White House Releases Report on Consumer Privacy, Calls for Legislation

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Project HealthDesign grantee teams have long recognized that the robust use by patients of technologies such as personal health records (PHRs) and mobile health applications to improve health and well-being depends on trust. Individuals need assurance that the personal data they collect and share using these technologies will be handled responsibly and with respect for its sensitivity. But health data collected by and shared through consumer-facing technologies is typically not covered by HIPAA or state health privacy laws.

At a roundtable on privacy and security protections for PHRs hosted by the Department of Health and Human Services (HHS) in 2010, Project HealthDesign grantees submitted testimony noting some of the privacy and security issues raised by their projects and the challenge of addressing these issues in an uncertain legal environment.  Failure by policy-makers to address this uncertainty chills innovation and places obstacles to widespread consumer adoption of promising health information technologies.

Securing enactment of comprehensive privacy policy is never easy, but the future is looking a bit brighter. Just last month, the White House released a report expressly acknowledging that “[p]rivacy protections are critical to maintaining consumer trust in networked technologies” and calling for stronger privacy rules to protect personal information, including health information, shared by consumers with private sector companies.

Specifically, the White House sets forth the following “Consumer Privacy Bill of Rights”:   

• Individual Control:  Consumers have a right to exercise some control over what companies collect from them and how they use it.

• Transparency:  Consumers have a right to easily understandable and accessible information about privacy and security practices.

• Respect for Context:  Companies should limit their collection, use and disclosure of personal data to those purposes consistent with the context in which consumers provided the data.

• Security:  Companies should maintain reasonable safeguards to control risks such as loss, unauthorized access, and improper disclosure.

• Access and Accuracy:  Companies should provide consumers with reasonable access to personal data collected about them and appropriate means to correct inaccuracies.

• Focused Collection:  Companies should collect only as much personal data as they need to accomplish the purposes that are consistent with the “Respect for context” principle.

• Accountability:  Companies should be accountable to enforcement authorities and consumers for adhering to these principles.

The White House also calls on Congress to enact legislation adopting the Consumer Privacy Bill of Rights as law and providing enforcement authority to both the Federal Trade Commission (FTC) and State Attorneys General. The White House also directs the U.S. Department of Commerce to convene multi-stakeholder groups to negotiate codes of conduct that would implement the Consumer Privacy Bill of Rights in ways tailored to the privacy issues raised by specific industry sectors.

Under the legislative approach advocated by the White House, these codes of conduct – when reviewed and approved by the FTC — would become safe harbors that insulate companies that follow these codes from liability. But even if Congress does not act, these codes of conduct — when companies voluntarily follow them — can be enforced by the FTC, which already has authority to force companies to comply with privacy commitments made to consumers. The Department of Commerce is expected to soon begin convening multi-stakeholder groups to develop the codes of conduct called for in the White House report.

Entities covered by existing federal data privacy laws like HIPAA would be exempt from the new legislation. However, the White House does call for review of whether existing laws could be “simplified” to benefit both consumers and companies.

To what extent would national, consensus-based policy protecting health data collected, used and shared by commercial companies reduce barriers to more widespread adoption of consumer-facing health technologies like PHRs and mobile apps?  Share your thoughts in the comments.

Read more posts about legal and policy issues.

The iN Touch Approach to Device and Data Security

Holly Logan, iN Touch Project Coordinator, San Francisco State University

When we issued iPod Touch devices to participants, we knew some would be lost or stolen. We installed the Find iPhone application on each device that would allow us to locate a missing device, send messages, lock or wipe it.

The first time a participant came to us to inform us that their iPod Touch had been stolen, we took the necessary precautions: we locked it right away, sent a message to the iPod Touch indicating it was now stolen property and waited for it to hit Wi-Fi so that we’d be able to locate it. That was the catch. In order to be able to locate or wipe the device, it had to connect to Wi-Fi. And to throw in another step, when you choose to remote wipe the device, you can no longer locate it. So you have to take your chances here and work with the participant to see if they think they will be able to ask around and locate it, or think of who could have taken it and from where, etc. That was where it was tricky: Was it really stolen and gone forever, or was it temporarily misplaced?

When our first “situation” arose, the health coach had only spoken with the participant, who had said it was stolen. We decided to lock the device remotely and wait for it to hit Wi-Fi. In the meantime, we met with the participant to see what they thought about the device’s status. We asked “Do you know who stole it? Do you think you will be able to get it back?” When we determined that the participant knew who had stolen it, that they were adamant that they would never be able to retrieve it, and that they did not feel comfortable accusing the person, we decided to remotely wipe all data from the device.

However, we followed another process if we had reason to believe that the iPod Touch was simply lost, because we knew we might be able to recover the device. This happened with one participant who called and told us she had lost her iPod Touch after a day of running errands. She had searched her house high and low and looked in her car. The last place she remembered having seen it was when she was at Target.  I immediately locked the device and sent a message to it, which indicated that it was lost property and needed to be returned. Luckily the iPod Touch was going in and out of Wi-Fi, so I was able to see the location. When I told her the location, it turned out it was at her address. I asked her whether a neighbor could have taken it, or if she could have left it in her car. I had her go into each room and listen as I triggered a sound on her device. She still couldn’t find it. She decided to check her car, and I continued to play the sound. She finally heard it and found it jammed under the passenger seat of the car.  Thankfully, we had decided to search for it before remotely wiping it, otherwise all of her data would have been gone forever. When a device was reported lost, we decided it was important to give it at least a week to try to locate it. After that time, and if it was still lost, we decided it was a good idea to remotely wipe it as a security measure.

Unfortunately for all of the participants whose iPod Touches were stolen, none of them were returned, and we ended up wiping them all once they hit Wi-Fi. In each instance, the Find iPhone app has turned out to be a valuable tool that allows us to take the right steps to ensure the privacy and security of the participant’s health data and to  help the participant locate their device.

Images courtesy of Find iPhone app

Who’s Seen My Health Care Information?

Proposed Changes to HIPAA Privacy Rule Would Help Patients Learn the Answer

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

On May 27, the United States Department of Health and Human Services (HHS) issued a proposed regulation (the Proposed Rule) that would amend the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy Rule to provide patients with more information about who has accessed their protected health information (PHI). The Proposed Rule is the latest in a series of regulatory changes HHS is making in response to the Health Information Technology for Economic and Clinical Health (HITECH) Act .

Some of you may already be familiar with HIPAA’s “accounting of disclosures” provision. The provision requires health plans and health care providers, upon request, to give patients a list of the disclosures of their PHI. This “accounting” must describe, among other things, when the PHI was shared, for what purpose and who received it.

Under existing rules, accountings do not have to include the most common disclosures that covered entities make:  those for treatment, payment and health care operations.  Many covered entities have claimed that even this limited accounting obligation is burdensome. But privacy advocates have argued that the routine disclosures should be accounted for as well, especially if they are made using electronic record systems that have the capacity to automatically track disclosures.

The Proposed Rule weighs in on the side of the privacy advocates by requiring covered entities to give patients an “access report” that lists who has accessed their PHI in an electronic designated record set (that is medical records, billing records or other information that is used by covered entities to make payment or treatment decisions and that is maintained electronically) for any purpose, including treatment, payment and health care operations.

• If a patient requested an access report, a covered entity would have to include the following information:
• The date and time of access;
• The name of the natural person (if available) or the name of the entity accessing the electronic designated record set information;
• A description of what information was accessed (if available); and
• A description of the action by the user, if available (e.g., create, modify, access or delete).

There is significant debate about how difficult it will be for covered entities to provide this new access report. HHS has stated that covered entities are already supposed to be electronically tracking much of the information required in the new access report under the HIPAA Security Rule in order to generate required audit trails. But the extent to which covered entities actually do this is unclear.

In a nod to concerns expressed by covered entities, the Proposed Rules would also streamline the Privacy Rule’s current accounting of disclosures provision. For example, the Proposed Rule excludes research disclosures from the accounting requirement in response to complaints that it is difficult for providers to track the large number of records accessed in many research projects.

From the Project HealthDesign perspective, it is important to know that today, very few patients take advantage of their right to know who has seen their health information. Indeed, covered entities often point to the small number of accounting requests to support their arguments that the accounting requirement is unduly burdensome. But as patient-generated information like observations of daily living (ODLs) become more integrated into clinical health records, patients may take greater notice of their right to know who sees their health information and for what purposes.

For a more detailed summary of the Proposed Rule, please read the summary I wrote with my colleague Susan Ingargiola.

Read more posts about legal and policy issues.

Can Meaningful Use Become More Meaningful for Patients?

Patricia Flatley Brennan, R.N., Ph.D., Project HealthDesign Director

Because so many of the Stage 1 meaningful use criteria apply primarily to professionals’ uses of health information technology (HIT) in clinical care settings, Project HealthDesign is pleased to see criteria proposed in Stage 2 that would allow patients to become beneficiaries of meaningful use of HIT.

Meaningful use shouldn’t focus exclusively on electronic health records (EHRs) and clinical care settings. It’s time to ensure that the benefits of HIT meaningful use extend to the everyday lives of patients and families.

We call for accelerating the criteria for meaningful use Stage 2 that would lead HIT to:

1. Exchange health data back and forth between EHRs, which house clinically originated data, and PHRs, which house patient-originated data. Health data arise from a variety of sources. Our work on Project HealthDesign has shown that patients value health data that they themselves define and generate. These types of health data, or observations of daily living (ODLs), can include data related to mood, pain levels and even sleep quality.
   
   
2. Allow patients to invite trusted others, including family members, friends and surrogate decision-makers, to access selected health data. The coordination of patient care would benefit from this type of shared access, which engages patients, clinicians and other individuals designated by the patient while also allowing each patient to maintain the level of privacy he or she desires.

Now is the time for a broader, bolder approach to meaningful use. Patients are relying on HIT professionals to ensure that the bilateral exchange of health data between EHRs and PHRs is meaningful for both patients and clinicians. For more information, please read the full Project HealthDesign Stage 2 meaningful use comments.

Related resources:

• View the full draft of proposed Stage 2 meaningful use criteria [pdf].
• Read Project HealthDesign national advisory committee member John Halamka’s comments.

Could 2011 Be a Big Year for Consumer Privacy?

Deven McGraw, Health Privacy Project Director, Center for Democracy & Technology

A number of developments at the end of 2010 suggest that 2011 could be an important year in the advancement of consumer personal information protections, which would include health information protections.

• The Department of Health and Human Services (HHS) Office of the National Coordinator (ONC) hosted a day-long roundtable, “Personal Health Records – Understanding the Evolving Landscape,” on December 3, 2010. The roundtable explored the current state and evolving nature of personal health records (PHRs), the value of PHRs to consumers, and privacy and security protections for PHRs.
  
  Three Project HealthDesign principal investigators submitted to the ONC comments demonstrating that a lack of comprehensive protections on PHR data, uncertain application of the law and failure of current law to keep up with technological innovation all hinder progress toward innovative care approaches that leverage innovations in information technology. This testimony will inform a congressionally mandated report on privacy and security protections for entities not covered by HIPAA (which includes many PHRs); this HHS PHR report is expected to be issued in 2011.

• Two days before the PHR Roundtable, the Federal Trade Commission (FTC) issued a comprehensive report on consumer privacy, “Protecting Consumer Privacy in an Era of Rapid Change.” The report was based in part on a series of public roundtables the FTC hosted in 2009 and 2010. In the report, the FTC notes the growing collection of consumer personal data (particularly on the Internet), consumers’ limited understanding of data collection practices and inability to make meaningful choices about them, the importance of privacy to consumers, the significant benefits that result from the increased flow of consumer data, and the blurring distinction online between personally identifiable information and information purported to be “anonymous” or de-identified.
  
  In response, they proposed a new framework for addressing the use of consumer data, both online and offline. This framework has three main components:
  1. Businesses should embrace a full complement of fair information practices and build consumer privacy protections into their everyday business practices (also known as “privacy by design”).
  2. Consumers should have more simplified, streamlined choices about how their data is accessed, used and disclosed.
  3. Businesses should increase the transparency of their data practices.

          The FTC is accepting comments on this report until February 18, 2011.

• Two weeks after the FTC released its consumer privacy report, the U.S. Department of Commerce (DoC) released its own report, “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.” This report calls for the U.S. to improve its privacy protection framework and better align itself with global data protection initiatives. DoC also calls for a framework based on a full set of fair information practice principles. Those principles would then be used to create industry-specific codes of conduct that would be developed through negotiations with multiple stakeholders.
  
  The report recommends that any new commercial data privacy framework not conflict with existing laws that provide important protections, such as laws governing the health industry and the financial sector. The report also called for “nationally consistent” security breach notification laws.
  
  DoC is accepting comments on this report until January 28, 2011. Submit comments via e-mail.

At a minimum, these reports indicate a renewed federal focus on privacy protections for consumer data. The reports also suggest that privacy initiatives could garner congressional attention, and that the private sector could also become more engaged in developing strong, voluntary codes of conduct. All of this activity is occurring just as the HITECH meaningful use incentive program begins in earnest, ensuring that a focus on the use and protection of personal health data will remain front and center in 2011.

PCAST Report Comment: Looking Toward Truly Patient-Centered Health Data

Patricia Flatley Brennan, R.N., Ph.D., Project HealthDesign Director

As director of the RWJF-funded Project HealthDesign initiative, I commend the President’s Council of Advisors on Science and Technology (PCAST) for the effort and care evident throughout their December 2010 report, "Realizing the Full Potential of Health Information Technology to Improve Healthcare for Americans: The Path Forward," and for the attention given to patients and their health information needs. I am encouraged to see that the technical standards and structures the council recommends will allow for broad and safe use of health information in the future. I also appreciate the report’s openness about the privacy and identity management concerns involved in this significant undertaking.

Yet even as I affirm the overall spirit of the report, I find myself searching for a more explicit focus on the patient. I was hoping for a report addressing health information technology, but this report focuses more on health care information technology.

Effective management and use of health data must contribute to the improvement of the health of individuals, families and societies. I echo the comments of Chris Gibbons of Johns Hopkins Urban Health Institute, who emphasizes that health data includes the life experience of the individual, which encompasses—but is not limited to—clinical encounters.

Through my work with Project HealthDesign, I have learned that clinical data tell only part of the patient’s story. We must also value any data that the patient values. Patient-defined, patient-generated data such as observations of daily living (ODLs) contribute to a full picture of the patient’s health and complement clinical care data.

ODLs serve as personal health sentinels, which give individuals cues about their health or alert them to take personal health action. Because they arise from the patient’s experience, not the clinician’s perception, ODLs may be the most truly patient-centered type of personal health data. I believe the standards and structures PCAST recommends will prove sufficiently robust to handle even these types of data.

From its beginning, Project HealthDesign has advocated a vision of health information technology (HIT) in which applications draw data from many sources and synthesize and present it in ways that guide action. As bodies such as the ONC and FDA deliberate the PCAST recommendations and use them to guide the criteria for demonstrating meaningful use of HIT, I exhort them to hold fast to the fundamental purpose of effective health data management, which is to improve health.

Related resources
• Read the full PCAST report [pdf]
• Read Project HealthDesign National Advisory Committee member Chris Gibbons' [bio] comment on the report
• Read Project HealthDesign National Advisory Committee member John Halamka's [bio] primer on PCAST-related technological terms

Project HealthDesign Submits Comments to ONC about Future PHR Technology, Privacy and Security

Libby Dowdall, Communications Coordinator, Project HealthDesign National Program Office

Following the Dec. 3 PHR Roundtable, hosted by the Office of the National Coordinator for Health Information Technology (ONC), Project HealthDesign submitted public comments regarding the future of personal health records (PHRs).

Project HealthDesign Director Patricia Flatley Brennan, R.N., Ph.D., commented on the inclusion of patient-generated observations of daily living (ODLs) in PHRs and highlighted the shift toward independent personal health applications (PHAs) that run on top of PHRs.

Walter Sujansky and Sam Faus of Sujansky & Associates, technical partners to the project, noted patients’ desire to assign to family, friends and clinicians customized levels of access to PHRs. They also provided information about the open-source Project HealthDesign Common Platform as evidence of this task’s feasibility.

Principal Investigators Anind Dey, Ph.D., Katherine Kim, M.P.H., M.B.A. and Gillian Hayes, Ph.D., commented on patient expectations in regard to PHR privacy, security, customization of access and ease of use.

Read Project HealthDesign comments.

Read other individuals’ and groups’ comments.

Watch videos of the ONC PHR Panel sessions (see Web Archive section).

 

Pooling Intellects to Achieve Better Health IT Legal Policy

By Deven McGraw, Director, Health Privacy Project, Center for Democracy & Technology

Read all Manatt and CDT blog posts

 The most recent Project HealthDesign grantee meeting at the Vanderbilt Center for Better Health included a session on cross-cutting legal and policy issues.  The purpose of the session was primarily to seek input on legal issues – both real and perceived – that are confronting grantees in moving forward with their projects.  But grantees dug deeper and also teed up issues that, if not resolved by policymakers, are likely to create obstacles to more widespread adoption of care models that leverage technology to bridge the information gap between clinical care teams and patients to achieve better health outcomes.

Grantees brainstormed issues arising in three categories:  provider liability concerns, assuring the security of information transmitted between portable devices and other computer systems, and the lack of privacy protections for many types of personal health records.  The Manatt-CDT team will use this input to develop materials that recommend potential solutions to some of the more critical policy challenges.

Although we are still digesting these materials, I came away with these initial impressions:

• These open policy issues are clearly very important to grantees.  When we asked for feedback in the session, the response was almost overwhelming.
• Some issues showed up in more than one category, which of course underscores their cross-cutting nature and suggests a high degree of interdependency:  resolving concerns in one area can help us alleviate issues in another.  For example, if we had privacy and security provisions that covered health information regardless of who holds it, we would have less need to focus on whether information shared with a patient by mobile phone is or isn’t “PHI”.
• Some of the concerns raised in the legal/policy issues discussion were also raised in grantee discussions about the operational challenges for their projects.  For example, grantees discussed the challenge of getting the clinicians or care teams to incorporate patient data into their records and workflow.  This operational challenge is closely related to the legal challenge of providers’ concern about liability for responding to patient-generated data.  A thoughtful solution involving careful management of expectations of both patients and providers/care teams should help address concerns in both areas.
• A number of the concerns raised by grantees targeted clear gaps or uncertainties in the law – for example, what protections are available for data entered by patients onto social networking sites or what are entities’ specific responsibilities with respect to the security of mobile devices used by providers to communicate with patients.  Further efforts by the Manatt-CDT team will likely focus on these gaps and suggest potential solutions for further consideration by the public, industry stakeholders, and policymakers.
• Grantees also raised some issues that are fairly well covered by existing state and/or federal law, but different interpretations of the law, or risk averse behavior on the part of health care organizations and institutions, leads to uncertainty and an unwillingness to take action or experiment with different care models.  Cutting through these “interpretation” challenges is probably the most difficult hurdle of all.

Watch video of the brainstorming sessions: 

1. Portable Device Security
   
2. Personal Health Record Security
3. Provider Liability Concerns

Preparing to Dive into Cross-Cutting Policy Issues at the September Grantee Workshop A Call for Input

By Deven McGraw, Director, Health Privacy Project, Center for Democracy & Technology

Read all Manatt and CDT blog posts

As part of our role as regulatory/assurance consultants to Project HealthDesign, my Manatt colleagues and I are looking to identify “cross-cutting policy issues” that are either currently impacting your use of observations of daily living (ODLs) to enhance patient care, or that may create obstacles to more widespread use of ODLs.  

To date, the Manatt-CDT team has focused on the privacy and security legal issues affecting the structure and implementation of each grantee’s project.  For this next phase, we want to take it up a notch and think about issues beyond just the application of HIPAA and state health privacy laws. Based on our experience in working with the grantees, as well as conversations with the Project HealthDesign National Program Office, we have created an initial list of cross-cutting policy issues that we want to discuss during our the upcoming retreat (September 8-9) in Nashville.  The list includes:

• Provider liability concerns, including those related to reliance on inaccurate or incomplete data (stemming from ODLs or otherwise) and potential malpractice liability for not accessing or using information generated by patients.
• Assuring the security of information transmitted between portable devices and other computer systems, including use of text messages by providers to communicate with patients.
• The lack of privacy and security protections for many types of Personal Health Records (e.g., those not created on behalf of a HIPAA Covered Entity) and for models of collecting ODLs that may leverage social networking websites.

Our goal is to develop strategies to prevent these issues from impeding wider adoption of ODLs into clinical practice by providers throughout the country.  But before we take another step in our preparation for Nashville, we want to make sure that this list is the right list – that these are the policy issues that are “keeping you up at night,” (or at least nagging in the back of your mind).  Please jump in with comments below - feel free to send us your laundry list of favorite policy concerns.  We look forward to seeing you in Nashville.

An Example of Our Regulatory/Assurance Function in Action

By Bob Belfort, Manatt Phelps & Phillips, LLP.

Over the past few weeks, my Manatt colleagues and I have met by phone with each of the Project HealthDesign grantees to review how existing state and federal laws governing the privacy and security of health information impact their projects, and what steps they should take to ensure compliance with those laws.

We talked about things like minimizing security risks associated with loss or theft of, or improper access to, portable devices and ensuring transmission security of information between portable devices and other computer systems. These requirements generally stem from the HIPAA Security Rule, which requires covered entities to employ administrative, physical, and technical safeguards to protect the confidentiality and integrity of protected health information maintained or transmitted electronically. 

To Encrypt or Not to Encrypt:  Text Message Transmission Security
We had a very interesting discussion with one grantee about health care providers’ use of text messages to send reminders and alerts to patients participating in their project.  It highlights the type of judgment calls that are often necessary when interpreting one’s responsibilities under HIPAA and state privacy laws.

Under the HIPAA Security Rule, a covered entity has discretion to adopt security measures within specified categories based on the entity’s size, complexity, capabilities and resources.  In addition, while certain security measures are required, others are “addressable,” which means that a covered entity has the flexibility, through a formal security risk analysis, to assess whether the measure is “reasonable and appropriate” in its particular environment and, if not, to adopt an alternative reasonable and appropriate measure.

As many of you know, there are obstacles to encrypting text messages.  Because the security measure that protected health information sent over an electronic communications network be encrypted is an “addressable” one under the HIPAA Security Rule, we engaged in a mini risk analysis during our call, weighing the risks of sending certain types of information through unencrypted text messages and considering how best to mitigate these risks.  One mitigation strategy we discussed was limiting the nature of the information transmitted. We talked through the risks associated with texting “Don’t forget to take your medication today” as compared to “You forgot to take your Lipitor today,” and discussed a variety of other potential scenarios.

The bottom line is that there is simply no bright line to guide a grantee’s decision whether to encrypt or not to encrypt, and, if not to encrypt, what types of alternative measures to adopt to ensure the security of the information being sent via text.  For example, while limiting text messages to “pointers” (e.g. “Check the Carrot.com for a note from your health coach.”) is probably the most conservative way to minimize the risk of unauthorized access to protected health information or other information sent via text, it may not be the most effective way to motivate patients to take control of their health.

This is one of the reasons we at Manatt and our partner Deven McGraw at the Center for Democracy and Technology are here:  to talk these types of questions through with grantees and assist in finding solutions that minimize legal risks but also work in practice.  We’ll be addressing these types of risks during standing monthly calls. We’re looking forward to some interesting conversations.