U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

33–874 PDF 2007

S. Hrg. 110–114

PRIVATE HEALTH RECORDS:

PRIVACY IMPLICATIONS OF THE FEDERAL

GOVERNMENT’S HEALTH INFORMATION

TECHNOLOGY INITIATIVE

HEARING

BEFORE THE

OVERSIGHT OF GOVERNMENT MANAGEMENT, 

THE FEDERAL WORKFORCE, AND THE DISTRICT 

OF COLUMBIA SUBCOMMITTEE

OF THE

COMMITTEE ON 

HOMELAND SECURITY AND 

GOVERNMENTAL AFFAIRS 

UNITED STATES SENATE

ONE HUNDRED TENTH CONGRESS

FIRST SESSION

FEBRUARY 1, 2007

Available via http://www.access.gpo.gov/congress/senate

Printed for the use of the 

Committee on Homeland Security and Governmental Affairs

(

(II)

COMMITTEE ON HOMELAND SECURITY AND GOVERNMENTAL AFFAIRS 

JOSEPH I. LIEBERMAN, Connecticut, Chairman 

CARL LEVIN, Michigan 

DANIEL K. AKAKA, Hawaii 

THOMAS R. CARPER, Delaware 

MARK L. PRYOR, Arkansas 

MARY L. LANDRIEU, Louisiana 

BARACK OBAMA, Illinois 

CLAIRE McCASKILL, Missouri 

JON TESTER, Montana 

SUSAN M. COLLINS, Maine 

TED STEVENS, Alaska 

GEORGE V. VOINOVICH, Ohio 

NORM COLEMAN, Minnesota 

TOM COBURN, Oklahoma 

PETE V. DOMENICI, New Mexico 

JOHN WARNER, Virginia 

JOHN E. SUNUNU, New Hampshire

MICHAEL L. ALEXANDER, Staff Director 

BRANDON L. MILHORN, Minority Staff Director and Chief Counsel 

TRINA DRIESSNACK TYRER, Chief Clerk 

SUBCOMMITTEE ON GOVERNMENT MANAGEMENT, THE FEDERAL 

WORKFORCE, AND THE DISTRICT OF COLUMBIA 

DANIEL K. AKAKA, Hawaii, Chairman 

CARL LEVIN, Michigan 

THOMAS R. CARPER, Delaware 

MARK L. PRYOR, Arkansas 

MARY L. LANDRIEU, Louisiana 

GEORGE V. VOINOVICH, Ohio 

TED STEVENS, Alaska 

TOM COBURN, Oklahoma 

JOHN WARNER, Virginia

RICHARD J. KESSLER, Staff Director 

JENNIFER A. HEMINGWAY, Minority Staff Director 

EMILY MARTHALER, Chief Clerk 

(III)

C O N T E N T S 

Opening statements: Page 

Senator Akaka .................................................................................................. 1

Senator Voinovich ............................................................................................. 3

Senator Carper ................................................................................................. 4

WITNESSES 

THURSDAY, FEBRUARY 1, 2007

Robert Kolodner, M.D., Interim National Coordinator for Health Information 

Technology, U.S. Department of Health and Human Services ........................ 5

Daniel A. Green, Deputy Associate Director, Center for Employee and Family 

Support Policy, Office of Personnel Management ............................................. 7

David A. Powner, Director of Information Technology Management Issues, 

Government Accountability Office, accompanied by Linda Koontz, Director 

of Information Management Issues, Government Accountability Office ......... 17

Mark A. Rothstein, Herbert F. Boehl Chair of Law and Medicine, and Director, Institute for Bioethics, Health Policy and Law, University of Louisville 

School of Medicine ................................................................................................ 19

Carol C. Diamond, M.D., Managing Director, Markle Foundation, and Chair, 

Connecting for Health .......................................................................................... 20

ALPHABETICAL LIST OF WITNESSES

Diamond, Carol C., M.D.: 

Testimony .......................................................................................................... 20

Prepared statement with attachments ........................................................... 138

Green, Daniel A.: 

Testimony .......................................................................................................... 7

Prepared statement .......................................................................................... 44

Kolodner, Robert, M.D.: 

Testimony .......................................................................................................... 5

Prepared statement .......................................................................................... 35

Koontz, Linda: 

Testimony .......................................................................................................... 17

Prepared statement with attachments ........................................................... 52

Powner, David A.: 

Testimony .......................................................................................................... 17

Prepared statement with attachments ........................................................... 52

Rothstein, Mark A.: 

Testimony .......................................................................................................... 19

Prepared statement .......................................................................................... 130

APPENDIX 

Background Memorandum ...................................................................................... 29

Simon P. Cohn, M.D., M.P.H., Chairman, National Committee on Vital and 

Health Statistics, submitted copy of a report entitled ‘‘Privacy and Confidentiality in the Nationwide Health Information Network’’ .......................... 164

Response to questions submitted for the Record from: 

Dr. Kolodner ...................................................................................................... 181

Mr. Green .......................................................................................................... 185

Mr. Powner ........................................................................................................ 188

(1)

PRIVATE HEALTH RECORDS: PRIVACY 

IMPLICATIONS OF THE FEDERAL 

GOVERNMENT’S HEALTH INFORMATION 

TECHNOLOGY INITIATIVE 

THURSDAY, FEBRUARY 1, 2007

U.S. SENATE,

SUBCOMMITTEE ON OVERSIGHT OF GOVERNMENT

MANAGEMENT, THE FEDERAL WORKFORCE,

AND THE DISTRICT OF COLUMBIA,

OF THE COMMITTEE ON HOMELAND SECURITY

AND GOVERNMENTAL AFFAIRS,

Washington, DC. 

The Subcommittee met, pursuant to notice, at 2:33 p.m., in room 

SD–342, Dirksen Senate Office Building, Hon. Daniel K. Akaka, 

Chairman of the Subcommittee, presiding. 

Present: Senators Akaka, Carper, and Voinovich. 

OPENING STATEMENT OF CHAIRMAN AKAKA 

Chairman AKAKA. This hearing will come to order. 

Today’s hearing, ‘‘Private Health Records: Privacy Implications of 

the Federal Government’s Health Information Technology Initiative,’’ will examine what actions the Federal Government is taking 

to ensure that privacy is an integral part of the national strategy 

to promote health information technology. 

Studies show that the use of health IT can save money, reduce 

medical errors, and improve the delivery of health services. For example, in 2004, the Center for Information Technology Leadership 

estimated that in ambulatory care settings the use of electronic 

health records (EHRs) would save $112 billion per year, or 7.5 percent of health care spending. In addition, EHRs are shown to help 

avoid duplicate tests and excess medication. 

In 2004, President Bush called for the widespread adoption of 

interoperable electronic health records within 10 years and issued 

an Executive Order that established the position of the National 

Coordinator for Health Information Technology. The National Coordinator is charged with developing and implementing a strategic 

plan to guide the nationwide implementation of interoperable 

health IT in both the public and private sectors. 

Two months later, the Department of Health and Human Services (HHS) released a framework for strategic action to promote 

health IT, which calls on all levels of government to work with the 

private sector to stimulate change in the health care industry. For 

example, the Departments of Veterans Affairs (VA) and Defense 

2

(DOD), the major Federal health care delivery organizations, are 

leaders in the use of health IT. 

VA, one of the country’s largest health care providers, has had 

an automated information system in its medical facilities since 

1985. DOD has provided IT support to its hospitals and clinics 

since 1968. As Chairman of the Veterans’ Affairs Committee, we 

are looking at how to move DOD and VA forward in developing 

joint EHRs. 

This Subcommittee is particularly interested in the strategy, 

which calls for the Office of Personnel Management (OPM) to use 

its leverage as the administrator of the Federal Employee Health 

Benefits Program, which covers approximately 8 million Federal 

employees, retirees, and their dependents, to expand the use of 

health IT. OPM, through its annual Call Letter to carriers, has 

been encouraging carriers to increase the use of EHRs, electronic 

prescribing, and other health IT-related provisions. 

Although I support efforts to increase the use of health IT, I am 

deeply concerned about the level of privacy protections in the 

health IT network. In 2005, a Harris Interactive survey showed 

that 70 percent of Americans were concerned that an electronic 

medical records system would lead to sensitive medical records 

being exposed due to weak electronic security. This fear is understandable. 

Over the past few years, we have seen various data mining programs in the Federal Government that lacked key privacy protections. We also recall the loss of a VA laptop computer and the news 

of many other Federal data breaches that put the personal information of millions of Americans at risk. These incidents reinforce 

the need to build privacy and security protections into any system 

containing personal information. Our personal health information 

must not be subject to these same failings. Privacy and security are 

critical elements in health IT and should never be an afterthought. 

That is why I wrote to OPM in May 2005 seeking information 

on how Federal employees’ health information would be protected 

under the efforts of OPM and the health insurance carriers. OPM 

responded that the Health Insurance Portability and Accountability 

Act (HIPAA) would address these privacy concerns. But while 

HIPAA is a foundation, HIPAA by itself is not enough. Privacy protections must be built in conjunction with the development of the 

health IT infrastructure. 

To ensure that this was happening, Senator Kennedy and I 

asked the Government Accountability Office to review the efforts of 

HHS and the National Coordinator to protect personal health information. GAO’s report, which was released this morning, found that 

while HHS and the National Coordinator have taken steps to study 

the protection of personal health information, an overall strategy is 

needed to: One, identify milestones for integrating privacy into the 

health IT framework; two, ensure privacy is fully addressed; and, 

three, address key challenges associated with the nationwide exchange of information. 

Given the overwhelming evidence of the benefits associated with 

the expanded use of health IT, as well as the fact that 70 percent 

of Americans are concerned about the privacy of their health inforVerDate 0ct 09 2002 09:44 Aug 14, 2007 Jkt 033874 PO 00000 Frm 00006 Fmt 6633 Sfmt 6633 C:\DOCS\33874.TXT SAFFAIRS PsN: PAT
3

mation, I am surprised to learn that HHS objects to this recommendation. 

It is clear that the health care industry faces challenges in protecting electronic health information given the varying State laws 

and policies, the entities not covered by HIPAA, and the need to 

implement adequate security measures. But while more and more 

companies, providers, and carriers move forward with health IT, I 

fear that privacy suffers while HHS takes time to decide how to implement privacy protection. HHS must address these issues in a 

more timely fashion in order to give the private sector guidance on 

how to move forward with health IT and protect the private health 

information of all Americans. 

I want to thank our witnesses for being here today to discuss this 

critical issue. 

I now turn to my good friend, Senator Voinovich, for any opening 

statement he may have at this time. 

OPENING STATEMENT OF SENATOR VOINOVICH 

Senator VOINOVICH. Thank you, Senator Akaka. I appreciate 

your holding this hearing today on a subject that is of interest to 

me. 

The widespread adoption of health information technology such 

as electronic health records will revolutionize the health care profession. In fact, the Institute of Medicine, the National Committee 

on Vital and Health Statistics, and other expert panels have identified information technology as one of the most powerful tools in reducing medical errors and improving the quality of health. 

Unfortunately, our country’s health care industry lags far behind 

other sectors of the economy in its investment in information technology. But, Senator Akaka and Carper, as I travel around Ohio I 

see a marked acceleration in the use of IT. 

The Institute of Medicine estimated in 1999 that there were 

nearly 98,000 deaths each year resulting from medical errors. 

Many of these deaths can be directly attributed to the inherent imperfections of our current paper-based health care system. 

Not only can technology save lives and improve the quality of 

health care, it also has the potential to reduce the cost of the delivery of health care. According to the Rand Corporation, the health 

care delivery system in the United States could save approximately 

$160 billion annually with the widespread use of electronic medical 

records. As technology advances, the issues surrounding protection 

of personal information will continue to be at the forefront of people’s minds. Individual citizens continue to express concern over 

the security of personal, confidential information whether it is contained in an electronic health record or stolen from laptops, as Senator Akaka pointed out, at the Department of Veterans Affairs. 

However, the benefits of technology in the health care arena are 

undeniable, and I support the use of HIT. In fact, in the 109th Congress, Senator Carper and I introduced the Federal Employees 

Electronic Personal Health Records Act. I am sure we will be hearing more from Senator Carper about it. The bill will provide for the 

establishment and maintenance of electronic personal health 

records for individuals and family members enrolled in the Federal 

4

Employee Health Benefits Program. I have talked with one of the 

major health insurance companies and they support the use of HIT. 

I am hopeful the testimony today will assist my colleagues and 

me as we make decisions about implementing health IT. I personally look forward to learning from our witnesses ways Senator Carper and I might refine our legislation before introduction. As I say, 

we are making progress on privacy protections, and I am really 

pleased that the President issued an Executive Order specific to deployment of health information technology, including establishment 

of a National Coordinator for Health Information Technology. 

Since then, the Coordinator and the Department of Health and 

Human Services have made considerable progress toward the adoption of interoperable IT. But the successes have not come without 

criticism. Dr. Kolodner, your office has an enormous responsibility 

to continue to cultivate a strategic plan to guide implementation of 

nationwide interoperable health information technology. It is an 

important job. We must bring health care costs under control, and 

HIT is one part of that goal. However, there is some concern about 

whether information in IT systems is going to be private and secure. We cannot let those weaknesses impede our progress in this 

area. 

So, Mr. Chairman, I am looking forward to hearing from our witnesses. 

Chairman AKAKA. Thank you very much, Senator Voinovich. 

Senator Carper. 

OPENING STATEMENT OF SENATOR CARPER 

Senator CARPER. Thank you, Mr. Chairman, and to our witnesses 

and to my friend and colleague, Senator Voinovich. He telegraphed 

my pitch a little bit, but I think it is great that he did. 

Mr. Chairman, as Senator Voinovich has said, we introduced in 

the last Congress and I think we are close to reintroducing in this 

Congress legislation to require those who provide insurance under 

the Federal Employee Health Benefits Program—they would have 

a period of time, I think maybe less than 2 years or so—to provide 

electronic health records for Federal employees insured under those 

policies if the employees wish to have that. And I know you have 

a strong interest in privacy protection, and we would look forward 

to working with you and your Subcommittee and your staff to 

make sure that we meet muster in that regard. 

Next month is a big month for us in Delaware, and I say this 

to our witnesses and others. We are beginning to stand up what 

we call the ‘‘Delaware Health Information Network,’’ an apple in 

my eye when I was Governor many years ago, and it is now actually coming to fruition as we try to electronically link our doctors’ 

and nurses’ offices and our hospitals and our labs and other providers. We are excited about the possibilities that holds for us. 

I am an old Navy guy, and I remember when I got out of the 

Navy—at least off of active duty, not out of the Navy, but off of active duty in 1973 and showed up at the VA hospital just outside 

of Wilmington. And it is not a place that, frankly, a lot of veterans 

wanted to go to for health care. I did not sense there was a lot of 

joy on the part of people who worked there being a VA employee, 

5

1The prepared statement of Dr. Kolodner appears in the Appendix on page 35. 

doctor or nurse or anything else. And, boy, that has really changed, 

especially in the last decade. 

I would never have imagined 33 years ago, that we would be 

looking to the VA to provide the way with respect to improving outcomes and holding down costs and saving lives. But they sure have 

come through for us. 

Mr. Chairman, don’t you chair the Veterans Committee in the 

Senate? 

Chairman AKAKA. Yes. 

Senator CARPER. I thought so. OK. Well, you have sort of a double interest in this particular issue. But we really look forward to 

what you have to say. We do not have very strong attendance here 

today, partly because there is a concurrent just-called caucus of the 

Senate Democrats, and they are meeting as we speak to discuss a 

resolution that pertains to the President’s proposed surge of troops 

in Iraq. So people may be drifting in to join us in a little bit, but 

that just began literally at the time that this hearing began. So we 

apologize for them. Those of us who are here are anxious to hear 

what you have to say. So thanks for coming. 

Chairman AKAKA. Thank you very much. 

I welcome to the Subcommittee today’s first panel of witnesses: 

Dr. Rob Kolodner, Interim National Coordinator for Health Information Technology at the Department of Health and Human Services, and Daniel Green, Deputy Associate Director, Center for Employee and Family Support Policy, at the Office of Personnel Management. 

It is the custom of this Subcommittee to swear in all witnesses, 

and I ask you to stand and raise your right hand. Do you swear 

that the testimony you are about to give this Subcommittee is the 

truth, the whole truth, and nothing but the truth, so help you, 

God? 

Dr. KOLODNER. I do. 

Mr. GREEN. I do. 

Chairman AKAKA. Thank you. Dr. Kolodner, please proceed with 

your statement. 

TESTIMONY OF ROBERT KOLODNER, M.D.,1 INTERIM NATIONAL COORDINATOR FOR HEALTH INFORMATION TECHNOLOGY, U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES 

Dr. KOLODNER. Good afternoon, Chairman Akaka, Senator 

Voinovich, and Senator Carper. Thank you for inviting me here 

today to discuss the privacy plans, activities, and accomplishments 

of the National Health Information Technology agenda led by HHS. 

Mr. Chairman, we appreciate Hawaii’s efforts as pioneers in protecting patient health information and note that Hawaii’s early 

work to develop a comprehensive privacy law informed and was an 

important resource for HHS when we developed the HIPAA privacy 

rules. 

Privacy and security are integral components of the national 

health IT agenda and are addressed by a spectrum of activities 

that advance our current understanding of the issues and multiple 

6

levels and lay the foundation for future activities. The widespread 

adoption of interoperable electronic health records will save lives, 

reduce medical errors, and improve the quality and efficiency of 

care, as you have noted. 

At the same time, it will create both new challenges and new opportunities with respect to protecting health information. HIPAA 

created a strong foundation of privacy and security protections for 

personal health information upon which States may provide additional privacy protections. We are vigorously addressing the new 

challenges by leveraging existing privacy policy foundations, building robust new public-private collaborations, partnering with 

States, health care organizations, and consumers to address State 

and business level protections, and considering privacy and security policies and implementation at a nationwide level. 

Ultimately, the effective coordination of health IT activities will 

help create an environment that improves the health status of both 

individuals and communities at the same time that personal health 

information is protected. 

The HHS Office of the National Coordinator for Health IT, ONC, 

is charged with leading the national health IT agenda across the 

Federal Government and the private sector by coordinating health 

IT activities, including those related to privacy and security. ONC 

has the lead for working with CMS, the Office for Civil Rights, or 

OCR, and others to develop the privacy policies for health IT, and 

OCR and CMS are responsible for the oversight and enforcement 

of the related HIPAA rules. 

The GAO report provides an excellent summary of the myriad of 

our successful health IT activities since 2004, and the report documents an active, progressive program of HHS activities that identify national privacy issues to be addressed as well as barriers to 

interoperability caused by privacy policy variations across States 

that need to be resolved. 

The tools we use to advance our privacy and security activities 

include contracts, including a recent one with the National Governors Association, an interdepartmental Federal Policy Council, 

and a public-private Confidentiality, Privacy, and Security Work 

Group of the American Health Information Community. The Community is a Federal advisory committee that is chaired by Secretary Leavitt himself and plays a central role in all of our activities. The members of the Community, consisting of senior leaders 

from the public and private sectors, participate in deliberations 

that guide our work and shape our understanding of how we can 

most effectively advance the health IT agenda nationwide, including privacy and security. 

Much like the historic journey by Lewis and Clark 200 years ago, 

who were crossing uncharted territory, we, too, are on a similar 

journey. Their goal was clear: to find a route to the Pacific Ocean, 

although the exact path was unknown at the beginning. Our goal 

is clear as well: The secure exchange of interoperable electronic 

health information. And the detailed milestones necessary to 

achieve our goal are also not yet knowable. 

Our approach is iterative. First, it requires an understanding of 

the multiple environments in which we are operating. To gain this 

understanding, we have initiated multiple complementary activiVerDate 0ct 09 2002 09:44 Aug 14, 2007 Jkt 033874 PO 00000 Frm 00010 Fmt 6633 Sfmt 6633 C:\DOCS\33874.TXT SAFFAIRS PsN: PAT
7

1The prepared statement of Mr. Green appears in the Appendix on page 44. 

ties, such as the Nationwide Health Information Network prototypes, the Privacy and Security Solutions Contract, and the State 

Alliance for e-Health. And we have gathered input from other expert resources such as the National Committee for Vital and 

Health Statistics, or NCVHS. 

Second, our approach requires that we evaluate and analyze 

what we have discovered and learned. For example, only after we 

get the State level reports this spring that identify challenges and 

opportunities to protect and share health information will we have 

sufficient data to reliably establish the next set of milestones that 

we must achieve. An output from one source becomes input for another, such as the NCVHS recommendations that have been publicly shared with the Community work group I mentioned previously. As that work group moves from addressing security to addressing privacy concerns, we anticipate that these recommendations will inform the next set of privacy priorities. 

Our activities confirm the importance we give to confidentiality, 

privacy, and security. We have been executing an effective plan, 

originally described in our strategic framework that you mentioned, 

Mr. Chairman, and one that will continue to grow and evolve as 

we submit our health IT strategic plan later this year. 

We are using a results-oriented strategy of discovery and advancement that must be done in collaboration with a variety of 

stakeholders at the local, State, and national levels. GAO has documented the progress that we have made in the first 2 years of our 

work, and we continue to undertake multiple related productive activities to properly protect the electronic health information today, 

tomorrow, and into the future. 

Thank you for your time, and I welcome any questions you might 

have. 

Chairman AKAKA. Thank you very much. I want our witnesses 

to know that your full statements will be included in the record. 

Mr. Green. 

TESTIMONY OF DANIEL A. GREEN,1 DEPUTY ASSOCIATE DIRECTOR, CENTER FOR EMPLOYEE AND FAMILY SUPPORT 

POLICY, OFFICE OF PERSONNEL MANAGEMENT 

Mr. GREEN. Mr. Chairman, Members of the Subcommittee, it is 

my pleasure to be here today to represent the Office of Personnel 

Management (OPM) Director Linda Springer. I plan to discuss how 

OPM is working with the Department of Health and Human Services and other organizations on the National Health Information 

Technology Initiative, and I will discuss how we at OPM are working with our health benefits carriers to implement health information technology (IT) that is secure and protects member privacy. 

OPM administers the Federal Employees Health Benefits 

(FEHB) Program, which covers approximately 8 million Federal 

employees, retirees, and their dependents. Like other large employers, we contract with private sector health plans. We have consistently encouraged participating plans to be responsive to consumer 

interests by emphasizing flexibility and consumer choice. We have 

also encouraged plans to adopt health information technology as an 

8

important consumer-oriented initiative. At the same time, we have 

placed great importance on the privacy and security of personal 

health information. 

FEHB enrollees have the same privacy protections under Federal 

law as all Americans. The Health Insurance Portability and Accountability Act of 1996, provides protections for privacy of individually identifiable health information. All FEHB health carriers are 

required to comply with HIPAA requirements. 

And now I would like to provide some background on OPM’s initiatives in health information technology. 

In 2004, President Bush issued an Executive Order to develop 

and implement a nationwide health IT infrastructure to improve 

the quality and efficiency of health care. In response to the Executive Order, we have been working with our FEHB plans on focused 

efforts to promote health IT while at the same time ensuring compliance with Federal requirements on privacy and security. More 

specifically, we have asked our carriers to concentrate on specific 

short-term objectives which include education for consumers on 

health IT, offering personal health records to consumers based on 

their medical claims history, encouraging e-prescribing, linking disease management programs with health IT, and compliance with 

Federal requirements on privacy. 

We have found that while there are wide variations in the scope 

and extent of health IT use, most carriers have focused on providing consumers with claims-based information through their secured websites. Some have robust health IT systems. We have recognized them on our own website during Open Season so consumers would have this additional information to take into consideration in making their plan choices. 

Then, last August, President Bush issued a second Executive 

Order, which underscored his commitment not only to health IT, 

but also to health care cost and quality transparency. In support 

of the order, we required all FEHB carriers to report on quality 

measures, including data from the Health Plan Employer Data and 

Information set. We also encouraged them to provide information 

on cost and quality transparency. Along with the carriers that have 

state-of-the-art health IT capabilities, the carriers that made their 

best efforts to provide cost and quality transparency were also 

prominently positioned on our Open Season website last fall. 

Looking forward, OPM will continue to work with carriers on 

standards for interoperability of health information records as they 

are adopted in the health care industry, and we will continue to 

provide information for consumers on carriers’ cost and quality 

transparency initiatives as well as their health IT capabilities. 

As a member of the American Health Information Community, 

OPM will monitor the recommendations of the Confidentiality, Privacy, and Security Work Group and determine if there are privacy 

and security requirements that should be applied to FEHB carriers. We firmly believe privacy and security of personal health information is important. We are encouraged by HHS’s efforts to address this important issue. We plan to continue to work closely 

with HHS, the Community, and the Health IT Policy Council to ensure all necessary steps are taken to protect consumer privacy 

rights. 

9

We appreciate this opportunity to testify before the Subcommittee on this very important issue, and we will be glad to answer any questions you may have. 

Chairman AKAKA. Thank you very much for your testimony. 

Dr. Kolodner, the GAO report notes that HHS disagreed with 

GAO’s recommendation to define and implement the overall approach for protecting health information, including identifying 

milestones and integrating privacy efforts. Can you elaborate on 

HHS’s objection to GAO’s recommendation, particularly why HHS 

believes that setting milestones will impede progress and preclude 

stakeholder dialogue? 

Dr. KOLODNER. Yes, Mr. Chairman. As I mentioned, the issue is 

not whether we have milestones. Milestones that we can set up 

right now based on what we know are very high level. They are, 

for example, to complete our Privacy and Security Solutions contract, to get the results of the contract, to analyze those results, 

and based on the content that was given in those analyses, to then 

determine the next set of milestones. That is pretty high level. 

That is not what we believe GAO was telling us to do, because that 

is basic project management, and we are doing that already. 

The idea of stating right now what those milestones will look like 

in June or July, when we have not yet received the report that will 

be received this spring, is something that we know would probably 

not accurately reflect what we will be executing in June, July, and 

August. So we see this as an iterative process of discovery and collaboration. 

A very important reality is that there are many parties that have 

very strong feelings, as you can tell, about this area, and privacy 

is important. We need to make sure that we advance deliberately, 

advance as quickly as we possibly can, but to make sure that we 

listen to and are informed by a variety of viewpoints. And as those 

deliberations occur and as those collaborations occur, we will advance forward. 

Chairman AKAKA. Thank you. 

Mr. Green, OPM’s contracts with carriers require compliance 

with HIPAA. As part of OPM’s requirement to promote the use of 

health IT, the 2007 Call Letter required carriers to comply with 

Federal requirements to protect the privacy of individually identifiable health information. 

How does OPM monitor carriers’ compliance with HIPAA privacy 

and security rules? And what steps are taken if a carrier is found 

to be noncompliant? 

Mr. GREEN. Mr. Chairman, in addition to the HIPAA law, we 

have required by contract that all our carriers follow the HIPAA 

rules, and we have also added privacy requirements that pre-date 

the HIPAA law, and those are in our standard contracts. We have 

also added certain measures that all our carriers are required to 

comply with concerning confidentiality of records and privacy and 

the regulations used to supplement the Federal Acquisition Regulations. They are called FEHBAR. The FEHB Acquisition Regulations apply to all our carriers. They are required to notify their contracting officer whenever they have an enforcement action resulting 

from noncompliance, as issued by a State or Federal authority. 

They are also subject to audit by both GAO and OPM, including 

10

OPM’s Inspector General’s office, and they run a system of audits 

against the computer systems of all our carriers on a rotational 

basis. And they will be introducing additional privacy audit steps 

this year into that audit. 

Chairman AKAKA. Mr. Green, are there any circumstances that 

would result in electronic health records or personal health record 

networks being developed or used by FEHBP carriers that would 

not come under HIPAA? 

Mr. GREEN. Senator, the FEHB carriers are required to follow 

HIPAA rules, and so are their business associates, such as pharmacy benefit managers. So any subcontracts they have would also 

under our contract require them to follow HIPAA rules. 

Chairman AKAKA. Dr. Kolodner, the statutory advisory committee, NCVHS, and the Secretary’s advisory committee, AHIC, 

have made recommendations to the Secretary of HHS regarding 

the protection of personal health information. What is HHS’s response to the recommendations, and how will they be incorporated 

into a nationwide health information architecture? 

Dr. KOLODNER. Mr. Chairman, the NCVHS recommendations, 

which were accepted by the Secretary and then sent to the AHIC 

work group—the Confidentiality, Privacy, and Security Work 

Group—are, in fact, informing that group as they consider the various privacy policies and privacy priorities. Those will then come 

back to the Community for recommendation up in terms of specifically what kinds of privacy policies and security kinds of architecture should be required as we move forward. 

The Nationwide Health Information Network prototypes also 

have brought forth a number of different solutions, and we have 

been using those to look at what should go forward for the next 

round of trial implementations that we plan to fund this next year. 

So they are very much guiding and identifying those requirements 

that need to be moving forward. 

Chairman AKAKA. Mr. Green, I believe privacy protections must 

be built into the health IT architecture at the beginning instead of 

racing to address privacy violations after Americans lose trust in 

the system. However, after reading the testimony of the witnesses 

on our second panel, I fear that HHS is not acting fast enough to 

integrate privacy protections in the development of the health IT. 

With this in mind, Mr. Green, what risks are there to Federal 

employees’ health information as FEHBP carriers push forward 

with health IT initiatives? 

Mr. GREEN. Senator Akaka, nothing in this world is perfect, and 

there is no absolute certainty anywhere. However, I am convinced 

that with the procedures that we have in place, the requirements 

we have in place today, protect our FEHB enrollees as fully or 

more so than any other citizen in this country against a chance of 

inappropriate misuse of that information. 

In addition, going forward with the implementation of health information technology, we are pleased and honored and excited 

about our participation in much of the work with the Department 

of Health and Human Services. As you know, we are a member of 

the AHIC. We are on several of the subcommittees, working 

groups, and, in fact, Director Springer for a time chaired the Consumer Empowerment Work Group, which is our deep interest beVerDate 0ct 09 2002 09:44 Aug 14, 2007 Jkt 033874 PO 00000 Frm 00014 Fmt 6633 Sfmt 6633 C:\DOCS\33874.TXT SAFFAIRS PsN: PAT
11

cause we feel like that is our responsibility—to support and protect 

our enrollees. They are our primary customers, after all. And, in 

addition, we work with the other Federal agencies that are heavily 

involved in this as part of an HIT Policy Council. 

So I am convinced that as we go forward, our Federal employees, 

retirees, and survivors and their family members will be as protected as we can possibly make them, and that is our promise to 

you, sir. 

Chairman AKAKA. Thank you. Senator Voinovich. 

Senator VOINOVICH. Thank you. 

Dr. Kolodner, do you believe that the Office of National Coordinator has sufficient authority to facilitate communications among 

Federal entities, the private sector, and consumer organizations to 

lead the development and implementation of appropriate privacy 

standards? 

Dr. KOLODNER. Yes, sir, I believe that we do, and I think that 

we have a number of avenues and a number of venues where we 

are already doing that, including the American Health Information 

Community, and also a number of the contracts with the States, 

like the State Alliance for e-Health. 

Senator VOINOVICH. Do you think outside groups looking in 

would say that they agree with you? 

Dr. KOLODNER. We have several venues where we use public-private collaborations, and we certainly look for any other opportunities there might be, but we have been as open as possible in the 

development of the standards, and in deliberations by any of the 

work groups. They are all open, broadcast on the Web, and have 

opportunities for public comment throughout. 

Senator VOINOVICH. I know this is off the subject, but it is something I am interested in. We have not passed appropriations, and 

we are talking about a continuing resolution. I would be interested 

in your observations in regard to whether you feel that it has been 

harmful to your respective organizations to have a continuing resolution in which you are operating under. 

Dr. KOLODNER. For the Office of the National Coordinator, we 

have been able to proceed on a variety of activities that we have 

underway, and we have not had to slow down because of the continuing resolution. And we also, as you know, have the good fortune of having both Secretary Leavitt’s very strong backing—this 

is one of his top programs—as well as the President having passed 

two Executive Orders that allow us to move forward. 

Senator VOINOVICH. So no problem? 

Dr. KOLODNER. No problem. 

Senator VOINOVICH. Mr. Green. 

Mr. GREEN. Senator, I cannot speak for all of the Office of Personnel Management on our budget issues. I will leave that to Director Springer. I can say that we are moving forward on our initiatives, and we have a very large agenda within the Federal Employees Health Benefits Program and the other benefit systems, 

and we are moving forward without slackening at all. 

Senator VOINOVICH. Do you have the personnel and resources to 

get the job done? 

12

Mr. GREEN. Sir, I argue and fight for as many resources as I can 

get with my leadership, but I think that would probably be best left 

inside the OPM doors. 

Senator VOINOVICH. Well, one of the things that bothers me is 

that we are asking many agencies to do all kinds of things, and we 

do not allocate the resources so they can get the job done. I know 

it is very difficult for the secretaries of these departments to be 

forthcoming about it, but it seems to me that during this new budget cycle we ought to be encouraging both of you to make it clear 

to the folks that are in charge if you need additional help. I just 

read, Senator Akaka, where the President is talking about flat 

funding the nondefense discretionary budget again. We just cannot 

keep going this way. There are too many responsibilities that are 

not getting done, and the nondefense discretionary budget is being 

cut. To be candid with you, we should be paying for the war, just 

not putting it on the tab. What it is doing is it is squeezing out 

other priorities that are essential. 

Have you, Mr. Green, had a chance to look at the bill that I 

joined Senator Carper in introducing, the Federal Employees Electronic Personnel Health Records Act? 

Mr. GREEN. Yes, sir, I have. 

Senator VOINOVICH. I would be interested in your comments 

about it. 

Mr. GREEN. Several comments, as a matter of fact. 

We note that the bill is consistent with the direction of the 

health care industry and the leadership provided by HHS, and it 

is also consistent with OPM’s initiatives, as well, to move our carriers toward having PHRs. We do have some concerns about some 

of the aspects of the bill. Let me put it this way: We would be excited and would like to work with you and your staff and Senator 

Carper to move that forward, to deal with some of the issues we 

have. I think you will find them good points that we both want to 

work through, and we would be happy to do that with you, sir. But 

overall, yes, we do support a bill like that. 

Senator VOINOVICH. So if Senator Carper’s and my staff got in 

touch with you, you would be able to tell us your concerns. 

Mr. GREEN. We would be pleased to do that. Yes, sir. 

Senator VOINOVICH. I was glad to hear from your testimony that 

you are interested in HIT yourself. I mean, it is not like we are 

asking you to do something that is not already being done. 

Mr. GREEN. No, that is true. And our carriers are interested as 

well. They see this as a real opportunity not only to provide for 

their members, but also to differentiate themselves in the marketplace. Our job and Mr. Kolodner job is to see to it that they are 

done interoperably and so that it is portable and also so that they 

are, in fact, secure, private, and the information is confidential and 

under the control of the enrollee. 

Senator VOINOVICH. Our thought is that we could use that as 

kind of a model for the rest of the country. I mentioned that I 

spoke with Aetna, while at the bipartisan health policy conference 

sponsored by the Commonwealth Fund and the Alliance for Health 

records with Aetna’s CEO, who said he thinks implementing personal health records is a great first step, and that they seem to be 

13

interested in moving forward with it. So it would be wonderful if 

we could get the standards in place and get moving. 

Mr. GREEN. Aetna is one of our carriers, of course, a very large 

participant, so that is good to hear. 

Senator VOINOVICH. Thank you, Senator Akaka. 

Chairman AKAKA. Thank you, Senator Voinovich. 

Dr. Kolodner, you testified that the current HIPAA statute provides the flexibility to protect health information while allowing 

best practices to emerge. However, as Mr. Rothstein on our next 

panel notes in his written testimony, some private sector companies are using electronic health record and personal health record 

networks that generally are not subject to any Federal or State regulation because the initiatives are not covered entities under 

HIPAA. 

Does HHS have a list of entities that may have access to personal health information under a health IT network, but are not 

covered by HIPAA? 

Dr. KOLODNER. The HIPAA rules define the entities that are covered by HIPAA. There are other entities that are not covered by 

HIPAA, and he may be referring to some of those entities. 

The Confidentiality, Privacy, and Security Work Group and our 

Consumer Empowerment Work Group, which is another work 

group under the American Health Information Community, both 

have started to consider whether there are entities that should be 

covered under HIPAA that are not now being covered. We will be 

looking at those recommendations as they come forward and see 

whether there is sufficient authority in HIPAA to extend that. So 

we are considering that as part of the deliberations that I mentioned that are underway. 

Chairman AKAKA. Dr. Kolodner, HHS has been without a permanent National Coordinator for Health IT since May 19, 2006. When 

will a permanent National Coordinator be named? 

Dr. KOLODNER. Mr. Chairman, that would be a question that 

Secretary Leavitt would ultimately need to answer. He has asked 

VA to detail me over. VA did that starting in September. VA was 

gracious enough to extend the detail, so I will be here for another 

period of time, and it will be up to Secretary Leavitt to ultimately 

decide. 

Chairman AKAKA. Thank you. 

Mr. Green, you testified that OPM is a member of several work 

groups focused on health IT. Can you share with us some of the 

recommendations that OPM has made to these groups? 

Mr. GREEN. Senator, the work groups operate under a consensusbased decisionmaking process. We contribute to those discussions 

on each recommendation as they come up. 

One of our primary objectives is to ensure consumer rights and 

responsibilities are protected, and we also share our knowledge on 

employer-based health benefits to shape recommendations that are 

achievable and promote the broad goals of the HIT initiative. 

Chairman AKAKA. Thank you. Senator Carper. 

Senator CARPER. Thanks, Mr. Chairman. Who did you succeed in 

your job? 

Dr. KOLODNER. Dr. David Brailer was the first National Coordinator. 

14

Senator CARPER. What is Dr. Brailer doing now? 

Dr. KOLODNER. I believe he is doing some private consulting. He 

is also a Special Government Employee, since he does still co-chair 

the American Health Information Community. 

Senator CARPER. Thanks. If you ever see him, give him my best. 

Thanks. All right. 

Dr. KOLODNER. I will do so. 

Senator CARPER. I understand when I was out of the room in another meeting here in the anteroom that Senator Voinovich asked 

for some reaction from both of you to the legislation we are about 

to reintroduce. And I understand that you pretty well trashed it. 

[Laughter.] 

No. I understand you were pretty generous. Would you just recap 

for me what you had to say and any thoughts you might have for 

making it better? 

Mr. GREEN. Certainly, Senator. I explained that we have reviewed and commented earlier, at least within the Executive 

Branch, on the bill and that since the provisions in the bill are consistent with the direction that the health care industry is going and 

the leadership that HHS is providing, it is also consistent with 

OPM’s direction of where we want to move with our carriers in the 

FEHB program. So we are supportive of the bill and its outline and 

its purpose. There are some issues that we would like to have the 

opportunity to discuss with you and your staff that we think we 

can help improve the bill to fit what goes on within the FEHB program and some other issues, to help deal with privacy concerns as 

well. So we would welcome the opportunity. 

Senator CARPER. We gratefully accept that offer. 

I mentioned earlier in opening statement, that in Delaware we 

are standing up the Delaware Health Information Network, and we 

are doing so with the financial support from the Department that 

Secretary Leavitt leads and from some of the folks that are your 

colleagues, Dr. Kolodner. And the State of Delaware is matching 

that money over the next couple of years, and the private sector in 

our State is stepping up as well. We just learned that Blue Cross/

Blue Shield of Delaware is the latest to step forward and say they 

want to be financially supportive of this, too. So we are very much 

encouraged. 

One of our focuses in standing up the Delaware Health Information Network is to protect patient privacy and patient records. And 

I know that you come out of the VA, don’t you? 

Dr. KOLODNER. Yes, sir. 

Senator CARPER. How long did you work there? 

Dr. KOLODNER. Twenty-eight years. 

Senator CARPER. Twenty-eight years, wow. Did you start as a 

child? [Laughter.] 

But the VA approach on harnessing information technology—just 

talk with us a little bit about what you did there to protect the privacy of patients and their personal or health records. And is there 

maybe a lesson there, a model for the rest of us, whether we are 

doing it at the State level or for Federal employees? 

Dr. KOLODNER. The VA had privacy as a central part of the system from early on, and we actually—because it is a single system 

and not a network. A network obviously presents new opportuniVerDate 0ct 09 2002 09:44 Aug 14, 2007 Jkt 033874 PO 00000 Frm 00018 Fmt 6633 Sfmt 6633 C:\DOCS\33874.TXT SAFFAIRS PsN: PAT
15

ties, new challenges. But as a system, we actually would contract 

to security companies for them to try to break into the electronic 

health record system and find where the vulnerabilities were so 

that we could fix them before any breach had occurred. The VistA 

system, which started out as the Decentralized Hospital Computer 

Program is secure and has not been a source of any breaches. 

We also have a personal health record we provide to veterans, 

starting in December, we actually upload this robust data from. 

Senator CARPER. Starting this past December? 

Dr. KOLODNER. This past December. We had it in test with a few 

thousand veterans before that, but starting this past December, 

veterans can, in fact, have a copy of their clinical record—not just 

any claims data but the clinical data that is in this robust VistA 

system—uploaded to a personal health record if they choose. So it 

is an opt-in strategy. And we have security——

Senator CARPER. It is opt in, not opt out? 

Dr. KOLODNER. It is opt in for the personal health record, yes, 

sir. And we have gotten very positive response from the veterans 

who——

Senator CARPER. Are they opting in? 

Dr. KOLODNER. They are opting in. Hundreds of thousands have 

opted in so far. And as with any new technology, if you remember 

when the Internet started, many of us were a little skeptical. We 

wanted to see what was going on. Did we want to use our credit 

card over the Internet? And gradually what happens is you get the 

early adopters who were willing to take a chance, and the system 

gets more and more robust, more and more trusted, and more people, in fact, come on board. So there is a growth curve that is a 

natural growth curve. It is not that everybody comes on at once. 

But it is one where you get more rapid uptake over time, and we 

are beginning to see that, particularly as you offer services that—

veterans had wanted to be able to refill their prescriptions online, 

and they can do that now. 

Senator CARPER. Great. You may recall in the last Congress the 

Senate passed legislation dealing with health IT, passed a pretty 

good bill. I don’t know that there was anybody who voted against 

it in the Senate. It went over to the House and it died. It died over 

there, and for reasons that are not altogether clear to me. 

What advice would you have for us as we come back and take 

up the legislation? There may be an effort to try to combine what 

Senator Voinovich and I are doing to actually make it part of the 

larger piece of legislation? I don’t know if we will let that happen. 

Maybe we will, maybe we won’t. There could be worse outcomes. 

But why did it die in the House? What might be different this 

time? And as we tinker with that legislation and prepare to pass 

it again in the Senate, what advice would you have for us, either 

of you? 

Dr. KOLODNER. Senator, certainly the reason why it died in the 

House or why the Senate and the House could not get together on 

it is beyond my purview and my expertise, and I would leave that 

to you and your colleagues. 

Senator CARPER. Well, we do not know either. [Laughter.] 

But we will figure it out. 

16

Dr. KOLODNER. I know that there is great interest in the health 

IT bill, and certainly we will work with you and with your colleagues as the various bills go forward to certainly work on something that advances the whole health IT agenda. 

Senator CARPER. Well, I don’t know how familiar you were with 

the legislation that was enacted in the Senate. I am not going to 

dwell on it. But if you have any ideas for the record that you might 

like to suggest to us, either of you, for how to improve that legislation when it comes to the floor, which I think will come fairly soon, 

we would welcome your input. 

Do you all have anything else you want to say with respect to 

any of the questions I have raised here? 

[No response.] 

OK. Thank you. Thanks very much for your good work, particularly at the VA, and as a veteran myself of the Navy, you make 

us very proud, even prouder to be veterans. And for all the veterans around the country, in Delaware and other places, who have 

the opportunity to use what I call the gold standard for health care 

in this country today, thank you for helping to provide that system. 

Chairman AKAKA. Senator Voinovich. 

Senator VOINOVICH. I would like to get back to the bill that Senator Carper and I are going to reintroduce. It is my understanding 

that originally the bill had a 1-year requirement, the bill Senator 

Carper had, and then we had a 2-year requirement, and then we 

talked to OPM and they said we might be moving too quickly. 

It is my understanding that OPM is reluctant to agree to a statutory deadline because the HHS standards have not been published. 

However, Dr. Kolodner, you indicated that you have the team necessary to get the job done. I just want you to know I do not want 

to see publication of the standards delayed. If you do not have the 

people that you need to get the job done, then we ought to know 

about it. I will pick up the phone and call my good friend, former 

Governor Mike Leavitt, and say, ‘‘Mike, you guys have made a commitment. Now put the resources in it so we can get it done.’’ I want 

this taken care of. 

So if you want to respond to that, you may. [Laughter.] 

Dr. KOLODNER. One of the pleasures of being over at HHS has 

been the undying support of Secretary Leavitt for the area of 

health IT. I could not ask for any stronger support from him, and 

that has been one of the things that attracted me to take this interim appointment. 

The office actually was established a little over a year ago, and 

we are just finishing up staffing up to our authorized level. We had 

been filling those activities with contractors. We are now bringing 

on the staff that we need, and we are moving as fast as we believe 

that we can, again, with this iterative process that is necessary to 

make the best policy. 

Senator VOINOVICH. Well, we welcome your input on our legislation. We will be talking to you and Mr. Green about it more. 

Thank you, Senator Akaka. 

Chairman AKAKA. Dr. Kolodner and Mr. Green, thank you very 

much for your valuable testimony. I look forward to working with 

each of you to ensure that privacy and security are integral parts 

of the health IT architecture. Thank you very much. 

17

1The prepared statement of Mr. Powner and Ms. Koontz with attachments appears in the Appendix on page 52. 

Dr. KOLODNER. Thank you, sir. 

Mr. GREEN. Thank you. 

Chairman AKAKA. And now I ask our second panel of witnesses 

to come forward. Testifying on our second panel are David Powner, 

Director of IT Management Issues, and Linda Koontz, Director of 

Information Management Issues, from the Government Accountability Office; also Mark Rothstein, Director of the Institute for Bioethics, Health Policy, and Law at the University of Louisville 

School of Medicine, as well as the Chair of the Subcommittee on 

Privacy and Confidentiality of the National Committee on Vital 

and Health Statistics; and Dr. Carol Diamond, Managing Director 

of the Markle Foundation. 

As you know, it is the custom of the Subcommittee to swear in 

all witnesses, so please stand and raise your right hand. Do you 

swear that the testimony you are about to give before this Subcommittee is the truth, the whole truth, and nothing but the truth, 

so help you, God? 

Mr. POWNER. I do. 

Ms. KOONTZ. I do. 

Mr. ROTHSTEIN. I do. 

Dr. DIAMOND. I do. 

Chairman AKAKA. Thank you. Mr. Powner, please proceed with 

your statement. 

TESTIMONY OF DAVID A. POWNER,1 DIRECTOR OF INFORMATION TECHNOLOGY MANAGEMENT ISSUES, ACCOMPANIED 

BY LINDA KOONTZ, DIRECTOR OF INFORMATION MANAGEMENT ISSUES, GOVERNMENT ACCOUNTABILITY OFFICE 

Mr. POWNER. Chairman Akaka, Ranking Member Voinovich, we 

appreciate the opportunity to testify on privacy initiatives associated with our Nation’s efforts to increase the use of health information technology. With me today is Linda Koontz, GAO’s Director of 

Information Management Issues and privacy expert. 

In 2004, President Bush issued an Executive Order that called 

for widespread adoption of electronic health records by 2014 and 

established a National Coordinator for Health IT to lead and to foster public-private coordination. Over the past several years, we 

have issued several reports and testified on numerous occasions, 

highlighting the need for detailed plans, milestones, and mechanisms to monitor progress if this 10-year goal is to be achieved. 

The benefits of health IT are immense and include reducing medical errors. However, it also raises concerns regarding the extent to 

which patient privacy is protected. The challenge here is to strike 

the right balance between patient privacy concerns and the numerous benefits IT has to offer this industry. 

This afternoon, as requested, I will summarize our report completed at your request, Mr. Chairman, on HHS’s health IT privacy 

initiatives. Specifically, I would like to highlight three points: First, 

the importance of having a comprehensive privacy approach; second, HHS’s initial efforts to address privacy; and, third, additional 

actions needed. 

18

Privacy is a major concern in the health care industry given the 

sensitivity of certain medical information and the complexity of the 

health care delivery system with its numerous players and extensive information exchange requirements. This concern increases as 

our Nation transitions to using more electronic health records. A 

comprehensive privacy approach is needed so that ultimately it is 

clear who these records are disclosed to, what limitations are 

placed on the use of the information, how patients can access their 

records, how inaccurate or incomplete information is corrected, and 

what administrative, physical, and technical safeguards are needed 

to protect electronic health information. 

HHS acknowledges in its National Health IT Framework the 

need to protect consumer privacy and plans to develop and implement appropriate privacy and security policies, practices, and 

standards for electronic health information exchange. HHS and its 

Office of the National Coordinator have initiated several efforts to 

address privacy. These include: Awarding several contracts that includes one for privacy and security solutions; consulting with the 

National Committee on Vital and Health Statistics to develop privacy recommendations; and forming a Confidentiality, Privacy, and 

Security Work Group to identify and address privacy and security 

policy issues. 

These efforts are good building blocks, but much work remains, 

including: Assessing how variations in State laws affect health information exchange; reporting and acting on the privacy and security contractors’ findings; acting on advisory group recommendations; and identifying and implementing privacy and security 

standards. 

The National Coordinator’s Office intends to use the results of 

these activities to identify policy and technical solutions for protecting personal health information as part of its continuing effort 

to complete a national health IT strategy. Ultimately, these and 

other efforts are to result in a comprehensive security and privacy 

policies, practices, and standards. However, how HHS plans to integrate the outcomes of its initiatives and when is unclear. 

Therefore, we recommended, Mr. Chairman, that HHS develop 

an overall privacy approach or a game plan that identifies milestones and an accountable entity for integrating the outcomes of its 

health IT contracts and recommendations from advisory groups. In 

addition, this approach should ensure that key privacy principles 

highlighted in our written statement are fully addressed. And, finally, this approach should address key challenges associated with 

legal and policy issues, disclosure of information, individual rights 

to access, and security measures. 

In summary, Mr. Chairman, while progress continues to be made 

through the National Coordinator’s private initiatives, a comprehensive approach is needed to integrate the results of the initiatives to ensure that key privacy principles are addressed and to ensure that recommendations from the advisory committees are effectively implemented. Otherwise, HHS will not be providing the leadership called for by the President and its goal of safeguarding personal health information will be in jeopardy. 

This concludes our statement. We would be pleased to answer 

questions. 

19

1The prepared statement of Mr. Rothstein appears in the Appendix on page 130. 

Chairman AKAKA. Thank you very much, Mr. Powner. Mr. 

Rothstein. 

TESTIMONY OF MARK A. ROTHSTEIN,1 HERBERT F. BOEHL 

CHAIR OF LAW AND MEDICINE, AND DIRECTOR, INSTITUTE 

FOR BIOETHICS, HEALTH POLICY AND LAW, UNIVERSITY OF 

LOUISVILLE SCHOOL OF MEDICINE 

Mr. ROTHSTEIN. Yes, thank you very much, Mr. Chairman and 

Senator Voinovich. I appreciate the opportunity to be with you this 

afternoon. I want to clarify for the record that I am appearing in 

my individual capacity and not as a representative of NCVHS, 

which may want to deny any responsibility for my statements, 

written or oral. 

I want to make two points this afternoon. First, in my view, HHS 

has not made meaningful progress in developing and implementing 

measures to protect the privacy of health information in electronic 

health networks. And the second point is that time is of the essence. I believe HHS must begin to act immediately on these very 

difficult privacy issues and also that Congress needs to hold HHS 

accountable and make them meet the milestones that have been 

suggested by GAO or some of the other measures that I want to 

suggest to you this afternoon in my testimony. 

I specifically agree with the comments in the GAO report. I believe that they accurately captured the sense and the progress, or 

lack of progress, on the privacy issues. But I would add my own 

assessment that I believe that the focus on privacy is currently lagging behind the focus at HHS on technical development of the infrastructure of the NHIN. And I am concerned that the gap between the technical progress and privacy is actually widening, and 

that is not a luxury that we have, for reasons that I want to pursue 

in just a minute. 

In 2004, the head of ONC at that time, Dr. Brailer, asked 

NCVHS to do a comprehensive study on privacy and confidentiality 

issues in the Nationwide Health Information Network. And it took 

us 18 months of hearings throughout the country, dozens of witnesses, and lots of rather heated deliberation to reach our recommendations, which were delivered to the Secretary in June 

2006. And just to emphasize the nature of these fundamental questions that have to be resolved, I want to go through a couple of 

them with you, if I may. 

First, NCVHS noted that a decision has to be made on whether 

individuals have a right to decide whether they want to be a part 

of this nationwide system, and if so, should that be opt in or opt 

out or some combination, should it be controlled locally or via some 

other method. So that is a fundamental question. 

Another fundamental question is whether individuals should 

have some control over the contents of their health records that 

would be disclosed via the NHIN. When you put together comprehensive, longitudinal, individual health records, they are likely 

to contain lots of old data. Some of it may be very sensitive. Some 

of it may be irrelevant to current care. These records are not usually available now because of the fragmentation of the system. You 

20

1The prepared statement of Dr. Diamond appears in the Appendix on page 138. 

cannot get it from all these places. Electronically, it will be easy 

to obtain this information, and I am concerned that under an electronic system we should not have less privacy than we do today. 

So that is a concern of mine. 

I am also concerned about the scope of the disclosures when people have to sign an authorization to get a job or life insurance. 

About 25 million of these are signed each year in the United 

States, and when the records are released, typically the entire file 

is sent. And this may include all this sensitive information. 

NCVHS submitted 26 recommendations to the Secretary, and I 

don’t think that very much progress, if any, has been made on any 

of these areas that we identified. And I believe that time is of the 

essence, as I emphasized in my written testimony. Private sector 

groups are working today—while we are still talking about these 

issues officially in terms of regulation, the private sector is marching ahead. Last month, we heard at our hearings from Wal-Mart 

about this huge personal health record system that it is putting together, with over 2.5 million employees represented, and this is a 

single company, in collaboration with other employers. They are 

not health plans. They are not covered entities under HIPAA. 

There is no regulation in place. 

So not only do I support the GAO recommendations, I think we 

need to be thinking beyond HIPAA. HIPAA is an archaic statute 

that was designed for totally different purposes. It was designed for 

the payment system. We now have a more comprehensive nationwide network involved, and I think we have to be thinking more 

comprehensively. And I believe that there are lots of things that 

need to be done, and I would recommend that the Subcommittee 

work with HHS and try to move the ball forward more rapidly on 

these very important issues. 

So I thank you for the opportunity to testify today and I look forward to your questions. 

Chairman AKAKA. Thank you very much. Dr. Diamond. 

TESTIMONY OF CAROL C. DIAMOND, M.D.,1 MANAGING DIRECTOR, MARKLE FOUNDATION, AND CHAIR, CONNECTING FOR 

HEALTH 

Dr. DIAMOND. Thank you, Chairman Akaka, Senator Voinovich. 

It is a privilege to be invited to testify today. I am the Managing 

Director at the Markle Foundation, and in that capacity I also 

serve as Chair of a large public-private collaborative called Connecting for Health. Our goal at Connecting for Health is to make 

sure that vital information is available both for patients and their 

providers when it is needed and where it is needed in a way that 

protects privacy and earns the trust of the American people. 

As you heard today, numerous efforts are underway to promote 

the use of health information technology within HHS, other parts 

of government, and the private sector. Yet as the GAO report and 

Mr. Rothstein have stated, there has not yet been enough progress 

in establishing a policy framework that will earn the long-term 

public trust required to sustain and build upon current activities. 

21

Toward that end, I have two important recommendations to 

make. First, the Nation needs a well-defined, comprehensive privacy framework based on key policy and technology attributes that 

I will lay out. Second, while the entities and contracts created by 

HHS have been useful to initiate action in this field, we now need 

to find the appropriate longer-term process for determining both 

the policies and the technologies that will achieve the attributes of 

such a framework. Our national strategy for health information 

technology must be carried out by decisionmakers informed by and 

accountable to a broad range of interests with direct public accountability. 

Let me first talk about the required framework for health IT. 

Our group took 3 years to develop this framework, and the framework includes the attributes that are necessary to protect privacy 

and security. Efforts to gather and share information should 

achieve these attributes: 

First, information sharing at the national level should be done in 

a decentralized and distributed way. Simply put, health information sharing should not require the development of large centralized repositories of personal health information. Clinical data 

should be left in the hands of patients and those who have a direct 

relationship with them in their care, and leave decisions about who 

should or should not see that data with patients and providers directly involved with their care. 

Second, sharing should separate demographic and clinical information. Sharing should be accomplished with an index that does 

not contain clinical data but, rather, knows where relevant information resides. Only those with proper authorization are then allowed to access the information, and this does not require the use 

of a national identifier. 

Third, the framework should be a flexible platform for innovation. Participation in the network by a broad range of providers delivering products and services will be a result of using open standards and transparent policies. This will encourage innovation so 

that we can make critical rapid progress. 

Fourth, the framework should implement privacy through technology. This is a key attribute. Technology choices should be made 

so that they can enable the effective implementation of policies protecting privacy. These technologies should create audit trails, implement security, improve data accuracy, prevent both intentional 

and unintentional improper disclosure of information. They should 

build rules and permissions into the process of accessing and distributing data. 

Our fifth attribute is really a set of nine foundational privacy 

principles. These have been adopted from fair information practices 

and other sources internationally. These principles include things 

like transparency, specifying the purpose of data being collected, 

collecting only what is necessary, adhering to the uses agreed to by 

the individual, allowing the individuals to know and have a say in 

how their information is used, maintaining the integrity of data, 

audit, oversight, and remedies in the event of breach or misuse. 

Every health information initiative should be expected to disclose 

how it addresses each of these principles. 

22

In summary, HHS deserves praise for its success in elevating 

public and industry interest in health information exchange and for 

encouraging the adoption of technical standards. But focusing only 

on technical standards is like building an interstate highway system, without the rules for entering, exiting, or anticipating the 

speed limits that need to be accommodated. In order to serve the 

communities through which it passes, a highway must have a coherent set of rules, made obvious through signage and visibly enforced, and be embedded in the design of the highway itself. And 

for the users of health information, patients and their providers, an 

explicit policy framework is essential. 

Several years of public opinion surveys show that Americans 

have significant privacy concerns when it comes to their health information. Without a policy framework with the attributes we propose, our Nation runs the risk of inappropriate uses of personal information followed by public clamor for hasty remedies, which will 

undermine the sustainability of an information sharing network. 

And these policies that touch the most private concerns of every 

American require a clear framework for privacy and an accountable 

visible process that can encourage public interest, that will be 

maintained over time, and that will give consumers confidence that 

their interests are being looked after. 

Mr. Chairman, the lack of trust in health information technology 

may not only impede progress but, more profoundly, it may squander this amazing window we have to stimulate a much needed 

transformation of our overburdened health care system. 

Thank you for the opportunity to testify. 

Chairman AKAKA. Thank you very much for your statements. 

I just talked to my friend, Senator Voinovich, and I am going to 

let him proceed first. 

Senator VOINOVICH. Thank you very much, Senator Akaka. 

First of all, you heard the testimony of Dr. Kolodner. You were 

here for his testimony, and I asked him whether or not he had the 

staff to get the job done. In your opinion, does he have the staff 

to get the job done? 

Mr. POWNER. We specifically have not looked at whether he has 

the human capital and all the resources to get the job done. Our 

big concern, Ranking Member Voinovich, is that we do not see a 

road map to get from where we are at today to have a comprehensive privacy policy in place. 

Dr. Kolodner made some comments about sound project management. Sound project management is about having milestones and 

targets, and we go after those milestones and set interim performance measures to gauge whether we are making enough progress 

or not. That is what we do not see, sir. 

Senator VOINOVICH. OK. So you are saying plan, milestones and, 

in addition, metrics to judge if milestones are being met? 

Mr. POWNER. Absolutely, and some of our other witnesses mentioned some of the key privacy principles that clearly need to be addressed as part of that approach. 

Senator VOINOVICH. Right. Senator Akaka, it might be good—if 

you recall, what we have been able to do with the GAO High-Risk 

agencies. OMB and GAO have sat down together to develop a straVerDate 0ct 09 2002 09:44 Aug 14, 2007 Jkt 033874 PO 00000 Frm 00026 Fmt 6633 Sfmt 6633 C:\DOCS\33874.TXT SAFFAIRS PsN: PAT
23

tegic plan on addressing these problems. They are making 

progress. It seems that process may have value here. 

The last question is for Mr. Rothstein. You said they are lagging 

behind the technical structure of developing IT. So what you are 

seeing is fast development without building privacy in at the beginning? 

Mr. ROTHSTEIN. Yes, Senator, and there are significant concerns 

that, unless privacy is built into the architecture of the system, we 

will not be able to come back and do it later. And that is why privacy protections have to be in from the start, and the longer it 

takes us to develop policies on what our privacy and confidentiality 

and security rules are, the more danger we have that it is going 

to be too late or it is going to be prohibitively expensive to go back 

and try to add the privacy protections. 

Senator VOINOVICH. Just another comment, Senator Akaka. It is 

nice that OPM may be saying they cannot do it because they are 

waiting to incorporate the privacy standards into the system. 

Thank you very much. I appreciate the chance to ask these questions. 

Chairman AKAKA. Thank you very much, Senator Voinovich. 

Mr. Powner, you recommended in your testimony that HHS define a comprehensive privacy approach that includes detailed plans 

and milestones for integrating its various initiatives. GAO specifically mentioned the need to sequence the implementation of key activities appropriately. Would you explain that comment? Tell us 

why this is important. And what else is missing from HHS’s current approach? 

Mr. POWNER. Similar to Mr. Rothstein’s comment, the sequencing 

is very important because his comment about building in privacy 

and security early, we see many examples throughout the Federal 

Government, Mr. Chairman, where we built in security or privacy 

after the fact, after systems and networks are built; and, one, it is 

very difficult to implement and, two, it is much more costly to do 

it after the fact. So it is very important that we sequence these activities. We are talking about prototypes right now for the National 

Health Information Network, and to Mr. Rothstein’s point, what is 

happening is the technology is getting ahead of the policy, and we 

need to make sure that we get the policies in place so that we can 

actually make those appropriate technology decisions and build it 

in up front. 

Chairman AKAKA. Dr. Diamond, I agree with your statement 

that public trust cannot be fully accomplished by relying only on 

existing legal provisions such as HIPAA. However, Mr. Green testified that OPM is pushing health IT through the FEHBP and is 

only requiring carriers to follow Federal privacy requirements. 

Do you believe OPM can earn the trust of Federal employees 

when carriers are increasingly using health IT? 

Dr. DIAMOND. Chairman, I would say two things. I think it is a 

very good thing for the Federal Government to help its employees 

find ways to see and access their own health information. But I 

would say that in the same way that the government can stimulate 

the use of information technology and stimulate the expectation 

that people can have their own information, it can also stimulate 

the adherence to a basic framework of privacy based on the atVerDate 0ct 09 2002 09:44 Aug 14, 2007 Jkt 033874 PO 00000 Frm 00027 Fmt 6633 Sfmt 6633 C:\DOCS\33874.TXT SAFFAIRS PsN: PAT
24

tributes that I articulated today. As long as those both policy and 

technology things are clear to the user, that there is transparency, 

that people know how their information is used, then we can earn 

the trust. 

So I would say there is an opportunity to both stimulate people 

being more engaged in their health care by having personal health 

records and also to use the role of the Federal Government to make 

sure the attributes are built into every initiative that is put out 

there using information technology. 

Chairman AKAKA. Mr. Rothstein, the privacy and security requirements of HIPAA and other laws do not cover all entities that 

exchange electronic personal health information. What can HHS do 

to ensure that gaps in legal privacy protection of health information are addressed by a privacy framework for the nationwide 

health information exchange? 

Mr. ROTHSTEIN. Mr. Chairman, one of the specific recommendations in my written testimony is that I believe that HHS should 

undertake a study to determine the number of health care providers that are, in fact, not covered entities under HIPAA at the 

moment. We have been doing that in my subcommittee—that is, 

the Subcommittee on Privacy and Confidentiality—and we are 

frankly astonished at the number of health care providers that are 

not covered entities. 

Unless you are engaged in an electronic billing transaction, you 

are not a covered entity. So all of the urgent-care, cash-paid doctors, many cosmetic surgeons that are not covered by any insurance plan, all sorts of other health care providers that are not covered—massage therapists, acupuncturists, and so forth—may not 

be covered entities under HIPAA. We don’t know how many there 

are, and it seems that it is going to be Congress’ role to enact new 

legislation or to amend the HIPAA statute to bring in all these 

other health care providers. But I think it would be very helpful 

to the Congress if we had a sense of how many there are that need 

to be covered. 

Chairman AKAKA. Dr. Diamond. 

Dr. DIAMOND. Yes, Chairman. As was stated previously by other 

witnesses, HIPAA was written at a time where we did not contemplate a Nationwide Health Information Network, nor did we 

contemplate the number of entities and parties today who are part 

of the use and sharing of health information. 

I do think, as I stated in my testimony, the two comprehensive 

things to do would be to require a policy framework based on key 

attributes and to establish a public process to build in and make 

sure that each information technology initiative that is proposed 

lives up to those attributes. 

Chairman AKAKA. Thank you. 

Dr. Diamond and Mr. Rothstein, based on the work of HHS to 

date to promote health IT, are there any legislative changes that 

we in Congress should consider making to ensure that the privacy 

of health information is protected? 

Mr. ROTHSTEIN. Senator, I believe there are two areas in which 

congressional action would be indicated. First, is to extend the coverage of health privacy legislation; in other words, to expand the 

number of covered entities that are currently covered under HIPAA 

25

or under some other replacement law. The second is of a more substantive nature, and that would be to try to limit the amount of 

information that third parties can require individuals to provide as 

a condition of getting a job or a life insurance policy or some other 

commercial transaction. At the moment, it is lawful to require that 

individuals sign basically an unlimited release and then all this information and, increasingly, more comprehensive information will 

be disclosed electronically to people who do not have a legitimate 

interest in this extra information. An employer or insurer may 

have a legitimate interest in knowing your current health status, 

but maybe not things that happened 20 or 30 years ago that would 

be of a very sensitive nature. And I think restricting those kinds 

of information requests would be very helpful. 

An example would be under the Americans with Disabilities Act, 

the Federal statute dealing with disability discrimination says that 

if you are a current employee, the employer can only ask about jobrelated health information. But if you are an individual who has 

a job offer but have not started yet, then they can have an unlimited request for information. If you applied that same standard 

that is applicable to current employees to these applicants, then 

the amount of information would be reduced substantially. 

Chairman AKAKA. Dr. Diamond. 

Dr. DIAMOND. I think there is an opportunity right now to consider what the right process is for this next level of public input 

and discussion that is required around privacy and security. And 

I think what I propose in my written testimony is what I will repeat here. Based on a set of foundational principles, there does 

need to be a process that will have appropriate public input, notice 

and comment, and deliberation so that we can move forward in a 

way that people feel trust in the health information network and 

the way their information is being shared. And I do think reverting 

to the policies and the attributes that I laid out today serve as a 

good yardstick or metric for trying to determine how to move forward. 

Chairman AKAKA. Thank you. This question is to all of the panelists. You all heard the testimony of OPM that Federal employees’ 

electronic health information is protected, despite the fact that 

HHS’s efforts on privacy and security are lagging behind. Do you 

agree with OPM? Mr. Powner. 

Mr. POWNER. Sir, I do not believe we are in a position to comment on OPM’s efforts in that area. We have not looked at it in 

any detail at all. 

Chairman AKAKA. Thank you. Mr. Rothstein. 

Mr. ROTHSTEIN. I would only note that the companies that offer 

insurance to Federal Government employees are covered entities 

under HIPAA because they are health plans. Therefore, they are 

regulated in the way that other covered entities are. But individual 

employees are not protected in the sense that for all of this information that is suddenly going to be aggregated and available electronically at a single point in time, we do not have new rules that 

apply to the network. What we are applying to government employees are the old rules under HIPAA. 

Chairman AKAKA. Dr. Diamond. 

26

Dr. DIAMOND. Yes, I am not familiar with OPM’s efforts. I will 

just offer that under the existing HIPAA rule, there have been 

22,000 complaints to OCR, and very few have actually resulted in 

penalties. And I think there is an opportunity to look at not only 

these new attributes that I laid out here and the principles as a 

way to ask ourselves if we are doing enough, but also to look at 

appropriate remedies in the event of breaches, because we are in 

an information world today. This is the Information Age, and I 

think every one of us, while we enjoy the benefits of it, also have 

to acknowledge that we need to think about the protections that 

need to be in place to participate fully. 

Chairman AKAKA. Mr. Powner, what do organizations that store 

and exchange personal information consider when balancing the 

benefits realized from IT with the risks introduced by storing large 

amounts of personal data in electronic format? 

Ms. KOONTZ. I will answer that, if I may. We found, in terms of 

the research that we have done on privacy, that best practices organizations do a number of things. First of all, they get continuous 

and early input from stakeholders, from experts, and from the public in some form. And I emphasize the word ‘‘continuously’’ because 

as these kinds of initiatives are worked on, they tend to evolve and 

change, and there needs to be a constant going back to the privacy 

principles to touch them to make sure that we are consistent with 

the framework that we have selected. 

I think successful organizations also use fair information principles. I agree with many of the other witnesses on the panel today 

that HHS needs to take a broad look at privacy, and it is useful 

to look at the fair information practices which are broad, very 

internationally accepted principles as a way of facilitating discussion on the balance that should be struck between privacy and 

other interests. 

I think best practices organizations assess privacy protections, as 

many of the other panelists have said, before information technology is acquired or developed. Technology can be an enabler to 

help build in privacy protections, but once a system is built, it is 

very difficult and often very expensive to go back and retrofit those 

kinds of protections. 

To the extent that HHS uses these kinds of best practices, I 

think it increases their chance of success in this. 

Chairman AKAKA. Thank you, Ms. Koontz. 

Mr. Powner, HHS has been without a permanent National Coordinator for Health IT for almost a year. What effect has the absence of a national coordinator had on HHS’s progress toward defining a privacy framework as part of its national strategy for 

health IT? 

Mr. POWNER. First of all, I think we need to give some credit to 

Dr. Brailer for getting the ball rolling here, and Dr. Kolodner has 

kept it rolling. But longer term, when you look at whether we need 

a permanent national health IT coordinator, we believe we do, for 

a couple of reasons. There are going to be some tough decisions. 

What we discussed here today, tough privacy decisions from a policy perspective are going to have to be made. Having a permanent 

leader would be very important for that. 

27

Also, too, because of the collaboration that needs to occur with 

the private sector, having a permanent leader sends a message 

that this is a presidential priority. Having an interim leader does 

not. 

Chairman AKAKA. Thank you very much. 

Mr. Rothstein and Dr. Diamond, in June 2006, the National 

Committee on Vital and Health Statistics sent a letter to HHS Secretary Leavitt with 26 recommendations on privacy and confidentiality in the Nationwide Health Information Network. Meanwhile, 

the Markle Foundation is working with various stakeholders, including government, industry, and health care experts, to address 

the challenges of creating a Nationwide Health Information Network. 

What has been the response from HHS on your initiatives? 

Mr. ROTHSTEIN. Mr. Chairman, in terms of the NCVHS, we received in the fall a letter from the Secretary acknowledging receipt 

of our report, but that has been the extent of our official response 

from the Department. 

Chairman AKAKA. Dr. Diamond. 

Dr. DIAMOND. Mr. Chairman, we have been involved in many of 

the discussions within the work groups of the AHIC and also within the NHIN contract, and I think the groundwork that we did in 

laying out the framework for sharing information with privacy has 

been very instrumental in those discussions. 

However, we have not yet had the opportunity to see those privacy principles or the comprehensive framework that I discussed 

today make its way into the current initiatives on the NHIN. And 

to echo what some of the other witnesses have said, we worry that 

the technology efforts and the standards efforts are moving too far 

ahead of some of those privacy principles and privacy requirements 

that the technology should fulfill, that we should not be trying to 

correct later on. 

We know firsthand from doing our own prototype the year prior 

in three communities—in Indianapolis, Boston, and Mendocino 

County, California—that it is possible to connect disparate communities with different technologies using privacy and security. But 

those decisions about privacy and security changed the way technology was implemented. They drove decisions in the way that 

technology was implemented that we would like to see inform the 

process going forward. 

Chairman AKAKA. Well, I want to thank you, Mr. Powner, Mr. 

Rothstein, and Dr. Diamond, for your testimonies and also Ms. 

Koontz, for your responses as well. And I want you to know that 

you have provided this Subcommittee with valuable information, 

and we appreciate all that you have done to ensure that Americans’ 

health information is protected. 

Today’s hearing underscored the need for HHS to integrate privacy into the nationwide health IT infrastructure. We heard repeatedly that individuals must have trust and confidence in the 

system to encourage them to share their personal health information. If we want health IT programs to succeed, we must have privacy and security protections in place at the beginning. I look forward to working with HHS, OPM, and the various stakeholder 

groups to make this happen. 

28

As there is no further business, the hearing record will be open 

for one week for additional statements or questions from Members 

of the Subcommittee. 

The hearing is now adjourned. 

[Whereupon, at 4:17 p.m., the Subcommittee was adjourned.] 

(29)

A P P E N D I X 


33874.001
30


33874.002
31


33874.003
32


33874.004
33


33874.005
34


33874.006
35


33874.007
36


33874.008
37


33874.009
38


33874.010
39


33874.011
40


33874.012
41


33874.013
42


33874.014
43


33874.015
44


33874.016
45


33874.017
46


33874.018
47


33874.019
48


33874.020
49


33874.021
50


33874.022
51


33874.023
52


33874.024
53


33874.025
54


33874.026
55


33874.027
56


33874.028
57


33874.029
58


33874.030
59


33874.031
60


33874.032
61


33874.033
62


33874.034
63


33874.035
64


33874.036
65


33874.037
66


33874.038
67


33874.039
68


33874.040
69


33874.041
70


33874.042
71


33874.043
72


33874.044
73


33874.045
74


33874.046
75


33874.047
76


33874.048
77


33874.049
78


33874.050
79


33874.051
80


33874.052
81


33874.053
82


33874.054
83


33874.055
84


33874.056
85


33874.057
86


33874.058
87


33874.059
88


33874.060
89


33874.061
90


33874.062
91


33874.063
92


33874.064
93


33874.065
94


33874.066
95


33874.067
96


33874.068
97


33874.069
98


33874.070
99


33874.071
100


33874.072
101


33874.073
102


33874.074
103


33874.075
104


33874.076
105


33874.077
106


33874.078
107


33874.079
108


33874.080
109


33874.081
110


33874.082
111


33874.083
112


33874.084
113


33874.085
114


33874.086
115


33874.087
116


33874.088
117


33874.089
118


33874.090
119


33874.091
120


33874.092
121


33874.093
122


33874.094
123


33874.095
124


33874.096
125


33874.097
126


33874.098
127


33874.099
128


33874.100
129


33874.101
130


33874.102
131


33874.103
132


33874.104
133


33874.105
134


33874.106
135


33874.107
136


33874.108
137


33874.109
138


33874.110
139


33874.111
140


33874.112
141


33874.113
142


33874.114
143


33874.115
144


33874.116
145


33874.117
146


33874.118
147


33874.119
148


33874.120
149


33874.121
150


33874.122
151


33874.123
152


33874.124
153


33874.125
154


33874.126
155


33874.127
156


33874.128
157


33874.129
158


33874.130
159


33874.131
160


33874.132
161


33874.133
162


33874.134
163


33874.135
164


33874.136
165


33874.137
166


33874.138
167


33874.139
168


33874.140
169


33874.141
170


33874.142
171


33874.143
172


33874.144
173


33874.145
174


33874.146
175


33874.147
176


33874.148
177


33874.149
178


33874.150
179


33874.151
180


33874.152
181


33874.153
182


33874.154
183


33874.155
184


33874.156
185


33874.157
186


33874.158
187


33874.159
188


33874.160
189

Æ


33874.161