[This Transcript is Unedited]
Hubert Humphrey Building
200 Independence Avenue, S.W.
Washington, D.C.
Reported By:
CASET Associates
10201 Lee Highway, Suite 160
Fairfax, Virginia 22030
(703) 352-0091
Call to Order and Introductions - Ms. Frawley
Discuss International Classification of Functioning and Disability
MS. FRAWLEY: I guess we can get started.
MS. HARLICK: I should mention, John Fanning mentioned to me that he had a confidentiality work group, I guess, on the reg now.
Bob said he was leaving, but he said he didn't get the material.
MS. FRAWLEY: Part of the problem is that Bob is not on the subcommittee. Gracie sent the materials to the subcommittee members. I had forwarded it to her a couple of weeks ago and asked her to send it to the subcommittee members.
MR. BLAIR: I don't hear Richard Harding's voice.
MS. FRAWLEY: Richard had to leave. His hospital was going through layoffs and a reorganization. In fact, he had to make a phone call early last evening to find out if he even had a job that he was going back to.
He survived the cuts, but had to fly back last night to the hospital.
MR. BLAIR: All of us are vulnerable to that in this industry. Did you know that he is now president of the American Psychiatric Association?
MR. ROTHSTEIN: I wish he was here so that we could congratulate him.
MS. FRAWLEY: Unfortunately, he told me yesterday morning that he was going to have to fly back last night. They were making the announcements at 10:00 o'clock yesterday so then he had to call a colleague. He lost several staff who were researchers.
Obviously, going in today wasn't going to be a happy day.
MR. ROTHSTEIN: He was pretty stressed. I was counseling him to relax.
MR. BLAIR: I have never seen him stressed. I thought he was genetically challenged without any stress genes at all.
MR. ROTHSTEIN: I guess stress for him.
MS. FRAWLEY: The material that you received in the mail, the subcommittee on populations met on April 13 and 14, and had a presentation on the international classification of impairments, disabilities and handicaps, which is now being looked at in terms of being called the International Classification of Functioning and Disability. So, they had a presentation at their meeting in April. I received materials and was asked that our subcommittee take a look at the classification, to specifically see if we had any particular privacy and confidentiality concerns. They will be meeting in July and I did talk to one of the staff who were assigned to the subcommittee.
She indicated that they would like feedback from this committee at their July meeting. I promised her that I would follow up with her on that particular issue. It is a little bit of a different issue for us to be addressing today. I thought we could spend some time walking through some of the materials, seeing what concerns or issues people had that I could take back to the subcommittee on populations.
Then what we will do is switch gears. I certainly have not had a chance to look at the networking health report that we received yesterday from the Institute of Medicine. I do know that there are some privacy recommendations. What I thought we could do is take a look at those for a few minutes and see if there is anything we wanted to address for our September meeting.
I suspect that our September meeting, we will be tied up with the privacy regulations if they come out on schedule, as they are saying late summer. I suspect we would be spending our time on the privacy regulations. I did want to take a look at the IOM report and see if there was anything there that we thought, on our calendar, we could be addressing down the road. That is kind of what the plan is for this afternoon.
I don't know how many of you are familiar at all with the international classification of impairments, disabilities and handicaps. It has been under development for a number of years by the World Health Organization. We have two individuals -- Jerry Stone and Paul Flagler(?), who work for the National Center for Health Statistics, who have been very involved on behalf of the national center, on the development of this classification.
Several years ago, they held a hearing and it was opened to a number of communities, to receive testimony from folks in terms of the classification, what they liked about it and what they didn't like about it. They had providers, they had patients. I happened to be a representative of a professional association, to get feedback on the classifications, to see what people thought about it.
There were concerns from the disability community about how things were labeled, and about whether it captured all the issues regarding functional status. Paul was taking that testimony back again to the working group he is involved in, in the revision of this classification.
Lisa's subcommittee on populations had a presentation on this in April. Unfortunately, we tend to meet often at the same time their subcommittee meets, so I was not able to attend that meeting, but did have the ability to participate in a conference call on the issue with Jerry and Paul. They kind of walked me through some of the material. What I thought I could do is talk a little bit about the material and then see if there are specific issues that people want to raise.
There is a particular coding format. It is a document that you received for administrative records, to come up with the functional status of an individual. There are eight elements that one needs to look at. The first is learning, the second is communication, third is movement, fourth is moving around, the fifth is self care, the sixth is domestic activities, seven is interpersonal activities and eight is major life activities. Those are the different areas that one would look at, in order to evaluate the functional status of an individual.
MR. ROTHSTEIN: I have a question. How is this used? It is not used in the United States at all.
MS. HORLICK: Does this go to the disability act community?
MS. FRAWLEY: It is not widely used in the United States. There are pockets of health care facilities -- rehabilitation facilities, different health care facilities -- that do use the classification. It has not been adopted in the United States and probably if you asked the average individual if they had ever heard of the ICIDH, they would probably look at you like you had three heads.
Most people know ICD-9-CM, but aren't familiar with some of the other international classifications. There is an international classification of primary care, ICPC, that some people are advocating for use in the United States. Since it is not tied to our reimbursement system, it has not received a great deal of attention. I think people who are in the research community and doing research in this area may be using the classification in terms of some of their work.
That was the sense that I got several years ago at the meeting that Paul held on the ICIDH. I was surprised how many of the people in the disability community knew the classification, and were urging adoption, you know, and felt that their needs were not being adequately recognized by health care providers. The ICD-9-CM doesn't really capture at all many of their unique needs in terms of functional status. So, Lisa's subcommittee has been focusing on that to a great extent.
What you have in terms of the handout is just a listing of the different chapters. Chapter one is activities of learning and applying knowledge and talks about learning activities. In that section, we see areas in terms of being able to read, write, calculate, acquire skills, activities of applying knowledge, and that gets into problem-solving activities, decision-making activities.
Chapter two is communication activities, and that is the activities of understanding spoken messages, activities understanding messages in formal sign language, activities of understanding non-verbal messages, understanding written messages. We know that there are a number of different ways one can receive messages. Then there is the subset on activities of producing messages. Again, it ties back to the understanding messages. Again, we are talking about spoken, formal sign language, non-verbal or written. Then, the ability of an individual to have conversations and use communication devices and techniques. So, that is all under chapter two, communication activities.
Chapter three is movement activities. There, the individual is evaluated for activities of maintaining and changing body position, and being able to change body position and transfer oneself, so looking at those skills. The activities of carrying, moving and manipulating objects, so whether an individual can carry objects, move objects with lower extremities, whether they had fine hand use, whether they had activities of hand and arm use. Then there are other specified movement activities.
Chapter four focuses on the activities of moving around. So, the first subset in the classification looks at walking and related activities. That would be walking activities, moving around activities, activities of moving around using equipment, and then other specified and non-specified walking and related activities. Then there are the activities of moving around using transportation. So, it is using transportation as a passenger, using transportation as a driver, other specified and non-specified activities of moving around using transportation, other specified activities of moving around and other unspecified activities of moving around.
Chapter five focuses on self care activities. That would be the activities of washing and drying oneself, activities of caring for body parts, activities related to toileting, activities related to menstruation, dressing activities.
DR. COHN: Kathleen, I don't mean to break in, but I don't know that we need a complete rendition. I think most of us have a sense that this is a code set focused on disabilities related to probably most anything. I guess a question I had, in terms of it being discussed by this group, I actually was reminded of a comment Clem McDonald was saying in our last meeting.
He was saying, gee, how do you discuss privacy concerns of a code set. He mentioned that as an example, that he wasn't referring to ICD when he was talking about it, but the same issue, I think.
MS. FRAWLEY: I think one of the reasons why it was referred to us, as you look at this list and look at the categories, you are collecting an awful lot of sensitive information on an individual. You really have to, as you go through these chapters and when you are trying to assess someone's functional status, you do have to ask an awful lot of personal questions.
As we know recently, from the concern regarding the full census form, where people felt that was an intrusion of their personal privacy because they were being asked a lot of questions, you know, the concern is in terms of individuals, whether they would feel that their privacy was being violated.
DR. COHN: Again, the issue is not the code set itself. It is how it is being used.
MS. HORLICK: I notice that it is not widely used in the United States. Either I didn't hear or I missed, what is it used for in the United States, if it is used at all? What would it be used for?
MS. FRAWLEY: Some health care organizations do use it like an ICD-9-CM code.
MS. HORLICK: See, I don't know about those either.
MS. FRAWLEY: What they would do is they would classify the patients.
MS. HORLICK: S, if somebody wants to go get benefits and somebody says you are wholly disabled or partially disabled after you have had an accident; is that what we are talking about? It is just floating out there for me. I don't know whether it is related to the ADA and if you code it a certain way, then you fit under it. I don't know where this goes.
MS. FRAWLEY: It is just a way of classifying the patient's functional status. It is not for any other specific purpose. So, you could be in a health care organization, a rehab facility, and they could use this classification to determine what your functional status is.
MR. ROTHSTEIN: As I understand it, Kathleen, this doesn't have any legal significance. It is used rarely here for clinical assessment, maybe somewhat more as a research tool.
MS. FRAWLEY: Yes, exactly.
DR. COHN: I don't know what Lisa was thinking in terms of bringing this over here. I would suspect that they are looking at this as maybe proposing this as the way that disability and impairment in functional status is collected and transmitted and shared within the United States. Of course, as we say that, to my knowledge, there is no way of sending the information around. The only way you would do that under HIPAA would probably be as a claims attachment.
DR. ZUBELDIA: If it is just a code, it could be sent just as the diagnosis code is sent, in the same segment of the 837. All it would need is a qualifier. The question is who would be sending it and who would be requiring it.
DR. COHN: Yes, but to do that would take change, I guess, in the implementation guide and using this as a national standard.
DR. ZUBELDIA: It would have to be a standard first and then change the implementation guide. So, we are talking about two years from now, if somebody put in the change request now.
DR. COHN: I can imagine that Lisa is probably going that way and sort of saying, gee, are there any privacy issues about it. Of course, my own view is, in the same way that I wouldn't want an ICD diagnosis on a census form -- mine anyway -- or anything else, I consider this to be a medical code set, and it has all the privacy that should be associated with the medical code set.
At least from my view of this, this is all medically sensitive information. I doubt that there are any of us who don't have one disability or another, that couldn't in some way be coded by ICD-9-IH. I don't mean to jump to the conclusion, but as I looked at it, that was sort of the conclusion I reached.
DR. BLAIR: I am right in synch with Simon's comments. The thing that I am trying to think of, my first cut at this is a person that has a disability, usually the disability is pretty visible. People know it in one form or the other. There are others -- I don't know how it relates to the American Disabilities Act. Apparently, the American Disabilities Act is being interpreted broadly in some ways.
I think that if you have cancer or if you have back problems that may not be visible, or you have diabetes, that you qualify under the American Disabilities Act, if there are certain things that you may not be able to do that may not be visible. Mark, you know more about this?
MR. ROTHSTEIN: Actually, the problem as I see it is just the opposite, that the ADA has been too narrowly construed by the Supreme Court and the lower courts, especially, after three decisions of the U.S. Supreme Court in 1999. The ADA does not establish that any given condition is a disability. It depends on an individualized assessment of how that individual is affected by that disability.
There are many impairments -- all the common medical conditions, asthma, hypertension, epilepsy, diabetes, and so forth -- that may or may not be impairments under the ADA, depending on how many seizures you have had, how bad your condition is, and for what purposes you are going to be considered.
MR. BLAIR: If that is the case, maybe we have to say strictly by the guidance that both Kathleen has given us and what Simon's comments are, that whether the disability is visible or not, the main point is that information may be gathered for clinical purposes and should be treated in the same way that we treat diagnosis codes, with the same privacy level as that. I can't think of any reason to treat them any differently.
MS. FRAWLEY: The only problem is that the ICD-9-CM codes and the CP codes go on claim forms, off to third party payers, and they are really not protected. I mean, people know what the code means. It is not really protected. If we started using ICDIDH on claim forms, let's say the decision was made to use that in the United States for those individuals who had a disability. That information, then, could conceivably be transmitted for payment.
DR. COHN: I thought this was protected. I thought that the information on a claims form was protected. That is what the HIPAA regs are all about, at least in my understanding. We were just talking about the fact that you can't go see a doctor, have a claims form done and sent to the insurer and then have the insurer send that information wherever they see fit. I think we are at least saying that it should be to that level. I guess I consider that to be in the realm of protected information. Perhaps I am mistaken.
MR. ROTHSTEIN: I am trying to create a scenario in which this ICDIH information would have some effect. I think maybe under the following situation, which may or may not come up.
That is, where this information would be analogous to broad psychiatric data. You have got what the individual tells the therapist, all that information is now handled differently from the pure diagnosis. So, everyone doesn't get access to someone's fears and fantasies and so forth.
MR. BLAIR: Is that a DSM code which is a diagnostic code?
MR. ROTHSTEIN: You are going to have the code, but you are not going to have the sort of effects underlying this. I see this, the ICDIDH code, because it goes into more detail than you would normally get in standard coding as to why a person is having problems of informal social relationships and intimate relationships and all that stuff, that might expand the ambit of what is out there, even though it is protected, or a very, very sensitive nature, even more so than depression. It is the basis for the depression.
That doesn't take away from the fact that it ought to be protected like any medical record, but it is now perhaps a more sensitive medical record than we have seen in the past.
MS. HORLICK: Just so I am understanding, there is a code number for depression, just like there would be a code number for something here. That code number, you would only know depression, you wouldn't know the basis. That would be the clinical part.
MR. ROTHSTEIN: Right.
MS. HORLICK: Here, by the code number you would be able to go in and --
MR. ROTHSTEIN: If you coded enough things, it has all this --
MS. HORLICK: That is what I am saying. With this code, you would be able to go in and say, oh, it is -- I just want to make sure that I understand.
DR. COHN: Maybe I should just jump in. I don't think of this as the cause for all of this stuff, but it is a different dimension. You can have asthma and you can be unimpaired by it or you can be only able to walk for a block. So, it has given you that dimension of really how it affects you personally.
That is not usually the cause, necessarily, the cause of depression or whatever, but clearly, like many other things we have talked about, it is another example of data about you, a procedure done, a diagnosis done, et cetera.
MR. BLAIR: The feeling I have -- I don't know if we are still trying to stick by this -- some years back when Bob Gelman was doing that fair health information practices act, I think he tried to get the different special interest groups for AIDS and drug abuse, and I forget all of it. A number of groups were winding up saying, no matter what privacy protection you have, our group requires a higher level of protection.
In that case, you wind up having a fragmentation and then you have states that wind up, therefore, identifying separate laws for protecting certain groups. I had hoped -- at least I would like it to be -- that we set the bar high enough so that it is unnecessary for AIDS folks to come in, and persons with disabilities, and persons with drug abuse or whatever it might be, to wind up saying, I am special.
Why don't we set the bar high enough that all of this information has an appropriate level, an adequate level of privacy protection, to cover no matter what it is.
MR. ROTHSTEIN: I agree with that as a general principle. I think that the application of that does raise certain issues. To take the HIV instance, if you have a diagnosis of HIV infection, that should be subject to the same general protection.
I don't know, if I was a patient with HIV infection, I would want a code sent to anybody outside of my physician indicating how I became HIV infected. If I had depression or schizophrenia or anything else, I am not sure I would want the details surrounding my mental illness to get out.
MR. BLAIR: Isn't that true of a whole host of other diseases?
MR. ROTHSTEIN: Absolutely, but it is not true for many other things. If I have asthma, I don't care if my payer knows everything surrounding my asthma. I might if it was a sexually transmitted disease, if it were a mental illness or some other kind of stigmatizing condition.
MS. HORLICK: Might there be a reason -- I am not really sure I am understanding -- that not the cause, but for some purposes, I would want them to know how it affects my ability to function.
MR. ROTHSTEIN: Who is they?
MS. HORLICK: If I am the patient, is there some reason -- maybe so I could show that I am eligible under the ADA or something?
Might there be a reason where I would want my ability to function, not the cause of --
MR. ROTHSTEIN: Absolutely. That may be relevant in all sorts of kinds of administrative determinations.
MS. HORLICK: Is that what they are talking about using this data for?
MR. ROTHSTEIN: I don't know of any proposal to use this.
MS. FRAWLEY: They are working on a second draft, which you have a copy of. I can't envision that, for disability benefits, that you would be required to classify it this way.
DR. ZUBELDIA: Some of it may be care, home health care claims need to have an attachment that has this same sort of information coded in different ways for their care. When you go to home health, with the private insurance, they code it different, and each home health payer is going to have this same sort of requirement coded in different ways.
I think if we can get a standard way of doing it, I think that is a positive role. I agree, as of today I don't know of anybody using this yet. Whether it needs to have a different protection than the diagnosis code, probably not. This type of information, probably not.
If you are talking about how you developed your sexually transmitted disease, that is not this. You are talking about something else. That may have different protections, but it is not this. This says how your sexually transmitted disease impairs your functionality and your ability to work normally. I don't see any different protection than diagnosis codes on this one code set.
MS. HORLICK: Do you think that Lisa was asking, in terms of a protection required, or was she actually asking us to look at the content of this and say is there something in there that maybe they --
DR. ZUBELDIA: One thing that strikes me, looking at the content of this --
MS. FRAWLEY: She was asking us to look at content.
MS. HORLICK: Menstruation or something like that, it seems like, I don't know.
DR. ZUBELDIA: You go to page 163 of this document. Here they have the code, which they show as three Xs but I understand it is an A with three digits. Then qualifiers, one through four, you can put either minus one through four or plus one through four, or you can put a period. Whether you put a plus, minus or a period has different meaning. I have never seen anything like that in a coding system, where the punctuation has meaning.
MR. BLAIR: That is interesting.
MS. HORLICK: I am not familiar with this at all.
MR. BLAIR: That may be an information systems issue.
DR. ZUBELDIA: That means that we cannot suppress the punctuation, because the punctuation has meaning. If it is a negative sign, it is a negative scale. If it is a plus sign, it is a positive scale. If it is a period, it is a barrier. I have never seen anything like this. It is very creative.
MS. FRAWLEY: Still, it is a good point to raise to Lisa's subcommittee. They may not have thought of that in terms of the technology.
DR. ZUBELDIA: Don't suppress the punctuation. Definitely, you can't suppress the punctuation because it has meaning. In the ICD-9, practically everybody suppresses the period. Also, another recommendation I would make is they start using the letter A and there are some codes that have the letter P and some codes have the letter E. I would stay away from the letter E. I don't have a problem with A or P, but E could get confused with the E codes of ICD-9 for external causes. It could get confusing.
MR. BLAIR: Did we drive very quickly to a consensus on this, or do we still have disagreement, that they do require privacy protection at the same level of all diagnosis codes have privacy protection? Is that something that is consensus or not?
MS. HORLICK: I think we are all in agreement on that.
MS. FRAWLEY: There is a handout that looks like slides that was actually the presentation that was done at Lisa's subcommittee, which explains the World Health Organization family of international classifications, the need for the ICIDH. They are looking at changing the name from the International Classification of Impairments, Disabilities and Handicaps to the International Classification of Functional Disability.
I think that, to answer the question Gail has, where she talks about the aims of the ICFD, it talks about, to provide a scientific basis for consequences of health conditions, to establish a common language, to improve communications, provide a systematic coding scheme for health information systems, and to permit a comparison of data across countries, health care disciplines, services and times.
That kind of lays out what the aims are. Then the applications are as a statistical tool, a research tool, which is kind of how it is being used right now, a clinical tool, a social policy tool, an educational tool. You know, this would not be, as an individual who has coded, this would not be an easy classification to work with.
You would really be dependent on an awful lot of documentation in the individual's medical record in order to be able to come up with the appropriate coding. You are looking for an awful lot of detailed information. It is a lot easier to code an ICD-9-IM when you are looking for principal diagnosis and the complications and the comorbid conditions.
Here, you would be looking for a lot more information about a person's lifestyle, their living arrangements and their ability to ambulate and so forth. It would require a lot of data collection by nursing staff, physicians and other care givers, in order to use a classification. It wouldn't be something that you could use easily.
MR. ROTHSTEIN: I think that is a good point. This might have some relevance where there were a detailed examination to make a specific determination of disability, such as for a disability insurance policy or something. In the context of a normal clinical record, you are probably not going to get all or even a fraction of these data that you could code from, especially managed care. You are not going to spend three hours trying to get information about somebody's plumbing.
DR. COHN: Some pieces of this might have some application in terms of tracking for physical therapy and occupational therapy. Kepa mentioned home health might be appropriate.
I have to think about it. Home health has its own code, a whole bunch of them, coding systems. I guess one continually asks, another coding system, what is it to be used uniquely for that we don't have another three or four different coding systems around for. I don't think it is the scope of our discussion, but it is a question that we always ask when we see another coding system. I assume that Lisa is trying to answer that question.
MS. FRAWLEY: Right. I think what has happened is there is some interest on part of some of the staff, the National Center for Health Statistics, to try to move this classification forward, you know, and see it implemented more widely in this country. I think that Lisa's subcommittee is focusing, to a great extent, on functional status. It is one of the topics they have been spending a lot of time on.
You know, they have raised the issue, which I think is good, in terms of privacy concerns, whether individuals with disabilities, whether it rises to a different level of privacy protection. Are there significant concerns that the HRSA committee should be aware of.
MR. BLAIR: Maybe we could report back to her that we have reviewed this but the results of our discussion are private and confidential. [Laughter.]
MR. STONE: Let me ask a question. Is this a one-time three-digit code that will prioritize the eight major areas, or does it change for each one of these?
MS. FRAWLEY: It would change. Your status could change, you know, when you enter the delivery system again, in terms of some of the areas, in terms of interpersonal activities. Some of your medical conditions may remain the same, but certainly in terms of social and interpersonal activities, things could change.
MR. STONE: Do you think one of the main problems could be misuse by third parties, employers, people who would want to misuse it for a particular reason? For that reason, it should be afforded a high level of protection as well as privacy.
MR. ROTHSTEIN: Of course, there is no such thing in terms of protecting information from employers. Employers can get their hands on anything they want, basically, legally. All they do is give you a piece of paper that says, if you want this job, sign this release.
MS. FRAWLEY: Do we have any more comments on ICIDH? Well, then, what I will do is draft a letter back to Lisa, to let her know that we released it, and just some of the comments that we raised.
What I wanted to do, which is not part of today's agenda, but I thought would be worthwhile, is Ted Shortliff yesterday, when he was doing his presentation on the IOM report, Networking Health, alluded to the fact that there were some privacy recommendations that the committee made.
I thought we could just take some time to take a look a those and see if there is anything we need to address in light of the recommendation or plan in terms of future meetings.
Since I have not looked at them, I know he said the recommendations were in chapter six. Jeff, I will just be sure to read along.
[Books perused by attendees.]
MR. ROTHSTEIN: The only thing I see is on page 264, under recommendation 4.1, the explanation, where it says, not only does HHS need to ensure the concerns and needs of the health community are reflected in attempts to address policy issues, such as intellectual property, protection of privacy and access to the information infrastructure, but it can also help to ensure greater coordination of the federal health agencies in these areas.
Elements of DHHS are involved, in missions to address issues such as this, that DDH itself has taken steps to address, issues such as privacy and security of electronic medical records. Additional focus would help ensure that these issues are suitably addressed by the policy-making community.
MS. FRAWLEY: I see where it lays out a number of activities for DHHS in terms of a number of roles. It does talk about convening public and private bodies to identify any examinations related to the internet and health care. These bodies could help federal agencies identify issues that need to be resolved, provide guidance on the kinds of approaches that might be most effective, and ensure greater coordination of public and private efforts.
The National Committee on Vital and Health Statistics has been playing a similar role in the area of privacy and security of electronic health information, and could serve as the model or the seed for other such groups. This recognizes some of the work that we are doing. I don't see anything --
MR. ROTHSTEIN: The only other place is chapter five, where it talks about unique patient identifiers. It is more descriptive of what the issues are in pending legislation. I also think that the issues raised by the internet are really security issues and not privacy issues or confidentiality issues, but security issues.
DR. ZUBELDIA: There is also an issue in the presentation that we had on digital signatures we had this morning. It is a privacy issue. I cannot agree with what he said. I think if I am going to send you an encrypted message, I want to make sure that only you can read the message. So, I have to have an authentic copy of your public key.
Otherwise, I would be sending something to a key that I believe is yours, but may not be. That is when information can be disclosed to a their party, because I made use of the key. So, encryption and authentication are very tightly linked.
MR. ROTHSTEIN: His terminology that he used, it is one that I would not agree with. It is interesting how people have different definitions of privacy, confidentiality and security. My definition of -- there are really two definitions of privacy that I use. One is what information I have a right to keep private about myself and not tell anybody about if I don't want to, and the sort of more lay definition of privacy that includes everything else.
It includes confidentiality and security. Confidentiality, I think, is generally used to refer to the re-disclosure of information that was disclosed within a confidential relationship, such as where your physician is not supposed to re-disclose information about you without your consent. Security is what third parties can do without anybody's authorization on either side, to gain access to your information and your ability to keep them out. He was using those terms, I think, very loosely.
MS. HORLICK: I always think of privacy in terms of sort of your rights over what information you want to keep to yourself, whereas security, on the other hand, is more of the technical and administrative mechanisms that are used to ensure that something is private.
MS. FRAWLEY: The only way I see the internet privacy, you have to use all those technical means to ensure that you protect that right to keep that message private. It seems much more on the technical side to me.
I am looking at the different citations that they have in the book. They talk about privacy-enhancing technologies on page 167.
They talk about anonymous e mail, protected web browsing, anonymous payment, anonymous data released from sensitive data bases.
So, they were offering those different mechanisms as a way to protect consumer privacy. I don't see anything in terms of looking in the index under privacy, much in the way of specific recommendations.
I mean, there are references throughout the report to privacy and obviously to this subcommittee and the subcommittee on securities and standards work. I don't see anything else we could wrap our hands around and say, you know, let's chew on this.
We did have our hearing in February on the internet and what people were doing in terms of privacy. Of course, the Federal Trade Commission has picked up that trail and is doing a lot with a lot of these web-based companies in terms of personal privacy.
I am not sure, just looking briefly through the index, and what is cited in the report, that there is any particular recommendation that we could, at this time, take on, unless someone else has any thoughts. You can send me an e mail afterwards.
MR. ROTHSTEIN: How do we get items on the subcommittee's agenda? I don't mean for the meetings, as a sort of a work plan. Does it have to be approved by the full committee or just the subcommittee?
MS. FRAWLEY: No, just the subcommittee. If there are any particular issues, this would be the place to raise them, so we can just add them to our work plan and prioritize them. You obviously have something.
MR. ROTHSTEIN: I throw out the issue that I discussed briefly, I think before Simon came in, and that is the issue of the form in which individually-identifiable -- or whether individually-identifiable health information needs to go to employers, particularly self-funded employers as part of the health benefits billing process.
I would like to take a look at the issue of whether new technologies are available and how much it would cost and who is doing it and what the problems in implementing these systems are, and are there breaches that are going on now, or is this a problem for individuals.
My understanding is that it is a problem.
DR. ZUBELDIA: I did a site visit to a TPA in Chicago one month ago, just to see what the operation looked like, and spent all afternoon going over every detail, and this is just one TPA.
They had about 150 employers that they administered claims for. When were looking at the advice that went to employers and how they generate those.
Their system generated a carbon copy of everything that it advised to be sent to the employer. The guy in the mail room was just throwing them away, or throwing them in a pile to be shredded.
They asked him, well, how many of these actually go to the employers. She said, we only have one employer that wants them. Everybody else, they don't want to know what their employees' claims are.
They do get a summary, just statistical summary, of what was paid that month. They don't know what their employees' illnesses are.
There was that one employer of 150 that did want to know.
MR. ROTHSTEIN: Presumably this TPA would have given more of that information if they did want to know.
DR. ZUBELDIA: Whatever it took to get a contract.
MR. ROTHSTEIN: For self-funded, self-administered employers --
DR. ZUBELDIA: That is a different story.
MR. ROTHSTEIN: I gave a speech one time to a large group -- I can't remember what the group was -- making this point. I thought it was unnecessary and a mistake, that individual identifiable claims information was coming back to the employer payers.
At question time, this woman got up and said, I am the vice president in charge of benefits for some Fortune 500 company, and I thought the next part was, and you are crazy.
The next part was, you bet it is a problem. The worst is when my personal claims come back to the department, because everybody is dying to know why I went to the doctor.
DR. COHN: I agree with you about the issue. I know Kathleen commented that we recently had a hearing on it.
I think we are all happy to go back into that area. It ultimately will satisfy the last one. The issue gets to be how you structure this to actually get something that is useful as opposed to a bunch of employers talking about how good practices are. I don't know if that is what you want.
MS. FRAWLEY: Gail couldn't get any witnesses. Nobody wanted to show up and testify.
MR. ROTHSTEIN: I want to hear from the folks at Ford. They, in the last few years, put in a whole new system that all their information about their employee health benefit claims is coded, and each employee has a separate medical identification number.
So, the company doesn't have any idea who is getting what. Yet, they can do all their statistics. They can make sure that the claims are not being paid unreasonably.
DR. COHN: These are technologies and approaches to deal with these issues?
MR. ROTHSTEIN: Yes, and I would like to see how that has worked, how much it has cost, is it widely available, why don't more employers do it, what would be the objections, that sort of thing.
DR. ZUBELDIA: We had testimony from IBM in that area, and they said how they do it, but how they handle the claims for the employee benefits group.
MS. HORLICK: The way we got IBM to come is by saying, we had someone on our committee, the subcommittee, that worked there and told us what wonderful policies you have.
So, they were happy to come because they did have good policies. Everybody else, as diplomatic as I tried to be about just sort of understanding the process, it was just terrible.
MR. ROTHSTEIN: The other side of it is, we call up SHRM, the Society for Human Resource Management. They are in Alexandria.
You say, we are considering a variety of recommendations, one of which might be to recommend that there be legislation requiring that employers use coding instead of individual names in paying bills. Would you like to comment on whether that is a good idea or a bad idea. We will hear from 100 people telling you why the world is going to come to an end if we do that, which is important to learn.
DR. ZUBELDIA: Wal-Mart is a sort of very large self-insured employer. They may be able to testify.
MR. BLAIR: I found it so disconcerting when one of the insurance companies told us -- I had just assumed that the companies that would request the information about employees would be small ones, because that would be a hit on their expenses, and the large companies would not.
She said, no, some large companies ask and some small companies, and it is not the size that is the determinant.
DR. ZUBELDIA: There is something that has been known throughout all this, and that is the insurance company. After the claim gets to the insurance company or a TPA, most of those self-insured employers or self-funded plans carry a stop loss insurance.
The stop loss carrier gets a copy of every single claim. Every single claim that is adjudicated goes to stop loss. They are totally outside.
MR. ROTHSTEIN: PBMs as well. Employers who want it can get a list of all other employees and what meds they are taking.
MS. FRAWLEY: We did PBMs and prescription drug companies. We had an all-day hearing with them, I guess a year ago February.
Again, it depended on the company in terms of their policies. Some of them had great policies and some of them didn't have any policies at all, and were sending identifiable data back to employers.
MR. ROTHSTEIN: I guess I can think in my mind about sort of well-known lawsuits that have been brought by people who claimed invasion of privacy as a result of their prescription drug record with their names being sent to their employer.
MS. HORLICK: Probably still on the web site is some of that testimony from a year ago that you can go back. We had some buys from CVS --
MS. FRAWLEY: That was right after CVS had been in the paper where they were planning on using a marketing firm and using prescription information. Due to public outcry, they stopped that process. They came forward and talked about what they were doing.
MS. HORLICK: I will say that clearly we did not get the whole picture for a number of reasons, not sort of discussing who should try to be on these panels and people not agreeing to be on the panel.
We had talked about revisiting that issue and going into it in more detail. Then we sort of get HIPAA tracked.
MR. ROTHSTEIN: There is a big case in Philadelphia.
MS. HORLICK: That was Rite-Aid, wasn't it?
MR. BLAIR: Isn't this an issue where there are not going to be examples of people bringing litigation because they caught somebody transferring this information. The employees don't know.
Then the other piece is that, for the most part, the insurance companies, just as you said, Gail, they really don't want to testify.
I sort of feel like, if we are going to do anything to address this issue, maybe we have to pick some different path to do so.
DR. ZUBELDIA: Is there a process for us to get testimony that is not discoverable? I know people are afraid that whatever they say would be discoverable under some --
MR. ROTHSTEIN: We need subpoena power.
DR. COHN: I think on the internet is probably not the way to get non-discovered.
MS. FRAWLEY: And the we leave it on the website.
DR. COHN: I am not an attorney. I am a doctor. So, have one view of all of this stuff. I am sort of struck that we keep assuming that we know the problem, and therefore we just get these people to come and testify.
I am wondering if maybe hearing from some sort of customers, patients, the unions, the people at the end of the stream, beginning to understand from them, do they have an issue. If so, what are their issues, what are their concerns, et cetera, et cetera. It might be useful.
MS. HORLICK: Jim Ellenberger came during the hearing and he gave me his card and said, I will come. I didn't know to invite him.
MR. BLAIR: Some of these groups may actually understand the issues almost better than we do. I may be wrong about that. I don't know all your experience and background in this stuff.
This area, to me, is sort of a black box and data goes around and about and I don't know what is important and what isn't.
MS. HORLICK: It was hard, too, because I didn't have enough background to try to put the pieces together.
MR. ROTHSTEIN: I think Jeff is right. Unless somebody really is discriminated against or it is widely disseminated, the person is not going to know.
I think if you asked 100 employees, 95 of them wouldn't even realize that their employers are getting, or have the right to obtain the information in such detail, about their medical conditions.
MR. BLAIR: Weren't there some surveys, Kathleen, that you or some other organization conducted as to the greatest concerns that the population at large has about abuse of their health care information?
The number one concern is that that information would flow to an employer and either prevent you from getting a new -- I thought that was an impetus for HIPAA. HIPAA only closed the door, but it is still not closed.
MS. FRAWLEY: It was Jan Laurie's report.
MR. BLAIR: I don't know. Do you think that if the NCVHS took a position to wind up saying that HIPAA didn't completely address the issue of closing the door, that we could have a possible effect in trying to get the door closed on information flowing to employers?
MR. ROTHSTEIN: We may want to take it up in September and see what the final drill is. This won't surprise you, but one of my personal comments on the rules, I advocated that information should be disclosed to third party payers in the least identifiable form that was practicable and consistent with essential uses.
I don't expect -- that is sort of way -- I don't want to say way, but it is beyond what the initial proposal was and I don't see them doing that now.
When we revisit the final rule and say, look, there are 10 major areas that weren't addressed at all and here they are and don't think this is the end of it.
MS. HORLICK: I have wondered, when it is finally issued and the public gets, when it gets filtered down, what the scope of these regs are. We have been waiting for this privacy legislation to come, and when they say, well, it doesn't do this and it doesn't apply to this, combined with our re-evaluating it, that may be a good time for some recommendations.
DR. COHN: It is going to be complex. It is not going to be, it doesn't do this or it doesn't do that. But what is the headline going to be.
MS. HORLICK What I am saying is, I don't think that people out there even -- people I have talked to, they have no idea that some regulations are only going to apply to health care plans. They don't even know. They say, oh, there is going to be privacy.
DR. ZUBELDIA: Last week in the SNP meeting, I was in the security work group and we talked about who are the covered entities.
Eighty percent of the people in the room -- these are people who are involved in implementing HIPAA -- 80 percent of them didn't know that if a physician doesn't file electronic claims or transaction, they are not a covered entity. When I pointed that out, they wouldn't believe me. They had to call to verify it. Then there was just this outcry, this throws everything out. We need to start again from scratch. Those are people involved in implementation.
MR. ROTHSTEIN: The regs are going to be tied up in court for years. Everybody is going to sue to strike them.
MS. FRAWLEY: Anything else that anybody wants to bring up?
DR. ROTHSTEIN: We could at least have the next step is to sort of mobilize around the regs.
MS. FRAWLEY: That would be my expectation for the September meeting.
MR. BLAIR: What opportunity will we have, once the regs are issued, to do any changes, though?
MR. ROTHSTEIN: None. The legislative recommendations, maybe.
MS. FRAWLEY: I think that we would be able to send a letter to the Secretary and identify areas that she might want to consider proposing for legislation.
It is going to be a bad time because you are going to be in the middle of a transition and have a campaign going, a transition administration. That leaves this whole area. I think that is why there is such a push to get the privacy regs out, you know, by late summer, so that we could identify areas to be covered under legislation.
DR. COHN: I think that will be a useful thing but I think implementation is going to be something that we don't -- I know there are policy wonks, but the issues of assisting implementation I would see as where they need help. The Secretary knows the areas the legislation doesn't cover. I don't think she needs us to necessarily remind her that it doesn't cover everything.
MS. HORLICK: So, how, when we say assist in the implementation, what is an example?
DR. ZUBELDIA: How the minimum necessary is being actually used.
MS. HORLICK: Sort of operationalizing it?
DR. ZUBELDIA: And how the implementation is being used. Which ones are being left behind and why. How the cross linkages between multiple sources is being done, the ones that are being identified. I think we need to understand better how the industry is reacting to the regs and implementing them.
Then, I don't know if this is going to happen or not, but one of the conditions of security was maybe there should be some standard text or boiler plate for the privacy required agreements and consent forms.
MS. FRAWLEY: A chain-of-trust agreement?
DR. ZUBELDIA: Chain of trust text, as an example, not of the entire contract, but sample paragraphs that implement these HIPAA privacy requirements. I don't know if we would put it together or somebody else, but at some point I would like to see what is it that the industry is doing in that area.
MS. FRAWLEY: The thing is that it would be early -- I was just thinking, December would be too early to do anything on implementation. I am just thinking, I am sitting in a hospital and I am going to have to deal with those privacy regs. December would probably be too early in the process, I am thinking, for epipial to come forward and talk about it.
Probably early next year, you know, would be probably the appropriate time. We certainly could get some representatives of some professional associations. The American Hospital Association will be giving guidance, you know, to hospitals. AANC will be doing it for their members, AHIMA will be doing it for their members, you know.
Maybe we could get some real people, somebody who is -- a physician who transmits electronically, or a hospital or something like that, you know, might be worthwhile. I think December would be too soon because I think if these regs hit in late August, early September, it will take a while for people to figure out what they are.
That is actually when I think we are meeting, around that time. Anything else? Walter, do you have anything? Jeff? Mark? Anybody? Then I will declare the meeting adjourned. Have a good summer, although I will see some of you over the summer.
[Whereupon, at 3:00 p.m., the meeting was adjourned.]