a long time.

SECRETARY LEAVITT: I think it's important that the vision of these value
exchanges that we recognize, that it's likely not going to be the value
exchange that creates a website that provides the comparison. It's
likely they will be providing the data, and some insurer will use that
data to provide their beneficiaries with what their contract would
provide in certain configurations.

I agree with what \-- and think there is a certain feeling \-- this does
feel chaotic. There is, in fact, a pattern here that I agree with you,
we'll figure out how to do this as we go, one step at a time.

DR. CLANCY: And Chip, I think what I also hear you saying is that right
now, there is not a clear business case or a business model for all of
these data collection efforts. And obviously, since hospitals were on
the leading edge here of reporting and so forth, you're going to be
acutely conscious of that.

Our focus has not been to prescribe solutions, but to actually figure
out what are the requirements that we're going to need to get to a place
where this is much, much easier than it is right now.

DR. BRAILER: We have a few more people that want to comment. I'll turn
to Kevin Hutchinson, and ask that the comments be brief, since we have
two more Workgroups to come in a short amount of time. Kevin?

MR. HUTCHINSON: Thanks, David. My comments are a suggestion, and just a
reaction to the suggestion. One of the things that's a well-documented
outcome is medication adherence and compliance.

I'm putting on my pharmacy hat as representing pharmacy on this Council.
And that the MMA recognized the value of medication therapy management
services in putting medication therapy management within the MMA. This
is something where data is available today, to be exchanged with
physicians as well, and I'd ask that we, in all of your slides and in
comments, that we also recognize the role of the pharmacist in that
process, not only as a healthcare services provider, but also as a point
of information in data exchange, to be able to share that medication and
history information.

In your Recommendation Two and Recommendation Three, which focuses on
clinical work flow, and then claims data, aggregation of data, this is a
very valuable source of resource, as a provider of care as well as a
data exchange. And I know we're working with CCHIT as well to get
medication history standards that's been adopted by HITSP into the
certification process. And this is something that we can do today, to
drive more compliance by patients on medication.

So as you look at the quality performance and improvement, that we focus
also on medication compliance as part of one of those quality
improvement \--

MS. CLANCY: It's a very good point, and also consistent with a lot of
work that we at AHRQ are doing with CMS right now. I mean oftentimes the
pharmacist is the only point of information about the fact that a
patient has tried to refill an inhaler, for example, 12 times in the
past month; which tells you something about either they're losing them a
lot or that their disease severity has increased dramatically and so
forth.

DR. BRAILER: Nancy Davenport-Ennis? Nancy, hold. I think you're on mute.
See, the healthcare industry isn't that \[inaudible\] interoperability.
\[laughter\] \[inaudible\] okay, Nancy.

MS. DAVENPORT-ENNIS: All right, thank you, David. There are three points
that I would like to make. Point number one, Carolyn, thank you for an
excellent report, and excellent recommendations.

There are \-- if I look at Recommendation Number One, I'm certain that
you would be including a patient consumer on the expert panel, but as I
represent those within the AHIC, I would just like to call this out so
that it can be a matter of public record that we are recommending that
they, indeed, are included on the expert panel.

Number Two, as we are looking at cost and collecting cost, and trying to
define the value that's being received for the cost, I think it is also
an ideal time for us to look at collecting the cost that the consumer
and the patient is investing, in order to access the public health
networks in this country, and the hospitals and the clinics in the
country. That information is going to be available at the time that you
are capturing the costs that are cited here.

I would also point to the Recommendation Two, which is gather and
deliver key information to providers and \[unintelligible\] improve
outcomes, and again, I think that as we look at identifying patients who
are eligible for inclusion, the AQA and the HQA, having a patient on
that expert panel and a consumer, can also be helpful in answering those
questions moving forward.

I'm very pleased to see that in Recommendation Three, that there is
going to be such a concentrated effort to collect the data, and I would
simply call out for a matter of public record that Carolyn, that
information will be of particular interest to the consumer, once it is
reported out to them, as they're defining value.

I think that Julie Gerberding certainly set a high bar in the remarks
that she made, for the quality work that you do, is, indeed \--
ultimately the value of it will be defined by the consumer who uses the
result of your work. Thank you very much.

DR. CLANCY: Thank you very much.

DR. BRAILER: Thank you, Nancy. Mitch Roob.

MR. ROOB: Thank you. Mr. Secretary, I spent some time going through
Indiana's opportunity before you visited last week, so if I may just \--
Chip, just to address your concerns.

The progress that we've made, and I think that you'll find here in
California, would not have been made, had you waited \-- no offense to
my friends at CMS, but had we waited for CMS to create the singular
national model. You couldn't have gotten off the ground, both in Indiana
and other places, with the speed and robustness in which we were able to
do.

We will be able to report data, beginning at the next contracting cycle,
as a result of that. And I think other value exchanges will, as well, in
terms of copying that performance to contracting.

We're very excited about that, and while I understand your concerns that
\-- at least in our state, the hospitals have driven that change
process, and have wanted it to be a local process, not a national
process. I recognize Indiana is a bit different, or may be a bit
different in that respect.

Secondly, I would just comment on the cost issue. Very difficult to
equate cost to this when you have as many uninsured Americas as we have
today, and that, when you're layering the cost of other people's care
into your care, it's very difficult to find what a real cost number is,
on a counter basis.

So we've got work on quality, I think, here, and work on the cost issue,
once we give more Americans a real opportunity to purchase affordable
healthcare products.

SECRETARY LEAVITT: Mitch, I think that's \-- from my observation, and I
think Chip would agree with this, where the real attraction is, is where
local hospitals are working with local groups to report this
information. They're far more enthusiastic about reporting to a local
group than they are in sending it off to CMS. They get paid for sending
it to CMS, but they're paying to send it to their local organization.
And somehow we've got to streamline that process, and certify into the
collection records, so that people get this automatically \-- so they
can do it automatically.

MR. ROOB: And Mr. Secretary, I'd also \-- they're much more willing to
do this on a local basis than even a state basis. I mean we have various
marketplaces in different states, which aren't particularly enthusiastic
about working all that closely together, but inside that marketplace,
they will; so we've got to keep that in mind as well. We found that in a
number of different adoption profiles.

DR. BRAILER: Okay. Because of a lack of dissent, I'm going to declare
the following recommendations. Approved by affirmation, 1.1, 1.2, 1.3,
2.1, 3.1, 4.1, and 4.2. Would you like to have any other discussion on
3.2? And ask for a vote on this. All in favor say "aye."

COMMUNITY: Aye.

DR. BRAILER: And those opposed, "nay. Thank you very much, Carolyn.

We now turn to the Population Health and Clinical Care Connections
Workgroup, with Chip Kahn, John Lumpkin and Julie Gerberding. And I do
ask for you all to be as brief as possible, allowing time for the
fullness of the discussions because of the number of issues we have
before us today.

MR. KAHN: Let me open up by thanking John Lumpkin and Julie for their
help over time. This will be the first time this Workgroup is reporting
as the Population Health and Clinical Care Connections Workgroup, and I
think that relates to our transition from focusing on biosurveillance,
solely in terms of the first \-- the first priority set out by the
Secretary to the broader public health issues. And I think that \-- you
will see, as we go through our recommendations.

What I'm going to do is ask Kelly Cronin to set some context, because
she's out there. Then Steve Solomon will go through \-- who works with
CDC and has been helping us. He's going to go through most of the
recommendations. I guess when we get to the last, number three, the
biodirectional, that will come back to me and then I'll close out.

But Kelly, if you could give the context, and then Steve go through the
other recommendations. I'll do the biodirectional reporting at the end.

MS. CRONIN: As Chip just pointed out, we are now entering into the new
phase of work in our Workgroup, and we are lucky to have good
representation from not only all levels of public health on our
Workgroup, but also from clinical care. And most recently, we added
membership from the Health Information Exchange, so we can start to make
sure we have a comprehensive and diverse set of expertise at the table
as we debate many different issues that apply to how health IT can
enable, more broadly, many goals we all share for approving population
health.

The broad charge that we already have agreed on is to make
recommendations to the Community that facilitate the flow of reliable
health information among population health in clinical care systems,
necessary to protect and improve the public's health.

Over recent months, we have been trying to focus on four \-- primarily
two out of four priorities that have been set by the Workgroup. So while
we have this very broad and ambitious charge, we do realize the need to
stay very focused on key priorities, including case reporting and
bi-directional communication. And as we have deliberated these issues,
we've realized that there is two emerging themes that keep on coming up
that our overarching recommendations will address today.

One is that public health agencies, across the country at all levels,
are largely not connected. They don't share the same standards, they
don't have systems that can interoperate or share information with each
other on a seamless level, as we would like to see across the healthcare
system. So we are offering many recommendations that address that issue.

We also have recognized the need to develop the business case for public
health, so that they can participate in the emerging national health
information network, and share data with each other, but also benefit
from the data that's going to be coming from healthcare, so there can be
a bidirectional flow, as needed, to reach many of our goals.

So I think articulating the need for healthcare providers to provide
this data, on a regular basis, to public health, is needed. They need to
understand how they might be reducing their burdens, and how they might
benefit from participating more closely in these public health
activities.

So with that, I'll turn it over to Steve for the presentation of our
overarching recommendations.

DR. SOLOMON: Thank you, Kelly. Mr. Secretary, members of the AHIC, as
Chip and Kelly have said, the first seven recommendations specifically
address the broader charge of the Workgroup, the clinical care
connection.

Let me start with 1.0, the state alliance for e-health in collaboration.
The state and local governmental public health, and clinical care
partners, in consultation with HHS, should develop a business case for
data information exchange, between public health and clinical care, as
well as develop a communications plan to improve the understanding of
the need for this exchange.

Recommendation 1.1. HHS, in collaboration with federal, state and local
partners, should develop an approach, including the identification of
resources, within public health, to support the HITSP process and the
harmonization of standards.

1.2. Again, with this broad collaboration in public health, to engage
directly with CCHIT, establishing an open participatory process for
certification of public health information systems, with
\[unintelligible\] functionality, security and interoperability.

1.3. Again, within an aggressive timeline, HHS, in collaboration with
other major partners in public health and appropriate organizations, to
establish proof of concept demonstrations, to show the added value of
the sharing of data, connecting clinical care to public health, through
health information exchanges.

1.4. We'll go back a slide. Again, the same group of collaborators will
work to develop a plan to encourage the integration of funded public
health surveillance programs and health information exchanges.

1.5. HHS and its agencies shall communicate internally, with all funding
recipients, regarding interoperability standards that were accepted by
you, Secretary, in December 2006, to be recognized this December.
Understanding that this recognizes \-- there is the acceptance of
interoperability standards in 2006, and the recognition of these
standards will be used for planning and programming purposes.

1.6. In 2008, it's our expectation that HHS and its agencies shall
ensure that internal programs, as well as externally funded programs,
and this is a key point, implement relevant recognized interoperability
standards. Again, this requirement applying to the implementation
acquisition upgrade of HIT systems, that support public or population
health, to make that consistent with the President's executive order.

And 1.7. Again, on a similarly aggressive timeframe, HHS should identify
a process to establish and manage an authoritative website, to share and
recognize standards, as well as to provide collaborative space, for the
sharing of standards being tested or used, but are not currently
recognized.

Let me move on now specifically to case reporting, which is the first
use case that was approved. April 30, 2007, it's our expectation that
the CSTE working with CDC will the define an ongoing process that we
will use to establish a common list of nationally notifiable conditions
to be reported at all levels of public health, along with the associated
standardized case definitions, including the appropriate data elements.
This August, CSTE, working with CSTE will provide to HHS this common
list of notifiably \-- nationally notifiable diseases, and the first set
of case definitions to be included in this process.

2.2. HHS should ensure the harmonization of data, technical and
interoperability standards for notifiable disease case reporting, based
on the resources that have been identified in Recommendation 1.1. And in
2.3, again, referring back to the first set of recommendations, CCHIT
should include requirements for flexibility and certification criteria
for automated case reporting of nationally notifiable conditions in EHRs
by 2009.

2.4. HHS should convene a meeting to determine a process for defining
requirements and implementation criteria for supporting automated case
reporting from electronic health records \[inaudible\] clinical systems.
This meeting will explicitly include industry vendors, as well as the
appropriate public health officials.

2.5. HHS, in collaboration with the other key partners of public health,
vendor organizations and clinical organizations, should develop a very
clear business case for the importance of automatic \-- automated
electronic case reporting. This business case can and should articulate
the burden associated with annual reporting, and the benefits and
limitations of automated reporting. Let me stop there.

MR. KAHN: Then if we go on to the last set of recommendations, bio
directional reporting; the first \-- Recommendation 3.1 allows for
harmonization standards are needed for formatting health alerts. And
what we mean here are these standards really apply to the structure of
health alert rather than the content of the alert. This can be thought
of as an envelope, rather than the pay load itself, although obviously,
these categories of content will have to be standardized, too. But our
thought here is the \-- in a sense, as I said, the envelope.

3.1. In order for public health and clinical care to communicate, they
must have current contact information. And this recommendation deals
with the issue of assuring, through work at HHS, that contact
information is updated regularly; and, therefore, a standard must exist
to support sharing contact information among public health and clinical
care partners.

And finally, for 3.2, by June 2007, HHS, in collaboration with the state
and local associations, representing public health and other appropriate
organizations, should establish a demonstration to look at the added
value of sharing information bio directionally among clinical care and
public health.

So David and Mr. Secretary, those are the recommendations of our
Workgroup, and Kelly, Steve, and myself would be happy to answer any
questions.

DR. BRAILER: Thank the members of the Workgroup, Kelly and Steve, it's
very good work, and I appreciate the very long amount of hours that you
put into this.

With this, let me open the floor for discussion on these
recommendations, and again, I'll ask you to speak directly into the
microphone and be as brief as possible, given our other agenda items.
Julie.

DR. GERBERDING: I just want to provide a frame here, because we are so
\-- we all recognize the importance of the improvements in value in
healthcare system, but we have to think about the health system more
broadly, and the public health piece of it is always kind of at the
margin.

And I think what these recommendations do is really bring the public
health system closer to the clinical care system in ways that not only
allow the public health sector to do its job better, but also
contributes to the future of the meaningful health system, where we can
begin to even talk about the value of the health system, not just the
value of the healthcare delivery system.

And the first step of that, just as healthcare transformation is \--
really health transformation is about, first of all, measuring the
health of the status in the community, reporting that to the community,
but also understanding, what are we investing, and what is the value of
that investment to the community?

And in order to do that, it's really the same principles that we're
working so hard around the table here to accomplish. But by bringing
this set of recommendations forward, I really see it as the first step
towards actualizing a future state, where we really are talking about
the same sides of the coin, and that we really can get to a value-based
public health system that will be very complementary to a value-based
healthcare delivery system.

DR. BRAILER: Thank you, Julie. Other comments? If there is any dissent
on these recommendations, please make it known. In the absence of
hearing any, we'll accept all these recommendations by affirmation.
Thank you all very much.

We'll now turn to the Confidentiality, Privacy and Security Workgroup
with Kirk Nahra and Jodi Daniel.

MR. NAHRA: Thank you very much. I know we're under a lot of time crunch
today, so we will be very brief with our single recommendation.

You have some information about our Workgroup. Membership list, that's
obviously undergoing some changes right now. I assume the AHIC is aware
of that. We are searching now for an additional co-chair who will be
working with us going forward.

Our exclusive recommendation, today, is essentially a follow-up from the
last meeting that we had, involving essentially a referral to CCHIT. We
do not \-- this recommendation does not require any revisiting of the
earlier discussion, related to the standards in that debate, and the
different views.

Our recommendation is very straightforward, which is we presented, last
meeting, some recommendations related to identity proofing, and we want
to make sure that essentially those recommendations are passed on to
CCHIT, and incorporated by them, as appropriate, in the event that they
end up making certification steps.

So our recommendation is that CCHIT should be made aware of the identity
proofing recommendations. They were accepted by the AHIC in January, and
where possible, security criteria, it develops, should support these
recommendations. Jodi, do you want to \--

DR. BRAILER: Jodi?

MS. DANIEL: Yes, David, thanks. If you go to the last slide, the one
thing that I actually wanted to highlight, this was actually a paragraph
that came out of the letter from the CPS Workgroup to the AHIC in the
last \-- at the last AHIC meeting.

The issue here \-- and I think what had come up at the last meeting was
that there were concerns about whether or not we were suggesting that
CCHIT be setting criteria for business processes. And I think we just
wanted to clarify that to the extent that there are criteria for the
technology that can be addressed to support the identity proofing
recommendations, we wanted to encourage CCHIT to do that, as they're
developing criteria. And it may be appropriate for AHIC to discuss, at a
future meeting, the issue of business processes and how best to
implement those.

We had suggested, and the CPS Workgroup has suggested in the letter last
time, how they anticipated the recommendations to be applied by HHS and
others, beyond this Recommendation Number Five. That came up last time,
so I just wanted to make that point.

DR. BRAILER: Great. Thank you, Jodi. Appreciate the work of the
Workgroup. With that, we'll open discussion to the Community members on
the Recommendation Number Five, from the Confidentiality, Privacy and
Security Workgroup.

If there are dissenting views, if you could make them known. I will
declare by affirmation that this recommendation is accepted. Thank you
all very much. We have worked so hard that we're going to take a
five-minute break. We will presume promptly at 11:00 a.m. Pacific Time.
Thank you.

\[break\]

DR. BRAILER: Let me call your attention to tab five. We will now have a
discussion about privacy and security, and I will turn to Jodi Daniel
and Susan McAndrew from HHS to lead this discussion.

I will say that what is being presented today, is the beginning of a
number of dialogues about privacy and security in the American Health
Information Community. We have been at work, or I should say the Office
of the National Coordinator has been at work, for more than two years,
on efforts to begin assessing and developing solutions, and framing
issues around privacy and security in the digital era of medicine. And
today is a glimpse. We're not asking for any actions. But this will
pre-stage actions to come, and recommendations at subsequent meetings in
2007. And with that, let me thank the panelists, and turn it to Jodi and
Sue.

MS. DANIEL: Thank you very much, David. \[inaudible\] I'm really excited
today to \-- I brought this panel together. I think we're just starting
to really see some exciting results from the privacy and security
solutions work at the state level, where that contract with RTI has
created the health information security and privacy collaboration across
34 states and territories.

The work that we have been doing on privacy and security \[inaudible\]
many different levels. We have been doing some work at a federal level,
as well as at the state and organizational level. And I'm going to try
to spend some time explaining some of the activities that we have been
doing, where they stand, and how we see some of our current activities
feeding some of our future activities in this area, and trying to
develop the policies on privacy and security in the future.

And then \-- but before I do that, I'm going to turn it over to Sue
McAndrew, our Office for Civil Rights, who is going to talk a little bit
about privacy policies from a federal perspective. I'll go through some
of the projects that we're working on in ONC, and then I'm going to turn
it over to Linda Dimitropoulos, who is the project director on the
privacy and security solutions contract. And I'll leave it to her to
introduce the folks we have here from the states, who are very much
engaged in this project, and who have been doing some really hard and
exciting work, and making some real progress at a state level.

So I will turn it over to Sue, and then turn it right back to me.

MS. MCANDREW: Thank you, Jodi. I'm very happy to be here. I am the
deputy director for health information privacy within the Office for
Civil Rights; and I will try to keep my remarks brief, because I know we
are all very interested and excited in hearing from the states where
this work \-- this very hard work is going on.

The road that we are embarking on, the privacy and security of
information in the health world, as Nancy and the other Workgroups that
I have participated on know, it is very critical to this effort. And at
the same time, these privacy and security issues are not easy. And the
policy decisions are very hard and complicated. The balances are very
tricky, and we have worked through them, some of them, in the context of
formulating the HIPAA privacy rule.

And I'm essentially here offering and underscoring my office's
availability to provide our expertise and our experience in creating,
and coming to the balances that we have within the HIPAA privacy rule,
and to say how much I appreciated and was encouraged by what I was
hearing at the national meeting of the states last week in Bethesda, who
have been looking at their own state issues and business practices, in
terms of uniformity, and how much \-- how many times it was repeated
that HIPAA \-- the privacy rule, far from being a barrier to this
effort, really can be seen as a way of facilitating the way forward.
That what it has done is it has created a baseline, a foundation of
uniform practices to build upon.

It is not, by any means, the total solution, but it is a very sound base
that will allow states, and others, to look at and to facilitate, as
they try to address the same issues that we wrestled with, in
promulgating the rule back in 2000; in recognizing what the balances
look like in this new world of electronic health information exchanges
and electronic databases.

We all recognize that these new e-health initiatives represent many new
risks to information, raises consumer concerns about information,
exposure, as well as providing wonderful opportunities to get the
consumer more involved, and give them more opportunities with respect to
controlling their data and having access to their data.

And I just want to underscore the role that the HIPPA privacy rule can
play in setting out, and \-- you know, we are here to make clear where
it is that this common ground has already been found, on many of these
policy area issues, and will allow the focus of the discussions to be on
those areas that are unique to this new electronic initiative and these
electronic exchanges of information.

We are already getting orders from the Consumer Empowerment Workgroup,
and I expect others very soon, in terms of providing some clarifications
about how the privacy rule operates, with respect to personal health
records; and in general, what these \-- what this new \-- how the rules
operate within some of these exchanges.

I will say that there are going to be new players in this environment.
There will be some entities that traditionally, the privacy rule has not
covered, and that's an area where a lot of new initiatives can be had in
terms of this \-- the AHIC, and the others contributing to advance the
privacy coverage.

I would just close by saying that we are really excited about the
capabilities of these networks to improve the way the consumer will be
able to access their information, and to be able to control, and move
their information from one place to another. These are exciting new
opportunities that go probably beyond what we could have dreamt with \--
about \-- back in 2000, when we were giving the individual new lights
with respect to their health information. And the abilities of this
technology to move this forward is just wonderful to contemplate.

And with that, I look forward to hearing from the states, and getting
their feedback in terms of where clarifications need to be made with
respect to the privacy rule today, and where changes need to be made,
what can be built upon the rule, in order to make interoperability a
reality in the future. With that, I'll turn it back to Jodi.

MS. DANIEL: Great. Thanks a lot, Sue. Sue and I have been working
together for many years, and it's really great to be sitting together,
and trying to, once again, figure out how to address some of these
privacy policy issues on a federal level, and really having that
collaboration within the federal government, as well as the
collaboration that we're going to hear about among the states.

Is it possible to have the slides viewable from this end, because there
is some animation I have in mind, and it would be helpful to see that.
I'll continue, but if somebody can work on that, that would be great.
I'm on the slide of technology and policy.

Clearly, I think one of the most important things, whenever we're
talking about privacy and security, is that it is integral to everything
we're doing. It's integral to the policy work we're doing, it's integral
to the technology work we're doing, and it's integral at every level
we're working at, through all of our partnerships at a federal, state,
and organizational level. And it's something that I take very seriously,
and is a very key part of my role, in ONC, to make sure that that
happens.

I very much believe that technology and policy need to be developed in
concert. They are interdependent, and like Mr. Secretary, you were
saying earlier, how these need to be working together. We need to be
working on the technology and the policy at the same time, and trying to
figure out how one feeds the other. I think it's very much consistent
with the work that we're doing. We're trying to move forward on all of
these fronts at the same time.

This really is an iterative process. The policy development is going to
be most effective when it's based on an understanding of the
environment, and how people interact with the technology. And the
technology development is going to be most effective when it is
considered implications on use, implications of the technology, and ways
to incorporate the policies effectively.

So I really see this as an iterative process, where the feedback we're
getting, as we're looking at some of the technology work we're doing,
can help drive the policy discussions. And the policy discussions can
help drive the technology development at the early stages as well. And
we're looking at that balance of how we can make the policy and
technology develop together and in concert.

One of the \-- one example that I always think about when, you know,
folks say, well, we should work on policies and develop the right
policies, is that if you don't think about them in the context of how
they'll be used, you may not necessarily get the result you want.

So everybody knows about passwords that we have. We have dozens of
passwords, and constantly have to change them, and constantly have to
add new characters, and capital letters and things in them. And as
people have to develop new passwords, it seems like these are going to
be more protective of privacy and security, and what happens is, because
users can't remember all their passwords, they end up putting their
passwords on sticky notes on their computer screen, which actually
compromises security more than the \-- than was intended with the policy
to begin with.

So understanding how the policies are implemented, and how they will be
used, and what kind of impact they have on the users, if there will be
work-arounds and things like that, is really critical in developing the
policies. And that's sort of why I think it's so important that these be
thought through together, so as we get feedback on people \-- how people
are really using the policies in the technology, we can modify the
policies and vice versa.

One of the things we're doing now, and Rob Kolodner had mentioned this
in recent meetings, is that we're working on our NHIN trial
implementations. The NHIN development is incremental. This isn't
happening overnight.

We did prototypes, now we're doing trial implementations, and this is
going to be an incremental process. And what we're trying to do is make
sure that as the technology is developing, we're not precluding policy
options because of the technology.

So one of the things we're doing is that we're incorporating some of the
products from the first year, from the \-- from \-- there is some work
from NCHS, a letter on privacy, NHIN, functional requirements, security
models for prototypes, as well as the Confidentiality, Privacy, and
Security Workgroup recommendations, into the NHIN trial implementations.
So as we're getting some policy feedback, we're trying to incorporate
that into this next technology effort.

And what we're trying to do is make sure that the trial implementations
will be required to include consumer capabilities regarding the flow of
health information, so that even though we haven't developed and honed
the policies in that area, we want to make sure that the technology
development is capable of meeting various policies for consumer
capabilities with respect to the flow of health information. And that is
a really important piece of what we're going to be doing with those
trial implementations.

Next slide, please. Just very quickly, I just wanted to highlight some
of the current activities that we have going on. You're going to hear
more about the privacy and security solutions for interoperable health
information exchange, from the other panelists. This is the contract
that formed the health information security and privacy collaboration.

We, just last week, had the national meeting from this contract, and it
is really just an exciting and really productive session. We had folks
from the 34 states and territories that are participating, as well as
many of the states and territories that were not directly participating
in this project, trying to learn from the other states. It was open to
the public, and it was really just a very productive session to get
folks to start talking about how they're seeing the issues, how they're
seeing the solutions, and trying to learn from each other on possible
approaches for addressing some of these issues.

In fact, not only are they coming up with great ideas and actual
solutions, but one of our presenters was unable to be here in person
today, because he is working with the state legislature today on some
privacy legislation that is being proposed, that's a direct result of
those contract work in his state. And we'll hear a little bit more about
that. But there really is some actionable results that are occurring as
a result of this project, and we're really encouraged by that.

There is a lot of momentum, and we want to encourage that to continue.
And we want to see \[inaudible\] looking at providing some additional
funding for implementation of some of these plans at a state level. We
do want to help the states to continue to follow through on the
important work, and the momentum that they have, and more news on that
to come.

A couple of other things, just to highlight, you know, about the
recommendations from the CPS Workgroup that this group has forwarded on
to the Secretary, with NHIN prototype security architectures, which were
developed as part of the last NHIN activity, and, of course, you heard
from CCHIT this morning about security criteria that they had
incorporated, and will continue to modify, and how that's really pushed
some of the vendors to include additional security provisions in their
technology. Next slide, please.

So just \-- I'll just highlight a couple of the planned activities. We
should be getting final deliverables from this contract, and we would be
happy to bring some of these folks back at the end of this contract, to
get some final assessments and analysis of how that project worked, and
some of the findings from this project.

We have the state alliance for e-health. This is a group of state
leaders in the executive, legislative, and judicial branches that are
designed to come up with consensus on policy issues that affect states
across the nation, and trying to come up with some solutions and
approaches that states can use, the various states can use in looking at
the some of the policy issues related to health information technology
and health information exchange.

As part of that, there is one task force focused on privacy and
security. This is the health information protection task force. They met
for the first time in February, so it was a very lively discussion, very
engaged group of folks who are trying to really make some progress in
thinking through privacy and security protections at the state level.
They're trying to get a better sense of some of the state laws that
exist currently, and whether those may be different across states, and
how to address that variability, and will be taking part of the work
from the HITSP project as they move forward. And I'll talk a little more
about that.

As Sue had mentioned, there will hopefully be some impending HIPAA
guidance with regard to PHRs, as a result of the work of the AHIC, so
we're working closely with the Office for Civil Rights and trying to
develop that. And as I had mentioned, the NHIN will be looking at trying
to incorporate consumer capabilities in the trial implementations. Next
slide.

This \-- I'm trying to \-- I wanted to show how some of the work that I
just talked about will feed some of the other work. If you can \-- next,
please? As Sue had mentioned, there are privacy laws that underlie
everything that we're doing. We have the HIPAA laws at the federal
level. There are substance based confidentiality laws at the federal
level, and there are state laws at the state level that underlie
everything that we're doing. And we obviously have to continue to look
at those as we are working on these different projects. Next?

In phase one, I have identified some of the work that we have been doing
at this point, or that we have been hearing about with respect to
privacy and security, and health information technology, and health
information exchange. Next?

And some of the activities that we're hoping to come. I mentioned the
state privacy and security implementations. CCHIT will continue its work
with the state alliance and the like. Next?

I wanted to highlight how some of the activities that we have been doing
in this first phase will feed some of the activities in this next phase.
The solid lines are sort of a direct feed, where we see the work of \--
in one area directly connecting to the work of another activity in phase
two. The dotted lines are where the work in the \-- from that first
project will have \-- provide input or provide some information to the
next process, where there is sort of a communication link. If you can go
back, sorry.

So, for example, the privacy and security solutions contract that you'll
hear about more today, will be feeding the implementations, will be
feeding the state alliance, and will be feeding some federal policy
development.

We have been hearing some questions about how some of the federal laws
interact with the state laws, or confusion about some of the federal
laws, and where we hear some of those, we have an opportunity to come up
with some policies or to provide guidance or clarification. Next,
please?

The NHIN prototypes, again, there were the security models that were
done through that, that can feed some federal policy development. It
will obviously feed the next phase of the NHIN trial implementations,
and will provide some information to some of the other processes that
I've mentioned as well. Next?

CCHIT criteria, as you heard from Mark Leavitt. CCHIT will be continuing
to modify their criteria for ambulatory EHRs. We'll be working on
inpatient EHRs, and we'll be looking at criteria for networks in the
future, so some of the security criteria that they have come up with
will feed the next stage of work as well, and should inform some of the
other actions as well.

The NCVHS recommendations that we've heard on privacy \-- next, please?
The NHIN \-- the NCVHS recommendations that we've heard about privacy at
NHIN will be referred to in the NHIN trial implementations, and will be
incorporated as much as we can into those trial implementations and
should also develop federal policies. And we're really looking at that
in the Confidentiality, Privacy, and Security Workgroup, to help frame
some of the issues that that Workgroup will be taking on as well. Next?

The Confidentiality, Privacy, and Security Workgroup of this group will
be directly feeding the NHIN trial implementations again. Those
identity-proofing recommendations will be incorporated. We'll be driving
federal policy development, and will be used to help feed, for instance,
CCHIT, now that that recommendation was accepted by the AHIC, and some
of the other activities. Next, please.

And what we're hoping is that this \-- once we go through phase two, as
we're moving forward, we want to see the technology and policy sort of
overlapping more and more, as we're starting to develop more shape on
what this nationwide health information network will look like.

We're working on these simultaneously, and we see them sort of
overlapping more and more as we start moving forward. Phase three is not
the end. This is still, as I mentioned, an iterative process. And we
expect that there will constantly be a feedback loop between the
technology development and the policy development, as new capabilities
are available.

And with that, I'm going to turn it to Linda Dimitropoulos, who is our
project director on the Privacy and Security Solutions contract. She
will give some remarks on the \[inaudible\], and some of what she's
hearing about from the state interim assessments. Linda?

MS. DIMITROPOULOS: Thank you, Jodi. Good morning, Mr. Secretary, Dr.
Brailer, members of the Community. I have with me today three
representatives, from three of the states, who are participating in the
contract, who will present some specifics from the work they're doing in
each of their individual states. I have Rex Gantenbein from Wyoming,
William O'Byrne from New Jersey, and James Golden, who is from Minnesota
and will be on the line shortly.

When we provided the last status report in June of '06, the state teams
had just signed their subcontracts and were forming steering committees
and Workgroups. In August and September, the state teams worked on their
assessments of variation, and then in October and November, we held a
series of ten regional meetings where the state teams came together to
share the information that they had each been working on, and it was a
very exciting series of meetings.

In addition to the 34 participating state teams, we also invited
participation from other states, and nine of those took us up on that,
and so we had 43 states participating in those meetings.

In November, January, and February, the states submitted interim
assessments, and there are three interim reports that they produced: an
interim assessment variation, an interim analysis of solutions, and an
interim implementation plan. These interim reports really just provide
us with a status update, a snapshot of where they're going, and their
final reports are due later this spring, actually later this month.

As Jodi mentioned, we had a \-- sorry. We held the national meeting last
week, and it was very successful. We had over 300 participants. About
half of those were from the state subcontract teams. We had nine
additional states which joined us, and as Jodi mentioned, those meetings
were open to the public. We had a lot of interaction, not only between
the states, but between the states and various experts and members of
the public. It was a very dynamic and productive day-and-a-half session,
and I believe the rest of the panelists will talk to you a little more
about some of the specifics that were discussed at that meeting.

What I'd like to do is just give a brief overview of some of the high
level sources of variation that the states have identified, and to no
one's surprise, stakeholders, in different states and businesses, apply
the HIPAA rules differently, creating a wide variety of organization
level business practices across the nation.

Some of the variation is due to the flexibility built into the rules,
and some is due to misunderstanding of how and when the rules apply. In
addition, some of the variation is caused by the use of differing terms
in the different regulations, so all of the state teams wrestling with
how to define adequate and meaningful patient consent. Many states have
state laws that require patient consent, and even where there is no
state law, most \-- many, if not most organizations, require patient
consent anyway.

There is a broad variation amongst stakeholders as to what is required
legally, what is appropriate for risk management purposes, what
constitutes the best public policy, and what is feasible from an
implication perspective.

Another source of variation related to HIPAA is the term "minimum
necessary." The HIPAA privacy rule states that a covered entity must
make reasonable efforts to limit \-- limit protected health information
to the minimum necessary to accomplish the intended purpose of the use
disclosure or request. HIPAA requires that uses and disclosures of PHI,
for anything other than treatment, be subjected to minimum necessary use
review, so that no more than the minimum necessary amount of information
is used or disclosed in each situation.

One of the issues surrounding minimum necessary is the widespread belief
that it applies to disclosures to providers for treatment purposes, even
though the HIPAA privacy rule explicitly exempts a specific purpose from
the minimum necessary requirement. Many business practices documented by
the states show that minimum necessary was applied to such disclosures,
even in emergency related transfers of records, creating inappropriate
barriers to otherwise necessary health information exchange.

A second set of issues, related to minimum necessary, is the
inconsistent application in all other non-treatment related disclosures.
A third set of issues is related to burden. Some of the states reported
that the federal requirement to limit the exchange of health information
to the minimum necessary standard increases the time required for the
exchange, and affects the ability to receive comprehensive records.

Furthermore, the reports indicated that in many cases, the existing
technology cannot limit disclosures to the minimum necessary, so
processes that could be electronic must be manual. The recommendations
that use paper records, that requires sifting through records to make
sure that the minimum necessary is exchanged, which is also time
consuming and prone to error.

In terms of security, stakeholders expressed a lack of knowledge and
significant concern related to the technologies available to protect
privacy and security, as well as the associated administrative processes
and liabilities.

The approaches that organizations take to compliance become even more
variable when you layer in federal regulations that afford special
protections for certain types of health information, such as that
associated with substance abuse, or mental health treatment. The
increased variation here was most frequently reported as a
misunderstanding of which rules apply and under what conditions.

There is clearly a variation and understanding of 42 CFR Part 2 by
treatment facilities, physicians and integrated delivery systems, and
there is also variation in the way that stakeholders understand the
relation of 42 CFR Part 2 to HIPAA, and how each is applied.

Additionally, there is a great deal of variation related to the state
privacy laws, and part of this is due to the fact that many state
privacy laws are fragmented, scattered through many chapters of law, and
when states identify them, they're often in conflict with each other.

Many of the states do have additional privacy laws and they also found
that many of them predate HIPAA, so they are antiquated and they don't
apply sensibly to electronic information exchange, because they were
developed for paper based information flows.

Trust, of course, is an overarching issue, and mistrust between
organizations is created by variation. There is clearly a need to
develop trust. The state teams reported that the lack of a common
method, for example, for authenticating individuals creates mistrust
between organizations, and reduces their comfort level with other
organizations, standards, or policies regarding who may authorize access
to PHI.

Consumers, on the other hand, are primarily wary of the system,
providers are primarily wary of liability issues, at least in the review
we've done so far.

A number of states have reported that concern about liability for
incidental or inappropriate disclosures causes many stakeholder
organizations to take a conservative approach to developing practice and
policy which then creates a mistrust of what the other organizations are
doing.

A number of the state teams, including Minnesota, reported that their
state's patient consent requirements placed responsibility and liability
for the appropriate release of patients' health information on the
healthcare provider releasing the information, and Jim Golden will talk
more about that later today, so I won't need to do that here.

Stakeholders are concerned about policies that will govern rights to
access control and management of health information whenever data
exchange occurs. A key question is whether and for how much access
patients should have to their health information. The state teams have
raised the issue of the tension between healthcare providers, hospitals,
and patients concerning who controls the data.

We are, right now, in the process of reviewing and creating a summary
analysis of the interim analysis of solutions reports that the state
provided to RTI. The process is that each state develops the report, and
then we synthesize all the information, create a summary overlay.

Right now, we are in the process of summarizing some 7,000 pages of
analysis and information from the states. But it looks like there are
four \-- clearly four major categories of solutions being pushed
forward, those that fall clearly in practice and \[inaudible\], those
that fall into legal and regulatory issues, technology and data
standards, and education and outreach is huge.

The states are also pushing out multi-state recommendations for
solutions, as well as some that will have national level
recommendations. We'll know more about that as we get to the nationwide
summary, which is due in June.

The implementation plans are clearly the expectations that these will be
actionable, and that the states will discuss the governance in
leadership. It will require realignment of their teams. They'll need to
discuss their resources required, and make recommendations, and develop
timelines.

And so with that, I would just like to say that again, the nationwide
summary is due by the end of June, and we would gladly come back and
talk about all of this at the end. But this project has catalyzed
discussions of privacy and security issues nationwide, and clearly, that
was one of the goals of the project. And I believe that we have achieved
that.

So without further ado, I'd like to turn this over to Rex Gantenbein to
talk about Wyoming.

MR. GANTENBEIN: Thank you, Linda. It's a real pleasure for me to be here
today. I want to thank Mr. Secretary, Dr. Brailer, and the rest of the
Community for allowing me to speak here. I also want to thank RTI and
the National Governors Association, and the NHIQ for the opportunity to
participate in this whole privacy and security project.

As a computer scientist, I have long been interested in privacy and
security from the technical point of view. To let you know how long it
is, we're here at the Computer History Museum. As I walked into the
meeting room, there was one of my textbooks from grad school, as a
historical artifact. \[laughter\] A little bit dismaying, but
nonetheless.

In Wyoming, we followed the basic process that RTI laid out for
developing our variations and solutions. Individual conversation is very
important. We are a very small state in terms of population, and so we
had to go to individuals much more so than large groups. And we worked
with our stakeholders from a variety of backgrounds, in order to develop
our variations reporting, and our implementation plans. We have a big
symposium planned later this month to vet those implementations plans.
We're going to get input from not just our stakeholders, but a wide
variety of public individuals. We're very much looking forward to that.

What we found was actually fairly typical of most of the other states,
as we found out at the national meeting. One of the big issues was, no
surprise, the inconsistent and incorrect interpretation of HIPAA.

Part of our problem, of course, is that in a very low population state,
we have many small providers, many small hospitals, and most of them,
the smaller ones, don't have the resources to interpret this law or the
policies, and therefore, we end up with a lot of conservative practices
for fear of legal reprisal or other issues that simply say, "I'm sorry,
HIPAA won't let us do that," without actually knowing what the results
are.

One example, some of our stakeholders told us that in some communities,
law enforcement officials, who suspect someone who has been involved in
an accident has been admitted to the hospital. If they suspect this
person has been driving under the influence, it requires a court order
for them to get a blood test on this person, once they have been
admitted to the hospital. The hospital will not release that information
or allow them to draw blood, once they have been admitted. This
obviously makes it very difficult to process cases against someone who
is suspected of causing injury or otherwise, causing problems after DUI.

We also have a very low level of technical knowledge, with respect to
electronic health information infrastructure in general. There are
health records that do exist in some facilities, but there is no
discussion at all going on about interoperability, at least not until
this program began.

Many providers and consumers are not in favor of the issues of
electronic health record adoption, simply because they're worried about
security privacy, as well as the cost and the complexity. One
interesting thing that we discovered was that most of our providers are
very much against the idea of a centralized or mandated system. They
prefer to develop their own systems, or to purchase their own systems,
and interoperability will come somewhere else down the line.

So one of the things we're working against is this ability to say,
"Well, sure, we'd like to have standards," but the standards are going
to have to be something that are going to have to apply to many
different systems.

We also have some legal issues, not many. We are not like some states
where we have a huge amount of legal discussion of privacy, but there
are some. But many of them are outdated based on paper records, existing
old privacy laws, apply really only to inpatient facilities. Our state
legislature recently passed a credit freeze law that protects financial
information, but this law does not directly address health information.

Now, what are we proposing to do about this? Well, there are three
things that we have recommended so far in our implementation plan. With
respect to HIPAA and other policy issues like that, we would like to
establish a regional policy coordinating center for health information
exchange for our state. Again, this would provide a resource for those
facilities or those providers and consumers who do not have access to
employers, and technologists, and things of that nature.

That would help, for our state, to analyze and clarify and communicate
legal and technical issues. It doesn't take anyone who's \-- just being
in this room to know there is a lot going on in this area, and one of
the things we would like to do is be able to disseminate the kind of
information that's happening here, and provide education and training
for the people in our state with respect to HIPAA and the other laws
that are being considered.

To deal with the lack of infrastructure, we would like very much to be
involved with a health information pilot project. Obviously, with our
lack of support for a centralized system, this really has to be
interoperable, and it has to work among disbursed systems. The main goal
of this, of course, is to demonstrate the benefits and the
trustworthiness of health information exchange, to both our citizens and
to our providers.

And finally, we're looking at some of the state statutes. We want to
generate changes in the state law that would extend protection for
notification laws to health information specifically. We want to be able
to go over our state statutes to ensure that they are harmonious with
HIPAA and the other laws, and with each other, which at this point they
are not. And we want to be able to look at other specific needs, such as
high risk, juveniles.

This was brought up to us by one of our specific stakeholders, who said
that people who take children into foster care are not allowed to get
access to their health records because of HIPAA and other things. The
problem being, of course, that many of these high-risk kids are HIV
positive, have mental issues, may have other questions like that. And no
one is allowed to tell their foster parents what they're doing. And
that's very, very difficult for all concerned.

I'm told I want to keep this moving, so I'm just going to basically show
that these are some of the implementation plans for each of these
discussions. These are very incremental steps. This will get us off the
ground.

We want to be able to, from the standpoint of our coordinating center,
use our health information organization, which is also the steering
committee for our project, to facilitate this establishment, put
together an advisory board, and try to find a business plan that will
let us get funding for this, that will eventually allow this
organization to be a good advocate for HIT, for the private security
issues as well, and support research and education in the state.

Our pilot project, we would like to be able to participate or develop a
network design, and a basic application area that would allow us to put
together some system that would allow our providers and consumers to see
what this is like. With the lack of any kind of infrastructure in the
state for it, we really feel we need to be able to demonstrate its value
and demonstrate that it can be trusted.

We've tried a couple times, in the past, to get this funded through our
state legislature. The bill in this year's legislature died in the
committee that would advocate money for a pilot project. It's the second
time we've tried, the second time we've failed. We're still working on
it.

And our state statutes, again, we want to be able to work through our
legislatures to be able to harmonize these laws, update our hospital
records and information act, our public records act, to address their
inconsistencies, both with HIPAA and each other, and we would like to be
able to create a health information exchange act, which I believe North
Carolina has, as one example, that defines specifically who is allowed
to share information about high risk juveniles or other people who are
affecting public health and public safety.

And with that, I'll turn it over to Bill O'Byrne.

MR. O'BYRNE: Thank you. Mr. Secretary, Dr. Brailer, members of the
Community, it's a pleasure to be here today. I'd like to tell you a
little bit about what's going on in New Jersey, and how it may integrate
with what the national landscape is.

In New Jersey, we have our own health information technology law which
is called HINT, H-I-N-T, for short, and it has allowed us to incorporate
into our payer community, or rather our community of stakeholders, a
very wide range of stakeholders. That has included the traditional
healthcare payers, but also includes our Medicaid office, for the
payment of claims in New Jersey, the automobile personal injury
protection insurers, the workman's compensation insurers, the state
veteran facilities, inmates, and committed patient facilities. All of
these we are trying to incorporate into our process.

This law allows us to adopt rules and regulations not only for
electronic health records, but also for health information technology,
and gives my department, banking and insurance, authority over the
payment of claims, specifically those claims which are paid by
state-based medical claim payers.

We also have authority over third party billers that do a great deal of
the assembly of bills for providers, and third party administrators that
are involved in the payment of claims.

Frankly, we have a great deal of authority over a lot of the players on
the state level, and this gives us a great, I believe, tactical and
strategic advantage to play an active role in the development of
electronic health records in New Jersey. We intend to use this authority
and power that we have in consort with what happens on a national level.
We will never and have never adopted anything that is not consistent
with the standards and formulas that are adopted in the federal level,
so that we look at ourselves as more facilitators in a local level of
what you all develop here in a national scale.

Frankly, also, I could tell you that we intend to pass the development
and implementation costs, which are significant. We intend to pass those
costs on to all of those who will share in the efficiencies and the
savings that will be realized from the deployment of these systems.
Thus, we have brought in the PIP insurers, the workman's comp insurers,
and all of those other traditional medical encounters that we all have,
which are not really on the table at this point.

Absent in one of the issues that we have been struggling with is the \--
is patient identification. This comes up over and over again, in terms
of privacy and security. How do you authenticate that the patient and
the person that you're dealing with, in fact, the right person?

Absent a federal master patient index, New Jersey will construct its own
MPI, or if possible, we will join with other willing states to form a
regional MPI. This MPI will be a unique identifier, which will permit
access to and from patients' electronic health records. There will be
crosswalks to all of the traditional identifiers. The goal will be to
reliably link a patient to their health information.

I should also tell you that last week, at the national HISPC meeting, I
had the good fortune of meeting with my associates and colleagues from
New York State, and at that meeting, we were able to form the basis for
an agreement, between New York and New Jersey, to handle the master
patient index between New York and New Jersey. We have millions of
people that go back and forth.

My next goal will be to tap into Pennsylvania, because that's the part
of New Jersey that I live in. But I'd like to think that we, in the
state level, can \-- if you give us a chance, come together to form some
of these partnerships.

One that I'm very interested in is this one dealing with master patient
index, which is fundamental to privacy and security. We are also looking
at bar coding and electronic strips on healthcare identification cards,
since my department can control what these cards look like.

One thing that I've always noticed is that these cards, they have the
information down, but it still requires someone in the provider's office
to transcribe what's there, and key it in. Why not have it on a bar
code, or an electronic strip, and eliminate all that misdirected and
misrecorded information when it goes on an 837 claim.

The idea here is to increase reliability and verification of detail at
the absolute lowest level. And I think that's where states can play a
meaningful role for these projects.

We are also involved in the legal policy issues. One thing that becomes
a problem is moving records from state to state. Privacy and security
application is normally different from state to state, and we encounter
problems when we go across state lines, when we are looking for medical
care in another state.

The idea here is to try to regionalize some of the agreements that may
exist, so that what I sign in New Jersey will be recognized and valid in
Pennsylvania or in New York. Very fundamental issues, but very
significant, dealing with privacy and security, and how we can make
things work better.

I should also tell you that parenthetically, a lot of these issues have
come up in these national \-- in the national meeting we had last week,
and I must tell you, it supplied me, and a lot of others, with the
ability to resolve a lot of significant questions that were on our mind.
We found that the other states had many of the same problems that I
have, and that we are able to come up with mutually acceptable solutions
to common problems. And it was invaluable.

I should tell you also that in New Jersey, we intend to create, I
believe, some kind of a federated model. I'm not going to call it a
RHIO, but I'll call it some kind of a public service type entity that
will be the custodian, and the gateway for access to electronic health
records.

It will be akin to a credit reporting agency that will hold access to
highly private medical information with extreme privacy and security
protections. When a claim for payment, for a medical test is submitted,
access to the medical test will be ceded to this public entity custodian
in the nature of a RHIO.

We will also establish a special web portal for ordering medical tests,
that will be constructed in such a way as to prompt the ordering
physician to use existing electronic test results, if still valid,
rather than ordering a duplicate or unnecessary test. This will not only
save money, but will also give the provider immediate access to critical
data when he needs it, or she needs it. Of course, if necessary, because
of medical circumstances, the provider could elect to order a whole new
test, if appropriate, according to the provider's judgment.

Much like a credit reporting agency, payers, providers, and others would
pay a subscription rate, based on the volume of usage, thus, the
public-entity RHIO, would be self-sufficient and self-sustaining.

Also \-- I would also give, much the same as a credit reporting agency
and entity, patients would have access to see and view their records.
They would have some control over the more sensitive aspects of their
records, and model it much the same as the bill of rights that people
have in their credit reports.

The idea here is to engage the citizens in a process that they can live
with. I believe that if we develop along these lines, that we're going
to model in New Jersey, we will come up with a protected health
information system that will endure and thrive. Thank you.

FEMALE SPEAKER: Is Jim Golden on the phone?

MALE SPEAKER: Is Jim Golden on the phone?

MR. GOLDEN: I am, thank you. Mr. Secretary, Dr. Brailer, can you hear
me? Mr. Secretary?

SECRETARY LEAVITT: Yes.

MR. GOLDEN: You can hear me?

SECRETARY LEAVITT: Yes, we can hear you.

MR. GOLDEN: Perfect. Well, Mr. Secretary, Dr. Brailer, thank you for the
opportunity to speak with you and the Community today. I apologize that
I'm not able to be there in person, however, we have legislation that is
actually coming directly out of our HISPC project in front of one of our
committees at the Minnesota legislature today, so I needed to be here
for that.

But what I wanted to talk about, related to our project, is that when
Minnesota began examining the privacy barriers to the electronic
exchange of health information, we really identified two issues as the
most significant and pressing issues that needed attention.

And those two issues were incorporating Minnesota's patient consent
requirements into the electronic exchange of information, and then the
second was developing security measures around authorizing and
authenticating individuals that access information, setting appropriate
access controls for those individuals, and then auditing those
individuals access to data. What I'll be talking about today is really
the first of those issues around patient consent. Next slide, please.

In talking about patient consent as a barrier, I think it's important to
note that we're not discussing whether or not to have patient consent
for the disclosure of information, but really, in Minnesota, we're
talking about how to make those consent requirements integrated into
whatever electronic exchange is developed here in the state. And to help
people understand why patient consent is such a significant issue in
Minnesota, it's helpful to just provide a brief overview of Minnesota's
patient consent requirements for the disclosure of health information.

Generally speaking in Minnesota, we require patient consent for the
disclosure of any health information for any purpose, including for
treatment purposes. Those consents need to be written and generally
expire within one year.

We do have a few exceptions for things such as a medical emergency, or
for things like \-- within the related healthcare entity, which would be
a large integrated system, and then we have a couple of special consents
that don't expire, for example, consents for disclosures to other
providers when they're being consulted, or to payers for payment.

Next slide, please. Minnesota enforces these patient consent
requirements through two primary mechanisms. First, providers who fail
to comply with the patient consent requirements can be subject to
disciplinary action by their licensing board or licensing agency. And
unlike HIPAA, Minnesota has a private right of action that allows
patients to sue for compensatory damages, costs, and attorney fees, when
their information has been negligently or intentionally released in
violation of our patient consent statutes.

The two things to note about these enforcement mechanisms is that the
current statute places all of the liability associated with these
inappropriate disclosure on the disclosing provider, and because of
that, whenever providers have liability concerns associated with the
inappropriate disclosure, they're very cautious in releasing any
information, and making sure that they comply with the requirements.

Next slide, please. Given this broad overview of our requirements, one
of the questions might be, well, how do patient consent \-- how does
this cause barriers for the exchange of health information? Well, what
our analysis has showed is that generally speaking, the patient \-- I'm
sorry, the healthcare providers don't agree on the when, or how patient
consent is required to exchange health information. And consequently, it
is very difficult to make that into an automated, real-time electronic
system.

Second, Minnesota has had its patient consent requirements for over 25
years, and many of these requirements were designed at a time when paper
was the standard, and were really designed for paper-based exchanges,
and they don't really help to facilitate real-time automated exchanges.

Next slide, please. As we looked into this deeper, we really found that
there were probably three causes for the variation in interpretation
with the patient consent. First, in our state statutes, we had a number
of undefined terms and ambiguous concepts that we are asking providers
to interpret and apply.

Second, we found that there are some new concepts to electronic records
that just don't have any kind of counterpart in a paper-based exchange.
A good example of this would be a record locator service that would be
used to help identify where patients' records might be located within a
health information exchange.

And then finally, because many of these laws were really written so long
ago, we really needed to take another examination of them and see if
there might be ways to update the requirements to fit more within the
electronic environment that we see today.

Next slide, please. As we worked through some of these solutions, we
found, I think, what many states found. We had privacy advocates who had
particular concerns, and we had healthcare providers and other members
of the industry who had some different concerns. What we tried to do was
identify various options for addressing the problems that we had
identified, and then identifying the pros and cons of all of those
options.

We couldn't reach consensus across all of the various stakeholders, so
as the department of health, what we did was we developed some criteria
for evaluating the solutions that they identified.

First on that was making sure that we maintained or strengthened the
patient's privacy and control over their records, then improved patient
care, and facilitated the exchange, all without putting an undue burden
on the industry.

Next slide, please. The next couple of slides really just kind of give
you a flavor of some of the types of things that we are currently
proposing to address legislatively, and as I say, we're doing that
actually even today. We're defining some of those terms such as health
record, medical emergency, current treatment. We're adding the concept
of a record locator service, how that record locator service can be
used, how consent requirements might apply to that.

Next slide. We're updating the mechanisms that facilitate exchange.
These would include the ability to collect the consent at the requesting
provider, and not require the consent to be collected solely at the
disclosing provider. We're modifying our framework for allocating
liability between the disclosing and requesting provider when there is
an inappropriate disclosure of information. And we think that these
changes will really help to facilitate the exchange within the system.

And the final thing we're doing is we're recodifying our statutes to
actually make them easier, both for patients to understand their rights,
as well as for healthcare providers to understand their
responsibilities.

I know that we're a little short on time, so I won't talk about the next
two slides, but I think that this project has been very good, and has
really given us a chance to examine our patient consent requirements,
and look at how we might be able to adapt those, and fit a little bit
better in the electronic world that we are facing today.

Thank you for your time.

DR. BRAILER: Thank you. And thank you, Linda, Jodi, and Sue, and the
other panelists, Rex and Bill. You can see this is a very broad and
complex area that has many stakeholders, and many levels of precedent
established in state and federal areas. I think you can see why this is
not only a project that's been very long in fruition, but was, in fact,
I think the single largest contract issued by ONC in the past couple of
years. We have to evaluate this on the foundation that it needs.

Discussions and further recommendations will continue throughout 2007 at
the Community, but at this point, I want to turn it to any brief
comments, or questions, or directions that would like to be issued from
any members of the Community.

SECRETARY LEAVITT: I'd just like to ask one question. I recognize we
don't have a lot of time. I'm going to try to summarize this. To what
extent is there an urgency among the state to get \-- to begin to
harmonize this, and \-- number one. Number two, you had this meeting
last week. Is that going to become a center of gravity to do it, and if
not, where will it be?

MS. DIMITROPOULOS: I think, if I can speak to that, and maybe the rest
of the panel has a comment, but that I think that the energy and the
urgency around this has been demonstrated clearly by the states.

Jumping into this, it was an aggressive schedule to begin with. And for
the states to pull together the range of stakeholders that they were
able to muster, very much of the work is done on volunteer time, on cost
sharing, people not billing for their hours because the issue is so
important to them.

So the states are moving forward at an incredible pace. I think the
national meeting went a long way to catalyzing this. There is a
recognition that they share common problems, and each of the states may
be at a different point in the process, so, you know, while, you know,
New Hampshire and New Jersey are working on one area, New Mexico and
Arizona may be working on a different issue. And as it all raises up,
you'll see, it will patch work together a really comprehensive picture
of what is needed nationwide.

SECRETARY LEAVITT: This is the natural progression, I think, again, it
has to go through. There has got to be some collection of where are we,
let's all get together and talk about it. And then the next step is
somebody has got to take charge of beginning to drive an agenda of
harmonization.

Did anything like that come out of the meeting? I think I'm looking to
see, now that we're beginning to assemble the information and we know
where we are, and have everybody's attention, what's the governance
process to drive this forward?

MS. DANIEL: If I can jump in here \--

MR. O'BYRNE: I think a lot of the states have to come up with their own
governance issues. Unfortunately \--

SECRETARY LEAVITT: Within the states, you mean \--

MR. O'BYRNE: I do believe. I believe that probably is true. I know in
New Jersey, I can assemble a lot of different players in the arena, but
that's not the same as it is in other states. They tend to rely on their
department of health, and not the department of banking and insurance,
so you don't always have the same players at the table, and the mix of
governance probably will have to change in each state. That doesn't mean
that the information that moves back and forth has to be different.

SECRETARY LEAVITT: I fully acknowledge what you're saying is true, every
state will be different.

MR. O'BYRNE: Yes.

SECRETARY LEAVITT: Somehow we've got to connect this up to a broader
driver. There has got to be \-- you got to have a central coordination
and local control. What I hear you saying is we've got to have a local
control, and I completely concur with that. Somehow we've got to figure
out a way to begin driving the agenda among the states.

Jodi, do you have a comment?

MS. DANIEL: Yes, I do. Thank you. I just wanted to say a couple of
things. I think that the states are moving forward, as Bill had
mentioned, and I think that's a good thing. There are two different ways
\--

SECRETARY LEAVITT: Jodi, hold on a second.

MS. DANIEL: Oh.

DR. BRAILER: Go ahead.

MS. DANIEL: Can you hear me? There are two different approaches that
we're taking beyond what the states are doing in driving their own
implementation plans forward, that we're hoping will facilitate this
coordination across the states.

First, the state alliance for e-health that is being \-- that's been set
up by the National Governor's Association, does have this one task force
called the Health Information Protection Task Force. They are looking at
these cost cutting state privacy and security issues, and will take some
of the inputs from this process to try to think across the states how
best to harmonize state laws, if that's appropriate, to come up with
approaches that states should look at, so that they're acting in a
coordinated way and the like.

The second thing I had mentioned, that we were going to be looking at
opportunities for funding some of the implementation plans, and one of
the things that we're looking at is how \-- trying to \-- trying to
promote those implementation strategies that provide coordinated efforts
across states and regions. So that while there is a lot of important
work going on state by state, we want to promote that collaboration
across the states, as they're looking at implementing some of these
solutions, and we hope to do that in the next phases of our work in this
area.

So those are two things that we're doing at our level. And I do think
that there are some states that have reached out to each other to try to
start having those dialogues and coordination, and I think the national
meeting that we've just had, that went off so well, I think really
spurred the desires for states to do that more and more.

So we're trying to promote that from our end, and would encourage the
states to try to look for opportunities to collaborate as well, when
they're looking at their implementation plans and solutions.

SECRETARY LEAVITT: I recognize we're out of time. The work you've done
is extraordinary, and obviously a lot of thinking going on in each
state. And I would just summarize my own views that we now need to begin
to think through how we can put this into a coordinated agenda that
somebody wakes up every morning thinking about.

DR. BRAILER: Any other comments from members of the Community? Okay.
Thank you all very much for the great presentation and for the very hard
work to date.

We will now turn to tab six, which is the employer panel where we will
have Andrew Croshaw, who leads this up for the Secretary moderated
discussion. Because we are running behind, we've asked the presenters to
make note of their presentations that are on the web and available to
you, and to make only oral comments today. So with that, I will turn it
to Andrew Croshaw.

MR. CROSHAW: Yes. Pleased to be with you. It's not fair to you, really,
to try and handle this in the amount of time that we have, but we'll do
our best to deliver results with urgency and accuracy, since that's what
value driven healthcare is all about. We have about a few minutes. The
Secretary will need to be leaving at 12:30, and if the Chair would like
to extend this a moment beyond, then we'll leave that to his discretion.

Let me just briefly say that the movement that is under way, to bring
value to healthcare, transcends greatly upon the work that you all are
doing. What we had hoped to accomplish, in the next few minutes, is just
to share with you how the four cornerstones of value driven healthcare
are being dealt with, are being handled, are being moved forward through
the payer community.

There is a clear and definite role for employers to play, along with the
other stakeholders in healthcare. And so with that brief background, let
me start with Peter Lee, and then we'll move to Jeff and Chris, and then
to Kevin, as soon as he joins us. Peter.

MR. LEE: Thank you very much, Andrew, and thank you, David, the
Committee, and Mr. Secretary. I'm not going to go through all the slides
and Power Points, which will be available to everyone tonight or
tomorrow, but I'd like to highlight a couple things, which is that
employers and purchasers have been out there for many years, seeking to
promote value. And what we're interested in doing, is both doing that
collectively, as well as individual employers.

And you're going to hear, after me, from three leading employers and how
they, on the ground, are seeking to promote value. The Pacific Business
Group on Health, is a collective of large employers anchored here in
California, but national as well as locally here.

And I'm just going to give you examples of each of the four
cornerstones, some of the ways that both collectively employers are
taking action as well individually. I'm going to walk through the four
cornerstones, ending with IT, a nice place to end, given the agenda of
this Community.

One of the first cornerstones is called quality transparency, and
collectively, employers have been driving to create standards, and using
standards, national quality forum standards, Hospital Quality Alliance
and AQA standards for measurement. But it's not just enough for
measures. It's getting those measures into consumers' hands. And so
large employers are \[inaudible\] on their health plans to provide their
enrollers with tools to make better choices.

Today, every national health plan has hospital chooser tools. None of
them did five years ago. That's because employers are demanding that of
their plans. Transparency, without it being a national tool
\[inaudible\], so quality and transparency need to be translated into
tools.

The second cornerstone is price transparency. Consumers, like employers,
care about quality, but they also care about what it's going to cost
them. And bringing quality together \-- and Dr. Gerberding made this
point earlier about value. It's a value equation that brings together
information about quality with price and cost. And many of the PBGH
members have started this effort by looking at plan chooser tools. And
it's getting information to consumers, based on their health status,
what their healthcare is going to cost them over the next year,
including out of pocket, marrying that with quality information, and
they're using those tools.

An example is Wells Fargo. One of our members uses the plan chooser tool
that has about 60 percent of their enrollees every year, uses this tool
to relook at which plan they're going to choose. And they're using that
based on what their financial exposure is going to be, but also then
what the quality is of the plans they're going to choose. We need those
same tools at the physician level, at the hospital level. That's what
we're driving to.

Third area of the cornerstone is incentives for better performance, and
employers are looking at benefit design to encourage consumers to make
better choices, but also looking at incentives for the providers. Having
high performance networks that have, in those networks, physicians,
medical groups, hospitals that perform better, reward them
differentially. A key element is rewarding both sides, the provider and
the consumer.

And finally, promoting health IT. A clearly \-- of great interest of
this group, and the example that I've highlighted is a California
project of the Integrated Healthcare Association, which is a pay for
performance initiative that is a multi-stakeholder collaborative.

The purchasers have been key drivers in that initiative, through that
initiative. Over the last three years, hundreds of millions, literally
hundreds of millions of dollars have been paid out on performance-based
basis, using common measures, some non-common measures. But in the last
three years, I just want to highlight this, close to \$500 million were
paid out on the basis of performance. A third of that on common
measures. Of those common measures, 20 percent of what IHA seeks to
reward is IT.

So we have medical groups in California that are getting rewarded for
data integration for population management, electronic clinical decision
support, care management tools. Changing the payment system to reward IT
is what it's going to take to actually get ramped up more quickly.

So I'm thrilled to be here. We embrace the four cornerstones. I think
you'll see some examples of individual purchasers and how they're doing
that following me. Thank you very much.

MR. CROSHAW: That, by the way, is a record for any presentation ever
given by Peter Lee.

\[laughter\]

MR. LEE: Seeking efficiency, Andrew. Thank you.

MR. CROSHAW: Let's move now to Jeff from Cisco.

MR. RIDEOUT: Good morning. I would like to add to what Peter said about
the four cornerstones. Cisco has over 20,000 employees in the Silicon
Valley alone, and it gives us some very unique opportunities to work
with peers, and local medical groups and hospitals.

Our employee base is very young, 38. We're actually getting younger,
because we're hiring people that are younger, and we actually don't have
a huge burden of disease, and we're not trying to do cost shifting to
our employees. So that gives us some very unique challenges and
opportunities.

And I would also say, like many young physicians and other clinicians,
our employees expect everything to be available on the web through
Internet tools, and they do not want to use paper. So we have tried to
promote, through our health benefits activities, an environment that
meets their expectations that they have every day when they walk into
work.

A few things that I'd say, over half of our costs for our employees, in
terms of their health and wellness, is with presenteeism. And for those
of you who don't know that term, that is work that they are not able to
do, while they're at the work site, because they are suffering under
some disability related to a typically health or medical condition.

Only a third of our spend is actually on medical care, so that puts us
in a very unique position, to try to say, how do we stay in front and
get in front of health issues that our employees are experiencing? And
it's really about modifying their health conditions so that we don't
experience some of the rampant cost increases in the future years.

I'm going to mention a couple of programs that highlight what Peter
said. The IHA program is a health IT, in part, driven, pay for
performance program. We took that concept and said, could we take some
leading medical groups, and a couple of employers in the area, and drive
an advancement in a program for an earlier adoption of health IT and
more advanced adoption of health IT, in literally a year-and-a-half.
Intel, Oracle and Cisco, and seven medical groups including; Kaiser,
Stanford, Palo Alto, Camino, San Jose Medical Groups, SKIPA, and \-- I
want to make sure I don't forget anybody, and Santa Cruz.

We have now doubled the number of physicians that are qualified under
NCQA's Physician Practice Connections Program to over 1800 to our
program alone. We have now A Bridge to Excellence Program. We will award
close to a million dollars in additional awards. We will allow these
groups to prequalify for the IHA programs, so that they don't have to go
through a second review. So we're trying to coordinate with that.

And I think some of the things I'm most proud about, within this very
small program; 57 percent of the program participants have added newer
reminder systems to patients, 43 percent have added same day
appointments. This is all what they're telling us they're doing. 28
percent have accelerated their adoption of electronic health records,
disease registries, 14 percent have added secure messaging and post
visit follow up, something near and dear to my heart. And 14 percent are
now doing tracking of referrals and progress toward EHR adoption that
they weren't doing before this very small program was added.

Another area, secure messaging. We're working with a number of medical
groups, and we now have shown, once again, a five-point return on
investment for secure messaging adoption. And Cisco is paying for that
by either supporting subscription services or paying for web visits.

And I think finally, the last thing I'll mention is because we think
this is so important, we are now in the final design phases of putting
in a state of the art health and wellness clinic on site at Cisco
campus, so that we can actually now become an additional provider of
care for those things that our employees need, traveling immunizations,
PT, and it will be paired with our state of the art fitness center. So
again, an employee retention tool, but also a way that we can actually
do much of this ourselves.

The last comment I'd make is I think one of the biggest challenges on
the four cornerstones, is what can we do, ourselves, or with a limited
number of employers, versus what do we need, and should do with larger
collaboratives? And that's the challenge for us.

SECRETARY LEAVITT: Jeffrey, can I \-- I'm intrigued by \-- you
apparently went out and contracted with various medical providers to
give access to your employees through e-mail?

MR. RIDEOUT: The program that we have done \-- it has a couple facets.
Several of the medical groups in this area, including Palo Alto and
Camino and others \-- and Kaiser, I should mention, have adopted an
electronic health system that has an ability to do online transactions
and services, and what we're doing is we're promoting that through our
employees.

SECRETARY LEAVITT: Do you compensate them in some way for that or how do
you deal with the billing components?

MR. RIDEOUT: Three business models, which really drive to how the system
is organized. For the Kaiser system, that's part of their per member per
month, and Kaiser very proactively provides that as a service, as part
of their service.

For other groups, it's a subscription fee that they would charge to the
patient directly, and we are covering that cost when they're an employee
of Cisco. And then still others, through different systems, we're
actually paying for qualified web visits as a \-- an EM code that uses a
special CPT code that's for web visits. So it really depends on the
business model in place. And that's part of the challenge, is that
everybody is doing it a little bit differently. Thank you.

MR. CROSHAW: Great. Thank you very much. Why don't we move to Chris
Nohrden from IBM?

MR. NOHRDEN: Thank you. Thank you, Mr. Secretary, Dr. Brailer. Very
happy to be able to speak to you about some of the exciting things that
IBM has been doing in the whole arena of value-driven healthcare for the
past several years. And a number of them really resonate with what both
Peter and Jeff have already talked to you about. It really is all about
engaging employees in the dialogue, getting them to understand how
they're spending their healthcare dollars, since they're really spending
IBM's dollars as a self-insured company.

We have been involved in three primary areas, that I would very briefly
mention now. One is personal health records for all of our US employees;
and we have about 500,000 employees in the US, about 80 percent of them
now have subscribed an opt-in process to put their personal information
in a web MD type format, personal health record.

It was a little bit of a \[inaudible\] to get them, there, though. If
they would go in and input their data, as well as complete a health risk
assessment, and take action on one of their major identified health
risks, as well as investigate the quality of hospitals in their
community, they're rewarded with \$150 dollar payment.

So with a little bit of a push/pull this year, we're going to start
integrating some of the pharmacy data, as well as some of the episodes
of care from their providers through claims data, so that we can start
building toward this whole concept of discreet episodes of care. And
they can really realize and see where they are spending their dollars on
their care.

The second area is what we're calling patient-centric primary care,
where we think there is an enormous opportunity to reengage our
employees with a primary care focus in their overall healthcare
experiences. We're looking to partner with the American Academy of
Family Physicians and American College of Physicians, in a large
multi-specialty clinic, in the Texas area, that will also have a primary
care focus.

What we'd like to do is help that clinic transform its ways of
delivering healthcare to our employees, in particular. It may also stand
the gamut of their other patients at the clinics. But to redefine the
experience so that there is technology enablement with e-mail visits.
There is open access calendaring, there is clinical decision support
tools available to our employees, and to others in the clinic, as they
see fit.

But we also have to address the whole concept of how we pay for that
type of care, because right now our plans are not able to do that. And
what we first want to do is define that type of care, and then work with
our plans to be able to pay for that type of care, and incent the
delivery of that type of care.

So personal health records, patient's central primary care, and then
information transparency, as Peter mentioned, is very key to us. That we
want our employees to have that information at their fingertips, as they
select their plans, as they select their providers, so that they're
doing the very best that they can to avail themselves of that
information and make the best use of it.

That would be, I think, the kind of \[inaudible\] that we have.

MR. CROSHAW: Great. We appreciate you all doing this on an expedited
timeframe. Before we go to our last presenter, Kevin, let me just
mention what I think these employers underscore here, which is a real
desire to move forward and take an active role as a payer, to move
towards kind of a value structure in healthcare. And what we are going
to see, I think, as we break from this meeting, the Secretary will be
speaking to a group of folks, many that are here. We invite you to move
with us just down the hall, and articulating the vision that are \-- and
addressing, I think, the issue that's brought up by Jeff here, in terms
of what's the role for employers to act collaboratively, for payers to
act collaboratively?

The federal government is the largest payer for healthcare. The state
and the local governments are engaged and interested in making change.
And there are others that are unions or that purchase healthcare through
other means that are very interested, and are part of the efforts that
are demonstrated here. And we look forward to really working, where
necessary, in a coordinated fashion. And I'm eager to have the Secretary
explore that vision for us a little bit, in just a few moments.

Kevin, if I could turn it to you for the last word here.

MR. HERGLOTZ: Great. Thank you, Secretary and Dr. Brailer. I appreciate
your leadership and the administration's leadership as it relates to
this important topic.

It's great to be here at the table with such great partners with Peter,
Jeffrey at Cisco, and also IBM. Working together with them, we can do a
lot of things as a company, and we're starting to see some really big
success in terms of getting our employees more involved and more active
in their healthcare decision-making.

Our CEO implemented a program, and is very passionate about this, a few
years ago, on how we can do that. We've actually taken a model with
about 30,000 of our employees throughout the country. We want to expand
that to our entire work force, which is 200,000, over time, but again,
it's bringing this value into their plans, particularly as it relates to
more responsibility, and preventive care, and things of that nature.

What we have done also, just following up on Chris, is the same thing, a
health risk questionnaire, with allows us to establish a baseline.
Again, the company doesn't see any of this information, but it does
allow for a starting point for us to go to our employees and actually
look and have them evaluate in terms of where their baselines are. And
we've done that through incentives as well, reduction in their premiums
and stuff, in order to participate in this program.

But we implemented a program where Safeway, you know, it's our \--
basically our healthy incentives health plan program, where, you know,
after two years, over 70 percent of our \$30,000 \-- or 30,000 non-union
work force is participating in this program. Again, it pays a hundred
percent of all preventive care, whether it's breast exams, prostate
cancer, annual physicals, age appropriate. It's everything from well
baby and childcare, and other appropriate exams. We pay for people to
stop smoking; we give them incentives to stop. And it's all based on
kind of an incentive structure to make better decisions, and take more
control of the decision-making.

And it's proving extremely successful. And our employees actually like
the plan. We have been able to, in just the short time that we have put
this plan in place, not only provide these discounts, but in addition to
it, we've actually reduced the healthcare costs, not only for our
company, but also our employees. Employees who are participating in this
plan have actually seen a 22 to 32 percent decrease in their annual
healthcare costs.

We have been actually able to expand their benefits by providing a lot
of the preventive care, putting in place an HRA and an FSA for them to
use. In addition to that, we've decided instead of adding cost savings
to our bottom line, to actually share that with the employee.

So \-- and what we're looking at, in working with partners like Cisco
and other companies, is continuing to expand these programs over the
next several years. So the plan right now has a whole menu of preventive
choices that they can make, but next year, we're going to be adding on
to that. So again, the idea is to continue to grow until we have what we
hope is 90 to 100 percent participation from our plans.

But again, to model that, I think our CEO has been talking to other CEOs
around the country as a way for companies to \-- in lieu of additional
action, from whether it's a state, or the federal government taking
action, it's a way for companies to step up to the plate and actually
show how using market forces and your own programs, and designing them
for your employees, how you can actually make a difference, and you can
actually stop this double digit increase in your healthcare costs, and
actually flatten them. So in the two-year period, we have actually seen
30 \-- we've opened up a 30 percent gap on where the national trend is.
And we want to continue to see that grow, and again, share that back
with our employees.

We're taking it one step further. We're able to do some of these things
as a company because we are a retailer. We have millions of customers
coming into our stores each day, and so now we're actually starting to
share this information and do a strong preventive health and wellness
program inside of our stores; using the Internet, using customer
communications, a stronger emphasis on health and wellness, and foods,
and giving customers information inside of our stores, and on our
websites, to help them make better choices, and again, drive the
preventive agenda.

So thank you for the opportunity to be here.

MR. CROSHAW: One thing, these are three exemplary employers, but this
falls on the heels of discussion of privacy. I just want to underscore a
data point. Safeway, 70 percent of their employees have completed an
HRA. It is very private information, and they address the issues of
employees saying they don't address that. Cisco, 75 of their employees
have completed an HRA, because they're incentive encouraged and engaged.
You heard from IBM, about 80 percent of the employees have a PHR.

So here you have \-- there is a lot of discussion. Will employees trust
their employers? You have across three very different large employers
with the vast majority of the employees ready to engage, who are
providing very private information, because they feel safe in doing
that, and they have an upside to doing it by being engaged in
prevention, as well as some financial incentives.

I think it's an important part of how quickly we're moving down the path
and having good data to be the anchor for both preventive programs, and
also a better benefit of the design.

SECRETARY LEAVITT: It is my view that if everyone in the United States
were employed by \[laughter\] or in some way part of the system, that
would approximate IBM, Cisco and Safeway, the world different be a
bigger place.

I think Jeffrey asked the question, posed the proposition that in many
respects, it's about companies like yours, figuring out what you can do
on your own, and what you'd need a larger social system to do that you
can't do. And I think quite symbolic is this \-- sits at this table.

It's very clear to me that the effort that AHIC has undertaken is, in
lots of respects, following what you are pioneering, and trying to
figure out how we can take what you're doing, and implement it over a
much broader construct of society. At the same time, it's clear to me
that to get from \-- to what you aspire and envision, you're going to
need to have the output of just mind-numbing detail that has to go into
building the infrastructure that we have been discussing today.

To my colleagues, may I say that in just a few minutes, we're going to
go in \-- we'll have 20 or 25 employers, including these three and
others, that Peter and \-- have assembled, and others \-- part of the
Pacific Business Group and others.

This whole effort to bring employers behind the four cornerstones has
been to create the necessary weight to drive through the resistance that
naturally exists. There is a very high probability, in my mind, that
we'll get to 60 percent of the entire marketplace, but before we get to
the '08 policy year, that we'll be behind in some way, in some form,
pushing in these four broad categories. That is the pressure that
continues to drive this forward.

It does feel, to me, often, chaotic. It may be that because I'm just
right in the middle of so much of it, that we are making progress, that
there is a lot of progress being made. Every year that clicks off the
calendar, we're getting closer and closer to this vision of a system
that is integrated, connected, and based on value.

I don't want our meeting to close today without acknowledging the Office
of the National Coordinator and the remarkable work they continue to do
under difficult circumstances and under the pressure of lots of urgency.
And Rob Kolodner, in particular, I want to acknowledge the leadership
that you're providing to the Office of the National Coordinator, and to
recognize that every day, I mentioned earlier, somebody has to go to
work every day with this on their mind. Rob does, as does the Office of
the National Coordinator. Every day they wake up with this on their
mind, and it's \-- I want to express both pleasure and appreciation for
real good work.

To members of the \-- of AHIC, this is our 12th meeting. I think if you
look back over a year and see what we have accomplished in the 12
meetings, we're having a profound impact. We need to keep driving. Dr.
Brailer, I'm going to ask if you have any comments.

DR. BRAILER: Thank you, Mr. Secretary. I think I have the voice for a
few comments. Mostly I will say that I do join your praise for Rob and
his hard work. I sleep better at night knowing that he's doing the job
instead of me. \[laughter\] I still wake up in the mornings thinking
about the same issues, sir, and I don't know what that says, but I do
think that we have a long way to go, and we're working very hard against
your deadline of making sure that by the end of '08, that we have all of
this locked down very strongly.

And to that end, I think we're ready for any public input that anyone
has today for the members of the Community. There is a microphone that
is to my left, to most members of the room's right, and the floor is
open. Please, and just introduce yourself. I'll ask you to be brief, and
of course, no commercial or solicitation comments, please. Go ahead.

MR. CANAL: Thank you, very much. Al Canal. Actually hit three of the
categories. I work for an employer, Eastern Kodak Company. Also on a
vendor community, Kodak Health Group and started the RHIO in Rochester,
New York, which was one of the biggest employer-led RHIOs. So we got
their involvement up front.

I want to commend you on the progress that's been made over the last
couple of years. It's been absolutely terrific, as I've watched and
participated. One area that I think is an opportunity for improvement,
though, is to complete the electronic health record.

Medical imaging is a critical part of the health record, and there are a
lot of reasons why that I think it can and should be part of the agenda,
whether it's as a use case, or whether it's as a Workgroup, or whether
it's just part of the EHR community. The cost of medical imaging is
staggeringly increasing. It is now the second largest part of
healthcare, fastest growing, and there is even actions in Congress to
try and lower it, by some not necessarily useful kind of things, like
lowering the reimbursement.

In addition, access to imaging for quality and clinical care can improve
lives, can improve care and reduce costs significantly. So rather than
going through the litany of these, I'll just lay the issue on the table.
When and how do we try and get this part of the mix?

SECRETARY LEAVITT: I just \-- I don't generally make a lot of comments
back, but I will tell you, I agree that \-- it's obvious that the cost
is becoming a big part, but it's also \-- ought to be one of the first
things that could be subject to competition based on value. This is an
area where we ought to be able to see a competitive environment develop,
much more quickly than some of the other more complicated conditions and
procedures.

DR. BRAILER: Thank you. Any other public comments? Please.

MS. GRANT: Thank you. Mimi Grant with the ADL, Adopted Business Leaders
Organization. I just to commend all of you. I have been sitting here
since before 8:00 this morning, and it's just really gratifying for a
taxpayer to see how much hard work both our paid government officials,
as well as the volunteers and business community, are putting into a
really fantastic, both goal, and certainly I think can be achieved, so
\-- just wanted to commend you as a taxpayer.

SECRETARY LEAVITT: Well, thank you for getting up at 2:00 o'clock in the
morning to get here. \[laughter\] She told me that earlier. \[laughter\]
It's the only way I would know. \[laughter\]

DR. BRAILER: I think it's time for the end of public comments.
\[laughter\] We stand adjourned. Thank you very much.

[\[Whereupon, the meeting was adjourned at 12:40 pm PST\]]{.underline}