American Health Information Community

Confidentiality, Privacy, and Security Workgroup Meeting #1

August 21, 2006

# Disclaimer

*The views expressed in written conference materials or publications and
by speakers and moderators at DHHS-sponsored conferences do not
necessarily reflect the official policies of the DHHS; nor does mention
of trade names, commercial practices, or organizations imply endorsement
by the U.S. Government.*

> **[\>\> Matt McCoy:]{.underline}**
>
> Members of the public who just came in, the meeting is going to be
> delayed two more minutes and then we\'ll get started.
>
> **[\>\> Paul Feldman:\
> ]{.underline}**Welcome to the first meeting of the Confidentiality,
> Privacy, and Security Workgroup of the American Health Information
> Community. My name is Paul Feldman. I\'m one of the co‑chairs. And
> with me, among other people in the room, I have my co‑chair and we
> would like to ‑‑ well ‑‑ we\'ve got the meeting. We\'re going to do a
> roll call in just a minute, I think. Because we\'re going to do
> introductions as we do roll call, I think.
>
> Want to do that real quick? All right. Paul Feldman.
>
> **[\>\> Kirk Nahra:]{.underline}**
>
> Kirk Nahra.
>
> **[\>\> Paul Uhrig:]{.underline}**
>
> Paul Uhrig.
>
> **[\>\> Judy Sparrow:]{.underline}**
>
> Judy Sparrow.
>
> **[\>\> Dan Rode:]{.underline}**
>
> Dan Rode with AHIMA.
>
> **[\>\> Christine Broderick:]{.underline}**
>
> Christine Broderick on behalf of Deven McGraw of the National
> Partnership for Women and Families.
>
> **[\>\> Sarah Wattenberg:]{.underline}**
>
> Sarah Wattenberg, Substance Abuse and Mental Health Services
> Administration.
>
> **[\>\> Susan McAndrew:]{.underline}**
>
> Susan McAndrew, Office of Civil Rights.
>
> **[\>\> David McDaniel:]{.underline}**
>
> David McDaniel, Department of Veterans Affairs, Veterans Health
> Administration.
>
> **[\>\> Jodi Daniel:]{.underline}**
>
> Jodi Daniel, ONC.
>
> **[\>\>]{.underline}**
>
> And we\'re ready for who is on the phone, please.
>
> **[\>\> Matt McCoy:]{.underline}**
>
> I\'ll give you a quick run down, joining on the phone today, Jill
> Dennis from AHIMA.
>
> **[\>\> Jill Dennis:]{.underline}**
>
> Hi everyone.
>
> **[\>\> Matt McCoy:]{.underline}**
>
> Elizabeth Holland from CMS is here today as a designee for Tony
> Trenkle. John Cuddeback is here as a designee for Peter Basch from
> MedStar Health. And Jeanette Thornton as a designee for Tom Wilder,
> from AHIP. John Houston from NCVHS and Maizy Howard is joining over
> the phone as well.
>
> **[\>\>]{.underline}**
>
> Thank you
>
> **[\>\>Karen Trudel:]{.underline}**
>
> Hi, this is Karen Trudel. Actually, I\'m the designee for Tony Trenkle
> from CMS.

[]{.mark}

> **[\>\>]{.underline}**
>
> Thank you all for joining us on this hot August day. Let\'s go around
> the room and see who is visiting.
>
> []{.mark}
>
> **[\>\>]{.underline}**
>
> \[inaudible\], from AHRQ.

[]{.mark}

> **[\>\> Ross Martin:]{.underline}**
>
> Ross Martin, from Pfizer. []{.mark}

[]{.mark}

> **[\>\> William Crawford:]{.underline}**
>
> William Crawford, CMS. []{.mark}
>
> []{.mark}
>
> **[\>\>]{.underline}**
>
> \[inaudible\]
>
> **[\>\>]{.underline}**
>
> \[inaudible\]
>
> **[\>\> Gloria Cohen:]{.underline}**
>
> Gloria Cohen, from ONC.
>
> **[\>\>]{.underline}**
>
> \[inaudible\] Office for Civil Rights. I\'m one of the Workgroup
> staff.

[]{.mark}

> **[\>\> Jeff Day:]{.underline}**
>
> Jeff Day, reporter with BNA News.
>
> **[\>\> Mary Ganous:]{.underline}**
>
> Mary Ganous, Bearing Point.
>
> **[\>\> Melissa Goldstein:]{.underline}**
>
> Melissa Goldstein, Markle Foundation.

[]{.mark}

> **[\>\>]{.underline}**
>
> \[Inaudible\], American Academy of Pediatrics.

[]{.mark}

> **[\>\>]{.underline}**
>
> \[inaudible\] Oliver \[inaudible\].

[]{.mark}

> **[\>\> Michelle Murray:]{.underline}**
>
> Michelle Murray, ONC.
>
> **[\>\>]{.underline}**
>
> \[inaudible\], ONC.

[]{.mark}

> **[\>\>]{.underline}**
>
> Jim \[inaudible\] on behalf of the American Psychoanalytic
> Association.
>
> **[\>\> Steven Posnack:]{.underline}**
>
> Steve Posnack, ONC.

[]{.mark}

> **[\>\> John Loonsk:]{.underline}**
>
> John Loonsk, Office of the National Coordinator.
>
> **[\>\>]{.underline}**
>
> Welcome. As we get started, we\'ll go around and make a little bit
> more of an introductory, introduce each other. And I guess I\'ll take
> the co‑chair role here and I\'d like to make some brief remarks to
> start.
>
> First of all, welcome to everybody. I\'m glad that everybody is here.
> We\'re going to have a lot of work today, and I think it\'s really
> important.
>
> I think that, well, confidentiality, privacy and security must be
> built into our e-health efforts from the ground up. That\'s where we
> start. I want to thank David Brailer and Secretary Leavitt for being
> flexible enough to acknowledge the need for this group for additional
> and specific focus on these issues and obtaining a consensus from the
> AHIC to form this Workgroup.
>
> I think it\'s a welcome sign in this environment. I want to thank the
> staff of ONC who have shown nothing but good faith to have a diversity
> of views to get a full and hearing on this Workgroup through a
> consultative process that\'s led to impaneling the folks here today.
> It\'s very healthy and welcome start, so thank you.
>
> Welcome also to the visitors in the room and on the Web and on the
> phone. It\'s great we can all be linked this way. I think it\'s
> obviously perfectly appropriate for the subject matter and I hope this
> is working for you as far as the documents that you see and what you
> hear. If it is not, or it is, and you want to let folks know, please
> let ONC staff know how we can make this experience work for you to be
> sure that you can fully participate, whether you are in DC or across
> the country.
>
> So I wanted to just say a couple of things. I believe that it is a
> consensus for ‑‑ certainly it\'s my position, my employer\'s position,
> the Health Privacy Project. And I think most of my colleagues, whether
> we\'re working in privacy and security, whether we\'re working in
> health access, health quality. Maybe ‑‑ not maybe research or
> prevention as well, that electronic health information exchange is
> something that patients need and we need it now. We want e-health to
> happen with all due speed. That\'s why I\'m here and I hope that\'s
> why you\'re here as well.
>
> I think that sometimes we think that privacy advocates may not want
> this to happen. Anything could be further from the truth. We recognize
> the need for it and the enormous benefits that accrue and we wish for
> it to happen now. For lack of good longitudinal information, we have a
> healthcare landscape where medication errors kill or harm far too many
> of us far too often. Unnecessary lab tests that once raised our
> healthcare costs while tormenting us with their inconvenience and
> discomfort. Our providers don\'t have access to our complete health
> histories and that of our parents and grandparents, and so they miss
> incredibly important facts, which too often mean the difference
> between treatment success and failure. Our providers don\'t have the
> knowledge that come from access or aggregated or anonymized healthcare
> experience data. That while not research per se would amplify what
> good providers already do, \[inaudible\] do, et cetera, and
> experiences with their peers to inform their clinical practice.
>
> So it\'s not that we don\'t want e-health, we want it badly, we know
> it, and we want it now. But we know based on evidence that individuals
> act against their own best interests by engaging in privacy protecting
> behaviors. Like foregoing treatment and care or going to a different
> provider so a particular encounter won\'t become a part of what they
> believe to be an unsecured permanent record. That\'s what happens when
> we don\'t trust that our highly sensitive health information will
> remain private, confidential, and secure.
>
> We owe patients, which, of course, include all of us sitting here and
> on the phone, better. This is the challenge that we attempt to meet
> here in this room now and for some months to come.
>
> It\'s hard not to be agitated about this stuff when you\'re worried
> about the location and extent of your data shadow. Unlike Peter Pan,
> we can\'t find Wendy to stitch it back on to our back and therefore
> know it\'s secure and confidential. Unfortunately, that is not how it
> goes.
>
> We fear for good reason. The commercial misuses of data. The
> information industry collects, compiles our personal information into
> a dossier available for sale, just as one example, for those who would
> use it to determine our worthiness to obtain insurance coverage or
> obtain a mortgage.
>
> Is it any wonder that the patients fear the widespread genetic testing
> when the results of such testing can be used to deny them the
> opportunity to buy a house or buy life insurance to protect their
> family or their loved ones, only because they have a genetic
> predisposition to a cancer or other life-threatening illness. Is it a
> wonder then that they avoid testing or seek care under the cover of
> darkness? This is serious stuff with enormous implications for all of
> us. We have to build it in from the ground up and that\'s what I
> believe we\'re here today.
>
> We will almost immediately undertake the process to determine what
> topics this Workgroup should address to support the break‑through use
> cases of three of the other Workgroups, Jodi will tell us more about
> that in just a minute.
>
> But I hold that we must locate our recommendations in a space informed
> by and steeped in basic policy principles with respect to
> confidentiality, security and privacy. Many believe that this is
> foundational work, and that to date it has not been taken up
> explicitly by the AHIC nor by its other workgroups.
>
> And whether or not you believe this to be true, I will advocate that
> this Workgroup should recommend how we can build in these policies
> that safeguard our most sensitive health information as the e-health
> technology and methods are rapidly created and widely diffused. So
> welcome to the rodeo. I think we\'ll have a good show. And spirited
> debate is not only the hallmark of democracy, it also fuels the
> development of robust markets and empowered patients and consumers.
>
> So bring it on and let me know by e‑mail if there\'s anything you want
> to talk about that you hear today or as this saga unfolds.
>
> So welcome. And thank you. Yeah, Matt, you were going to review the
> meeting protocols for call‑in participants, please.
>
> **[\>\> Matt McCoy:]{.underline}**
>
> Sure. I\'ll actually do this in two part fashion, some instructions
> for those of you who are sitting around the table at ONC and some
> instructions for those on the phone. First, for people who are on the
> phone, please keep your phone muted when you\'re ‑‑ and this is for
> Workgroup members, not members of the public. Please keep your phone
> muted when you\'re not speaking so we don\'t have any background
> chatter making noise. When you do have something to say, please
> introduce yourself before you speak. Just so we all know who is
> speaking and your comments get correctly attributed in the meeting
> transcript and summary.
>
> Also, if you\'re following along on the Webcast portion of this,
> please don\'t touch any of the controls on the interface that forward
> or reverse the slides, because all those changes will be shared and
> seen by everybody else that\'s following along.
>
> For members of the Workgroup at ONC today, please make sure, since
> we\'re using a speaker phone system, you get as close as possible to
> the microphone when you do speak. If there\'s members of the public
> who are sitting in the room and want to say something at the end of
> the meeting for public comment, they really need to get up next to the
> table and speak into a microphone, otherwise it won\'t get on the
> transcript and it won\'t be heard across the Web, and on the Internet.
>
> That\'s it.
>
> **[\>\> Judy Sparrow:]{.underline}**
>
> This is Judy Sparrow, and I want to make a reminder to everybody, both
> the Workgroup members and the public listening, that we\'re operating
> under the Federal Advisory Committee Act, FACA, which means we\'re
> basically operating in a fish bowl. The notice of all the FACA
> meetings are printed in the *Federal Register.* They\'re open to the
> public. We do keep detailed minutes, and that will be posted on our
> Website. And also to remind you we serve in an advisory capacity to
> the AHIC, to the American Health Information Community. So without
> further ado, I think I\'ll turn it back over to the co‑chairs.
>
> **[\>\> Kirk Nahra:]{.underline}**
>
> This is Kirk. I\'ll be working with Paul and the staff as one of the
> co‑chairs. One of the things we\'ve had preliminary discussions about
> and wanted to run through with the Workgroup was our approach to how
> we were going to make recommendations. We obviously have a defined
> committee, a group of people. We can have very formalized voting
> protocols. We\'ve sort of discussed how to do that.
>
> Our goal at the end of the day is to try to work for significant
> majorities. Because we\'re an advisory group, we\'re not necessarily
> looking for unanimity. We may have that on some of the issues. We\'re
> also not looking for just a pure mathematical majority, if a
> recommendation is, you know, of the 17 or 18 people on the Workgroup,
> if we\'re at 10 to 9, that\'s probably not a very useful
> recommendation. So our goal is to try to build, we\'ve talked about
> consensus as a word. Consensus doesn\'t necessarily mean unanimity. So
> our goal is to develop these issues as best we can to work for
> building significant majority support when we get to the idea of
> particular recommendations.
>
> We also have made at least preliminarily, and again throw out for
> discussion at a later point, the idea of having minority views carried
> through as potential recommendations. That\'s not an obvious decision.
> There certainly have been situations in the AHIC and otherwise where
> they are not minority moves that come forward. We thought it important
> to bring those out as best as we can. So that\'s sort of the operating
> principle that we\'re going to be working towards. We may find that
> easy to accomplish in some situations. It may be harder in others.
> There may obviously be some issues where we don\'t end up with a
> particular recommendation or our recommendation was that there\'s not
> a particular consensus on some of the issues. But that was sort of our
> approach, and again as the working group gets to know each other and
> gets familiar with each other, we\'ll be trying to explore that a
> little bit. But that was essentially our ideas starting out as to how
> we were going to try to move this forward.
>
> Paul, anything to add on that?
>
> **[\>\> Paul Feldman:]{.underline}**
>
> No, that\'s great.
>
> **[\>\>]{.underline}**
>
> We\'ll go around the room and do brief introductions of the Workgroup
> members here and on the call. We\'d like to keep this relatively brief
> so we can keep moving along. If anybody is uncomfortable would rather
> sit in the overflow room there\'s another room available. But I think
> everybody is sitting here. So ‑‑
>
> **[\>\>]{.underline}**
>
> If anybody is on their way and listening, there\'s no more room in
> here.
>
> **[\>\>]{.underline}**
>
> The big decision will be which one, apparently.
>
> So just to again give us your name, organization, affiliation, and a
> little bit of relevant background why you\'re here.
>
> And why don\'t we start with you. Let me start off. My name is Kirk
> Nahra. I\'m a lawyer here in Washington, with the law firm of Wiley,
> Rein, & Fielding. I\'ve been with that law firm now 19 years. My first
> job out of law school. Can\'t get another one
>
> \[laughter\]
>
> I\'ve been working on privacy issues now for close to 10 years. My
> background tends to be in healthcare industry and in the insurance
> industry. Obviously I\'ve been working with the HIPAA rules since they
> were in their initial drafts. And over the last few years have really
> expanded my work to deal with the full range of privacy issues for
> healthcare industry and otherwise.
>
> So I do touch on a lot of the different laws beyond HIPAA and have
> really worked with pretty much all those at both the state and federal
> level as well as internationally. So I tend to have more experience in
> the healthcare sector than others, but I don\'t come here representing
> any particular group or with any particular perspective. Paul and I
> have talked a lot about our different views. We agree on some things.
> We may not agree on everything. But I think we\'ll have a good working
> relationship to move this forward.
>
> **[\>\> Paul Feldman:]{.underline}**
>
> Paul Feldman, deputy director of the Health Privacy Project here in
> DC. I come to this work with a long, long experience as an AIDS
> activist and operative. Started as policy director for regional AIDS
> service organization in the northwest. And have been doing everything
> from co‑chairing the first Ryan White care access services committee
> in Seattle to almost but not literally standing on tables as an Act
> Out member many years ago.
>
> So I see the value of consumer involvement. I see the value in working
> in broad‑based coalitions and committees and I\'m very happy to be
> here.
>
> **[\>\> Jodi Daniel:]{.underline}**
>
> I\'m Jodi Daniel with the Office of the National Health Coordinator at
> HSS. I\'m the director of policy and research here, and among my
> responsibilities are to be leading from our office this Workgroup. I
> am also the project officer, one of the project officers, for the
> privacy and securities solutions contract that we are co‑managing with
> AHRQ to provide, to engage many different states, 33 states and one
> territory who will be involved in this project.
>
> I\'m looking at privacy and security issues, practice solutions and
> implementation plans to address some of the concerns that we\'ve been
> hearing about and that we may not be hearing about.
>
> My background is actually in health information privacy. I was
> involved, came to the department to work on the HIPAA privacy rules.
> And worked for many years for general counsel here on drafting
> regulations, implementing enforcement, guidance, et cetera, on the
> HIPAA privacy rules. So I come with that information as well on that
> background, and looking forward to work with y\'all.
>
> **[\>\> David McDaniel:]{.underline}**
>
> David McDaniel, I\'m with the Department of Veterans Affairs, and I
> most recently was responsible for the code insurance and portability
> act in the office in the Veterans Health Administration, a covered
> entity, have recently moved over to be a privacy specialist in DHSS,
> privacy office, to head up the responsibility of compliance. I hope I
> bring some perspective of the large healthcare provider trying to
> actually implement this particular requirements and how we can best do
> that.
>
> **[\>\> Susan McAndrew:]{.underline}**
>
> Sue McAndrew, I\'m the deputy director for health information privacy
> in the Office for Civil Rights. The responsibilities of the office is
> to both enforce the HIPAA privacy rule as well as to administer that
> rule from a policy perspective. So we do the regulations and the
> policy development, frequently asked questions, and also work with our
> regional offices on enforcement actions. Like Jodi, I\'ve been doing
> HIPAA almost exclusively since 2000. And it never ceases to amaze me
> it crops up in all different places but this one being the obvious
> one. I\'ll be here to offer any privacy expertise that I\'ve acquired
> with HIPAA.
>
> **[\>\> Sarah Wattenberg:]{.underline}**
>
> I\'m Sarah Wattenberg from the Substance Abuse and Mental Health
> Services Administration. To cut my teeth on HIPAA I came in in 2000,
> served as the \[inaudible\] HIPAA coordinator and worked with the
> Office for Civil Rights in developing a document comparing the HIPAA
> privacy rules with the federal confidentiality of alcohol and
> substance abuse records, and after that developed a work group with
> substance abuse and mental health stakeholders from across the country
> to develop electronic health record standards that protect mental
> health, substance abuse, and other kinds of information that we\'ve
> been working with our federal partners and Health Level Seven.
>
> **[\>\> Matt McCoy:]{.underline}**
>
> Excuse me for just a second whoever just spoke, it was extremely hard
> to hear anything over the Web and the phone. Just so we can make sure
> that everybody who is participating in this remotely can hear. If need
> be, when you\'re doing these introductions can you maybe slide, put a
> speaker phone on mute and slide it around the table so everybody is
> around a microphone.
>
> **[\>\> Sarah Wattenberg:]{.underline}**
>
> Do you want me to repeat it or move on?
>
> **[\>\> Matt McCoy:]{.underline}**
>
> I think you should repeat it.
>
> **[\>\> Sarah Wattenberg:]{.underline}**
>
> I\'m Sarah Wattenberg from the Center for Substance Abuse Treatment,
> Substance Abuse and Mental Health Administration, and I was the HIPAA
> coordinator for SAMHSA and worked with the Office for Civil Rights on
> an outreach document comparing the HIPAA privacy rule with the federal
> regulations on confidentiality of alcohol and substance abuse records.
>
> After that I created a work group for behavioral health stakeholders
> across the country to work with federal partners and the HL7 work
> group on developing standards for electronic health records that
> protect mental health and substance abuse records and information,
> other kinds of sensitive information. Thank you.
>
> **[\>\>]{.underline}**
>
> \[Inaudible\] I\'ll let Devon give you an introduction and idea of her
> background when she\'s able to join us. The National Partnership has
> had significant involvement in quality efforts, both reporting
> measurement and reporting to try to improve patient safety, also of
> course health IT. We\'ve been coordinating a coalition of consumer
> advocates to try to advance health IT, loss of protection of privacy.
> We think of course it will work best if those concerns are taken into
> account from the ground up.
>
> **[\>\> Dan Rode:]{.underline}**
>
> I\'m Dan Rode. Jill Dennis is on the phone. I\'ll let her describe the
> organization, if I can be a help. I worked with HIPAA I think 10 years
> ago and before that before it wasn\'t a bill. My background is
> administration, teaching hospitals and health systems, and I\'ve been
> working with the privacy aspects of it in detail since about 1999.
>
> **[\>\> Paul Uhrig:]{.underline}**
>
> I\'m Paul Uhrig, executive vice president of SureScripts, linked over
> 95 percent of the pharmacies with providers all around the country.
> Responsible for all our business contractual relationships and I\'m
> also the privacy officer. So dealing with these issues on a daily
> basis. Prior to joining SureScripts I was a healthcare attorney in
> private practice 18 years, representing hospitals, physicians and
> other providers in regulatory and corporate matters. Dealing with
> these issues for many years.
>
> **[\>\>]{.underline}**
>
> And the members who are on the phone, if you could introduce
> yourselves, please.
>
> **[\>\> Matt McCoy:]{.underline}**
>
> Let\'s start with Jill Dennis and I\'ll run down the line and prompt
> each person.
>
> **[\>\> Jill Dennis:]{.underline}**
>
> Thanks, Matt. Hi everyone. I\'m Jill Dennis, president of AHIMA. I
> know many of you are familiar with AHIMA, for those who aren\'t, our
> members manage health information in really a wide variety of
> healthcare organizations. And as part of that manage the release of
> information activities and HIPAA privacy compliance and security
> compliance that\'s all a part of handling health information.
>
> That\'s what I do from a volunteer standpoint. I also have a paying
> job, which involves consulting with healthcare organizations on risk
> management issues, including information management and privacy
> issues. I\'ve been involved in working on privacy issues since way
> back in the late 70s, probably one of my earliest introductions to it
> was working with the National Conference of Commissioners on Uniform
> State Laws trying to put together health information privacy act that
> would cross the state lines.
>
> So this is a passion of mine and certainly in the interests of our
> members and we come to it with the very practical perspective of the
> folks who have to administer the regulations that come out. So I\'m
> glad to be with you and looking forward to working with you.
>
> **[\>\> Matt McCoy:]{.underline}**
>
> John Cuddeback.
>
> **[\>\> John Cuddeback:]{.underline}**
>
> I\'m with MedStar, a group of hospitals and agencies and several
> diversified businesses here in the Washington and Baltimore area. I\'m
> chief medical information officer and was responsible for coordinating
> our HIPAA implementation. Now that\'s migrated to our office of
> corporate compliance. So I\'m not involved on a day‑to‑day basis
> anymore. But let me introduce my colleague Peter Basch in absentia.
> He\'s an internist, been using a electronic medical record in his
> practice for nine years and has been very much involved in promoting
> the use of electronic records both on the inpatient and outpatient
> sides of our business at MedStar and in the public policy arena as
> well.
>
> One of our major points of emphasis is using the EMR to transform
> care, not just automate broken processes and create long elaborate
> notes for billing. So one of the focuses has been very much on work
> flow operational support as well as clinical decision support. So a
> balanced focus on all of the aspects of performance improvement. And
> obviously the practicality of privacy and security processes in a
> large healthcare organization are one of the focuses that I\'m sure
> Peter will be able to bring to the group.
>
> **[\>\> Karen Trudel:]{.underline}**
>
> This is Karen Trudel from Centers for Medicare and Medicaid Services.
> Our director, Tony Trankle, is the member on the group. We\'re from
> the office of E-Health Services and Standards. We develop and
> interpret the HIPAA security standards, both in terms of policy and
> enforcement, and another part of our portfolio at CMS is working on
> E-education requirements for Medicare and also Medicare\'s role in the
> personal health record arena.
>
> **[\>\>]{.underline}**
>
> John Houston.
>
> **[\>\> John Houston:]{.underline}**
>
> Hi, my name is John Houston. I\'m with the University of Pittsburgh
> Medical Center. I am also a member of the National Committee of Vital
> and Health Statistics and a member of the privacy subgroup there. My
> background, I\'m the privacy officer for UPMC. I\'m responsible for
> information security and a little bit of background regarding the
> UPMC. We\'re about a six billion, that\'s with a B, dollar system. I
> deal with privacy and security in an extremely large and progressive
> meaning from an IT perspective health system from within the U.S. I
> have a lot of background on privacy and security.
>
> **[\>\>]{.underline}**
>
> That does it for the phone introductions.
>
> **[\>\>]{.underline}**
>
> I\'m sorry, there\'s one more.
>
> **[\>\>]{.underline}**
>
> Go ahead.
>
> **[\>\> Jeanette Thornton:]{.underline}**
>
> This is Jeanette Thornton from America's Health Insurance Plans. I\'m
> sitting in for Tom Wilder today. I\'m coming to you sort of on two
> separate capacities. The first is that I recently spent the past four
> years at the office of management and budget where I was responsible
> for the EF authentication E government initiative. We have a lot of
> experience with the policies of the federal government and the work
> they\'ve done in the areas of authentication and security. And second
> on behalf of Tom Wilder who is at a bed and breakfast in Upstate New
> York today who brings to the table practical considerations in
> implementation of HIPAA for our health plans who are responsible for
> implementing HIPAA every day. Again, we hope that this Workgroup will
> look at work that\'s already been done and not try to reinvent the
> wheel too much. And we are very, looking forward to participating so
> thank you.
>
> **[\>\>]{.underline}**
>
> We have some staff folks in the room who haven\'t introduced
> themselves and I would like you to do that, please. Speak into the
> microphone.
>
> **[\>\> Steven Posnack:]{.underline}**
>
> Steven Posnack, Office of the National Coordinator, in Jodi Daniel's
> Office of Policy and Research. I come in with a background of
> information and health security policy. I\'ll be the lead point staff
> from ONC\'s perspective. ONC.
>
> **[\>\>]{.underline}**
>
> I\'m with the Office for Civil Rights. I work with Sue McAndrew. As
> she stated we\'re responsible for enforcing the privacy rule. But
> prior to coming to the government I have over 14 years of consulting
> and healthcare operations background, including IT project management
> and HIPAA implementations in hospital payer environments and local
> Government.
>
> **[\>\> Kelly Cronin:]{.underline}**
>
> Kelly Cronin, director of the Office of the National Coordinator. I
> oversee the American Health Information Community along with Judy
> Sparrow, and will probably be staying engaged in the Workgroup process
> to the extent that it helps coordination across the rest of what
> we\'re doing in the office and the other workgroups, because as you
> know we have an awful lot of funded work within and outside this
> office. And one of the challenges to figure out how it\'s all going to
> feed into each other and we\'re building off through a state level,
> through the RTI contract, through the NHIN process and elsewhere.
> There\'s a lot of experts we can\'t engage in that process yet we know
> an awful lot. We want to make sure whatever public input we get,
> whatever testimony we get, we\'ll end up building collaboratively on
> an evidence base or at least what we think we all can contribute to
> it.
>
> **[\>\> John Loonsk:]{.underline}**
>
> I\'m John Loonsk, in the Office of the National Coordinator. I\'m in
> my room responsible for the nationwide health network process, the
> Certification Commission for health, the Health Information Technology
> Standards Panel, and federal architecture, all of which have important
> relationships, I think, to this effort and I will stay engaged in this
> process as well. I look forward to working with the group as it
> advances in this work.
>
> **[\>\>]{.underline}**
>
> Thank you. Jodi has all kinds of stuff to tell us.
>
> **[\>\> Jodi Daniel:]{.underline}**
>
> All right. There are a couple of things that I just wanted to discuss
> with the folks here about how this work group got established, what
> we\'re hoping to accomplish, and just sort of give some background for
> why we\'re here and how this relates to some of the other working
> groups that Kelly mentioned.
>
> **[\>\> Maizy Howard:]{.underline}**
>
> This is Maizy, do you mind if I introduce myself very briefly.
>
> **[\>\>]{.underline}**
>
> Sorry.
>
> **[\>\> Maizy Howard:]{.underline}**
>
> That\'s okay. I just wanted to say hello to everyone, and I\'m very,
> very thankful to all the leadership that the co‑chairs have put into
> this and Jodi Daniel as ONC director for this Workgroup. I\'m Maizy
> Howard. I\'m a registered nurse and a healthcare attorney. I consider
> myself a healthcare attorney because I have a certificate in health
> law and started out in medical malpractice. Then went more into the
> HIPAA security part and designed the functional requirements for the
> new CMS standard front end for their Medicare claims processing that
> they\'re working on implementing now.
>
> I also come with a strong background with Stark, anti-kickback, and
> Mpala and that\'s since being a registered nurse after returning to
> law school. And I just really wanted to thank everyone for attending
> the meeting. I work ‑‑ I\'m currently with Bearing Point. I work as
> the primary contractor and program lead working in conjunction with
> Steve Posnack, under Jodi Daniel.
>
> Prior to joining Bearing Point I worked for health committee and
> \[inaudible\] and was general counsel for that, for Congressman, for
> Congresswoman Melner on the House side. I\'ve had a lot of experience
> on both sides. And it\'s an exciting initiative we\'re taking. I
> wanted a chance to introduce myself because I am, I\'m in Fenway Park
> right now at a Red Sox Yankee game and being tortured and I\'m so glad
> I\'m able to be out. I\'m usually from St. Louis. They played two
> years ago and they lost. So I\'m grinding my teeth through it.
>
> **[\>\>]{.underline}**
>
> Thanks, Maizy for joining us. Maizy has been incredibly helpful in
> getting all this together and pulled off. She\'s been sort of taking
> the lead on working with us, keeping us organized and making sure that
> this was set up without a hitch. So thanks Maizy for all of your hard
> work leading up to this and for interrupting your hectic day for this
> Workgroup meeting.
>
> I just wanted to, like I said, give some background for all this
> started for that may not be aware for folks in the public who may not
> be aware of the impetus for forming this group this is the Workgroup
> of the American Health Information Community, it was formed on a
> recommendation from many of the other Workgroups, the EHR Workgroup,
> the Chronic Care Workgroup, and the Consumer Empowerment Workgroup
> recommended we set up a Workgroup to focus on privacy, security,
> confidentiality issues that were being raised in all these different
> Workgroups. And there was a discussion in all the different Workgroups
> it would be helpful to have one group look at all these issues across
> all the different breakthrough areas that were being discussed, rather
> than having the same discussion in three different groups, have
> different recommendations come up that might work for one breakthrough
> but may not make sense for other activities or more broadly.
>
> So the recommendation came up at one of the AHIC meetings to form a
> specific Workgroup on this topic to pull from members from all of
> those other Workgroups, from Chronic Care, Electronic Health Record,
> and Consumer Empowerment Workgroup, as well as to bring in other
> experts on privacy and security issues to come to the table and focus
> on these specifically.
>
> That was the impetus for forming this Workgroup. We are at ONC have
> been, are very excited at the thought of pulling this together because
> we think it\'s a great opportunity to address some of these really
> challenging issues and to do so in a way that will have public input
> and be a very public process where we can get lots of different
> viewpoints on the table. We intend this Workgroup to get lots of
> testimony from the outside. Much more so than I think some of the
> other Workgroups have in the past.
>
> We plan to have, we\'ll talk a little bit more about this later, when
> we talk about our first hearing. But we plan to have a series of
> all‑day hearings to touch on specific issues. One issue at a time and
> try to see how far we can get to come up with concrete recommendations
> directed at the breakthrough areas. One thing to highlight. One
> recommendation was this be a subgroup. We\'ve decided to make this a
> full Workgroup, not a subgroup. This is a Workgroup reporting to the
> American Health Information Community. We did this because we thought
> this issue was so important, we didn\'t want it to be reporting
> through another Workgroup where they have the same discussions again,
> decide what to bring to the AHIC. We wanted this Workgroup to have the
> ability to bring recommendations directly to the American Health
> Information Community for those to be considered and we think that
> that will help to show the importance of these issues in all of our
> activities in the breakthrough issues and et cetera. I know there\'s
> been some confusion, this is a full Workgroup with the same rights and
> responsibilities as every other Workgroup.
>
> We, like I said, not only did we pull folks from the three Workgroups,
> we have Sue McAndrew from Consumer Empowerment, Tony Trankle from
> Chronic Care, and \[inaudible\] if I said anything wrong I think I got
> it right. We brought in folks on various other areas, research, some
> you know mental health substance abuse or some staffing support.
>
> We are trying to get representatives from, you know, clinicians,
> health plans, and the like. So we\'re trying to get a broad base of
> knowledge of perspectives on these issues that we can have a very
> robust discussion and bring out all the challenging issues that come
> about when this topic is brought to the table.
>
> Like I said I\'ve been working in this area for many years. I know
> none of these issues have any easy answers. There\'s folks on every
> side of the multi‑sided table. We hope to bring out this issue because
> to try to hash out them and see how close we can get to unanimous
> decisions but at least to consensus. And we\'re very hopeful we can do
> that.
>
> The other thing I wanted to note all the full Workgroups do have a
> broad and specific charge. This one wasn\'t developed through the AHIC
> as of yet because it was intended to be a subgroup. Now that we\'ve
> made it a full Workgroup, we will be asking the American Health
> Information Community to decide on a broad and a specific charge for
> this Workgroup. That will be discussed at the next AHIC meeting. Judy,
> do you have the date of the next meeting?
>
> **[\>\>]{.underline}**
>
> 12th.
>
> **[\>\>]{.underline}**
>
> September 12th. You can look forward to that. But it should be one
> similar in tone and in scope to the other. Breakthrough Workgroup
> charges, and because there\'s a specific recommendation that\'s been
> formed this Community you can expect that it will be similar to that
> recommendation that came out. Just for, just to let folks know what
> the recommendation was specifically, it was to create the subgroup now
> made it a full Workgroup to solicit broad input and testimony to
> identify viable process to address issues that are agreeable to all
> key stakeholders. And the information they mentioned were methods of
> patient identification, methods of authentication, methods for
> securing data, methods for securing access to health information,
> policies for breach of health information, and guidelines and
> processes to determine appropriate secondary uses of information, and
> lastly a scope of work for, a long‑term independent advisory body on
> privacy and security issues.
>
> You can expect a broad and specific charge will look something like
> that. We will work with the American Health Information Community to
> come up with a broad and specific charge for this group but we have a
> pretty clear sense of direction based on the recommendation that they
> have accepted to form this group.
>
> I also wanted to, given this long list of issues we obviously tried to
> prioritize and figure out where to start. And I wanted to give some
> time to discussing what our thinking is the scope of this group, what
> we\'re trying to ask this group to focus on, what we\'re not trying to
> ask this group to focus on, and how folks should consider issues as
> they are presented with discussion and how we tried to select the
> first issues to come up.
>
> Specifically, I know there have been a lot of debates on privacy and
> security and health information over the years. We\'re not trying to
> open up old debates that have already gone through rule-making
> processes where there has been no change in the issue. We\'re not
> looking for this group to open that discussion. We have heard from
> other groups there are areas where existing regulations may not cover.
> For example, personal health records may not be covered entities
> \[inaudible\] or so there may be holes in our regulatory framework we
> need to think about or there may be new issues that are raised because
> of new sharing or new ways of sharing information electronically.
>
> So we are looking to focus on where there\'s something new to talk
> about, where there\'s some new issues on the table, or where there
> might be things outside the scope of other policies or practices that
> have already been debated at HHS, at least, and elsewhere. So I just
> wanted to suggest that as a scoping for this group discussion so we
> can have productive concrete discussions to advance the policy
> thinking and the debates rather than to take steps backwards in those
> discussions.
>
> When we\'re looking at specific issues to start with, we thought that
> there were a couple. And I\'m going to defer to Paul and Kirk to start
> the discussion. But we thought there were a few that came first, and
> we were proposing to have the first hearing be to discuss steps
> necessary to ensure appropriate first time entry and repeated access
> to different types of health IT products and services, particularly in
> areas of identity proofing authentication. And I will turn it over to
> the co‑chairs to talk about the specific issues and to have discussion
> on this issue.
>
> **[\>\>]{.underline}**
>
> Wanted to say the kind of processing, I would be interested to see
> what AHIC comes out with the specific and immediate charge given, that
> I\'ve been working from an assumption and I\'m believing many of us
> are, that this Workgroup was intended to support the breakthroughs of
> the three other Workgroups so that the elements that we pick should be
> informed by their being useful and provoking conversations to support
> them, for example. Identity proofing, authentication, it\'s clearly
> something that we\'ve got to talk about with respect to PHRs, with
> respect to secure messaging. So that one is cross cutting. Others may
> be particular to one or the other of the Workgroups. But that said, we
> still don\'t know if that\'s what is going to be our specific charge.
>
> **[\>\>]{.underline}**
>
> I think it\'s safe to say that the specific, the purpose for this is
> to have some specific breakthrough areas where there can be some
> initial demonstrable results. And the various Workgroups were
> discussing some obstacles or challenges to having those concrete
> demonstrable results and privacy and security were among those issues,
> various privacy and security issues.
>
> So my guess, and again I\'m just guessing at this point, but that the
> specific charge would be tied to those breakthroughs, and tied toward
> addressing issues that have been raised by the various Workgroups
> related to the breakthroughs.
>
> Of course the broad charge would be broader than that. But the goal
> would be to focus at least initially on how, on the privacy and
> security issues, as Paul said, that are raised through those other
> Workgroups and that can help advance the discussion and the results of
> the break‑through area.
>
> **[\>\>]{.underline}**
>
> All right. So we have before us, I think there\'s ‑‑ is there a
> document available for ‑‑
>
> **[\>\>]{.underline}**
>
> Attachment A. Elemental issues on privacy and security issues.
>
> **[\>\>]{.underline}**
>
> What\'s in the handout is two slides. The area one and area two.
>
> **[\>\>]{.underline}**
>
> Oh.
>
> **[\>\>]{.underline}**
>
> And sorry no \[inaudible\].
>
> **[\>\>]{.underline}**
>
> Could I suggest you e‑mail it out to people who are not in attendance,
> the members?
>
> **[\>\>]{.underline}**
>
> No, it wasn\'t, it was just prepared just before this meeting started.
>
> **[\>\>]{.underline}**
>
> Is it possible somebody could e‑mail it out as the meeting is going
> on, because obviously we\'re running blind if we don\'t have those in
> front of us.
>
> **[\>\>]{.underline}**
>
> Sure.
>
> **[\>\>]{.underline}**
>
> It is being done.
>
> **[\>\>]{.underline}**
>
> Somebody is running out to do that. It should be there shortly.
>
> **[\>\>]{.underline}**
>
> You may have this from last week. It\'s the same definition that we
> were given in the \[inaudible\].
>
> **[\>\>]{.underline}**
>
> He might not have that. They\'ll be sending it out. So just
> momentarily. But why don\'t we proceed and Paul why don\'t you read it
> out loud so folks that don\'t have the document in front of them or
> Kirk, whoever, can follow along.
>
> **[\>\>]{.underline}**
>
> All right. I\'ll do this quickly. There were two particular topics
> that we\'ve identified as topics for the first hearing. And on the one
> hand they\'re topics I think that sort of chronologically in the
> process do go early on perhaps first. We also viewed them as small
> bites that we could start with. And we wanted to focus, as Jodi said,
> on practical sorts of issues. So we wanted to address these two topics
> which are related and then we\'ll, I think, after that meeting the
> Workgroup will get together and evaluate whether we want to continue
> to focus on smaller issues that we can focus on particulars or whether
> we\'re going to need to step back and try to address on a slightly
> more general basis. But that\'s something for the group obviously to
> focus on down the road.
>
> The two areas we\'ve identified at this point, the first one is
> phrasing is identity proofing. And I\'ll just read what this quick
> slide says the process of providing sufficient information, e.g.,
> identity history, credentials, documents to establish and verify a
> person\'s identity. Identity proofing already takes place throughout
> many industries including healthcare. However, a standard methodology
> does not exist. With respect to identity proofing the CPS Workgroup
> should develop breakthrough-specific recommendations to practically
> address mechanisms for providing greater confidentiality and security.
> We viewed sort of in our own thinking about this at this point
> identity proofing as the first step which is how you get, I mean the
> analogy would be how you set up an account, something like that. What
> kind of requirements are people going to have in order to get a
> process started.
>
> Part two is considered user authentication. The process of confirming
> a person\'s claimed identity often used as a way to grant access to
> data resources and other network services. While the user name
> provides a foundational level of authentication, several other
> techniques, most notably two-factor authentication, have different
> capabilities. Preventing access to unauthorized health information is
> the first step necessary to protect confidentiality and security. With
> respect to user authentication, the CPS Workgroup should develop
> breakthrough-specific recommendations to practically address
> mechanisms for providing greater confidentiality and security.
>
> If identity proofing is setting up the account in the first place, the
> idea of user authentication is each time you want to go back,
> presumably, I won\'t say presumably, you\'ll not have to go through
> all the same steps you did to set up the account in the first place.
> So conceptually they follow one from the other and we\'re going to
> look at those two topics. And again we decided to propose addressing
> those together because they are obviously related and also seem to be
> connected on a lot of the same issues.
>
> So we hope that these will be good issues to get started. These will
> be issues that we\'ll be able to focus attention on practical details.
> But also use them at least to some extent as a starting point for some
> of the broader discussion of issues that we think will provide and
> sort of the different topics that we\'ll be discussing.
>
> **[\>\>]{.underline}**
>
> And what we\'re looking for is to see if now or later by e‑mail
> comment members of the Workgroup would have some comment or suggestion
> about what sorts of questions would we want to have answers to.
> Practice \[inaudible\] and the reason that we raised this now rather
> than closer to the hearing itself is we have some process in time
> issues. Not only with respect to accruing panelists, but also to get
> something out in the *Federal Register* so we can obtain public
> comment.
>
> I would imagine it\'s certainly possible that there would be the
> demand for public comment after the hearing as well, depending on how
> it goes, people hear what they hear. But we should, what ‑‑
>
> **[\>\>]{.underline}**
>
> I think we typically would ask people to try ‑‑
>
> **[\>\>]{.underline}**
>
> Do it before.
>
> **[\>\>]{.underline}**
>
> Provide testimony in time for the hearing at the same time as we would
> be getting testimony oral testimony from specific people on the panel.
>
> **[\>\>]{.underline}**
>
> There\'s also an opportunity to weigh in at the end of a meeting. So
> if in fact \[inaudible\] of the day or there\'s testimony that\'s
> raised either in writing or in oral testimony, people can respond to
> that and react to that through that public forum.
>
> **[\>\>]{.underline}**
>
> I\'m just kind of contemplating not particularly on this issue but
> others that we raised that people who aren\'t, who may not have the
> capacity to in advance hash through the issues and come up with
> written testimony may have something to say after hearing our, the
> testimony and the deliberations.
>
> So given that many of these things take, have been going on for years
> without a clear result, it\'s not unexpected that we might have the
> need for multiple rounds on some of this.
>
> But anyway, all to say that we want to give some questions out there
> and see if we can get folks to comment on them by providing written
> testimony and answer to them.
>
> **[\>\> John Houston:]{.underline}**
>
> This is John Houston. Could we take a step back maybe? The reason I
> ask that is being a member of NCVHS and specifically the privacy
> subcommittee, we actually, for about over a year, took testimony and
> actually came up a number of months ago with a detailed report, a
> letter to the Secretary, on privacy of the NHIN. And in which it
> raised a number of issues with regards to privacy that need to be
> answered, we felt, as well as made a number of recommendations.
>
> And the reason I bring that up is that I think if you\'re looking for
> themes for topics for things that need to be looked at more closely,
> it would be helpful maybe to review that letter to make sure that you
> understand sort of the basis why it was structured and some of the
> recommendations and maybe use that as the basis for some of what
> we\'re trying to cue up in terms of testimony as well as things to
> work on.
>
> **[\>\>]{.underline}**
>
> Thanks for raising that, John. As a matter of fact, I think we\'re
> going to have a link to that. It\'s the June 22nd recommendations, I
> believe.
>
> **[\>\>]{.underline}**
>
> I believe that\'s the case. I don\'t remember the date.
>
> **[\>\>]{.underline}**
>
> We\'ll have that document available from our Webpage to be, the
> temporary one there.
>
> **[\>\>]{.underline}**
>
> That will be up there shortly within a few days of the meeting we\'ll
> make sure to have that and some other background information available
> to Workgroup members and to the public.
>
> **[\>\>]{.underline}**
>
> For anyone who can\'t wait, type in NCVHS into Google and type \[audio
> disruption\] privacy and security committee and then it\'s the first
> document.
>
> **[\>\>]{.underline}**
>
> And again we spent a lot of time trying to really flush out a lot of
> these issues, and I really think that a lot of what we\'re trying,
> what they\'re trying to look for to start this committee off with. I
> think a lot of it, hopefully, is present in that document and help
> sort of form the arguments and the issues and the agenda.
>
> **[\>\> Kirk Nahra:]{.underline}**
>
> Just to follow up. This is Kirk. We do envision sending out what Paul
> and I have been calling some homework for the Workgroup members.
> Obviously some have been more involved in earlier discussions, more
> familiar with it. But we do want to get sort of a package of basic
> materials together that we hope will both bring people up to speed on
> discussions that have taken place up to this time and provide more
> comment for future discussions. We have a list of topics we\'ve been
> tossing around. Obviously we haven\'t gone far on that. These first
> two topics were really intended to be a starting point so we could, as
> I said, focus on particular issues with an eye towards very practical
> advice. But we do envision broader discussions. We envision developing
> additional lists. We don\'t have a set number of hearings or number of
> topics that we\'re going to be addressing. So I do think that the
> Workgroup, particularly over the next couple weeks ahead, both before
> the first hearing and certainly right after that hearing, we will be
> focusing on a lot of those other issues and really trying to build,
> frankly, a work plan for this group, both following the first hearing
> and after the specific charges coming out of the AHIC.
>
> **[\>\> Jodi Daniel:]{.underline}**
>
> This is Jodi Daniel. I\'m glad you mentioned that. I think your
> participation in this Workgroup will be very helpful in making sure
> we\'re aware of other information that has come up through NCVHS and
> where there are issues that should be included on the list.
>
> I would say, though, that at least on the outset one of our initial
> thoughts was to focus on specific recommendations to facilitate the
> breakthroughs, so to the extent there\'s some broad issues that were
> addressed in the NCVHS recommendations letter, those might be topics
> for a later discussion but may not be the first thing up on the table.
> That being said, if there\'s some information from that letter or
> recommendations that are relevant to some of the topics that the other
> Workgroups have recommended, then we should, we would hope that you
> could bring that to life for the Workgroup members so that we can have
> the benefit of those discussions as well.
>
> **[\>\>]{.underline}**
>
> I\'ll definitely do that. One of the other values of this letter, too,
> is I understand there\'s specific charges and the like. But that
> letter really does try to outline some of what we think are really
> some of the core issues that, if they aren\'t ‑‑ if they aren\'t
> solved on a, somewhat on a policy basis and some, you know, more
> architecturally, there are going to be real problems trying to
> implement NHIN.
>
> So it does still set a framework that I think we don\'t want to ever
> lose sight of. I think reading the letter, it will provide the
> member\'s background which I think we need to be mindful of.
>
> **[\>\>]{.underline}**
>
> I think this will be one of the balancing acts that we are
> undertaking, which is attempt to be immediately helpful while keeping
> the overarching landscape in view and responding to it as well.
>
> So I\'m glad you\'re here. That will be really helpful. Thanks.
>
> **[\>\>]{.underline}**
>
> To flush out these issues a little bit, I think it would be helpful to
> have some of the members\' input on these topic areas and how to focus
> this. When we\'re talking about identity proofing, some of the issues,
> we now have the slide up on the screen for those outside this room who
> are looking at the Web. But some of the questions we were thinking
> about was whether or not it\'s appropriate to have different levels of
> identity proofing for either different types of services or different
> types of users. So somebody who is going to be a proxy for a patient
> have a different level of identity proofing than the patient him or
> herself. How about providers, is it different if it\'s a patient is
> accessing a PHR, rather than some other service or document,
> application. Whether or not patients or users should have to go in
> person to prove their identity. Persons do something by phone or
> online. If there\'s any sensitive data that would be inappropriate or
> would be concerning to collect as part of identity proofing. I mean
> these are some of the issues and ideas that we\'ve thought about but
> we\'d be very interested in hearing some of the other members\'
> thoughts or ideas of things we should include either in questions for
> public system or for oral testimony for our hearing.
>
> **[\>\>]{.underline}**
>
> And obviously if people have them at this time great, but certainly
> feel free to think about it. We know we\'re hitting people with new
> materials. But if people have thoughts or comments that can be sent
> into the staff and be collected and we can have those as we\'re
> working forward on preparing for that hearing.
>
> **[\>\>]{.underline}**
>
> I would encourage you all to take a look first at the OMB guidance
> that I authored while at OMB describing the four levels of
> authentication as well as the corresponding myths, the national
> standards of technology guidance. Outlines for each level what type of
> identity proofing would need to be done. These are obviously for
> transactions with the government, and the Workgroup would have to look
> at how this, that information can transfer to transactions within the
> private sector, but I think a lot of great work has been done and
> those documents can be used as a foundation for any specific
> recommendations around the breakthrough areas. I would encourage you
> to take a look at, as well as the financial industry, where a lot of
> things have been tried and failed and other things have been very
> successful in the area of user authentication. So perhaps discussing
> with other industries who have had some success in this area would be
> very helpful. Thank you.
>
> **[\>\>]{.underline}**
>
> \[Inaudible\]
>
> **[\>\>]{.underline}**
>
> We will have some additional contract resources for this Workgroup. In
> fact, it\'s very likely that those resources will include people from
> expertise from other industries. So, for example, if co‑chairs decided
> they\'d like to have an issue brief written on what has worked or not
> worked for the financial industry, that could be prepared in advance
> of the hearing or in advance of a Workgroup meeting and then discussed
> publicly if that\'s something that either the Workgroup members or
> co‑chairs think would be needed or helpful.
>
> **[\>\>]{.underline}**
>
> Any thoughts we should be considering on these particular issues so we
> make sure to include in questions or in thinking about panelists.
> Anything like that.
>
> **[\>\> Susan McAndrew:]{.underline}**
>
> This is Sue McAndrew. I think it\'s the issue of whether you\'re
> talking about the provider or the participants, the record holder of
> whatever system, versus what kind of structure you want in place for
> the patient, the consumer themselves. While both may have some burden
> attached to them, what you place on the individual I think may be
> distinctly different than you would expect from an institutional
> provider.
>
> **[\>\>]{.underline}**
>
> I think for us to look at it as one single issue we\'re going to have,
> we\'re going to find ourselves in difficulty. We really do need to
> break it into two different issues. What are the issues related to the
> end-user and what they\'ll have to provide to be identified uniquely.
> And what do the organizations, the healthcare organizations that have
> to then use that information, what are their pieces of that pie as
> well. So you\'re right they\'re very different components.
>
> **[\>\>]{.underline}**
>
> I assume you\'re rolling up various roles of the organization and what
> the burden of identity proofing or authentication based on how much
> information they may have access to and how important it is to ‑‑
>
> **[\>\>]{.underline}**
>
> Right. Because what a healthcare organization will have to know about
> being able to disclose that information, for example, would be related
> to who the person is in relation to whom the information is about. Is
> it the person himself. Is it the attorney, who are we dealing with.
> That\'s one of the pieces we\'d need to understand from an
> implementation standpoint but then there\'s the flip side of that.
> That\'s the patient themselves what would they have to bring to the
> table to be able to be equally identified. And within an institution,
> it seems to me that you do have the institution itself as an
> identifiable entity and potential user as well as those variety of
> work force members and their role so I think how finely and how deep
> into that institution you need to go for external data versus internal
> data. Different factor that you would consider.
>
> And I don\'t know what you would look for in terms of totally external
> users or public health law enforcement. Any of those coming asking for
> data.
>
> **[\>\>]{.underline}**
>
> As Workgroup members are thinking about these issues and reading their
> homework and otherwise sending you out these hearings, if you have
> questions you\'d like to see addressed, topics you\'d like to see
> covered in testimony, suggestions on potential witnesses, if you could
> send that information to either Maizy or Steve, and they can compile
> that and we\'ll get that together and we\'ll try to pull together some
> more thoughts as we get closer to hearing. But it\'s that we do want
> to try to get some materials together to are the *Federal Register*
> notice and we do want to get people, at least in this first step,
> thinking about these particular issues, both specifically and in the
> broader context of some of the other issues that we\'ll be dealing
> with.
>
> **[\>\>]{.underline}**
>
> We\'ll make sure to send out contact information for folks so you know
> who to contact by e‑mail or phone if you have input to share.
>
> **[\>\>]{.underline}**
>
> I guess speaking of next steps, I think we mentioned at the beginning
> of the meeting that our testimony ‑‑ Judy, sorry, the public testimony
> hearing will be on September 29th and at the moment we\'re planning
> for an all‑day meeting. We have not set any time limit on that yet
> because we do want to get from the members of the committee, the
> Workgroup, some questions and some possible testifiers.
>
> So once we get that input from you, we can then massage that into how
> much time we\'ll need and how we will set up and frame those issues in
> the panels that we\'ll have to organize and put together for
> discussion.
>
> But, I mean, we see this as a very important role for you is to help
> gather that information and create a real deep information base for
> us.
>
> And then our job here at the Office of the National Coordinator, of
> course, is to make sure that we see this issue from all perspectives.
> And Jodi, do you have anything to add to that?
>
> **[\>\>]{.underline}**
>
> Yeah, I would just say that ‑‑ and you know folks who have been
> involved in NCVHS activities, either staff or John will know this, but
> pulling together these hearings those take a lot of planning and time.
> And so our responsibility is to make sure that these hearings are
> successful, that we have all different viewpoints to make sure that we
> are fully taking AHIC\'s interests at heart and making sure they have
> a complete set of information that\'s being discussed by this
> Workgroup. So ONC will take on the responsibility of making sure that
> we have what we believe is a fair representation of various different
> perspectives and making sure it\'s a successful hearing and
> informative and provides the perspectives that the Workgroup needs to
> have information to make decisions and discussions on these topics.
> We\'ll try to do our best to incorporate folks input from the
> Workgroup. Just from our standpoint they take a lot of time to put
> together and there are deadlines for *Federal Register* notices and
> things like that. We\'re going to be very busy in the next couple of
> weeks. So if you do have input, sooner rather than later would be
> helpful.
>
> **[\>\>]{.underline}**
>
> Topics you need to talk about that you think would be more useful?
> Welcome ideas about potential witnesses and folks to show up.
> Confusions about what we said that could be clarified either through
> some of the background documents or at the hearing itself. We intend
> to have a hearing day to have a good deal of conversation probably in
> the form of whatever panels there may be as well as at the end of the
> day before opportunity for public comment and we\'ll see how that
> goes. And the intention is to kind of debrief after that and see if
> this format worked well for us and how we may want to continue doing
> it or adjust it a little bit as we move forward.
>
> **[\>\>]{.underline}**
>
> May I ask a logistical question? Are you anticipating having another
> Workgroup meeting before the hearing or is the hearing going to be the
> next Workgroup meeting?
>
> **[\>\>]{.underline}**
>
> Well, that was the next topic on our agenda. So thank you for ‑‑
>
> **[\>\>]{.underline}**
>
> Sorry about that.
>
> **[\>\>]{.underline}**
>
> No, that\'s ‑‑
>
> **[\>\>]{.underline}**
>
> It was exact transition we were looking for. That\'s a question for
> the Workgroup to think about. We obviously need to get this Workgroup
> together as a body. We\'ve been, we still have a few more members that
> we\'re likely to be adding over the next few days.
>
> Many of you are new just in the last few days to the group. What do
> people think about whether it would be worthwhile to have another
> meeting like this, the meeting which would, I mean we would presumably
> try to set it up more for telephone. Although it can obviously be in
> person if people are local.
>
> As sort of a planning session for the meeting. Paul and I are sort of
> neutral on that. We certainly think that through emails and getting
> suggestions we could do the hearing without the need for an additional
> meeting. But wanted to get people\'s sense of their thoughts on that.
>
> **[\>\>]{.underline}**
>
> If I could just say, the one comment I have is again because it does
> take a lot of time to plan, it will take us a couple of weeks before
> we can set up a meeting. We would need input from folks probably
> before that time in order to be successful in pulling together all the
> testifiers. So that being said, if folks want another meeting there
> are a lot of people absent I think it would be fine we just wanted
> folks\'s input on that.
>
> **[\>\> John Houston:]{.underline}**
>
> I think it would be helpful to have another meeting. One of the things
> I realized before I went on NVCHS - there\'s the way to hold an
> effective meeting and the way to hold an ineffective. I think the
> members need to understand exactly how they want the hearing to
> progress, but at the same time I think we also need to make sure we
> get the rules outlined for the people that are going to speak. Because
> they can waste a lot of time giving us senseless background that
> frankly just simply bogs the meeting down or the hearings down.
>
> So I think it would be helpful to make sure we\'re all on the same
> page exactly how the hearings are supposed to be managed. The
> consensus whatever possible. Do people think that would be a good idea
> or conversely people who think we should just go ahead without an
> earlier meeting of the Workgroup.
>
> **[\>\>]{.underline}**
>
> I\'ve worked with NVCHS for a number of years as a staffer. I would
> suggest at least a few staff folks and co‑chairs should sit down
> before the hearing.
>
> **[\>\>]{.underline}**
>
> I should add the co‑chairs and the staff do have regular discussions.
> And those discussions clearly will be, we will be having those in
> advance of the meeting. I don\'t think we could have the hearing
> without that. The question is whether we want to try to convene in a
> session like today, you know, ideally an hour rather than two or three
> hours perhaps but try to get the full Workgroup together one
> additional time prior to that meeting at the end of September. That\'s
> really ‑‑ we clearly will have staff discussions and co‑chair
> discussions.
>
> **[\>\>]{.underline}**
>
> I think if we could do it by conference call I think it would be
> beneficial given that this will be our first one and we want to come
> out of the gate doing this really well so that we can get a track
> record of running smooth meetings and being able to really glean a lot
> of good information out of the people doing the testimony.
>
> So I think it would be good if we can do something that\'s an hour
> long conference call that wouldn\'t impact a lot of schedules and
> wouldn\'t also require a lot of leg work on your part getting the
> meeting pulled together. That would be the preferred.
>
> **[\>\>]{.underline}**
>
> Why don\'t we anticipate that. As you said, earlier rather than later.
> Because earlier we will need input on questions and potential topics,
> potential witnesses, et cetera. But maybe the idea would be, I\'m
> going to throw this out a little making up as we go along maybe a week
> or so in advance so we have a list of people that are testifying, we
> can share that, get that around, get people ‑‑ maybe that would be the
> idea. Does that make sense?
>
> **[\>\>]{.underline}**
>
> Sure.
>
> **[\>\>]{.underline}**
>
> So we will get back with potential times for that call now. The idea
> would be to have the group get together for an hour or so by
> conference call. Enough in advance of the September 29th date to be
> effective but won\'t be next week.
>
> **[\>\>]{.underline}**
>
> I have a question for you. You talked about that you can, well
> there\'s a difference between a good hearing and a not so good
> hearing. And it sounded like part of it was the advice given to folks
> who are testifying to make that time useful. Are there things you have
> in writing already or wisdom you can share with us sooner rather than
> later maybe off line so we can help write the questions?
>
> **[\>\>]{.underline}**
>
> It\'s real simple. I mean it all comes down to the questions and I
> don\'t think there\'s any wisdom. I\'ll share it with you online
> because it\'s real easy. A, you have to make sure that the testifiers
> stay on point. And the issue always is if the testifier comes in and
> decides they want to spend 10 or 15 minutes telling you about
> themselves or they\'re trying to do some type of a sales pitch, and
> they don\'t get to the meat of the questions that they\'re being asked
> to answer, then what you end up doing is wasting a lot of time trying
> to get them to the point where they\'re going to tell you something.
> So I guess my advice is simply that yes, you\'ve got to have questions
> in advance. You ask for testimony in advance. And if they want to
> have, give background information, that\'s great. And then we can
> circulate that for people to read. But then when they get there you
> would really like them to stay focused on specifically addressing the
> questions that you\'re posing to them so that you can minimize the
> amount of wasted time. I think that\'s just simply the way you have to
> structure it. You have to be very blunt with them - that\'s really
> what we\'re asking them to do and not give a lot of background.
>
> **[\>\> David McDaniel:]{.underline}**
>
> Having testified to NVCHS, I think giving that real good instruction
> in advance does take a lot of heat off the testifier to know exactly
> what the committee is looking for, what the Workgroup wants to hear
> and bring forth all the needed information. If we\'re very vague in
> giving that information, we will get people who will ramble and will
> go away with not a lot of information. If we\'re very explicit as to
> what we want to hear about, those will be really good testimonies that
> we\'ll get.
>
> **[\>\> Jeanette:]{.underline}**
>
> Would it be helpful, I think the Workgroup needs to have a better
> sense of the scope especially in the area of authentication and
> identity manage. It\'s so broad and there\'s so many ways the
> Workgroup can go. Why are we rushing into a hearing at the end of
> September? Does it have to be at the end of September? Could it be
> mid‑October to allow for a full Workgroup meeting first to adequately
> plan the hearing so we\'re not rushing?
>
> **[\>\> Jodi Daniel:]{.underline}**
>
> I\'ll try to answer this. From our standpoint, we\'re constantly at
> ONC being asked to do things yesterday. This is one of those cases. We
> have these four breakthrough areas that have been charged by the
> American Health Information Community last January and the goal is to
> have demonstrable results. As breakthroughs we\'re trying to hash
> through them and have some recommendations earlier rather than later
> because if they\'re going to be some pilots and demonstrations and
> things that need to be planned and need to be going forward, if we\'re
> coming up with recommendations six months down the road, then we will
> have missed an opportunity to get those issues addressed through some
> of these projects. From our standpoint we\'re trying to come up with
> issues that were not, that were important but that were manageable
> early on so that we can hopefully have some recommendations later this
> year that could be incorporated into some of these break‑through
> projects.
>
> **[\>\>]{.underline}**
>
> Just to follow on to that. I think there\'s a couple of points. While
> John and David and others have talked about the importance of having
> this hearing and setting it up right we obviously want to make sure
> that works. It\'s also a little bit of a dry run for the group. We
> wanted to have something that\'s a piece that\'s not so small that it
> doesn\'t really advance the cause but again something that was a
> little more manageable. We may find we need another hearing on this
> topic. If there\'s new issues. I don\'t think that it\'s a question of
> this being our one and only chance but it\'s something that we wanted
> to try and get the group going and get at least ‑‑ we thought that
> having a concrete goal like that hearing would start to get the group
> coalescing and start to get, frankly, raise our awareness of what the
> issues were. We thought that would be helpful to do sooner rather than
> later.
>
> **[\>\>]{.underline}**
>
> Might I suggest that with the topics you\'re proposing that in terms
> of participants one way to get focused easily would be to see if some
> of the contractors Northrup Grumman and IBM and others, CSC could come
> and speak. They have a lot of experience because they\'ve been
> involved in these type of problems for some time now.
>
> **[\>\>]{.underline}**
>
> I think that\'s a reasonable suggestion that we can consider. I would
> also suggest that you know we want to make sure, I mean I know that
> this group is going to be one of the, one of the ones that just based
> on the number of folks in the room that we\'re going to have a lot of
> folks interested in. And we wanted to try to start chewing on some of
> the real hard issues as soon as we could rather than spending a whole
> lot of time planning. We have done a lot of back work with Kirk and
> Paul for about a month and a half now to try to figure out how best to
> set up this group to think through some of the first set of issues. So
> it\'s not like we\'re starting from ground zero right now there\'s
> been a little bit of thinking. And like I said those folks here
> working very closely with co‑chairs are committed to making sure and
> responsible for making sure that the hearing is pulled off. So you
> know we will be doing a lot of work in between meetings to make sure
> that that happens. So you know that\'s sort of our thinking on the
> fast paced here and actually just so you know there are folks who are
> at least at HSS wondering why we haven\'t had our first hearing yet.
> So some people think we\'re dragging our feet.
>
> **[\>\>]{.underline}**
>
> It was originally on the calendar for last week.
>
> **[\>\>]{.underline}**
>
> So we\'ve been pushing back to make sure that this is a successful
> hearing. And while that may seem like a really fast fast pace for some
> folks at HSS who are waiting results for this stuff we\'re dragging
> our feet, so we\'re trying to manage both sides of this. We\'ll do our
> best.
>
> **[\>\>]{.underline}**
>
> There\'s one thing I\'ll throw out there from NVCHS experience, where
> I\'m also a staffer. You know to try and use some of the transcripts
> from NCVHS as a launching point to sort of understand what the people
> who came there had to offer in terms of the specifics on some of these
> issues so that we\'re not re-inviting the same people to come in and
> say the same thing that they\'ve already said. Because I think to
> really move this forward you want to get very targeted in the question
> and you can use that as a background to interviewing some of your
> potential testifiers, that you know you essentially called them
> initially for background information. You really can, before you
> invite people to come, get a feel for what the whole scope of that,
> the issues are that could feed into that hearing and generate a lot of
> your specific questions to each person based on what they\'ve told you
> on the call what their expertise is, what their business has done. And
> if you do that in conjunction with the NVCHS transcripts I think you
> can probably get people to get very focused pointed feedback.
>
> **[\>\>]{.underline}**
>
> I also want to say one person who is not here who is also going to be
> staffing this work group is Mya Bernstein who is the lead staff to the
> NCVHS privacy and confidentiality work group. I believe that\'s the
> right name. Committee. And she\'s just on vacation today. But she\'s
> asked me ‑‑ and we\'ve been very much relying on her knowledge and
> expertise as well as Sara to make sure we have those perspectives and
> that we\'re not duplicating activities that have gone on at NVCHS but
> that we\'re also taking advantage of those discussions when we plan
> our hearing.
>
> **[\>\>]{.underline}**
>
> I guess the other cut might be to the extent that the other Workgroups
> have identified how, what they need to know about these issues, that
> would be very, very useful to be as specific as possible. I totally
> agree there\'s stuff that we\'ve heard before and we\'ll hear again
> and maybe we can skip this time.
>
> **[\>\>]{.underline}**
>
> I think we were supposed to say this earlier but I\'ll say it again.
> We\'re going to have our public input ‑‑
>
> **[\>\>]{.underline}**
>
> Yeah, are you ready?
>
> **[\>\>]{.underline}**
>
> I think we\'re supposed to queue them up.
>
> **[\>\> Matt McCoy:]{.underline}**
>
> There is a slide on the Internet right now for members of the public
> who are following along on the Webcast. They will see a phone number
> and instructions for calling that phone number and queuing up to make
> a comment.
>
> If anybody gets in that way, I will let you know that somebody is on
> the line and waiting to speak. We can also take comments from members
> of the public who are in the room just ask once again if somebody is
> going to make a comment they get up close to a speaker phone so that
> everybody listening remotely can hear what they\'re saying.
>
> **[\>\>]{.underline}**
>
> Any comments from the room?
>
> **[\>\> Jim Piles:]{.underline}**
>
> Jim Piles with the American Psychoanalytic Association. I want to
> thank the group for taking up this very important issue. As Paul says,
> it\'s probably one of the most important issues we can consider in
> health IT because we know if the public doesn\'t participate and
> doesn\'t trust health IT they won\'t use it. I\'ll go a little step
> farther than what Paul said. It\'s not that privacy and health IT are
> compatible or certainly not incompatible. I think strong privacy
> protections are essential for health IT and for the public\'s trust to
> use it. With that in mind, though, and also I wanted to second the
> comments from the fellow from the VA. I think you probably know this
> from better experience, it\'s a good idea to put these things in at
> the beginning. To make sure you don\'t have to go back and do it
> later. It\'s more expensive if you have to put in privacy protections
> in retrospectively.
>
> But I just wanted to pick up on a thread that Mr. Houston mentioned,
> and that is perhaps the need for a framework and I know NVCHS has done
> a lot of good work in this area. I know it\'s a desire to come up with
> some specific practical solutions. But when we look at something like
> identity proofing, the question is to what purpose. Why would we want
> to do that? Unfortunately, I think one of the reasons that there\'s a
> need for a group like this is that there has been an effort to go
> forward with health IT with certain specific standards and technical
> standards, without first looking at and examining what should the
> general privacy principles be. Do people have the right to privacy.
> Should it be protected? Is it something that they should be able to
> assert, identity proofing I guess goes to the question of control.
> Should an individual have some control over the disclosure of their
> information. So I would hope one thing this group might do is during
> its deliberations I think it would be a great service to perform is if
> it could identify certain general privacy principles, which NVCHS has
> started doing, which I\'ll add to their credit. And second, I think a
> huge service this group could provide to AHIC would be to at least in
> some sort of background paper identify the privacy protections that
> are already out there that apply across state lines. Constitutional
> protections. Standards of medical ethics. Physician patient privilege.
> Every state except South Carolina has one. Psychotherapist patient
> privilege. All 50 states have that. These are things that have been
> recognized in various federal documents and never pulled together in
> one spot as far as I know. I think that would be a great background
> document to have and it might help you establish a framework for a
> more specific recommendation. Thank you.
>
> **[\>\> Ross Martin:]{.underline}**
>
> This is Ross Martin with Pfizer and I\'m a member of the Consumer
> Empowerment Workgroup. So first want to say big hurrah. I\'m glad this
> group is coming together. Very glad to hear it was elevated to the
> level of an independent Workgroup rather than a subgroup of the
> Empowerment Workgroup. I think that does speak a lot to the importance
> of this and recognition of that as an issue.
>
> Having said that, I do hope that as you tease out both your speaker
> list for this hearing and the hearings to come and et cetera, that you
> do ‑‑ I\'m sharing this based on just a lot of the thinking that went
> into why we were recommending first the creation of the group and why
> we thought it should be under the Consumer Empowerment Workgroup in
> the first place. First, we need to have a consumer focus. It has to be
> about what are the patients saying they want this thing to do for
> them. And that\'s not just about how consumers will be identified and
> will be authenticated. But for the benefit of the patients, how will
> providers and others similarly have access to the system? I also want
> to just pose a question about the, in the recommendations about area
> one, it talked about using Prudential as identity and bring out
> Prudential\'s use for identity management. This is especially for
> people who have multiple licenses or either across state lines or
> multiple certifications in terms of their board certification, board
> approval, prescriptive authority those kinds of things. Would
> encourage you to look at those in terms of that topic of identity
> management.
>
> One other issue that I think that would be worth looking at is as a
> committee to be really thinking about this question of the benefits of
> a unified perspective of answering these questions. What I mean buy
> that is we\'ve done a lot of, you know, local, state \[inaudible\]
> federal initiatives around these issues. And any solution that we put
> together technical- or policy-wise or otherwise will be much more
> beneficial if there can be one way of doing it, more often than not.
> Obviously we\'re never going to probably get to that one thing that I
> can write prescriptions with and get authentication, I can also start
> my car with.
>
> But that has actually a goal. So not only just thinking about
> healthcare but thinking beyond how do we do this as a matter of course
> of identity authentication, and what would be the ultimate benefits of
> that if we can do that. Really mapping that out trying to come up with
> some potential return investment numbers for that could do a lot to
> help people understand why it\'s worth it to invest heavily in this
> infrastructure. That\'s it. Thank you.
>
> **[\>\>]{.underline}**
>
> This is Bill \[inaudible\] from the E Health Initiative. I wanted to
> point out that a lot of work has been done on identity proofing. We
> all have gone to a notary public to get our identities proofed we
> should not forget to include the people who have written the model law
> that states have passed for identity proofing for everything else in
> the world just because we\'re talking about healthcare.
>
> They\'ve also come up with a new model law that includes electronic
> identity proofing, but I don\'t think any, if maybe a few, but I
> don\'t think any states have adopted it. But at least it\'s out there
> and people have been working on it and thinking about it so we ought
> to include them in our inputs. Thanks.
>
> **[\>\>]{.underline}**
>
> Matt, is there anyone on the line?
>
> **[\>\> Matt McCoy:]{.underline}**
>
> No we don\'t. I should note as well actually there\'s an e‑mail
> address also on line. So if people are following along and don\'t want
> to speak up with a comment right now they can certainly forward a
> comment or a question that will then be forwarded on to the co‑chairs
> and staff for this Workgroup. But we don\'t have any callers today.
>
> **[\>\>]{.underline}**
>
> Okay.
>
> **[\>\>]{.underline}**
>
> I think we\'ve done it. We\'ve had our first meeting. We\'ll be
> meeting between now and the other hearing. And we hope that you will
> all be able to make it and bring your questions. It was really
> interesting, I have to say, that I know very little about this stuff,
> I will admit freely. And just hearing the brief conversation was
> actually quite informative. So I\'m imagining there\'s a great deal of
> learning to occur for any of us. Happy to have it.
>
> So again thank you for being here and thank you for your service as
> members of this group. And we\'ll see you soon and talk with you
> sooner.
>
> **[\>\>]{.underline}**
>
> Thank you.

**[\>\>]{.underline}**

Thank you.