American Health Information Community

Confidentiality, Privacy & Security Workgroup Meeting #7

Tuesday, February 20, 2007

**Disclaimer**

*The views expressed in written conference materials or publications and
by speakers and moderators at HHS-sponsored conferences do not
necessarily reflect the official policies of HHS; nor does mention of
trade names, commercial practices, or organizations imply endorsement by
the U.S. Government.*

[**\>\>**]{.underline}

We\'re ready to go.

**[\>\> Judy Sparrow:]{.underline}**

Okay. Good afternoon, and everybody welcome to the seventh meeting of
the Confidentiality, Privacy, and Security Workgroup. Just a reminder
that we are operating under the auspices of the Federal Advisory
Committee Act, which means that there will be opportunity at the end of
the meeting for public comment. Also, this meeting is being broadcast
over the Internet, and members are asked to speak clearly and
distinctly, and identify yourself before speaking.

Let\'s go around the room here and identify who is here from the
committee and then Jennifer, if could you introduce those on the
telephone. We have \--

**[\>\>Mazen Yacoub:]{.underline}**

Mazen Yacoub, on behalf of Sam Jenkins from the TMA Privacy Office.

**[\>\> Steve Posnack:]{.underline}**

Steve Posnack, ONC.

**[\>\> Kirk Nahra:]{.underline}**

Kirk Nahra, Wiley & Rein.

**[\>\> Yuri Dzambasow:]{.underline}**

Yuri Dzambasow, consultant to ONC.

**[\>\> Jodi Daniel:]{.underline}**

Jodi Daniel, ONC.

**[\>\> Jill Dennis:]{.underline}**

Jill Dennis, AHIMA.

**[\>\> Judy Sparrow:]{.underline}**

Great. And Jennifer, if you could tell us who is on the telephone,
please.

**[\>\> Jennifer Macellaro:]{.underline}**

Sure. On the phone today we've got Tom Wilder from America\'s Health
Insurance Plans. Deven McGraw from the Partnership for Women and
Families. Don Detmer from the Medical Informatics Association. Dennis
Seymour from the VA. Zinethia Clemmons from the Office for Civil Rights.
Peter Basch from MedStar Health. Steve Davis from the Oklahoma
Department of Mental Health and Substance Abuse Services. And Flora
Hamilton from the \[Family and\] Medical Counseling Service. Did I miss
anyone?

[**\>\>**]{.underline}

No.

[**\>\>**]{.underline}

Okay.

**[\>\> Judy Sparrow:]{.underline}**

Okay. I think we can now turn it over to the co-chairs.

**[\>\> Kirk Nahra:]{.underline}**

Good afternoon, everybody. Welcome. This is Kirk Nahra. We have a number
of things we\'re going to try to cover today. We also envision having
some time for additional discussion of our work plan and priorities over
the next few months.

The materials that were sent out included summaries of our last couple
of meetings. We need, I guess, to get approval of those. Anybody have
any particular comments or questions about those minutes? Do we need a
formal approval? We\'re going to pause for a second. We have a big group
coming in. I\'m guessing there was a tie-up downstairs.

**[\>\> John Houston:]{.underline}**

John Houston, I\'m on the line now.

[**\>\> Kirk Nahra:**]{.underline}

Hi, John. Those individuals who just joined us on the Workgroup, could
you also just identify yourself quickly?

**[\>\> David McDaniel:]{.underline}**

David McDaniel, Department of Veterans Affairs, Veterans Health
Administration.

[**\>\> Alison Rein:**]{.underline}

Alison Rein, National Consumers League.

**[\>\> Kirk Nahra:]{.underline}**

Anyone else from the Workgroup? We\'re just getting started. If people
have questions \-- I don\'t know if everyone\'s had a chance to take a
look at the meeting summaries, if you have questions or comments over
the course of the meeting, you can just let us know. They look to be
perfectly reasonable summaries of what our discussions were.

I guess there\'s a next point, one of the things that\'s happened since
we last met is that we participated in really our first AHIC meeting.
And I\'d like to turn that over to Jodi to talk about what went on in
the AHIC meeting, and in particular the focus of discussion of our
Workgroup recommendations.

[**\>\> Jodi Daniel:**]{.underline}

Sure, Kirk. Welcome, everyone. Both Paul Feldman and I presented at the
AHIC, we presented the letter with the recommendations that we had all
discussed at the prior meeting, and brought them forward to the AHIC. We
had a general statement which we talked about but then asked for
specific feedback on, and then we had five recommendations that went
into the, that we had presented to the AHIC.

Paul and I were actually both please, a little bit surprised, but
pleased that the first four recommendations pretty much sailed through
without much comment. I think it\'s sort of a testament to the fact we
did spend a lot of time on these and came up with a good product or I
hope that that\'s the case. So the first four recommendations were
accepted by the AHIC, and will be sent to the Secretary as formal AHIC
recommendations for identity proofing.

The fifth one, which is on the agenda for us to discuss today, there was
a little bit more discussion about that fifth recommendation and what it
meant for CCHIT to develop certification criteria for identity proofing
practices. I think some of the concern, and when we talk about this,
others can voice their opinions as well, as far as what they heard. But
some of the concern was are we really talking about processes or
functionality and, of the systems themselves. And so there was a
recommendation by the AHIC members that we just go back and refine this
one and present it back again at the next meeting, which is in March.
March 13th. So that\'s on the agenda for today.

We also talked about next steps in some of the conversation that we had
as a Workgroup as far as our next steps. And there was \-- they didn\'t
discuss those at all. So we\'re going to, one of the things on the
agenda today is to talk about our next steps, our work plan and
priorities and further applying our thinking on that as well so we can
sort of jumpstart the next issue of our agenda.

But, you know, quite frankly, I think it went pretty smoothly and it was
sort of a, I think a good first step for this Workgroup and a good
accomplishment for this Workgroup to come up with recommendations that
folks really agreed to sign off on pretty easily. The other thing, just
as a reminder, that we noted to them and that we\'re going to be talking
about a little bit later is identity proofing, or actually next, is
identity proofing, patient identity proofing where there is no prior
relationship. And that was something we had tabled, as you recall, from
our last meeting. So we will have a further discussion on that and we
did not present any recommendations on that topic.

Was there anybody else who attended that had other thoughts or wanted to
share their perspective, what they heard at the meeting?

**[\>\> Kirk Nahra:]{.underline}**

Jodi, could you just give us a little more sense of what, I mean what
the concern was with the number 5?

[**\>\> Jodi Daniel:**]{.underline}

Yeah, I think it\'s two things. One, there was some question about some
of what our recommendations were were about practices, like business
practices. And CCHIT certifies product. And so there\'s some question
about what does it mean for CCHIT to come up with criteria. And I think
what we were trying to say as a Workgroup, is that it was where it was
applicable and there\'s some things that may not be applicable, there
might be some things that help support those practices from a systems
perspective. But there was some question about that.

And then my other, just my own personal guess of what was going on was
that the Consumer Empowerment Workgroup has been having some discussion
about whether or not CCHIT or another certifying body should be coming
up with criteria for PHRs at this time. And since that conversation was
coming up at the meeting as well, I think there was some confusion as to
whether or not there was, accepting this recommendation might be
inconsistent with the CE indecision on what to do with that.

So I think there was some confusion of those two issues that also came
about. I don\'t know if other people heard anything else as far as the
concerns they were raising on this. Is Paul Uhrig on the phone?

**[\>\> Kirk Nahra:]{.underline}**

He was not on the phone.

[**\>\> Jodi Daniel:**]{.underline}

Okay, because Kevin Hutchinson \-- I\'m sorry?

\[inaudible\]

[**\>\> Jodi Daniel:**]{.underline}

Oh, he's in New Zealand?

\[inaudible\]

[**\>\> Jodi Daniel:**]{.underline}

I was just asking because Kevin Hutchison is on the AHIC and had been
one of the people raising some comments.

[**\>\> Kirk Nahra:**]{.underline}

Were there any other highlights of the AHIC meeting that would be useful
for people to know about?

[**\>\> Jodi Daniel:**]{.underline}

The Consumer Empowerment Workgroup presented and one of the
recommendations which we\'ll have somebody talk about the Consumer
Empowerment work in a little bit later this afternoon, but they came up
with one recommendation about working with this Workgroup on privacy
policies for personal health records and the AHIC thought that, great,
go ahead and work together on this. So that was one issue and we\'ll
talk a little bit about the Consumer Empowerment Workgroup and where
they are on this discussion. And how best we might be able to work with
them.

There were also the NHIN prototypes that were demonstrated at the
meeting. And they were also demonstrated again at a forum a week later.
So that was just an information sharing opportunity to let folks know
what was coming out of the demos.

Trying to think if there\'s anything else relevant to this Workgroup
that \-- anybody else have anything else to add as far as what was
discussed that might be of interest?

[**\>\> Kirk Nahra:**]{.underline}

Good, well, there will be another meeting coming up in mid-March, as
Jodi indicated, and we\'ll give a report back after that meeting as
well.

All right. Why don\'t we move on to the next topic on our agenda which
is to try to close some loops on the couple of open issues from our
first set of recommendations related to patient identity proofing. Why
don\'t we start with the piece that we had made a recommendation on
where we were asked to look at our recommendation again. And can I turn
that over to Steve to talk about sort what the new proposals are and
what we\'re going to be discussing on that today?

[**\>\> Steve Posnack:**]{.underline}

Sure. Thank you Kirk. For everybody on the phone, I will sound these
out, hopefully articulately and clearly. We have two options that were
proposed. Everybody on the Workgroup got one sent to them late last
week. And I\'m sorry that we couldn\'t get these up on the Web but it\'s
been a work in progress up until this morning. So option 1 is from one
of the Workgroup members, we also made a slight modification to the
wording, so I hope that that will work for them.

This one is \-- so we can refer to this as option 1. Where applicable,
the Certification commission for Healthcare Information Technology,
CCHIT, should develop functional security criteria for software systems
to help support the identity proofing processes represented in the
January 23rd AHIC CPS recommendations.

[**\>\>**]{.underline}

I want to \-- read that again.

[**\>\>**]{.underline}

Read that again? Slow.

[**\>\>**]{.underline}

Slowly, so people can jot it down.

**[\>\> Steve Posnack:]{.underline}**

Where applicable, the Certification Commission for Health Information
Technology should develop functional security criteria for software
systems to help support the identity proofing processes represented in
the January 23rd AHIC CPS recommendations.

[**\>\> Kirk Nahra:**]{.underline}

I don't know if we have this in front of us, if anyone has this, but
would it be useful to have the old recommendation, just so we can get a
sense of what the changes are?

[**\>\> Steve Posnack:**]{.underline}

I have it right here. The old one that we presented to the AHIC said
where applicable, the Certification Commission for Healthcare
Information Technology should develop certification criteria for the
systems and networks they certify to support the identity proofing
practices in these recommendations.

[**\>\> Jodi Daniel:**]{.underline}

So the primary difference, and this was based on what we were hearing,
some folks were saying they wanted clarity on, that this is not
processes, that this was about the security criteria. CCHIT will certify
three different types of criteria: interoperability criteria,
functionality criteria, and security criteria. And make it clear that
this is falling in the security criteria bucket and it's about the
functional criteria for the software as opposed to the business
processes. So I think that\'s pretty much the substantive difference of
this compared to the prior recommendation.

[**\>\> Kirk Nahra:**]{.underline}

You said there was a functionality category. And this, this has the
words functional security. What\'s the functionality category? Is that
something different, or are we \-- is that going to cause any problem if
I\'m mixing those terms?

**[\>\> Steve Posnack:]{.underline}**

Why don\'t we go through option 2 and see if we want to marry the two
\--

[**\>\> Kirk Nahra:**]{.underline}

I don\'t have a sense of what functionality \--

[**\>\> Jodi Daniel:**]{.underline}

Well, for instance, if it\'s functionality for the electronic health
record, it might say that they have to be able, that the software has to
be able to support sending an electronic prescription to a pharmacy.
That would be a functional criteria that the software must be able, must
possess in order for it to pass certification.

So yeah, that\'s, I think it was sort of to try to, we might need a
different word for that. That\'s a good point. But the process \-- the
point was to try to say that it was about the system \-- the functions
of the system, rather than the business processes, so maybe we need
another word to make that clearer, but \--

[**\>\>**]{.underline}

Are we really talking about system requirements?

[**\>\>**]{.underline}

Right, and those could be technical criteria, as well as functional
security criteria but the point is it\'s aimed at the functioning of the
system. That\'s how I\'m reading it anyway.

[**\>\> Kirk Nahra:**]{.underline}

Let me ask this and I know we have option 2, as well, to talk about, but
does the word functional add anything to the idea of security criteria?
Can we just take that out?

[**\>\>**]{.underline}

I think it\'s better if it\'s removed because it seems to me it puts a
limitation on the kind of security criteria they might \--

[**\>\> Kirk Nahra:**]{.underline}

Let\'s hold that thought. Steve, why don\'t you go throughout second \--

[**\>\> Steve Posnack:**]{.underline}

That foreshadows option 2 which I will read. So option 2 will read:
Where applicable, the Certification Commission for Healthcare
Information Technology should develop security criteria for health
records and networks to ensure that software systems have functionality
that, wherever possible, supports the identity proofing processes
represented in the January 23rd AHIC CPS recommendations.

**[\>\> Jodi Daniel:]{.underline}**

Does anybody need that read again?

[**\>\> Kirk Nahra:**]{.underline}

Go ahead and read it again.

[**\>\> Steve Posnack:**]{.underline}

Where applicable, the Certification Commission for Healthcare
Information Technology should develop security criteria for health
records and networks to ensure that software systems have functionality
that, wherever possible, supports the identity proofing processes
represented in the January 23rd AHIC CPS recommendations.

[**\>\> Kirk Nahra:**]{.underline}

Now, a couple of distinctions. And again, I\'m struggling a little bit
to think through the implications of the distinctions. The first option
talks about security criteria for software systems. The second one says
security criteria for health records and networks to ensure that
software systems have functionality. So \--

[**\>\>**]{.underline}

I guess for me, part of it is defining it as an electronic health record
would help clarify option 2. And really we\'re not talking about all
networks. We\'re only talking about networks that support those
electronic health records. So that defines that a little bit better.
That\'s what\'s really snagging me on that particular option.

[**\>\>**]{.underline}

The other thing that bugs me on that option is they don\'t, I mean,
CCHIT doesn\'t really develop criteria for health records. They develop
criteria for software products. So that\'s where I start to think it
goes a little astray.

[**\>\>**]{.underline}

In option 1, does software systems exclude anything except the qualifier
that we have at the end of that? I\'m just trying to think if we leave
out \-- by using that term, would we leave out something that we would
want to include? Because my preference is that term versus option 2
terminology. But I just want to make sure that I\'m not missing
anything.

[**\>\> Kirk Nahra:**]{.underline}

I guess here\'s the distinction. I mean, do the security criteria apply
to health records or do they apply to the software systems?

[**\>\>**]{.underline}

I would say they do both but the domain of CCHIT is the software, not
the bigger picture.

**[\>\>]{.underline}**

And what clouds the issue is if you\'re talking about a particular
electronic health record, you are talking about software, like in our
organization when we talk about VistA, we\'re talking about our
electronic health record. But it is a software. It in turn manages all
the data that makes up what we traditionally think of as a health
record. I think that\'s, we\'re using that word two different venues
here. We need to break through that somehow.

[**\>\> Kirk Nahra:**]{.underline}

Well, let me generalize from our discussion so far, and I\'m not meaning
to cut this short, but it sound like there\'s \-- well, let me throw
this out and see if people have a reaction to it. It sounds like
there\'s a general preference of these two for the approach taken in
number 1 rather than the approach taken in number 2. Is there anyone who
doesn\'t agree with that?

**[\>\> Peter Basch:]{.underline}**

This is Peter Basch. Can I ask you to read option 1 one more time? I\'m
sorry to appear dense but I\'m really struggling with the implications
of the subtle changes in words and what we think they mean versus what
the AHIC had in mind when they requested the change.

**[\>\> Steve Posnack:]{.underline}**

Sure. Option 1 is where applicable, the Certification Commission for
Healthcare Information Technology should develop functional security
criteria for software systems to help support the identity proofing
processes represented in the January 23rd AHIC CPS recommendations.

[**\>\> Peter Basch:**]{.underline}

Okay, that\'s option 1.

**[\>\> Steve Posnack:]{.underline}**

Correct.

[**\>\> Peter Basch:**]{.underline}

Yeah, I actually like that better. And I think it puts the request to
CCHIT, as other members have related, on topics that are germane to the,
to what they can do. Which is essentially talk about functional
specifications and not to certify procedures or how they\'re used. Yeah,
I think option 1 is a good one.

**[\>\> John Houston:]{.underline}**

This is John Houston. Was that option 1, that sounds like the one \--
that I wrote pretty much. Is that correct?

[**\>\> Steve Posnack:**]{.underline}

That\'s correct with the exception we changed "that address" to "help
support".

[**\>\> John Houston:**]{.underline}

Okay. That's what I thought.

[**\>\> Don Detmer:**]{.underline}

This is Don Detmer. I have a question. I think it reads okay but I\'m
kind of curious, does anyone else discriminate between security and
confidentiality criteria?

**[\>\> Jodi Daniel:]{.underline}**

I think the only \-- that's CCHIT, their terminology. They have three
buckets for which they develop criteria, one of them they call security
criteria. That was the only reason we used that term.

[**\>\> Don Detmer:**]{.underline}

Thank you. That\'s helpful.

**[\>\> Steve Davis:]{.underline}**

This is Steve Davis. I have a question about the reference to security
criteria and maybe it\'s just my use of terminology, but it seems to me
that better wording might be develop evaluation criteria for the
security elements of health information software or electronic health
records.

[**\>\> Kirk Nahra:**]{.underline}

Can you say that again? I'm not sure I followed that.

[**\>\>**\
]{.underline}CCHIT should develop evaluation criteria for the security
elements of health records and software that include functionality that
we\'re interested in. The identity proofing processes. Aren\'t they
really establishing the criteria by which those elements are, the
security elements are going to be evaluated, or assessed?

[**\>\>**]{.underline}

They do both, don\'t they? I mean, they have to develop criteria, but
then they also have to use them in order to certify a product. So I
think, I mean, I think that in order to certify, they have to go through
that process and to my knowledge that\'s a public process so people have
been commenting on those criteria.

[**\>\> Steve Davis:**]{.underline}

But you\'d want the operational criteria in place as well because if you
don\'t get the operational criteria then the evaluative piece \-- I
guess you can make the assumption that they\'re one and the same but you
really couldn\'t make that assumption if you\'re putting that
expectation on them to develop it.

[**\>\>**]{.underline}

Is that the CCH term, criteria?

[**\>\>**]{.underline}

Yes.

[**\>\>**]{.underline}

As opposed to standard or \--

[**\>\>**]{.underline}

Yes.

[**\>\>**]{.underline}

The criteria against which they will then evaluate for determining if a
product should be certified.

[**\>\>**]{.underline}

So it\'s not passing over to them the decision-making role in terms of
what the criteria is should be. They just look at what we want to
achieve through identity proofing and translate that into a standard for
the software?

[**\>\>**]{.underline}

Well, yes. That they would then evaluate against, yes. I think that\'s
correct, if I understand what you\'re saying.

[**\>\> Kirk Nahra:**]{.underline}

Well, let\'s continue with option 1 as our focal point. I had suggested
dropping the word \"functional.\" Are there any objections to that?

[**\>\>**]{.underline}

Can you restate your reason for wanting to drop the word functional,
please?

[**\>\>**]{.underline}

Well, as I understand what CCHIT does, they have these three buckets,
they have a security bucket and a functionality bucket. And on the one
hand it struck me, we were, our earlier recommendation was sent back
because it was confusing and not clear what we were asking, I gather.
I\'m worried about that word creating its own confusion, and then to a
point that Jill made, which is it may also be too limiting. So my
suggestion was we want them to develop security criteria, I\'m not sure
what functional adds to that and the way I would read it absent the rest
of their buckets would be develop security criteria that work. I mean,
that\'s, I assume that\'s what they would do.

[**\>\>**]{.underline}

Yeah, the reason I\'m asking the question is I just wonder for the way
that CCHIT thinks and uses terminology, if the word functional is a
necessary descriptor. For example, if they were asked to create quality
requirements for an electronic health record, do they term it as
functional requirements for quality improvement or would they actually
term it as a quality measures? This may be the way they think and look
at how electronic systems work, and it\'s possible that we may want to
have a conversation with somebody at the Certification Commission to see
if the language that makes more sense to us is something they would feel
uncomfortable with.

[**\>\> Kirk Nahra:**]{.underline}

Let me ask, I mean John, I gather this was largely your drafting. Was
that part of your thinking, or was that \--

[**\>\> John Houston:**]{.underline}

I just \-- I wish I could say it was that deliberate.

[**\>\> Kirk Nahra:**]{.underline}

That was my sense, it was an unanticipated consequence of that.

[**\>\> John Houston:**]{.underline}

Yeah.

[**\>\> Kirk Nahra:**]{.underline}

So it wasn\'t prepared with that additional element in mind.

[**\>\> John Houston:**]{.underline}

No, I was just trying to make it \-- I thought it addressed \-- I was
just trying to clean it up to address what I thought the AHIC was asking
us to do and I thought it read better.

[**\>\> Kirk Nahra:**]{.underline}

My concern is, to follow up on the earlier point, this will create more
confusion rather than less confusion because of that functionality
bucket. I don\'t want them to come back and say we don\'t understand,
are you putting it \-- which bucket are you putting it in, functionality
or security?

[**\>\>**]{.underline}

Is it both?

[**\>\> Kirk Nahra:**]{.underline}

That\'s what I don\'t understand the functionality is. But if there\'s a
bucket \-- if we want it to be in two buckets, we should be clear that
we want it to be in two buckets. I don\'t personally understand what
that other bucket is.

[**\>\>**]{.underline}

Well, wouldn\'t functionality for security be the software that enables
the processes that we\'re recommending rather than them, CCHIT itself,
kind of being somebody who states what those processes are? That\'s kind
of why I like the term functionality and I\'m willing to drop my
objections if the rest of the group feels that it doesn\'t make that
much of a difference.

**[\>\> Don Detmer:]{.underline}**

I\'m wondering whether it might be smarter \-- this is Don Detmer \-- to
have the chairs kind of pursue that. It\'s also possible \--

[**\>\> Kirk Nahra:**]{.underline}

You\'re cutting in and out.

[**\>\>**]{.underline}

My point is that we ought to, I think, go ahead and let the chairs
decide which, whether the word stays in or out. There\'s a possibility
that functionality might relate to interoperability which in fact I
think we want.

[**\>\>**]{.underline}

Interoperability.

[**\>\>**]{.underline}

That\'s the third bucket.

[**\>\>**]{.underline}

Now it\'s in all three buckets.

\[laughter\]

[**\>\>**]{.underline}

I guarantee you they\'ll take it up.

[**\>\> Jodi Daniel:**]{.underline}

It seems to me, what I was hearing at the AHIC and if others heard
anything else, please speak up. What I was hearing was that at this
point in time CCHIT has been evaluating the criteria for the software
itself as opposed to the business processes that a user of the software
might implement. And that that\'s what they were looking for
clarification on.

So just so you know, option 1 is still very similar to what we had
before. And so the question is, how do we make that clear, that we\'re
talking about the criteria of the software as opposed to the processes
of the user?

**[\>\> Peter Basch:]{.underline}**

And that\'s \-- this is Peter Basch. That is exactly the point I was
trying to make and I think you made it far more eloquently than I could.

**[\>\> Kirk Nahra:]{.underline}**

Although it says security criteria for software systems, it\'s just not
clear to me what functional adds to that. Again, I read that without the
added concern about this other bucket as saying, should develop security
criteria for software systems that are effective, or that function. I
mean, we wouldn\'t tell them to come up with things that don\'t work.

[**\>\>**]{.underline}

But I think we want to make it clear that we\'re not developing, or
we\'re not asking them to develop security criteria for the business
processes that people use them. And I think that is the point of
confusion. And I think Don\'s suggestion is you\'ve heard enough
discussion on this and we should leave it to the chairs to work it
through.

[**\>\>**]{.underline}

Do you want to replace functional with technical or did somebody ask
that before?

[**\>\> Kirk Nahra:**]{.underline}

Jill made the point that you often hear descriptions, and if I get this
wrong, Jill, let me know. You hear often both functional and technical
as aspects of the security. And her concern was by saying the word
functional, not only do we have these other issues but we may in fact be
not asking them to do technical. Again, I don\'t have any ingrained
meaning of functional. I don\'t know if it\'s limited it that way. I
don\'t see \-- if we have the confusion about this other bucket and the
possibility that we\'re excluding something with that word, I don\'t see
what it adds.

[**\>\>**]{.underline}

We could add dis to the front of it. Disfunctional.

\[laughter\]

**[\>\> Kirk Nahra:]{.underline}**

I think we\'re doing that already.

\[laughter\]

Where do you want to go on this? I'm perfectly happy to leave it up to
the co-chairs.

[**\>\>**]{.underline}

I second that motion.

[**\>\>**]{.underline}

Sounds good.

[**\>\> Kirk Nahra:**]{.underline}

I will \-- Paul is not here today. We will run it by Paul. My sense at
this point, and again just for any last comment if people have a strong
objection, is to delete the word functional and otherwise keep that
recommendation, the option 1 recommendation the way it is.

[**\>\>**]{.underline}

Is there any benefit to making the explicit statement that this is not
intended to, for CCHIT to dictate the business processes of the user.

[**\>\>**]{.underline}

You could just have a parentheses, security criteria for software
systems, and then in paren, not the business processes. Or something
that, you know, \--

**[\>\> Kirk Nahra:]{.underline}**

I mean, what that does is it makes the relatively clear recommendation
longer. You guys tell me if that\'s necessary from the perspective of
people \-- I mean, I wasn\'t there to hear the questions being raised.
If you think that\'s a necessary clarification, I don\'t object to it.

[**\>\>**]{.underline}

Can you say that on the record?

[**\>\> Jodi Daniel:**]{.underline}

When we present it, we can make that clear.

[**\>\>**]{.underline}

The only question I would have is does it make sense to distinguish
between a system or a product. The CCHIT certify just products or \--
because the system could be an interconnection of a bunch of products.
Are they going to have criteria \--

[**\>\>**]{.underline}

Let me ask one other question. Was the concern out of the AHIC from a
particular individual?

[**\>\> Jodi Daniel:**]{.underline}

There are a couple folks that were commenting on this. I think some were
commenting because they were, they had somebody sitting in on the CE
Workgroup and they had heard something about the CCHIT recommendation,
that there was some controversy over it, and so I think some folks were
objecting because they didn\'t understand how the two related. And then
I think there were some folks who were concerned about making sure that
it was the software and not the business process. I think we heard a
little bit of both.

[**\>\>**]{.underline}

Does it make sense to reach out \-- are we allowed to reach out to those
people specifically and ask whether this meets their concern?

**[\>\> Jodi Daniel:]{.underline}**

Yeah, I don\'t see why not.

[**\>\>**]{.underline}

That might be another way make sure we\'re not back at the table next
meeting talking about this yet again.

[**\>\> Kirk Nahra:**]{.underline}

I will take away from this that we have some flexibility with the
co-chairs to sign off on a recommendation that looks basically like
this, we want it to clarify \-- we don\'t want this to get tossed again
on a technicality so we want to try to work that out. Not that I
wouldn\'t love to have another discussion of this at our next meeting.
But we\'ll try to get that worked out and we will send out to the
Workgroup our final recommendation. Leave it to our discretion. If it is
something that is significantly different from what we've talked about
today, we will distribute that in advance of signing off on it,
otherwise we\'ll take care of it from there.

Any last comments, I hesitate to say but any last comments on this? In
fairness and full disclosure, any last comments?

All right. Why don't we move on to the next point on our agenda, and
this point is, I expect, a little more substantive today rather than
trying to read tea leaves. When we met to finalize our set of
recommendations, we had a significant debate within our Workgroup about
whether there are appropriate identity proofing methods that can be used
in situations where no prior relationship exists. On the one hand our
group was very interested, I think, in in-person identity proofing as a
very good means of doing identity-proofing. We also had discussed some
of the options that are available for other than in person identity
proofing and we had lots of discussion about whether those other options
were sufficiently protective, sufficiently security and privacy
protective. So we very consciously did not make a recommendation on that
issue and we reserved that for sort of our next discussion point. And
what we\'d like to do today is give a presentation that Yuri is going to
do about his research into what identity proofing techniques exist in
the marketplace today to give us a sense of how that framework might be
translated into our recommendation. So with that, Yuri, why don\'t I
turn it over to you.

**[\>\> Yuri Dzambasow:]{.underline}**

Thank you, Kirk. Welcome to everybody. I want to acknowledge, too, a lot
of help from Steve and Jodi on this to help get it to the point of a
presentation today. And I\'d like to ask, please don\'t shoot the
messenger, I\'m just giving the research results.

**[\>\> John Houston:]{.underline}**

Excuse me. This is John Houston, there\'s a lot of background I think
coming from the main committee room. Is there a possible way to do
something to quiet it down a little bit?

**[\>\> Kirk Nahra:]{.underline}**

This is Kirk. I will take responsibility. I was opening a piece of
candy. It will not happen again.

[**\>\> John Houston:**]{.underline}

At least share it with us.

\[laughter\]

**[\>\> Kirk Nahra:]{.underline}**

If you could think of a way to do, that we\'d be happy to do it.

[**\>\>**]{.underline}

We\'ll send Fed Ex packages to everybody. I\'m kidding.

[**\>\> Yuri Dzambasow**:]{.underline}

Who is driving the presentation?

**[\>\>]{.underline}**

Just say "next slide".

[**\>\> Yuri Dzambasow:**]{.underline}

If we can go to the agenda slide, that would be great.

What I\'ll try to go through as quickly as possible and as much time as
Kirk allows, a brief introduction to give some framework around the
research performed. A little bit of analysis on the identity proofing
practices that were uncovered by the PHR providers. A couple of examples
of identity proofing practices provided by some non-healthcare entities
on what they\'re doing. And then some considerations for the working
group, as a result of the research. And if time allows and if there\'s
interest, there were some other research findings as well with relation
to privacy policies, authentication credentials, and SSL service
certificates, and we\'ll just sort of play that one by ear.

So we'll go on to the first introduction slide, on slide 3. And the
research started with looking at paring down a list. The list was
provided by Altarum, and then Steve Posnack provided it to me. There was
probably around 100 companies on that list. We sort of took about 50 of
them that were providing PHRs where those PHR providers had no prior
relationship with the consumer. And the research was based on publicly
available information off the company\'s sites. What we found was
there\'s basically two types of PHR providers, we called them offline
and online.

Offline providers are those that would provide an application or product
that a healthcare consumer could use, let's say in their own home, to
create a medical journal and just keep track of facts for themselves and
they would not network that PHR to an online environment.

And online PHR providers fell into two buckets. Either they were
providing a purely online service, a hosted service where a consumer can
go online and create an online PHR and manage it remotely over a
networked environment over the Internet. Or they could procure a product
or an application and use it in an offline mode but they could also
connect it over the Internet and network it to get some online services.
And so since they did offer online services, we threw them in the online
category. The offline providers were those that had no Internet
connectivity or network connectivity advertised.

Next slide, please. Slide 4.

**[\>\> Peter Basch:]{.underline}**

Is it possible to ask a brief clarifying question on slide 3?

**[\>\> Yuri Dzambasow:]{.underline}**

Sure.

**[\>\> Peter Basch:]{.underline}**

Just want to clarify when you use the term provider, you\'re
specifically referring to PHR provider, not the way we tend to use the
term provider for other purposes?

**[\>\> Yuri Dzambasow:]{.underline}**

Peter, that\'s correct. And I\'ll try to say PHR provider as often as
possible.

**[\>\> Peter Basch:]{.underline}**

No, I think it was clear, I just want to make sure of it. Thank you.

**[\>\> Yuri Dzambasow:]{.underline}**

There will be a couple of points later on in the presentation where I
will talk about a caregiver or a care provider, and I\'ll try to note
that. But for the most part when I\'m talking provider in this
presentation I\'m talking about the company or the entity that\'s
providing the PHR to the consumer.

**[\>\> Kirk Nahra:]{.underline}**

This is Kirk. Let me just jump in for a second. I don\'t know if this is
the printing process for the people in the room, or the original that
was sent out, but for the people in the room, we seem to be missing some
of the slides. 3 and 4, 7 and 8. 15, 16. So, again, people who are
looking at the e-mail, I don\'t know if that error extends to those or
not. But the slides are available on the Website, and we\'ll try to go
through them. Anyone looking at the e-mail know if you have those
slides? Anyone looking at the e-mail?

[**\>\>**]{.underline}

Yeah.

[**\>\> Kirk Nahra:**]{.underline}

Can you tell us if you have, for example, slides 3 and 4?

[**\>\>**]{.underline}

I have a different slide up now. I was looking at it before, and I
recall seeing these slides before in the e-mail.

**[\>\> Kirk Nahra:]{.underline}**

Yeah, we have most of them, we\'re just missing some. I don\'t know if
it was in the original sent out or not. But, again, you may hear Yuri
talking about some slides that people in the room will not have in their
packages, it may be all of us don\'t have them. Go ahead, Yuri.

**[\>\> Yuri Dzambasow:]{.underline}**

On slide 4, the way those 50 PHR providers broke down between offline
and online, 17 were offline providers and 33 were online providers,
equating to 34 and 66 percent respectively. So what that meant is from,
you\'ll see as the presentation goes on, we\'re whittling the research
down to an area we want to concentrate on and so right off the bat
we\'re going to remove these 17 offline providers from the research
because they don\'t provide a network connectivity for the PHR.

[**\>\> Kirk Nahra:**]{.underline}

Although just one comment on that Yuri. We did have a discussion about,
you\'re calling them the off line or the journal providers, there was
some discussion in one of our earlier meetings that was not a
significant market segment and I guess I would \-- I\'m hearing you say
it is in fact a significant market segment. It may not be the biggest
one but 34 percent, if that\'s remotely close is a big chunk.

**[\>\>]{.underline}**

We don\'t know what market share they have, though. We just know
they\'re out there.

[**\>\>**]{.underline}

Right.

[**\>\> Kirk Nahra:**]{.underline}

But they are out there. Something we have to factor into our equation.
We can\'t just disregard them.

**[\>\> Yuri Dzambasow:]{.underline}**

And I think because of that discussion earlier on in the Workgroup, that
we didn\'t want to focus on those 17 right now. We wanted to focus on
PHR providers that had an online environment and then you\'ll see we
even tailored it some more.

**[\>\> Yuri Dzambasow:]{.underline}**

Moving on to slide 5. What we did then is we extended the research to
identify those online PHR providers that were offering what we call
value-added services and what we meant by value-added service is one,
they were services beyond just traditional medical journal services.
Things like being able to securely communicate with a care provider,
being able to request a prescription refill, or get lab results uploaded
into our PHR. Those would be considered value-added services. The other
requirement is that it involve some sort of third party. So the
healthcare consumer through its PHR, its online PHR, is communicating
with a third party to get some other value-added service beyond just the
medical journal services provided by the PHR.

[**\>\> Kirk Nahra:**]{.underline}

I\'m sorry, Yuri, let me ask a question. Is the group you\'re just
talking about there different from the online and offline category?

**[\>\> Yuri Dzambasow:]{.underline}**

Yes, and you'll see that just in a second. And as a note, all of the
offline providers that were identified here, those 17, none offered
value-added service. There was just an offline medical journal that a
consumer would just operate on their home computer or office computer or
whatever, and not connect it in any way.

I\'ll wait for the train to pass.

Slide 6. Shows how the online PHR providers broke down between offering
just journal services and these value-added services that I talked
about. And we\'ll describe specifically what those services are in a
moment. And you can see that 13 of the 33 online providers, PHR
providers, offered some sort of value-added service beyond the journal
services and 20 just only offered an online journal. So there was no
advertisement by those PHR providers that a third party was also
interacting with the consumer, that it was just an online capability for
the consumer to create a PHR and store medical information and keep
track of medical data on their behalf. There wasn\'t any sort of
indication that they were communicating with a doctor or doing
prescription refills. There were 13 of them that did offer those types
of services, or 39 percent of those online providers.

**[\>\> Kirk Nahra:]{.underline}**

So a minority of the online providers are touching a third party.

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s correct.

[**\>\> Kirk Nahra:**]{.underline}

So again, going back to the earlier point, there's even a bigger
percentage, we don\'t know market share, but just of the 50, do I have
the numbers right, more than half of them don\'t have any connectivity?

**[\>\> Yuri Dzambasow:]{.underline}**

Well \--

**[\>\> Kirk Nahra:]{.underline}**

All the offline and \--

**[\>\> Yuri Dzambasow:]{.underline}**

What you have is you have these 20 online service, PHR providers that
don\'t offer, that only offer journal services and the 17 offline
providers. So you have 37 providers, PHR providers that \--

[**\>\> Kirk Nahra:**]{.underline}

Of the 50.

**[\>\> Yuri Dzambasow:]{.underline}**

\-- that were not advertising any value-added service or connection to a
third party.

[**\>\> Kirk Nahra:**]{.underline}

So significantly more than half do not have third party connectivity.

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s correct. At least of the 50 that we looked at.

[**\>\>**]{.underline}

Can I ask, if the 13 that did offer value-added services, if your
listing of them was based on what they advertised or based on research
that went deeper than a self-declaration?

**[\>\> Yuri Dzambasow:]{.underline}**

It\'s based on what was advertised.

[**\>\>**]{.underline}

So it could be lower.

[**\>\>**]{.underline}

Okay. And do you actually have a list of those companies rather than
just a number for those of us who might be interested in independently
seeing what they claim and what they actually offer?

**[\>\> Yuri Dzambasow:]{.underline}**

There\'s a spreadsheet that was developed of the 50 companies that were
researched, and all the raw data is in that spreadsheet so you can see
explicitly which of the 13 vendors \--

[**\>\>**]{.underline}

Was that spreadsheet made available to us?

**[\>\> Yuri Dzambasow:]{.underline}**

It has not yet \--

[**\>\>**]{.underline}

We can send it out.

[**\>\>**]{.underline}

Thank you.

[**\>\>**]{.underline}

When you\'re saying value-added services is that always equating to a
third party involved? It could be you\'re adding value by putting lab
results in but you\'re handling lab internally and so you\'re doing that
yourself.

**[\>\> Yuri Dzambasow:]{.underline}**

What it meant was a third party was touching the PHR in some manner. So
that there was someone else connecting into the PHR other than the
healthcare consumer.

[**\>\>**]{.underline}

So that example you gave was just the type of service that you\'d get
from a third party?

**[\>\> Yuri Dzambasow:]{.underline}**

It was more so the interconnectivity of the PHR.

[**\>\>**]{.underline}

Right.

**[\>\> Deven McGraw:]{.underline}**

This is Deven McGraw. I\'m sorry if I\'m the only one confused here but
this slide, number 6, these are only the online PHR providers, right?
Just that slice of the pie?

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s correct.

**[\>\> Deven McGraw:]{.underline}**

And yet 20 of those only provide the journal services? I guess I\'m
trying to figure out what the difference is between an online PHR
service providing a journal, medical journal, versus an offline. What
that means is that they\'re holding the data on behalf of the consumer.

**[\>\> Kirk Nahra:]{.underline}**

Let me see if I can answer that to see if I understand it. Which is
there are two ways that an individual could have a journal to keep track
of their own healthcare information. One would be putting that on a
Website essentially. That would be one of the online providers. But
there would be no interconnectivity, no connection to third parties. Or
I could just download that to my home computer. I could buy a piece of
software, have it on my computer, it would be like a form document,
basically, setting up of some kind. Again, no connectivity but I can do
that in my house in my computer without it being on a Website. Both of
those categories which total about 37 of the 50 companies that were
surveyed, do not, as I understand it, present the main interconnectivity
risks that we\'ve been worried about.

**[\>\> Deven McGraw:]{.underline}**

Yeah, I\'m not sure that I would agree with the very last statement that
you said, Kirk, because notwithstanding that I do agree that the third
party touching the information is of, is a high priority concern for us.
But what it sounds to me like is the distinction between these online
versus offline providers and journaling, unless I\'m getting it wrong
which I very well could be, is that the information, if it\'s just on
your hard drive, that\'s one thing. Take that off the table. But this
information is in a Web-based service. Being held by, either in the
Internet or \-- I don\'t think there\'s an absence of concern with that
type of journal.

[**\>\> Kirk Nahra:**]{.underline}

Well, I didn\'t \-- yeah, I agree there\'s not an absence of concern. I
didn\'t mean to describe an absence of concern. But it seems to me \--
the issue that came up and I don\'t remember who on the Workgroup raised
this originally, but the question is, what kind of identity proofing are
we going to require in some of these PHR settings? And there was some
concern expressed that said, look, if I walk into Office Depot and want
to buy a set of tax forms, they don\'t have to identity proof who I am
to buy a set of tax forms. All I do is sit on my home computer and I can
enter anything I want. You have issues when you start sending the tax
forms in and you have that kind of piece. But if all I do is fill out
the forms on my home computer, we don\'t have an identity, the same kind
of identity proofing concern.

I think the same issue largely presents itself with these hosting
situations. We have security concerns, clearly, and we don\'t want
somebody else to be able to access my record, which again is a security
concern, and perhaps an authorization concern, but what we\'ve described
as identity proofing is setting up that account in the first place. If
Jodi Daniel wants to buy one of those things and host Jodi Daniel\'s
records on a Website, unless there\'s connection to other third parties,
we don\'t care if \-- well, the argument that was thrown out is we
don\'t care whether Jodi Daniel puts her name on it or John Smith
because it doesn\'t match up to anything else.

[**\>\>**]{.underline}

Okay.

[**\>\>**]{.underline}

And it\'s not relied on by anyone else to be necessarily used as medical
data if it\'s essentially either one\'s own journal or one's hosted
journal. So I think you explained it very well.

**[\>\> Yuri Dzambasow:]{.underline}**

As an analogy that exists today, think of TurboTax. You can go into the
store and buy TurboTax and install it on your desktop, run through the
software and create a tax return and print it out and mail it in. You
can go to TurboTax online and do the same thing all online and print it
out and mail it in. Or you can extend it and say I now want to
electronically submit it to the IRS, which involves a third party which
is a value-added service you\'re now getting and now the IRS wants to
know it\'s really Yuri and I want to know it\'s really the IRS getting
it and I want to make sure TurboTax is doing their job in the middle.
That\'s about the best analogy I can give everybody as it relates to
these PHRs.

[**\>\>**]{.underline}

Well said.

[**\>\>**]{.underline}

It sounds like there\'s a continuum of risk management starting from a
very low risk because it\'s living on someone\'s home computer. Then the
risk gets greater when you\'re talking about it lives on a network
somewhere and it maybe doesn\'t have other services or other
connectivity but it\'s even greater once there\'s the connectivity to
other providers. I guess the one thing that we might have to consider,
though, is as this whole thing matures over time, what about those that
get started offline and then what about the credibility of that data
when the person says there\'s a service out here that I now want to be a
part of and you\'re be not only validating the person but you\'re also
trying to validate the data that the person has been collecting off line
and being able to make sure that data is legitimate.

[**\>\>**]{.underline}

I don\'t think that would be as much of a concern, however, because for
a PHR managed on your own computer which has no connectivity or hosted
solution, which is essentially a hosted journal without connectivity,
all of the inputs would be identified as self-generated, rather than put
in directly from a reference lab or an imaging center. I think once one
starts to include those kind of entries, whether or not they are on
one\'s own hard drive or a hosted solution, there has to be, as our
chairs were saying, a level of identity proofing that the third parties
who are publishing the data have good reason to believe that you are who
you say you are. And for example I think that if you had essentially a
journal with data for many, many years that was all self-generated, I
don\'t think there would be a tremendous concern about having to
validate that. It would be looked at as all personally entered rather
than collected from a variety of external sources.

[**\>\> Kirk Nahra:**]{.underline}

And keep in mind what \-- the issue we are really looking at at this
point is what kind of identity proofing recommendations are we going to
make? And \--

[**\>\>**]{.underline}

Exactly.

[**\>\> Kirk Nahra:**]{.underline}

In the purest version of what Yuri is talking about at this point, if I
talk into Office Depot and want to buy a piece of software for Medical
Records 'R Us, and it\'s just something that I put on my computer to
keep my notes of my medical treatment, are we going to impose some kind
of identity proofing standard on Office Depot to figure out who I am
before I buy that 12 dollar piece of software? That\'s part of what
we\'re \-- and if the answer were yes, we\'re really concerned about
that because if the wrong person puts that information in, it might get
linked up in ways that would cause other kinds of problems, then we
would want to say, well, we still are concerned about identity proofing.

But as we\'re going through this, and we\'re obviously not at a point of
conclusion yet, but I think our inclination from the earlier discussion
was that where these records are not interconnected in any way, the
concern about identity proofing is greatly reduced and may be so much
reduced, this maybe goes to Deven\'s point, maybe so much reduced that
we don\'t impose any identity proofing standards for the unconnected,
non-interoperable records. It\'s only when, the point when it reaches
out to other records that we start to become more concerned about those
issues. Again, that was sort of our working hypothesis. We haven\'t I
think definitively gotten to that conclusion yet.

[**\>\>**]{.underline}

I would support that.

[**\>\>**]{.underline}

Then you\'ve got the perfect catch point of if it ever becomes
connected.

[**\>\>**]{.underline}

Right.

[**\>\> Kirk Nahra:**]{.underline}

I\'m sorry, Yuri, we\'re getting off track here. Why don\'t you go
ahead?

**[\>\> Yuri Dzambasow:]{.underline}**

I\'m on slide 7 now. Next slide, please. And what Slide 7 shows is the
breakdown of these value-added services that is were provided by the
online PHR providers. And the first thing you\'ll notice, this doesn\'t
add up to the 13 online providers because some PHR providers offered
multiple value-added services. And you can see that six offered a
capability to securely communicate with a doctor or care provider. That
could be through a secure Web messaging capability, it could be being
able to launch an e-mail capability to the doctor in some secure manner,
but it\'s the ability to consult with a care provider. There were two
PHR providers that offered online appointment scheduling for the
consumer to schedule an appointment at the doctor\'s office. Three had
offered the ability to request a refill for prescription and to get that
filled by a pharmacy. One offered the ability for the healthcare
consumer to request a medical record from their doctor, which implicated
a tie into an electronic health record, being able to pull that data.
Four providers each offered read access of the PHR by some third party
such as a doctor. Four offered some sort of write access to a PHR, such
as uploading of lab results or putting in EHR data into a PHR. One
offered the ability for the consumer to directly pay online to their
doctor\'s office. There wasn\'t an insurance involved in there. And one
offered the ability for emergency medical services to gain access to the
PHR in case of emergency medical \--

**[\>\> John Houston:]{.underline}**

This is John Houston. For your one that regarding third party read
access to PHRs, or I\'m sorry third party write access to PHRs. Did that
also include third party read access?

**[\>\> Yuri Dzambasow:]{.underline}**

Yes.

**[\>\> John Houston:]{.underline}**

Okay. So really third party read access is really 8 but \-- or maybe to
rephrase my question.

[**\>\> Kirk Nahra:**]{.underline}

Read only or read and write. That\'s a good clarification.

[**\>\> John Houston:**]{.underline}

Thank you.

[**\>\> Kirk Nahra:**]{.underline}

You usually hear of it as read only. It\'s read only and read/write.

**[\>\> Yuri Dzambasow:]{.underline}**

So that\'s how the value-added services had broken down. And continuing
on to slide 8, so that\'s where we wanted to focus our research, were
those online PHR providers that were providing services that allowed
interconnectivity with a third party so the consumer was communicating
with someone. There was a need for, at least there\'s a need to know who
the third party is, who the consumer is, to securely communicate the
data. And what we looked at were the identity proofing practices of
those PHR providers, compared them to what some non-healthcare entities
were doing online in a similar environment that have no prior
relationship to a consumer and then we also examined the privacy
policies, authentication credentials, and any other miscellaneous
findings that came out of it toward the end.

So moving on to slide 9, and the identity proofing practices that were
found. The first thing that jumped out was that of the 13, 5 of them did
not provide any sort of data or definition as to what their identity
proofing practices were, while 8 of them did. You can actually go
through the process and get a PHR established. So that\'s roughly 38
percent of those 13 did not define identity proofing practices
whatsoever.

[**\>\> Kirk Nahra:**]{.underline}

And let me ask a question that follows up on something asked a minute
ago. Is that based on just looking at the site or actually trying to do
it?

**[\>\> Yuri Dzambasow:]{.underline}**

It\'s looking, it\'s going through and looking at all the advertised
capablities and then trying to actually go through a process to define
where I can register, where I can go online, and where I can do all that
\--

**[\>\> Kirk Nahra:]{.underline}**

So in this piece you went further \--

**[\>\> Yuri Dzambasow:]{.underline}**

Right.

[**\>\>**]{.underline}

Could you complete the process and still not know what their practices
were?

**[\>\> Yuri Dzambasow:]{.underline}**

No, the 38 percent here, going through their entire site and not finding
anywhere where I could actually go and start the process whatsoever. So
it might be just call them up on phone and go through whatever and they
take a whole bunch of information from you to collect everything online
and then they\'ll get you set up.

[**\>\>**]{.underline}

This doesn\'t mean the 38 percent aren\'t doing some sort \--

**[\>\> Yuri Dzambasow:]{.underline}**

Just says \--

[**\>\>**]{.underline}

They aren\'t advertising it on their Website.

**[\>\> Yuri Dzambasow:]{.underline}**

That's right.

[**\>\>**]{.underline}

Showing you how to do it.

**[\>\> Yuri Dzambasow:]{.underline}**

Right.

[**\>\> Kirk Nahra:**]{.underline}

Even though you did more than just reading \-- you tried to push.

**[\>\> Yuri Dzambasow:]{.underline}**

And you\'ll see that in the upcoming slide. So it wasn\'t publicly
defined, it wasn\'t intuitive going to their site that I could follow
this process, get identity proofed, and get a PHR established.

Moving to slide 10. Of the eight that did have a process in place
online, two only required name and e-mail address to be verified. And
they were offering free PHRs, so that sort of explained a little bit as
to not collecting a whole lot of information to verify.

[**\>\> Kirk Nahra:**]{.underline}

Let me ask a question. You say the word verify. They collected that
information? Or they matched it to something?

**[\>\> Yuri Dzambasow:]{.underline}**

They\'re collecting it and it\'s assumed they\'re collecting it to
verify it somehow, or to use it to establish a PHR online for the
consumer.

[**\>\> Kirk Nahra:**]{.underline}

But those strike me as two different points. I want to collect your name
and your e-mail address so that I can send you marketing materials or I
can send you an upgrade. That may have nothing to do with identity
proofing. This is the information that\'s collected.

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s right.

[**\>\> Kirk Nahra:**]{.underline}

We don\'t really know if they\'re using it for any identify \-- and
frankly, e-mail address is a very hard one to use for identity proofing.

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s why the reason I noted is these are free PHRs.

**[\>\> Kirk Nahra:]{.underline}**

For all of these, we may find that that information is collected rather
than the information is used for identity proofing.

**[\>\> Yuri Dzambasow:]{.underline}**

Right, well, again, except for the free PHRs, with the name and e-mail
address. It's tough to verify an e-mail address, about the only thing
you can do is send an e-mail and make sure it doesn't bounce, at least
it goes. For the others it appears there appeared to be at least some
verification going on.

Three of them required name, address phone, e-mail and a credit card
number. One of the providers took that information and added age as
well. One of the providers, name, address, phone, e-mail, Social
Security Number, and date of birth. That was actually one where the
doctor wanted to make sure that they knew the consumer they were
communicating with about the PHR, and the doctor was going to use the
Social Security Number as a way to identify that consumer. And then one
PHR provider required you to actually purchase the PHR. They would sell
you a device that you could use locally in your environment and then to
set up an o-line PHR account, part of that process required you to enter
in the device ID, like the serial number of the device along with name,
address, phone, e-mail, and credit card number to set up the online
account.

[**\>\>**]{.underline}

The ones asking for credit card, they\'re all ones, collecting a fee. So
that sort \--

[**\>\> Kirk Nahra:**]{.underline}

I still don\'t understand why we think those are being used to identity
proof. If I\'m selling something I need your credit card so I can make
money off of you. I suppose I have some credit card industry rules to
make sure that\'s a valid card, but \-- that\'s \--

**[\>\> Yuri Dzambasow:]{.underline}**

You\'re getting to where the research is heading in a couple of slides,
Kirk.

Slide 11 \--

[**\>\> Kirk Nahra:**]{.underline}

I\'m sorry, but we say identity data verified by PHR providers offering
value-added services, isn't that at this point collected by rather than
verified by?

**[\>\> Yuri Dzambasow:]{.underline}**

It\'s probably more appropriate that it\'s collected by.

Slide 11 maps the value-added services against the identity proofing
practices employed by the PHR providers, and you can see that four of
the value-added services, there was no mapping defined, so those \-- the
reason for that is because those PHR providers didn\'t, they didn\'t
publicly define a set of identity proofing practices for the PHRs but
they were advertising that you could do this with their online PHRs. You
could do appointment scheduling, you could do a prescription refill, but
there wasn\'t a whole lot of other information there as to how that was
going to occur. There were four that there is a mapping, secure
messaging with a care provider, read and write access, read only access,
read/write access, as well as emergency alert services, and you can see
how the mapping fell out there.

Slide 12 summarizes, I think, what\'s going on with PHR identity
proofing. And basically there\'s little to no information on identity
proofing, or being performed on the consumers. It is mostly focused on
getting consumers to purchase a PHR, which is why the credit card is
such a prevalent piece of information. They want to you buy a product or
service and set up and then offer other value-added services to entice
the consumer to buy this PHR versus a different PHR. In one case, there
was advertisement of write access to the PHR and yet I only needed a
name and e-mail address to set up a PHR in the first place. So I'm not
sure how the write access would occur but very minimal identity proofing
going on from the consumer \--

[**\>\> Kirk Nahra:**]{.underline}

That case allowed write access by who?

**[\>\> Yuri Dzambasow:]{.underline}**

This was a PHR provider where I could get a PHR stood up with name and
e-mail address only and then it was advertised somehow that there could
be write access into the PHR by a care provider to exchange EHR data
with the PHR. Now, how that was set up wasn\'t clear. Which leads to the
second bullet on slide 12. There really wasn\'t a whole lot of
information on how third parties are identity proved into the system.
Basically what you got out of it is the consumer and the third party
just need to trust that the PHR is somehow establishing these bilateral
relationships between the third party and the consumer, whether with the
lab or the pharmacy or the care provider, and I\'m sure there\'s
information in there but it would require a little more digging in.

**[\>\> Peter Basch:]{.underline}**

And the converse is also true, that the third party would need to trust
the PHR vendor that the individual named as the PHR owner is who that
person says he or she is.

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s correct, Peter, yep.

[**\>\> Kirk Nahra:**]{.underline}

And Peter, let me ask a question. Let\'s say you happened to be treating
somebody who had one of these products. Would it ever cross your mind to
ask the service provider what they did to identify on an identity
proofing a person?

[**\>\> Peter Basch:**]{.underline}

I'm sorry, was that question for me?

**[\>\> Kirk Nahra:]{.underline}**

I'm just asking from a provider perspective. I would assume you would
trust it without asking any questions. You would just assume it was
right.

[**\>\> Peter Basch:**]{.underline}

I would assume that a, kind of a cold call or e-mail from a provider
saying we are a third party connecting you and your patient John Smith,
click here to accept yes. Is that what you\'re saying? I\'m trying to
envision a circumstance where a care provider would get a communication
from a PHR provider and trust, and trust it at all. My basic assumption
would be that without being clear as to who that person is and how this
came to a provider, the, I think the core assumption would be we
wouldn\'t trust it at all.

[**\>\>**]{.underline}

This is \--

[**\>\>**]{.underline}

That\'s consistent with what I've heard from other providers who are
asked to release patient information. They\'re really reluctant to do
that.

[**\>\>**]{.underline}

This is like name, e-mail address and a pair of dice.

[**\>\>**]{.underline}

I can\'t imagine a doctor doing that.

[**\>\> Kirk Nahra:**]{.underline}

The possibility exists, you\'re raising a practical concern, here,
Peter, which is providers wouldn\'t do it. But that, that is because
they in their own exercise of judgment wouldn\'t do it. Not that they
couldn\'t. And not that the system creates any impediments. It\'s just
their own professional responsibility creates those impediments.

[**\>\>**]{.underline}

Also, I would argue that there might be some requirements under HIPAA
verifying the, verifying the identity of the person requesting the
information.

[**\>\> Kirk Nahra:**]{.underline}

Who had a question on phone?

**[\>\> John Houston:]{.underline}**

John Houston. Interesting data, but the one thing really missing from
the data, or at least I didn\'t hear, was there any attempt to try to
find out how many patients were actually utilizing these PHRs and is
there sort of an average number? And again I think that\'s important to
understand whether what we\'re finding is there\'s not a lot of interest
out of patients to worry about identity proofing versus the things
aren\'t getting enough play yet for the issues to arise.

**[\>\> Yuri Dzambasow:]{.underline}**

There wasn\'t any information like that collected, John, on the actual
usage of the PHRs and how many patients have signed up for them. The one
thing that I can share with you, that it\'s not part of the research we
took it out, we did see, we went through three insurers that advertised
online PHRs and all three of them required that you be a member in their
plan. And so you had to have a prior relationship exist with the
insurance company in order to get an online PHR established, which is
consistent with the recommendations that the group made not too long
ago. But we wanted to focus on PHR providers where there was no prior
relationship and I honestly don\'t know how many of these providers have
patients signed up. Just looking at Websites, you might get a feel for
what appears to be something that a consumer might sign up for versus
other sites, but I don\'t have that data.

[**\>\>**]{.underline}

That would be a real helpful piece of information to at some point try
to find out.

[**\>\>**]{.underline}

I\'m sorry, you\'re saying the helpful piece of information would be to
try to find out numbers of consumers who actually using these particular
different types of PHRs?

[**\>\>**]{.underline}

Yeah, because I think part of the issue is that if there aren\'t a lot
of people signed up, there, the level of concern may not have arisen yet
because there aren\'t, there isn\'t enough people to avoid concern over
the fact that they\'re adequately identity proofing.

[**\>\>**]{.underline}

I would agree with you. I think if we\'re going to try to collect, that
I would take that concern one step further and define usage not as, not
strictly as people signed up for, because I know from my side as a care
provider, there\'s some vendors who started off by pre-signing up entire
blocks of physicians based on medical society membership. So without
naming names, certain of these providers could claim we have half a
million physician practice Websites active, you know. And in fact a very
small percentage were ever used by the physician. So if a health plan
created PHRs for two million members, and \-- we want to make sure that
were they ever used by members, because if they were, and we\'re not
seeing a lot of concern about identity proofing, that certainly means
something different than if we have kind of millions of blank folders
created that have never been used because then consumers may not
actually be aware of the issues.

**[\>\> Steve Posnack:]{.underline}**

This is Steve Posnack from ONC and John, to get to your question about
usage, I helped with some of the Altarum work that was done for the
Consumer Empowerment Workgroup and if we could point people to the work
that's on the Consumer Empowerment group's Website, but we did ask to
try to look into the amount of people to get an N of users and they
essentially reported back that that wasn\'t being disclosed. So it may
not be that Yuri won\'t be able to dig up the information but that
there\'s a roadblock for him to get that information at this moment.

[**\>\>**]{.underline}

And I understand that point.

**[\>\> Steve Posnack:]{.underline}**

It would definitely be useful and we wanted it to be useful for the
other work that Altarum did and it just wasn\'t something made
available.

[**\>\>**]{.underline}

Steve, why is the information not being disclosed?

[**\>\>**]{.underline}

It\'s proprietary. You know, the company doesn\'t necessarily want to
disclose their consumer base.

[**\>\>**]{.underline}

Clients.

[**\>\> Kirk Nahra:**]{.underline}

It could be because it\'s big or because it\'s small. It could be a
variety of reasons.

[**\>\>**]{.underline}

Come on, when they\'re big they like to disclose it all.

[**\>\> Kirk Nahra:**]{.underline}

So then it\'s all small.

[**\>\>**]{.underline}

That\'s important to know.

[**\>\> Kirk Nahra:**]{.underline}

Well, there\'s two questions. Obviously you\'re right that it would be
important to know. We also can understand why these people are not
volunteering that information if the answer is it\'s very small. So I
mean, I\'m not sure what we do about that. I mean, that\'s a factual
question. We could make an assumption that anyone who refuses to tell us
that information is in fact a small player, that may be an accurate,
that may be an accurate conclusion. But I\'m not sure how we\'re going
to know that. Again, I think we want to keep an eye on our piece of this
goal. Which is we need to make some decisions about what \-- you know,
what I\'m hearing so far, and I want to make sure we can get back to
Yuri so we can get through all this. What I\'m hearing so far is that
the current marketplace is not doing much on identity proofing.

Now, it may also be because there isn\'t a lot of this connectivity
right now, but right now the standards are very low, so much so that
they may be almost nonexistent. And from a privacy and security
perspective, personally that\'s concerning to me. So we\'re not \-- one
of the instructions we\'ve had or one of the operating principles we\'ve
had is that we don\'t want to make recommendations that are going to
cause dramatic harm in the marketplace, but A, it\'s not clear how big
of a piece of the market it is, and B, there will be some situations
where we say, you know what, the marketplace practices are so bad that
we are willing to make a recommendation that may get in the way of that.
Now, the recommendation may end up being we want to see some kind of
legislation that imposes practices in this area because the market\'s
not doing that. Again, that\'s getting ahead of ourselves, but again, as
I\'m listening to this research, I\'m hearing one, we may have more
people offering these standalone records than we thought. And again,
somewhat less of a concern there, maybe dramatically less concern. But
for the people offering some kind of interactive services, the standards
are very low, I haven\'t heard anything so far that says any one of
these sample people is going to be at a level that, again, based on what
I know today, I would feel is appropriate. And again, given some of the
earlier discussions, I suspect I\'m not going to be the only one that
thinks that.

[**\>\>**]{.underline}

Shouldn\'t we go forward with that mind set, because in the world of new
electronic health records coming online every day and the world of RHIOs
starting to stem up everywhere and people trying to become more
connected, isn\'t is inevitable it is going to get to the point where
these are going to be connected and shouldn\'t there be some
infrastructure for setting at least a floor standard for that?

**[\>\> Kirk Nahra:]{.underline}**

I agree \--

[**\>\>**]{.underline}

We know this is the case today.

[**\>\> Kirk Nahra:**]{.underline}

Again, keep in mind why we\'re looking at this. I mean, the \-- where we
were in our earlier discussion is we promoted in-person identity
proofing as the best identity proofing standard. We promoted a variety
of other alternatives in situations where there was an existing
relationship where the people, the providers or the insurance company or
someone else who had that existing relationship could use that history
to identity proof. We\'re now talking about a different category. It may
not that be big a category right now. It may be that the marketplace is
going to push people to develop these records in connection with places
where they have relationships. But for people who are doing it
separately we\'re looking at whether there are standards we can
recommend beyond identity proofing, in-person identity proofing. I
haven\'t yet heard from our discussions, and I say yet, something that
gives me a lot of comfort other than some kind of in-person identity
proofing. We can look at how that is done and we can look at proxies and
maybe if Microsoft is selling one of these piece that is interoperable,
you don\'t have to go to Redmond to get identity proofed. I understand
we need to look at that but I haven\'t yet heard here are some viable
alternatives to the in-person identity proofing and the research we\'re
hearing so far, we keep cutting Yuri off, I\'m a prime offender on that,
is what\'s out in there in the marketplace isn\'t giving us good ideas
on what those alternatives are. We\'re not so far hearing, oh, I love
what that vendor is doing, they\'re doing a great thing on this identity
proofing. So I think what we\'re concluding or what we may conclude from
this research is there\'s nothing particularly comforting in the
marketplace that we can use to draw on to create these other standards.

[**\>\>**]{.underline}

I think if there were, we\'d already have more interoperability. The way
you phrased it before, is that we, you know, don\'t have this
connectivity and so there\'s not been a need to address it. And actually
I would flip it around and say we don\'t have the ability to do this and
it\'s inhibited a lot of people from establishing that connectivity.

[**\>\> Kirk Nahra:**]{.underline}

Right.

[**\>\>**]{.underline}

I think it's a slippery slope, because many of the vendors sell the
product to a place that then uses it is. And certainly if you look at
probably the biggest one out there in terms of sheer numbers is probably
EPIC. But they don\'t, they actually don\'t do this. They actually have
people buy their product and then those places use it. So I think the
research is really useful but I don\'t think it\'s quite complete
enough. I think it would be helpful to touch base with Kaiser, for
example, and some of the other EPIC users in particular, as well as VA
if you want to get a sense of how this really and totally is being used.
Because in one \--

[**\>\> Kirk Nahra:**]{.underline}

But again those are perfect examples, but they\'re not these examples
because those are all relationship situations. And we\'ve come up with,
we came up in our earlier recommendations with some alternatives to
in-person where there is that relationship history. What we\'re looking
at here is the complete stranger situation. And so I think that that\'s
where we\'re, that\'s where we couldn\'t come up with recommendations
early earlier, that\'s where we haven\'t yet seen, we haven\'t yet seen
good alternatives where there\'s no preexisting relationship, and what I
hear Yuri saying is he didn\'t find any either.

[**\>\>**]{.underline}

I would add to that that what Yuri has shown us is that what exists in
the marketplace, even if it\'s very limited, causes us affirmative
discomfort.

[**\>\> Kirk Nahra:**]{.underline}

Well, let me suggest this. I would like to have Yuri finish up on the
next couple of slides. Maybe we\'ll take a break at the additional
research point. I would like to go through that. We\'re about due for a
break, but if you could finish up, particularly in the non-healthcare
example. That\'s the other market that we\'ve been looking at is what
else is out there. But let see if that gives us any more comforting
information.

**[\>\> Yuri Dzambasow:]{.underline}**

I\'m on slide 13 now. And \-- next slide. And there is a technology that
is out there today and it is being used in a number of areas. And it\'s
called knowledge-based authentication. And don\'t focus on the word
authentication because it\'s actually technology that\'s used to
identity proof as well as do, it\'s to real-time identity proof and to
authenticate you in one session. It just has the name of KBA. And
basically you provide an initial set of identity information and that
information is then verified through some trusted third party sources
online and then based on a successful verification of that going to
credit bureaus, DMVs, you pose a set of questions and then if you answer
those questions successfully, then the service provider has a higher
degree of confidence that you are who you say you are in an online
environment. And if anybody wants additional information on it, there\'s
a Weblink to a NIST site, there was a symposium done a couple years ago
on knowledge-based authentication and there\'s a lot of good
presentations there if you want to become more familiar with it. I
include this because it leads us into the non-healthcare examples on
slide 14.

And I looked at three online service providers. One is the
annualcreditreport.com Website. This is not the freecreditreport.com
Website where you have to sign up for the 30-day subscription. This is
an actual, honest to goodness free credit report, annual, you can do
once a year. And also went to Capital One, a credit and banking
organization, as well as HSBC Direct, another online bank. And you can
see the initial set of information that was required to be collected by
these three providers. Everybody wanted your legal name, Social Security
Number, date of birth, a mailing address. And they also want to know
whether you lived at your residence for more than two years. And if you
didn\'t, you had to provide previous residence on top of that.

Capital One and HSBC further asked to you for your citizenship. They
asked you for a driver\'s license or state ID, the number on it, the
state which it was issued. And they used that initial set of data that
you provide to then go off and verify that with a number of third party
database providers. Having worked for a company that did this sort of
thing, you could go out and ping anywhere from 20 to 50 primary,
secondary, and tertiary service providers that are out there. And then
you get back a whole bunch of raw data and you score it to see how
accurate all that triangulates. If it comes back successful, the person
going through the application process or going to set up, either get the
credit report or set up an online account, bank account is then asked
some personal questions, based on information that\'s accessible.

[**\>\> Kirk Nahra:**]{.underline}

I'm sorry. If it matches, you then ask additional questions?

**[\>\> Yuri Dzambasow:]{.underline}**

Basically they\'re trying to find out, does someone, does Yuri
Dzambasow, with this information, Social Security Number, date of birth,
residence, does he exist? Okay? If I end up with a prison address,
they\'re probably not going to let me go through the application
anymore, or if it shows up as a P.O. Box.

**[\>\>]{.underline}**

Former prison.

**[\>\> Yuri Dzambasow:]{.underline}**

Right.

[**\>\>**]{.underline}

If you don\'t get through the first \-- if the company were to look at
these different sources and find out in fact you\'re entered doesn't
match, then they would stop right there?

**[\>\> Yuri Dzambasow:]{.underline}**

They may stop there. Prior experience has shown that what they might do
is kick to offline process and say we\'re having trouble verifying your
information can you call this number, talk to a representative, you
know, they could mail you out a form. But the on line process will stop
and you\'ll get redirected somehow, some way. For the online process to
continue, so there\'s a successful identity verification check based on
that basic set of identity. And then a list of questions will appear.

For Annual Credit Report, they wanted to know who is your mortgage
provider, what\'s the mortgage amount, car loan provider, car loan
amount. The way they phrase the questions is they give you basically A,
B, C, D, and none of the above. So they\'ll give you four mortgage
providers and none of the above. They\'ll give you four loan amounts,
none of the above and so on and you have to select those and submit
that. And then they\'ll check the answers based on what they think you
should be answering. Capital One talked about personal loans in case you
don\'t have a mortgage. You might have a personal loan on file, you
might have a credit card on file. So they'll say, you know, back in 2002
you got a credit card with a department store, which one was it. And you
know. So \--

[**\>\>**]{.underline}

That\'s a \--

**[\>\> Yuri Dzambasow:]{.underline}**

In some cases it might be challenging for the consumer if they go back
too far and you took advantage of all these 10 percent off sales at all
the department stores. For students they might ask for a student loan
because you don\'t have a mortgage. So you can see that a lot is
financially driven, where they can get credit information, loan
information, residency information. They can ask, you know, at about
this time you lived at this address, and say that was there or none of
the above. But the identity is that they want to ask you more personal
questions just beyond your identity data, and then see how well you
answer those questions.

[**\>\>**]{.underline}

They then compare these against \--

**[\>\> Yuri Dzambasow:]{.underline}**

Against the actual data that they have.

[**\>\>**]{.underline}

That they personally have, or that they can access?

**[\>\> Yuri Dzambasow:]{.underline}**

As they\'re going through and collecting, when you provide you\'re basic
identity data, not only are they triangulating that I think this is Yuri
because his name and address and phone number and driver's license, they
all see to correlate and triangulate with one another and they do that
because, as you may know, the credit information can get out of synch
over time, it takes a while for stuff to \-- that\'s why they go out and
ping about 15, 20 databases, and so if the majority come back and say
Yuri lives at this address, and that seems to be good, then they also
know who my mortgage provider, what the payments are, and all that, so
they can run that through an algorithm and create the questions and then
based on the results they can compare them to what they believe the
known answers are.

[**\>\>**]{.underline}

If they don\'t have a relationship with you, they\'re checking a credit
bureau, checking a third party.

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s right.

[**\>\>**]{.underline}

But this works really well for somebody who's 45 years old and in lots
of databases and there's lots of other questions you could ask.

**[\>\> Yuri Dzambasow:]{.underline}**

That\'s correct.

[**\>\>**]{.underline}

But when you get down to a 21-year-old they may not be in very many of
these places and you don\'t have backup questions that would verify that
the first set of data that you gave you have that second round of data
to ping off of.

**[\>\> Yuri Dzambasow:]{.underline}**

Correct. It does assume you actually have a fair amount of history out
there or at least some history out there to ask you some questions. If
it\'s not enough, more than likely they\'ll kick you to an offline
process and tell you to contact \--

**[\>\> Kirk Nahra:]{.underline}**

Although the number of 21-year-olds at this point that don\'t have
credit cards is probably, I mean, seriously, probably pretty low.

[**\>\>**]{.underline}

Question on this slide.

[**\>\>**]{.underline}

Need multiple things on which to verify. Usually not just one. Then off
student loan. But \-- (inaudible) they\'re going to want more than one
thing to verify you on.

**[\>\> Peter Basch:]{.underline}**

This is Peter. I have a question on this slide. Do we know if any of
these examples where a Social Security Number is asked for, once they
verify identity, then make sure that the Social Security Number is not
part of the credit report itself?

**[\>\> Yuri Dzambasow:]{.underline}**

There is actually for the credit report, you have an option to check off
and mask the first \-- how many \-- you can check off an option to
expose only the last four numbers of the Social Security Number, if you
so choose.

[**\>\> Peter Basch:**]{.underline}

Got it. Okay. I\'m just being sensitive to the discussion we had the
last meeting or the meeting before about use of Social Security Number
for in-person identity proofing and what we do with that information
should we obtain it.

[**\>\>**]{.underline}

And in healthcare, that last four would not be identified information.

[**\>\>**]{.underline}

Right.

[**\>\>**]{.underline}

That\'s actually the most sensitive part of the Social Security Number.
That\'s the identifying piece.

[**\>\>**]{.underline}

The first five are actually fairly static. But \--

[**\>\>**]{.underline}

Can\'t be entirely true.

[**\>\>**]{.underline}

Right.

[**\>\>**]{.underline}

There\'s a little bit of work required but \--

**[\>\> Yuri Dzambasow:]{.underline}**

And so the methods that are being used is there\'s third party source
verification going on on the basic identity data and then there's
knowledge-based identification to generate the more personal questions
and see if the consumer answers against a known set of answers.

In terms of activating the account with the credit report if you go
through all that you get the credit record and immediate activation and
if you want to go back in and get it later, they give you a credit
report number you can log back in with and then you provide your state,
ZIP code and Social Security Number if you want to go back and view it
online once you\'ve done it.

With the banks, what they do is they give you, they set up an account,
so you get an account ID established and then from there you can go
ahead and set up an online access to the account so you have to provide
that account information back in, again with your Social Security
Number. This is basically saying now that I have a relationship
established with you, I\'m going to leverage that relationship
information, the account information, Social Security Number that I\'ve
now put in my database to now set up an online account for you, that you
can begin to manage and they were both user name/password accounts.

[**\>\> Kirk Nahra:**]{.underline}

One thing that strikes me as interesting is I\'m trying to analogize to
our interconnected situation. The two banking examples, their identity
proofing is obviously pretty rigorous. I\'m sort of intrigued as to why
it\'s so rigorous. If I want to open a bank account in John Smith\'s
name and all it does is I put money into it and I take money out of that
account, you wonder sort of why they\'re that concerned about who I am.

[**\>\>**]{.underline}

Know your customer.

[**\>\> Kirk Nahra:**]{.underline}

I don\'t know if it\'s driven by those other \-- if I put in 2,000
dollars, you know, it\'s just \--

[**\>\>**]{.underline}

They don\'t know in advance \--

\[multiple speakers\]

[**\>\> Kirk Nahra:**]{.underline}

And the credit report piece, which in the one where I\'m tapping into
existing information, is the least \-- more \-- it\'s more rigorous than
any of the healthcare examples, but it\'s the least rigorous of the
sets, and that\'s where someone is going in and pulling out \-- if Steve
is going in, he\'s getting my information. So it\'s just an interesting
comparison. But if there really is the know your customer stuff, that\'s
says the way that is going to happen is by law, not by business
practice.

[**\>\> Yuri Dzambasow:**]{.underline}

The banking environment is driven, as far as legislation goes they\'ve
always had a know your customer requirement that\'s been there for a
long time. Then 9/11 invoked the Patriot Act requirement. There\'s
basically a terrorist watch list that has to be checked to make sure
you\'re not funding terrorists before you set up a online account.
That\'s an extension of know your customer. And then on top of it, the
banking industry is just responding to market pressures to better know
your customer and better authenticate the customer. As you saw, they\'re
still using user name/pass words as far as subsequent authentication go
into the online account.

So to summarize on 15, in looking at the non-healthcare examples
compared to what we looked at for PHRs, the non-healthcare ones appear
more advanced, a little more stringent, in identity proofing and setting
up online services, and so if you assume that PHR information is as
sensitive as a credit report or online banking information, then perhaps
this group needs to consider looking at beefing up or making
recommendations to beef up the identity proofing processes for those
providers that are offering interconnectivity to other third parties
gaining access to the PHR.

[**\>\> Kirk Nahra:**]{.underline}

I guess, I think your conclusion is sort of half right. It\'s not a
sensitivity issue in my mind. All of the information that we\'re talking
about is sensitive information. But it\'s not really the sensitivity
that we\'re concerned about. We\'re concerned about, we\'re most
concerned about the interconnectivity piece and the ability of someone,
of my data to get mixed up with Steve\'s data. If I have the Web hosted,
maybe use the online no value-added services model, we\'re very
concerned about the sensitivity of that information which is why we want
security controls for that but we\'re less concerned about is it really
my information versus his information.

[**\>\>**]{.underline}

Which is the risk of harm issue.

[**\>\> Kirk Nahra:**]{.underline}

Exactly. And reason it\'s different from a financial model.

[**\>\>**]{.underline}

Okay.

[**\>\> Yuri Dzambasow:**]{.underline}

Do you want me to do slide 16 \--

[**\>\> Kirk Nahra:**]{.underline}

Sure, why don't we do that and have some additional questions for
thought and then we\'ll take a few minute break.

**[\>\> Yuri Dzambasow:]{.underline}**

So some thoughts that fell out of doing the research that I thought
might be worthy for the group to consider, I offer up to the group and
the co-chairs, these four bullets. One, should PHR providers offering
these value-added services, offering interconnectivity with third
parties, should they be required to explicitly describe their identity
proofing practices on their provider sites? So that third parties and
consumers know what needs to happen to set up the PHR and access it, and
all that.

Second bullet, do you want do you want to look at technology such as
knowledge-based authentication, along with the utilization of online
trusted third-party sources as a way of doing identity proofing for PHR
consumers where the consumer has no prior relationship to the PHR
provider?

Third bullet, should third parties who have access to a PHR be identity
proofed separately from the consumer and further, should the identity
proofing be more stringent for those third parties that have write
access into the PHR.

And then lastly, should the degree of identity proofing be commensurate
with the actual value-added service being provided, for example, if
you're only offering appointment schedule is that something that's less
risky than securely communicating with a care provider and do you want
to map values, services to a level of identity proofing, just a
consideration. Those are some of the things that I thought fell out of
this that might be interesting for the group to consider.

[**\>\> Kirk Nahra:**]{.underline}

I have on my watch 2:39. How about we take a ten-minute break and come
back at 2:50? Thanks.

\[break\]

[**\>\> Kirk Nahra**]{.underline}

Welcome back everybody, we are back on the record. What I'd like to do,
we are running a little bit behind and so I would like to ask Yuri
quickly, and without comment from the Workgroup, just walk through his
last couple of slides just to fill in a little bit of the picture. As he
indicated earlier, I think it\'s related to our core topic and may help
inform some of our discussion. I\'d like to do that quickly and then we
will turn to the next piece of our agenda, which is to start to talk a
little more, not to start, but to continue our discussion of sort of our
next steps for the Workgroup.

Yuri, if you could go ahead and do that quickly.

**[\>\> Yuri Dzambasow:]{.underline}**

For those folks on the phone, slide 18. The next one, please. There we
go, yep. And in looking through this, I thought it would be interesting
just to take a quick peek and see which of the PHR providers actually
publish privacy policies. Seeing as they were collecting information
about you to sell you a PHR or provide other services, I would expect
that you would have a privacy policy on your site that I could look to
that says this is how you\'re going to collect my information and keep
it secure and manage it and everything. And what we found was 38 percent
of those PHR service providers offering the value-added services, of the
13, 38 percent didn\'t even publish a privacy policy.

On Slide 19, the next slide.

I also looked at authentication credentials and that is once you
actually go through the process of setting up a PHR, then what is the
credential that's used to log in to the PHR and continue to \--

[**\>\>**]{.underline}

\[inaudible\]

[**\>\> Kirk Nahra:**]{.underline}

We have somebody on who is talking without their phone being on mute.
Could we do something about that?

Go ahead, Yuri.

[**\>\> Yuri:**]{.underline}

Of the 13 of the value-added service providers, three of them actually
were none or unknown as to how you go back and log into the PHR, going
through the process. Typically, it\'s a user name and password or PIN.
In two cases, it was actually asking you for additional account
information once it was all set up. The bottom line is single factor
authentication appears to be the norm in this environment.

And the last thing that I thought was interesting was that 13 percent of
the sites, and I can\'t remember the actual number, 13 percent, it would
have to be two. Two of the 13 sites, there were issues with their SSL
certificate, that's secure socket layer, SSL certificates are used to
establish a secure session with a Website, the little padlock shows up
at the bottom of the browser and says it\'s secure, I can pass
information to the site. And so two of the sites actually had issues and
on the last slide, slide 21 \-- two of the sites actually had issues and
on the last slide, slide 21 \--

[**\>\>**]{.underline}

Echo.

**[\>\> Yuri Dzambasow:]{.underline}**

My echo. Seven-second delay in case I say something bad.

\[laughter\]

[**\>\>**]{.underline}

Very good.

**[\>\> Yuri Dzambasow:]{.underline}**

The issue could be either the certificate expired, it could not be
trusted by the Web browser, meaning it does not actually verify to one
of the root authorities in the browser. Or the name on the certificate
doesn\'t match the domain name in the URL. Those are supposed to match.

If one of those issues occurs, what happens is you get a message. And
this is a message that might appear. There is problem with this Website
certificate. We recommend that you close this Webpage and do not
continue to this Website.

So what I\'m pointing out is that PHR providers online, they really
should make sure they keep these SSL certificates up to date, to avoid
these kinds of issues. Because this would keep consumers shying away
from the site as a not so trustworthy site.

[**\>\>**]{.underline}

And that\'s a message that's generated by the browser itself,
independent of the PHR?

**[\>\> Yuri Dzambasow:]{.underline}**

That's right. This is embedded in the browser. Netscape Navigator has a
similar message. This happens to be out of Internet Explorer 7. That was
just the additional information I had.

[**\>\> Kirk Nahra:**]{.underline}

All right. So Yuri, thank you very much for that. I think that\'s going
to be very useful information as we look at some of our next topics.

Let us move at this point to the next item on our agenda \-- I\'m sorry.

[**\>\>**]{.underline}

I had a quick question. Are we, aside from the evaluating this report
asis, are you planning to do any follow-up research to try and probe
deeper, or is that not something that we\'re thinking or can request
happen?

**[\>\> Yuri Dzambasow:]{.underline}**

From my position, I think if the group would like research and Steve and
Jodi would like me to help out with that, then we can go down that path.

[**\>\>**]{.underline}

Okay, well, I don\'t want to derail our conversation but I think good
research begets good research and I would have some questions about
following up, maybe probing further.

[**\>\> Steve Posnack:**]{.underline}

Let\'s do it, if members have additional questions, that they think are
worthwhile, we should go down. Why don\'t you e-mail them to me. And
we\'ll compile a group and prioritize maybe the top 10 questions that we
can give Yuri.

[**\>\>**]{.underline}

We\'ll just take a list of those and we\'ll talk with the co-chairs and
see which ones are worth pursuing and based on Yuri\'s time and our
resources.

[**\>\> Kirk Nahra:**]{.underline}

Okay, great. Let\'s move on to our next topic, which is CPS work plan
and priorities. We are going to continue the discussion that we started
at I guess our last meeting, it\'s been a little while ago now. And I\'m
actually going to jump to, skip the first bullet point there which is
sort of a carryover review of next topic criteria. And I\'d like to have
two presentations that we\'re going to do to get a little bit of a sense
of what is going on on related topics by some of the other groups in
this area. And so again, the idea was to let us have our priorities, be
able to evaluate our priorities with an understanding of what other
people are doing so that we\'re not reinventing the wheel and
duplicating efforts. Why don\'t we first hear an update from the
Consumer Empowerment Workgroup and talk a little about our working with
that Workgroup. Jodi?

[**\>\>**]{.underline}

Can I ask one question. On the identity proofing, besides going back and
doing more research on this, I just wanted to get a sense from the group
is this something we should keep on the agenda and continue to have
discussions about? I want to see where we want to go with this.

[**\>\> Kirk Nahra:**]{.underline}

My sense is we don\'t answer that question until we get to talk about
what our next steps are. And we should try to figure out where that fits
in. I mean, I\'m going to suggest some topics dealing with these
non-covered entities, you know, there\'s some pieces I think we can link
up, but that\'s something for the group to obviously talk about.

[**\>\>**]{.underline}

Okay, fine.

[**\>\> Kirk Nahra:**]{.underline}

Michelle is going to talk about the Consumer Empowerment.

**[\>\> Michelle Murray:]{.underline}**

This is Michelle Murray. I work for ONC and I support the Consumer
Empowerment Workgroup and I wanted to give you an update on the
recommendation that was accepted by the AHIC on January 23rd from the
Consumer Empowerment Workgroup about working together with CPS on
privacy policies. I have a quick update but first I\'ll read the
recommendation, soyou can remember what it was. The AHIC
Confidentiality, Privacy, and Security Workgroup in collaboration with
the Consumer Empowerment Workgroup should develop principles and
identify best practices for privacy policies for consumers' PHR data
that are interoperable, i.e., protections that follow the consumer as
his or her data moves or is shared. These recommendations should apply
to all individuals and entities including both covered and non-covered
entities under HIPAA.

And the update is that there was a meeting, a brief meeting, between the
co-chairs of both Workgroups back in January, and we\'re working on
scheduling another such meeting to prioritize how we\'re going to go
about working on this recommendation together. Internally we\'ve come up
with a process that might work of Consumer Empowerment first identifying
privacy policy components using research the Workgroup has done. And
then working together with CPS on those priorities and CPS could jump in
and help with the legal aspects and take over and work together on the
other recommendations. That\'s my understanding.

\[siren\]

We have a fire engine going by.

So that\'s the current proposed process. We could definitely have
feedback if you think that\'s an appropriate process. And we do plan to
have the Workgroup co-chairs continuing to meet throughout this process.

[**\>\> Jodi Daniel:**]{.underline}

Can you also Michelle just basically what \-- and I\'m putting you on
the spot, if you\'re not prepared to talk about it, fine \-- but let
folks know what kind of testimony you\'ve already heard on this topic,
just so that folks know what the Consumer Empowerment Workgroup had
heard in coming up with that recommendation, just generally.

[**\>\> Michelle Murray**]{.underline}

Right.

[**\>\> Kirk Nahra:**]{.underline}

Let me jump in for a second. To be clear so people on the phone
understand. When that recommendation is read it sounds like it\'s one of
our recommendatiosn because it talks about our group. That was really a
recommendation that came out of the Consumer Empowerment Workgroup so
this group has not for the most part heard that recommendation before,
and so when that did come out and get accepted by the AHIC, that\'s when
we started that dialogue.

Can you do two things? Why don\'t you read that again and then go back
into Jodi\'s question?

[**\>\> Michelle Murray:**]{.underline}

Okay. CPS Workgroup in collaboration \--

[**\>\>**]{.underline}

Could you read slowly?

[**\>\> Michelle Murray:**]{.underline}

Sorry. \-- in collaboration with the Consumer Empowerment Workgroup,
should develop principles and identify best practices for privacy
policies for consumers\' PHR data that are interoperable, i.e.,
protections that follow the consumer as his or her data moves or is
shared. These recommendations should apply to all individuals and
entities, including both covered and non-covered entities under HIPAA.

And we can e-mail this out, I think, Steve, right, so people have this?

[**\>\>**]{.underline}

Sure.

[**\>\>**]{.underline}

Yeah, that would be helpful, thanks.

[**\>\> Michelle Murray:**]{.underline}

All right.

[**\>\> Kirk Nahra:**]{.underline}

Why don\'t you talk a little bit about the testimony?

[**\>\> Michelle Murray:**]{.underline}

One of the main parts of testimony that we\'ve had was that Altarum
environmental scan that we\'ve been discussing did have a section that
focused on privacy policy. They did some work similar to what Yuri did
where they looked at what was online and available publicly through a
variety of PHRs and their Websites. And kind of made some assessments of
how available are these policies, are they easy to read? We can also
send that report out if it hasn\'t been seen before.

And we had testimony in July of this year, of 2006, and again in
September, that briefly touched on privacy issues, but it wasn\'t a main
focus. So there\'s a little bit of testimony there. And we can also look
into bringing in other testifiers in the future.

[**\>\> Kirk Nahra:**]{.underline}

Okay, so when Paul and I had had our call with the Consumer Empowerment
chairs, one of the issues that came up with was that recommendation has,
from our perspective, some assumptions built into it that weren\'t
necessarily the same assumptions that this group had been working on.
For example, the point about the policy should be the same for people in
and out of HIPAA. Well, that may end up being our conclusion, but
that\'s not an obvious \-- we wanted to make clear that was an
assumption that drew with it some, had some background to it and had
some components there.

So we had a first discussion with the co-chairs, designed to sort of
make sure we were on the same page. I don\'t know that we were saying
anything that was inconsistent or in conflict, but they had a particular
direction and we were a little bit parallel to them. So we\'re trying to
move that forward so we can come up with some ways to get, not duplicate
our efforts and make our recommendations consistent as we move forward.
We\'re going to continue to have that dialog.

I think that the description Michelle sort of next steps makes a lot of
sense. We were going to look at sort of the Consumer Empowerment group
trying to come up with things that consumers are looking for in these
privacy policies \-- that obviously assumes that consumers have a
perspective on those policies. But that\'s \-- come up with sort of
things that should be in these policies and then we would take that list
and match them up against both what\'s in the market, how much of that
is currently included for HIPAA covered organizations, if it\'s
something that if there were 37 things on that list, and only 20 of them
were even required by HIPAA groups, then we\'re talking about having
some set of rules that would go beyond HIPAA, even for people covered by
HIPAA. So those were some of the assumptions that we wanted to flesh out
and put a little more detail on to that.

We also had a little bit of a sense from the discussion there may need
to be expertise on some of the HIPAA details brought over to that
Consumer Empowerment Workgroup and we offered to provide that assistance
if there was anything there that was needed.

That\'s sort of heads up for the time being. I think that right now,
again, we each have our current agendas that have some areas of overlap
but some areas that don\'t overlap. And we\'re going to be trying to
make sure that the overlap areas over the next few months don\'t involve
duplication of resources and involve us trying to work together as best
we can.

Any particular questions on that? It\'s really sort of beginning stages
and we\'ll have some more information by each of our next upcoming
calls.

[**\>\>**]{.underline}

I would just add, in following up on your HIPAA comment is that, based
on another recommendation that was put out at the AHIC, is that OCR is
committed to working with the Consumer Empowerment Workgroup to map
HIPAA requirements to a set of defined PHR scenarios. That we\'ll be
working with Steve and others at ONC to identify what those typical, or
to identify a typical set of PHR environments and then come match HIPAA
requirements to the sharing environment.

[**\>\>**]{.underline}

Okay.

[**\>\>**]{.underline}

I just wanted to clarify something. It sounds like all of the work
coming out of Consumer Empowerment that where there\'s overlap is
related to personal health records. So there\'s no other discussion
that\'s been ongoing within that Workgroup that would then carry over
into what we\'re doing?

[**\>\> Michelle Murray:**]{.underline}

No, they work only on the personal health record. And where it might
interact with the electronic health record.

[**\>\>**]{.underline}

Well, right, so that\'s where I was going. I mean, I guess I just wanted
to know how narrowly focused the sort of overlap was going to be.

[**\>\> Kirk Nahra:**]{.underline}

The collaboration piece, and I think it\'s in the recommendation
specifically, focus was on PHRs.

[**\>\>**]{.underline}

Right.

[**\>\> Kirk Nahra:**]{.underline}

So we want to be attentive to whether there are other issues as well but
that particular piece was look, you\'re both looking at this particular
issue, let's make sure there's collaboration.

[**\>\> Michelle Murray:**]{.underline}

And this was one of the issues to be discussed at the last meeting of
the CPS Workgroup as one of the topics that may be of interest to this
group, because it\'s an area where there are instances that aren\'t
regulated and this sort of we are getting feedback from CE on this, et
cetera. So it was something we had talked about and there were sort of
these conversations going on at both Workgroups. So we can see an
opportunity to work together on it.

[**\>\>**]{.underline}

I wanted to clarify scope.

[**\>\> Kirk Nahra:**]{.underline}

Any other comments on the Consumer empowerment Workgroup activities?

[**\>\>**]{.underline}

I would just like to say that I\'m glad to see that level of scope to
address the non-covered entity piece of that. Because I think we did
talk about that before and it\'s a concern that I have because there\'s
not current legislation to reach that population and how do we put some
sort of standards around those people maintaining personal health
records when they\'re not covered under HIPAA. I just think it\'s a
whole \--

[**\>\>**]{.underline}

I agree.

[**\>\>**]{.underline}

Any other comments on that issue? Why don\'t we move on to our next
update, which is the NCVHS update. John Houston, I understand you\'re
going to be able to give that?

[**\>\> John Houston:**]{.underline}

That\'s correct, and I think it's obviously a good segue into what I\'m
going to talk about for a few minutes. My update will be specific to the
privacy and confidentiality subcommittee of NCVHS. Is Maya in the room?

[**\>\> Maya Bernstein:**]{.underline}

I\'m here.

[**\>\> John Houston:**]{.underline}

Feel free to chime in whenever I miss something because I\'m sure I
will.

[**\>\> Maya Bernstein:**]{.underline}

Do you have any doubt?

[**\>\> John Houston:**]{.underline}

I have no doubt. That I\'ll miss something.

\[laughter\]

**[\>\> Maya Bernstein:]{.underline}**

That I would chime in.

[**\>\> John Houston:**]{.underline}

I see what you were saying. I gotcha.

[**\>\> Kirk Nahra:**]{.underline}

We have more confidence in you than you do, John. Go ahead.

**[\>\> John Houston:]{.underline}**

Believe me, you just don\'t know me well enough. Unfortunately \-- I\'m
going to give an update and tell you before I do that unfortunately last
week we had an NCHVS meeting and the time that was devoted for the
privacy subcommittee I guess was lost because of the snowstorm. So we
actually had to reschedule our meetings, make them into conference calls
so we can go over some of the things that are on our agenda and where
we\'re going but I can still speak because I think it\'s, there are some
things we\'ve been doing that are very relevant especially based upon
the last update and that being for the last three hearings that we\'ve
held for the privacy subcommittee, we\'ve held them in essence on
exploring issues related to non-covered entities.

So we actually held a meeting, I\'m sorry, testimony in September,
November, then in January, and in each one of those we engaged various
groups that would not necessarily be considered covered entities. And
for example in the latest round of testimony we heard from non-covered
health data benefits and services providers. Non-covered healthcare
providers such as spas, athletic trainers, and the like. So we really
have tried to delve into that, this particular area.

And really we\'re at the point now where we really I think are about
ready to come up with recommendations to send to the Secretary as to how
to deal with non-covered entities especially as it relates to having to
share data between covered entities and non-covered entities. And I
think really by implication there will be some discussion about how
we\'re going to deal with this in the context of what\'s going on with
regard to NHIN, and what we\'ve been talking about as part of this
Workgroup.

So we\'re pretty far along in our investigations as to issues associated
with non-covered entities. And really I think now again short of
drafting a letter which describes some of our concerns, we\'re then
looking for what is the next set of topics that really we\'re going to
start focusing on. Maya, I forgot, there were supposed to be two letters
we were supposed to draft, recommendation-wise. Do you remember what the
second one was?

**[\>\> Maya Bernstein:]{.underline}**

The other letter has to do with the intersection between FERPA and
HIPAA, that's the Family Educational Rights and Privacy Act that
protects education records. So we heard from like school nurses and the
athletic trainers have a piece of that to the extent they\'re operating
in schools. And essentially FERPA is a very protective of privacy but
was designed for the educational environment and doesn\'t take into
account the public health needs of school nurses, so for example
there\'s a lice breakout or immunization issues or trying to, turns out
there\'s autism issues. Autism is more often identified in school than
it is in a healthcare setting for a variety of reasons and they have
trouble sharing the information that they have with other healthcare
providers, with public health organizations and so forth because FERPA
was designed for grades and registration and just didn\'t contemplate
healthcare records that might be in a school setting.

We heard a lot about that in particular. So there\'s going to be a
separate letter on that because we don\'t have authority over FERPA.
That\'s the Department of Education. And the committee recognizes that
if they make recommendations to the Secretary it would have to be that
we work together with Department of Education to fix, you know, somehow
improve that situation.

[**\>\> John Houston:**]{.underline}

We heard very clearly that they want \-- there\'s a lot of conflict and
at the same time I think people just want to have a good clear
understanding of what the boundaries are. They\'re almost not as
concerned about where the boundaries are drawn as long as there\'s a
clear boundary and they are able to understand what the rules are.
Because really it\'s pretty unclear at this point in time.

**[\>\> Peter Basch:]{.underline}**

This is Peter. Could I ask a clarifying question on FERPA, please?

[**\>\>**]{.underline}

Sure.

**[\>\> Peter Basch:]{.underline}**

Yeah, it\'s my understanding is with FERPA, that the rights that are
given to emancipated minors in regards to medical records don\'t apply,
meaning that parents have a right to see the school health record or the
school record which may contain health data.

[**\>\> John Houston:**]{.underline}

I don\'t think we ever got into that particular detail. Had we, Maya? I
don\'t remember any of that.

[**\>\> Maya Bernstein:**]{.underline}

I mean, if you\'re emancipated, you\'re emancipated, right? You have
legal \-- I shouldn\'t be answering this because I\'m talking off the
top of my head.

[**\>\> John Houston:**]{.underline}

We never delved into that particular issue, though it does sound like
one we should try to get some clarification.

[**\>\> Peter Basch:**]{.underline}

I\'m raising that because that\'s an issue we are dealing with now on
one of the state task force that I chair, which is Maryland's EHR task
force.

[**\>\>**]{.underline}

Why is that issue coming up in particular?

[**\>\> Peter Basch:**]{.underline}

Because there\'s an interest in interconnecting health records with
school health records to better share information bi-directionally. And
one of the concerns was that if an emancipated minor was seen, let\'s
say by the provider for birth control or treatment of a STD, and in a
particular state that information is protected and confidential. If it
were to transfer into a school health record, what the adolescent was
told was private is no longer, or private from his or her parents, is no
longer necessarily protected from his parents. That\'s what we were led
to believe and I was just trying to confirm whether or not that\'s true.

**[\>\> Deven McGraw:]{.underline}**

But Peter, this is \-- I think that was you Peter. Sometimes it\'s hard
to tell voices. This is Deven McGraw from the National Partnership for
Women and Families. It\'s not just in the case of emancipated minors who
actually are emancipated so the parental consent issues don\'t apply for
a whole range of issues, including probably in the educational context,
but in certain states and I\'m not sure whether this is the case in
Maryland there are what are called mature minor rules with respect to
consent and medical records which allow the minor to consent to get STD
treatment, pregnancy tests, et cetera, without needing parental consent
if they\'re of a certain age. And in that case they\'re not emancipated
but nevertheless \--

[**\>\> Peter Basch:**]{.underline}

I may have used the wrong term.

[**\>\> Kirk Nahra:**]{.underline}

Deven is definitely right. I had occasion to look at this in the last
few days. Those laws are very complicated and very confusing and
they\'re essentially laws from a doctor\'s perspective that allow the
doctor to treat a minor, that give the doctor permission to treat a
minor without the consent of the parent. There is, sometimes those laws
are limited to treatment issues, other times they cross over on to some
of the privacy issues, but there\'s a very difficult interaction between
HIPAA standards on personal representatives and parental rights in
connection with that treatment issue. So its' a very complicated area,
Peter, and I guess you should make sure that the information you\'re
getting is accurate and it\'s difficult to make it accurate particularly
on a more \-- you could look at Maryland\'s laws without any problems,
but I had a context we were looking at it for 50 states and it was just
a complete mess.

[**\>\>**]{.underline}

I can just say NCVHS OPs, we didn\'t look at the issue, so \--

[**\>\>**]{.underline}

I can tell you, in the state of Pennsylvania, if a minor, we've decided
that, as part of the health system I work for, that f a minor has the
right to separately consent for treatment on any, for any type of
treatment, that the minor then has an expectation of privacy and we will
not disclose information to a parent. So if they can consent, then \--

**[\>\> Peter Basch:]{.underline}**

That\'s in the health record. But my question was, if that information
in a physician record was then made available into a school record,
would those same privacy rates convey?

[**\>\> Kirk Nahra:**]{.underline}

We don\'t know the answer to that and Peter, there\'s others issue which
is when you turn in to the insurance company, the different rules would
apply to the insurance company because the insurance company's got a
policy with the parent.

[**\>\>**]{.underline}

Right.

[**\>\> Kirk Nahra:**]{.underline}

Again, there\'s lots of \-- I mean, very complicated issue and again
from my perspective it points out something someone said a few minutes
ago, which is clarity of these rules may be at some level more important
than what the rules say. People \-- right now it\'s very hard to figure
that stuff out.

**[\>\> John Houston:]{.underline}**

I think that\'s as much what we heard in our testimony was that people
\-- I mean, I remember one trainer saying I want to know what the rules
are.

[**\>\> Kirk Nahra:**]{.underline}

Yeah, I\'ve said that publicly, in speeches, that I don\'t even care
what the rule is, just let me know what it is so I can understand it

**[\>\> Peter Basch:]{.underline}**

I agree and last comment, I don\'t disagree with that sentiment at all,
but for those who take care of those minors, and make certain statements
regarding privacy of their healthcare, even if they come in and pay for
it themselves, so it\'s not affected by the insurance company, I want to
make sure that our providers are making accurate representations.

[**\>\> Kirk Nahra:**]{.underline}

Let me ask you a question about you said you were going to be making a
recommendation about non-covered entities.

[**\>\> John Houston:**]{.underline}

Right.

[**\>\> Kirk Nahra:**]{.underline}

Do you have any sense of the timing on that?

[**\>\> John Houston:**]{.underline}

I think our plan is by early summer to have letters prepared to go to
the Secretary. Maya, there\'s like a June meeting I think we\'re trying
to get on target for?

**[\>\> Maya Bernstein:]{.underline}**

Full committee meeting is in June. I\'m not exactly sure what the dates
are.

**[\>\> Kirk Nahra:]{.underline}**

Full NCVHS?

[**\>\> Maya Bernstein:**]{.underline}

Full NCVHS. The subcommittee can\'t do anything on its own. It has to go
through the full committee, so what we've, so let me tell you the
timing. We\'re going to have some conference calls, as John mentioned,
in the upcoming week to figure out what the topics should be for our
April hearing which will be an in-person hearing for one day in
Washington, D.C. In sort of middle of March we\'re going to have a
conference call to talk about those letters that are coming out of
previous work. And I think the idea would be to draft those letters and
circulate them among the subcommittee and eventually the committee,
hopefully more than once, before the June meeting.

And it's already sort of been discussed in, without having drafts but in
the abstract, basically in principle, at the last full committee meeting
last week, and so the committee is prepared, they know this is coming,
and they\'re going to look for some drafts and they'll have an
opportunity comment on them and then they\'ll be discussed, usually what
happens is that they\'re discussed on the first day of the full
committee meeting and voted on on the second day.

[**\>\> John Houston:**]{.underline}

So we\'ll have the letters out in June. And I don\'t feel comfortable
discussing what our recommendations are because I think that\'s \--

[**\>\> Maya Bernstein:**]{.underline}

We don\'t know what they are.

[**\>\> John Houston:**]{.underline}

\-- I think that\'s up to the committee to decide on those.

**[\>\> Jill Dennis:]{.underline}**

John, can I ask question? This is Jill Dennis. I think I understood you
to say the recommendations were related to the non-covered entity
sharing data back and forth with covered entities.

**[\>\> Maya Bernstein:]{.underline}**

Not necessarily.

[**\>\> Jill Dennis:**]{.underline}

All right. Because \--

[**\>\> John Houston:**]{.underline}

That's one aspect of it. I think there\'s also aspects of it about
simple issues associated with how you deal with a non-covered entity
having PHI, whether they're collecting that themselves.

**[\>\>]{.underline}**

Right. And their uses of it. So you\'re not limiting your
recommendations to the sharing with covered entities.

[**\>\> John Houston:**]{.underline}

No, in fact I think this is a very rich topic, obviously, and I think
obviously with the NIHN on the horizon, it\'s going to be a re-occurring
issue simply because you can\'t expect that only covered entities are
going to be participating in the NHIN. So I think we recognize that
issue.

[**\>\>**]{.underline}

I think the other thing to point out is in the June 22nd letter, from
NCVHS on privacy and the NHIN, the committee was fairly explicit in
saying they intended to, I mean they recommended that anyone who holds
health information whether or not they\'re a covered entity, whether
they're a financial institution, educational institution, whether they
hold, share, store, whatever, should have some rule. The committee is
already on record as saying something broad and this is going to refine
that.

[**\>\> John Houston**]{.underline}

The letters \-- the letter wasn\'t, the focus wasn\'t on NHIN, though.
At least I don\'t believe that\'s where this is going to be focused. It
will be on \--

**[\>\>]{.underline}**

That\'s, my sense, John, is that that's the context, new, non-covered
entities are arising, RHIOs, PHRs like WebMD, you know, independent
PHRs, and they're arising in the context of all the things happening
with NHIN, whether or not they\'re specifically connected to that.

[**\>\>**]{.underline}

I think there\'s also a lot of non-covered entities today.

[**\>\>**]{.underline}

Medical spas that have nothing to do NHIN, but are just not covered
entities.

[**\>\>**]{.underline}

Right.

**[\>\>]{.underline}**

They take cash, for example.

[**\>\>**]{.underline}

And a good example of this was the example of the spa.

[**\>\>**]{.underline}

Right.

[**\>\> Kirk Nahra:**]{.underline}

That\'s an interesting question. I mean, I would assume, I mean,
there\'s that, I don\'t want to call it a loophole, but there's a HIPAA
exception on providers. Not all healthcare providers are covered, they
have to bill a certain way. There\'s a historic reason for that. I would
assume the question about spas and athletic trainers and doctors who
don't bill to insurance companies, is not something that\'s within our
purview, particularly, except as it touches on the PHR, EHR environment.

[**\>\>**]{.underline}

You would be amazed how much medical information these organizations
either have or would like to have in order to perform the services they
provide.

[**\>\> Kirk Nahra:**]{.underline}

Absolutely. And I guess my \-- I mean, I have a personal view, having
nothing to do with any information I\'ve heard in the course of this
activity, that I don\'t quite understand, I understand the history but
it doesn\'t make any sense to me to say that how this doctor treats the
information he or she has is different depending upon how we bill. So
that\'s never made any particular sense to me, but if everyone on this
Workgroup thought HIPAA should be amended to get rid of that exception,
that doesn\'t strike me as having anything to do with our assignment.

[**\>\>**]{.underline}

It sounds like \-- I mean that\'s clearly within NCVHS's purview. But if
it\'s not connected to electronic sharing of health information, I would
agree with Kirk it wouldn\'t necessarily be something that would be
within the charge of this Workgroup.

[**\>\>**]{.underline}

Okay.

[**\>\>**]{.underline}

Yeah, I think it\'s really a boundary of what will constrain secondary
uses of EHR data is where I think NCVHS is also concerned.

[**\>\> Kirk Nahra:**]{.underline}

Maybe that\'s the \-- maybe that\'s the connection we make and this goes
back to something, I don\'t remember whether this was Peter or John a
minute ago talking about the amount of information they have. If a, I
mean, I don\'t know, a spa may be different from a doctor who only takes
cash, but that doctor is presumably going to have the same need to
gather information from a, from the NHIN as a doctor who bills
insurance. And so that would be, that would be the link, I suppose, is
to say, all right, there are going to be users of this data, not service
providers, but users of this data who are core medical providers, or
medical providers of some kind, but are not within the HIPAA structure
due to that historic piece, but are clearly using NHIN information in
the same way that all the covered entities would be using it.

[**\>\>**]{.underline}

Right.

[**\>\>**]{.underline}

What we heard from the medical spa example in particular is what you\'ll
often have is a doctor\'s office who is doing, they\'re sort of one of
the cosmetic guys are sort of one of five kinds of specialties, a
dermatologist, or the plastic surgeons, or they're dental aestheticians,
that sort of thing, and they have a regular covered practice and across
the street, so you can go and get your liposuction, and then you can go
across your street to the medical spa and get your Botox and have a mice
massage or something, with their subsidiary that\'s cash-only, and the
record gets either passed back and forth or there\'s some, there\'s
often relationships between those two things. It\'s unlikely that those
things are going to be rising up in a vacuum, by themselves, completely
separate from the other kinds of things that we're doing that have
electronic records.

[**\>\> Kirk Nahra:**]{.underline}

Right. But the distinct issue of should those people be covered, for
example, by HIPAA is broader issue than our issue.

[**\>\>**]{.underline}

Right but it\'s not even covered by HIPAA or not covered by HIPAA,
covered by something, I think the issue is \--

[**\>\> Kirk Nahra:**]{.underline}

Right. They are not covered by HIPAA today.

[**\>\>**]{.underline}

Today they are not covered by HIPAA, and we\'re not necessarily saying
HIPAA rules should apply to them. We're saying, I mean the committee has
said, as I understand it, some rules should apply to them.

**[\>\> Jodi Daniel:]{.underline}**

This is Jodi. It sounds like NCVHS privacy and confidentiality
subcommittee is planning to have recommendations in that area.

[**\>\>**]{.underline}

Yes.

**[\>\> Jodi Daniel:]{.underline}**

And so, you know, in the interest of not obviously duplicating efforts,
it\'s probably worth us sort of, John, if you could kind of keep us
abreast of what\'s going on in the NCVHS subcommittee and if in fact
there are issues that come up that are perhaps appropriate for this
Workgroup, that would be helpful.

[**\>\> Maya Bernstein:**]{.underline}

The PHR thing, sort of looking, and the reason I mentioned the schedule
and John is talking about the schedule, the April hearing \-- and we
should, when we\'re picking our dates, figure out also what this group
is doing \-- there was some talk earlier on about having a joint
meeting. And we could do it, if we're \-- you know one of the topics I
recall, John, you may recall other topics, that the subcommittee is
talking about is the privacy and PHR piece, NCVHS already did some work
on PHRs previously, and there's more to do, obviously, on privacy and
PHRs, both coming out of AHIC and coming out of NCVHS. That might be one
area that's ripe to work together, if we wanted to try to have a joint
hearing, April is a good time to do it, if we can find a date that works
for everybody. Or, you know, but I can\'t say that that is what the
subcommittee is going to decide to do. John, do you think it would be
inappropriate to have either Kirk or Paul or some representative from, I
mean, we have staff people, but to have members from the CPS Workgroup
sit in while we talk about the next step for \--

[**\>\> John Houston:**]{.underline}

I think that would be entirely appropriate. I think something we'd have
to ask Mark but I don\'t see why we wouldn\'t. I think it would be great
benefit, actually. You know, the other area, by the way, I think there
was some discussion, it may not be on the privacy subcommittee of NCVHS,
but I know there\'s been some talk about delving into some secondary use
issues.

[**\>\>**]{.underline}

I agree that\'s an issue and nobody quite knows what that means.

[**\>\>**]{.underline}

We\'ve had conversations with some of the folks from NCVHS and some of
the staff about secondary uses and whether or not NCVHS might want to
look at some of the issues regarding secondary uses. Both policies and,
but particularly, I think, particularly in the area of quality. This is
in the context of the Quality Workgroup trying to figure out if there
were issues there.

[**\>\>**]{.underline}

They\'re mostly interested for research purposes in terms of quality. It
is coming out of the Quality Workgroup.

[**\>\>**]{.underline}

Right.

[**\>\>**]{.underline}

There are some preliminary discussions about working together, having
ONC be involved, because of some of the things we're hearing from these
AHIC Workgroups, letting NCVHS take a first cut at some of these issues.
So there are some discussions about NCVHS taking on some issues related
to secondary uses particularly in the area of quality. It hasn\'t been
fleshed out, it's just sort of preliminary discussion.

[**\>\> John Houston:**]{.underline}

Simon Cohn is the chair of NCVHS. He put me on notice he wasn\'t sure
what was going to happen but he wanted me to know that something
probably was going to happen with regards to secondary uses, and I
should be ready to help out, so I said that's great.

**[\>\>]{.underline}**

Yeah, and we should talk to Simon about it.

**[\>\>]{.underline}**

They're not really thinking about it in the context of privacy.

**[\>\> John Houston:]{.underline}**

No.

**[\>\>]{.underline}**

It's a bit frustrating to me, actually, because there's a huge privacy
angle.

[**\>\> John Houston:**]{.underline}

But Simon was very cognizant of the fact that there's a privacy
component, and he specifically wanted me involved, I know, because of
that.

[**\>\>**]{.underline}

I don\'t think there was any intent from our office that that wouldn't
be in scope.

[**\>\>**]{.underline}

Yeah.

[**\>\>**]{.underline}

Again, we\'re in preliminary discussions at this point, I don't think
anything's been fleshed out.

**[\>\> Peter Basch:]{.underline}**

This is Peter. Can I ask one quick question on pertaining to the last
discussion about covered entities, and who perhaps should be considered
for future discussions by either Workgroup. Has there been any
discussion on coverage of retail medical clinics, which are a growing
phenomenon and probably have more PHI than cosmetic spas?

[**\>\>**]{.underline}

Are these not billing?

[**\>\> Peter Basch:**]{.underline}

Some do, some don\'t. Often they\'re cash only.

[**\>\> John Houston:**]{.underline}

That\'s sort of gets \-- we didn\'t specifically delve into that
particular group but I think that, I\'m sure that they would have a lot
of the same issues that some of the other entities did that we talked to
and I think hopefully we can craft a letter that meets that, addresses
that particular issue.

[**\>\> Peter Basch:**]{.underline}

I\'m only raising it because I think that the number of them are
growing, and that as emergency rooms become more and more clogged, and
primary care doctors become less able to care in a timely fashion for
their patients' non-life-threatening medical concerns, more and more
consumers will be using these retail clinics for routine medical care,
and the issue of whether or not they have expectations of privacy is one
that is probably something that most people are not aware of.

[**\>\>**]{.underline}

A number of them, a number are actually trying to implement systems
because they don\'t want to be perceived as the medical home or because
they shouldn\'t be the medical home of capturing the information from
the patient visit and the clinic electronically in order to transfer it
to the patient\'s medical home. And so I think it\'s a really relevant
area. I\'m a little bit confused by this conversation though because I
feel like we\'re jumping the gun on setting this group\'s agenda because
all of these issues that we\'re discussing are things that I at least
have submitted as potential topics for discussion and yet I\'m hearing
them get carved up into other Workgroups and other activities and I
would rather start with a conversation about where we see our activities
going over the course of the next six months to a year, and then
figuring out how to dovetail that with the other \--

[**\>\>**]{.underline}

And I think the whole point was so that this group was informed about
other things that are going on and can think about how best to
coordinate.

[**\>\> Kirk Nahra:**]{.underline}

Let\'s go ahead and turn to the next agenda topic and the work plan. I
mean, one of the things that I hear from what John and Maya were saying
is that NCVHS has done a lot of work in connection with these
non-covered entities. Some of those issues are what we would envision as
being in the scope of our group. Some maybe are not or are broader or
include things that are both in and outside of our scope. I would
generally say that if that work, if NCVHS is moving forward with a June
timetable, that I\'m not sure there\'s any benefit to us trying to
reinvent the wheel on those issues. I do like the suggestion of trying
to have a joint hearing or something like that if that\'s feasible,
because I think that\'s not reinventing the wheel. But I was intending
to talk about these non-covered entities as something we should turn our
attention to and I guess I\'m going to back away from that given where I
think NCVHS is. If they said that\'s going to be December, that\'s a
little different issue.

**[\>\> John Houston:]{.underline}**

Let me say this. Knowing Mark Rothstein well, I cannot imagine that Mark
would not be open to coordinating these activities between these two
groups. I mean, clearly we want to get as much benefit out of, or wisdom
as possible and maybe we don\'t have joint hearings because we can cover
more ground separately if there\'s enough topics and I think there are,
that warrant, you know, investigation and recommendations.

[**\>\> Kirk Nahra:**]{.underline}

Let me do this, let me go through \--

**[\>\> Maya Bernstein:]{.underline}**

I wasn\'t thinking about that topic for our joint hearing. We\'re both
in a position of trying to figure out what the next topic will be at the
same time. Not the non-covered entities issue, which NCVHS has already
had three hearings, we're working on a letter for that. Now, we\'re
going to talk about what\'s next, starting in April. And this group is
also thinking about what\'s next, starting about then. So if it\'s PHRs
or if it\'s some other topic, let\'s figure out if we can \-- that seems
to me there are other areas where we could collaborate where it might be
fruitful.

**[\>\> John Houston:]{.underline}**

And Maya, it may not even be collaboration, just coordinating so we\'re
not stepping on each other's toes, and I know Mark will be open to that.

[**\>\>**]{.underline}

Right, right.

[**\>\> Kirk Nahra:**]{.underline}

Okay, so let me do this. Let me refresh people\'s recollection on what
was I guess a slide that was turned in to the AHIC for the last AHIC
meeting which as Jodi indicated did not get a lot of attention at the
last AHIC meeting. We identified a couple of potential or future topics.
One of them is the identify proofing issue that Yuri was talking about,
the identify proofing in instances where no prior relationship exists.
We should talk about what we want to do next with that, if anything. Let
me move forward before we start discussion on that.

Then we have a topic on an analysis of the effect consumer choice and
control could have on the benefits of electronic health information
exchange. What is intended by that description is to talk about impacts
of differing models of consumer control. If you let consumers say, I
want X, Y, and Z in my record, but not A, B, and C, what kind of impact
would that have on the system that we\'re looking towards. Similarly, if
they can control who gets access to what, again, what kind of impact
would there be from that kind of a structure. Now, we have prepared,
with Jodi and Steve\'s help, a list of information gathering questions
that were designed to go out in a Federal Register notice with an eye
toward gathering information on those questions. We had originally
envisioned getting those out in time that people would have a good
amount of time before our next meeting which is a potential testimony
hearing in March. I\'m concerned at this point that those haven\'t gone
out and therefore if we tried to get those out in the next few days, we
don\'t have a lot of time. So that\'s something to be aware of, we do
have a list of questions. I don\'t think that\'s been circulated to the
Workgroup yet, although those are probably in a position to do that. But
those were questions that were designed to solicit information on what
these different consumer choice models would do to both to the NHIN
conceptually and other kinds of health information exchange.

**[\>\>]{.underline}**

One clarification, Kirk, what we had been doing (inaudible) in the
context of personal health records, so they\'re a little bit more narrow
than that topic. It was sort of a combination.

[**\>\>**]{.underline}

So they\'re not sort of should we have people opt in or out NHIN, or
should we have people control what parts of their EHR can be had \--

**[\>\> Kirk Nahra:]{.underline}**

Well, maybe we have a disconnect. What I had envisioned asking about, or
gathering information about is if we put in different kinds of choices
for those questions, you let people opt in, you let people opt out, you
let people opt in halfway, how would that affect things like medical
quality, which is one of the goals? Administrative savings which is one
of the goals? I want to understand what difference those things would
make. If the answer is we can give every consumer full and complete
choice over anything that goes in and whatever happens to it and still
achieve all of those goals, great answer. I don\'t have any particular
sense that that\'s how it\'s going to play out but I want to understand
if we give people an opt in or an opt out choice completely, that\'s
going to destroy our efforts to improve medical quality. Again, I don\'t
have any idea if that\'s the answer. That\'s what I want to learn, what
the impact of those decisions would be.

[**\>\>**]{.underline}

What is your question to us now about what we think our topics for the
next meeting in March are?

[**\>\> Kirk Nahra:**]{.underline}

We\'re going towards what are our next topics in general. We need to \--
I don\'t want to put as necessarily what we\'re going to do in March. I
think we\'re going to get to that. But one of the questions in March is,
we originally talked about that being a testimony hearing, it's not
clear to me how viable it is to make that a testimony hearing when we
don't, as of today, have a list of topics for testimony and gathering
it. So we just need to, we need to play that out, but I'm trying to go
through what we had identified previously as our next potential topics
and I want to get through the list so we can then open up for discussion
on what people think we should be focusing our attention on.

So e have identity proofing in instances where no prior relationship
exists, that\'s Yuri\'s topic. We have this question about effects of
consumer choice and control, at least in the PHR setting. I would hope
that would be broader than that. Then we have the question of
identification and analysis of changes in the health IT environment
since HIPAA. The idea for that is to look at what\'s different today
from when the HIPAA rules were passed. That would involve some of the
activities that John was talking about in terms of new kinds of people
that have health information, new kinds of providers, it would look at
RHIOs, it would look at the role that they\'re playing in this
structure, to see whether this is really different from HIPAA or not
different from HIPAA. So again, the idea there, at least from my
perspective, is do we want to say that things have changed in the HIPAA
universe such that we need to change the HIPAA rules? Or are we looking
at a situation where, you know what, there are these other people that
are outside of HIPAA, maybe all we do is bring them inside HIPAA or
something HIPAA-like. And again, all of those options are sort of on the
table, but trying to look at what\'s different today from what was
happening, what do we call it? Ten years ago, five years ago, whatever.

[**\>\>**]{.underline}

If I could just caveat that. If we were going to do, that I\'d rather
see us look at what is different in healthcare today, not in the HIPAA
environment today. Because I think the healthcare environment is
continuing to evolve and what was put in place to protect individually
identifiable information at a snapshot in time is now being surpassed by
all these different technologies.

[**\>\> Kirk Nahra:**]{.underline}

I said since HIPAA, since that time period. There was a set of rules
that came out, that was snapshot in time. How different does the
snapshot look today?

[**\>\>**]{.underline}

Could we call it an analysis of the healthcare consumer protection
landscape? I mean, that\'s what I view it \-- I mean, we've got HIPAA as
one tool, but there's all these other tools that are in a completely
different context, and set of circumstances, and I guess I share your
perception that just focusing on a conversation about in HIPAA, out of
HIPAA, it's sort of irrelevant given that we're in the 21st century.

**[\>\>]{.underline}**

I hear two different things, though. I hear you saying we need to expand
this beyond HIPAA. And I hear Kirk say people keep saying that these
non-covered entities should be brought under the same rules as
HIPAA-covered entities, and I think what I hear Kirk saying is, well,
let\'s understand is there really something different that\'s happened
since those policies were put in place that warrant either a relook at
those policies, new policies for these organizations that are outside of
HIPAA. What\'s different that would require us to look at establishing
different policies? And I don\'t think what you\'re saying is
necessarily exclusive of each other.

**[\>\> Kirk Nahra:]{.underline}**

I think that\'s right. Again, here\'s how I have looked at it. We have
entities that today are covered by the HIPAA rules, a hospital, for
example. If we\'re going to say that we want as recommendation of this
Workgroup some new obligations imposed on hospitals because of
healthcare IT changes or the NHIN or whatever we want to call that, I
want to understand why that environment is different from what was in
place when HIPAA went into effect, to know whether the rules for
hospitals aren\'t good enough or aren\'t applicable there. The answer
may be there\'s nothing different. The answer may be they\'re
tremendously different. The answer may be there\'s nothing different but
what\'s been in place didn\'t work. Those are all potential conclusions.

**[\>\>]{.underline}**

But you\'re starting with a covered entity. What if you start with a new
type of business that didn\'t exist ten years ago, like a RHIO?

**[\>\> Kirk Nahra:]{.underline}**

Let me finish, because I gave one question. That\'s a very distinct,
defined question. I don\'t want this Workgroup to come out and say we
think hospitals need to do something more than HIPAA until we have a
basis for saying that there\'s something different, either HIPAA
doesn\'t work or there\'s something different that makes us have a new
set of requirements for those people. Then we have the people for whom
HIPAA has no relevance, the outside \-- well, we have people who have no
connection to HIPAA, non-covered entities, non‑business associates,
non-anything in the HIPAA environment. We also have, as thinks like
RHIOs have developed, we have these people who arguably think like
business associates but play a much more front and center role than the
traditional view of a business associate. So I want to understand all of
those developments so that we can look at it and say, hospitals, you
know, for example hospitals are good. We don\'t need any new rules for
hospitals but we do need new rules for business associates. We need some
rules for business associates and we need some rules for these
non-covered entities or we need a new set of rules for all of them. All
of those are possibilities, and I don\'t know what the right answer is
yet, and, again, this topic would look at what\'s out there today
comparing it to what the regulatory structure is, does the regulatory
structure work in today\'s environment?

**[\>\>]{.underline}**

Kirk, I see going in the direction of something in the line of what both
of you saying. I think you have to look at what is the complexion of
healthcare today. And that may include an evaluation of what healthcare
looked like during the time that the HIPAA rules were being put in place
and recognizing that those rules may have been adequate for that time
period but now you\'ve got all kinds of new innovations out there, types
of businesses that weren't addressed in HIPAA that probably, may very
well would have been, had they been in play at the time. I mean, the
whole issue of RHIOs is a perfect example. It wasn't even something that
was thought of and organizations are struggling with how do we do this
and how do we actually operationalize this.

I think if you look at it strictly in the context of HIPAA I think we're
going to really miss something. I think we need to look at it in the
context of what is healthcare doing today. Do we have adequate privacy,
security protections around healthcare?

**[\>\> Kirk Nahra:]{.underline}**

I\'m struggling to get my point across because everything that has been
said is I think consistent with what I\'m saying. But I\'m using does
this HIPAA environment work for people in the HIPAA environment as one
component of this question. That\'s one piece of this. I mean the idea
would be what\'s different since HIPAA went into effect? From a consumer
perspective, from a healthcare systems perspective, from a payer's
perspective, we can put a thousand things on that list.

**[\>\>]{.underline}**

I think we\'re all saying the same thing.

**[\>\> Kirk Nahra:]{.underline}**

I think we are too, but each of the comments has been more like you\'re
missing something because of this. And I want to say no, I think it\'s
not.

**[\>\>]{.underline}**

I think we just need to phrase it in a way that doesn\'t make it overly
specific. Maybe we just have to come up with some more general language
to describe this assessment of the landscape.

**[\>\> Kirk Nahra:]{.underline}**

Let me back up. What I was trying to do was list several potential
topics. I haven\'t got to the end of my list yet. We can say, this topic
I\'m mentioning, we don\'t want to touch that, so then we don\'t have to
wordsmith what it means. I want to get through the list and then we can
say, oh, this is what we want to focus on next, that one we want to
focus on next, we want this one but we\'ve got to tweak it a certain
way. We\'re getting into the weeds before we\'ve even gotten to the rest
of the topics. So identity proofing, consumer choice and control impact,
identification of changes in some to-be-defined environment. The last
piece was privacy protections for information held by non-covered
entities. That was identified as something to work on with Consumer
Empowerment. It\'s also something where NCVHS, I mean, I think we all
think that\'s the important issue. It strikes me as one of the issues
where lots of attention is being focused by other people, so if that\'s
the one we\'re going to pick or the next issue we\'re going to pick we
have to navigate among those other groups. But again that was the list
of topics, potential topics that we identified in our last discussion
without saying we were going to pick number three or number two or
number one.

**[\>\>]{.underline}**

Can I just suggest a potential \-- given the NCVHS discussion on this
topic, that last one, particularly since we already said we\'re not
going to necessarily talk about medical spas if they\'re not connecting
information electronically through NHIN, that probably the most relevant
non-covered entities and privacy protections we\'re talking about are
PHR vendors, which was identified by CE, or these networks, RHIOs, other
health information exchanges, whatever they are, that are kind of more
in the health IT landscape and that kind of are the things that sort of
pop up the red flags immediately.

**[\>\>]{.underline}**

I can sort of envision that number three here, the one that just caused
the spirited conversation, would actually be a support to these other
groups that are trying to get their hands around the non-covered entity
piece, because a lot of the holes that we would find in that evaluation
from looking at HIPAA, looking at the new landscape and trying to figure
out where we are with that. Some of the missing pieces that we would
locate are with those non-covered entities or those non-covered
healthcare provider groups. And I think we could feed that information
back to the groups that are trying to deal with that. I think it would
be a good opportunity to work together but not on the same thing
exactly.

**[\>\>]{.underline}**

I kind of think of point three as being the overarching umbrella, that
at least encompasses one and four, and I'm not sure, potentially 2 is a
little bit of a different discussion. But I guess the way at least I\'m
currently thinking of point three and maybe this further discussion or
wordsmithing and I would think of differently, but I don't see, I would
definitely see one and four being sort of a tangential part of that, so
then we would want to be then sensitive to what the other Workgroups are
doing and allow for the opportunity for their work to inform whatever we
would develop.

**[\>\>]{.underline}**

And I think at least the draft questions that we've come up with, and
again, depending on where the group decides to go today, were somewhat
focused on PHRs, but trying to bring in some of these other issues,
trying to bring in what\'s new in the healthcare environment, whether or
not the PHR providers are covered or non-covered entities, and what are
the impacts of particular types of consumer choice in that environment.
So that\'s how we originally drafted, came up with a draft of questions
focusing on a particular area and then a particular type of entity and
then trying to weave in some of these questions, just in order to get a
little bit of a landscape on a lot of these topics that we can do that,
or we can focus on one of them, one of the four rather than on a
particular, you know, like PHR vendors or a particular other type of
entity.

**[\>\> Jill Dennis:]{.underline}**

That\'s one of the things I\'m struggling with, because I find all of
those topics interesting but how do they fit within the charge with this
Workgroup? Because as I understand it the charge of the Workgroup is a
little more specific than that, in terms of the breakthrough project. So
some of these have the potential to spiral way out of control.

**[\>\>]{.underline}**

That\'s a fair question, Jill. And I think that, from my perspective and
I think Paul\'s perspective, and I think the staff's perspective,
although they will tell me if I'm not right about that, that the
specific breakthroughs were narrow snapshots by which we had to address
these issues but in a narrow context that we were concerned would either
require revisiting those same topics over and over again or sort of
shortcutting big topics by identifying them in too narrow a setting.

And so we came up with this list originally as what are the issues that
keep coming up with the different breakthroughs and keep coming up every
time we talk about these topics. And I agree that \-- well, I guess I
have a couple of reactions. One, I don\'t think we can do justice to the
breakthroughs without looking at some of these bigger picture issues. I
suppose we can say that goes beyond the scope of what we\'ve been asked
to do. But I guess from my perspective, if we look at the only thing
we\'re able to do is answer the specific break through questions, I
think, I don\'t think we do a good job, because I think they're too, I
think those particular examples are too narrow. So that\'s what these
were. These were some of the overarching questions that were coming up,
came out as a result of the breakthroughs, came out as a result of the
AHIC discussions, or things we\'re reading about in the newspaper every
day.

**[\>\> Jill Dennis:]{.underline}**

I don\'t disagree with any of that. I guess my question is, though, is
there an appetite on the front end to use broader recommendations? You
know, what I wouldn\'t like to see happen is two years of effort spent
on some of these broader questions and then you take it to AHIC and they
say but that\'s not what really we asked you to do and we\'re not
prepared to move forward.

**[\>\> Kirk Nahra:]{.underline}**

And that\'s why we, frankly, why we put it in front of them, and we
didn\'t get feedback one way or the other. So, I suppose, when's the
next meeting? March 13th. We don't have any particular reason to think
these are going to be talked about then, do we?

**[\>\>]{.underline}**

We can. I think there is an intention of having a privacy and security
panel particularly focused on, because our privacy and security
solutions work at the state level is going to have a break right before
then. I think we could put this work on the agenda to talk about.

**[\>\>]{.underline}**

AHIC is meeting ‑‑

**[\>\>]{.underline}**

The 13th.

**[\>\> Kirk Nahra:]{.underline}**

We have a meeting scheduled for March 15th. That was originally
scheduled to be a full‑day meeting, some of which, at least some of
which, was going to be testimony. We\'re not at a point where I think we
have to do that yet. I think we\'re going to have to make a fish or cut
bait decision whether it\'s going to be testimony hearing at all, and if
so, what the topics are going to be.

**[\>\>]{.underline}**

Not enough time.

**[\>\> Steve Posnack:]{.underline}**

This is Steve. There\'s differences between the different types of
testimony that we can get. I think what we envisioned for the 15th would
be a meeting that would have maybe one panel or two panels of narrow
discussions that would feed into whatever topic we were to choose to
help educate us on more of the issues that we need to look at further
down the road. And instead of, like we did in September of having a full
day of testimony that took six months to digest, literally, we take
little nibbles at getting testimony and have more discussion in the
second half of the day to facilitate \--

**[\>\> Kirk Nahra:]{.underline}**

I think that was definitely what we were envisioning. It\'s just not
clear to me that we're going to get to a point, on February 20th, that
we have those bits and pieces we can do.

**[\>\>]{.underline}**

I think probably the best thing is to focus on, let's see how much
consensus we can get as a Workgroup as far as where to go next and then
we can at least at the staff level take a step back and figure out what
we can do and what we can\'t do by that date. And we\'ll let you, Kirk
and Paul, know what we\'re able to pull off and what we're not able to
pull off.

**[\>\> Kirk Nahra:]{.underline}**

Let me also just parse out one of these things. This identity proofing
piece seems to me to be something we should continue to work through. I
haven\'t heard anything from what Yuri reported today that says we
should put that as a topic for any testimony on March 15th. That we
should use that as a parallel issue to these bigger picture issues. Is
that okay with people? We\'ll continue to move forward with identity
proofing, work through those issues with the idea of coming up with a
recommendation on that issue we punted on last, we explicitly punted on
last time, but we\'ll do it as sort of a parallel track to our next big
topic of analysis.

**[\>\>]{.underline}**

So I mean it would be interesting since we did try to try to come up
with these questions, we sort of addressed this, Jill\'s comment about
focusing on the sort of more the issues the AHIC is most focused on,
which is the health information exchange, these new entities for holding
health information, et cetera. That one of the approaches for that next
discussion and that next meeting could be looking at a variety of these
issues but in the context of PHRs was the example we used because we
were hearing about it from the Consumer Empowerment Workgroup and trying
to see what information we can get there and using it as an information
gathering session to then maybe drill down on that. Maybe it\'s consumer
control, maybe it\'s impact, maybe it\'s PHR privacy policies.

**[\>\> Kirk Nahra:]{.underline}**

But here\'s where I struggle when we focus exclusively on PHRs. Yuri's
report is that of the 50 vendors he looked at 37 of them have no
interconnectivity today of any kind. And so we can look at that and say
boy, and then of that group half of them don\'t even seem to collect any
information. They give you the software that you can write to yourself
and then keep it on your home computer. That doesn\'t strike me as sort
of the biggest risk here. We have the Website people where we could
clearly say and we get close to what NCVHS is looking at, we can say
we\'ll all agree we don\'t like the idea that people are hosting these
Websites with all this medical information and no rules of any kind out
there for those people. I\'m not going to take a poll today, but my
guess would be if we took a poll on that we would very quickly get to a
consensus that says we don\'t like that situation and that something
needs to be done about that particular situation.

**[\>\>]{.underline}**

But the data that, the vendors that Yuri was looking at were where no
relationship existed. So there\'s a much larger collection of PHR
vendors with more consumer health information in them than just the
subject \--

**[\>\> Kirk Nahra:]{.underline}**

So let\'s play that out. We\'ve got PHR vendors that are tied to
insurance companies. We got PHRs tied to government entities. We\'ve got
PHRs that are tied to ‑‑

**[\>\>]{.underline}**

Employers.

**[\>\>]{.underline}**

And healthcare providers.

**[\>\> Kirk Nahra:]{.underline}**

So what would be the idea of what we would do about that? We\'d bring
something in from DASEA to talk about what they\'re doing.

**[\>\>]{.underline}**

We did that in January. We had WalMart testify at our last hearing. I\'m
wondering, John Houston, do you have any sense of whether Mark or other
members of the subcommittee would be adverse to splitting off the PHR
piece of the non-covered entities and focusing on the other things.
Because the PHR thing is sort of large and complex. There seems to be a
lot of interest in it all over the place.

**[\>\> John Houston:]{.underline}**

Yes, I think there\'s a logical break there that you, so you could break
it up as you described. I know that\'s an area of great interest to
Mark, or I suspect it is. But I also suspect he would be willing to at
least entertain that. You'd have to ask Mark. But I think he would be
open to that.

**[\>\>]{.underline}**

I\'m also remembering, and you probably remember this better because
you\'re on the subcommittee and I'm not, on standards and security, I
remember Jeff Blair saying, he's one of the co-chairs of the standards
and security group, basically saying that he thought this was one of the
most important things that people should be working on, that this was
going forward \--

**[\>\> Kirk Nahra:]{.underline}**

This being?

**[\>\>]{.underline}**

PHRs as a type of service, were moving ahead quickly and being offered,
he sort of described it as the Wild West, without any kind of
limitations in these various contexts that you just mentioned, and he
thought it was a very important area to work on. There\'s also more than
one subgroup of more than committee, more than one advisory committee. I
mean, CE is interested in it, you guys are interested in it, more than
one NCVHS subcommittee is interested in PHRs for various reasons. And
I\'m not sure that if Mark or I or the group tried to sit down and write
a letter today making recommendations specifically on privacy and PHRs
we\'d really be able to do a good job at it yet. I don\'t know what
John\'s feeling is about it.

**[\>\> John Houston:]{.underline}**

I think there\'s so much subject matter there that if we could break it
up logically, I think that everybody could reasonably contribute in a
reasonable timeframe. I think that\'s always been one of the problems
with NCVHS, is sometimes it takes so much effort, some of the things
we\'ve done have been so broad it takes enormous time and effort to get
them done.

**[\>\>]{.underline}**

We had invited WebMD to the hearing and they were unable to appear
although WalMart appeared and talked about Dossia. There are other
people that we\'d like to hear from. We were trying to have sort of an
employer, an independent one, a plan-connected one, sort of different
(inaudible) of PHR.

**[\>\>]{.underline}**

(Inaudible) data on and testimony on.

**[\>\>]{.underline}**

Right. We were trying to focus on specifically what the privacy rules
are, how they manage their data, which CE didn\'t necessarily do. But
I\'m wondering if that, if this group is particularly interested,
whether we could propose to NCVHS that we break that piece off and the
groups could together go forward on the PHR thing and we could work on
other non-covered entities separate from that. I don\'t know what Mark
would say about that. But I think i\'s worth proposing, if that's an
area of particular interest. I know it\'s been a long standing issue of
AHIC and of NCVHS, and there\'s a lot there.

**[\>\>]{.underline}**

Related to the privacy and security component of the PHRs, there\'s
also, there's so many different models of PHR depending on who it\'s
connected to and what they actually do. I mean, some of them that call
themselves a PHR, in my mind, aren\'t even real, authentic PHRs. So
actually the point about the effect of consumer choice and control on
the system, actually the effect of consumer choice and control vis‑a‑vis
their own PHR, would be an interesting analysis, I think, for this group
to consider.

**[\>\> Kirk Nahra:]{.underline}**

Is that what you think those questions point to?

**[\>\>]{.underline}**

Some of \-- the ones that we drafted? Some of them do. But we could work
on others that are more specific if we chose to.

**[\>\> Kirk Nahra:]{.underline}**

Let me ask this. We have a set of questions. The idea behind those
questions was to put them out in the Federal Register and solicit
testimony, solicit written testimony from a broad audience. We figured
there would be a lot of people interested in submitting testimony if we
give people enough time, that it wasn\'t on a rush to get something in
before a hearing, before people would be asked to testify on a hearing.

I know that those issues, those questions have not been generally
circulated. But putting aside wordsmithing of questions, I guess my view
is I\'m not sure I see any downside to putting that out as something
that we could gather information on. Maybe it informs what we do next. I
think if we try to put that out now, with all the timing issues of the
Federal Register, that doesn\'t get out until, what, probably Friday at
the earliest? More likely Monday or Tuesday next week. And then ‑‑

**[\>\>]{.underline}**

John, Judy, do you have anything?

**[\>\>]{.underline}**

I think we\'ve gone through it. If the questions went out on the 22nd,
days from now sending it to ‑‑

**[\>\>]{.underline}**

It takes three days.

**[\>\>]{.underline}**

That would give you time to give people a week or two to respond. But
the other thing you could do is you can mention, have that information,
you don\'t necessarily have to talk about it at the next meeting.

**[\>\> Kirk Nahra:]{.underline}**

Again, my idea when we started doing this was not to make it a ten-day
race. And I think if we\'re tying it to this March 15th meeting, we\'re
back into it being a ten-day race.

**[\>\>]{.underline}**

If you\'re looking for that public input then we should work on getting
something out soon because otherwise we\'ll have the same issue for the
next meeting.

**[\>\> Kirk Nahra:]{.underline}**

Here\'s my only point with that, my recommendation subject to whether
people want to review the questions or not is let\'s get those out.
Let\'s give people 30 days to write something. Let\'s put that on as a
progress point, independent of what we choose to do on March 15th. I
think that\'s all upside and no downside.

**[\>\>]{.underline}**

I agree but I would really like the opportunity to review those
questions, because I think the way you characterize the question has a
lot to do with what you get back.

**[\>\>]{.underline}**

We've tried to keep them as neutral as possible, but I think that\'s
absolutely fine.

**[\>\> Kirk Nahra:]{.underline}**

Anyone have any concerns with doing that? Again we\'re going to
circulate the questions, but putting out a request for information,
written testimony about these topics. Maya, do you have your hand up?

**[\>\> Maya Bernstein:]{.underline}**

I do. It's hard to know how to evaluate whether the questions are going
to be helpful or not, because we haven\'t seen them. But I\'m concerned
about what kind of information, the way you\'ve characterized what
you\'re trying to get out of them it\'s not clear to me that we\'re
going to get the kind of answers that will be helpful. I mean if you\'re
saying, if you\'re trying to understand the impact of particular
choices, who is likely to respond to this thing? Is it going to be
hospitals or plans or whatever? And what are they going to say what
consumer choice is going to do. It will mess with our business. I know
what they\'re going to say pretty much. We've heard it before and
through a variety of testimony. What is the audience you\'re trying to
get at and what are the kinds of ‑‑ it\'s hard to know without seeing
the questions. But I\'m skeptical that you\'re going to get the kind of
information that would be helpful to you in making decisions for this
community in that fashion, that there may be other ways to get
information in.

**[\>\> Kirk Nahra:]{.underline}**

Well, we will circulate the questions. Jodi and Steve have been working
on those questions for a while. If you\'ve got suggestions on that
please make them. I certainly can\'t conclude at this point there\'s no
way to point out questions that will get us helpful information.

**[\>\> Peter Basch:]{.underline}**

Can I ask a question?

**[\>\> Maya Bernstein:]{.underline}**

I\'m not saying that either.

**[\>\> Kirk Nahra:]{.underline}**

You\'re saying you\'re skeptical about questions you haven\'t seen.
We\'ll get them soon.

**[\>\> Maya Bernstein:]{.underline}**

I haven\'t heard what the question is yet, well defined.

**[\>\> Kirk Nahra:]{.underline}**

Why don't you wait until you get the questions and see if you have the
same objection.

**[\>\> Maya Bernstein:]{.underline}**

You\'re missing my point.

**[\>\> Kirk Nahra:]{.underline}**

I hear your point.

**[\>\> Maya Bernstein:]{.underline}**

You\'re missing my point which is if we don\'t know what information we
want to get out of it we can\'t design questions that will elicit that
information. And we haven\'t clearly defined what it is we\'re trying to
get out of these questions. What is the information that we are trying
to collect?

**[\>\>]{.underline}**

It is a reasonable point because I\'m not sure we know yet what we want
to tackle. And so is the point of asking the question to figure out what
we want to tackle or is it to get more information about what we\'ve
already decided we want to tackle? And I\'m not sure that we\'ve come to
any sort of conclusion on that.

**[\>\>]{.underline}**

Was there somebody on the phone who wanted to comment?

**[\>\> Peter Basch:]{.underline}**

It was Peter, but I\'ll hold it. It\'s okay.

**[\>\> Kirk Nahra:]{.underline}**

We have at least two choices at this point. We can circulate the list of
questions that we've developed, for people to look at them, or we can
talk about what a list of questions should say.

**[\>\>]{.underline}**

Maybe if you could answer that question, though. Kirk, are we asking the
question in order to figure out what our process should be moving
forward, or are we asking the question presupposing that we already know
what we want to do?

**[\>\> Kirk Nahra:]{.underline}**

I guess I\'m not sure I like either of those choices.

**[\>\>]{.underline}**

Or on a continuum between knowing and not knowing where are we?

**[\>\>]{.underline}**

What do you want to get out of those questions?

**[\>\> Kirk Nahra:]{.underline}**

What I would like to get out of them, please feel free to chime in. I
read a lot about this system that\'s being developed. And there\'s
reasons why this system is being developed. And if you read going back
to the executive orders and all this stuff, there are particular things
that are spelled out as why this system that's being pushed for over the
next ten years is a good idea. I want to understand what various privacy
and security choices will do to achieving those goals. And if we say we
want to give consumers 100 percent choice over everything that happens
in that system and the result of that would be no new efficiency, no
improvements in medical quality, no improvements in medical safety,
that\'s something we need to know. We need to know before we say, you
know, if our recommendation is going to be we\'re going to propose
privacy and security controls that will have the effect of eviscerating
the benefits of that system I want to understand that before I make
those recommendations. So I want to understand whether, if the system
can accommodate, you know, again if there are people that know more
about technology and know more about the networks that say you know
what, we can design this system, despite the fact the marketplace is
moving forward, to accommodate all of these concerns still have maximum
quality and maximum efficiency, great. I'd love that to be the answer. I
don\'t have any sense of whether that is the answer. So I would like to
hear from people that have an interest in this topic on what difference
it would make if we give no privacy choice versus complete privacy
choice versus having security versus no security.

**[\>\> Jodi Daniel:]{.underline}**

This is Jodi. Let me just give a couple of comments on what I think we
were trying to accomplish. It was really more of an information
gathering. It was basically sort of a combination of these issues,
focusing on PHRs, but trying to do a little bit of an environmental scan
of what\'s new, the what\'s new question in the healthcare environment,
and is this something that\'s possible, what kind of impact consumer
choice would have. The NHIN prototypes, a couple of them had PHRs as
core components and did in fact include consumer controls in those, so
it might be interesting to hear from those folks on what they did and
how feasible it was from a technical perspective. We have NHIN trial
implementations that we are working on an RFP for right now, there may
be opportunities to try to weave in some requirements for privacy
protections or consumer control into those trial implementations. So it
was really designed as sort of an information gathering and I think the
thinking if we did have some testimony at the next meeting is to get
people to come in and tell us what, sort of feasibility and what they
have done so far, maybe on some of these NHIN prototypes, or et cetera.
Again to sort of to get more information and maybe we need to focus from
there. But I think, it seems like the Workgroup is struggling with
trying to identify specific topics. We\'re trying to get some
information that was related to these topics focusing on health IT and
electronic health information exchange in order to get a better basis
and to then sort of focus a little bit more on the piece that we want to
take on first, second, third.

**[\>\>]{.underline}**

I'm going back to an earlier point. It strikes me that a lot of the
responses you get might be ideologically or business interest motivated.
I concur that those who have a strong interest in responding one way or
the other might have more of a motivation and ability to do so and I
guess if we're going to go down this route, it might be, if those truly
are the questions we want to ask, I would rather get evidence‑based
responses, and so in prototype seems like a perfect candidate because
we\'ve got some evidence of an entity trying to go through a process and
they have some information to share. As opposed to just sort of getting
more hypothesis generating information. Not that I\'m not open to public
comment, but I do wonder if those are truly, if that\'s truly the point
in asking the questions, whether or not that\'s the best way to ask
them, or to get that information.

**[\>\>]{.underline}**

Do you have other suggestions on how to get ‑‑ I think we were trying to
focus at least on some of the questions on factual information, what are
people doing in the space today, where, what have people seen as
challenges when they have built in consumer protections, things that are
I\'m, I\'m making this up. I don\'t remember the exact questions. But we
were trying to be somewhat factual. I think some of the questions might
have had some opportunity for opinion. But we were focusing on getting
more of the environmental scan on what\'s happening, what's working,
what's not working, why, that kind of stuff, as opposed to the what do
you think. Although there\'s a little ability of the what do you think.

**[\>\>]{.underline}**

Yes, but if we just kept our question to environmental scan and what
people are doing now I don\'t think we would begin to touch upon, I
think it was Kirk\'s question, about what a future state would or could
look like if a consumer was given complete control, because again
somebody give me a virtual kick if I\'m way offbase here but I don\'t
think you're going to get much valid testimony on evidence where that is
being done. And I think there\'s a lot of good, I\'ll say it\'s more
than speculation, but good thought about what could be and what can't be
done and not just respecting business interests but respecting our
medical legal system.

**[\>\>]{.underline}**

I guess the question back to the group, I think I hear some of the
concerns, is what would be a better \-- if folks are concerned about
questions are there questions that we could write that would work or are
there other approaches that people want to throw on the table that they
think would work better either for honing our discussion topics or for
getting more information?

**[\>\>]{.underline}**

It\'s probably to have as crisp questions as we can. But I also don\'t
see any reason why we can\'t let other people weigh in on whatever is on
their mind.

**[\>\>]{.underline}**

We can do that at any time.

**[\>\>]{.underline}**

Today at our open meeting.

**[\>\> Peter Basch:]{.underline}**

But I also think we should not shy away from contentious issues that are
based on strongly held opinion and also reasons that people may or may
not choose to participate in the system. Because if this new system is
going to work, it\'s not going to work just because the evidence says
it\'s going to work. It\'s going to work because people from all sides
trust it and are willing to use it. And I think that it means that we
have to delve into areas that are messy, ugly and contentious.

**[\>\>]{.underline}**

I totally agree with you, Peter. By evidence I wasn\'t suggesting
evidence that something does or doesn\'t work. It\'s evidence supporting
the contention that if you give people complete control, then my
business will be wrecked, or if you give, you know, sort of I mean I
think ‑‑

**[\>\> Peter Basch:]{.underline}**

Maybe we\'re saying the same thing then. Yes, certainly just wild
speculation based on nothing but a strong desire not to change is not
helpful.

**[\>\>]{.underline}**

I think that\'s the concern.

**[\>\> Peter Basch:]{.underline}**

Okay. I\'m with you on that, then.

**[\>\> Deven McGraw:]{.underline}**

This is Deven. We just went through this process where the Department of
Labor sent out one of these requests for information on the Family
Medical Leave Act covering a pretty broad range of issues. And I can\'t
imagine that it\'s really going to be all that helpful from either end,
because people viewed it as a really political opportunity to get their
viewpoints in. And I\'ll bet the Department of Labor is probably sitting
on tens of thousands of comments right now. Now, having said that, I
know some people may be more in tune with what\'s going on with the FMLA
than this particular set of topics, but we have really interested
stakeholders, just waiting to see what we come up with. It wouldn\'t
surprise me if we were overwhelmed by what we get back and only a
quarter of it being all that useful. So rather than sort of an
environmental scan, I think we\'ve already laid out a bunch of topics
that we know we want to tackle. I don\'t see the wisdom of letting the
general public dictate which ones come first. I think we have enough
expertise on our Workgroup to figure that out. And then if we want to
ask the public some questions, we would do so in a very focused way
because there are specific answers we\'re looking for.

**[\>\>]{.underline}**

So Deven, do you have a suggestion? I was looking at the time, do you
have a suggestion what would be your, do you have a proposal on where to
start? Sorry to throw it back at you, but \-- to have some folks
throwing some ideas on the table and trying to see if we can get
consensus on where to go next, because otherwise we\'re going to go
around in circles.

**[\>\>]{.underline}**

Deven, if I can jump in.

**[\>\> Deven McGraw:]{.underline}**

Sure. I\'m going back to the chart to remind myself.

**[\>\>]{.underline}**

We all did submit sort of topics, and maybe I\'m missing something, but
I don\'t recall seeing sort of a synthesis of that submission and having
a specific agenda discussion to figure out as a group where our
priorities are and then to have a conversation with perhaps some of the
other players to figure out what they\'re working on so we can divvy up
the work accordingly. Maybe that\'s what this is, but there\'s these
questions that we haven\'t looked at and maybe I just missed a file. But
I\'m not sure I know what everybody else said they wanted to work on. Am
I missing something?

**[\>\> Kirk Nahra:]{.underline}**

There was a list that was worked through at the last meeting. But the
meeting that led to formulation of this slide had that discussion, had
some of that discussion. I mean it was obviously a beginning of a
discussion.

But some of them went through and said three people talked about this.
And three people ‑‑ we did some of that. And we can ‑‑ as you said we
may be getting to a point quickly where we're essentially tabling this
for our next discussion. And that\'s okay. I guess I just look at the
question we were just talking about and I mean it\'s fine to say that we
have expertise on the Workgroup, but ‑‑ and we can sit around the table
and try to come up with a recommendation without gathering external
information, but it seems to me that we\'re going to need to hear from
other people.

And I\'m not quite sure I understand ‑‑ if what we get, if what we get
is a thousand hospitals writing in saying oh my God we can\'t do
anything, okay, we can ‑‑ I assume we\'ll also have a thousand
technology companies saying: If you use us we can do anything you want.
And there\'s some balance out there and seems to me we\'ve got to start
somewhere in gathering information.

**[\>\>]{.underline}**

Can I suggest that I am just concerned, this is sort of our second
conversation trying to figure out what our next steps are and we\'ve got
so many possibilities and pretty meaty issues, and they will take a long
time to actually think through and get testimony and get recommendations
on. Can I suggest that maybe some folks throw a couple of proposals on
the table as to where to go next and then see if we can, if perhaps
there\'s some consensus around one or two of those proposals and then we
can try to figure out what the best process is. If maybe there\'s a
couple of factual questions we can ask, that\'s great. If we need to
take testimony, great. Perhaps if some folks can just throw a couple of
issues on the table and see if anybody has anything to throw around.

**[\>\>]{.underline}**

Is it possible for us to get a matrix of all of those suggestions of
what this group should be tackling. On one sheet of paper and then a
correlation to the other Workgroups and where they are with those issues
so we could actually look at the whole body of work and say, okay, these
are the 12 things that we all identified, and of these 12 things, these
3 or 4 are being handled by other Workgroups at different levels, and I
think we're trying to get at that today, and I think \--

**[\>\>]{.underline}**

\-- issues we were aware of, and what's going on. And I think you've
heard the extent of what\'s going on. I\'m not sure there can be any
more information on what NCVHS is doing or what CE is doing. I'm just
worried we're going to get stuck in process for another two months
trying to figure out what to do next, and not actually moving on. And I
think there\'s a lot of issues to tackle, and I'm concerned that we
won't actually get to them because we spent a lot of time just thinking
about what to get to.

**[\>\>]{.underline}**

I'd like to throw out a straw man, if I could. It\'s actually sort of a
statement against interest, because it\'s not the area that I think is
necessarily most important, but we\'ve already taken the step to do some
preliminary work on this subject of identity proofing PHRs that have no
prior relationship. And there were some good solid questions posed to
this Workgroup that I think are fairly no-brainers as far as issuing
some recommendations. I could be wrong about that, but it just seems to
me that \-- why don\'t we finish that? I mean why don\'t we take a step
and finish that and make some recommendations. It\'s a low-hanging fruit
approach but it just seems to me that while we\'re figuring out a master
scheme of where we\'re going, we need to be doing some productive work,
too. And I guess \--

**[\>\>]{.underline}**

I thought we already decided to do that in parallel with whatever \--

**[\>\>]{.underline}**

I had that on my list. Already assumed that\'s our next step is to
continue that all the way through. I think where I\'m getting stuck is
what\'s the next big thing for us to accomplish? And I think there are a
lot of really good big next steps for us and I think that\'s why we\'re
all sort of bogging down.

**[\>\>]{.underline}**

I think probably from my perspective I think there\'s sort of, it\'s a
matter there\'s too many choices not that we can come up with a good
idea. And so it seems to me if we can start tackling one then we can ‑‑

**[\>\>]{.underline}**

In my mind we have to know what the landscape is first. And to do that
analysis and know where our holes are. I mean, how are we going to plug
in potential solutions and look for things to fix if we don\'t know what
the whole landscape looks like? And the landscape is not what it was
when HIPAA was written.

**[\>\>]{.underline}**

This is going back to what Kirk suggested, understanding what\'s new in
the healthcare environment.

**[\>\>]{.underline}**

I think that\'s our first step. If we know where that is, then we can
kind of project where the industry is going to go. We can look at some
of these other things. We might be able to then pull back in some of the
work that we\'ve already started doing on the personal health record if
we think that that\'s an area that\'s just going to balloon, then by all
means let\'s go back to it, but we won\'t know that until we\'ve really
looked at the complexity that\'s now healthcare. It\'s a different
complexity than we\'ve had five years ago.

**[\>\>]{.underline}**

Is that a what\'s covered versus what\'s not covered question in terms
of the landscape?

**[\>\>]{.underline}**

No.

**[\>\>]{.underline}**

No.

**[\>\>]{.underline}**

It\'s what's out there, what are the new evolutions?

**[\>\>]{.underline}**

Perhaps the way to frame it is to say, you know, when HIPAA was enacted,
in \'96, there was a healthcare landscape and a perspective, a CPS
perspective to that. And here it is now 11 years later, what\'s that
environment look like from a CPS perspective again. And then we can just
start to look at what\'s changed. Perhaps we\'ll find out that here\'s a
hole but this group is addressing it. Check. And here\'s a hole and ‑‑

**[\>\>]{.underline}**

I think what you\'ll see fall out of that we\'ve had either eight or ten
years to operationalize HIPAA and we will realize that there are some
things that flowed into healthcare operations really nicely and other
things that didn\'t flow so nicely. And I think that we\'ll also uncover
some of those things that are going to become ongoing problems for us as
we try to ‑‑

**[\>\>]{.underline}**

Okay, so let me ask you a follow-up question. If that were the direction
the Workgroup went, how would you suggest gathering that information? If
this Workgroup gathered that information. We\'re happy to support the
Workgroup any way we can, but we need to know what you would find most
helpful.

**[\>\>]{.underline}**

I think we would need to look at some of these evolving technologies. We
would have to look at some of these evolving products and see what, see
how they fit into what we currently have as far as privacy and security
protections, and that goes to your point, Kirk, back to the idea of we
really do have to compare it at some point against what we have
for.current legislation because that\'s where we\'re going to know where
the holes are. But I think that it\'s also going to give us the
opportunity to see how these new services, these new products, these new
ideas are being impacted by what we have as current privacy and security
protections.

**[\>\> Kirk Nahra:]{.underline}**

Let\'s continue to drill down on that. What does that mean? That means
we bring in someone to testify about what?

**[\>\>]{.underline}**

I\'m concerned if we take on the entire healthcare environment we\'ll be
doing a two‑year study on what\'s new and not actually talking about
privacy and security.

**[\>\>]{.underline}**

That\'s exactly my concern.

**[\>\>]{.underline}**

But you can define that scope however you need to, though. And I know
that you talked about personal health records. I think that\'s almost
too narrow of a scope. But I think from the standpoint of maybe if you
looked at the personal health record and the electronic health record
and how those are going to talk to one another, you start right there
and you say in the world that we live in how can we take that piece of
it and, no, that\'s not the whole universe, but it\'s a big chunk of the
universe. And we take that piece and say how can we facilitate making
sure there are appropriate privacy, security, and confidentiality
protections around what\'s evolving with the use of a personal health
record, with a combination of sharing of information. I mean it\'s going
to touch on other things that other people are dealing with, like RHIOs
and things like that. But it\'s still going to give us something that\'s
doable and \--

**[\>\>]{.underline}**

Again, I\'m just worried about sort of the whole broad charge of this
Workgroup. And again it seems my one caution is try to take off
something where we can actually come back with some recommendations. At
the last AHIC meeting, the one thing actually I don't think I did talk
about at the beginning, the secretary was talking about trying to roll
off the AHIC into sort of a private sector body by the end of 2008. So
if we\'re working on something that\'s going to go beyond that period of
time we\'re not sure what our recommendations are going to be going
toward. It might be a very different-looking activity.

**[\>\>]{.underline}**

So that activity sounds to me like a way to increase the number of
topics, to figure out what the topics are that we are going to
undertake, rather than undertaking a topic to discover what the topics
are out there.

**[\>\> Tom Wilder:]{.underline}**

This is Tom Wilder with AHIP, if I may just add my two cents worth. I
think there\'s two topics that I\'ve heard a lot of discussion about in
this Workgroup and also in other conversations I\'ve had that I think we
ought to take a look at over the next year. The first one is this issue
of how can we develop a set of recommendations around those entities
that are not subject to the HIPAA rule, because there\'s a recognition
that there\'s a lot more players now in the kind of PHR/EHR space that
may not be subject to a set of established regulations. We can argue
about whether or not HIPAA is sufficient or not, but we at least know
there\'s some groups that are outside that orbit. And I would suggest
one way of addressing that is to bring in some folks who can talk to us.
I would get somebody from a RHIO perspective to talk to us. I would get
someone from a PHR vendor like a WebMD to talk to us about their views.
I would maybe get someone from the consumer or privacy perspective to
talk about their expectations. Maybe someone from a security standpoint
to talk about what are some current best practices in security.

The second issue that I think is a big issue that we need to talk about
is we know that we\'re going to have to at some point talk about
consumer control of their record. What are their expectations, what are
some principles or recommendations around how much control they have
over their record and how far they can drill down in terms of
segregating out portions of their record to share or not share. And to
address that issue again I would like to hear from some consumer, maybe
a consumer viewpoint, maybe from some of the, particularly those folks
who are in special needs or disease, this is a very bad way of saying
it, but some patient groups who have a particular interest in how their
health information is used. I would want to hear from the provider
community, because they are end users of this information so they
obviously have an interest in getting a full and complete record. I
certainly would want to hear from health plans because they have an
interest as well. But those to me are two of the big kind of issues that
I think everybody talks about that I would like to see us maybe address
over our next series of meetings.

**[\>\>]{.underline}**

So I heard, Tom, two of the issues that I think Kirk had raised
initially, which were consumer control and non-covered entities that got
to the top of the list as two areas that folks had prioritized when we
asked for individual input on this.

**[\>\> Don Detmer:]{.underline}**

I support that.

**[\>\>]{.underline}**

Who was that?

**[\>\> Don Detmer:]{.underline}**

Don Detmer.

**[\>\>]{.underline}**

Okay.

**[\>\>]{.underline}**

Didn\'t we just hear those that one of those has just been done by
NCVHS, or no? Is that the first one.

**[\>\>]{.underline}**

That was my understanding, too.

**[\>\>]{.underline}**

And the second one has been addressed by NCVHS, although, and a lot of
it in last June's letter, although I admit that NCVHS punted on a lot of
it and there\'s room for more work in some of those areas where NCVHS
was not able to come to a conclusion in terms of consumer control and
figuring out what kinds of controls are appropriate. But there\'s a lot
of work that\'s been done in that area, and \--

**[\>\> Tom Wilder:]{.underline}**

And \-- this is Tom Wilder again \-- and perhaps having Mark Rothstein
or somebody come in and talk to us about the work that they\'ve already
done so we\'re not reinventing the wheel.

**[\>\>]{.underline}**

And I think it\'s, I think it\'s more limited on one side rather than
the other. I mean, also there\'s the dimension of with informed consent
giving the citizen very broad capacity to say my data can be used for
research, for identification, for \-- so I think that it's tended to be
very much not a wide open kind of look at the options.

**[\>\>]{.underline}**

Well, are you saying that NCVHS didn\'t look at the options?

**[\>\>]{.underline}**

I think they did not explore the dimensions of all the options.

**[\>\>]{.underline}**

They did make recommendations.

**[\>\>]{.underline}**

So let me ask a couple of questions. I think Maya, you were saying that
NCVHS has started looking at the non-covered entity issue as it pertains
to RHIOs and PHR vendors and others, but that there might be a
willingness to peel off part of that if this group wanted to look at
that \--

**[\>\> Maya Bernstein:]{.underline}**

Yes.

**[\>\>]{.underline}**

\-- and basically since they\'ve just starting chewing on that, it
sounds like.

**[\>\> Maya Bernstein:]{.underline}**

Well, they\'re about to start chewing on writing their recommendations.
We\'ve had three different hearings on the topic. We heard from schools,
employers, non-health insurers, financial institutions, and then
non-covered health industry providers and other types.

**[\>\>]{.underline}**

But it wasn\'t necessarily focused on PHR vendors.

**[\>\> Maya Bernstein:]{.underline}**

No, no, but PHRs were one of those entities among the healthcare
industry non-covered entities.

**[\>\>]{.underline}**

So this group could consider delving deeper into that, or could consider
delving deeper into the consumer control issue, which NCVHS has done
some work on.

**[\>\> Maya Bernstein:]{.underline}**

I agree, those would be two fruitful areas.

**[\>\>]{.underline}**

Given that they kind of bubbled up as the top two areas when we did do
the round the table kind of discussion, then maybe that is the answer,
is that we go with those topics, but specifically look at what are the
carveouts for this group.

**[\>\>]{.underline}**

Can I ask a follow-up, you mentioned some work forthcoming on secondary
data use.

**[\>\>]{.underline}**

Yeah.

**[\>\>]{.underline}**

So would that be another area? I\'m sorry \--

**[\>\>]{.underline}**

Yeah, the people at NCVHS who were talking about secondary data, I mean
to be candid, when people talk about secondary uses, a variety of them
have a variety of different meanings of what they mean by that. So the
privacy and confidentiality group tends to think about secondary use,
well, they tend to think of anything that\'s not the primary original
collection. Anything else is a secondary use of the data. And in the
quality workgroup they\'re particularly interested in the types of
secondary uses that are relevant to quality issues. Not necessarily
interested in privacy or controls or whatever. So I\'ve heard other
people basically say anything that\'s not the original clinical use is a
secondary use, even if it\'s in a hospital setting. So there are a
variety of different definitions of what that is. But my understanding
is that the quality group is doing work on secondary uses and I frankly
haven\'t been that involved in it but I think there\'s going to be \--
John, are you still there?

**[\>\> John Houston:]{.underline}**

I\'m here, yeah.

**[\>\>]{.underline}**

Help me.

**[\>\>]{.underline}**

There\'s something going with the privacy group and the quality group
and also ONC to try to figure this stuff out.

**[\>\>]{.underline}**

Do a first cut on second \-- on pieces of data, not clinical uses of
data for quality purposes. So it is limited and it was sort of a first
cut at that, which could conceivably get punted back to the Quality
Workgroup of AHIC, or that hasn\'t been decided.

**[\>\>]{.underline}**

So that\'s useful because there is, for example, in the June 22nd
letter, what I would call discussion of secondary uses that has to do
with having to sign a consent when you get a loan or having to sign a
consent when you get a job saying you\'re going turn over all your
health information to us for the purpose of us evaluating whether
you\'re appropriate for this job which we would consider a secondary
use. It\'s not a quality use at all. It's not completely unrelated to
quality, but it\'s another type of secondary use that\'s not the purpose
for which the information was originally collected.

So there are other issues like that that are among the issues in the
June 22nd letter that, some of which have not been fully fleshed out.
How do you do contextual access control or those kind of things that we
talked about, not fully fleshed out. And there are some things in there
that I think would be fruitful.

**[\>\>]{.underline}**

I mean, I\'m thinking regardless of what the actual secondary use is,
this group might be able to come up with some recommendations about how
consumers need to be informed through a variety of means about what
their choices \--

**[\>\>]{.underline}**

Right, are you suggesting that this might be, maybe consumer control is
the wrong word but, sort of a focus of the consumer control or consumer
involvement or whatever the right term is?

**[\>\>]{.underline}**

Is I think of fair \--

**[\>\>]{.underline}**

\-- focused on secondary uses as opposed to clinical uses.

**[\>\>]{.underline}**

Well, I mean, clinical, though, could be secondary.

**[\>\>]{.underline}**

Right.

**[\>\>]{.underline}**

So I mean, you know, not right now thinking about whether it\'s for
quality or for, you know, research or surveillance or whatever it is,
but would this group want to make some recommendations about the process
by which consumers are informed, engaged in the decision-making of how
their information is going to be used? And that\'s something that I
personally would have an interest in, and I think it fits within the
rubric of a couple of things we\'re talking about. But I\'m not sure. I
just didn\'t want to be stepping into areas where NCVHS, or others were
already deeply engaged.

**[\>\>]{.underline}**

I think the other thing is any of these areas that we take on
necessarily is going to deal with some concept of secondary uses, one
way or the other. If you talk about PHRs and what rules should relate to
PHRs, if you\'re talking about fair information principles, you often
have something that says, you know, information that\'s collected for
one purpose should not be used for another purpose without consent or
some other process. And so whether it was originally collected for a
clinical purpose or my personal PHR or my employer\'s purpose or
whatever it is, you\'re going to get into those secondary use issues.

**[\>\>]{.underline}**

Secondary use conversations also have a lot of consumer emphasis to it,
and I wonder if there\'s any concerns we may need to explore on the
provider side in terms of, saying, especially when you get into quality
how a maybe a physician\'s or provider\'s performance information or
quality information might be protected or used or shared, et cetera.
Which may be another set of considerations we could discuss at some
point.

**[\>\>]{.underline}**

Absolutely.

**[\>\>]{.underline}**

Okay, there\'s a couple of, I\'ve heard a couple of things on the table.
I\'ve heard talking about non-covered entities and privacy and security
practices of RHIOs and PHR vendors as a primary example. I\'ve heard
issues of consumer control or whatever that means, you know, for sharing
information through a health information exchange. And then I\'ve heard
\-- (inaudible) and then I\'ve heard specifically focus on secondary
uses and, from a consumer perspective, but maybe also we need to broaden
that, not just from a consumer perspective but from a broader set of
perspectives.

**[\>\>]{.underline}**

It could be individual and institutional responsibilities vis-à-vis
secondary uses of data. I mean, I don\'t know how specific or narrow we
need to make, it but I just, you know, acknowledging the point that
it\'s not just consumers that have concerns about how their information
may \--

**[\>\>]{.underline}**

And the one caveat I would say, because this is a Workgroup of the AHIC,
which is focused on health information Technology is that if we\'re
talking about secondary uses or if we\'re talking about consumer
control, it should be in relationship to electronic health information
exchange and not sort of rethinking policies that are not, are affecting
individuals that are not involved in electronic health information
exchange, which gets to Kirk\'s point about something being new and not
sort of \-- I think.

**[\>\> Kirk Nahra:]{.underline}**

Well, the issue I started with that I think we moved past at one level
also seems to be involved with each of those issues. For example, if
we\'re going to talk about secondary uses and we\'re going to ask
questions about secondary uses that are permitted in a HIPAA
environment, and we\'re going to ask whether they should be permitted or
how they should be dealt with in a public information exchange
environment, that goes back to my question which is why is this
different? And I\'m still focused on that question. I don\'t know, maybe
we don\'t have any way to deal with that question. But again if we\'re
going to make a recommendation that says we want to have specific rules
for secondary uses in health information exchange contexts, even if
those same secondary uses are permitted under HIPAA if it\'s not part of
the health information exchange, I want to understand why we\'re making
that recommendation.

And in order for me to understand why we\'re making that recommendation,
I need to understand why this environment is different. Which is where,
again, we started with at one point, but \--

**[\>\>]{.underline}**

Well, maybe that is more of a specific question, though, I think, that
we would then ask of people giving testimony or in the Federal Register
notice that it\'s very tightly linked to that area. So I would want to
understand why, as well, although I may have my \--

**[\>\>]{.underline}**

So perhaps that is a preliminary question no matter what issue we take
on, even if we don\'t look at it for the entire healthcare environment,
that if we\'re looking at, say, secondary uses, that we should say
what\'s new here, as sort of a preliminary question.

**[\>\> Kirk Nahra:]{.underline}**

Yeah, again that\'s fine if that\'s how people want to do it. It seems
to me we\'re then going to ask that question every time we have an
issue, we\'re going to ask what\'s different. Which is, again, that was,
at least from my perspective, an effort to not have to ask that question
with each of the next ten topics we\'re going to deal with, by trying to
deal with it once up front. But if people don\'t think we can do that
once up front, you know, I\'m fine with that.

**[\>\>]{.underline}**

I\'d like to try, Kirk, I totally agree with you, and it seems to me if
we\'re going to ask that question in terms of secondary uses, and
deliberately leave out primary uses, it doesn\'t make a whole lot of
sense and it seems like we\'re going at it backwards.

**[\>\>]{.underline}**

Well \--

**[\>\>]{.underline}**

That was what I was suggesting before, and I think we had some concerns
about whether we could hold that in scope.

**[\>\>]{.underline}**

Yeah, but if we frame it, I think, in terms of not whether, what\'s the
universe of changes in the healthcare system since 1996 writ large,
that\'s enormous. But in terms of the uses of health information, maybe
that\'s a way to have it. Or medical record, treatment of medical
records, treatment of patient health information. Some way to confine it
to the sort of data pieces that we\'re interested in, as opposed to
well, there\'s more use of medical devices these days. That\'s only
relevant to us if that information is somehow, you know, if there\'s a
datapoint issue.

**[\>\> Kirk Nahra:]{.underline}**

Well, we have ten minutes remaining, we have an obligation under the
FACA rules to open this up for public comment. Let me ask the operator,
do we have any people lined up for public comment, or do we need to tell
them that\'s coming?

**[\>\>]{.underline}**

I can go ahead and put the slide up right now.

**[\>\>]{.underline}**

Okay, go ahead and do that please, and we\'ll give people a couple of
minutes. And we\'ll continue our discussion for a couple of minutes and
then we'll check back and see if there\'s any public comment.

**[\>\>]{.underline}**

I\'ll remind everybody that the number is up there, if they\'ve already
dialed in, they just need to press star 1, and there\'s also an e-mail
address if people want to write in comments after the meeting.

**[\>\>]{.underline}**

Now, I guess what we need to do in our next few minutes is figure out
what we\'re going to do next. Now, we have a couple of issues. We can
try to have a quick decision on what we do next. We can leave it up to
Paul and I and staff to make some suggestions to the groups following
this meeting. We can punt this whole topic to March 15. Are there any
other options?

**[\>\>]{.underline}**

If there are a couple of folks who want to try to propose some
suggestions we can have a smaller group with particular ideas, get
together and just, with you and Paul.

**[\>\> Kirk Nahra:]{.underline}**

Thoughts?

**[\>\>]{.underline}**

Well, I can, John and I can go back to, Maya, NCVHS, we\'re supposed to
have a conference call in the next week or two and figure out if
they\'re amenable to the idea of splitting off the PHR part.

**[\>\>]{.underline}**

That would probably need to have one of the chairs involved, either Paul
or Kirk. Somebody needs to be involved from this end.

**[\>\>]{.underline}**

My point is we haven\'t set the date for that yet \--

**[\>\>]{.underline}**

Okay.

**[\>\>]{.underline}**

Arrange for one of the co-chairs to be at that meeting, I think you\'re
right. And talk about that or talk about it in advance and see if both
groups are amenable to that. It\'s a choice. It doesn\'t mean you would
go in that direction but just to see if that option is available.

**[\>\>]{.underline}**

Let me cut through. I gave people a little bit of time but I\'m going to
assume we\'re not going to answer these questions in the next ten
minutes. I\'m going to assume that we don\'t want to wait to have our
next step be reopening this discussion on March 15th. And I\'m therefore
going to decide that the main option is we need to gather in whatever
information we\'re going to do and make some suggestions to the group.
Do we see any other realistically viable options on that over the next
couple of weeks?

**[\>\>]{.underline}**

Sounds good to me.

**[\>\>]{.underline}**

Okay, let me say this and then we\'ll open this up for public comment. I
would appreciate hearing specifically and directly to either me or Steve
and Jodi, specific suggestions on \-- if anyone has them, no one is
required to do this \-- but if somebody has suggestions on, you know, a
topic to address, a definition of what that topic, and how you suggest
addressing that, I would like to see that in the next week. By the end
of, okay, by the end of this week. That\'s fair. That means that on next
Tuesday, although I\'m going to have an issue with next Tuesday, but the
next time we have our co-chair meeting, scheduled for next Tuesday, we
can go through those topics and try to formulate our suggestions to the
group on what our next steps will be.

**[\>\>]{.underline}**

Is it possible to put up a very short summary of what we, all the
different topics that came up today, just so we can sort of use that as
a framework for people to decide maybe what they want to work on?

**[\>\>]{.underline}**

I think the answer to that is yes, but I don\'t want people to wait to
have that, we\'re not going to get, I assume that\'s not going to get
out today. It\'s not an easy thing to do. So I would suggest don\'t wait
for that to start thinking about what you can get us by the end of the
week. It will obviously be, it will get out before the end of the week
but I\'m not sure it\'s going to get out before tomorrow night or
Thursday morning or something.

**[\>\>]{.underline}**

And I would encourage folks to to try to talk with others if you have
some suggestions, and see if, you know, if you bounce your ideas off of
somebody else, and say, you know, three of us thought this was a good
approach, that might be helpful information for the co-chairs in making
a decision on next step.

**[\>\> Kirk Nahra:]{.underline}**

Is there anyone who had any concerns about that approach? All right. Can
we open this up to the public now, please.

**[\>\>]{.underline}**

There are no public comments.

**[\>\>]{.underline}**

Okay. All right. I\'m sorry? Are there any comments in the room? Okay.

All right, hearing none, so our next steps. Over the next couple of
days, please get either to Steve and Jodi or to me directly, your
suggestions. And I\'d like those to be as concrete as possible because I
think we had today we had a list of topics that at one point were more
generally agreeable but when we started to get down to the detail, that
fell apart. So we need suggestions and we need them to be specific. That
should include, that doesn\'t need to say I want to hear testimony from
John Smith with this organization. But one of the things that struck me
particularly about changes about changes in the healthcare system, is we
actually do have most of that knowledge in this room. I mean, I don\'t
know that there\'s any significant development that people in this room
don\'t know something about or know enough about to be able to tie those
together into our discussion. I\'m not sure that it requires a, you
know, healthcare expert in some testimony to talk about the fact that
there are now RHIOs. You know, so I want to be specific on what kinds of
information will be useful to be gathered.

And again, we want to try to do that as quickly as we can because I am
concerned about drift on this. I do think it\'s fair to say, just for
planning, that I would be astonished if we end up taking testimony on
March 15. Taking public testimony on anything. You know, having a
hearing.

**[\>\>]{.underline}**

It\'s possible we could get one or two people in if there were some
really concrete issues that were factual.

**[\>\>]{.underline}**

Don\'t do that to Steve.

\[laughter\]

**[\>\> Steve Posnack:]{.underline}**

We make miracles happen around here.

**[\>\>]{.underline}**

Yeah.

**[\>\>]{.underline}**

All right.

**[\>\>]{.underline}**

You know \--

**[\>\>]{.underline}**

You know what\'s required to make them happen.

**[\>\>]{.underline}**

And I guess we should probably hold the whole day and if we don\'t have
some testimony, we can cut it back.

**[\>\> Kirk Nahra:]{.underline}**

All right. I hesitate to ask, but any last minute comments?

**[\>\>]{.underline}**

One decision that was made was to continue on with the identity proofing
discussion. So I guess the other comment is if people have specific
questions, for Yuri, that people would want more research on, as well as
to let us know that so we can start working on that.

**[\>\>]{.underline}**

All right. Thank you very much, everybody. Take care.