HIT Policy Committee Privacy and Security Tiger Team

1. HIT Policy CommitteePrivacy and Security Tiger Team Deven McGraw, Chair Paul Egerman, Co-Chair August 30, 2010

2. Tiger Team Members • Deven McGraw, Chair, Center for Democracy & Technology • Paul Egerman, Co-Chair, • Dixie Baker, SAIC • Christine Bechtel, National Partnership for Women & Families • Rachel Block, NYS Department of Health • Carol Diamond, Markle Foundation • Judy Faulkner, EPIC Systems Corp. • Gayle Harrell, Consumer Representative/Florida • John Houston, University of Pittsburgh Medical Center; NCVHS • David Lansky, Pacific Business Group on Health • David McCallie, Cerner Corp. • Wes Rishel, Gartner • Latanya Sweeney, Carnegie Mellon University • Micky Tripathi, Massachusetts eHealth Collaborative • Adam Greene, Office of Civil Rights • Joy Pritts, ONC • Judy Sparrow, ONC

3. Agenda—Review Recommendation Letter with focus on items not previously presented to Policy Committee • Tiger Team’s Scope • Core Recommendation • Core Values • Triggers and Meaningful Consent • Granular Consent • Conclusions

4. Framing: Scope Recommendations apply to electronic exchange of patient identifiable health information among known entities to meet Stage 1 of Meaningful Use (MU) Note: Patient Access, Research and Claims and Payment Processing are not in scope for this initial discussion.

5. Scope: Specific Issues/Questions Addressed • Use of intermediaries or third party service providers in identifiable health information exchange; • Trust framework to allow exchange among providers for purpose of treating patients; • Ability of the patient to consent to participation in identifiable health information exchange at a general level (i.e., yes or no), and how consent should be implemented; • The ability of technology to support more granular patient consents (i.e., authorizing exchange of specific pieces of information while excluding other records); and • Additional recommendations with respect to exchange for Stage I of Meaningful Use – treatment, quality reporting, and public health reporting.

6. Core Tiger Team Recommendation • All entities involved in health information exchange – including providers (individual and institutional) and third party service providers like Health Information Organizations (HIOs) and other intermediaries – should follow the full complement of fair information practices(FIPs) when handling personally identifiable health information. • Each set of recommendations is mapped to applicable fair information practice principle(s) • Formulation of FIPs comes from ONC’s Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information (adopted by Policy Committee in Strategic Framework).

7. Core Values • The relationship between the patient and his or her health care provider is the foundation for trust in health information exchange, particularly with respect to protecting the confidentiality of personal health information. • As key agents of trust for patients, providers are responsible for maintaining the privacy and security of their patients’ records. • We must consider patient needs and expectations. Patients should not be surprised about or harmed by collections, uses, or disclosures of their information. • Ultimately, to be successful in the use of health information exchange to improve health and health care, we need to earn the trust of both consumers and physicians.

8. Recommendations 1 and 2 Use of intermediaries or third party service providers in identifiable health information exchange; Trust framework to allow exchange among providers for purpose of treating patients; Recommendations previously presented and included in Appendix. 8

9. 3.1 Consent and Directed Exchange Recommendation 3.1 on page 9 • Assuming that FIPs are followed, directed exchange for treatment does not require patient consent beyond what is required in current law or what has been customary practice • Not intended to change patient-provider relationship or importance of provider exercising judgment on the patient’s behalf • The same considerations and customary practices that apply to paper or fax exchange apply to directed electronic exchange

10. 3.2 Trigger when ONC Should Require Additional Consent When the decision to disclose or exchange the patient’s identifiable health information from the provider’s record is not in the control of the provider or that provider’s organized health care arrangement (“OHCA”), patients should be able to exercise meaningful consent to their participation. ONC should promote this policy through all of its levers. Letter Pages 10 and 11

11. 3.2 Trigger when ONC Should Require Additional Consent Examples: • A centralized HIO model, which retains identifiable patient data and makes that information available to other parties. • A federated HIO model, which exercises control over the ability to access individual patient data. • Information is aggregated outside the auspices of the provider or OHCA and comingled with information about the patient from other sources. 11

12. Trigger when ONC Should Require Additional Consent (cont.) - The patient must be provided with an opportunity to give meaningful consentbefore the provider releases control over exchange decisions. - If the patient does not consent to participate in an HIO model that “triggers” consent, the provider should, alternatively, exchange information through directed exchange. - There are some HIOs that offer multiple services. The provider may still contract with an HIO to facilitate directed exchange as long as the arrangement meets the requirements of recommendation 1 of this letter.

13. 3.3 Meaningful Consent Attributes • Advanced knowledge/time • Not compelled, or used for discriminatory purposes • Full transparency and education. • Commensurate with Circumstances • Consistent with Patient Expectations • Revocable Details in Appendix 13

14. 3.4 Consent Implementation Guidance • The provider has the responsibility to educate and discuss with patients how their information is shared. • The federal government, as well as regional extension centers and HIOs, also have responsibilities to educate the public and should provide resources to providers. • Providers should obtain and keep track of patient consent but they may delegate consent management/administrative functions to a third party (such as an HIO), with appropriate oversight.

15. 3.5 Provider Consent to Participate in Exchange Should providers have a choice about participating in exchange models? Yes! . Letter Page 13

16. 4. Ability of Technology to Support More Granular Patient Consent • June 29 Technology Hearing (June 29) (pages 14-17) • Reviewed NCVHS recommendations • Co-chairs of NCVHS confidentiality and privacy workgroup made presentation

17. Ability of Technology to Support More Granular Patient Consent – Recommendation 4 • Promising Technology but in the early stages of development and adoption. • Furthering experience and stimulating innovation for granular consent are needed. • This is an area that should be a priority for ONC to explore further.

18. Ability of Technology to Support More Granular Patient Consent – Recommendation 4 (cont.) • Important that ONC find evidence (such as through pilots) for successful models and not rely on theoretical possibilities. • In the interim, patient education is paramount: Realistic expectations about privacy need to be established.

19. Question 5: Additional Recommendations Use of intermediaries or third party service providers in identifiable health information exchange; Trust framework to allow exchange among providers for purpose of treating patients; Ability of the patient to consent to participation in identifiable health information exchange at a general level (i.e., yes or no), and how consent should be implemented; The ability of technology to support more granular patient consents (i.e., authorizing exchange of specific pieces of information while excluding other records); and Additional recommendations with respect to exchange for Stage I of Meaningful Use – treatment, quality reporting, and public health reporting. Recommendation #5 was previously presented and are included in Appendix. 19

20. Conclusion • Recommendations were targeted to address a set of questions raised by ONC; they are not the definitive or final word on privacy and security and health IT/health information exchange. • More work is necessary – only a systemic and comprehensive approach to privacy and security can achieve public confidence. • Among the issues needing further work: exchange beyond Stage 1, provider credentialing assurance levels, individual access, transparency, security safeguards, and de-identified data.

21. Appendix 21

22. 1. Use of “Third Party Service Organizations” Recommendation 1 on page 6 of the letter • Third party service organizations should not collect, use or disclose identifiable health information for any purpose other than to provide the services specified in the business associate or service agreement and any necessary administrative functions. • Such information should be retained only for as long as reasonably necessary. Retention policies must be disclosed. After retention period, information must be securely returned or destroyed. • Require transparency also for uses of de-identified data. • BAA provides accountability – but not sufficient governance to build/maintain public trust

23. 2. Trust Framework for Exchange Among Providers Recommendation 2 on pages 7-9 (top) • Providers “hold the trust” – but may delegate functions such as issuing digital credentials or verifying provider identity, as long as delegation maintains this trust. • Federal government should establish acceptable level of accuracy and establish and enforce clear credentialing requirements; state governments can provide additional rules if necessary • Providers should also attest to relationship with the patient who is the subject of the information, and all who exchange identifiable health information should be required to comply with applicable law and policies (enforced through law and ONC policy levers)

24. 3.3 Meaningful Consent Guidance When Trigger Applies Recommendation 3.3 on page 12 • Such consent must be meaningful in that it: • Allows the individual advanced knowledge/time to make a decision. (E.g., outside of the urgent need for care.) • Is not compelled, or is not used for discriminatory purposes. (E.g., consent to participate in a centralized HIO model or a federated HIO model is not a condition of receiving necessary medical services.) • Provides full transparency and education. (I.e., the individual gets a clear explanation of the choice and its consequences, in consumer-friendly language that is conspicuous at the decision-making moment.)

25. Meaningful Consent Guidance (cont.) • Is commensurate with the circumstances. (I.e., the more sensitive, personally exposing, or inscrutable the activity, the more specific the consent mechanism. Activities that depart significantly from patient reasonable expectations require greater degree of education, time to make decision, opportunity to discuss with provider, etc. • Must be consistent with reasonable patient expectations for privacy, health, and safety; and • Must be revocable. (I.e., patients should have the ability to change their consent preferences at any time. It should be clearly explained whether such changes can apply retroactively to data copies already exchanged, or whether they apply only "going forward.")

26. 5. Additional Recommendations re: Stage 1 of Meaningful Use Recommendation 5 on pages 17-18 • Exchange of identifiable health information for treatment should be for treatment of the individual who is the subject of the information, unless the provider has the consent of that individual use his/her information to treat others (note: further work needed to ensure appropriate care of infants and children) • Public Health and Quality reporting should take place using the least amount of identifiable information necessary, unless law requires disclosure of identifiers • Provider is responsible for public health and quality disclosures, but may delegate to an HIO pursuant to a business associate agreement.