The National Committee on Vital and Health Statistics was convened on Wednesday, November 3, in the Georgetown Holiday Inn in Washington, D.C. The meeting was open to the public. Present:
Dr. Lumpkin welcomed three new members to the Committee: Andrew Kramer, M.D., Mark Rothstein, J.D., and Kepa Zubeldia, M.D.
The Department has just published the NPRM on health information privacy, and the Committee has until January 3 to submit comments. Mr. Claxton reviewed highlights of the proposed privacy rules, focusing on these topics:
The proposed privacy rules cover information that has been maintained or transmitted electronically, including all manifestations of that information including those on paper. The standards apply to all health plans, broadly defined, all health care providers conducting electronic transmissions covered by HIPAA, and health care clearinghouses. Important overarching rules pertain to the use of the minimum amount of information necessary, the responsibility of covered entities for the actions of their business partners, and the concept of de- identified information. The proposed rule does not preempt state, federal, or tribal laws that are more protective of privacy. Complaints and enforcement will be handled by the HHS Office of Civil Rights.
Mr. Claxton answered questions and fielded comments from the Committee. Regarding reviewing public comments, he said the Department "wants to get this right" and will talk with as many people as possible. This includes consulting with NCVHS.
Later in the meeting, the Committee agreed on a process for developing comments by the January 3 deadline (see Action Items). It subsequently discussed the NPRM further, identifying several topics on which it wishes to comment. (See detailed summary below.)
The group agreed that the Committee's letter to the Department on the NPRM should refer to the NCVHS privacy recommendations as the standard for what is needed regarding privacy, acknowledging that the NPRM has a narrower scope. The letter will reflect the diversity of viewpoints on the Committee, and report votes. In the conference call, votes will be taken on individual issues where there is a controversy, as well as on the full report.
Dr. Iezzoni presented the revised Medicaid Managed Care report. Following discussion and some minor adjustments, the Committee approved the report. (See action items.)
Mr. D'Angelo reported on the Department's plan to improve the collection and use of race and ethnicity data, outlined in a forthcoming report. The plan is the product of the Data Council's Working Group on Racial and Ethnic Data and of a group working on the Department's initiative to eliminate racial and ethnic disparities in health. The plan is to develop an overall Departmental strategy, linked to the six priority areas in the Disparities Initiative.
The report stresses that race and ethnicity are sociocultural as well as biological concepts. It concludes with ten major recommendations, and recommends specific action steps in the categories of data collection, data analysis and interpretation, data dissemination, and data research and maintenance.
The report will be submitted to the Data Council for final approval and then widely circulated. A detailed action plan will be developed with the Council.
It may be possible to use the meetings of the Subcommittee on Standards and Security on December 9-10 or January 31/February 1 to review the claims attachment NPRM. If these meetings do not work, a conference call will be scheduled. The comments developed by the Subcommittee will either be reviewed at the February NCVHS meeting or in a specially- scheduled conference call. This procedure was approved by unanimous vote.
Dr. Lumpkin reported that the 50th anniversary symposium will be at the National Academy of Sciences main building, with a reception following, on June 20. The agenda is being planned by the Executive Subcommittee and the Work Groups on the NHII and 21st century vision for health statistics. Written documents will feature status reports of these two work groups as well as an update of the 50-year history. Subsequently, all three will be published along with a report on the symposium.
Dr. Lumpkin called the meeting to order and asked everyone present to introduce themselves. Three new members were welcomed:
Dr. Lumpkin introduced the first presenter by noting that the Department has just published the NPRM on health information privacy, and the Committee has until January 3 to submit comments.
Mr. Claxton said his ASPE office wrote the NPRM on the basis of the Secretary's privacy recommendations, which NCVHS had influenced through its recommendations. He reviewed the highlights of the proposed rules, focusing on these topics:
The proposed privacy regulations cover information that has been maintained or transmitted electronically, including all manifestations of that information including those on paper. The Department is asking for comments on this and every other aspect of the proposal. The standards apply to all health plans, broadly defined, all health care providers conducting electronic transmissions covered by HIPAA, and health care clearinghouse, and (through contracts) entities doing administrative procedures on behalf of plans and providers.
Information can only be disclosed when it is authorized either by the Department's rule or by the individual to whom the information pertains. There are standard forms and processes for authorization by individuals. The rules authorize disclosure for research, public health, oversight, and law enforcement, among other purposes. Disclosure is never required (as opposed to permitted), except so that individuals can look at their own information or so that the Secretary can enforce this rule.
There are three important general rules. The first is the concept of minimum necessary information for uses and disclosures. The NPRM recognizes the varying abilities of organizations to delimit information, but an effort is expected. Second, plans and providers (covered entities) are required to have contracts with business partners (who are not covered by HIPAA), containing requirements regarding the use of information. The plans and providers are held responsible for bad acts by business partners. Third, the rules dictate an approach for creating de-identified information, i.e., protected health information from which identifiers have been removed. If these steps are followed, the other rules do not apply to the use of that information. The Department has committed to providing guidance periodically on what it means to de-identify information, since this area of knowledge is evolving. In general, sophisticated entities will be held to a higher standard than those who rarely do disclosures.
Another aspect of the rules is that people have a right to see their own information and make copies of it, and to ask for notations if information is inaccurate or incomplete.
Mr. Claxton reviewed the administrative procedures for carrying out the rules, including notification to patients and enrollees regarding disclosure. Covered entities must document their privacy practices and have a privacy official.
The proposed rule is intended as a floor and does not preempt state, federal, or tribal laws that are more protective of privacy. Complaints and enforcement will be handled by the HHS Office of Civil Rights. New funding will be sought for this purpose. A complaint procedure is established in the regulation.
Mr. Claxton referred the Committee to the press release that came out with these proposed rules. In it, the Department comments on the limitations to its authority.
Asked about the plans for reviewing public comments, he said the Department "wants to get this right" and will talk with as many people as possible. This includes consulting with NCVHS. All recommendations will be noted in the comment record.
He and Dr. McDonald (who praised the document for its clarity) discussed the implications of the rules for academic research.
Regarding the timing of implementation, he said it is the same as for other standards: two years after the final is published, or three years for small plans.
Mr. Gellman praised the Department's "good-faith effort" but expressed a few concerns. One relates to the looseness of the term "disease management" in defining treatment, thus opening the door to commercial uses. Mr. Claxton said the intent is to use the Department's enforcement guidance rather than the HIPAA rules to tighten definitions and prevent abuses, because provisions in HIPAA are locked in for two years. Mr. Gellman praised the narrow definition of health care operations. He then commented on the broad exemptions for some federal government agencies (not including HHS) and for law enforcement.
Asked about de-identified information, Mr. Claxton said entities themselves are to determine whether they are required to meet the standard for de-identification. As in many other areas, he said considerable comment is expected on this issue, and the Department may decide to provide guidelines about it. He confirmed that there is no way to prohibit the non-covered recipients of de-identified information, given in good faith, from trying to re-identify it. This is one of the many reasons why the Department is calling for comprehensive federal legislation.
Dr. McDonald expressed concern that the more stringent requirements of IRBs, combined with current pressures on hospitals and a litigious climate, could result in a refusal to disclose any information. Mr. Claxton said HHS hopes for a lot of comment on all aspects of this issue.
In response to a question about what aspects of a medical record are and are not covered, he said the safe approach is "to treat everything as if it is protected." The Department has asked for comment on whether to attempt to cover all paper records in covered entities.
To another question, he described the principle of scalability, whereby different amounts of effort and expense are expected of organizations of different sizes and levels of sophistication.
Mr. Claxton and Dr. Cohn discussed the comparative scopes of the proposed rules for security and privacy.
Noting that a lot of comment is expected on this topic, Mr. Claxton explained the thinking behind the shift from informed consent to what Dr. Harding called "presumed consent." The strongest argument for the change is that so-called "consent" has in fact been effectively coerced as a condition of treatment. The Department seeks help with implementation in this area, and is open to strengthening the privacy protection here if the burden is manageable.
(Note: The following two agenda items are presented out of chronological order to consolidate the items on the privacy NPRM.)
Ms. Frawley recommended that the Subcommittee on Privacy and Confidentiality draft a letter for the Committee's review, sending it to the full Committee by December 8, with a deadline of December 22 for comments. This will allow time to get final comments to HHS before the deadline. Ms. Greenberg suggested that the Executive Subcommittee look at the draft comments at its December 7 meeting. Dr. Lumpkin said a Committee conference call would be scheduled, with provisions for public involvement. The Committee will vote on the comments at the conference call.
This procedure was approved by unanimous vote.
Members agreed to reinforce the Department's comments about the continuing need for national privacy legislation. Dr. Iezzoni suggested that Ms. Frawley's Subcommittee tap the expertise of the Committee members who are researchers. Mr. Gellman observed that it is likely that the Committee will be unable to reach consensus on aspects of the comments, so provisions should be made for expressing multiple views.
The purpose of this discussion was to provide input for the Privacy Subcommittee's deliberations. Dr. Lumpkin proposed that the Committee focus on priority areas within the NPRM. The group agreed to use the page numbers in the Federal Register document for reference in the Committee's comments. Mr. Fanning and Ms. Horlick joined the discussion.
The following issues were among those identified as warranting comments:
The following paragraphs summarize major themes of the discussion.
Mr. Rothstein observed that this HIPAA proposal has a very narrow focus and should not be confused with comprehensive medical privacy legislation. It deals primarily with the unauthorized disclosure of medical information, and does not address questions of when it is permissible to require persons to authorize release of medical information, nor questions about third-party users. Protection against discrimination is offered through the Americans with Disabilities Act, but that does not prevent access to medical information.
The discussion returned to the question raised earlier by Dr. Cohn: whether the privacy NPRM, like the security NPRM, covers information that is maintained and/or transmitted electronically. There were differing views on the interpretation of the rules, and Ms. Horlick agreed that various interpretations are possible. Dr. Zubeldia submitted that the ambiguity and hair-splitting about what is and is not covered makes the rule unenforceable. Mr. Fanning and Mr. Scanlon said the preamble asks for public comment on what the scope of the rules under HIPAA is and should be.
Mr. Gellman commented on the many roles played by "employers" and the resulting difficulty of fashioning applicable rules or legislation. He also stressed that it is impossible to assure the confidentiality of records, as many kinds of disclosure are authorized; the best that can be sought is fair information practices.
On the subject of de-identification, Mr. Gellman said that while the NPRM approach is better than most, the reality is that there may no such thing as "de-identified data," as demonstrated by Latanya Sweeney to the Privacy Subcommittee in a hearing. Dr. Lumpkin commented that at least the process outlined in the NPRM raises the cost of trying to identify someone, and established penalties for doing so. Dr. McDonald pointed out that the regulations could also set a limit on the size of data pools, to reduce the possibility of identifying people.
There was a wide-ranging discussion of the issue of the minimum data necessary. Mr. Rothstein suggested that language may be needed requiring that medical records be stored, used, or transmitted in the least identifiable form consistent with its purpose. Dr. McDonald cautioned against undermining patient care by imposing draconian restrictions on data flow. He also stressed that scientists and clinicians, not administrators, must be allowed to decide what is necessary. He recommended that the rules be kept general rather than made overly detailed and specific, and that they be allowed to evolve through experience.
Dr. Kramer pointed out the overarching principle of scalability in the proposed rules, which permits flexibility. Dr. Lumpkin commented on the need to reconcile the transaction standards with the principle of minimally necessary data, because the recommendations are currently in conflict. Dr. Christoph observed that in claims processing, "there may not be a minimum set to do things correctly," and even redundant information is needed for cross- checking. Thus "we have to be very careful in talking about minimum data."
In the public health area, the Committee discussed questions concerning registries and the exchange of information among and within agencies.
At Dr. Lumpkin's request, Mr. Fanning described the research components of the NPRM, which are similar to those in proposed bills in Congress. Based on his experience with IRBs, Dr. Friedman strongly supported the comment in the preamble recommending "another good hard look at the common rule." Mr. Fanning said ASPE and AHCPR are funding an IOM study of how IRBs conduct reviews of records-based research.
The group discussed questions about IRB approval and patient consent with respect to records-based "research" conducted within a health care organization, primarily for program evaluation. A broad question is how to distinguish between research and operations-oriented record review.
Mr. Fanning then reviewed the major points regarding individual rights. Mr. Rothstein commented on the need for a statement that these rights may not be waived.
Dr. Lumpkin outlined points that should be included in the Committee's letter to the Department on the NPRM. It should refer to the prior NCVHS privacy recommendations as the standard for what is needed regarding privacy, acknowledging that the NPRM has a narrower scope. It will reflect the diversity of viewpoints on the Committee, and report votes. In the conference call, votes will be taken on individual issues where there is a controversy, as well as on the full report.
Dr. Harding proposed that the letter include comments on the Committee's recommendations regarding law enforcement. Dr. Lumpkin added that the Committee may wish to comment on exemptions for other government agencies and the intelligence community.
Asked about the connections between the security NPRM and the privacy NPRM, Ms. Wahl said the two are closely linked, notably in the area of safeguards for administrative procedures.
The group discussed the applicability of the privacy NPRM to various forms of insurance. It was noted that medical payments coverage that is sold along with liability insurance needs to be dealt with. Another area that needs to be dealt with is workmen's compensation, according to Mr. Fanning.
Reviewing the forthcoming process of producing comments, Ms. Frawley reiterated that the Privacy Subcommittee would meet by conference call to discuss recommendations. She will then draft a letter, circulate it to the Subcommittee, revise as needed, and get it to the full Committee by December 8. Committee members were asked to submit their comments to Ms. Frawley in writing by mid-November.
Committee members received the final version of the report two weeks prior to this meeting. Dr. Iezzoni reviewed the changes made to the previous draft, in accordance with Committee input. She said that Ms. Frawley drafted language on the confidentiality implications, and Dr. Iezzoni and Ms. Rimes drafted a statement about the context for the report. Both additions are to be inserted in the introduction. Dr. Iezzoni moved that the report be approved, as revised.
Dr. Gellman said he would vote No on the report because he views it as fundamentally flawed due to the failure to consider privacy in its conception. Dr. Iezzoni stated that while the Subcommittee did not formally ask privacy experts to speak at its hearings, it did ask all who testified to comment on privacy and confidentiality.
A few small editorial changes were suggested and accepted. Because the report components had not yet been compiled, Dr. Iezzoni amended her motion to also direct the Executive Subcommittee to inspect the report in December and make technical and conforming changes as needed, prior to its release. In addition, the executive summary will be circulated to the full Committee by e-mail.
Dr. Iezzoni's motion was passed, with one abstention and one member opposed.
Mr. D'Angelo reported on the Department's plan to improve the collection and use of race and ethnicity data, outlined in a forthcoming report. The plan is the product of the Data Council's Working Group on Racial and Ethnic Data and of a group working on the Department's initiative to eliminate racial and ethnic disparities in health. The Department has studied the issue a great deal, but few recommendations have been carried out. The plan now is to develop an overall Departmental strategy, linked to the six priority areas in the Disparities Initiative.
The report concludes with an action plan and key recommendations. It begins by stressing that race is a sociocultural concept as much as, or more than, it is biological or genetic. The report integrates recommendations from the six focus reports of the racial and ethnic Disparities Initiative, which include collecting more data, encouraging analysis, ensuring that racial and ethnic groups are represented on key data committees, and promoting geocoding.
The Department is just starting its work on improving data for the Discrimination Initiative, and it will issue another report focusing on data issues in this area. The current report incorporates testimony on Healthy People 2010 in meetings around the country. It also looks at the ways in which racial and ethnic data are used in government and the private sector.
There are ten major overarching recommendations, including these:
In addition, action steps are recommended in the categories of data collection, data analysis and interpretation, data dissemination, and data research and maintenance.
In the first category, one priority is to assess the ability of existing data systems to measure discrimination and to modify or come up with new systems as appropriate. It appears that existing systems do not do a good job of measuring discrimination. The report also recommends that the Department advocate for the inclusion of racial and ethnic data on administrative records. Another recommendation is for a forum, held in conjunction with the states, on improving coordination of racial and ethnic data collection, analysis, and dissemination. Also, socio-cultural data elements should be collected in surveys, research, and administrative records.
One of the action steps for data analysis and interpretation is the inclusion in the analysis of persons familiar with the culture, and also involving the community in all phases. Other recommended action steps are accounting for reporting bias by source; and analyzing and dealing with the effects of miscoding on death and birth certificates, 2000 age adjustment, the shift to new OMB categories, and ICD-10 coding.
The action steps for data dissemination and use include expanding HHS data retrieval systems, supporting regional data centers, and increasing the number of agency websites.
In the category of data research and maintenance, the report makes study recommendations including on the feasibility of using telephone interviews, better sampling techniques, ways to adjust for race misreporting on death certificates, and better income measures. The report also recommends working with Census to produce post-censal race/ethnicity population estimates by age and gender, with SES estimates at the State level and below.
The report has been submitted to the Data Council and revised based on their comments. It will be submitted to the Council for final approval and then widely circulated. A detailed action plan will be developed with the Data Council, so that the report has an impact.
Dr. Friedman noted that ethnic variations in health status exceed race variations. Also, length of time in the U.S. and generational effects are significant. He stressed the importance of intercensal race estimates. He, Mr. D'Angelo, and Dr. Carter-Pokras (co-chair of the Working Group on Racial and Ethnic Data) discussed issues related to geocoding.
Ms. Ward stressed the training issues around collecting racial and ethnic data. She recommended practical and sensitive tools such as scripts for funeral directors and hospital intake people, to help them explain to family members the importance of the information being requested.
Mr. Blair pointed out the discrimination issues relating to denial of access to health care, and asked what measures are planned for addressing them. Mr. D'Angelo reiterated that the report does little on discrimination because the Department is just deciding how to proceed on that. The latter plan will address access issues.
He agreed with Dr. Zubeldia about the sensitive nature of combining information on race, ethnicity, and income. Dr. Carter-Pokras commented that one challenge of developing recommendations for the Department is that it has more than 180 data systems, and they are routinely made available to the public. This is one reason for the interest in geocoding. The Data Council hopes to encourage analysts to look at data that have been collected but not analyzed. In response to a question by Dr. Zubeldia, she said it is possible to do such analysis on a de- identified basis.
Dr. Cohn stressed the importance of educating the public on the socially valuable uses of demographic information, particularly to get at the "Why are you asking me that" reaction.
Dr. Carter-Pokras referred the group to a new report by the U.S. Commission on Civil Rights that calls for better monitoring and enforcement of anti-discrimination laws. Many of its recommendations relate to data as well as the need for public education.
Dr. Friedman noted an exemplary, aggressive campaign in Australia on the need to provide accurate race and ethnicity data.
Mr. Scanlon said some of this kind of public outreach will occur in the context of the decennial census. The Department's activities in the Discrimination Initiative include engaging Dr. Tom LaViest to do a literature review of best practices and to make research recommendations. In that Initiative, the Department is taking the lead in the health area; the other areas are housing, employment, education, and criminal justice. Mr. Scanlon noted the practices of NCHS that protect confidentiality in data obtained using geocoding while making them accessible to analysts.
Dr. Lumpkin concluded the session by thanking Mr. D'Angelo, who is retiring, for his hard work on data on racial and ethnic minorities, particularly American Indians.
Dr. Cohn said it is impossible to predict when the claims attachment NPRM will come out. It may be possible to use the meetings of the Subcommittee on Standards and Security on December 9-10 or January 31/February 1 to review the NPRM. If these meetings do not work, it will be necessary to have a conference call. The comments developed by the Subcommittee will either be reviewed at the February NCHVS meeting or in a specially-scheduled conference call.
This procedure was approved by unanimous vote.
The National Committee will have completed 50 years of service in the year 2000. In honor of that occasion, a 50th anniversary symposium will be held on June 20, at which working documents will be unveiled reflecting the current status of 1) thinking about the national health information infrastructure and 2) the vision for 21st century health statistics. In addition, the history report prepared for the 45th anniversary will be updated. All members are encouraged to participate in the symposium, and former chairs and recent members will be invited. The Executive Subcommittee has asked the Workgroups on the NHII and on 21st century vision for health statistics to work with it on the agenda.
The symposium will be at the National Academy of Sciences main building, with a reception following.
The meeting was adjourned at 3:23 p.m.
I hereby certify that, to the best of my knowledge, the foregoing summary
of minutes is accurate and complete.
/s/ John R. Lumpkin, M.D. 2/24/00
____________________________________________________
Chair Date