HIT Policy Committee Privacy and Security Tiger Team Deven McGraw, Chair Paul Egerman, Co-Chair October 20,

Tiger Team Members Deven McGraw, Chair, Center for Democracy & Technology Paul Egerman, Co-Chair, Dixie Baker, SAIC Christine Bechtel, National Partnership for Women & Families Rachel Block, NYS Department of Health Carol Diamond, Markle Foundation Judy Faulkner, EPIC Systems Corp. Leslie Francis, University of Utah; NCVHS Gayle Harrell, Consumer Representative/Florida John Houston, University of Pittsburgh Medical Center David Lansky, Pacific Business Group on Health David McCallie, Cerner Corp. Wes Rishel, Gartner Latanya Sweeney, Carnegie Mellon University Micky Tripathi, Massachusetts eHealth Collaborative Adam Greene, Office of Civil Rights Joy Pritts, ONC Judy Sparrow, ONC 2

Tiger Team Approach Work intended to flesh out a comprehensive privacy and security framework, guided by fair information practices (ONC’s Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information) –Copy of working document provided to Committee –Updated to include August recommendations Today’s update provides an initial set of recommendations on the principle of openness and transparency 3

Core Values Patients should not be surprised to learn what happens to their health information. The provider-patient relationship is the foundation for trust in health information exchange. Providers are responsible for ensuring the privacy and security of patient information but may delegate functions to business associates if done in a trustworthy manner. about or harmed by collections, uses, or disclosures of their information. 4

Core Values NEW core value: Transparency about information exchange practices is a necessary component of establishing credibility with patients. In achieving greater openness and transparency for patients, we need to balance the need to give patients complete information on how their information is shared while at the same time providing information in a form that is manageable for patients to read and understand. 5

Key Challenge & Solution Challenge: How can we have complete information exchange transparency, without creating a notice that is unmanageable for patients and without creating undue burden on providers? Solution: Implement a tiered (“layered”) approach to transparency. Applied to three contexts: –The HIPAA Notice of Privacy Practices (NPP) (required of all providers) –“Indirect” Exchange (exchange that triggers meaningful consent per August recommendations) –Organized Health Care Arrangements and other integrated delivery networks (OHCAs) 6

Transparency Recommendations Providers should provide the HIPAA NPP as a layered notice –Short summary of sharing policies and activities –A detailed notice for interested patients –Plain English & at an appropriate reading level –Current & anticipated exchange activities, not just what the law permits 7

Transparency Recommendations Where there is an “indirect exchange” that triggers consent, notice to patients should –not be buried in the NPP, but easily distinguishable, –be layered, providing a brief summary of the model (including purposes for which information can be accessed/shared), with more detailed information available, and –be provided in advance, per August recommendations With respect to OHCAs –All patients should receive summary information; this notice should be distinct & not buried in the NPP. –Patients should have the ability to obtain more detailed information, including list of all participants. 8

Transparency Recommendations ONC should require federally funded HIOs and Regional Extension Centers to develop and implement public education plans regarding their information sharing policies and practices. The Tiger Team also developed examples of summary notices for situations in which Health Information Organizations (HIO) and Organized Health Care Arrangements (OHCA) are involved. 9

Example Notice: HIO We send an electronic copy of your medical record to the state health Information organization, which makes your data available to other healthcare professionals. We also use a gateway for electronic submission of prescriptions, which keeps a copy of your medications profile. If you want to learn more details about how we perform electronic exchange of data, you may request a copy of our Detailed Information Exchange Description, which can also be found at this web- site: 10