From: Charles Stellar <cstellar@wedi.org>

Sent: Thursday, October 24, 2019 5:06 PM

To: privacyframework <privacyframework@nist.gov>

Subject: NIST Privacy Framework Comments

Charles Stellar

WEDI, President & CEO

WEDI

202-329-9700

4401A Connecticut Ave, NW

Suite 205

Washington, DC 20008

http://www.wedi.org
October 24, 2019

Submitted Via Electronic Mail to:

privacyframework@nist.gov

Katie MacFarland

National Institute of Standards and Technology

100 Bureau Drive

Stop 200

Gaithersburg, MD 20899

RE: NIST Privacy Framework: Preliminary Draft Comments

Dear Ms. MacFarland:

I am writing on behalf of the Workgroup for Electronic Data Interchange (WEDI), the 

nation’s leading nonprofit authority on the use of information technology to create 

efficiencies in health care information exchange. We appreciate the opportunity to 

respond to the National Institute of Standards and Technology (NIST) proposed Privacy 

Framework as published in the Federal Register on September 9, 2019.

About WEDI

WEDI was formed in 1991 by then-Secretary of HHS Dr. Louis Sullivan. Named in the 

bipartisan Kassebaum-Kennedy HIPAA legislation as an advisor to the HHS Secretary, 

we have worked closely with every Administration since our founding. WEDI is a multistakeholder organization whose membership includes ambulatory providers, hospitals, 

health systems, health plans, health information technology standards organizations, 

health care information technology vendors and government entities. We actively work

with both the public and private sectors advocating to reduce health care administrative 

costs and facilitate improvements in information exchange through voluntary 

collaboration. 

WEDI has been an instrumental in establishing, and later enhancing, HIPAA standards 

for electronic administrative transactions, data privacy and data security. WEDI has also 
helped identify opportunities to drive down the costs associated with manual, paperbased transactions and increasing the confidentiality of patient information through the 

use of technology. Our robust workgroups, white papers, informative conferences, 

surveys and online webinars provide critical industry education and foster collaborative 

partnerships among diverse organizations to solve the challenges of real-world data 

exchange.

We have also worked closely with both the Centers for Medicare & Medicaid Services 

and the Office for Civil Rights on industry outreach and education.

General Comments

WEDI is committed to protecting the privacy and security of consumer health 

information as mandated in the HIPAA regulations for covered entities. For the past 20 

years, the HIPAA Privacy and Security Rules have engendered public trust and have 

been effective in protecting identifiable health information. Overall, the preliminary draft 

Framework provides a good set of guiding principles and structural elements to help 

entities build a solid privacy foundation. We believe the Privacy Framework will help 

improve privacy practices across all healthcare sectors, particularly those entities that 

do not have baseline privacy practices. We also believe the payers, providers and 

vendors that we represent are an example of successful practices for protecting 

information privacy and security.

We believe it is important to continue the emphasis on care coordination that aligns with 

the continued practice of protecting consumer health information. As NIST further 

develops their framework, we encourage collaboration with industry stakeholders such 

as WEDI and support the agency’s approach of developing the Framework in 

collaboration with public and private stakeholders. As an advisor to the Secretary of the 

Department of Health and Human Services (HHS) and a multi-stakeholder organization, 

WEDI offers the structure for intra-industry collaboration. WEDI has proven leadership 

engaging the industry to address the most impactful changes of our time, including the 

National Provider Identifier, ICD-10, health claim attachments and prior authorization. 

The NIST Privacy Framework must be voluntary for HIPAA-covered and similarly 

situated entities. Health entities are currently governed by both federal laws and 

regulations and a multitude of state legal requirements and as such, we endorse the 

Privacy Framework as a voluntary tool that can further assist entities with identifying, 

assessing, managing, and communicating privacy risks to foster the further 

development of to protecting an individual’s privacy.

We believe that health entities need the flexibility to utilize the NIST Privacy Framework 

to complement their already robust privacy and security programs and processes with 

the understanding that refinements and improvements should always be made to keep 

pace with industry best practices and to avert developing threats to privacy. The Privacy 

Framework should not be used as a new layer of mandated and duplicate requirements 

for the healthcare sector.
Current practice allows non-HIPAA covered entities, such as some private entities and 

public organizations, to access, use, transmit or disclose health information without 

having to comply with federal or state privacy laws. NIST and other agencies could be 

helpful in identifying gaps for protecting consumer health data, and to work with the 

Administration and Congress to help promote better privacy protections of consumer 

health information by these non-HIPAA entities.

WEDI appreciates the opportunity to collaborate with NIST and stand ready to assist as 

needed. Charles Stellar, President and CEO of WEDI, or I would be pleased to answer 

any questions pertaining to WEDI’s recommendations, which are enclosed herein.

Sincerely,

/s/

Jay Eisenstock

Chair, WEDI 

cc: WEDI Board of Directors