[This Transcript is Unedited]
Hubert H. Humphrey
330 Independence Avenue, SW
Room 305A
Washington, D.C.
P R O C E E D I N G S (8:00am)
DR. ROTHSTEIN: Good morning. The subcommittee on Privacy and Confidentiality is called to order for this meeting this morning. I'm Mark Rothstein, the Chair of the subcommittee. Before we begin our substantive work, we'll have introductions of our members and guests.
DR. COHN: Simon Cohn, member of the committee.
MS. GREENBERG: I'm Marjorie Greenberg from NCHS, CDC and executive secretary to the committee.
DR. FITZMAURICE: Michael Fitzmaurice, Agency for Healthcare Research and Quality. I'm liaison to the committee.
MR. FANNING: I'm John Fanning from the Office of the Assistant Secretary for Planning and Evaluation. I'm adjunct staff to the committee.
DR. HARDING: Richard Harding. I'm a child psychiatrist from South Carolina, member of the committee and subcommittee, and president of the American Psychiatric Association.
MR. BLAIR: Jeff Blair, Medical Records Institute, member of the committee.
MS. FULLER: Sandy Fuller, the American Health Information Management Association.
MR. RODIE: Jan Rodie from the American Health Information Management ASSOCIATION.
MR. BATO: Pat Bato, National Coalition for Cancer Research.
MS. KASE: Kirsten Kase.
MS. JACKSON: NCVHS staff.
DR. ROTHSTEIN: Thank you and welcome to everyone and greetings to the folks listening via Internet. I want to first before we get started. I want to thank Richard Harding for chairing the presentation yesterday afternoon in my absence and Stephanie Kaminsky for helping to prepare the documents for today's discussion.
As you see on the agenda, the first thing we need to do is clean up our position on marketing and then we'll take up fundraising because at today's afternoon session, our hope is that we will be able to bring forth a recommendation to the full committee.
We have prepared a draft framework for a letter to Secretary Thompson. In the marketing section, the only thing we did include based on the subcommittee conference call and the vote taken at the conference call, was that we approved, as a subcommittee, only one, Recommendation 1, that accept as provided in our additional recommendations marketing should not be considered within treatment, payment, or healthcare operations.
The specifics that would flow after that are yet to be worked out. What we included on this sheet that you also should have are some possible things that we might include as menu of options. As we were discussing, I think it's probably not wise to include great detail and a whole list of things at this time.
We have discussed in the framework of the letter itself our rationale for wanting to make a change from including marketing to not including it. What we might want to do is select of these 11 items, the ones that we think are most important or most illustrative of the kinds of considerations that we have in mind, and include those in our letter as examples of what our direction of recommendations would be for the secretary. With that, I will open the floor for general comments to see if that is the consensus of the committee to see how to proceed.
DR. COHN: This is a question to our lead staff. Those on the conference call know that we were in favor of tightening the marketing provisions, but we were all aware that there were two ways to do it. One was to go back to the old provisions and then create exceptions versus just tightening what we have.
I think it made more sense to go back to the old provisions. I am concerned that we would like to see revisions to a final Privacy Rule. Since our conference call, I had occasion to reread the rule and reminded me how arcane and complex the marketing area is.
My question is: Do we aid the work of OCR by taking a different approach and making these recommendations and will that be helpful in terms of revising the rule or would it be better to do more on what to do to tighten the current existing structure? We could go either way.
MS. KAMINSKY: Unfortunately, I'm too new to OCR to be able to really comment with authority about that. My sense is that the recommendations of NCVHS are taken quite seriously and whichever direction it's characterized or framed will be taken quite seriously.
The timing has been an issue all along in terms of whether or not these recommendations are going to make it into the new proposed modifications that are coming out, but those will just be proposed. Whatever the subcommittee together come up with as recommendations should go forward in their purest form.
DR. ROTHSTEIN: That's a fair question, Simon. If you think these 11 are difficult to incorporate into the new framework, keep in mind that these are based on the assumption that we're going to the other model. If we were going to have recommendations on keeping the same model, there might be 20-30 other things based on the testimony we heard.
That was one of the things that drove our discussion. We thought it would be simpler to go to the old way and carve 3-5 exceptions rather than to add 15 things that were problematic with the current rule. That's our current thinking.
If I can read into what Stephanie was saying, the changes in the Privacy Rule are eminent, but they're proposed and there is a time for public comment. There is time for this subcommittee and the national committee to make general statements and fine-tune them during the period of public comment before any changes are made finally in the Privacy Rule.
DR. ROTHSTEIN: Even if this were deemed too fundamental to incorporate into the NPRM, it's not to say it would not find its way into the final rule; is that fair?
MS. GREENBERG: Will it be possible for people to comment on provisions that are not addressed in the NPRM or will it just be more circumscribe and not open up the whole rule again. I would think the changes would have to do with the marketing issues. If marketing isn't addressed in the NPRM, I don't know if one can then comment on it.
DR. FITZMAURICE: I think it's possible to comment on the absence of something. For example, you made these changes, but you haven't addressed marketing.
MS. GREENBERG: Everything is open.
MR. FANNING: Yes, in one sense, it doesn't make any difference. Anyone can write in anything they please regardless of any principle we might enunciate here. They might well say something along the lines that it was tightened up here and done this and that. Why haven't you done "X"?
MS. GREENBERG: Everything is up for grabs?
MR. FANNING: Yes.
DR. HARDING: Just for the sake of time, when the rule is brought forward, what's the comment period?
DR. FITZMAURICE: It will say in the rule, either 30 or 60 days.
DR. HARDING: That's before our next meeting.
DR. ROTHSTEIN: What I'd like to suggest to you now in taking up some of the specific recommendations, deciding what we want to incorporate, we keep in mind the context in which these recommendations will appear. I'd like to ask you to go back to the paragraph of text immediately preceding the recommendation to make sure that you're comfortable with it and to have that as a guide to figure out how we can flesh that out.
Let me briefly read that paragraph. There are two main options for regulating marketing. First, the NPRM position can be used in which marketing is presumed to be unlawful. In certain exceptions, it can be created, e.g., permitting pharmacists to notify customers that it's time to refill a prescription, to strike the proper balance.
Second, the final rule position can be used in which marketing is presumed to be lawful. Restrictions are added, e.g., disclosures and opt-out provisions, to strike the proper balance. After carefully considering the issues, the NCVHS believes that the final rule should be amended to return to the approach of the NPRM.
In our view, the current approach provides inadequate protection in several key areas such as disclosure of health information about children, disclosure of sensitive medical conditions, redisclosure of information by marketers, and reliance on an opt-out system of questionable effectiveness that puts the burden on consumers.
We believe that it will be easier to strike the appropriate balance by creating exceptions to a general prohibition on marketing than it will to add restrictions to a general approval of marketing.
MS. GREENBERG: I have a problem with the use of the term lawful. Isn't a question as to whether it's allowed of included.
DR. ROTHSTEIN: Permissible?
DR. FITZMAURICE: We could say in which marketing without individual authorization is presumed to be a violation of the Privacy Rule.
DR. ROTHSTEIN: Please tell me what sentence you're on.
MS. GREENBERG: It's not a question of being lawful. Or is not permissible, but the issue is without authorization.
DR. FITZMAURICE: Also, under which marketing is presumed to be lawful. We could say presumed to be permitted by the Privacy Rule.
MS. GREENBERG: Then down here, I would say exceptions to a general prohibition on marketing without individual authorization.
DR. ROTHSTEIN: Given the general tenor of that paragraph, we have as our first recommendation that marketing should not be considered within treatment, payment, or healthcare operations, in other words, going back to the NPRM position. It seems to me that we might want to consider adding some of the more specific recommendations on this list. Let me tell you where.
DR. FITZMAURICE: On the recommendations following what Marjorie suggested, I would write that as marketing without individual authorization should not be considered permitted within treatment, payment, and healthcare operations.
MR. BLAIR: Should not be considered permitted or should just not be permitted?
MS. GREENBERG: I don't know if you need that there. Consent covers the treatment, payment, and healthcare operations. If marketing is not considered within that, it's going to need authorization.
DR. ROTHSTEIN: Let me go through the first one on the list. I think we heard ample testimony. The first one is the definition of marketing should be clarified such that refill reminders and other treatment related reminders by pharmacists and other providers or their business associates are considered treatment and not marketing.
There was widespread sentiment for something of this sort. This would be one of the essential recommendations that we have because we didn't want to lose this by going back the other way.
DR. COHN: You're suggesting that we accept this one?
DR. ROTHSTEIN: Okay.
DR. COHN: Anybody in disagreement with that?
DR. ROTHSTEIN: This is a no-brainer for the subcommittee. Everyone gets a pick.
DR. COHN: Is there a reason not to go one after another?
DR. ROTHSTEIN: No. The second one is the definition of marketing should be clarified such that disease management activities, the primary purpose of which is not to sell products or services, is considered treatment and not marketing. I understand, Simon, if you think this is problematic.
DR. COHN: It needs to be in there, but is it treatment? It needs to be an exception to marketing but I don't know how to wordsmith it.
MS. KAMINSKY: There was a comment at yesterday's full committee meeting objecting to a primary purpose. There were other meanings.
DR. ROTHSTEIN: That's the definition of the Direct Marketing Association that provided us the information. There is a second consideration too and that is that some state laws do not permit health plans to give treatment. Only providers can give treatment.
MS. GREENBERG: The question is could disease management be considered part of healthcare operations? That would get around the treatment thing.
DR. FITZMAURICE: States would have one definition of treatment and the Privacy Rule may have a different definition of treatment. They aren't equivalent.
MS. GREENBERG: You could considered treatment or healthcare operations and not marketing. Do the disease management people say that those are activities?
MR. FANNING: You need not get in here to whether you call it treatment or operations. The advice the Secretary would need is permit this activity without explicit consent or whatever and leave to the drafters how to categorize it.
DR. ROTHSTEIN: A wonderful idea. Thank you. That will be reworked in a more general way so we get the sentiment without having to worry about that.
MS. FULLER: Just a question. Would it be your intent that any disease management company would have access to information from a healthcare provider?
DR. FITZMAURICE: Currently, they can do that already. If they make people angry, they will go to the papers or drop out of the health plan. We're trying to offer more protection than just the marketplace.
DR. ROTHSTEIN: You have to be a business associate of the provider or the plan.
DR. FITZMAURICE: Or a covered entity such as a health plan.
MR. FANNING: This is all within the context of a rule which says you may not use or disclose information except as stated below. I don't think there is any idea that the disease management constitutes some exception whereby the provider or plan can simply turn over information for this purpose.
MS. KAMINSKY: I understand your point. We're touching again on how does an unrelated third party get this PHI to use it for a marketing purpose? This continues to be a tension that we've been talking about and having lots of views about. I'm not sure that the way the rule is constructed now if we make a recommendation that disease management is considered part of TPO that there are a lot of questions about how then a disease management company would get that information and what restrictions there would be on handing it over.
MR. BLAIR: I think that by taking the position that we're taking, we are inherently acknowledging that the disease management function is a valid TPO function and winding up saying that any extensions to marketing activities would fall outside the boundary.
If we it that way, we then actually have a stronger position than if we try to go the other way around saying that we're making exception for disease management. That gets more problematical. Did that address what your concern was or not?
MS. KAMINSKY: The question is I'm just trying to think through assuming the current rules, that there still would be consent for TPO. Then what we're saying is somebody gets consent and then a third party starts to market to that.
MR. BLAIR: We're carving off the marketing piece from the disease management piece. We're saying the basic functions of disease management are appropriate within TPO, but if they extend it into performing marketing functions, that where we put the boundary.
MS. KAMINSKY: I don't know what the verb is for doing disease management, but a third party does it to a patient because the patient or consumer has signed a consent at one point for TPO. That's what we're essentially saying that it's okay.
MR. FANNING: To the extent that it's done and not by the organization of which the individual has the relationship. The organization needs a business associate relationship with the outside organization.
MS. GREENBERG: You can't provide information to somebody unless they're a business associate.
MR. FANNING: Is that not the case?
DR. ROTHSTEIN: You just couldn't sell you PHI to somebody who calls themselves a disease manager.
MR. FANNING: You couldn't give it much less sell it. That's right. If it is within the things envisioned within the consent, the basic business for which the person is relating to the institution, it's allowed.
If somebody else is going to help the plan with it, then a business associate relationship is necessary to bind the outfit that's doing the work to the rules. I'm sure that in many instances, the disease management is done by outside organizations that specialize in this and we heard in many instances that it's done in such a way that it is branded with the name of the health plan.
The notice you get saying we are enrolling you in this program to assist you in the management of your diabetes comes from you health plan. In fact, the health plan had this outside organization comb its records, and design the program and the like.
MS. GREENBERG: They entered into some relationship.
MR. FANNING: Correct. They hired them to do it and after this rule is in place, we'll have to have a relationship with a contract that governs the use of information.
DR. GIBBONS: The law isn't the only guardian. The covered entity doesn't have to give the data to the health plan if the health plan requests it. It can argue this is not the minimum necessary data needed for you to pay my claim. They can argue that in public and in private.
When an individual gives permission to use the data or it can modify that. You can argue about the market power. Does a health plan have the market power over the physician because they're the ones doing the paying? Does it have market power over the consumer because the consumer may have no other choice, this is the one chosen by the employer? There are these other safeguards.
DR. ROTHSTEIN: Let me make a suggestion. There is widespread consensus on the first one dealing with the refill reminders and widespread consensus on what we're trying to accomplish with disease management exception.
As to 3-11, we can't include them all, but maybe we can make three points that capture the rest of these on the list. Number 1, even when marketing is permitted, there need to be appropriate disclosures which would include such items as Number 4 and 9.
The second broad thing is authorizations. Number 4, 5, 10 deals with authorizations. When there is marketing pursuant to an authorization, there need to be some boundaries established for what is a permissible subject for an authorization.
The last one deals with procedures and methods. Numbers 7 and 11 talk about what sort of information must be disclosed to an information and how the contact might be regulated. Number 11 is protected health information and it must not be revealed by voice mail, FAX, or other method.
You can't leave someone a message on their voice mail saying it's time to renew your birth control. That's just a suggestion of a way in which we can generalize some of the concerns that are indicated in 3-11. That's just one possibility and I'm happy to entertain others.
Instead of going into the specifics of 3-11, it may well be in one thing, we just want to recommend to the Secretary that there are three other areas of concern that we have, including disclosures, the content and scope of authorizations and the actual methods by which individuals are contacted regarding marketing pursuant to an authorization.
MS. KAMINSKY: When you characterized them, you didn't put 6 or 8 in any category. I thought that a lot of people had a lot of feelings about 6.
DR. ROTHSTEIN: That might fit in with one of the others.
DR. COHN: Isn't 6 generally true for everything?
DR. ROTHSTEIN: I suppose the question I have is for John because you got me thinking about the best way to propose this to the Secretary. Do you think a letter with that level of specificity which says these are some of our other concerns is adequate to convey these points or to alert the Secretary to be thinking about authorizations themselves might be a problem?
MR. FANNING: Are you envisioning that there would be items of this?
DR. ROTHSTEIN: What I'm envisioning if we had items 1-2 and a third general item or 3-5 in which we break out these concerns, is that sufficient to apprise the Secretary of our concerns? I'm trying to reach the right level of detail.
MR. FANNING: Yes, that's important. My offhand guess is that it is. You don't want to go into a lot of detail, but if there is some particular thing in the present text that you find particularly troublesome, I would say make the point about it.
DR. ROTHSTEIN: For example, one of my concerns deals with authorizations and even though people can theoretically authorization all sorts of things, the fact of the matter is when you are admitted into a hospital, they give you a stack of things to sign and may or may not explain in detail and you may not be up for reading the fine print and you just sign.
I think that a healthcare institution should not be permitted to allow you to authorization the disclosure of your protected health information for marketing purposes to business associates, in the loosest sense, and authorizing contact by anyone who is going to sell you a vacation trip that's going to improve your mental health and so forth.
That's beyond the bounds of what we have in mind. I think that authorizations need to be limited. Number 10 is very important. It may not occur to the patient right away, but if they're signing this authorization for everything, it's going to include a lot of things that perhaps they don't want.
But if you have records that you don't want disclosed, I think they should be allowed to do that. That comes under authorizations for me. That's important, but I don't know whether it's appropriate or valuable for us to say anything besides the Secretary needs to take a look at authorizations and make sure that the scope of authorizations are appropriate.
MR. FANNING: If the committee, in fact, feels that the things you outlined are issues that need to be addressed in the regulation, then you should write it down in sufficient detail so that the Secretary knows what you really mean. A general warning to be careful about the misuse of authorizations is probably not helpful.
DR. COHN: My understanding of authorizations is generally that they're also time-limited and for a specific purpose.
MR. BLAIR: Are those words that you already have in there?
DR. COHN: I thought that was the general definition of authorizations.
MR. BLAIR: Maybe we need to make sure those words are there.
DR. HARDING: I don't think it's time-limited. It's been suggested by people, but I don't think that's in there.
MR. FANNING: As I understand it, it isn't possible to have an authorization expire upon an event.
DR. ROTHSTEIN: But nothing would preclude an open-ended authorization?
MS. KAMINSKY: They can be drafted and crafted in a myriad of ways.
MR. FANNING: The event concept does permit great imagination in terms of formulating it.
MR. BLAIR: Nevertheless, Simon's words were "typically time-limited".
DR. COHN: I'm not sure that gets us anywhere. I have to think about in relation in the way we're beginning to describe authorizations.
MS. GREENBERG: I agree with you that people in a healthcare environment are vulnerable and can be taken advantage of to get to their room. The major thing is we can't be too paternalistic. It just gets too murky and complicated.
The major contribution is to say we do not believe that marketing is part of treatment, payment, and healthcare operations. Essentially, it needs authorization, except with these few exceptions. Then to try to fine tune what can be in the authorizations and how you get them, treatment, payment, and healthcare operations should not be contingent upon someone signing an authorization. That's important.
DR. ROTHSTEIN: That's already in the rule.
MS. GREENBERG: Beyond that, to some degree, the buyer has to beware and we have to rely on the integrity of the healthcare system. It's not practical to fine tune too much. I understand your concerns, but we are dealing with a profession that has ethical standards. I get uncomfortable. The significant change is to require authorization.
MR. BLAIR: I think I especially respect Clem's experience in his admonition to be careful. The only thought that I do have as a balance is Stephanie wound up saying that authorizations can be crafted in almost any way.
MS. KAMINSKY: I have to look at the reg. I don't have a copy of the reg.
MR. BLAIR: My only concern is that we don't want to put forward a privacy law that simply codifies current practice and includes the abuses of current practice. If we use words which are closer to what we do consider ethical behavior of authorizations and we use it for a specific situation and they are either time or event constrained.
I don't have your exact words, but as long as that is in there as the definition or within the definition of authorization, I feel much more comfortable rather than authorization being open-ended where anybody could define it any way they want.
DR. COHN: I beg ignorance on this one. I do remember testimony on another issue having to do with health plans and authorizations. We heard testimony by AHP and other about their desire to have access for HEDIS and other measures.
They made cases about the nature of authorizations not being useful for that. That's where I remember those comments from. That's really why I was referencing that. We may need to be careful starting to craft or further define authorizations beyond what's already there.
MS. KAMINSKY: The committee made some recommendations in that regard that would give health plans.
DR. COHN: Yes, we've already gone through that. It didn't have to do with fixing authorizations. It had to do with observed limitations of the authorization process.
MR. FANNING: If the point of this letter is to address marketing, to the extent that you think there is some particular hazard or abuse that's possible with respect to obtaining authorizations in this context, you might want to comment on that and then let the Secretary decide whether the concerns you express and the constraints that you would want put on would apply to authorizations generally or would apply in the general instance here where you're looking at one area of concern.
There are practical difficulties in having different standards for authorizations in many contexts. On the other hand, if the committee genuinely feels there is an abuse or hazard and you think some corrective or preventive method is appropriate, say so.
DR. ROTHSTEIN: What's the subcommittee's view? I don't think we reached closure on this. We've talked about it, but how should we put this together for committee approval, for the use by the Secretary? I'm hearing conflicting views.
MS. KAMINSKY: It sounded to me from John's recommendation that a certain degree of specificity wouldn't be a problem. That would be better than the very general statements. Since we have spent a lot of time in discussion in the last several meetings coming to a point that we have these issues enumerated in this way, why don't we go with the original suggestion of Simon to go down them one by one and see where we come out together?
DR. ROTHSTEIN: I've got another proposal that tries to shorten things. How about if we go through all of them and then at the end, we can group them, and try it that way. We're back to number 3 after a detour.
(Number 3 was read.)
DR. FITZMAURICE: The Privacy Rule applies restrictions and punishments to cover entities. In here, I'm not sure who the covered entity is.
DR. ROTHSTEIN: The way we would reach this conduct would be to say something about business associate agreements must contain provisions that the business associates notify individuals of the financial arrangement with the covered entity. That's indirect.
MR. FANNING: Presumably, what you're addressing here sounds here like this should be done even if the entity itself contacts the person. A general rule is that if some condition applies to the behavior of the covered entity, most certainly if it hires someone else to do this work for it, the other entity that's doing it, must conduct it in accord.
DR. ROTHSTEIN: If hospital were marketer working for hospital is paid by some third party equipment manufacturer, that needs to be disclosed.
MR. FANNING: That's the point. It doesn't make any difference if it's the business associate or who it is.
DR. FITZMAURICE: Notice that the Privacy Rule as written, has the covered entity making the initiation to the patient, if they're reporting to us, you have to identify the covered entity. I'm concerned that the tie isn't directed as this is stated.
You can say a covered entity cannot do this or must notify the patient of the relationships. If the covered entity discloses the data to anybody else for such a purpose, that responsibility still lies with the covered entity.
DR. ROTHSTEIN: Here's the thinking and maybe it goes back to the paternalism that Marjorie raised. You get a call, I'm Simon Cohn for Smith Company and I'm calling at the direction of Methodist Hospital to tell you about a new hospital bed that might help you sleep better at night.
I want to know if Craftmatic is paying for this whole operation? It's not that the hospital thought their patients need to sleep better at night. Let's hire Simon to call and offer this. It's that they're getting money from this manufacturer.
MR. FANNING: If the committee feels that it's important that that notification be included, say so, and it's irrelevant whether the hospital hires someone else to do it or does it directly.
DR. ROTHSTEIN: That's what's behind number 3. The question is does the subcommittee feel that this is the kind of thing that should be included?
DR. FITZMAURICE: You have to write it as though the covered entity may not disclose protected health information for this purpose unless the patient is notified of the following things.
MR. FANNING: I don't think it relates to disclosure. It relates to use as well. If the hospital itself telephones through full-time paid staff, you would want the patient to be advised that we're calling this to your attention at our being paid to call it to your attention by the manufacturer of a product.
It has nothing to do with disclosure or business associate relationships. The general rules about business associate relationships would still apply. If the hospital hires someone else to do it, the someone else has to conduct it the same way the hospital would be required to conduct it.
DR. FITZMAURICE: But somebody calling on behalf of the hospital?
DR. ROTHSTEIN: It would be just one variation, adding an extra layer.
MR. FANNING: Mark's point is that the person to whom the pitch is being made should know the background and circumstances of the approach.
DR. FITZMAURICE: I agree with that. They already had their information given out.
DR. HARDING: They've authorized that.
DR. ROTHSTEIN: It's marketing they could not have done without authorization, but in addition to the authorization what I'm raising is, is that sufficient to inform the individual of exactly what's going on here? Maybe it's not part of the privacy reg. Maybe this is the FTC. The horse is out of the barn or something because you authorized disclosure of the information. Now, what I'm worried about is deception.
MS. KAMINSKY: The piece that I was hit with is that maybe there is something about healthcare that makes it different than regular FTC regulation because people's perceptions are skewed in this arena because there is so much emotional import that goes with health problems. There's more vulnerability when you get that and you may not understand that this really just the same as buying a computer on the street. There is something about healthcare.
DR. ROTHSTEIN: When they say I'm calling at the behest of the hospital where you were just treated, people don't hang up the way they would if it's a credit card offer.
DR. COHN: Should we leave 3?
DR. ROTHSTEIN: I don't know how I'd like it to be. We know what the thrust of it is. The question is, is that something we feel strongly about including?
DR. FITZMAURICE: You can ask for projections on the use of protected health information when people are marketed to and revealing more information to the people who are marketed to.
DR. ROTHSTEIN: This might be similar to the kinds of issues raised in 11 about not leaving a message by voice mail or sending a FAX or number 7.
MR. FANNING: These are really having to do with the process of marketing. If you're calling somebody, you're saying I'm marketing this to you whether or not you are an exception or have an authorization which is different than what we have here. We do have a financial arrangement and we are doing this because they thought it was a good idea.
DR. ROTHSTEIN: It could be considered a disclosure or procedures and methods or something like that.
DR. COHN: This is like holding on to a fish. Every time we think we've got it, it slips out of our hands.
DR. ROTHSTEIN: Do we agree on the need to include this in the letter? That's the first thing.
DR. COHN: Are these ethical standards for marketing?
DR. ROTHSTEIN: Privacy is an ethical concept.
DR. COHN: What I meant is this is one of the method of marketing. This is not around information. I'm just wondering if we wrap this in an ethical view of the process of marketing which applies to 11, do you leave sensitive information on a voice mail.
MR. FANNING: This goes to Mark's question about this being an appropriate subject for a privacy regulation to address. The existing text permits communication with the individual without prior authorization and says that the communication must disclose the financial relationships and so on.
The question you raise if you're going to require prior authorization, do you need to build these things into it as well? It's difficult. This is on the boundary between information use and the rest of good practice.
DR. COHN: The reg describes without an authorization.
MR. FANNING: The present regulation does control in various ways how covered entities get and use authorizations, what conditions they can make with respect to their services and that sort of thing.
DR. ROTHSTEIN: Even though I would like this spelled out, the practical side of me says if the subcommittee is having this much difficulty, we can multiply that by the number of members on the full committee. Maybe it's not realistic, given that we're under the gun, to go into elaborate detail.
I'm going to revisit my original proposal which is to characterize our concerns in general ways in which we think that authorization that marketing contacts pursuant to authorization which we are now recommending be reinstituted, need to be tightened up and some guidance provided as to how authorizations and what kind are permitted and contact as well.
DR. HARDING: The only problem I'm having with what you're saying is that the authorization should be fully informed and with financial incentives and other kinds of things like that.
DR. ROTHSTEIN: The problem is if you get an authorization and you sign it authorizing marketing of health related products and services, it may not be clear exactly how it's going to be used and who the business associates may be. It would be terribly inefficient to have it expire after six months.
If you're going to allow it to go forward, allow it to go forward and then have people have the right to say no more, I'm done, I'm out. You would have that information. I authorize adjustable beds, heating pads, and so on.
I am concerned about this kind of arrangement. I think that people need to have the opportunity to provide limited authorization and protect certain kinds of information. I'll let you market to me, but I don't want you sharing my psychiatric information with anyone. Unless they're reminded of that, they may not realize it. They're signing papers like crazy.
MR. RODIE: Just realize that you cannot practically consent to or authorize some information versus other information being shared. It cannot be controlled by an entity. You can't say don't let any of the psyche information in my file go out, but it's okay to let my orthopedic information go out. You don't have somebody sitting there reading the record to determine what's psychiatric and what's orthopedic.
DR. ROTHSTEIN: If that's the case and you may well be right except for institutions that are really compartmentalized. T&hat's part of the kind of disclosure you need to make for an authorization. By authorizing this information, your complete medical information may be disclosed which would include everything. We've got to get to fundraising too. What's your pleasure? Richard, you got a way out of this for us?
DR. HARDING: I'm lost in the trees right now.
DR. ROTHSTEIN: I have another idea. Let's go through these quickly. Is it fair to say that they're supported in the abstract for number 3? We have some degree of abstract view of that. What we're going to do with it remains to be seen.
(Number 4 was read.)
You should not be asked to sign an authorization that's going to sell you air conditioning because you're going to be more comfortable at home and that will improve your health. Research is separate.
MR. FANNING: This isn't the context of marketing.
DR. ROTHSTEIN: Under the rule, anything that's health related is fair game for marketing now and pursuant to authorization perhaps in the future. That is so nebulous that you could justify almost anything as improving the health of the individual. It needs to be directly related to the health of the individual.
MR. BLAIR: I won't be here this afternoon and I don't know whether or not my attendance is part of a quorum.
DR. ROTHSTEIN: No, not for the full committee, Jeff.
MR. BLAIR: But in terms of the items that you're going down, if you just get general acceptance, yea or nay, from this group on each of those items, then that at least will give you enough guidance to move forward.
DR. ROTHSTEIN: So I can put together a proposal that we can tweak at the meeting this afternoon. What about this principle of delimiting marketing to matters that directly relate to the health of the patient? Is it possible to do that?
DR. COHN: I think it's fine. The example you gave is one that doesn't support that position. I can think of many patients with asthma.
MS. KAMINSKY: You told me aluminum siding. That's what you said.
DR. COHN: Many state laws actually talk about things directly related to healthcare. I think that you don't, once you get into examples, we can spend the next day on it.
DR. ROTHSTEIN: You're anxious if we get you the new credit card that will consolidate your data. You'll feel much better.
DR. COHN: That one I would buy. The principle of having it correctly to help the patient would be fine.
(Number 5 read.)
MR. FANNING: Marjorie raised a question about that yesterday, but you're designing a special set of rules for approaching the patients for authorizations in the marketing context.
DR. ROTHSTEIN: What does unrelated mean?
MS. KAMINSKY: Not a business associate.
DR. ROTHSTEIN: You could theoretically do that.
DR. COHN: It's probably a bad idea. I was trying to think realistically how without a business associate relationship would be in a position to do this, but if, indeed, it could happen.
MR. FANNING: One could imagine that. Some organization that's attempting to sell something comes to the hospital to say, we'll pay you if you get authorization from all of your asthma patients to give us their names.
DR. COHN: You couldn't give them the information because it's protect health information without a business associate relationship.
MR. FANNING: This is about the authorization. The air conditioning company doesn't have the names. They say, we'll pay you $5 for information you give us about asthma patients.
MS. KAMINSKY: We'll pay you $5 for getting authorizations from each one of your asthma patients. They're going to be signing a bunch of authorizations anyway. Can you just put ours in the pile, please?
MR. FANNING: That's right. The mechanism would be getting an authorization. The facility couldn't give it without the authorization. The question is, do you want to allow that to occur?
MS. KAMINSKY: Marjorie's concern was if you don't let the covered entity do that, how will those other entities ever get authorization because they don't have access to the patient without that covered entity helping them in some way.
MR. FANNING: I'm not sure whether she was thinking of it only in the narrow marketing context. More generally, it would be a very troublesome rule. Perhaps the answer is different if you're talking specifically in the marketing context.
DR. FITZMAURICE: Does that mean that an OB doctor can't have in his waiting room a card to sign up for information about Pampers and other baby paraphernalia?
MS. KAMINSKY: Or not even $5. Can I just put this in your waiting room.
DR. COHN: I can't think of a doctor getting $5 to have a Pamper's display in the waiting room. Usually, you get these free things you give patients and give them a discount.
MS. KAMINSKY: I have a lot of pregnant friends who are getting Pampers solicitations.
MR. BLAIR: Do any of them feel uncomfortable about receiving those solicitations?
MS. KAMINSKY: Yes, actually. I had a discussion about it just the other day.
MR. FANNING: Does it appear that they've gotten it without having authorized it?
MS. KAMINSKY: We didn't go to that level. I don't know.
DR. ROTHSTEIN: They might be getting it because of birth records. They're public record.
DR. COHN: Or go to a maternity shop and buy maternity clothes.
DR. ROTHSTEIN: I'm willing to scratch 4 and move to 6 then. No, on 5. I'm worried about that.
(Number 6 read.)
MS. KAMINSKY: This one came up in the context of the opt-out issues more than in the context of the authorization issues.
DR. ROTHSTEIN: We're going to delete that.
(Number 7 read.)
MR. FANNING: One of the criticisms of the existing regulation was that the requirement doesn't include any requirement to make it easy.
DR. ROTHSTEIN: That goes with number 8.
(Number 8 read.)
MR. FANNING: The scenario presented by one critic was that they could put at the bottom simply send us a certified letter to the address here telling us the names of all and you don't want to be included. Some of the states that have implemented the financial law have in their regulation, put a requirement for a toll-free number or Web site or something like that. I'm not urging one thing or another. I'm indicating one of the criticisms that appeared in the testimony that the committee took.
DR. ROTHSTEIN: How about if we "no" 7 and 8 and put something that says dealing with the issue of notice and ease of opt-out.
(Number 9 read.)
This is separate. You go and get your accounting and you learn exactly who the person behind the screen is paying for the contact.
MS. KAMINSKY: I don't know the accounting piece of the reg well enough. When you get an accounting now, what do you get; do you know?
MR. FANNING: Here, you're talking about disclosures with authorization.
MS. KAMINSKY: When you go to regular accounting, do you get the disclosures?
DR. ROTHSTEIN: Where it was sent, not who paid for it.
MS. KAMINSKY: Or whether it was an authorized disclosure or not?
DR. FITZMAURICE: The first one can be unauthorized if it's going to the covered entity and has to have a provision for opt-out. There are some provisions that if the doctor has been paid, that must be stated in the letter.
MR. FANNING: This is about the disclosure accounting. You come into the facility and say to whom have you sent my information? I don't know what you would get. I assume the facility would retain onhand your authorization and say we've disclosed it pursuant to this authorization. That, in this context, might include a great list of recipients.
MS. KAMINSKY: My point is I don't know what the reg includes in that general accounting for disclosures. If it does, then this doesn't seem to matter, does it?
MR. FANNING: This is a proposal for knowing something else about the disclosure, not simply that it was made, but the financial circumstances are.
DR. ROTHSTEIN: When you get the notice, it may go to Washington Marketing Co., but this would say for use by Proctor & Gamble.
DR. FITZMAURICE: It seems to get beyond the covered entity and the business associate agreement.
DR. ROTHSTEIN: Okay. That's gone.
(Number 10 read.)
Let me suggest that number 10 might be in general language merged with number 4 dealing with directly related to health of the patient. I'll try to work up some language that will not go into this degree of specificity, but will get the point made.
MS. KAMINSKY: I would make a plug that this specificity is appropriate in this particular case, but that's the committee's call. Even if it's difficult for covered entity or anybody who has protected health information to parse the information, this reg is full of new types of rules that are being put on these covered entity to just provide minimum necessary.
There are a lot of new burdens that this rule is asking for good reason to put on covered entities and a big piece of the testimony that we heard about marketing had to do with these sensitive classes of information. I wouldn't gloss over it that quickly, but it's the committee's call.
DR. ROTHSTEIN: I'm glad you support number 10 and we'll see what we come up with.
DR. FITZMAURICE: There is a strong feeling not to parse out different classes of information. In fact, of all the classes that you would consider sensitive, only psychiatric information was treated separately because it imposes such a great burden. The cost of the regulation would be very high.
DR. ROTHSTEIN: At the least, what we should do remind people signing authorizations that they're authorizing of their medical information.
MR. FANNING: You're proposing a special set of rules for authorizations for disclosure for marketing.
DR. ROTHSTEIN: Correct.
MR. FANNING: I just wanted to note that. This is not with respect to all authorizations.
DR. ROTHSTEIN: That's correct.
MR. FANNING: That may have some bearing on how much regulating you might want to do in this area.
DR. COHN: So what are we doing? Psychiatry is already in there as a special case. What are we doing with the rest of it?
DR. ROTHSTEIN: Psychiatry could, but you can't release psychiatric information without an authorization. In general terms, when certain psychiatric narratives are not disclosable pursuant to a consent, the one-time consent. You need special authorization. Unless we enact something like this for marketing-related authorizations, then your authorization for marketing would scoop in the psychiatric information that couldn't be even revealed to payors.
DR. HARDING: Psychiatric information is actually broken down into categories.
DR. ROTHSTEIN: This would include everything. This would include notes.
DR. FITZMAURICE: Psychiatric notes takes a separate authorization, but you can include that.
DR. COHN: That information is usually held separate.
DR. HARDING: It gives all the factual information in the medical record.
DR. ROTHSTEIN: It would have diagnostic information and treatment plan.
DR. HARDING: In this case, we're dealing with separate issue of authorization for marketing, not for treatment, payment, and healthcare operations.
DR. COHN: The issue gets to be exactly as you start segregating. Is depression in an practitioner's note, is that psychiatric information? Is lower abdominal cramping noted in the subjective part of a doctor's note for a young woman in an OB/GYN record?
DR. ROTHSTEIN: That's why I'm now leaning to the disclosure. If you authorize this, you're disclosing all of your doctor's records.
MR. FANNING: I think under that scheme, the entity that was asking to sign the authorization could tailor it to a class of information and then would not make that disclosure.
DR. ROTHSTEIN: You are disclosing only your orthopedic records or whatever.
(Number 11 read.)
The first sentence is obvious. The second one goes to the issue of if you're getting a phone call from a marketer, they should tell you before the pitch why they're calling you and what the relationship is, not after they make the sale.
MR. FANNING: It's understandable in the context of a telephone call. In written communication, I don't know what upfront means.
DR. ROTHSTEIN: I'll split those two. In other words, there may well be more support for the first suggestion from the second half which there may be less support for.
DR. HARDING: Who could argue security?
DR. FITZMAURICE: This is presuming there is individual authorization.
DR. ROTHSTEIN: What is the sense of the subcommittee? Is there support for the second as well, the upfront?
DR. FITZMAURICE: I wish all the telemarketers would do that. I'm just worried that it may be micromanaging methods and might be difficult to enforce.
DR. ROTHSTEIN: I'm willing to drop that in favor of the first one which I'm very concerned about the first one. To recap, we've agreed on 1. We need to clean up 2. We talked about the notification of financial arrangements and haven't figured out exactly how to do that.
We agreed that marketing pursuant to an authorization must relate to matters that directly relate to the health of the patient. I said that I would try to put together something that dealt with the notice and ease of opt-outs. The disclosure in the authorization must indicate that all records will be disclosed. You can't leave the message in some way that's not secure.
With the subcommittee's indulgence, Stephanie and I will try to put this stuff together by the afternoon meeting in 2-4 bullets that will go under the general recommendation.
MR. BLAIR: Is there time to discuss any other issues before we close?
DR. ROTHSTEIN: Yes, we're on to fundraising.
DR. HARDING: Before we close, I'd like to come back to disease management. Let's do the fundraising, but just a clarification.
DR. ROTHSTEIN: Let's do the fundraising and then come back to disease management? Let me read you the intro text.
(Read introductory text and number 1.)
There is a difference of opinion as to what we agreed on at the conference call. I received a copy of the letter that was sent to John Lumpkin from the ASSOCIATION for Healthcare Philanthropy that they were lurking on our conference call, lawfully.
MR. FANNING: The public was there at the meeting. It's an open meeting.
DR. ROTHSTEIN: Their comments go to this issue. The question is that you'll recall that fundraisers and the witness from Hopkins wanted the rule amended to allow them to target the fundraising efforts to specific units. The current rule permits day of service and demographic information only to be revealed.
They want, you were seen in the Oncology Department or whatever. That gets into a very difficult balance. The oncology unit may be building a new wing and they don't want to send out 10,000 letters to everyone who was seen who had a child at that hospital. On the other hand, now you are sharing with non-medical personnel some rather specific PHI that relate to the purpose of the treatment.
DR. COHN: Is this a disclosure form or an authorization form, or consent form? What are we doing here?
DR. ROTHSTEIN: When you sign your consent, if nothing is changed, the one time general consent allows the disclosure for fundraising of only two things: demographic information and data service. What I'm raising in this suggestion is that pursuant to some simplified authorization, the individual then could authorize the disclosure of the department.
If you recall, this was the fall back position of Hopkins when they testified before us in January. In fact, she even drafted a proposed simplified authorization form that in case we didn't recommend amending the rule, to make that part of the one-time consent, her view was to go through this formal authorization would be burdensome and we need some simplified authorization.
DR. COHN: I am confused why this isn't just part of a one-time general consent since it's basically asking someone to fill out another sheet of paper.
DR. ROTHSTEIN: When you sign the consent, it says I consent to PHI for treatment, payment, and healthcare operations.
DR. COHN: Which includes every information other than the one data element you describe.
DR. ROTHSTEIN: Correct.
DR. COHN: Are we going to do this for every single data element that we decide later on?
DR. ROTHSTEIN: The fundraisers do not want anything else? They don't want the diagnostic information or anything apart from this.
DR. COHN: I'm still confused why this isn't part of the general one-time consent that we're just saying for fundraising activities. We're just adding this as an additional data element. I'm asking why we aren't supporting that.
I know what the debate is and you're saying we need a separate disclosure, but you want to make a simplified disclosure for that single data element when the fundraisers already have the first two data elements and they only want the third.
I'm saying we're going to have disclosures for every single data element in this thing? If we're going to have a separate disclosure for this information, what's the point of putting this as a separate disclosure.
MR. BLAIR: Actually, Simon, I'm not sure Mark is asking for that. He doesn't know yet what we feel about adding in addition to the name. The first thing Mark has to determine from us is whether we agree with adding that additional.
DR. ROTHSTEIN: If we did nothing and left it the way it is, they would get these two fields. The fundraisers want to get this third field. There are two ways of doing it. One, you amend the rule.
MR. BLAIR: Before you go to the two different ways, don't you want to ask whether we want to go down that path or not?
MS. KAMINSKY: Even dealing with the department at all?
MR. FANNING: The way Mark has structured the question, you'll come to that. If you don't want to do that, then you just say, no, they need a full-blown authorization.
DR. ROTHSTEIN: Correct. In order to get the third field, there are three possibilities. One, you amend the rule and sweep it into the one-time consent. Instead of you automatically get two, you get three. The other extreme is you require a full-blown authorization and say we're not accommodating that request in any way which is the current rule.
The other possibility is an intermediate approach which is you need an authorization. We don't want to sweep it into consent, but we're going to try to make that easier and come up with some simplified. There are three options on the table.
DR. COHN: There's actually probably a fourth which would be considered to be one-time consent, but for areas that are particularly sensitive like psychiatric hospital or admission, you would have to file a separate disclosure. That's another one.
DR. ROTHSTEIN: The problem is, some people would view oncology as one.
DR. HARDING: Infectious disease.
DR. ROTHSTEIN: What is sensitive is often subjective. That's the problem.
DR. COHN: The fundamental question here about where the interest of society falls in all this stuff. Having said that, that doesn't necessarily answer the issue. We're all starting from the same place, but it's a question of where to set the balance.
DR. FITZMAURICE: I tend to lean toward sweeping it into the rule on the grounds that you don't raise very much funds if you make people mad. Those you do make mad if you violate a right, you really embarrass them. In this case, the marketeers have to be very sensitive or they're not going to get any money from anybody they make mad. There is always an opportunity at some later date to change it if people rise up and complain. Now, they have free limit to use everything and we don't hear a lot of complaints about it.
DR. ROTHSTEIN: Let me ask a question: When you sign your one-time consent, what does it say you are consenting to besides treatment, payment, and healthcare operations?
DR. FITZMAURICE: That's it.
DR. ROTHSTEIN: It doesn't go into any specifics as to what that constitutes?
MR. FANNING: No, it doesn't, but it assumes there is a notice of information practices which is easily available and you can look at now or later. It's connected with the simple consent.
DR. ROTHSTEIN: I'm sympathetic to what we're trying to do. Most of us are supported by the generosity of former patients. Everyone who is a former patient ought to recoup. On the other hand, I want to try to protect the rights of individuals to not have this information disclosed. If we could do it from the other side by making an opt-out easier or some sort of notice.
MS. KAMINSKY: You are making this assumption that if somebody gets a solicitation and it has a department that's soliciting that anybody who sees that that's not the individual is going to assume that that person has some health problem related to that department.
DR. ROTHSTEIN: The fact that we're getting a solicitation from the AIDS Foundation doesn't mean that the world thinks I have AIDS. The marketers at the hospital and business associates of the hospital get information. That's the concern I have.
It's not that there's an envelope from the American Psychiatric Association or the psychiatric hospital in my mailbox that somebody sees the return address on. It's these unknown people who may be my neighbors who are getting the list of people who were seen in certain department. That's what we need to be sensitive to. Think of people in small communities.
MR. BLAIR: Let me put forth my opinion. I think that the way we crafted it originally is appropriate. While it might make is slightly less efficient on the fundraisers, if they cannot target their fundraising to specific patients that had specific diseases or treatments, the privacy implications outweigh the slight fundraising cost.
They still have freedom to send out messages that are targeted for a specific new cancer wing, a new OB/GYN wing or whatever. It doesn't stop them from doing that, but it does protect individuals that might be in a psychiatric wing or AIDS or whatever it was. That information will not be disclosed. I'm jumping in because I'm not going to be here this afternoon.
DR. ROTHSTEIN: Your view would be to leave the rule as is without making any changes?
MR. BLAIR: Yes.
DR. ROTHSTEIN: What about a simplified authorization?
MR. BLAIR: Yes.
MR. FANNING: One intermediate message would be that there are some categories of uses and disclosures where a simple opportunity to object. I just point that out. I don't know whether the committee needs to go into that sort of detail.
DR. ROTHSTEIN: Could we say something about this: We encourage the Secretary to explore alternatives that would make access to department information more easily obtainable by non-profit fundraisers while also protecting to the extent possible the PHI of patients.
MR. FANNING: You might formulate in terms of protecting the ability of the individual to have some role in controlling it. Isn't that what you're speaking of?
DR. ROTHSTEIN: Yes. Would that satisfy you? It's not going to be our call anyhow ultimately. All that we can do is put the issue on the table.
MR. FANNING: That's the point of my term giving the individual some role. The Secretary will then decide whether that role is opt-out or allowed to be included as an element of the consent form or a simplified authorization. The transcript of this proceeding is available to the people writing the regulation and they will see the legislative history of this particular finding.
DR. ROTHSTEIN: What about number 2? We have three more to go through in five minutes.
(Number 2 read.)
MS. KAMINSKY: I think that's in there already. I'll look.
(Number 3 read.)
DR. ROTHSTEIN: We'll take out the upfront language to make it consistent with the other one. We'll approve number 3.
(Number 4 read.)
We heard testimony at our hearing last month about whether hospitals could continue to use information that was generated before the rule came into effect. There are transitional rules for other things, but not for fundraising. That needs to be clarified.
DR. FITZMAURICE: Are we for or against use of that information past the deadline?
DR. ROTHSTEIN: My view is that they should be allowed to use that rule for a certain period of time.
DR. FITZMAURICE: To grandfather the data in.
DR. ROTHSTEIN: Individuals have an opt-out provision at their next contact. They can say no more.
MR. BLAIR: We might want to be more specific about that.
DR. ROTHSTEIN: To allow them to continue using it?
DR. COHN: Until their first contact with the institution.
DR. ROTHSTEIN: Okay. We have just a couple of minutes. I want to raise the issue about how we're going to respond to the NPRM as a group. We may only have 30 days. There might be time for the full committee meeting or regular subcommittee.
One possibility is we could schedule a meeting of the subcommittee here at the end of April assuming that something is going to be out by then which we could cancel at any time and have the agenda for that one-day meeting, how we're going to respond and to draft recommendations for consideration by the full committee or executive committee by conference call. The 25th of April?
MR. BLAIR: If there is agreement on that date, there is one issue that I would like to raise before we close. I have heard from a number of people, personally and through the industry, a lot of fear and concern, much of which I think is unnecessary with respect to the Privacy Rule. I feel as if we can avoid a continued negative reaction to the Privacy Rule to some degree if we prepare the final rules or if HHS prepares the final rules with more thought to how it is offered.
The more than 1,000 page NPRM had the final rules toward the back of the rule. It looked overwhelming and the consultants and the attorneys apparently have offered help, but some of them have done so in a manner to point out the risks and exposures to it that either doesn't comply with the rule in a manner which has injected fear and disconcern.
It is a serious matter and I think we do consider it serious. A lot of consultants and attorneys are offering valuable services. I think that it is extremely important, this is what I would urge to HHS, that that final rule be presented with a preface or something up front declaring the intent clearly to someone who is not an attorney and consultant where they could understand the basic intent of these regs so that we could minimize the amount of fear and the impression that this is an overbearing regulation.
A lot of the information is there really for the intent of clarifying, not for the intent of making this an onerous thing to implement. I think it's extremely important that we consider a lay person in the health industry and make sure they understand the intent of the rule and where to go for information in the rule.
MS. KAMINSKY: This may not speak to your concern, but in the beginning of the preamble, there is a description of each provision of the rule, just a little summarized description.
DR. ROTHSTEIN: You need to have some degree of sophistication. People don't read that whole thing. I agree with you entirely, Jeff. I would be even more critical of the consultants because they make their living. I've got some literature that really points up the off-the-wall possibilities that might happen.
MR. BLAIR: Government fines, jail, all of that stuff is emphasized to sell the services.
DR. ROTHSTEIN: It would be fair for us to include a couple of sentences at the end saying that in light of the fact that the NPRM is coming out, the committee has detected a level of anxiety in the public. We recommend that the NPRM take steps to inform the public of the general intent and to try to allay fears.
DR. COHN: I don't think this is a role for the NPRM. It has to do with the fact that OCR, as I heard yesterday, has pulled back from public presentations. Instead, there is written FAQ and guidance to the industry. This is an issue where there needs to be some communication and some clear guidance to the industry in FAQs such as you're describing.
The problem is, with a federal reg is 9-10 point type. My glasses are barely good enough to deal with it. There is going to be no way no matter what you say in the first 20 pages.
DR. ROTHSTEIN: How about if we couch it as this is an opportune time to redouble the efforts in education and public awareness and outreach?
MR. BLAIR: Stephanie, when we got the original NPRM, I would tell you that I went through that with my assistant for more than an hour and a half trying to find out where the actual rule was. I wound up calling Michael and saying I can't find it. He said it's towards the back.
MS. KAMINSKY: This is larger than just this reg.
MR. BLAIR: Since I've been involved and other people were calling me also with the same question.
DR. FITZMAURICE: The regs are always in the back. That's why they call it a preamble.
MS. KAMINSKY: There was a general plea made yesterday at the full committee meeting for subcommittees to weigh in on some kind of letter to Congress.
DR. COHN: It's the annual report.
DR. ROTHSTEIN: Thank you and we are adjourned.