[This Transcript is Unedited]
Hubert H. Humphrey Building
330 C Street, S.W.
Washington, D.C.
Discussion on the Letter to the Secretary
DR. ROTHSCHILD: Let's introduce ourselves. Simon, you start.
DR. COHN: Sure. This is Simon Cohn, member of the committee and subcommittee.
MR. FANNING: I'm John Fanning, from the Office of the Assistant Secretary for Planning and Evaluation of HHS. I'm the privacy advocate of the Department, and I serve as staff to the committee.
DR. DENNEHER: John Denneher, new committee member.
DR. ROTHSCHILD: And I guess new subcommittee member, too.
DR. DENNEHER: Subcommittee member.
DR. ZUBELDIA: Kepa Zubeldia from Clareti Corporation, member of the committee and subcommittee.
DR. BLAIR: Jeff Blair, Medical Records Institute and member of the subcommittee.
DR. FITZMAURICE: Michael Fitzmaurice, Senior Science Advisor for Information Technology at the Agency for Health Care Research and Quality, liaison to the National Committee and staff to the Subcommittee on Standards and Security.
DR. HORLICK: Gail Horlick, Centers for Disease Control and Prevention, staff to the Subcommittee on Privacy and Confidentiality.
DR. ROTHSCHILD: And if we could have our guests?
DR. ROADY: Dan Roady with the American Health Information Management Association.
DR. TATE: Michael Tate, the American Dental Association.
DR. GUILFOY: Helene Guilfoy, Guilfoy Consulting.
DR. WILSON: Bruce Wilson with the Physician Insurance Association.
DR. ALD: Vivian Ald, National Library of Medicine
DR. CHOY: Angela Choy, Health Privacy Project.
DR. AARONSON: Deborah Aaronson, Federation of American Societies for Experimental Biology.
DR. RUNNICK: Tim Runnick, American Association of Health Plans.
DR. GATES: Michelle Gates, Inter Technology, Inc., contract support for the DoD PMA Uniform Business Office.
DR. ROTHSCHILD: Thank you, and welcome to all of you. Before we get started, I'd like to tell you that we have to vacate this room by 5 o'clock, because that is when the NHII work group is going to meet, and because there are some people who overlap on both this subcommittee and the working group, it is my hope that we can break five to 10 minutes early, to give them a brief break between sessions.
As you know, the purpose of our subcommittee meeting is primarily to discuss the next letter to the Secretary from the committee. You should have in your packet -- actually, it is both in the briefing book as well as in the subcommittee packet a copy of the draft letter.
What is in the subcommittee packet is the version of the letter containing the proposed revisions that were submitted by Mike Fitzmaurice. You can see where the adds and the strikes, et cetera.
So before we get started on the individual comments with regard to sections, I'd like to take a second and discuss with you in a very general way some of the constraints that I believe the subcommittee was under in trying to draft this letter.
The purpose of the hearings that we had in August on the four issues that we selected was specifically to discuss implementation issues. We wanted to hear from the folks who were actually trying to comply with the privacy rule about some sort of unanticipated consequences, practical problems that they were running into, areas that they thought needed to be clarified.
As we get into it then, it seems that we have gone beyond that to major, in some cases substantive revisions of the rules, including some of the foundational bases of the rules. I'm not saying that is off the board; all I am saying is that is an unanticipated problem that the subcommittee has run into.
Another issue that has complicated our work has been the nature of the testimony we have received. Sometimes we received individual comments or comments from a few witnesses as part of the whole range of recommendations or concerns that they had, without elaborating on what exactly do you mean by that. At the hearings themselves, we were sometimes able to ask questions of the witnesses to try to get at that. But in the case of the written testimony we received, that of course was not possible.
In addition, we have been faced with the difficult in some places issue of whether to even mention recommendations that we are rejecting; should we acknowledge some peoples' suggestions that we do the following things, and when we ultimately decide not to go through with them. We discussed one of those issues earlier today when we were talking about the suggestion that we include research within the areas for which a general one-time consent would be necessary.
We included that, because we thought it was an important enough issue that we thought we needed to recognize that that was a concern.
The other problem is that the conference call at which we discussed many of these issues, we did not have full participation of the subcommittee, so it was I think inappropriate for us to go out on a limb in terms of our recommendations, when we didn't really have widespread support.
So those are just some of my views as to the complicating factors. If the members of the subcommittee would like to make some general statements before we go into some specific issues, I think now would be the time to do that.
Okay, I can see you are anxious to dig into the meat of the issues. So the first thing that I would like to do is, if it is okay with the members of the subcommittee, I would like to work through the proposed revisions contained in Michael Fitzmaurice's proposal, because that has both versions. I assume everyone has a copy, including our guests?
DR. COHN: And I presume the cover sheet and the pink is the same?
DR. ROTHSCHILD: Duplicate, it looks like.
DR. COHN: Duplicate, okay.
DR. ROTHSCHILD: Yes, it should have draft 11-5 written in bold.
DR. BLAIR: Is Michael here?
DR. FITZMAURICE: Yes, I'm here to your right.
DR. BLAIR: Do you think it might be helpful -- because I think Michael's comments, in some cases they were suggestions, but in many cases they were comments, and even prompting us as to make a decision or take a position where we hadn't. I am almost wondering whether it might be expeditious if Michael were to lead us through some of those things, because he might be able to get us to the heart of the comment which is for our decision or our action and get us focused and moving quickly. What do you think?
DR. FITZMAURICE: Jeff, that might be expeditious, but I want Mark to be able to point to other people as necessary and not let one person monopolize the presentation.
DR. BLAIR: Okay.
DR. FITZMAURICE: Even if it is me.
DR. COHN: Mark, I'm going to just suggest for process -- and recognizing that we are I believe on the Internet, is that correct?
DR. ROTHSCHILD: Yes.
DR. COHN: So people have obviously not seen any versions, but just recognizing that the changes that Mike is suggesting for the introductory paragraphs are primarily wordsmithing changes, you might want to read these, note the changes as they occur, and if we agree with them, then we can accept those changes all at once before we get into the substantive areas.
DR. ROTHSCHILD: Okay, I think that is an excellent idea
DR. COHN: Then we can handle paragraph by paragraph after that.
DR. ROTHSCHILD: The paragraphs that I am about to read now, I will read in the revised form. It is a proposal to a proposal, so we might as well read it as proposed. Then we can go through any corrections that we might have.
Dear Secretary Thompson. As part of its responsibilities under the Health Insurance Portability and Accountability Act of 1996, HIPAA, the National Committee on Vital and Health Statistics, NCVHS, monitors the implementation of the final rules that adopt the health data standards required by the administrative simplification provisions of HIPAA.
Okay? Good.
Next paragraph. On August 21 to 23, 2001, the NCVHS Subcommittee on Privacy and Confidentiality held public hearings on the implementation of the final rule, standards for privacy of individually identifiable health information that was published on December 28, 2000. More than 30 people including health care providers, payors, researchers, members of professional organizations, other users of health care information and members of the public testified on 40 issues identified by the Department of Health and Human Services, Office of Civil Rights, OCR, and NCVHS: One, the requirement for consent in order to use protected health information for treatment, payment and health care operations. Two, the requirement that covered entities make reasonable efforts to limit the use and disclosure of protected health information to the minimum necessary. Three, the regulation on research and four, the marketing provisions.
Anybody have any problems with that? Mike?
DR. FITZMAURICE: I would just suggest an apostrophe after services, to show that it is the Department of Health and Human Services' Office of Human Rights.
DR. ROTHSCHILD: Yes, thank you.
MR. FANNING: Mr. Chairman, a brief editorial thing. The regulation on research doesn't quite make sense. I think what is meant is the effect of the regulation on research or the impact.
DR. FITZMAURICE: Or the regulation's provisions on research?
DR. COHN: The effect of the regulations of research, I think.
DR. ROTHSCHILD: Anyone have a -- we are going to make this the effect of the -- can we make it rule to be consistent? We have been using rule instead of regulation, is that all right?
MR. FANNING: Whatever it is, the same term.
DR. ROTHSCHILD: The effect of the rule on research. Any other comments on that paragraph?
Next paragraph. The focus of the hearings was to explore practical issues in implementing the final rule, including unintended consequences of the rule, possible inconsistencies and areas needing further clarification. Panelists were asked to provide specific suggestions for possible modifications of the rule. Additional written comments from testifiers and others were also received.
Comments?
In an October 1, 2000 letter to you, NCVHS addressed the consent requirements and the minimum necessary provisions, and provided recommendations for you to consider. This letter contains our recommendations on the research provisions and our comments on the marketing provisions.
Since OCR staff attended the hearings and received copies of all the written comments, including comments that addressed issues that were beyond the scope of the hearings, OCR will have the opportunity to address these additional issues not covered in this letter.
DR. COHN: Maybe it is consider?
DR. ROTHSCHILD: To consider these additional issues? Okay.
DR. ZUBELDIA: Mike, also, this letter contains our recommendations on the research provisions and our initial comments, because there will be more forthcoming.
DR. ROTHSCHILD: I'm sorry?
DR. ZUBELDIA: At the end of the third line, our initial comments referring to marketing.
DR. ROTHSCHILD: Yes, okay, thank you. After our initial. Other suggestions?
Next paragraph. NCVHS will continue to see public comments on the implementation of HIPAA administrative simplification provisions. In light of the widely-voiced concern about the lead time needed for implementation, NCVHS respectfully recommends that modifications to the privacy rule be made and disseminated as expeditiously as is possible.
Comments on this paragraph? Hearing none, we will just set this aside and move now to the section on research.
Before I read this section, which is much more aggressively revised, let me ask all of you to consider the issue of whether we need to include in particular the second paragraph at all, under the theory that it is basically a rejection paragraph, stating what we heard, and that we don't want to go along with it. That might clear up a lot of the problem. I suppose that also colors the first paragraph as well.
Simon?
DR. COHN: Go ahead.
DR. ROTHSCHILD: Let me read the first paragraph, not counting the bracketed editorial.
DR. FITZMAURICE: I'd appreciate that.
DR. ROTHSCHILD: Under the heading, research. Witnesses expressed concern that the additional costs and administrative burdens they believe will be generated when researchers comply with the privacy rule may have a detrimental impact on researchers' access to essential medical information, and therefore on researchers' abilities to pursue their mission.
There was also concern that unwarranted fears of civil and criminal penalties for the improper use and disclosure of information create a disincentive for covered entities to share information with researchers, even when the disclosure to researchers is permitted by the privacy rule.
Research promotion and privacy rule education by the Department are needed to counteract the unwarranted fears. On the other hand, written testimony from others expressed the view that the privacy rule may build public trust in research and help insure that researchers receive complete and accurate health information for their studies. This testimony applauded the Department's attempts to extend the scope of accountability and oversight to privately funded research.
So the floor is now open for comments on this first paragraph.
DR. COHN: I actually am following and tracking through this new sentence which says research promotion and privacy rule education by the Department are needed to counteract the unwanted fears. I am actually not sure what the other hand is all about, since I don't think that that is on the other hand. I think that is just an extraneous set of comments that I don't know -- I think the rest of that paragraph could easily be removed without anything being damaged.
DR. ROTHSCHILD: I think it used to be on the other hand. It may not any longer be on the other hand.
DR. FITZMAURICE: To show the contrast in the paragraph, that says, hey, this privacy rule has raised unwarranted fears and on the other hand, it gives assurance. It does one or the other. There are countervailing views here.
DR. HORLICK: That was to reflect what we heard in the testimony.
DR. ROTHSCHILD: Right, and it wasn't necessarily even unwarranted fears so much. We had a group of witnesses who said that the research provisions were seriously flawed, and that they would stifle research. We had other witnesses who said these research provisions are basically pretty good, and will encourage research and insure that researchers have complete and accurate health information.
DR. COHN: Well, maybe it is a different paragraph then. This is a non sequitur going on right now, which is -- I think what we are saying here is that, as it has been reviewed, I think we are saying that research promotion and education are needed to counteract the fears. I don't know if they are unwarranted fears, but they are fears.
DR. FITZMAURICE: Warranted fears help compliance.
DR. COHN: I don't know whether they are warranted or unwarranted, but they are just fears.
DR. FITZMAURICE: I am asserting that many a point that were expressed were incorrect interpretations of the privacy rule and therefore unwarranted. You can disagree and I can be right or wrong, but I am offering that for your consideration. I am perfectly agreeable to have any of it struck.
DR. ZUBELDIA: If it is still on the other hand, you would say better informed testifiers.
DR. FITZMAURICE: Well, we're not sure of that, either.
DR. ROTHSCHILD: Let me just try to put these two paragraphs at the moment into context. This is the introduction to the research section. It is not any of our specific issues dealing with research, which are broken down before.
So one possibility that might make it a little clearer is if we actually deleted the sentence before "on the other hand", because we specifically address that issue in point number six. That would then make it -- some people basically said the privacy rule, treatment of research is good, and other people said it wasn't so good.
DR. COHN: Okay.
DR. FITZMAURICE: That does tend to support one of the recommendations rather than be an introductory portion.
DR. COHN: So why don't you just start reading, there was also concern, and read the rest of it.
DR. ROTHSCHILD: Okay. There was also concern that unwarranted fears of civil and criminal penalties for the improper use and disclosure of information create a disincentive for covered entities to share information with researchers, even when the disclosure to researchers is permitted by the privacy rule.
On the other hand, written testimony from others expressed the view that the privacy rule may build public trust in research and help insure -- et cetera, et cetera.
DR. COHN: I guess I'm fine, except I am still confused by this "unwarranted". I think it is fears of, warranted or otherwise. I think it is the fears that is the issue here, as opposed to the warranted or unwarranted.
DR. FITZMAURICE: If you have seen how the legal process has unfolded in many other regulatory things, unwarranted is not --
DR. COHN: I think what you are describing here is fine so far, but I would get rid of the "unwarranted".
DR. ROTHSCHILD: The "unwarranted" is an editorial judgment on --
DR. FITZMAURICE: Mine.
DR. ROTHSCHILD: Michael's editorial judgment. As we have revived this paragraph, we are actually setting out what the witnesses said. So are you comfortable with removing "unwarranted"?
DR. FITZMAURICE: Sure.
DR. HORLICK: So are we leaving that sentence in?
DR. ROTHSCHILD: No, we are taking out the sentence, and we are also taking out "unwarranted".
DR. HORLICK: So we are taking out the research promotion sentence?
DR. ROTHSCHILD: The sentence that begins "research promotion" is deleted, and the word "unwarranted" has been deleted.
DR. HORLICK: Okay. Then if you really want to look at in the next sentence, on the other hand, then what they said is, this will build trust. They didn't say it may build trust.
DR. ROTHSCHILD: Right.
DR. HORLICK: If we are reflecting what they said.
DR. ROTHSCHILD: So if we want to undo that, we can go back --
DR. MC DONALD: Is that what the said?
DR. HORLICK: That is what some of them said.
DR. MC DONALD: They actually said? In 30 years of being a researcher, I haven't seen a great wave of untrust among researchers. It is posing a problem that --
DR. ROTHSCHILD: No, there was testimony from some of the public interest to categorize the group, privacy advocates, that --
DR. MC DONALD: Then we should say that.
DR. ROTHSCHILD: Well, we didn't identify who said anything else.
DR. HORLICK: Really, what we are trying to get at, we heard two sets of things that --
DR. MC DONALD: They cancel each other out.
DR. HORLICK: Right, but that is what we heard in the testimony. So some people said, well, we are afraid of these penalties and all this, and the other people said, no, we think these rules are good, they are going to help us feel better about research.
DR. MC DONALD: But I'm almost certain the top one is researchers. They are talking about their interests.
DR. ROTHSCHILD: Can you use the mike, please? We're on the Internet.
DR. MC DONALD: It would make a difference if we could identify the sources. If it says some researchers thought this was bad and some researchers thought it was good, then it completely blanks it out. If you are saying researchers had some worries and other parties --
DR. ROTHSCHILD: Well, they weren't actually all researchers. Some were medical institutions, some were pharmaceutical companies.
DR. MC DONALD: I didn't mean professional researchers, but both of those kinds of organizations -- people didn't come from the local hospitals to testify about research. It was the Mayos or the Harvards or whatever.
DR. ROTHSCHILD: Well, arguably the privacy advocates have an interest in research, too, just of a different kind. Michael?
DR. FITZMAURICE: I want to draw a parallel. Up at the third line down, talking about the burdens that will be generated when researchers comply with the privacy rule, may have a detrimental impact, then down below, I made a parallel; two mays, may build public trust, may have a detrimental impact. You could say will have a detrimental and will build public trust. Since we heard from several different people, I don't remember which ones said will and which ones said may. I was just making a parallel.
DR. ROTHSCHILD: That is a good point. So now the question is, do we want to use will in both places or may in both places?
DR. COHN: Why don't we do may?
DR. ROTHSCHILD: May in both places? Is everyone comfortable with that? So we are going to leave the may in the third line and change -- leave the may in both places, I'm sorry. Anything else in that first paragraph? Simon?
DR. COHN: I'm looking at the last sentence. Testimony applauds the Department's attempt to expand the scope of accountability and oversight to privately funded research. I guess that is probably okay.
DR. ROTHSCHILD: I think that is accurate, in the sense that of course, the common rule as enforced through HHS and the other agencies applies to federally funded research, although it is not -- it is an accurate statement, but perhaps a non sequitur here, in the sense that it doesn't flow directly from this point-counterpoint that we set up earlier in the paragraph. So it wasn't specifically that.
If we want to include that sentence, I think we would have to make it sound something like, the testimony also applauded this as an extension, rather than making that sound like it was describing the prior sentence.
DR. HORLICK: I think it may be there, I'm not sure. It may be that the people that were thinking it builds public trust may have said that. So maybe that is how it got there.
DR. FITZMAURICE: The way the paragraph was written, I assume that they were the same people.
DR. HORLICK: Right, exactly.
DR. FITZMAURICE: Even though it may not be the same points being made above.
DR. ROTHSCHILD: So there are a couple of options to fix this. We can add some language to show this was a separate point made or asserted by the same group, or we can delete it as being out of kilter with the earlier statement in the paragraph.
DR. FITZMAURICE: If the sentence is deleted, then NCVHS gets to skirt the issue of whether they agree with the Department extending the scope of accountability and oversight to privately funded research. That may be a plus, but it doesn't give guidance to the Secretary on that point. If you leave it in, the Secretary is going to say, so this is what testimony said, what does my august body of advisors say?
DR. MC DONALD: It gets more complicated than that, though, because much privately funded research is covered by yet other things. The FDA has got its own regs. It almost sounds -- I guess I'd be in the line of taking it out. It almost sounds like there is nothing covering all this private research, but there may be some corner of it, market research or something that is not covered.
DR. COHN: Certainly it is an odd place to put it if we want to make a recommendation about it.
DR. FITZMAURICE: Yes, I think it begs for a recommendation, or at least a statement from the committee.
DR. HORLICK: It was written, so here is a paragraph or two on the overview of the testimony, and then below is, now we are going to talk about what the issues are and what we are recommending. So I don't know if we actually need to make a recommendation on every bit of testimony that we address in the overview.
DR. COHN: Yes. I think we will need to say somewhere that we support the direction and whatever of the privacy rule. I think there is probably need there. But let's hold that thought and see if in the next paragraph we want to get rid of it.
DR. ROTHSCHILD: It is possible that we might want to -- instead of the last sentence in the first paragraph, we might want to conclude -- assuming that we ditched the second paragraph, we might want to save the last sentence of the second paragraph and make that as the concluding sentence of the first paragraph.
DR. COHN: Okay, that's very good.
DR. ROTHSCHILD: So let me read the second paragraph minus the editorial commentary.
There was also testimony that substantive modifications to the common rule are beyond the scope of HIPAA, and that some of the waiver criteria are impracticable and duplicative of the criteria in the common rule. Specifically, there was concern about the ambiguity of criteria, such as the requirement that privacy risks must be reasonable in relation to the anticipated benefits. NCVHS believes that what is termed ambiguity here is a statement of one of the privacy rule's responsibilities for the IRB PB relative to the confidentiality of PHI, and that reasonable IRB PBs may reach different local decisions. What is termed ambiguity is the permitted latitude of the body of human minds to determine what is reasonable.
NCVHS is committed to maximizing access to protected health information that is essential for research as long as appropriate safeguards are in place.
DR. COHN: I think that last sentence is fine. Let's get rid of the rest of it.
DR. ROTHSCHILD: So you would support that?
DR. COHN: I strongly support that.
DR. HORLICK: That goes after studies?
DR. ROTHSCHILD: Let me just restate what the proposal is. Yes, to delete all of the second paragraph except the very last line, and substitute that last sentence for the last sentence in the current first paragraph, so that the first paragraph would end -- and this would be the entire body of the introduction -- with the following two sentences: On the other hand, written testimony from others expressed the view that the privacy rule may build public trust in research and help insure that researchers receive complete and accurate health information for their studies. NCVHS is committed to maximizing access to protected health information that is essential for research, as long as appropriate safeguards are in place.
How is that? John?
MR. FANNING: You have moved from a description of what was said to a committee comment.
DR. ROTHSCHILD: Yes, right.
MR. FANNING: I am wondering whether you might want to do that, whether you really want to do that. You can get the views in later, it seems to me, maybe by changing recommendations in the next line to observation, then including that among that.
I think you have been at great pains now not to have editorializing, if you will, in these paragraphs. Now you have suddenly inserted a statement of the committee's view.
DR. ROTHSCHILD: I think that is an excellent point. One option; if the subcommittee feels like we need to say something about our overall philosophy, maybe we could include that as a separate paragraph. In other words, we have in the opening paragraph what we heard and then just a sentence saying how we generally feel about things. Would that satisfy the mixing issue, John?
MR. FANNING: Yes, it would for me.
DR. ZUBELDIA: But I'm not sure that it is a commitment to maximize access, but it is more a commitment to allow access, rather than maximize access.
DR. FITZMAURICE: Maybe we don't know what the committee thinks, but I think that what this testimony said was, the world is changing, and they are taking away traditional processes, and we sound like we are trying to support those traditional processes, when you say strongly.
So we don't want to lose anything, is what you are saying in that statement. I like the way you said it. Now, we can argue about the individual adjectives, and I think we should say something like that, unless you think we are against that. This committee is born of a public health emphasis which is interested in discovery and health by data. Public health is born with that; they invented data.
DR. HORLICK: You might be able to put that sentence right before the sentence that says what our recommendations are. So first you have what the testimony said, and then you say what NCVHS thinks. Normally we say what the issue was and what the specific recommendation is, and then you could make a general paragraph about what we are committed to, and therefore we are making the following recommendations.
DR. ROTHSCHILD: John?
MR. FANNING: I was just going to say, I do think this committee has supported research, and that maximizing is a reasonable word there, putting words in the mouths of the researchers. However, lest that appear too one-sided or arrogant, I would say something more than, as long as the appropriate safeguards are in place, simply as a matter of tone, to make a little more clear. Say a few more words, like, as long as there were careful precautions to be sure that the information is carefully protected, that it is used only in a respectful way and is truly necessary, or something else.
DR. ROTHSCHILD: In other words, you think that we need to amplify -- if we are going to take a strong position of maximizing, you think we need to amplify on what we mean by safeguards?
MR. FANNING: That's correct. It is simply a matter of tone. I wouldn't go into a lot of detail about the safeguards, but bland passing reference to appropriate safeguards may look cavalier.
DR. ROTHSCHILD: If everyone agrees to that, John, can you repeat the specific language?
DR. MC DONALD: Maybe we could cover some of these other ones, and then we could come back to it.
DR. ROTHSCHILD: A revision to that sentence that we will incorporate?
DR. MC DONALD: I just want to clarify, if there was testimony in this part of the paragraph, I don't know if I heard this testimony, but there has been concern -- the regulation is added to the common rule. There are two more bullets that the common rule doesn't have. I'm not sure what this first sentence was trying to say. Was this trying to reflect what some of the testifiers were saying, that they shouldn't be messing with the common rule?
I'm afraid we are not reflecting something. Can you recall what the point was in the testimony?
DR. HORLICK: Not exactly. The way it is written leads me to believe that some of the testifiers didn't quite understand how the common rule would be impacted or what the rule would do.
DR. FITZMAURICE: I think it was clear that by talking about there being any modifications of the common rule, they didn't understand that the privacy rule is entirely separate from the common rule, did not modify the common rule, and that the framers of the privacy rule felt that those criteria, even while they appeared to be duplicative of what is in the common rule, were needed to guide privacy boards as well.
So why not make the same criteria for both, privacy boards and IRB when reviewing the privacy considerations of a research project?
DR. MC DONALD: I thought it did. I thought it did absolutely modify it. There are two more bullets added to the common rule.
DR. FITZMAURICE: No, it did not change the common rule at all.
DR. MC DONALD: That is correct literally, that it didn't change what is in another document, but it added these two other requirements on top of those requirements.
DR. ROTHSCHILD: What requirements are you talking about?
DR. MC DONALD: Unless they took it back out of the draft version on the first pass, there were two more explicit bullets put on there that were not in the common rule. In fact, one of them, I couldn't tell what was different about it.
On top of that, there was a political -- or there was a push to try to get the common rule changed as well, which made me really nervous, because this whole research -- we don't have a problem that I have heard about in research. It is just that all of a sudden, it is being posited. We are being very defensive. This research stuff is what is making people live now; everybody is getting excited about it, because we are doing things that help, and maybe we'll cure cancer.
So I am really worried about accepting the premise that we have got this horrible problem with research. I think we should defend the research position.
DR. COHN: Clem, can I just ask you before we go any further here, I don't know that you need to recuse yourself, but I do think you need to disclose --
DR. MC DONALD: I'm a researcher. I guess everybody guessed that.
DR. COHN: I just want you to disclose your affiliations on all of this stuff.
DR. MC DONALD: I am a university professor, and I do research. I have worked with people for 30 years, and I haven't heard -- this is not in the press or anywhere, that I have detected a raging civil problem. There are issues about privacy in general, but I haven't heard raging civil problem about IRB controlled research. So I think that someone has got to defend the position that -- are we solving a problem that isn't there.
DR. MC ANDREW: There are four criteria that the common rule provides for IRB consideration of when informed consent should be waived. Essentially, what we did, there are actually eight factors that are expressed in the privacy rule as to what an IRB or a privacy board should consider when determining when individual authorization ought to be waived in order to provide a researcher access to protected health information without the individual's knowledge or consent.
Of those eight privacy factors, the first three were our best attempt to take the criteria in the common rule and specify how those criteria may apply in a privacy context, since that is the only thing that we have authority to govern.
The other criteria that were expressed in the privacy rule were adapted from other parts of the common rule or were part of guidance under the common rule in terms of general principles on confidentiality and privacy. What we had received many comments on was the fact that -- what we had done in the privacy rule, we had in fact amended the common rule. We maintain that that was not what we did. We were establishing a set of principles for waiver of the individual authorization under the privacy rule that were applicable to research in general, whether it subject to the common rule or not subject to the common rule.
DR. MC DONALD: When you look at this net, there are two different sets of bullets. Whatever label you put on them, it would be much easier for the world if you just did it by reference or had one set of bullets.
You could say the common rule, this package, now applies to everything without having to add two bullets, at least one of which is confusing. So what I think the research community was worried about is, you have got a common rule-like rule that granted, is not the Declaration of Independence -- that is a different document -- but it has almost the same components plus some other ones, and you are saying that applies to everything.
Saying it applies to everything is good and fine and well. I don't think anyone is objecting to that. It is just that now we have two places to figure out what is true and what do these words mean, and two more lawyers to go to, and that sort of thing.
DR. FITZMAURICE: Clem, can't both be true?
DR. MC DONALD: Sure, they can both be true, but in general, you like to pocket in one encapsulated object -- in the programming world -- the stuff that has to do with that. I think what this testimony was saying is, why did you just not reference the common rule, or why do you tweak it.
Granted that it is a different scope of control, but how I would have done it, why didn't you just say, the common rule applies to all this research, and here it is. We are going to incorporate it totally in the document, instead of making changes, because there are also going to be changes made in the common rule by a different board, and then we are always going to have this -- and it is not a bad set of rules.
So I think the testimony was saying that they don't like having this difference. That is what I think they were saying.
DR. ROTHSCHILD: Do you want to respond?
DR. MC ANDREW: Only to say that the --
DR. ROTHSCHILD: Why don't you just identify yourself for the Internet?
DR. MC ANDREW: I'm sorry, I'm Sue McAndrew with the Office for Civil Rights. One of the difficulties that we face with the common rule was that the waiver principles are fine, but they are in the context of an overall research project approval or disapproval. While they focus on whether or not informed consent is necessary for that particular research to go forward, privacy and confidentiality is not the sole focus. In fact, they are only kind of inferred.
DR. MC DONALD: By definition, when the rule says you should balance it against the value.
DR. MC ANDREW: In fact, the criteria in the common rule never really used the term privacy or confidentiality. They are looking at a broader set of risks and benefits from the research than what we would be focused on in a strictly privacy context.
All that said, one of the things you struggle with is -- that we struggled with in trying to come up with a set of criteria was not importing so much of the common rule that we were actually getting into some sort of substantive approval or disapproval of the research per se when the common rule was not otherwise applicable in trying to explain what the common rule factors, which does go into that, where the common rule does apply, how to narrow that into just a privacy context.
DR. ROTHSCHILD: Let me recognize John.
MR. FANNING: First of all, with respect to this criterion which you say is new or different about the balancing of the privacy risks, right now the common rule requires that kind of calculation for all research, even if you are asking the subject for his or her consent. So it is not an unreasonable thing to take into account.
I don't want to get into an advocacy mode here, but let me say, I think what Sue just pointed out is perfectly correct. This is a refinement that is privacy specific of a very general set of rules. These rules were developed in the 1980s. People are a lot more thoughtful about privacy now. We have refined the kind of things we should take into account.
Many of the factors here are already in use. For example, this Department gives out information for research with identifiers without consent under a set of conditions set out in the Privacy Act system notices, and some of these factors appear there.
So my only point is, these are the kind of things that any IRB ought to take into account in any case.
DR. MC DONALD: I think you're getting the wrong position in this. I am arguing that the testifiers were saying that you screwed around with the wording and you made it more complicated. I don't think that is terribly wrong, but I don't think we can settle the real truth of it.
Basically, they are saying, why didn't you just leave it simpler and refer to the common rule, and we can argue about how you make that work. That is all I really wanted to say. I think we discard that. They came to give this testimony, and we have ignored it.
DR. ROTHSCHILD: So your suggestion is that we not eliminate the second paragraph, but revise it somehow to present the views of the witnesses who were concerned about the interface of the common rule with the privacy rule.
DR. MC DONALD: Right.
DR. ROTHSCHILD: And we certainly can do that, if that is the subcommittee's wishes. Although, let me say, that may take some very delicate drafting.
DR. MC DONALD: That actually I think is the whole issue, how they interact.
DR. FITZMAURICE: If you want to give directions to those who are using data for research, some of which are subject to the common rule and some of which are not, you are perfectly free to put a set of criteria, some of which are common rule criteria and some of which are additional criteria.
Now, the committee can have an opinion on, gee, I don't like the seventh one, I don't like the sixth one, and they can make a recommendation that it be changed. But to say, one ought to be more like the other --
DR. MC DONALD: We're not saying that. We're saying that the testifiers said that. If they didn't say it, then we can forget it.
DR. FITZMAURICE: But some of what they said was wrong.
DR. HORLICK: Yes, I'm not sure that is what they said.
DR. ROTHSCHILD: Sue, did you want to comment?
DR. MC ANDREW: No, I do think it is not an unfair characterization of the testimony that we got through the comment period, as well as -- what I heard at your public hearings was that in fact, we had made life particularly difficult for researchers that are subject to the common rule by layering on top of their efforts separate and in some cases distinctly different privacy standards for obtaining essentially the same kind of waiver.
DR. MC DONALD: That is another perfect way to say it. I'd take either of those.
MR. FANNING: Yes, I think that is a fair characterization. They were saying that.
DR. ROTHSCHILD: Okay. Now, we have all agreed what they said. The issue is, does the subcommittee believe that we ought to say what they said, or to characterize what they said in this overview to our recommendations.
DR. COHN: I guess what I am hearing is almost more along the lines of a recommendation, which is having to do with -- we heard there was concern about that interface, and we recommend that there be clarification, not clarification, more guidance developed by OCR and HHS to clarify this, and if necessary rectify any inconsistencies.
DR. ZUBELDIA: Should we have a section after the sixth recommendation and before going to marketing that says something like, other issues for which the subcommittee makes no recommendations, but we want to reflect here?
DR. ROTHSCHILD: Simon's suggestion when we get to that first may moot your suggestion. I take it that Simon's suggestion is that we carve out what is currently in the second paragraph as rewritten, according to what we have just discussed, and make that a separate point where we don't know, but to add to the sixth and make a seventh point, the relationship between the privacy rule and the common rule.
DR. ZUBELDIA: But without a recommendation, just other issues reflected in testimony.
DR. FITZMAURICE: I think it would be fairest if we just decide whether we want to say what the testimony was, and then decide whether we want to make a recommendation or not.
DR. COHN: I don't want to reflect the testimony without a recommendation. I don't think it makes much sense. I don't see why we should bother.
DR. HORLICK: We reflected testimony about fears about criminal testimony and we didn't make a recommendation about that. Even in our consent issues, we sort of gave a broad brush of what they had to say.
DR. ZUBELDIA: But the recommendation about that was further education.
DR. HORLICK: Well, that's true.
DR. ZUBELDIA: Maybe the recommendation on this issue with the final rule is the same, further education.
DR. FITZMAURICE: Or clarification.
DR. ROTHSCHILD: Well, there is in my viewpoint a major distinction between clarification and education. Education is making sure people know the way it is, and clarification is to explain some ambiguities or --
DR. FITZMAURICE: Interpretation for a given scenario.
DR. ROTHSCHILD: Yes, like applications. So I think the first thing we need to consider is -- let me restate the issue the way I see it, maybe you will agree. That is, whether we want to agree with Simon's suggestion that the issue of the relationship between the common rule and the privacy rule needs to be expressed separately as a separate item and also containing a recommendation of some sort to deal with that. That is my view of your suggestions, is that correct?
DR. MC DONALD: That is correct. I support that.
DR. ROTHSCHILD: Okay. So let's just take a sense of the subcommittee.
DR. ZUBELDIA: Yes.
DR. FITZMAURICE: Could I discuss a point?
DR. ROTHSCHILD: Sure.
DR. FITZMAURICE: Let's suppose that we agree that we have common rule criteria, privacy rule criteria, there is some duplication or there may not be duplication otherwise. What would be the sense of the committee, with the sense of the committee saying, yes, that is the way it is and we like it? Or with the sense of the committee being, we recommend the following change?
DR. COHN: I guess my straw man on this one is, I don't mind duplication. What I think we should be concerned about are inconsistencies.
DR. FITZMAURICE: And so far, I have seen no inconsistencies pointed out.
DR. COHN: Well, if indeed there are no inconsistencies, then HHS only needs to provide guidance. If there are inconsistencies on further evaluation, then that needs to be dealt with.
DR. MC DONALD: As I understand it, and maybe you will know better, I think there is a considerable concern in the research community about a lot of interactions in a lot of these things, and I think we should respect their concerns.
I would suggest it should be reviewed and can be considered. I think one of the concerns -- and this is third or fourth hand -- there is some NIH-level concern that some of these things are developed without collaboration, without a discussion. I don't know if that is true. No, that's not true?
DR. FITZMAURICE: It was fully discussed with NIH.
DR. MC DONALD: About the common rule stuff?
DR. FITZMAURICE: Yes.
DR. ROTHSCHILD: Well, let's take up the issue. I think we have got thoroughly widespread consensus that the issue of the relationship between the common rule and the privacy rule needs to be a separate item, in which I think, Gail, -- are you satisfied with your -- you'll get to see it again -- a version of the concern.
DR. MC DONALD: You stated it the very best, I think, the most acceptable. Can you restate that?
DR. FITZMAURICE: That's not what the testifier said.
DR. ROTHSCHILD: Well, we're going to change it.
DR. MC DONALD: We've got to reflect it. We have got to get the tape. What we have here doesn't tell anybody what --
DR. FITZMAURICE: If what she said is accurate, I would like to see it as advice to the Secretary.
DR. ROTHSCHILD: So now the issue is, let's assume that we can phrase the concern in a way that people are satisfied with. Now the question is, what should be the tenor of our recommendation? So from what I am hearing, and people will undoubtedly correct me if I am in error, is that what we are going to ask the Secretary to do is take a look at the relationship between the common rule and the privacy rule and to clarify and if necessary amend the rule to make sure that there are no inconsistencies or unnecessary impediments to research.
DR. FITZMAURICE: But if we say that, you are the Secreary, you're looking at the letter and you're saying, they say look at this for any ambiguities or inconsistencies, they can't find any and they want me to look for them? They are not pointing any of them out to me. They are saying, there may be a problem, take a look at it. I got better things to do with my time.
DR. ROTHSCHILD: How about if it is to clarify the relationship between the privacy rule and the common rule? Is that better?
DR. COHN: And if inconsistencies are identified or whatever.
DR. MC DONALD: I liked your thing about avoiding unnecessary impediments.
DR. COHN: Okay, maybe it is clarify or avoid unnecessary impediments.
DR. ROTHSCHILD: Gail, how are you doing?
DR. ZUBELDIA: Mark, if we make that recommendation number seven.
DR. ROTHSCHILD: I don't think I'd like to make it number seven. We'll have to figure out where to put it. That will be our next issue. Seven, the general education, I'd like to make that the last one. So I am open to what other --
DR. ZUBELDIA: Okay, the seventh recommendation. But then do we still keep that last sentence of the first paragraph, in the first paragraph? Or do we make that part of this new recommendation?
DR. ROTHSCHILD: Do you have any thoughts?
DR. ZUBELDIA: I think it would fit better into the new recommendation.
DR. FITZMAURICE: Yes.
DR. ROTHSCHILD: So you are suggesting that we use that last sentence as perhaps a last sentence in this new numbered item dealing with the relationship?
DR. ZUBELDIA: In the new recommendation.
DR. MC DONALD: Or an introduction to it. It would work either way.
DR. HORLICK: In terms of the formatting, we have usually stated -- for ones we were making recommendations for, we stated the issue, and then we might put a sentence on what NCVHS thinks or believes, and then we say basically what we recommend.
DR. MC DONALD: It still fits.
DR. HORLICK: But I wanted to ask, in terms of the interface between the common rule and the privacy rule, someone said earlier about the layering of separate and distinct privacy standards on top of the common rule.
DR. MC ANDREW: It was my language.
DR. HORLICK: Right, I liked that one. But I guess that is a little bit of a separate concern than just looking at the relationship.
DR. ROTHSCHILD: I think that is an amplification.
DR. HORLICK: Right, but are we saying that we want the Secretary to look at possible --
DR. FITZMAURICE: You can say whatever you want, but we think there is unnecessary layering. We think this is a problem.
DR. HORLICK: Do we?
DR. FITZMAURICE: And because we think it is a problem, we want the Secretary to look at it. Otherwise why have the Secretary look at it?
DR. MC DONALD: I think if we get the phrasing you said, I think it captured -- it is not a quote from the testimony, but it captured the issues in a clear and non-controversial way. I wish we would have just pulled that out of the air and stuck it on paper.
DR. HORLICK: Well, I wrote it down. You would say then a concern about the laying of separate and distinct privacy standards on top of --
DR. FITZMAURICE: But the concern is either that they don't understand it, or it causes them extra burden.
DR. HORLICK: Right.
DR. ROTHSCHILD: Right.
DR. HORLICK: Or actually, both.
DR. FITZMAURICE: Yes, both.
DR. BLAIR: The reason that you did the layering was, you were trying to --
DR. ROTHSCHILD: Jeff, could you speak into the mike, please?
DR. BLAIR: Sure. When you did the layering, what was your purpose? Why did you do that?
DR. MC ANDREW: The layering was twofold. One to try to interpret a broader set of common rule standards to apply in a privacy context, because our mandate was only to govern -- this is a privacy rule, that is all we can get into. Two, to also focus on other standards which we thought would be appropriate for an IRB or a privacy board to take into consideration in determining whether or not it was appropriate to allow this information to flow without the individual's knowledge or consent.
DR. ROTHSCHILD: With the consent of the members of the subcommittee and in the interests of time, let me propose that I think we have got enough information to do a draft. I would actually propose -- and we can talk about it when we see the language -- make this point number one, because the other ones go into the specifics of the rule itself. Then you will see another version of this. Is that okay? Great.
Let's move on now. We finished the preamble.
DR. ZUBELDIA: And we have taken out that last sentence of the first paragraph, right?
DR. ROTHSCHILD: Yes, we have taken out the last sentence of the first paragraph, and all of the second paragraph to return again in some other form, somewhere else.
The committee makes the following recommendations. Number one, consent instead of authorization. Some witnesses recommended that the privacy rule should be amended to include research as an activity for which a general consent rather than specific authorization is required. As a result, research would be treated in the same way as treatment, payment and health care operations. It was suggested that such an approach would free researchers of burdensome requirements.
Okay?
DR. COHN: My only comment is the title is actually opposite of what you are saying. I don't know what the new title should be.
DR. ROTHSCHILD: We could make it consent versus authorization.
DR. FITZMAURICE: Or in place of.
DR. COHN: Maybe it is versus. The title here is against what we have recommended.
DR. ROTHSCHILD: The next paragraph. NCVHS believes that research though an essential medical activity is not directly related to patient care. When patients are treated by a covered entity, the use of identifiable health information is essential to providing health care, obtaining reimbursement and engaging in other activities such as quality assurance and approved health operations. Accordingly, it is reasonable to cover these practices under a single general consent for treatment, payment and health care operations.
By contrast, research subjects must provide specific informed consent or clearly defined research protocols. Therefore, including research within a general consent would be contrary to established principles of research on human subjects.
DR. ZUBELDIA: I am running into the dual definition of consent in this paragraph. Where you are talking about informed consent, we are calling that authorization under HIPAA. So we are using informed consent without saying that it actually means authorization. Then in the next line, it says general consent, meaning HIPAA consent. I am wondering if there should be some explanation about that.
DR. ROTHSCHILD: Well, you are pointing out the problem. We used consent now in the privacy rule in a way that is different than we typically have used consent in the research setting. Yes, I agree, it is confusing.
DR. FITZMAURICE: Can I make a suggestion that might get us through this pretty quickly? That is, keep only the first sentence and strike all the rest, and then go right into the recommendation.
DR. ROTHSCHILD: In other words, the first sentence of the second paragraph?
DR. FITZMAURICE: Keep, NCVHS believes that research though an essential medical activity is not directly related to patient care. Then strike everything else and say, NCVHS recommends that the privacy rule continue to require individual authorization.
DR. ROTHSCHILD: Okay.
DR. FITZMAURICE: It keeps us --
DR. ROTHSCHILD: It keeps us out of trouble.
DR. FITZMAURICE: Yes.
DR. ROTHSCHILD: John?
MR. FANNING: That is okay. I had a more basic problem. The way this describes the witnesses' grievance, it suggests that the alternatives are, either include research as one of the normal allowable uses within a facility, or get a specific written authorization. Well, in fact, the more typical alternative isn't a specific written authorization, it is a waiver of consent and disclosure for research permission.
This makes the burden seem greater than it really is. The burden they have to do is to go to a board and say, look, is this okay. So I'm not sure exactly what they said, but I can't imagine that they are unaware of the real alternatives.
DR. ROTHSCHILD: I think your earlier testimony before the full committee was excellent in explaining that. What do you think we would need to make that point here?
MR. FANNING: Well, simply say that, to include research activity which would be permitted under the general consent for treatment, payment, operations, rather than an allowable use and disclosure for which the specific conditions in Section 5-12, whatever, including review by a board.
DR. ROTHSCHILD: We are at the top of page three. You are saying, after we say, as a result, research will be treated in the same way as treatment, payment and health care operations, rather than --
MR. FANNING: No, I'm talking about the bottom of page two, characterizing their comments. Again, I don't have the text in front of me, but to set the two alternatives more precisely.
DR. COHN: It sounds like we need to have him come up with the language.
DR. ROTHSCHILD: Would you be willing to write the thing?
MR. FANNING: I can write something. But then you would still have to go on to say -- then you are still faced with this thing of, what else should be said here. I'm just talking about the factual background.
DR. ROTHSCHILD: Right.
MR. FANNING: Witnesses said.
DR. FITZMAURICE: John, could it be corrected by saying, some witnesses recommended that the privacy rule should be amended to include research as an activity for which only a general consent is required?
MR. FANNING: I think you have to make reference to the consent as used in the rule and have a specific word about that.
DR. FITZMAURICE: All right.
MR. FANNING: I think it can be said with ease.
DR. FITZMAURICE: I was trying to skirt the long explanation of what is currently applicable.
MR. FANNING: I don't think it will take very long.
DR. ROTHSCHILD: So, John, you're going to revise that first paragraph?
MR. FANNING: I'll provide the description -- or at least my concept of what we are saying.
DR. ROTHSCHILD: Okay. Now, for the second paragraph, the issue is whether we should go with just that first sentence or whether we need more. John, would you be happy with just that first sentence?
MR. FANNING: I don't really have a view on that. I think it would be fine.
DR. MC DONALD: I think that part is okay. This is again interpreting what the testifiers are saying. I think what comes out of this is that there is this huge spectrum in research from the epidemiological stuff to numbers to cutting someone open. I think some of the researchers are confused, and maybe even the people who are going to judge what you are allowed to do, about where in the spectrum you are allowed to do what. If we could maybe ask the Secretary to clarify -- to give people more explicit guidance.
This is at risk of screwing up the IRBs. Remind them that -- like what you just said; this has been going on for years in the IRB. You have to get IRBs now. So maybe we can say -- I don't know.
MR. FANNING: I don't think the committee has talked about it enough to have a terribly refined focus on this. I think the catch-all thing at the end about education and maybe closer work between the Office for Human Research Protections and OCR in producing guidance and so on might be as detailed a recommendation as the committee can make, at least based on what I have heard of your deliberations.
DR. ROTHSCHILD: Let's take a look at the specific recommendation on this point and see if everyone is comfortable with that. That is, NCVHS recommends that the privacy rule continue to require individual authorization for research and continue to provide the stated exception to the requirement or individual authorization for research use of protected health information.
MR. FANNING: I think they have to be stated in the alternative, because it may not be clear to all readers that those are alternative groups, to use the records for information. Indeed, I think individual authorization will be the uncommon one, will it not?
DR. ROTHSCHILD: To require either individual authorization for research or the -- something referring to the waiver?
MR. FANNING: Yes. Yes.
DR. FITZMAURICE: Or the IRB/privacy board approval of a waiver.
DR. ZUBELDIA: Before we get into that, I would start off saying, NCVHS recommends that the privacy rule not include research in the definition of health care operations.
MR. FANNING: Yes.
DR. ROTHSCHILD: Yes, not include research within health care operations, because we never actually said that.
DR. COHN: Treatment, payment, health care operations.
DR. ROTHSCHILD: So as generally mentioned, if we redraft this paragraph to say that NCVHS recommends that research not be included within TPO, and then say NCVHS further recommends that the privacy rule continue to require either individual authorization for research or IRB/PB waiver of consent or waiver of authorization, I suppose.
DR. FITZMAURICE: I can live with, NCVHS recommends that the privacy rule not include research in the definition of health care operations or TPO, period.
DR. ROTHSCHILD: Instead of doing it this way?
DR. FITZMAURICE: Instead of again explaining all the alternatives. We want to include it in health care operations? We don't recommend that, period.
MR. FANNING: That would be fine. I think it would be helpful to say, we believe that the allowable uses and disclosures for research, the regulation -- no. One could start explaining it, and this is the point of your straightforward --
DR. ZUBELDIA: If you are going to put that explanation, then put it in the paragraph above.
DR. HORLICK: Right. You could put a sentence before --
DR. ZUBELDIA: It is not a recommendation, it is an explanation.
DR. HORLICK: Right, that NCVHS believes that the --
MR. FANNING: Other mechanisms are available for making information available for research.
DR. ZUBELDIA: That is not the recommendation.
MR. FANNING: Then go on to say that it should not be considered with treatment, payment and health care operations.
DR. ROTHSCHILD: Okay. If there is consensus on that, we have now finished two of seven. This subcommittee has undoubtedly done it again, and not gotten anywhere near what we proposed to do. We may be able to get through another number on this list.
I want to raise a process point as to where we go next. We have got to get something done on this. This is our chance now I think to, as a group, agree if we want to plan subcommittee hearings in January on marketing and fundraising, because if we don't do it now, we are just going to totally write that issue off.
DR. COHN: I guess it is your choice about how we proceed. We can delay this, at which point this becomes non-useful.
DR. ROTHSCHILD: Right.
DR. COHN: Or we can try to figure out some way to do this, figure that we will find out some other methodology to handle hearings.
DR. ROTHSCHILD: You need to talk into the mike.
DR. COHN: I'm sorry. I guess I'm a little cross-eyed, only in the sense that I think that if we start talking about future activities, there is going to be no opportunity in any way shape or form to complete this.
I guess I am thinking A, that there is another subcommittee that meets here in another ten minutes?
DR. ROTHSCHILD: Right.
DR. COHN: And recognize that some of this subcommittee is on that work group, I am going to suggest that you deputize a subgroup to further refine this. We ask the subcommittee's permission to try to work through some of these other issues and try to further refine this, so we can bring it back tomorrow, so hopefully we can get -- so we can have something to present, and that we can further refine that from hopefully ten to 11 tomorrow, number one.
Number two, I am expecting that you assume based on our previous comments that there be some more work done in terms of a hearing on marketing. Number three, assuming the subcommittee is in agreement, we completely strike anything in this document related to marketing, other than to say that we intend to do further hearings on this, and that we will be sending it to you for further comments on it.
Right now, we have two paragraphs on marketing that don't say anything except that we are confused. Not we are confused; testifiers were confused, and we feel we need more information.
DR. ROTHSCHILD: We are happy certainly to work from the bottom up with the marketing provisions, which are just asides, and just indicate that we will be having hearings. But that assumes that we are. So I take that to be a motion to hold hearings in January on marketing?
DR. COHN: I think we have to poll the committee. I think probably the winter, with the idea that you need to poll the subcommittee for availability.
DR. ROTHSCHILD: Okay. Is there a second to that recommendation, that we pose to the full committee tomorrow to approve a subcommittee hearing on the issue of marketing, this winter as early as possible, which strikes me as mid-January at the earliest. Jeff?
DR. BLAIR: I'll second it.
DR. ZUBELDIA: Marketing and fundraising, right?
DR. ROTHSCHILD: Marketing and fundraising, yes, thank you.
DR. COHN: And maybe, and other issues related to privacy as determined by the Chair.
DR. ROTHSCHILD: And armed forces appropriations, budget and tax policy. So we need to vote on this. All in favor of recommending that to the full committee for approval tomorrow morning, raise your hand. Any opposed?
DR. COHN: Mark, I don't think you need the permission of the full committee to hold a hearing.
DR. ROTHSCHILD: We don't?
DR. COHN: I think you need to basically announce that we are going to do it. You do need the agreement by the subcommittee that we are going to do this.
DR. ROTHSCHILD: Okay. Well, the subcommittee has voted and so I will announce, with the vice chair's consent tomorrow, at some appropriate time.
Now, the issue is what to do with the rest of this stuff. I suppose what we can do is work this evening, a subcommittee of the subcommittee.
DR. FITZMAURICE: Can I ask how many people would be available for this separate working group?
DR. COHN: From five to six?
DR. FITZMAURICE: Five to six now? If everybody is overlapped, then you're going to have nobody working. I'm not overlapped, I'd be happy to do it.
DR. ROTHSCHILD: The only people we are going to lose are -- who are we going to lose for the NHII?
DR. COHN: Kepa and Jeff.
DR. ROTHSCHILD: So Kepa and Jeff.
(Simultaneous discussion.)
DR. ROTHSCHILD: So with the consent of those who may not be able to be here because of the NHII meeting concurrently, the rest of us will continue somewhere for another hour.
DR. COHN: I presume we can basically use the room being used by the Subcommittee on Populations. We can now go forward until such time as we have to change rooms.
DR. ROTHSCHILD: Right. So we have ten minutes. Let's use it to get to number two, if there are no other problems.
Number two. This will be an easy one. Use of de-identified information. First paragraph. Witnesses expressed concern about the difficulty of conducting research on health data that has been de-identified according to the privacy rule requirements. It was asserted that the standards for de-identification are too restrictive, essentially stripping off all identifiers, such that the data have minimal value for research. Other requirements such as hiring a statistician were perceived as unduly burdensome.
Any comments on the first paragraph?
DR. COHN: I think the last sentence needs to be struck. I don't know about any requirements that have to do with hiring a statistician. Maybe I haven't read the privacy rule --
DR. MC ANDREW: It is not a requirement. The stripping of the 17, 18 specific identifiers is a safe harbor. The other way to come up with de-identified information is to use statistical means to determine the likelihood of identifying anyone from the information that remains in the database is small.
DR. ROTHSCHILD: So in other words, one way of satisfying that would be to change the word requirements to be other alternatives, such as hiring a statistician, were perceived as unduly burdensome. I think that would be an accurate reflection of the testimony.
DR. ZUBELDIA: But I think that a lot of the testifiers were concerned with the fact that some of these elements are not identifiers. They were saying, we have to strip off all identifiers, and then all of this other information that is really not an identifier that we need to use, such as the zip code.
DR. FITZMAURICE: But it can be used in conjunction with another database to identify the specific individual.
DR. ZUBELDIA: Yes, but I think the concern that they had was that they are not identifiers, and they want to leave it there because it is not an identifier.
DR. FITZMAURICE: But because that particular variable is especially useful for linking with other databases.
DR. ZUBELDIA: Yes.
DR. FITZMAURICE: The cost of giving it up is so great.
DR. MC DONALD: And we have got to have a clear wall on what is to be identified before we can use it as non-protected information. One would wonder, though, all this is based on Latania Sweeney's work, all this concern about this cross-referencing. A lot of it is due to the fact that hospitals distribute as policy the admissions de-identified but with the zip code and the diagnoses. If it is a rare diagnosis and there are other characteristics -- and you could break this thread some other way.
So I guess the zip code is probably the only one in there that you really are tempted by for epidemiologic research purposes, et cetera. So whether we could say --
DR. ROTHSCHILD: I think there are others as well that researchers are concerned about. One is the time element, because many researchers need to follow the progression of the date of service to find out the course of events of an individual.
DR. COHN: I was just reading through Mike's next paragraph and his comment. I think that Mike has somehow expressed the issues around de-identification much better than I ever have. The issue here is that -- maybe you can read it, but to paraphrase, the issue about identification which I think has been tried to state but has never been done very well, is that de-identification isn't just a research use. You basically could use it for marketing, you could send it over the Internet unencrypted, and use it for anything you darn well please.
DR. FITZMAURICE: Put it up on the wall.
DR. COHN: So we are saying, it is too strict, but it is clearly not too strict for that use. On the other hand, it may be too strict for research uses, because they tend to think of de-identified in a different fashion.
I think, Mike, we probably should read your comments, but I think you have done a very good job of articulating the issue that there probably needs to be something else for researchers that is in the middle, that isn't completely open for everybody to use, but provides some additional patient identifier protections.
DR. FITZMAURICE: Well said.
DR. COHN: I somehow have not been able to say that well. Do you want to read his comments, because I think that really hits the point.
DR. ROTHSCHILD: I'll let him read his comments. He will be able to put the correct emphasis on it.
DR. FITZMAURICE: I make a point that the paragraph misses the point of the privacy rule's de-identification provision. The de-identification protects the confidentiality of all uses of the protected health information, so modified, because individuals can no longer be reasonably identified from the resulting de-identified data.
If you make it weaker, that is, weaker deletions, would invalidate this application of the concept, the concept that, you have taken all the identifiers off, you can do anything you want with the data. It would be better to acknowledge this and recommend another solution, that is, that a restricted data set be created that may be identifiable in conjunction with other data sets perhaps, but is protected by a data use and disclosure contract that is valid in each relevant state and forbids unstated and prohibited uses and disclosures, subject to severe contractual penalties.
I would have this contract approved by an IRB or privacy board for all the stated uses for all the receivers of the restricted data set. So somebody could create a restricted data set, take off names and social security numbers, keep dates of service, keep county codes, keep other information that is useful for research, but coupled along with this data set is an agreement for this use that has been reviewed by an IRB or a privacy board, that it is deemed okay by the privacy board to release this data set to someone who will sign this contract. The contract will have punishments that can be enforced by the laws of that particular state, so it has teeth in it.
Under those conditions, it is all right to release this data without the individual's consent. The clause in such a contract will be, you will never contact these individuals, you will never seek to identify them, et cetera.
DR. COHN: Do you want to read the next two paragraphs just to further identify what the recommendations are that you have here?
DR. FITZMAURICE: NCVHS recommends that HHS/OCR reconsider whether the provisions of the privacy rule dealing with the use of de-identified information unduly interfere with research, and if so, search for options that reduce the undue interference.
I would strike that, because I don't want to be telling OCR what to do on that score. I would say, NCVHS recommends that the privacy rule be modified to permit disclosures and uses of a restricted data set containing some information that could lead to personal identification, regrettably, but governed by a data use and disclosure contract that establishes permissible uses and disclosures that have been reviewed and agreed upon by an IRB or privacy board.
PARTICIPANT: This may be my ignorance, but this was brought up focused toward the response by the research community. Will this recommendation you are putting forth also work for the private sector?
DR. FITZMAURICE: Yes.
PARTICIPANT: The private sector doesn't have an IRB per se.
DR. FITZMAURICE: Yes.
PARTICIPANT: But it will now.
DR. FITZMAURICE: I'm saying it applies to the data. It doesn't apply to whether you call yourself a researcher or you call yourself a marketeer. But one of the conditions would probably be, you can't contact the individual, therefore you can't use it for marketing. But you could use it for an analysis of the community to see, should I locate something here, or is this a good place to sell my particular product.
PARTICIPANT: Right. Let me just push again so I understand it, and again, I apologize. With this restricted data set, would this restricted data set -- would a person who is contributing data to this, whether a patient or member or whatever, would they be signing some consent or authorization?
DR. FITZMAURICE: No, they would not.
DR. ROTHSCHILD: I'm afraid I'm going to have to invoke the closure.
DR. MC DONALD: Can we at least express our support or denial of that?
DR. ROTHSCHILD: You're not going to be here?
DR. MC DONALD: I'd like to express my support for this. It solves a number of other issues.
DR. ROTHSCHILD: Okay. Sue?
DR. MC ANDREW: I was just going to ask, since you involve the IRB or the privacy board in the approval of the contracts, what type of research would this allow to go forward that you couldn't get the waiver for to get identifiable information? What is the subset that you can't get, since you are going to the IRB anyway?
DR. FITZMAURICE: The use of a restricted data set to determine whether I want to locate an ambulatory clinic in a particular community. That is an application, as opposed to being a research product to improve generalizable knowledge.
DR. MC ANDREW: But I thought we were in research, that this was a data set for research, not for non-research purposes.
DR. FITZMAURICE: This solves a problem that the researchers would have, in that they can't get county zip codes to link to the file and other variables. But it also solves an additional problem, namely, the private sector uses identifiable data and tries not to release it, because they can bad publicity. But it forces them to sign conditions that would be acceptable by an IRB or a privacy board beyond research.
I believe it solves the research problem and it can solve other problems as well. So I pose that as a potential solution.
DR. ROTHSCHILD: Well, we will continue our discussion on this. We are being evicted. We will take a ten-minute recess and reconvene somewhere.
(Whereupon, the meeting was recessed at 5:00 p.m.)