Rita Moya

President & CEO

NATIONAL HEALTH FOUNDATION
515 S. Figueroa Suite 1300
Los Angeles, CA 90071
(213) 538 0723
email: rmoya@natl-hlth-fdt.org

Good morning and thank you for this opportunity to address the National Committee on Vital & Health Statistics. We are especially appreciative of your holding these hearings on the west coast and we are hopeful our perspectives on data standards, health confidentiality and medical/clinical coding will assist your development of standards for the Health Insurance Portability and Accountability Act.

The National Health Foundation is a Los Angeles based charitable organization that was founded in 1973. The Foundation's mission is to improve the healthcare system by developing projects that promote and support more effective healthcare delivery and better personal health. NHF specializes in forming public/private partnerships and collaborations that address critical healthcare issues. Projects are designed to be replicable, self-sustaining and permanent solutions to gaps in the healthcare system. NHF receives specific program and general endowment funding from individuals, corporations, government and private foundations.

For the past five years, NHF has been involved in numerous projects related to administrative simplification and specifically the electronic transfer of health information. In 1993, the Foundation created the Healthcare Data Information Corporation, a mutual benefit organization made-up of healthcare providers, payers, purchasers and government entities in California. The shared vision of the members was to make Californians healthier by facilitating the development of a secure, standards-based, open statewide healthcare data interchange and data analysis capability. I will not elaborate on the work of HDIC because you will be hearing from Ann Geyer, HDIC's President, later today. My reason for referencing HDIC is that much of what the National Health Foundation has learned in terms of public policy development related to privacy, confidentiality and access for health care information was developed as part of our efforts to successfully launch this new organization. NHF actually spun HDIC off as a free-standing, self-sustaining entity last year but I am still a member of the Board of Directors in my capacity as founding President of HDIC.

HDIC is not NHF's only involvement with health information technology. We have been involved in the successful re-engineering of California's poison control centers, in creating an intranet for community clinics and in developing computer-based decision support tools. Because NHF has completed so many projects with a health information technology focus in the past several years, we recently created a Center for Health Information Technology and have made a permanent commitment to this area of endeavor. One of the goals of the new Center is to increase collaboration among healthcare stakeholders and work with all entities to eliminate barriers to effective deployment of health information technologies. One of the key barriers we have identified is the lack of standards, particularly for clinical information. NHF, as a charitable organization, places particular emphasis on the interests of consumers and evaluates all information technology in terms of its impact on consumers.

Given this history and focus, NHF is most interested in the opportunity that the Administrative Simplification provisions of the Insurance Portability and Accountability Act provide. We support any efforts that will advance development of standards for health information. We also appreciate the difficulty of this process. Having worked with diverse stakeholders, NHF has learned that consensus is difficult to achieve especially regarding standards. Often the group that should have a significant voice, consumers, are not represented.

Consumers have often been absent from discussions related to health information technology due to a number of factors. The very idea of healthcare "consumers" points to one of the biggest barriers to creating health information standards. Who are health "consumers"? Are they patients who actually need healthcare? Are they the general population in need of maintaining health? Or are consumers the employers who often pay for health benefits? In reality, "consumers" are all these groups.

All the various healthcare consumer categories must become advocates for utilizing more modern information technology in the processes of healthcare delivery and the maintenance of health. Our work with HDIC and the community clinics has shown us that healthcare providers are reluctant to invest in computer systems and software applications that keep track of patient information. Patient privacy, confidentiality and security of such data have often been cited as reasons for not converting records to electronic formats. These are issues of real concern but ones that can be solved with appropriate policies and procedures for utilizing information technology just as there are procedures for paper based systems. Patient, consent, encryption, data security software and coded access can do much to protect confidential information.

The National Health Foundation has spent over three years working with a group of dedicated volunteers from health plans, health provider organizations, consumer advocacy groups, employer groups and state and local government entities to develop guidelines for public policy that will protect the privacy rights of individuals and the confidentiality of all forms of health information which is collected, stored, processed or transmitted in electronic form. There are several basic assumptions regarding privacy that were supported by all these participants:

• Individuals have the right to privacy.
• Individuals have the right to review and have corrected data about themselves.
• Individuals have the right to access the audit trails that pertain to their own health records.

Additionally, there are assumptions related to confidentiality that were supported by all stakeholder participants:

• Electronic transfer of data will not occur without systems in place to support the verification of appropriate informed consent and maintenance of confidentiality.
• To protect confidentiality, a social security number should not be used as the sole unique identifier. (A social security number combined with additional characters may be acceptable.)

The stakeholder group proposed several policy areas for maintaining confidentiality that might be helpful to your deliberations:

• The individual has the right to identify items that s/he does not want disclosed.
• Payer, provider and employer proprietary information is confidential and is not to be released without consent.
• A unique system-generated identifier needs to be established for each patient, provider and payer.
• Appropriate data protection techniques need to be utilized to prevent the inadvertent release of person-identifiable information.
• The burden of proving patient consent will be the responsibility of persons/organizations requesting access to data.

Access to data is an area related to privacy and confidentiality but with additional parameters. The stakeholder group determined access to person-identified/identifiable data must be given only when the privacy and confidentiality provisions are not compromised. Access to aggregated, non-identifiable data can be given to researchers and other appropriate entities provided the purposes for which the data is sought are determined to be in the public interest and benefiting the overall advancement of knowledge regarding population(s) health. NHF, as an organization that does engage in research activities, feels strongly that access to aggregated, non-identifiable data is essential to furthering our collective understanding of what works and doesn't work in terms of health care delivery and health maintenance.

In closing, I would like to encourage this Committee to be bold and realize the full potential of administrative simplification that is contained in the Portability and Accountability Act of 1996. More efficient handling of information is in the best interest of all the various healthcare consumers. Balancing their unique requirements and needs is difficult, as we have learned from the projects we have undertaken with clinics, employer groups, health plans, provider organizations and consumer representatives. From these experiences we have come to regard the process of forging consensus as a very necessary part of any effort related to health information technology. We are not lacking for technological solutions but rather the shared will to cooperate on implementing the solutions. The details involved in accomplishing this consensus building are frustrating and time consuming but well worth the effort.

Thank you.