Averting the Collision: Privacy Doctrine & Health Information Exchange Katherine L. Ball, MD, MSc William A. Yasnoff, MD, PhD, FACMI e-Health Initiative Washington, DC December 5, 2008 © 2008 NH I I ADVISORS

2 2 © 2008 NH I I ADVISORS Dangers of Electronic Records “ Anything you do to make information more accessible for good, laudable purposes will simultaneously make it more accessible for evil, nefarious purposes ” - William A. Yasnoff, New York Times, 2/18/07 (p. 16) Therefore, privacy is a much greater concern as more health records are electronic.

3 3 © 2008 NH I I ADVISORS Consumers and Health Privacy n Surveys of “information hiding” l 2006: 13% of consumers l 2007: 17% of consumers n Consumers already control information in their records n Without control, too many will opt out OR politically force system shut down n Choices are today’s system or consumer control -- complete information without consent is not (and should not be) a viable option n Patient control essential

4 4 © 2008 NH I I ADVISORS HIPAA Does NOT Assure Privacy n Information may be released WITHOUT consent for Treatment, Payment, or Operations (TPO) n TPO is determined solely by holder of information l No notification to patient l No review or appeal of TPO decision n No records of TPO disclosures required l No opportunity to review compliance l Trust without verification --> mistrust n Privacy depends on good behavior of covered entities l No enforcement possible

5 5 © 2008 NH I I ADVISORS PHR Privacy Assured by Federal ECPA Law n ECPA = Electronic Communications Privacy Act of 1986 (U.S. Code Title 18, Part I, Chapter 121, § ) n Applies to operators of publicly-available remote computing services (e.g. PHRs) n Operator may not release any subscriber information to any private party without consent of the subscriber l No exceptions n Does not apply to “non-public” systems n Much stronger protection than HIPAA n Extending HIPAA to PHRs would eliminate ECPA protection

6 6 © 2008 NH I I ADVISORS Independent Privacy Certification is Needed n Consumers need assurance that their privacy is protected n Privacy policies difficult for consumers to understand l Monitoring for changes is impractical for consumers n Certification addresses inherent conflict-of- interest between organization holding data and consumer n Certification must be independent of data organizations n Certification is information equivalent of financial auditing

7 7 © 2008 NH I I ADVISORS Privacy Certification Process n Establish auditing criteria (focus on policy) l Clear privacy policy l All access requires consumer consent l Audit trails accessible to consumers l No targeting or profiling without consent n Security is prerequisite l But not adequate to protect privacy n Careful review of audit criteria l In operational environment l Cannot be applied to system “in the box” n Independent evaluation of audit results l Avoids conflict of auditors and “auditees” n Compliance monitoring & annual recertification

8 8 © 2008 NH I I ADVISORS Health Record Banks (HRB) Can Protect Privacy n Secure community-based repository of complete health records n Access to records completely controlled by patients (or designee) n “Electronic safe deposit boxes” n Information about care deposited once when created l Required by HIPAA n Allows EHR incentives to physicians to make outpatient records electronic n Operation simple and inexpensive

9 9 © 2008 NH I I ADVISORS Clinical Encounter Health Record Bank Clinician EHR System Encounter Data Entered in EHR Encounter Data sent to Health Record Bank Patient Permission? NO DATA NOT SENT Clinician Inquiry Patient data delivered to Clinician YES optional payment Clinician’s Bank Secure patient health data files Health Record Bank Operation

10 © 2008 NH I I ADVISORS HRB Rationale n Operationally simple l Records immediately available l Deposit new records when created l Enables value-added services l Enables research queries n Patient control --> l Trust & privacy l Stakeholder cooperation (HIPAA) n Low cost facilitates business model n Creates EHR incentive options l Pay for deposits l Provide Internet-accessible EHRs

11 © 2008 NH I I ADVISORS Health Record Bank Organization Customer Support Marketing Operations HRB Operator Board of Directors Management Health Record Bank Operator (for-profit) regulate via contract % of revenue RESPONSIBLE FOR: Policy Governance Oversight RESPONSIBLE FOR: Obtaining Capital Operating HRB Executive Director Other Staff(Optional) Community Non-profits Community Board of Directors Many communities use single HRB

12 © 2008 NH I I ADVISORS Questions? For more information: William A. Yasnoff, MD, PhD, FACMI 703/ Katherine L. Ball, MD, MS