# Presentation: 319631

## Enhanced Protections for Uses of Health Data

**A Framework for “Secondary Uses” of Electronically Collected and Transmitted Health Data**

**Justine M. Carr, MD**
**Beth Israel Deaconess Medical Center**
**Co-Vice Chair, NCVHS Work Group on Uses of Health Data**

|                             | The National Committee on Vital and Health Statistics
The Public Advisory Body to the Secretary of Health and Human Services  |
| --- | --- |

## NCVHS

**Statutory public advisory body to the Secretary of Health and Human Services**
**58 year history of advising HHS in the areas of health data, health statistics, privacy and national health information policy**
**Congressionally mandated role in HIPAA**
**18 members**
**16 appointed by the Secretary, 2 by Congress**
**Leaders and experts in their fields**
**Reputation for open, collaborative processes and the ability to deliver timely, thoughtful, and practical recommendations**

## Ad Hoc Work Group

- Chair: Simon Cohn, MD, MPH **Kaiser Permanente**
- Co-Vice Chair: Justine M. Carr, MD **Beth Israel Deaconess Medical Center**
- Co-Vice Chair: Harry Reynolds **Blue Cross Blue Shield of North Carolina**
- Members:
- J. Marc Overhage, MD, PhD **Indiana Health Information Exchange**
- Mark Rothstein, JD  **University of Louisville School of Medicine**
- William J. Scanlon, PhD **Health Policy R&D**
- Paul Tang, MD  **Palo Alto Medical Foundation**
- Kevin Vigilante, MD, MPH  **Booz-Allen & Hamilton**
- NCVHS Reviewers:
- Jeff Blair, MBA  **Lovelace Clinic Foundation**
- Larry Green, MD  **University of Colorado**
- Carol J. McCall, FSA, MAAA  **Humana**
- Leslie Pickering Francis, PhD, JD  **University of Utah**
- Judith Warren, PhD, RN  **University of Kansas**

## Discussion Outline

**Scope of Work**
**Premises**
**Process**
**“****Secondary Uses”**
**Why Address Uses of Health Data Now?**
**HIPAA Challenges**
**“****Data Stewardship”**
**Risk/Benefit Analysis Framework**
**Next Steps**

## Excerpts from ONC Request for Assistance

- Identify requirements and articulate roles various entities (HIEs, research, population health) play in data stewardship
- Develop initial set of recommendations to clarify allowable and appropriate approaches for use of data for quality measurement and reporting
- Identify requirements for identified, anonymized, and de-identified data for various secondary uses and how HIEs would verify identity and authority of data users
- Address lack of clarity under current law with respect to allowable secondary uses of data in light of emerging approaches to data capture, exchange, and aggregation in support of quality measurement & reporting
- Discuss role of a data stewardship entity to ensure data is captured, aggregated, and analyzed according to rules and guidelines that ensure the precision and reliability of quality measures
- Aid understanding of how HIEs and other entities relate to each other and obtain appropriate disclosures and consents as needed to be compliant with current law and protect privacy and confidentiality

## NCVHS Scope of Work

- Develop a conceptual and policy framework that:
- provides guiding principles that balance the risk, sensitivity, benefits, obligations, and protections of various uses of health data,
- clarifies terminology associated with various uses of health data, e.g., anonymization, pseudo-anonymization, de-identification, aggregation, to the understanding of all stakeholders, and
- includes a taxonomy describing types of uses and users of health data
- Develop recommendations for HHS on policies, guidance, regulation, and/or public education to facilitate the use of health data for advancing the quality of the Nation’s health and healthcare delivery system, while respecting the privacy of the individuals who are the sources of those data
- Initial consideration is placed on how data are used in the processing and management of data directly associated with quality measurement, reporting, and improvement

## Premises

**The common good for all Americans is served when health data, collected in the practice of caring for individuals, can be optimized to advance the quality of health and health care for the Nation**
**Appropriate uses and protections for health information must be transparent to individuals in order to reassure them that their privacy                                                              is protected. **
**Application of health information technology affords an opportunity to optimize use of health information for the improvement of the Nation’s health and healthcare delivery system.**

## NCVHS Process

- Participation in AMIA invitational conference: “Towards a Framework For Secondary Uses of Healthcare Data” June 21-22, 2007
- Public Hearings and Meetings in Washington, DC area: June 28, 2007, July 17-19, 2007, August 1-3, 2007, August 23-24, 2007, October 4-5, 2007
- 58 Testifiers from:
- Provider and consumer representatives
- Quality organizations
- Health information exchanges
- Vendors who process and use health data
- Research and public health communities
- Interim findings discussed with AHIC Consumer Empowerment and Quality Work Groups
- Themes and pre-decisional recommendations being developed by Work Group for approval by full NCVHS

## Related Work and Collateral Documents

- AHIC QWG and ONC supported
- AHIC QWG Vision Summary
- AHIC Quality Use Cases
- AHRQ National Health Data Stewardship RFI
- AQA Guidelines and Key Questions for Physician Performance Data Aggregation and Measurement Projects
- Health Information Privacy and Security Collaboration (HISPC)
- AMIA – Toward a National Framework for Secondary Use of Health Data
- NCVHS
- Recommendations to the Secretary Regarding Privacy and Confidentiality in the NHIN, June 22, 2006
- Recommendations on the Initial Functional Requirements for a NHIN, Oct. 30, 2006
- Recommendations on Populations Based Data Collection, August 23, 2004
- Report on Measuring Health Care Quality, May 2004
- Annual Reports to Congress on the Implementation of the Administrative Simplification Provisions of HIPAA

## “Secondary” Uses of Health Data

**Difficult to define, no standard reference**
**Grouping all uses under a single rubric may result in all being treated the same**
**Connotes lesser importance than other uses**
**NCVHS is avoiding the use of the term “secondary,” and attempts – and encourages others also – to explicitly and uniquely describe each use of health data**

## Why Address Uses of Health Data Now?

**Enhanced use of health information technology:**
- Increases ability to use health data to benefit health and health care
- Enhances quality measurement and reporting in response to heightened consumer interests
- Enables a more real time quality improvement cycle
- Supports public health surveillance and responsiveness
- Produces more rapidly available and meaningful research
**But, Increases the potential for harm:**
- Erosion of trust in the healthcare system and compromises to health care may occur when there is a divergence between what the individual reasonably expects health data to be used for and when uses are made for other purposes without the knowledge and permission of the individual.
- Embarrassment and discrimination concerns may be amplified as there is enhanced ability to collect longitudinal data coupled with sophisticated means to re-identify data

## Why Address Uses of Health Data Now?

- Health data available for incorporating into large databases are no longer just claims data, but include richer data (e.g., lab results, medications) that can more readily be linked with other databases.
- Providing enhanced data and their analysis may be a means to provide a sustainable business model that supports HIEs
- Sources of electronic health information are expanding beyond HIPAA protections of covered entities and their business associates
- For example, commercial personal health record vendors and providers who do not transmit claims electronically are not covered by HIPAA at all
- Companies that transmit health data (beyond the HIPAA financial and administrative transactions) may be business associates, agents of business associates, or not addressed by either
- Electronic solutions to protect data are also more readily available: for role-based access, integrity, non-repudiation, and individual consent to follow data, and others

## HIPAA Challenges

- Health Insurance Portability and Accountability Act of 1996 (HIPAA) Administrative Simplification provisions promote electronic exchange for administrative simplification
- Congress included requirement for federal privacy legislation within 3 years of enactment, or HHS to adopt regulations safeguarding privacy of individually identifiable health information
**HIPAA only regulates:**
_**Covered entities**_ (CE) who electronically transmit health information in connection with transactions for which HHS has standards
- Health care payers
- Health care providers
- Health care clearinghouses
_**Covered entity use of business associates (BA) and (to a lesser extent) their agents**_
- Person or entity acting on behalf of CE to perform a function regulated by HIPAA via a business associate contract

## HIPAA Privacy Rule Challenges

- Covers only individually identifiable health information (in any form, paper, electronic, or oral) held or transmitted by a covered entity = protected health information (PHI)
- Requires authorization for disclosure of PHI, except for:
- Uses for treatment, payment, or _healthcare operations_ (**TPO**)
- When required by law, public health, health oversight, research (when covered by Common Rule or waived by a privacy board), and certain other uses
- _Healthcare operations_ includes quality assessment, competency review, payment processes, compliance activities, business planning, and general administrative activities – a broad scope of uses
- De-identified data (defined as 17+ designated identifiers [safe harbor] or statistical process)
- May undermine utility in a quality analysis, where some identifying data may be relevant
- Do not require a quantitative target or reporting of ability to re-identify
- Are not protected under HIPAA and may be used in any manner, including their sale for marketing or other purposes

## Data Stewardship

**Stewardship** is the careful and responsible management of something entrusted to one's care
- When an individual provides private health information to a provider, the individual expects it to be held confidential, to be safeguarded, and to be used in certain ways
**[Health] data stewardship** (AMIA) “encompasses the responsibilities and accountabilities associated with managing, collecting, viewing, storing, sharing, disclosing, or otherwise making use of personal health information”
- Data stewardship principles are included in the HIPAA Privacy and Security Rules, and need to be elaborated for the new world of HIT and HIE

## Risk/Benefit Analysis Framework

## Next Steps

**Work Group meeting October 4-5, 2007**
**Additional open calls and feedback during October**
**Full Committee review and approval**
**Scheduled for completion, ****October/ November 2007**
**Ongoing analysis and subsequent recommendations anticipated**

## Thank You for Your Attention...

***Questions?***
***Comments?***

**www.ncvhs.hhs.gov**