# Presentation: 111817

## Testimony of
William R. “Bill” Braithwaite, MD, PhD
Health Information Policy Consulting
Washington, DC

June 22, 2007

- William R. “Bill” Braithwaite, MD, PhD
- Health Information Policy Consulting
- Washington, DC
- June 22, 2007

- American Health Information Community	Confidentiality, Privacy, and Security Workgroup

**HIPAA and New Electronic ****Health Information Exchange Networks**** **

## HIPAA Required HHS to Adopt Standards:

- Electronic transmission of specific administrative and financial transactions (including elements/code sets)
- List includes claim, remittance advice, claim status, referral certification, enrollment, claim attachment, etc.
- Unique identifiers (including allowed uses)
- Health care providers, plans, employers, & individuals.
- For use in the health care system.
- Security and electronic signatures
- Safeguards to protect health information.
- Privacy
- For individually identifiable health information.

## Scope: Who is Covered?

- Applies directly only to Covered Entities (CEs):
- Health Plans.
- Health Care Clearinghouses.
- Health Care Providers who conduct the HIPAA standard transactions electronically.
- Including all providers > 10 FTE who bill Medicare.
- Including pharmacies (both local and mail order).
- Applies indirectly to Business Associates (BAs):
- Agents who handle Protected Health Information (PHI) on behalf of a Covered Entity.

## Scope:  What is Covered? 

- Protected health information (PHI) is:
- Individually identifiable health information,
- Transmitted or maintained in any form or medium,
- Held by covered entities or their BAs.
- All PHI is protected equally.
- Different PHI is sensitive for different people for different reasons at different times.
- Psychotherapy notes are unique - not usually shared.
- CEs and States are allowed to add protections.
- De-identified information is not covered.

## Principles of Fair Information Practice

**Notice**
- Existence and purpose of record-keeping systems must be known.
**Choice** – information is:
- Collected only with knowledge and permission of subject.
- Used only in ways relevant to the purpose for which the data was collected.
- Disclosed only with permission or overriding legal authority.
**Access**
- Individual right to see records and assure quality of information.
- accurate, complete, and timely.
**Security**
- Reasonable safeguards for confidentiality, integrity, and availability of information.
**Enforcement**
- Violations result in reasonable penalties and mitigation.

## HIPAA Security Rule Approach

- Identify & assess risks/threats to electronic health information:
**Availability.**
**Integrity.**
**Confidentiality.**
- Take **reasonable** steps to reduce the risks.
**Involves policies/procedures & contracts with business associates as well as technology.**
**For security technology to work, behavioral safeguards must also be established and enforced.**

## Different Approaches to Privacy & Security

- Privacy Rule based on application of simple, stable principles to a complex environment.
- Regulations detailed because change is slow.
- Recent developments may question that assumption.
- Security Rule based on application of general principles to rapidly changing environment.
- Highly technical threats and potential protections change very rapidly.
- Regulations could never be modified quickly enough to respond to needs.
- Compliance requires analysis and revisions.

## Federal Preemption by HIPAA

- The HIPAA regulations preempt contrary provisions of State law
- except where State law provides a more stringent (higher) privacy standard.
- Applicability of other federal laws is NOT affected.
- Resulting in complex web of regulations from federal, state, and local law.

**Notes:**
Comments:
Keep in mind that HIPAA does not preempt stricter state laws related to the privacy of health information. The HIPAA privacy regulation sets a floor for privacy standards, not a ceiling.  Therefore, if a state law has stricter provisions than HIPAA, the state law will prevail.  Remember to consult with your organization’s legal counsel and/or regulatory staff regarding any matters of compliance with federal or state privacy laws 

Transition to Next Slide: 
What are people saying about HIPAA?

## HISPC Sources of Variation

- Variation related to misunderstandings and differing applications of federal laws and regulations:
- HIPAA Privacy Rule
- Confusion about Patient Authorization/Consent
- Variation in Determining “Minimum Necessary”
- HIPAA Security Rule
- Confusion regarding the different types of security required
- Misunderstandings regarding what was currently technically available and scalable
- CFR 42 part 2
- Variation in the understanding of treatment facilities, physicians, and integrated delivery systems of 42 C.F.R. pt. 2, its relation to HIPAA, and the application of each regulation

## HISPC Sources of Variation (continued)

- Variation related to state privacy laws
- Scattered throughout many chapters of law
- When found, they are sometimes conflicting
- Often antiquated – written for a paper-based system
- Trust in applied information security
- Organizations mistrust each other
- Consumers/Patients mistrust orgs (except their doctors)
- Cultural and business issues
- Concern about liability for incidental or inappropriate disclosures
- General resistance to change

## HISPC Summary

- Fear, Uncertainty, and Doubt will impede HIE and HIT Initiatives unless resolved.
- GAO Challenges from June 2007 Report are similar.
- States are starting to understand the issues.
- States are formulating solutions:
- Practice and Policy Solutions.
- Legal and Regulatory Solutions.
- Technology and Data Standards.
- Education and Outreach.
- Multi-state and National Level Recommendations are forthcoming.

## Alternatives to Consider

**New Comprehensive Federal Law.**
- covers all participants equally but difficult to get passed.
- different types could address these issues:
**Non-discrimination law**. – Making it illegal for organizations to discriminate against individuals based on their health status would remove the major motivation for people to keep their health information secret, making the rest easier to handle.
**Comprehensive privacy law**. – Requiring each state to pass laws that meet certain criteria based on the principles of fair information practice; states that signed up for such an approach could not send individually identifiable data to states that had not signed up.
**Comprehensive health information privacy law**. – A law like the one that was promised by HIPAA would apply to any person who handles the individually identifiable health information of another person, and would limit state variability to enable eHIE.

## Alternatives to Consider (continued)

**Federal Law Modifying HIPAA**.
- A law that adds new types of organizations that handle individually identifiable health information would require new regulations applying principles to new functions.
- Including requirements for specific clinical information transaction standards could justify covering new entities.
- Classifying eHIE organizations as a new type of health care clearinghouse.
- Classifying PHR services as covered entities because of their direct interactions with patients.
**Model for State Laws **
- A common model law based on HIPAA regulations could enable states to pass very similar laws.
- Conceptually based on the successful passage and use of the Uniform Commercial Code (UCC) or Notary Public law.

## Conclusion

- HIPAA privacy and security rules are based on solid principles.
- HIPAA cannot be used alone in its present form to adequately cover PHR service providers and eHIE organizations.
- Applicability and regulatory details don’t fit.
- HIPAA is a good guide as to how to apply principles to the new environments.
- HIPAA implementation challenges should serve to forewarn and motivate prevention of similar difficulties in future legislative and regulatory efforts.

- Thank you!
- William R. “Bill” Braithwaite, MD, PhD
- Washington, DC
- bill@braithwaites.com