From: Lori P Potter <Lori.Potter@kp.org>

Sent: Tuesday, October 22, 2019 1:18 PM

To: privacyframework <privacyframework@nist.gov>

Cc: Jamie Ferguson <Jamie.Ferguson@kp.org>; Walter G. Suarez <Walter.G.Suarez@kp.org>; Anne D 

Mcnealis <Anne.D.McNealis@kp.org>

Subject: Kaiser Permanente comments on the Privacy Framework Preliminary Draft

Kaiser Permanente appreciates the opportunity to offer feedback on the NIST Privacy Framework 

preliminary draft. Our comment letter is attached.

Regards,

Lori Potter

Lori Potter

Senior Counsel

Government Relations

One Kaiser Plaza

Oakland, CA 94612

510-271-6621; tie-line 8-423-6621

510-3015644 (cell)

lori.potter@kp.org
 

 

 

 

 

 

Kaiser Foundation Health Plan 

Program Offices 

October 24, 2019 

National Institute of Standards and Technology (NIST) 

Attention: Katie MacFarland 

100 Bureau Drive, Stop 2000 

Gaithersburg, MD 20899 

Submitted electronically to: privacyframework@nist.gov 

RE: NIST Privacy Framework: Preliminary Draft 

Dear Ms. MacFarland: 

Kaiser Permanente appreciates the opportunity to offer the following comments on the NIST 

Privacy Framework preliminary draft (Framework) published in the Federal Register on 

September 9, 2019.1

The Kaiser Permanente Medical Care Program is the largest private integrated healthcare 

delivery system in the U.S., with 12.3 million members in eight states and the District of

Columbia.2 As part of its mission, Kaiser Permanente has implemented a secure Electronic 

Health Record (EHR) system, KP HealthConnect® to support the delivery of healthcare services 

to our members and to enhance communications among providers. 

NIST solicits feedback on the draft Framework, before issuing an updated version of the NIST 

Privacy Framework: A Tool for Improving Privacy through Enterprise Risk Management. This 

draft is aligned, both structurally and conceptually, with the previously published NIST 

Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework), 

April 16, 2018). 

General Comments

As an integrated care delivery system with provider and health plan organizations, Kaiser 

Permanente is committed to protecting our members’ health information, and welcomes this 

additional opportunity to provide input to an important area of NIST responsibility. We 

1

 84 FR 47255 

2

Kaiser Permanente comprises Kaiser Foundation Health Plan, Inc., the nation’s largest not-for-profit health plan, and

its health plan subsidiaries outside California and Hawaii; the not-for-profit Kaiser Foundation Hospitals, which

operates 39 hospitals and over 650 other clinical facilities; and the Permanente Medical Groups, self-governed

physician group practices that exclusively contract with Kaiser Foundation Health Plan to meet the health needs of 

Kaiser Permanente’s members.

1 
 

 

KP Comments 

NIST Privacy Framework

previously provided comments and recommendations in response to the November 2018 request 

for information (RFI) on Developing a Privacy Framework, and the April 2019 NIST Privacy 

Framework Discussion Draft. 

Overall, the preliminary draft Framework provides a good set of guiding principles and structural 

elements to help organizations build a solid privacy foundation, and to align privacy risks with 

broader enterprise risks within an organization. 

Purpose, Objectives and Scope for the Privacy Framework 

NIST should clearly state the purpose and rationale for the Framework. The Executive Summary 

and the Introductory sections should explain why it is critical to drive better privacy engineering 

and help organizations protect individuals’ privacy. Similarly, the Framework should describe 

the scope of the document. 

We recommend the next version of the Framework include a section devoted to purpose, 

objectives and scope that discusses how and why a privacy framework can help organizations 

manage privacy risks, why it will be useful to a wide range of organizations of all sizes, and why 

it should remain agnostic to any particular technology, sector, law, or jurisdiction. 

Privacy Framework Structure and Privacy Risk Management 

We applaud NIST’s efforts to organize the overall Framework into a model comprising three 

major components (Core – activities and outcomes; Profiles – functions, categories and 

subcategories; and Implementation Tiers – processes and resources) and for choosing to focus 

the draft Framework around Privacy Risk Management. The simplicity of the model allows the 

draft Framework to define processes and outcomes that support an enterprise’s mission and 

business objectives, cover many existing practices, assist in strengthening individual privacy 

protections, enable organization use, and facilitate compliance with applicable laws and 

regulations. 

The model also allows organizations to better integrate privacy risks with other business and 

operational risks within the organization. However, we recommend NIST expand two sections in 

the next version of the document. Specifically, NIST should include a definition of privacy risk 

management in the overview and add a discussion of why it is important and how it relates to 

other risk areas of an organization. Section 1.2 contains a very brief overview of privacy risk 

management. Given how significant and central this is to the framework, it is important for NIST 

to expand on this section. 

NIST should also consider modifying Section 1.2.1 to focus on Information Security risks and its 

relationship to Privacy risks, and not limit the discussion to cybersecurity risks (a component of 

information security). By focusing only on cybersecurity risks, the framework leaves out several 

other information security components (administrative, physical, technical) that directly relate to, 

and impact privacy risks. The graph used in this section (venn diagram) that correlates 

cybersecurity risks with privacy risks should be replaced with a diagram that correlates 

information security risks with privacy risks. 

2
 

KP Comments 

NIST Privacy Framework

To be relevant in the context of organizations’ respective sectors of the economy, the Framework 

would benefit from documenting examples of the use of the framework in selected industry 

sectors – and provide these examples as supplemental materials – to illustrate how components 

of the Framework (Core, Profiles, Implementation Tiers), and the foundational focus on privacy 

risk management, apply, in a practical way, to specific sectors. NIST should include the health 

and health care sector in this supplemental analysis because of its significant legislative, 

regulatory, and operational privacy achievements over the past twenty (20) years. Creating a 

cross-reference to national policies, such as HIPAA privacy and security rules, will be a critical 

component of such an analysis. As a general approach, the draft Framework includes, and does 

not diverge from, existing privacy policies and practices in the health/health care sector. 

Due to its flexible nature, the draft Framework can be integrated into existing requirements and 

practices. NIST has achieved the intended outcomes related to privacy risk integration, privacy 

risk management guidance, relationship definition between privacy and cybersecurity risk 

(however we recommend expanding this relationship to information security), various 

stakeholder roles’ understanding of privacy risks and mitigations, scalable guidance, and a costeffective implementation. 

It is too early to assess whether the proposed Framework would improve the ability of 

organizations to adapt to and address privacy risks arising from emerging technologies such as 

Artificial Intelligence (AI), Machine Learning (ML), or Internet of Things devices (IOT). These 

concepts and technologies are still evolving and not yet widely adopted and implemented. 

Moreover, a broader legal and regulatory framework for the adoption and use of such 

innovations does not yet exist. 

Core, Profiles and Implementation Tiers of the Privacy Framework 

The Core, which comprises Functions, Categories, and Sub-Categories, provides a set of 

activities and outcomes that enable an organizational dialogue about managing privacy risk. 

We agree with the five identified Functions, (Identity, Govern, Control and Communicate to 

manage privacy risks associated with data processing; and Protect, to manage the privacy risks

associated with privacy breaches). However, we strongly recommend including three additional 

functions related to managing privacy breaches – and that would align with Protect. They are: 1) 

Detect; 2) Respond; and 3) Recover. These are key functions that organizations need to consider 

when addressing privacy breaches. While they have been incorporated into the Cybersecurity 

Framework, they are also an integral part of the Privacy Framework. 

We are concerned that the Core sub-categories in the draft Framework would have the effect of

system controls with potentially excessive prescriptive authority built into the design. 

Organizations should be able to determine the relative risks and assign values to each of the 

elements independently, consistent with the overall structure. 

The draft Framework defines Profiles as the representation of privacy outcomes that an 

organization aims to achieve. In health care, this outcomes-based approach for designing Core 

3
 

 

KP Comments 

NIST Privacy Framework

elements is not compatible with the process-based regulatory and compliance regimes enforced 

by federal, state, and local laws and regulations. The resulting incompatibility will lead to 

disparate results in scoring and reporting on specific elements and for aggregating items. 

Sectoral Concerns 

As we previously commented in the Discussion Draft from April 2019, sectoral considerations 

are critical to the development of the Framework, even as they will complicate its broad 

application and implementation. Privacy in the health care sector requires balancing multiple 

interests; moreover, it is governed by multiple, often overlapping state and federal laws and 

regulations, including but not limited to the HIPAA Privacy Rule. To assist in applying the 

Framework in our sector, we offer the following principles that seek to address individual 

privacy, as well as the delivery of safe and effective health care: 

 Enable Privacy Protection and Quality Care Delivery: The Framework should enable 

health care entities to protect patient privacy while also delivering safe and high-quality 

care. The Framework should promote laws and policies that enable health care 

organizations to achieve both goals simultaneously. The federal HIPAA Privacy and 

Security Rules, as well as state laws and regulations, already require providers and 

certain other entities to protect the privacy and security of individually identifiable health 

information. At the same time, delivering safe and high-quality health care necessarily 

uses personal information. 

 Harmonize Laws and Regulations: A robust Framework should endorse harmonizing 

federal, state and local laws and regulations that protect the privacy and confidentiality of 

individually identifiable health information necessary to provide health services or related 

products and services. 

 Promote Innovation and Flexibility: A flexible Framework will promote regulations 

that do not mandate specific standards, methodologies, technologies, or other prescriptive 

requirements that can only be updated or changed via new laws or regulations. 

Flexibility supports innovation, best use of resources, cost effectiveness, and allows 

organizations to implement systems that best meet their needs. 

 Clear and Open Communications with Stakeholders: Confidentiality and trust are 

core values in the caregiving relationship. The Framework should recognize the need to 

clearly communicate how information is collected, used, shared and maintained, 

consistent with applicable laws and regulations. Implementations of the Framework 

should incorporate and reference the health sector notice requirements as well as the 

remedies available to stakeholders under applicable laws and regulations. 

Specific Comments in Response to the Draft Privacy Framework and Appendices 

As requested in the NIST Notice, we have organized our specific comments and 

recommendations in response to the draft Framework sections utilizing the comment template 

made available by NIST (attached). 

4
 

KP Comments 

NIST Privacy Framework

Conclusion 

Kaiser Permanente looks forward to working with NIST on the draft Framework. We appreciate 

your consideration of our comments. Please feel free to contact me ( jamie.ferguson@kp.org;

510.271.5639) or Lori Potter (lori.potter@kp.org; 510-271-6621) if you need additional 

information. 

Sincerely,

Jamie Ferguson 

Vice President, Health IT Strategy and Policy

Kaiser Foundation Health Plan, Inc.

5
Comment 

#

Organization Name Submitted By 

(Name/Email)

Page # Line # Section Comment 

(Include rationale for comment)

1 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

4 119 NA As noted in our general comment

overall, the preliminary draft Framprovides a good set of guiding priand structural elements to help organizations build a solid privacyfoundation, and to align privacy rbroader enterprise risks within anorganization. However, the next vof the Framework should include section devoted to purpose, objecand scope.
2 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

5 153 1.1 We applaud NIST’s efforts to orga

overall Framework into a model comprising three major compone(Core – activities and outcomes; Pfunctions, categories and subcateand Implementation Tiers – proceand resources) and for choosing tthe draft Framework around PrivaManagement. The simplicity of thallows the draft Framework to deprocesses and outcomes that supenterprise’s mission and businessobjectives, cover many existing passist in strengthening individual protections, enable organization facilitate compliance with applicaand regulations.

3 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

6 196 1.2 While the model also allows orga

to better integrate privacy risks wother business and operational riswithin the organization, as noted general comment letter, we recomNIST expand two sections (1.2 andin the next version of the docume
4 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

6 202 1.2.1 While the model also allows orga

to better integrate privacy risks wother business and operational riswithin the organization, as noted general comment letter, we recomNIST expand two sections (1.2 andin the next version of the docume
5 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 248 1.2.1 Immediately after subsection 1.2.

before the current next subsectioRelationship between Privacy RiskManagement and Risk Assessmenrecommend NIST add a new secti"1.2.2 Relationship Between Privaand Other Business Risks," and diit HOW other risks in the organizainteract with privacy risks, the imof an integrated, comprehensive management strategy that includprivacy risks along with other riskprovide examples of the interactibetween various risks within an 

organization.

6 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 239 1.2.1 Call out for "problematic data act

7 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 248 1.2.2 The explanation on the relationsh

between these two concepts, PrivManagement and Risk Assessmenmore substance and examples.
8 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 249 1.2.2 "Privacy risk management is a cro

organizational set of processes thorganizations to understand how systems, products, and services mcreate problems for individuals anto develop effective solutions to msuch risks. Privacy risk assessmenprocess for identifying, evaluatingprioritizing, and responding to speprivacy risks."

9 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 278 1.2.2 "Privacy risk assessments help 

organizations distinguish betweenrisk and compliance risk" ‐ these aalways mutally exclusive.
10 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 284 1.2.2 As stated in our general comment

to be relevant in the context of organizations’ respective sectors economy, the Framework would from documenting examples of ththe framework in selected industsectors – and provide these examsupplemental materials – to illusthow components of the Framewo(Core, Profiles, Implementation Tand the foundational focus on primanagement, apply, in a practicaspecific sectors.  NIST should incluhealth and health care sector in tsupplemental analysis because ofsignificant legislative, regulatory, operational privacy achievementsthe past twenty (20) years.  Creatcross‐reference to national policieas HIPAA privacy and security rulebe a critical component of such aanalysis. As a general approach, tFramework includes, and does nodiverge from, existing privacy polpractices in the health/health car
11 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 284 1.2.2 As stated in our general comment

due to its flexible nature, the drafFramework can be integrated intoexisting requirements and practichas achieved the intended outcomrelated to privacy risk integrationrisk management guidance, relatidefinition between privacy and cybersecurity risk (however we recommend expanding this relatioto information security), various stakeholder roles’ understanding privacy risks and mitigations, scalguidance, and a cost‐effective implementation.

12 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

7 284 1.2.2 As noted in our general comment

tt is too early to assess whether tproposed Framework would imprability of organizations to adapt taddress privacy risks arising from emerging technologies such as ArIntelligence (AI), Machine Learninor Internet of Things devices (IOTconcepts and technologies are stievolving and not yet widely adoptimplemented. Moreover, a broadand regulatory framework for theadoption and use of such innovat

does not yet exist
13 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

9 312 2.1 Modification of Figure 4 

14 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

9 313 2.1 Emphasis 
15 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

9 314 2.1 As noted in our general comment

we agree with the five identified Functions, (Identity, Govern, ContCommunicate to manage privacy associated with data processing; aProtect, to manage the privacy risassociated with privacy breaches)However, we strongly recommenincluding three additional functiorelated to managing privacy breacand that would align with Protectare: 1) Detect; 2) Respond; and 3)Recover.  These are key functionsorganizations need to consider waddressing privacy breaches. Whihave been incorporated into the Cybersecurity Framework, they aan integral part of the Privacy Fra

16 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

9 335 2.1 Core Functions ‐ add additional th

referenced above.
17 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

9 335 2.1 As stated in our general comment

we are concerned that the Core scategories in the draft Frameworkhave the effect of system controlspotentially excessive prescriptive authority built into the design. Organizations should be able to determine the relative risks and avalues to each of the elements independently, consistent with thstructure.

18 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

9 335 2.1 As stated in our general comment

the draft Framework defines Profthe representation of privacy outthat an organization aims to achiehealth care, this outcomes‐basedapproach for designing Core elemnot compatible with the process‐regulatory and compliance regimeenforced by federal, state, and loand regulations. The resulting incompatibility will lead to disparresults in scoring and reporting onelements and for aggregating item

19 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

10 356 2.1 Control‐P emphasis 
20 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

10 368 2.1 Protect‐P emphasis 

21 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

10 373 2.2 Earlier in the document NIST state

an organization should develop a profile and a target profile to idenneeded improvements. The first swould be to inquire, to what wouprofile be applied? Smaller entitiewithout subsidiaries or regional operational differences or regionasystems or state laws could, concchoose to apply its selected profilagainst the entire organization's pactivities, but throw in any other and it becomes a bit more challen

22 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

10 373 2.2 If systems/solutions are conductin

"data processing" is the profile toapplied by individual systems? Thappears to be a conceivable approthe Framework calls out the SDLCand integration of the profile into
23 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

10 373 2.2 Profiles will be important compon

help address actions that need totaken, from a privacy risk managestandpoint, after a privacy incidenoccurred.

24 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

10 373 2.2 The draft Framework defines Prof

the representation of privacy outthat an organization aims to achiehealth care, this outcomes‐basedapproach for designing Core elemnot compatible with the process‐regulatory and compliance regimeenforced by federal, state, and loand regulations. The resulting incompatibility will lead to disparresults in scoring and reporting onelements and for aggregating item

25 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

11 397 2.3 While the four Tiers seem reason

they are simply listed in the docuwith little information about them
26 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

12 414 3.0 As stated in our general comment

to be relevant in the context of organizations’ respective sectors economy, the Framework would from documenting examples of ththe framework in selected industsectors – and provide these examsupplemental materials – to illusthow components of the Framewo(Core, Profiles, Implementation Tand the foundational focus on primanagement, apply, in a practicaspecific sectors.  NIST should incluhealth and health care sector in tsupplemental analysis because ofsignificant legislative, regulatory, operational privacy achievementsthe past twenty (20) years.  Creatcross‐reference to national policieas HIPAA privacy and security rulebe a critical component of such aanalysis. As a general approach, tFramework includes, and does nodiverge from, existing privacy polpractices in the health/health car
27 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

12 437 3.1 Mapping to industry‐specific natio

privacy "frameworks," such as HIPhealth care) will be particulary hethis section, as a way of contextuthe applicability of the frameworkspecific industry sectors.

28 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

13 470 3.2 One element missing from Figure

the entire discussion on StrengtheAccountability is the depiction of external drivers/forces affecting tinternal elements in the iterative being described. Highlighting thesexternal forces, including nationa

jurisdictional laws and regulations

as new consumer expectations, wbeneficial in this section.

29 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

14 475 3.3 The "ready, set, go" model seems

simplistic for a national privacy framework. Most organizations hmore complex processes that areto fit into a "ready, set, go" conceptualization. While the simpthe model has some appeal, comare missing for what happens bef"ready" and after the "go" (e.g., evaluation, feedback, remediatio
30 Kaiser Permanente Jamie Ferguson  15 525 3.4 We appreciate NIST including this

Jamie.Ferguson@KP.org dealing wit hthe relationship betw

Privacy Framework and the SDLC.

31 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

17 596 3.6 This section should not be limited

"buying" decisions, but to all extecontracted services. Profiles couldstandardized across business agreof many kinds.

32 Kaiser Permanente Jamie Ferguson 

Jamie.Ferguson@KP.org

18 611 Appendi

x A

Appendix A covers topics around implementation, scalability, align

and roles. It does not cover the to"flexibility" and how the model caflexible so as to allow organizatiocontextualize it within their respesectors. For example, "Table 1 ‐ PFramework Function and CategorUnique Identifiers," which providedetailed and complete set of FuncCategories and Sub‐Categories, shallow organizations to at least addindustry‐specific categories and scategories, if not additional funct