[This Transcript is Unedited]
Quality Hotel Courthouse Plaza
1200 N. Courthouse Road
Arlington, Virginia 22201
DR. FRAWLEY: I am Kathleen Frawley, Chair of the subcommittee. I'd like the subcommittee members to take an opportunity to introduce themselves. Mark?
DR. ROTHSTEIN: I'm Mark Rothstein, subcommittee member.
DR. FRAWLEY: Jeff?
DR. BLAIR: Jeff Blair, Medical Records Institute, subcommittee member. Well, I guess I am a subcommittee member.
DR. FRAWLEY: Yes, you are.
DR. COHN: Simon Cohn with Kaiser Permanente and a subcommittee member.
DR. ZUBELDIA: Kepa Zubeldia with Envoy Corporation and subcommittee member.
DR. HORLICK: I'm Gail Horlick with CDC, staff to the subcommittee.
DR. HARDING: Richard Harding, University of South Carolina, a subcommittee and committee member.
DR. FRAWLEY: And our audience? Mike.
MR. SANDELL: Steve Sandell, Centers for Disease Control and Prevention, staff to the committee.
MS. SLOANE: Pat Sloane, Hampton University, interpersonnel and detailed to ASPE.
PARTICIPANT: Gracie (word lost), NCHS staff.
MS. ADLER: Jackie Adler, NCHS.
DR. FRAWLEY: Thank you. When we last met in June, we were hoping that the privacy regulations would be out, and that we would be using this meeting as an opportunity to talk about how the subcommittee wanted to move forward with the publication of the final rule.
Unfortunately, John Fanning isn't here, so we don't really have -- he's circling? Okay. Oh good, right on cue.
What we wanted to do this morning is to take a little bit of time to talk about what the subcommittee planned regarding the implementation of the regulations would be, and what we would like to do as a subcommittee once the regulations are published.
As we heard yesterday from Bill Braithewaite, and I'm sure John will be able to give us some more information, there is a group seriously working on the regulations, and they are still committed to trying to get the regulations out as quickly as possible.
I'll give John a second to get settled. John, do you want to give us a little bit of an update as far as the privacy regs? Anything? No? Okay.
Basically, what we need to talk about is what we would like to do once the regulations are published, in terms of a plan for the subcommittee.
DR. COHN: Can I just ask a question on this one? We observed this during the executive committee, and I probably need to pull out the -- not the regulations, but the actual HIPAA law. I didn't get up to speed as to what is the statutory responsibility of NCVHS in relationship to a privacy final rule. At least as I interpreted it at one point, and I do need to go back to it, it appeared to me that our responsibilities for ground implementation were the same as for other final rules coming out of HIPAA.
Now, when I look around to everybody, maybe I should look at John also on this one, am I over reading the legislation or am I mis-reading the legislation on that?
DR. FRAWLEY: No.
DR. COHN: What is your thought?
DR. FRAWLEY: John?
DR. COHN: Was this handled somehow differently?
MR. FANNING: I don't have the statute with me. What I recall is that we are obliged to consult with you in publishing regulations. I don't know if there is any other obligation.
DR. COHN: I think the issue is whether or not we had a responsibility in terms of tracking implementation.
MR. FANNING: I don't know.
DR. COHN: And monitoring.
MR. FANNING: I'll look at the statute and a little later comment on it.
DR. COHN: Okay, let me take a look, and I'll give it to you.
DR. ZUBELDIA: I have a related question. The other standards are supposed to be updated or refreshed or renewed once a year, or no more frequently than once a year. Are you contemplating a process to review the privacy regs periodically, just like the other standards?
MR. FANNING: I don't know of any such process being planned, but I would rather guess that there will be such a process.
DR. ZUBELDIA: And the other standards have this group where you can submit changes and new standard requests and things like that. Is there something in progress for privacy equivalent to that?
MR. FANNING: I think we are having all we can do to get out the final regulation in a thoughtful, nuanced, effective text. I can't say this with absolute assurance, but I would rather guess that that has not been addressed.
It might have been addressed in the planning of Bill Braithewaite and his colleagues in planning more generally for what happens once the standards are published. However, the confidentiality regulation is somewhat different, and I think that the details of what happens next are yet to be thought about seriously.
DR. BLAIR: Is that significant, that you refer to it as the confidentiality regulations rather than privacy?
MR. FANNING: No, it is of no significance. I think privacy is not the correct word there; confidentiality is the correct word, but it doesn't really make any difference. There is no significance. Privacy is the term used in the statute. I think it is not the best word in the situation. I think confidentiality would be preferable, but it is of no substantive significance.
DR. ROTHSTEIN: My recollection of the statutory language is similar to John's. That is, I believe the statute requires that we be consulted in terms of the confidentiality regulations before the fact. It doesn't explicitly state that we have a continuing role.
Nevertheless, it would seem that a continuing role, even if it is not significantly set out in the statute, would certainly be consistent with the overall statutory mandate of the committee. I think the question that we need to resolve as a subcommittee is whether we think that is an appropriate use of our resources. In other words, there is certainly enough work to be done that we could engage in a full-time job of assessing, reassessing and attempting to measure the successes and flaws in the regulation, and never do anything else.
And so the question is one of priorities; should that be our first priority, even though it may crowd out all the other opportunities that we have to deal with issues of privacy and confidentiality. I think that probably is something that we may want to consider.
MR. FANNING: Your statute does say that you shall be responsible generally for advising the Secretary and the Congress on the status of the implementation of Part C of Title 11, which is the administrative simplification --
DR. COHN: Does this include the privacy --
MR. FANNING: Oh, yes.
DR. COHN: Okay. That was the -- not being a lawyer, I had a little confusion over that.
MR. FANNING: But I think Mark's analysis is correct. Even if it didn't say this here, obviously you could turn your attention to it within your general powers set out there, but it is not basically a legal issue.
DR. COHN: Actually, my own feeling is that the way this has all been going, I think we do need to look to some extent to the legislation for the legislative intent. The only role that the legislation Congress had received as plain was in the initial consultation, then I'd say what exactly should we be doing here. On the other hand, if it is stated explicitly in the legislation, it seems that we -- how we get into it is a whole other story, but it does appear that we do need to have some focus on tracking implementation and identifying the issues as it goes forward.
But once again, Mark, I agree with you; it depends on what level and how we focus that, because that can be not just a fulltime job, it can be a fulltime job for a room much bigger than this filled with people.
DR. FRAWLEY: If you remember, when the NPRM was published, we did spend a considerable amount of time in that short period of time working on a response which we sent to HHS. So again, I think that is why we want to take some time this morning to talk about what we want to do, and plan a strategy for the subcommittee. Obviously once their final rule is published, we know that NPRM received a lot of attention, because we don't have federal legislation in this area, so obviously the regulation will be very important to the industry. So it is a matter of deciding how we want to proceed.
Again, we are limited in terms of resources. There are only seven members on the subcommittee, and obviously there are only so many -- we have conflicts obviously with other subcommittees and other full committee activities. So I just wanted to get a sense of what approach we should be taking or are planning to take.
DR. HARDING: Also, I had understood or had seen the Congress is currently working on a proposal for a commission that is going to help recommend or oversee the privacy and confidentiality issues. Is that something that you all are aware of? There is certainly the word going around that there is a bill coming forward to create a commission on privacy, and I wondered if that would in effect overlap or displace our responsibilities.
MR. FANNING: Yes, I have heard that going around, too. It is in fact objectively verifiable. There is a bill, and it has been reported out of full committee in the House.
The view of the Administration is that any such commission should not delay other attention such as this regulation or legislation, in the area of health or financial services, since a great deal of work has already been done in those areas.
I'm not sure exactly what the letter to the Congress will say, but it is clearly the position of the Administration that this should go on, building on the work already done.
DR. ROTHSTEIN: I'd like to suggest a possible way of taking an active but limited approach to reviewing the effectiveness of the regs. That would be the following.
The full committee submitted as we all know a series of recommendations, and what we might want to do is compare our recommendations with the final rule to see how many of the areas in which we expressed concern were incorporated into the final reg.
The other thing that we might do is also, when an agency publishes a final rule that they have received a lot of comments on, it is customary to indicate what the comments were and whether they were adopted or rejected, and for what reasons. We could go through that statement for reasons for adoption or non-adoption and try to identify a dozen or so areas in which the non-committee commentators expressed particular concerns, and just track those issues to see whether -- let's assume that association X said we are concerned about this proposal because we don't think it will be effective for the following reasons, and let's assume that HHS considered it and they say, we considered it but we rejected it for the following reasons. Put that one on our radar screen and maybe follow up to see how that has worked out after a period of time, and do that with the ones that we have identified as important issues to this committee and then perhaps a dozen other major issues that have been identified by other groups that were not specifically addressed by the committee.
I think doing that is really the only feasible or perhaps one of the only feasible ways that we can look at this with our limited amount of staff resources and limited amount of committee resources, because we don't have the staff that HHS has, spending 100 people working full time on this. So if we focused our attention on a limited number of important issues, then we might have something valuable to say.
DR. FRAWLEY: Jeff?
DR. BLAIR: John, piggybacking on Mark's suggestion, which was that we might -- NCHS would focus on a selected number of areas where we had concern, is there the ability for there to be some feedback to us on anything where we made suggestions which have been altered, modified or deleted? Because in a sense, that might even help us zero in even more precisely on the ideas that Mark is saying.
MR. FANNING: I think that would occur after the regulation were published, and everyone saw what the preamble said in terms of accepting and rejecting particular suggestions.
DR. BLAIR: I just was wondering if there was an interim step or anything there. You are questioning something that we had asked for, and maybe you wanted more feedback on that or something.
MR. FANNING: As far as I know, there is no plan in that regard.
DR. FRAWLEY: Simon?
DR. COHN: I like much of what Mark was commenting on in terms of trying to focus the discussions. However, I am struck with -- probably for the first time that I can remember, we are faced with, do we want to think about this as high level policy issues, or do we actually want to deal with this as a real-world implementation.
As we look for example at the Subcommittee for Standards and Security, which now has a final reg, I think the approach that we had been taking was to actually ask the industry what are their issues, trying to identify issues, trying to pull out from them what they thought the most vexing things were and see if there were ways to mitigate some of the issues.
I think rather than us assuming that our foresight of two or three years ago was perfect, and that we understood all of the issues of industry and that that they are the same as today, it might make sense early on to begin to elicit some public comment, a better understanding of the issues the industry has in relationship to the implementation. That might help us focus some of those issues a little better. I don't know if you had thought about that in your process, but that is an overwhelming task.
DR. ROTHSTEIN: What I am suggesting is that we go to the comments that were submitted by the groups that you are mentioning, the various industry groups, find out what their concerns were, and try to make some sort of distillation of what their key concerns were, and especially the ones that were suggested to HHS and rejected, and then possibly, as we follow those through to see how well they have worked, then go back to those groups and say, you were concerned about X, and that was in your comment, but they didn't adopt it; how has what they actually did do -- were your fears misplaced, has it not been as big an issue as you thought it would be, or maybe things are even worse than you predicted, and all these terrible things are happening, and so then get a sense.
It would seem to me to be an overwhelming task to go to the groups now. We have got -- I don't know how many thousands of comments have been received, and to reopen the whole issue of the regulation is just something that we don't have the ability to do. But I think if we focus on some issues and find out what their views were and then go back to them and say, you wanted this, you didn't get it, are you able to live with what you got, sort of question.
DR. COHN: I was going to ask a question of Gail on this, since you are our main staff support. As we are talking about this stuff all of which directly affects you, what are your thoughts in terms of support staff, about your ability to support as we move forward in all of this?
DR. HORLICK: I think it has been my understanding that we would probably have additional hearings of some type, and that I would be primarily responsible for planning them, particularly in such a broad issue I would think I would need significant input from the committee.
DR. COHN: I think the approach we were taking involved some analysis. At least, that is what I was hearing. I was just wondering if the support staff is equipped to do some analysis of -- or looking across the issues.
DR. GREENBERG: She's a lawyer. I know you doctors, how you feel about lawyers.
DR. COHN: Hate them until you need them.
DR. HORLICK: I would really also have to look at what kind of time commitment that would take. That seems pretty extensive. I certainly would want to take on my responsibility here, but --
DR. GREENBERG: Also, what are these 100 people now working on the reg going to be doing after the regulation has been published? Maybe a few of them might be able to work --
DR. COHN: Volunteer to help.
DR. GREENBERG: No, seriously though, they understand certainly in different areas as well as anybody what the comments were and how they struggled with responding to them. Hopefully we could get some support.
In this case, it wasn't really feasible for the committee to participate in the discussions around the rule, making the way you did on transactions, but I would think that certainly once the rule is finalized, that HHS staff would be able to work with you to the extent possible.
DR. ROTHSTEIN: One possibility might be for after the final rule is published, for each of the subcommittee members to independently put together a list of, let's say, 10 things besides the ones that the full committee suggested, 10 additional issues that we view as particularly important points of contention that are mentioned in the preamble to the final rule as being important. Then we would each have our list, and then either by a conference call or by our next meeting of the subcommittee, compare our lists, and whittle that down to something manageable.
Let's say that we had a master list of 10 issues that we came up with. Then from that list, we could arrange to do a certain number of issues per hearing, and then it would be something manageable for Gail to put together a hearing on point A, and she would know from the comments that were submitted and other resources who the people are to get together for that hearing.
DR. HORLICK: Maybe I wasn't clear, but are you talking about after the final reg, that we would look at how people were handling the issues that were not addressed?
DR. ROTHSTEIN: Right.
DR. HORLICK: We could get a preliminary list together, but it seems like we don't know what is even addressed in the final rule yet.
DR. ROTHSTEIN: That's right, and I am not suggesting that we do this immediately. It is certainly going to take time. What we might also do as we go through our list, we might divide those issues into ones that we can look at right away and the ones that we need time to reflect on and the parties need time to reflect on, to see how it is working out. Then stagger our hearing schedule based on that, and the ones where we need some data and some experience, put those a year or 18 months out, and the ones where there is actually something that we can learn in the short run, closer to the -- or, on top of the schedule.
MR. FANNING: May I say something?
DR. FRAWLEY: Yes, John.
MR. FANNING: Note that the required compliance date is two years from the effective date, which will be roughly 60 days from the date of publication. While some organizations will no doubt be implementing it during that period, its true impact will not be very well assessed until a little time has passed.
DR. GREENBERG: I was a little late this morning. Was this discussion in the context of the annual report to Congress? It's broader than that, but has that come up, the annual report to Congress on implementation of HIPAA? Because I would think that this would feed into that as well.
DR. COHN: Yes, actually we started out reviewing the evaluation to see what our responsibilities were. And certainly within the re-chartering of the national committee, our responsibility for the privacy regs are exactly the same as for the standards and security, which involve a yearly report, but also ongoing identification of issues, tracking of implementation and all of this. So I guess the answer is yes.
But I do agree with John that as we look at any of these final rules, and I am just reflecting now on the administrative and financial transactions, the timing of hearings and listing comments is a very tough issue. You don't want to do it too late, and you also don't want to do it when everybody is in a flurry and hasn't quite figured out how they are going to approach something.
You want to capture people after they have settled down a little bit, figure out, is this really as bad as they thought or is it much better than they had hoped, or whatever, come up with some plans for implementation, or beginning to put their budgets together, to speak intelligently about an approach as opposed to, my God, I didn't get what I wanted, which I think maybe is what John is referencing, is the timing issues and the two-year window piece.
MR. FANNING: Yes, that is certainly part of it.
DR. FRAWLEY: Our next subcommittee meeting will be part of the full committee meeting in November, and that meeting is scheduled for November 28 and 29. We still don't know whether or not the regulations will be published by then.
So that is problem one that we are struggling with, that is, the uncertainty of publication of the regulations. But what I have heard from our discussion so far is that our plan would be for each of the subcommittee members to analyze the final rule against the comments that were submitted to HHS, identify key issues, and we then as a subcommittee would take each of our key issues and come up with a prioritization of those issues, come to some consensus on a manageable list of issues that the subcommittee would address, and then at that point probably decide to have some hearings.
So what we are really talking about is a work plan for 2001, because I am working under the assumption that at our November meeting, we may just have regulations published and we may still be in a waiting mode. Is that pretty much the consensus of the subcommittee, in terms of the approach we want to take?
DR. ZUBELDIA: I agree with that approach. I think it is probably the best thing we can do. I would like to plug in the states somewhere, because when the regulations come out, the states are going to do the same sort of analysis and find out if the regulations meet the state needs. If those needs are not met by these regs, will be met by the states with their own state laws. What I think we need to do is track those state efforts, and if we see an effort that is being made by multiple states to fill a hole, that should be brought up to the national level and have it filled uniformly rather than a patchwork.
I don't know whether we have the resources to do that or not, probably not, but somehow we need to get assistance to track those and make sure that they are brought up to the national level.
DR. FRAWLEY: Simon?
DR. COHN: Actually, I was going to follow up on Kepa's comment, because this has actually been an issue that I have been dealing with in my real job. This is not a future tense sort of issue. States are developing and passing privacy legislation for health care information. I think we're going to be in a worst-case scenario if we don't watch out. I think we have all seen the -- our desire is to have a good, uniform level of privacy across the country, and what I think we're going to wind up with is a patchwork quilt, depending on what jurisdiction you're in; yes, there will be this, but there will also be all of these additional changes, things that have to undergo analysis to figure out which is more rigorous.
Actually, I think it is too early to begin to get into some of those discussions, because it isn't as though the states are waiting for the federal government. Not that the federal government has not been prompt in all of this, but I am seeing a number of states that are passing legislation in the final stages of passage, and I think it is going to be a real issue for anybody trying to implement good privacy policies.
So I think obviously we need to prioritize that, but that is going to be I think one that is sort of obvious.
DR. ZUBELDIA: The feedback that I have been getting from some vendors' clearinghouses is that if a state requires something that has to be done for that state, and it makes sense, they are probably going to require the vendor -- multi-state vendors are probably going to require that in all 50 states, regardless. If they are going to have to do it for one state, they might as well raise the bar for everybody, because sooner or later, all the other states are going to require the same thing; they might as well do it.
We probably could look into that approach. If a series of states have an additional requirement, maybe suggest a new rank that comes out, the same as the standard ranks come out periodically, revisions to the privacy to meet more and more of the state requirements, so we have more uniformity.
DR. FRAWLEY: Yes, Marjorie?
DR. GREENBERG: I just wanted to mention that yesterday, the population subcommittee requested a three-hour working session at the November meeting. So just some feedback from this subcommittee would be helpful, because we are going to be having a conference call in a week or two to plan the meeting. If you did have longer breakout sessions like that, it would be an opportunity to have -- not necessarily in this regard, but to have testimony to bring people in.
DR. FRAWLEY: I'm confused. A three-hour session with us?
DR. GREENBERG: No, no, I'm sorry, just from the point of view of scheduling. I thought if you might have longer working sessions in November than these two-hour ones. Or if others don't feel the need for it, we might not. It would be helpful to have that feedback.
DR. FRAWLEY: We are in a quandary. Our problem is, we don't know what is going to happen with the regulations. We can leave here this morning and say, okay, here is the plan and this is what is going to go forward, and be sitting in November with no regulations being published.
DR. GREENBERG: Sort of like deja vu from last year, when we didn't know when the NPRM was going to be.
DR. COHN: My sense is, I'm not sure there is a whole lot we're going to be able to do in November, other than just to be able to talk about what the regs are.
I am going to put my pitch in for early in 2001, that the issue that Kepa brought up is one of the very obvious things that we ought to be getting some input in, probably a panel or a hearing looking at the reaction, which is going to take away from, do you like the federal reg or not, which is something I'd rather not do early on, but more like, how are you dealing with trying to figure out this crazy quilt, how much problems is that causing you, et cetera, et cetera. That may be something that you want to look at somehow during the first quarter of the year 2001, while we are figuring out our overall game plan and longer term strategy and relationship to this. Just a thought.
Mark, do you have any thoughts on that?
DR. ROTHSTEIN: My thought on the issue of what the states are going to do is, I can't see how this issue will not get challenged in court. So --
DR. BLAIR: What would get challenged in court?
DR. ROTHSTEIN: The nature of the pre-emption effect, the pre-emptive effect of HIPAA on state laws, because there are all different legal theories of how broadly a federal law pre-empts a state law. My impression -- John, I'll defer to you -- is that the scope of the pre-emption is not crystal clear under the law, and even if it were crystal clear, somebody would still say it is not crystal clear.
So I think overhanging any discussion of compliance with state laws is the issue. I can't imagine there is not going to be a lawsuit challenging the HIPAA pre-emption on state laws.
MR. FANNING: There may well be litigation surrounding this. With respect to the pre-emption issue, I might note that the statute says that we can't override a tougher state law. So if a disclosure is allowable under the federal regulation but not allowed by a state law, someone in that state may not make the disclosure. So in that fairly straightforward pre-emption situation, the statutes seems fairly clear, although there could be debates about what is more stringent and so on.
DR. ROTHSTEIN: And what state law is arguably -- even though it may be more stringent in some respects, inconsistent arguably in other respects and that sort of thing.
MR. FANNING: As you say, even if it were crystal clear, someone would come forth and say it isn't.
DR. FRAWLEY: What I am wondering is whether for our November meeting, to follow up on this issue in terms of the state activity, whether it might be worthwhile to invite someone from the National Conference of State Legislatures to brief the subcommittee on what type of activity they saw in calendar year 2000 in the states on this particular issue, and what they see happening in the coming year, because they do track obviously all of the activity at the state level.
So it might be worthwhile to get a feel for what the states have been doing in this area, or where they see the issue headed. Yes, Jeff?
DR. BLAIR: I remember six years ago, I guess it was, going to a meeting that Bob Gellman had pulled together when he was drafting the Fair Health Information Practices Act. This issue was one that he was struggling with, how does he craft a bill that could deal with this.
He had representatives from many different special interest groups that were either concerned about AIDS or mental health or drug abuse or genetic issues, all of the ones that have requested special protection in terms of privacy.
Is Bob here?
DR. FRAWLEY: No, he's not.
DR. BLAIR: I think it might be helpful to hear from him, the way he pulled it together, because the gist of what appeared was that if you have the level -- matter of fact, I believe he did these in negotiations. He basically wound up going around to each of them saying, what kind of protection do you feel is necessary, and that became the standard for everything.
So if the bar is set high enough, and they got them to agree that they wouldn't ask for additional protections if that was the bar for protection of health care. Again, this was like six years ago, and this is my general recollection of it, but I think Bob might be able to help us with this a little bit more.
John, do you recall this? Maybe you were working with him at the time.
MR. FANNING: I certainly remember the discussions, but I do not remember the content or the resolution the way you described it. It may well have happened that way. I simply had no occasion to remember it.
DR. FRAWLEY: Jeff, I think what we are really trying to focus on is the issue as far as the states.
DR. BLAIR: Right.
DR. FRAWLEY: The groups that Bob brought in were special interest groups, more along the lines of the mental health community, the AIDS community, other groups who were looking for protection for sensitive health information.
DR. BLAIR: I thought they were related, because I thought that those were the groups that were petitioning the states for higher levels of privacy protection. So that is why I thought it was closely related to where the states might be different.
MR. FANNING: Kathleen, yes, in fact it was that interaction that gave rise to -- as I recall, a provision in the Condit bill, which derived from those discussions, the federal law would be totally pre-emptive. In other words, states could not have a tougher law, except they could have tougher laws with respect to mental health and public health information. That was an effort to leave in place the tougher laws that those groups have achieved in the states.
Now, some further bills have picked that up, and there have been some modifications of it. Our department in its recommendations to the Congress did not make any distinction based on the type of information. What we did recommend to the Congress was that the federal law not pre-empt tougher state laws. What we asked the Congress was that they pass a law which would permit states to have tougher laws if they wish.
DR. ZUBELDIA: But there are two aspects to pre-emption. One is the legal pre-emption, the legal ability of the state to issue tougher laws, and the other is the practical aspect of it, that if the fair law is tough enough, the states don't have a practical need to pass anything tougher.
So you may not have legal pre-emption, but you may end up with the practical equivalent.
MR. FANNING: Yes, we have thought of that, although it seems unlikely to me that states that have now laws that they have worked very hard on in specific areas like mental health and HIV infection information, would modify those.
But I certainly see your point, that states may not feel compelled to legislate in this area if the entities in their state are already obliged to meet a high standard.
DR. COHN: I was going to come back to the earlier comment you made. I think this particular conversation is very interesting, but I'm not sure that it may be relevant to our situation, which is not what legislation we would love to see passed by Congress, but more the real world of, we're going to have federal regs coming down the pike, we've got a bunch of states doing various things, and I think we need to assess the environment.
So I think your idea of bringing in somebody to do a little bit of a briefing for the committee, to give us an idea of what the states are doing, would certainly be informative for me. It might help us figure out what and if we want to do something in 2001 about that. That is one person's opinion.
DR. FRAWLEY: Richard?
DR. HARDING: Just in a practical sense, we are proposing from what Mark is saying that we are going to try to monitor in some way the quote controversial issues, the ones where there have been extraordinary debate, things like consent and special protections and those kinds of things, and figure out a way to monitor them, and then give feedback to Secretary Shalala and her order of placement, figure out how to quantitate that somehow or other, say over a period of four years, I guess, whether that is working or not.
DR. ROTHSTEIN: I think that's right. And of course, the point that John makes, we should all keep in mind, that this is over time and not initially.
I think we will have done a service by simply identifying the main points of contention that still remain when the regs are finally published, because they are so difficult for many people to get a handle on.
DR. HARDING: Then the other part, Simon is proposing that we monitor the unintended consequences. Is that what you're saying? The states are going to start patching in for good or not, and so there are going to be consequences of these rules. There already are, but there are going to be more, and we need to monitor that or shape that. What are we doing in this committee?
DR. COHN: I actually thought that was an area where we needed to do a little information gathering. I like your concept of unanticipated consequences, but of course this is not so much unanticipated consequences of the federal regs; it is more the unanticipated consequences of various legislative bodies and administrative bodies making independent decisions, and how all this comes together. I thought that was actually a relatively narrow focus, but their reactions might be very useful and helpful.
DR. HARDING: We are creating a work plan for life, which is nice to go to retirement, or when our terms expire. But if that isn't going to be done by any advisory body, then it seems like that would be an area that we should be involved in.
Again, I have a little bit of concern that we are going to get into something and then be pre-empted by this new commission, perhaps, but that may be just a figment of my imagination, that a new commission will be looking at an overall government-wide aspect of privacy and confidentiality, and maybe we should stay the heck out of what we're doing here, and look at other aspects outside of banking and health. But I don't know that.
DR. FRAWLEY: The purpose of our meeting in November, do we want to plan on having a briefing from a representative from the National Conference of State Legislatures, to give us an idea on what is going on with state activity relative to confidentiality of health information?
I know that they had activity going on in updating the Uniform Health Care Information Act, so that was a model that was developed in the 1980s. I do know that they had put a task force together last year to work on revising that model. So they may be able to share some of their deliberations in terms of that effort.
I think that would be obviously one part of our agenda for the November meeting, and secondarily what we could do. I certainly would be willing to go back and look at our original report to the Secretary, and also the comments we submitted on the NPRM, and at least categorize some of those issues, so we have a working list just from that, which would at least give us something to start with in terms of recommendations that came out of this subcommittee to the full committee, and from the full committee to the Department on the NPRM. So that would give us a working list that we could then all use, so when the regulation is published, we could see from our own perspectives whether those issues had been addressed, or whether we have identified other issues.
I think one of the problems that Richard has raised is, then we go to operationalize this regulation, and I'm looking at it from a very pragmatic point of view, working in a hospital, when I have to go back and say, this is the regulation that we have to follow, and trying to operationalize it within an organization. There may be things that no one ever thought about, in terms of the realities of how some of this is implemented.
But at least we would have our working list of issues, what were identified in our first report out of the subcommittee, and then the letter on the NPRM, which would give us at least some of the key issues and concerns that we identified. Then obviously, we would have to take a wait and see approach in terms of the Department, as to when the regulations will be published. At least we have our work plan in terms of what we would like to do moving forward.
But I do think, as Mark indicated earlier, we are going to have to be very careful that we don't let this overwhelm us. I would hate to start having hearings where we have people coming in to testify in terms of what they want in the way of federal legislation, or how the regulation doesn't meet their needs, because I think we could wind up getting absorbed in terms of that. We know just from the NPRM, certainly it didn't cover all issues, and it is not going to address everyone's concerns regarding privacy and confidentiality.
So I guess we are going to be walking a tightrope in terms of our work effort on this particular issue.
DR. HARDING: Just as a practical issue, does the executive committee of the committee support -- do you feel they would support this activity that we are proposing?
DR. FRAWLEY: This afternoon we will give a report to the full committee, in terms of what our subcommittee discussion was this morning, and --
DR. HARDING: From the discussions of the executive committee in August, does that have any thought about people on the executive committee? Does it sound like what they have got in mind for us as a subcommittee?
DR. FRAWLEY: It is really the responsibility of the subcommittee to come forward with its work plan, and receive the blessings of the full committee. Obviously, the executive committee is there to provide guidance and resources as appropriate. So I don't think -- in terms of the executive committee, we do have a conference call in early October, but certainly we will report out this afternoon our discussion from this morning.
I think the discussion that came up in the retreat in August was the issue of the subcommittee structure and also the work group structure, and the concern that has been raised before that other subcommittees are addressing issues where privacy is on the back burner, and how do we resolve that issue; do we keep a formal subcommittee or do we take people with expertise in privacy and have them participate in the other work groups and subcommittees so that we always keep that focus front and center, as opposed to having a decentralized process, where after a subcommittee does a lot of work and issues a report, we then come forward and criticize it because there has been no input or any perspective addressed in terms of privacy concerns.
Simon?
DR. COHN: I was going to comment, Richard, that as we look at the process, we are actually still in the process of fact finding. I don't think we're at a point where we are making a proposal for -- at least, as far as I understand the conversation that we had as a preliminary conversation, we don't have a work plan sketched out for the next year that we are going to focus on this issue, that issue or that issue, write either letters or papers on these four issues.
So I think at this point, as you look at the work process we are proposing, this is the point at which we are talking publicly by January or February, we will be able to come forward to the committee and say these four issues really need an in-depth look, and this year we suggest we go forward on this. At that point, I think we get the committee saying yes.
But I don't know that one has to get approval from the committee to say, we are fact finding, we are identifying issues, we are going to have a briefing by the state to see if there are any issues over there. It is where we start delving in deeper is when you need to put something before the committee.
I was just going to make a comment about the briefing. One of the things that we should probably query before the executive committee session or otherwise is whether or not a briefing such as we are describing is actually of interest to the full committee, and maybe is an appropriate briefing for everyone as it would be for just the subcommittee.
I don't have an answer to that one, but it might be of some general interest.
DR. FRAWLEY: Yes, Richard?
DR. HARDING: My question was one of a zero sum game. In my opinion in the last several years, probably privacy has gotten a disproportionate share of the full committee's time and energy, because of the referral from HIPAA and so forth.
I kind of read between the lines and comments yesterday and so forth, that maybe it should be pulled back to its appropriate level. That may be correct. The national committee has lots to do, and privacy is only one small part of that.
I was asking just as a general feeling, is there a feeling that maybe we should pull back a little bit on the proportion of resources and energy that privacy takes from the full committee? Or should it stay at its present level? That is a philosophical issue that I'm not saying one way or the other on. But I had that feeling yesterday that that was being discussed indirectly, and may be something that we want to talk about directly.
DR. FRAWLEY: Jeff?
DR. BLAIR: My feeling is that the Subcommittee on Privacy should be kept at its present level. Richard, the reason that -- and I understand that we may have some lulls here, like this meeting. We don't have all that much substance to be able to review and decide in this particular session, but the reason that I think that it should be maintained, number one, is for its focus. It may become a lightening rod, and we really have to be very, very careful in everything we do in this area, to make sure that this doesn't upset the apple cart for all of HIPAA.
That is number one. Number two is that just from the viewpoint or perspective that I have from the Subcommittee on Standards and Security, when we start talking about the financial and administrative transactions, or even especially the standards of the patient medical record information, if we are not successful in having appropriate relevant, effective legislation on protective privacy of health care information, it affects these other areas. If the public at large does not feel that their health care information is safe and secure, their willingness to move forward with standards for patient medical record information or the implementation of that in computer form could be severely impaired.
So I feel the focus is deserved, and I don't look upon it as an isolated issue. I think it affects what we do with financial administrative transactions, and code sets, and patient medical record information.
DR. FRAWLEY: Simon?
DR. COHN: I think Richard, also I like both Jeff and Mark yesterday personally conclude that the subcommittee is very important and needs to be continued.
I would observe that as you look through the notes from the executive committee last time, the discussions around privacy and confidentiality were actually intended to reflect on how we can be most effective in the area. Actually, it was a suggestion that was floated by one of the members of the subcommittee with the intention of being more effective in getting the issues more appropriately addressed, as opposed to any sort of a statement that this was a less important area, or should be somehow put in its rightful position.
I personally think that the subcommittee needs to be continued. Certainly, as one reads the federal regs, I can't think of anybody else that can monitor the implementation as required under HIPAA, at least until further federal legislation comes in.
DR. FRAWLEY: Elizabeth?
MS. WARD: I think for me, the real issue is how to integrate better what the single subcommittee is doing into the other subcommittees, not the level of effort. How can you have a committee that needs to spend its own time looking at this issue also go to all the other subcommittee meetings. That is what is missing to me.
Sitting in the other committee meetings, we are missing the expertise that this committee has developed in all of our deliberations. When we have gotten into stress is when our committee has become very concentrated on an issue and then found that we have not been addressing the privacy component of that in a more appropriate fashion. If you all had nothing to do, you could go to all of our subcommittee meetings, including your own. To me that is the issue, not doing less.
DR. BLAIR: Could I ask a question? The impression I had was that we had a risk of that and exposure of that, but like for example the way the agenda, Elizabeth, was set for these two days, I kind of thought that we are dealing with this, not by changing the structure of the subcommittees and work groups, but we are dealing with that in the way that we are setting the agendas for these meetings.
So for right now, all of those of us who are involved in other committees or work groups on the NCVHS are available to be here this morning, because the agenda was set up where there would be no conflicts. Now, I may be missing some other examples of what you are thinking of.
MS. WARD: This morning has helped, but again, it is what is here now at the table is the confidentiality subcommittee, not the whole group, nor are you in your expertise being well integrated.
DR. COHN: I hear what you're saying, and I reflect on that, and I think that some of the issues that cause me to make those comments, one thinks about some of the papers that had to go back and get rewritten.
However, as one reflects on it, in some ways it is really not as though we weren't all involved in the process. By we, I also include you in these discussions. It is more our own personal lapses, that we get off into one thing and tend to compartmentalize things. In reality, we all have been involved in most of these other projects and most of these other production of papers and otherwise. So it isn't as though we can say, gee, if only we had been there, because we were generally there in all of this stuff.
So I think we just need ourselves to be more vigilant on these issues. That was the conclusion I came to as I thought about that. I don't know.
MS. WARD: I think it is more problematic.
DR. FRAWLEY: Mike.
MS. WARD: I just think we are still facing how to use a very limited resource in getting it. I'm on both committees, I'm on this committee and the population committee. This is the first time in a year I have been able to actually come to a confidentiality subcommittee, because they usually meet at the same time.
DR. BLAIR: Ah, maybe then you have put your finger on it.
MS. WARD: It's just the organizational issue. Richard has had a similar problem. We divided it up and Richard has come to more of these and not gone to the population meetings.
DR. HARDING: I've had to drop off the population because of that.
DR. FRAWLEY: We have the same problem. Yesterday afternoon we had the Subcommittee on Standards and Security and the Subcommittee on Populations. So many of us here are on Standards and Security, so we wouldn't even be able to go to the Subcommittee on Populations if we chose to, because we always shave a conflict in terms of the subcommittee schedule.
So I think that is a real challenge, is how to be able to take the expertise of the committee members and appropriately use it.
But to go back to Richard's original comments, I don't think there is any intent to lessen the focus at either the full committee or at the Subcommittee on Privacy. I think the problem that Elizabeth articulated is that there is a need in the other subcommittee for individuals with particular expertise to help them in their deliberations.
The problem that we face when we were discussing the executive committee is how do we structure the full committee meetings so that -- and there was some discussion in the briefing material from that discussion at the full committee meetings; we need to know why we have something on the agenda, whether it is a briefing for a particular purpose, whether it is for information only, whether it is an action item. Maybe the full committee meetings need to be shorter with more time given to subcommittee and work group activities.
But the challenge to all the groups is how do you schedule things so you don't have these conflicts. That is the problem, is the issue of how to approach it. So I don't think there is any sense that we lessen our time or our focus on the issue, but how do we spread more resources to other subcommittees to provide that insight, as opposed to having reports come into the full committee, or having the other subcommittees feeling they are not getting some perspective or insight from our subcommittee.
So that is how the discussion went forward. But I think that is something that we are going to struggle with, how do you be in two places at the same time, in terms of that.
Does everyone feel comfortable then as far as November, moving forward with the concept of having a briefing from the National Conference of State Legislatures? We will bring it up at the full committee this afternoon to see if it should be a subcommittee briefing or if it should be a full committee briefing.
Then the other thing is, I'll put together an analysis of just the issues that we identified in our report to the Secretary and then our letter to the Department on the notice of proposed rulemaking. Obviously, we will be in a waiting mode. If the regulation is published, then certainly I'll communicate out to all of you if we are going to change our strategy for the November meeting. But if the regulation is published, then obviously we would use some of our time to start our identification of key is and prioritization of issues, depending on the time frame.
Anything else in terms of that particular topic?
Since our last meeting, what was sent out to you in your packet of materials for this meeting, the final report of the Federal Trade Commission Advisory Committee on Online Access and Security was published.
If you remember, we did have hearings last spring on e-health issues. At that time, the FTC was also engaged in some efforts in that area. So what you have is a copy of their report and recommendations on online access and security.
What I put in your packets for today's meeting, which you haven't had a chance to see, is, the American Health Information Management Association also convened a working group of individuals in the health care industry and consumer groups to come up with principles to protect the privacy of health care information on the Internet. There are a number of principles that were developed by AHIMA.
What I thought we could spend some time doing is just discussing the FTC report. Obviously you haven't had a chance to look at the AHIMA recommendations on the personal health information on the Internet, but I just wanted to spend some time as a subcommittee talking about the issue to see if there was anything that we felt that we needed to do on this particular issue, whether we want to bring closure to this issue, whether we want to continue to monitor it, how we want to continue to proceed.
So I just wanted to throw it open for discussion, in light of the fact that there has been activity by other groups besides this subcommittee.
DR. ZUBELDIA: When did this come out, the AHIMA?
DR. FRAWLEY: The working group was convened in May, and this was published recently. So it is available from the website, but it was just recently published. But they did hold a meeting in May to do work on this particular issue.
DR. COHN: I just have a basic question. Not being a lawyer, I sometimes get confused. Not being a legislator, I can get more confused about the impact of some of these reports.
Maybe you can all clarify it for me. As I look at this FTC Advisory Committee report, it appears to me along the same lines as papers that we write and send off to places. Does it have any more impact than that?
I thought it was a very nicely written document, but it didn't appear to me to --
DR. ROTHSTEIN: I think it has less impact.
DR. COHN: I guess I was wondering if there is something here I am missing about, is there going to be some action taken or something coming down the road, or is this just something people need to think about, that we may see something from the FTC in the next couple of years?
DR. ROTHSTEIN: I don't imagine that anything is going to come of this for a couple of reasons. Number one, the structure is just to make some recommendations. Number two, the persuasive power of any document that is recommended to a federal agency or Congress ultimately depends on the case that can be made within that document for doing something. In other words, the merits of the report. In my judgment this report has no merit. For that reason alone, nothing will -- as long as I have hinted about my views, --
DR. FRAWLEY: I'm just curious as to why you think it has no merit.
DR. ROTHSTEIN: I think the obvious problem is that it takes no position on anything. The issues are very contentious, and that is the danger of having a committee that represents all interests, and they don't vote on anything. To expect consensus from such disparate groups is impossible. They didn't want to say by a 10 to three vote we did this, and by an eight to seven vote we are recommending that.
So their only value is to set out the areas of contention. I think many people already recognize what those areas are.
The biggest problem I found in this document, aside from the fact that it didn't take any positions, was that it didn't make any sort of attempt to answer the fundamental questions that I think have to be answered in this area. I just jotted a few down as I was reading this.
Number one, they don't address the issue of whether online access policies should differ from other access policies, which strikes me as a very fundamental question; should different standards apply to material that is online versus material that is in other forms.
They don't address the issue. Now, this one is on all sorts of stuff. It is across the board. They don't address the issue explicitly on whether the nature of access should depend on the nature of the information. In other words, should medical information be different from say consumer spending habits or demographic data, or even within that, whether some kinds of medical information should be subject to, from our standpoint, an issue that we should address, a more heightened level of protection, such as HIV records, psychiatric records, et cetera.
So that is something. I think where we would want to go in my personal judgment is not in this direction, spelling this type of detail out, but just in getting more general principles that I think a group such as this could push.
By that, I mean I think a reasonable starting point would be a principle such as access to health information online, should be at least as extensive as offline access, currently available under state law and HIPAA. I think that is a basic principle that most people could agree with on its face, and others would need to be fleshed out.
Or for example, disclosure policies. In other words, disclosure of information to consumers about what their privacy and confidentiality policies are online, should be at least as extensive online as exist under state law and as mandated by for example professional ethics requirements now. So when you see your physician, you are theoretically told, I'm going to take this record of your psychiatric history, and here is how I am going to protect it.
So that is why I think this document is particularly disappointing, because it doesn't address any of those concerns. If we were to revisit this issue, I would like us to go in that direction, as opposed to trying to get a vote by six to five on every one of the points that went down here in the FTC report.
DR. COHN: I think this is a very interesting issue and one that is very pertinent to the committee. Obviously the question gets to be what impact will final regs have on resolving some of these issues. I suspect the answer will be, in some of the cases there will be direction, in other things there won't be any direction, because they will be judged not to be covered entities. That would be how I would describe the likely outcome there.
Having said that, I tend to be persuaded that this is probably an issue we need to wade into a little more next year as being somehow out of scope of what has been handled up to now, assuming that final regs don't do something beyond what we expect they would do.
Mark, do you have a comment on that?
DR. ROTHSTEIN: I agree.
DR. FRAWLEY: Any other concerns regarding that report? I need to get a sense from the subcommittee, do we want to do anything more in the e-health area?
DR. COHN: Maybe I'll re-speak on that one. As a comment, I think it is very important. I think we need to make sure what the issue is after those final regs come out. But I personally think that we need to be early in 2001 doing something, again looking at this area.
If you remember, we did something and then deferred it to the FTC, recognizing that they were looking at that area last year. If the results of their looking at the area is this report, clearly we need to go back and take a look at it from the health view.
So this was just -- unless there is some other report that they have produced that I'm not aware of; is there anything?
DR. FRAWLEY: Not that I'm aware of.
DR. COHN: As I said, it has to be done with the knowledge of what is going to be done in the final regs, recognizing that that will solve some of the problems, but obviously not all of them. Other comments?
DR. BLAIR: Did I hear you ask the question about e-health?
DR. FRAWLEY: Yes.
DR. BLAIR: Privacy and security? The feeling I have on this is that it is part of the overall picture of privacy and confidentiality, and it does deserve monitoring and attention. However, however, the impression that I have is that with the FTC focus, Congressional focus, and the fact that when an individual volunteers to put their health care information into a consumer health record, there is much more of a direct relationship, where you can identify more direct accountability. We already are getting public focus on that.
So my feeling is that protective actions are being taken there, and people can be held more accountable there, more easily than in a provider-payer environment, where the accountability is more difficult to pin down, where the individual or patient has far less choice in terms of what health care information they volunteer.
So I feel as if the weight of our focus should remain where it has been with respect to privacy and confidentiality of health care information within the provider sector, and to the extent that that extends to the other covered entities of payers and clearinghouses, because that is where I think the consumer needs the greatest protection, and they have the least handle on being able to exercise protective action.
DR. FRAWLEY: Simon?
DR. COHN: Jeff, I am actually surprised in some ways by your comment. I know you sit on the work group for the national health information infrastructure, and recognizing that they have the paradigm of talking about the consumer health record and the provider health record and the administrative quality health record, and how all of these overlap, and why the airwaves data move easily from one to another. You all know the vision.
To come up with a comment that somehow the consumer record is different from these other things in terms of requirements, I think in some ways I would characterize the consumer health record environment has more to do with the wild west, in terms of, let the buyer beware, the buyers in many cases are not sophisticated enough to appreciate many of the security pieces, assuming that anyone even looks at them.
I will tell you, at home the response I get on the Internet when I start opening up websites, I don't wander around extra screens typically, when I go from website to website. I don't look in every security screen of every website I encounter to even know when I am moving from one to another.
Having said that, I think there is a legitimate issue here. I personally think that there is some sort of responsibility at some point for some sort of statutory involvement to assure the privacy and confidentiality of this information.
DR. BLAIR: I wasn't saying that we shouldn't monitor it or focus on it. I just felt as if FTC reaction seems to be fairly swift.
I guess my thought is that in terms of where our help is needed the most at this particular time, and I felt as if it is with respect to health care information that is gathered by providers and payers right now. It may switch. It may switch. We may find that the actions that are being taken now to try to protect the privacy of consumer health records may fall short. I think we ought to monitor that.
The other piece that I think you just made, which is I think a very valid one, is that maybe my initial comments were to look at these as separate domains. You are absolutely right; the information flows from one domain to another, as in the NHII. That is another reason why we need to continue to monitor the privacy of consumer health records.
Does that bridge the gap between the two of us?
DR. COHN: Sure.
DR. FRAWLEY: So obviously we are going to keep this on the subcommittee's work list, as far as monitoring, particularly after the final regulations are published, to see to what extent some of the issues that we have raised are addressed, and then obviously monitor developments in this area, to see if there is something that we need to do in 2001.
What I would like to do is open up the agenda to other issues or concerns that members of the subcommittee want to raise, in terms of our work plan in 2001.
DR. ROTHSTEIN: I have a question. The question is, what does it mean to be on our work plan? There are a lot of things that theoretically on our work plan, that I don't know what that means. There is a list that includes EAP information, employer access to medical records, insurance company access, smart cards, and the list.
So what does it mean to simply add e-health to that list of other things that are just out there somewhere?
DR. FRAWLEY: Obviously it would direct our activities in terms of how we move ahead. We have already identified the fact that we have a strategy for addressing the final regulations and how we move forward. But then at some point, that work effort may subside, and it would be then, what issue does the subcommittee want to move forward on. So that is a working list for us, in terms of issues that have been identified, that we may want to have a briefing on, hold hearings on.
DR. ROTHSTEIN: I suppose the question was, I am assuming that everyone agrees that those issues that I rattled off and the others -- I don't have the list in front of me -- are things that the members of the subcommittee believe are worthy of further investigation. So how do we get from there to actually the implementation phase?
DR. COHN: If I can comment, because I think you are bringing up the issue that the term work plan is really not the right term. It is more of an issues list. I think what we need to do is -- I don't think we're anywhere near a work plan development at this point. Maybe in November we might have a work plan for 2001. But I think there needs to be something -- we don't have the final regs. We certainly need the final regs to figure out what the priorities are and what we ought to be doing and to what end. At least, that would be my view on this one.
So I think we are left right now with an issues list. Many of them I think are way down on the issues list, but I think at some point before the end of the year really focus in on not just the issue is, but the intent of doing something. Usually I tend to think of things as not just the issue, but the outcome of an action. Unless I am convinced that there is some reasonable outcome that can be achieved, I don't want to go down that road. That is my own personal --
DR. ROTHSTEIN: No, I agree with the statement. Just because something is on an issues list doesn't mean it is feasible or ought to be our top priority. Some of those things, if we wanted to study them, would require a lot more work than others. So I am just trying to move the ball a little bit, and try to get some more concrete sense of, okay, this requires a report, this requires a hearing, this requires whatever, and what our priority list is among those items that have been identified on the list.
DR. FRAWLEY: I think that is something that at our November meeting we will be in a better position -- and certainly when the regulations are published, to be able to identify. Some of the issues that are on that list may very well be addressed as part of our work effort on the regulations, and some of them obviously will not be, and then we will have to decide as a committee whether we want to do anything on those particular issues, or just leave them on a back burner. But there may be other things that come forward that are not on the list at all right now, that we may decide we need to address.
So I think it is kind of at this point that our work effort for the coming year is primarily dictated by the regulations, and then secondarily by what we think we can reasonably address. Again, that depends on whether it would be the approach of a briefing or a hearing. I don't know in terms of reports whether we would have the resources to commission a paper or something like that. But I think that is something we would have to discuss with the executive committee.
DR. SCANLON: I just might say that in planning resources for the next fiscal year, we anticipate that there will be funding available for contracts or commissioned papers or some of that.
So I think you're right. With the potential regulation coming about, you almost need a plan A and a plan B, one that more or less focuses the work plan on issues that will clearly be evident in the regulation, in terms of needing followup, hearing, clarification and guidance. Then others, should the regulation -- whatever happens to the regulation, are there other issues that would be worth pursuing, fact finding hearings, analytical papers, commissioned papers, just bringing folks together in a convener role that would lead to some work product later.
So it is kind of a difficult stage, because you don't necessarily want to take on a whole new area. You obviously want to look at what the framework looks like in the regulation. There are clearly areas that you would want to pursue; the regulation could only go so far.
So in a way, you do need a flexible plan at this point, and then over the next few months hopefully it will become clearer.
DR. FRAWLEY: Simon?
DR. COHN: I made this comment before to the executive committee, so this is certainly nothing secret. But my own view of the national committee generally is that we are not uniformly affected. I said it nicer than I even intended, but there are areas where we don't follow through, or there are things where we take the first step, and then take the second and third.
In my own view, and once again I'm just looking back at the executive subcommittee retreat summary, I think all of us observed this, in terms of, we hold hearings and nothing comes and we never do an add-on step, and there is not a cohesive game plan. I think it is really wise to try to put in this structure where we systematically identify issues, set priorities, develop strategies, et cetera, et cetera. Then before we get too far down that road, we are going to check in with the full committee to make sure that given our limited resources, that it was something everybody felt was important enough, so we don't wind up writing major reports and tremendous amounts of time on something the whole committee doesn't think is worthy of everyone spending that much time on.
So I think we're at a point now where we are talking about identifying issues, we're almost to where we want to frame them, but we need the other information. But hopefully with this new structure, it might prevent us from backing down a road and then discovering that there is only one Indian there. At least, that is my hope. I don't know if that is going to work or not.
Certainly, I guess I would hope that in November, that we can actually not just come up with the issues of, do you want to hold a hearing on this issue, but hold hearings on these issues with these expected results, and coming up with something that will make a difference that we can articulate for ourselves and to the full committee and to others, so that we can move into the area of being strategic.
It may be a wild hope, but, anything else on that, Mark?
I do on a slightly different topic, before I forget, I want to mention -- most of you are on the Committee on Standards and Security. I know Mark is, and Elizabeth is. But there is actually going to be a hearing that many of you may want to attend in October, that has to do with digital electronic signature. Kepa is helping to organize it for the Subcommittee on Standards and Security.
Now, certainly electronic signature and digital signature is security, it isn't privacy and confidentiality. But I think we are all well aware of how much they overlap. There is just a commonality of interest there. This will be October 26 and 27, and just it may be worth -- I suspect some of you may actually be called to testify. But beyond that, it may be worth everyone's time to attend.
DR. FRAWLEY: Any other issues or concerns that members want to raise?
DR. HARDING: Would it be possible, following up on Mark's comments, to have some e-mail between the subcommittee about what has been on our plate and some thoughts among us as to what might be on the higher level of priority, just to begin that process between now and the November meeting, so that we could begin -- do we have that ability, to have a listserve or anything, or is that not easily done?
DR. GREENBERG: Maybe all of the subcommittees would like listserves, I don't know. No?
DR. COHN: I personally would vote for an e-mail distribution, unless you have --
DR. HARDING: Just a way that we can begin hearing peoples' thoughts and so forth as they respond to things, in some place other than just these meetings.
DR. FRAWLEY: Sure.
DR. HARDING: The one that always gets access going is employer access to patients' medical records. We have had testimony, and people go crazy over that issue. Also, sale of medical information. Those are two that are always full of emotion when people come and testify about those issues. Those would be the kind of things that I would see moving up the agenda.
DR. FRAWLEY: Any other comments? Well, then I would move that we adjourn.
(Whereupon, the meeting was adjourned at 9:45 a.m.)