Musings on the Value of Project HealthDesign from Regulatory and Assurance Counsel

by Deven McGraw

With this, my last Project HealthDesign blog post, I wanted to share, on behalf of myself and my colleagues at Manatt, some final thoughts about our experience as Project HealthDesign’s Regulatory and Assurance Counsel, providing assistance to each of the five research teams and helping bring the experience of Project HealthDesign into current and important policy conversations about how to achieve a more patient-centered, digital health care system.  

We began our involvement with Project HealthDesign with a keen appreciation of the fact that the health care system today does not appropriately recognize the critical role that a patient’s personal experience and day-to-day activities play in achieving optimum health and wellness. Over the past three years, it has been an honor to help the Project HealthDesign research teams and National Program Office communicate to the broader policy community the important  lessons learned from their experience.  Patients are experts at their personal experience; clinicians are experts at clinical care.  To achieve better health outcomes, both patients and clinicians will need information from both domains—and technology can play a key role in bridging this information gap.

Project HealthDesign took this message straight to the heart of the policy debate over how to improve our nation’s health care system, including testifying before federal policymaking bodies charged with charting the future of health IT and patient engagement.  As a result of Project HealthDesign’s efforts, the Federal Health IT Policy Committee’s meaningful use workgroup included in its preliminary recommendations for Stage 3 meaningful use of electronic health record (EHR) criteria a requirement that patients be provided with the ability to report patient-generated data to providers and hospitals. Observations of daily living (ODLs) were specifically mentioned on the list of acceptable types of patient-generated data.  The experience of the Project HealthDesign research teams helped bring the discussion of meaningful patient engagement using technology out of the theoretical and into the practical -- and the possible.  

In addition to influencing national health care policy, Project HealthDesign also generated best practices to help health care providers in the field begin incorporating ODLs into clinical care.  It is not hard to envision an environment in which health care providers routinely encourage patients to use mobile devices to collect and share clinically relevant information such as ODLs. As reimbursement models for health care providers move toward paying for outcomes and episodes of care, shared savings incentives, and capitation, there will be greater incentives for providers to more actively engage patients in daily self-management and care coordination.  Project HealthDesign research teams provide roadmaps for how this can be done. 

One area where Project HealthDesign generated and disseminated best practices was in health information security.  Patients’ use of mobile devices to generate and communicate health information triggers unique security risks, and the tools frequently used by patients are not typically equipped with high-end security tools.  When health care providers handle electronic, identifiable health information, they are subject to the HIPAA Security Rule. But HIPAA regulates providers, not patients. In an article published in the Journal of Healthcare Information Management, we sought to allay health care providers’ privacy and security concerns by developing best practice recommendations for providers to help their patients safeguard the health information they create and share through mobile devices. 

Another area where we seek to provide best practice recommendations is with respect to provider concerns about potential liability for failing to pay sufficient attention to patient-generated electronic health information.  In a forthcoming paper, we highlight Project HealthDesign’s experience that that setting clear expectations with patients about the sharing of patient-generated data – and honoring those expectations - helped alleviate liability concerns. 

By exploring practical ways to digitally capture and integrate patient-recorded observations of daily living into clinical care and testing this with real patients and real providers, Project HealthDesign’s interdisciplinary research teams have contributed groundbreaking work that will help the policy and clinical practice communities shape important improvements to the health care system.

While our involvement with Project HealthDesign may be coming to a close, we are proud to have been associated with Project HealthDesign’s important message: that a paradigm shift to a more patient-centered health care system requires that patient generated data be captured, interpreted, and incorporated into clinical care – and that we must begin now to lay the necessary groundwork for that change.

 

Paper Looks at Strategies for Protecting Patient-Generated Data on Mobile Devices

Libby Dowdall, Communications Coordinator, Project HealthDesign National Program Office

The Journal of Healthcare Information Management (JHIM) recently published “Lessons from Project HealthDesign: Strategies for Safeguarding Patient-Generated Health Information Created or Shared through Mobile Devices” (pdf), a new paper from Project HealthDesign’s Regulatory and Assurance Advisory Group. Experts from Manatt, Phelps & Phillips, LLP, and the Center for Democracy & Technology co-authored the paper, which appears in the summer issue of JHIM.

The paper draws insights from Project HealthDesign’s five Round 2 grantee teams (2010-12). In the absence of established best practices for safeguarding patient-generated data created and/or shared through mobile devices, each team implemented a unique approach to device and data security. Whereas clinical data is subject to the HIPAA Security Rule, patient-generated data is not. Even so, during their studies, several Project HealthDesign Round 2 grantee teams implemented systems or approaches in which patients shared data about their observations of daily living (ODLs) — one form of patient-generated data — with their health care providers. The resulting strategies for protecting patient-generated data should prove valuable if and when it becomes more common for patients to share with clinicians select data (or summaries of the data) they’ve generated outside of the clinical setting.

The grantee teams’ approaches inform the strategies shared in this paper. Topics include data encryption; limiting the nature and extent of the data that’s transmitted; equipping patients to assess the risks of storing and transmitting the health data they generate; and educating patients about options for protecting the data. Finally, the paper encourages health care providers to thoughtfully weight the risks of storing and transmitting patient-generated data on mobile devices with patient-generated data’s benefits for clinical care and individuals’ self-management.

Read the paper (pdf).
Learn more about our Regulatory and Assurance Advisory Group.

White House Releases Report on Consumer Privacy, Calls for Legislation

Deven McGraw, Proje­ct HealthDesign Regulatory and Assurance Advisory Group, Center for Democracy & Technology

Project HealthDesign grantee teams have long recognized that the robust use by patients of technologies such as personal health records (PHRs) and mobile health applications to improve health and well-being depends on trust. Individuals need assurance that the personal data they collect and share using these technologies will be handled responsibly and with respect for its sensitivity. But health data collected by and shared through consumer-facing technologies is typically not covered by HIPAA or state health privacy laws.

At a roundtable on privacy and security protections for PHRs hosted by the Department of Health and Human Services (HHS) in 2010, Project HealthDesign grantees submitted testimony noting some of the privacy and security issues raised by their projects and the challenge of addressing these issues in an uncertain legal environment.  Failure by policy-makers to address this uncertainty chills innovation and places obstacles to widespread consumer adoption of promising health information technologies.

Securing enactment of comprehensive privacy policy is never easy, but the future is looking a bit brighter. Just last month, the White House released a report expressly acknowledging that “[p]rivacy protections are critical to maintaining consumer trust in networked technologies” and calling for stronger privacy rules to protect personal information, including health information, shared by consumers with private sector companies.

Specifically, the White House sets forth the following “Consumer Privacy Bill of Rights”:   

• Individual Control:  Consumers have a right to exercise some control over what companies collect from them and how they use it.

• Transparency:  Consumers have a right to easily understandable and accessible information about privacy and security practices.

• Respect for Context:  Companies should limit their collection, use and disclosure of personal data to those purposes consistent with the context in which consumers provided the data.

• Security:  Companies should maintain reasonable safeguards to control risks such as loss, unauthorized access, and improper disclosure.

• Access and Accuracy:  Companies should provide consumers with reasonable access to personal data collected about them and appropriate means to correct inaccuracies.

• Focused Collection:  Companies should collect only as much personal data as they need to accomplish the purposes that are consistent with the “Respect for context” principle.

• Accountability:  Companies should be accountable to enforcement authorities and consumers for adhering to these principles.

The White House also calls on Congress to enact legislation adopting the Consumer Privacy Bill of Rights as law and providing enforcement authority to both the Federal Trade Commission (FTC) and State Attorneys General. The White House also directs the U.S. Department of Commerce to convene multi-stakeholder groups to negotiate codes of conduct that would implement the Consumer Privacy Bill of Rights in ways tailored to the privacy issues raised by specific industry sectors.

Under the legislative approach advocated by the White House, these codes of conduct – when reviewed and approved by the FTC — would become safe harbors that insulate companies that follow these codes from liability. But even if Congress does not act, these codes of conduct — when companies voluntarily follow them — can be enforced by the FTC, which already has authority to force companies to comply with privacy commitments made to consumers. The Department of Commerce is expected to soon begin convening multi-stakeholder groups to develop the codes of conduct called for in the White House report.

Entities covered by existing federal data privacy laws like HIPAA would be exempt from the new legislation. However, the White House does call for review of whether existing laws could be “simplified” to benefit both consumers and companies.

To what extent would national, consensus-based policy protecting health data collected, used and shared by commercial companies reduce barriers to more widespread adoption of consumer-facing health technologies like PHRs and mobile apps?  Share your thoughts in the comments.

Read more posts about legal and policy issues.

The iN Touch Approach to Device and Data Security

Holly Logan, iN Touch Project Coordinator, San Francisco State University

When we issued iPod Touch devices to participants, we knew some would be lost or stolen. We installed the Find iPhone application on each device that would allow us to locate a missing device, send messages, lock or wipe it.

The first time a participant came to us to inform us that their iPod Touch had been stolen, we took the necessary precautions: we locked it right away, sent a message to the iPod Touch indicating it was now stolen property and waited for it to hit Wi-Fi so that we’d be able to locate it. That was the catch. In order to be able to locate or wipe the device, it had to connect to Wi-Fi. And to throw in another step, when you choose to remote wipe the device, you can no longer locate it. So you have to take your chances here and work with the participant to see if they think they will be able to ask around and locate it, or think of who could have taken it and from where, etc. That was where it was tricky: Was it really stolen and gone forever, or was it temporarily misplaced?

When our first “situation” arose, the health coach had only spoken with the participant, who had said it was stolen. We decided to lock the device remotely and wait for it to hit Wi-Fi. In the meantime, we met with the participant to see what they thought about the device’s status. We asked “Do you know who stole it? Do you think you will be able to get it back?” When we determined that the participant knew who had stolen it, that they were adamant that they would never be able to retrieve it, and that they did not feel comfortable accusing the person, we decided to remotely wipe all data from the device.

However, we followed another process if we had reason to believe that the iPod Touch was simply lost, because we knew we might be able to recover the device. This happened with one participant who called and told us she had lost her iPod Touch after a day of running errands. She had searched her house high and low and looked in her car. The last place she remembered having seen it was when she was at Target.  I immediately locked the device and sent a message to it, which indicated that it was lost property and needed to be returned. Luckily the iPod Touch was going in and out of Wi-Fi, so I was able to see the location. When I told her the location, it turned out it was at her address. I asked her whether a neighbor could have taken it, or if she could have left it in her car. I had her go into each room and listen as I triggered a sound on her device. She still couldn’t find it. She decided to check her car, and I continued to play the sound. She finally heard it and found it jammed under the passenger seat of the car.  Thankfully, we had decided to search for it before remotely wiping it, otherwise all of her data would have been gone forever. When a device was reported lost, we decided it was important to give it at least a week to try to locate it. After that time, and if it was still lost, we decided it was a good idea to remotely wipe it as a security measure.

Unfortunately for all of the participants whose iPod Touches were stolen, none of them were returned, and we ended up wiping them all once they hit Wi-Fi. In each instance, the Find iPhone app has turned out to be a valuable tool that allows us to take the right steps to ensure the privacy and security of the participant’s health data and to  help the participant locate their device.

Images courtesy of Find iPhone app

Who’s Seen My Health Care Information?

Proposed Changes to HIPAA Privacy Rule Would Help Patients Learn the Answer

Robert Belfort, Project HealthDesign Regulatory and Assurance Advisory Group, Manatt, Phelps & Phillips, LLP

On May 27, the United States Department of Health and Human Services (HHS) issued a proposed regulation (the Proposed Rule) that would amend the Health Insurance Portability and Accountability Act’s (HIPAA) Privacy Rule to provide patients with more information about who has accessed their protected health information (PHI). The Proposed Rule is the latest in a series of regulatory changes HHS is making in response to the Health Information Technology for Economic and Clinical Health (HITECH) Act .

Some of you may already be familiar with HIPAA’s “accounting of disclosures” provision. The provision requires health plans and health care providers, upon request, to give patients a list of the disclosures of their PHI. This “accounting” must describe, among other things, when the PHI was shared, for what purpose and who received it.

Under existing rules, accountings do not have to include the most common disclosures that covered entities make:  those for treatment, payment and health care operations.  Many covered entities have claimed that even this limited accounting obligation is burdensome. But privacy advocates have argued that the routine disclosures should be accounted for as well, especially if they are made using electronic record systems that have the capacity to automatically track disclosures.

The Proposed Rule weighs in on the side of the privacy advocates by requiring covered entities to give patients an “access report” that lists who has accessed their PHI in an electronic designated record set (that is medical records, billing records or other information that is used by covered entities to make payment or treatment decisions and that is maintained electronically) for any purpose, including treatment, payment and health care operations.

• If a patient requested an access report, a covered entity would have to include the following information:
• The date and time of access;
• The name of the natural person (if available) or the name of the entity accessing the electronic designated record set information;
• A description of what information was accessed (if available); and
• A description of the action by the user, if available (e.g., create, modify, access or delete).

There is significant debate about how difficult it will be for covered entities to provide this new access report. HHS has stated that covered entities are already supposed to be electronically tracking much of the information required in the new access report under the HIPAA Security Rule in order to generate required audit trails. But the extent to which covered entities actually do this is unclear.

In a nod to concerns expressed by covered entities, the Proposed Rules would also streamline the Privacy Rule’s current accounting of disclosures provision. For example, the Proposed Rule excludes research disclosures from the accounting requirement in response to complaints that it is difficult for providers to track the large number of records accessed in many research projects.

From the Project HealthDesign perspective, it is important to know that today, very few patients take advantage of their right to know who has seen their health information. Indeed, covered entities often point to the small number of accounting requests to support their arguments that the accounting requirement is unduly burdensome. But as patient-generated information like observations of daily living (ODLs) become more integrated into clinical health records, patients may take greater notice of their right to know who sees their health information and for what purposes.

For a more detailed summary of the Proposed Rule, please read the summary I wrote with my colleague Susan Ingargiola.

Read more posts about legal and policy issues.

Can Meaningful Use Become More Meaningful for Patients?

Patricia Flatley Brennan, R.N., Ph.D., Project HealthDesign Director

Because so many of the Stage 1 meaningful use criteria apply primarily to professionals’ uses of health information technology (HIT) in clinical care settings, Project HealthDesign is pleased to see criteria proposed in Stage 2 that would allow patients to become beneficiaries of meaningful use of HIT.

Meaningful use shouldn’t focus exclusively on electronic health records (EHRs) and clinical care settings. It’s time to ensure that the benefits of HIT meaningful use extend to the everyday lives of patients and families.

We call for accelerating the criteria for meaningful use Stage 2 that would lead HIT to:

1. Exchange health data back and forth between EHRs, which house clinically originated data, and PHRs, which house patient-originated data. Health data arise from a variety of sources. Our work on Project HealthDesign has shown that patients value health data that they themselves define and generate. These types of health data, or observations of daily living (ODLs), can include data related to mood, pain levels and even sleep quality.
   
   
2. Allow patients to invite trusted others, including family members, friends and surrogate decision-makers, to access selected health data. The coordination of patient care would benefit from this type of shared access, which engages patients, clinicians and other individuals designated by the patient while also allowing each patient to maintain the level of privacy he or she desires.

Now is the time for a broader, bolder approach to meaningful use. Patients are relying on HIT professionals to ensure that the bilateral exchange of health data between EHRs and PHRs is meaningful for both patients and clinicians. For more information, please read the full Project HealthDesign Stage 2 meaningful use comments.

Related resources:

• View the full draft of proposed Stage 2 meaningful use criteria [pdf].
• Read Project HealthDesign national advisory committee member John Halamka’s comments.

Could 2011 Be a Big Year for Consumer Privacy?

Deven McGraw, Health Privacy Project Director, Center for Democracy & Technology

A number of developments at the end of 2010 suggest that 2011 could be an important year in the advancement of consumer personal information protections, which would include health information protections.

• The Department of Health and Human Services (HHS) Office of the National Coordinator (ONC) hosted a day-long roundtable, “Personal Health Records – Understanding the Evolving Landscape,” on December 3, 2010. The roundtable explored the current state and evolving nature of personal health records (PHRs), the value of PHRs to consumers, and privacy and security protections for PHRs.
  
  Three Project HealthDesign principal investigators submitted to the ONC comments demonstrating that a lack of comprehensive protections on PHR data, uncertain application of the law and failure of current law to keep up with technological innovation all hinder progress toward innovative care approaches that leverage innovations in information technology. This testimony will inform a congressionally mandated report on privacy and security protections for entities not covered by HIPAA (which includes many PHRs); this HHS PHR report is expected to be issued in 2011.

• Two days before the PHR Roundtable, the Federal Trade Commission (FTC) issued a comprehensive report on consumer privacy, “Protecting Consumer Privacy in an Era of Rapid Change.” The report was based in part on a series of public roundtables the FTC hosted in 2009 and 2010. In the report, the FTC notes the growing collection of consumer personal data (particularly on the Internet), consumers’ limited understanding of data collection practices and inability to make meaningful choices about them, the importance of privacy to consumers, the significant benefits that result from the increased flow of consumer data, and the blurring distinction online between personally identifiable information and information purported to be “anonymous” or de-identified.
  
  In response, they proposed a new framework for addressing the use of consumer data, both online and offline. This framework has three main components:
  1. Businesses should embrace a full complement of fair information practices and build consumer privacy protections into their everyday business practices (also known as “privacy by design”).
  2. Consumers should have more simplified, streamlined choices about how their data is accessed, used and disclosed.
  3. Businesses should increase the transparency of their data practices.

          The FTC is accepting comments on this report until February 18, 2011.

• Two weeks after the FTC released its consumer privacy report, the U.S. Department of Commerce (DoC) released its own report, “Commercial Data Privacy and Innovation in the Internet Economy: A Dynamic Policy Framework.” This report calls for the U.S. to improve its privacy protection framework and better align itself with global data protection initiatives. DoC also calls for a framework based on a full set of fair information practice principles. Those principles would then be used to create industry-specific codes of conduct that would be developed through negotiations with multiple stakeholders.
  
  The report recommends that any new commercial data privacy framework not conflict with existing laws that provide important protections, such as laws governing the health industry and the financial sector. The report also called for “nationally consistent” security breach notification laws.
  
  DoC is accepting comments on this report until January 28, 2011. Submit comments via e-mail.

At a minimum, these reports indicate a renewed federal focus on privacy protections for consumer data. The reports also suggest that privacy initiatives could garner congressional attention, and that the private sector could also become more engaged in developing strong, voluntary codes of conduct. All of this activity is occurring just as the HITECH meaningful use incentive program begins in earnest, ensuring that a focus on the use and protection of personal health data will remain front and center in 2011.

PCAST Report Comment: Looking Toward Truly Patient-Centered Health Data

Patricia Flatley Brennan, R.N., Ph.D., Project HealthDesign Director

As director of the RWJF-funded Project HealthDesign initiative, I commend the President’s Council of Advisors on Science and Technology (PCAST) for the effort and care evident throughout their December 2010 report, "Realizing the Full Potential of Health Information Technology to Improve Healthcare for Americans: The Path Forward," and for the attention given to patients and their health information needs. I am encouraged to see that the technical standards and structures the council recommends will allow for broad and safe use of health information in the future. I also appreciate the report’s openness about the privacy and identity management concerns involved in this significant undertaking.

Yet even as I affirm the overall spirit of the report, I find myself searching for a more explicit focus on the patient. I was hoping for a report addressing health information technology, but this report focuses more on health care information technology.

Effective management and use of health data must contribute to the improvement of the health of individuals, families and societies. I echo the comments of Chris Gibbons of Johns Hopkins Urban Health Institute, who emphasizes that health data includes the life experience of the individual, which encompasses—but is not limited to—clinical encounters.

Through my work with Project HealthDesign, I have learned that clinical data tell only part of the patient’s story. We must also value any data that the patient values. Patient-defined, patient-generated data such as observations of daily living (ODLs) contribute to a full picture of the patient’s health and complement clinical care data.

ODLs serve as personal health sentinels, which give individuals cues about their health or alert them to take personal health action. Because they arise from the patient’s experience, not the clinician’s perception, ODLs may be the most truly patient-centered type of personal health data. I believe the standards and structures PCAST recommends will prove sufficiently robust to handle even these types of data.

From its beginning, Project HealthDesign has advocated a vision of health information technology (HIT) in which applications draw data from many sources and synthesize and present it in ways that guide action. As bodies such as the ONC and FDA deliberate the PCAST recommendations and use them to guide the criteria for demonstrating meaningful use of HIT, I exhort them to hold fast to the fundamental purpose of effective health data management, which is to improve health.

Related resources
• Read the full PCAST report [pdf]
• Read Project HealthDesign National Advisory Committee member Chris Gibbons' [bio] comment on the report
• Read Project HealthDesign National Advisory Committee member John Halamka's [bio] primer on PCAST-related technological terms

Project HealthDesign Submits Comments to ONC about Future PHR Technology, Privacy and Security

Libby Dowdall, Communications Coordinator, Project HealthDesign National Program Office

Following the Dec. 3 PHR Roundtable, hosted by the Office of the National Coordinator for Health Information Technology (ONC), Project HealthDesign submitted public comments regarding the future of personal health records (PHRs).

Project HealthDesign Director Patricia Flatley Brennan, R.N., Ph.D., commented on the inclusion of patient-generated observations of daily living (ODLs) in PHRs and highlighted the shift toward independent personal health applications (PHAs) that run on top of PHRs.

Walter Sujansky and Sam Faus of Sujansky & Associates, technical partners to the project, noted patients’ desire to assign to family, friends and clinicians customized levels of access to PHRs. They also provided information about the open-source Project HealthDesign Common Platform as evidence of this task’s feasibility.

Principal Investigators Anind Dey, Ph.D., Katherine Kim, M.P.H., M.B.A. and Gillian Hayes, Ph.D., commented on patient expectations in regard to PHR privacy, security, customization of access and ease of use.

Read Project HealthDesign comments.

Read other individuals’ and groups’ comments.

Watch videos of the ONC PHR Panel sessions (see Web Archive section).

 

Pooling Intellects to Achieve Better Health IT Legal Policy

By Deven McGraw, Director, Health Privacy Project, Center for Democracy & Technology

Read all Manatt and CDT blog posts

 The most recent Project HealthDesign grantee meeting at the Vanderbilt Center for Better Health included a session on cross-cutting legal and policy issues.  The purpose of the session was primarily to seek input on legal issues – both real and perceived – that are confronting grantees in moving forward with their projects.  But grantees dug deeper and also teed up issues that, if not resolved by policymakers, are likely to create obstacles to more widespread adoption of care models that leverage technology to bridge the information gap between clinical care teams and patients to achieve better health outcomes.

Grantees brainstormed issues arising in three categories:  provider liability concerns, assuring the security of information transmitted between portable devices and other computer systems, and the lack of privacy protections for many types of personal health records.  The Manatt-CDT team will use this input to develop materials that recommend potential solutions to some of the more critical policy challenges.

Although we are still digesting these materials, I came away with these initial impressions:

• These open policy issues are clearly very important to grantees.  When we asked for feedback in the session, the response was almost overwhelming.
• Some issues showed up in more than one category, which of course underscores their cross-cutting nature and suggests a high degree of interdependency:  resolving concerns in one area can help us alleviate issues in another.  For example, if we had privacy and security provisions that covered health information regardless of who holds it, we would have less need to focus on whether information shared with a patient by mobile phone is or isn’t “PHI”.
• Some of the concerns raised in the legal/policy issues discussion were also raised in grantee discussions about the operational challenges for their projects.  For example, grantees discussed the challenge of getting the clinicians or care teams to incorporate patient data into their records and workflow.  This operational challenge is closely related to the legal challenge of providers’ concern about liability for responding to patient-generated data.  A thoughtful solution involving careful management of expectations of both patients and providers/care teams should help address concerns in both areas.
• A number of the concerns raised by grantees targeted clear gaps or uncertainties in the law – for example, what protections are available for data entered by patients onto social networking sites or what are entities’ specific responsibilities with respect to the security of mobile devices used by providers to communicate with patients.  Further efforts by the Manatt-CDT team will likely focus on these gaps and suggest potential solutions for further consideration by the public, industry stakeholders, and policymakers.
• Grantees also raised some issues that are fairly well covered by existing state and/or federal law, but different interpretations of the law, or risk averse behavior on the part of health care organizations and institutions, leads to uncertainty and an unwillingness to take action or experiment with different care models.  Cutting through these “interpretation” challenges is probably the most difficult hurdle of all.

Watch video of the brainstorming sessions: 

1. Portable Device Security
   
2. Personal Health Record Security
3. Provider Liability Concerns