Privacy and Security Tiger Team’s Recommendations in Full Text

Health IT Policy Committee Approves Tiger Team Recommendations
Mary Mosquera reported in Government HealthIT reported on August 20, 2010
“The Health & Human Services Department Health IT Policy Committee endorsed a set of recommendations on when health care providers must obtain consent before exchanging patient heath records electronically with other clinicians, testing labs or health information exchange (HIE) networks.”

Here’s the full-text version of the Tiger Team’s recommendations to the Health IT Policy Committee, which the committee approved and sent on to the Office of the National Coordinator (ONC) for Health IT.
PDF Version
HTML Version below:

August 19, 2010

David Blumenthal, MD, MPP
Chair, HIT Policy Committee
U.S. Department of Health and Human Services
Washington, D.C. 20201

Dear Mr. Chairman:

An important strategic goal of the Office of the National Coordinator (ONC) is to build public trust and participation in health information technology (IT) and electronic health information exchange by incorporating effective privacy and security into every phase of health IT development, adoption, and use.

A Privacy and Security “Tiger Team,” formed under the auspices of the HIT Policy Committee, has met regularly and intensely since June to consider how to achieve important aspects of this goal.

The Tiger Team has focused on a set of targeted questions raised by the ONC regarding the exchange of personally identifiable health information required for doctors and hospitals to qualify for incentive payments under Stage I of the Electronic Health Records Incentives Program.

This letter details the Tiger Teamʼs initial set of draft recommendations for the HIT Policy Committeeʼs review and approval.

Throughout the process, the HIT Policy Committee has supported  the overall direction of the Tiger Teamʼs evolving recommendations, which have been discussed in presentations during regular Policy Committee meetings this summer. There has always been an understanding, however, that the Tiger Team would refine its work and compile a set of formal recommendations at the end of summer for the HIT Policy Committeeʼs final review and approval.

It bears repeating: The following recommendations apply to electronic exchange of patient identifiable health information among known entities to meet Stage I of “meaningful use — the requirements by which health care providers and hospitals will be eligible for financial incentives for using health information technology. This includes the exchange of information for treatment and care coordination, certain quality reporting to the Centers for Medicare & Medicaid Services (CMS), and certain public health reporting.

Additional work is needed to apply even this set of initial recommendations specifically to other exchange circumstances, such as exchanging data with patients and sharing information for research. We hope we will be able to address these and other key questions in the months to come.

Most importantly, the Tiger Team recommends an ongoing approach to privacy and security that is comprehensive and firmly guided by fair information practices, a well-established rubric in law and policy. We understand the need to address ad hoc questions within compressed implementation time frames, given the statutory deadlines of the EHR Incentives Program. However, ONC must apply the full set of fair information practices as an overarching framework to reach its goal of increasing public participation and trust in health IT.

I. FAIR INFORMATION PRACTICES AS THE FOUNDATION
Core Tiger Team Recommendation:
All entities involved in health information exchange – including providers (1)
and third party service providers like Health Information Organizations (HIOs) and other intermediaries – should follow the full complement of fair information practices when handling personally identifiable health information.

Fair information practices, or FIPs, form the basis of information laws and policies in the United States and globally. This overarching set of principles, when taken together, constitute good data stewardship and form a foundation of public trust in the collection, access, use, and disclosure of personal information.

We used the formulation of FIPs endorsed by the HIT Policy Committee and adopted by ONC in the Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information. (2)  The principles in the Nationwide Framework are:
———————————–
(1) Our recommendations are intended to broadly apply to both individual and institutional providers.
(2) http://healthit.hhs.gov/portal/server.pt/gateway/PTARGS_
0_10731_848088_0_0_18/NationwidePS_Framework-5.pdf

——————————————–
            • Individual Access – Individuals should be provided with a simple and timely means to access and obtain their individually identifiable health information in a readable form and format.           

            • Correction – Individuals should be provided with a timely means to dispute the  accuracy or integrity of their individually identifiable health information, and to have  erroneous information corrected or to have a dispute documented if their requests are denied.           

            • Openness and Transparency – There should be openness and transparency    about policies, procedures, and technologies that directly affect individuals and/or their individually identifiable health information.           

            • Individual Choice – Individuals should be provided a reasonable opportunity and  capability to make informed decisions about the collection, use, and disclosure of  their individually identifiable health information. (This is commonly referred to as the individualʼs right to consent to identifiable health information exchange.)          

            • Collection, Use, and Disclosure Limitation – Individually identifiable health      information should be collected, used, and/or disclosed only to the extent necessary         to accomplish a specified purpose(s) and never to discriminate inappropriately.           

            • Data Quality and Integrity – Persons and entities should take reasonable steps to         ensure that individually identifiable health information is complete, accurate, and up-    to-date to the extent necessary for the personʼs or entityʼs intended purposes and     has not been altered or destroyed in an unauthorized manner.          

            • Safeguards – Individually identifiable health information should be protected with           reasonable administrative, technical, and physical safeguards to ensure its  confidentiality, integrity, and availability and to prevent unauthorized or inappropriate   access, use, or disclosure.           

            • Accountability – These principles should be implemented, and adherence  assured, through appropriate monitoring and other means and methods should be in   place to report and mitigate non-adherence and breaches.

The concept of remedies or redress — policies formulated in advance to address situations where information is breached, used, or disclosed improperly — is not expressly set forth in this list (although it is implicit in the principle of accountability). As our work evolves toward a full complement of privacy policies and practices, we believe it will be important to further spell out remedies as an added component of FIPs.

We also note that in a digital environment, robust privacy and security policies should be bolstered by innovative technological solutions that can enhance our ability to protect information. This includes requiring that electronic record systems adopt adequate security protections (like encryption, audit trails, and access controls), but it also extends to decisions about infrastructure and how health information exchange will occur, as well as how consumer consents will be represented and implemented. The Tiger Teamʼs future work will need to address the role of technology in protecting privacy and security.

 II. CORE VALUES  

In addition to a firm embrace of FIPs, the Tiger Team offers the following set of Core Values to guide ONCʼs work to promote health information technology:

             • The relationship between the patient and his or her health care  provider isthe foundation for trust in health information exchange, particularly with  respect to protecting the confidentiality of personal health information.           

             • As key agents of trust for patients, providers are responsible for  maintaining the privacy and security of their patientsʼ records.           

              • We must consider patient needs and expectations. Patients should not  be surprised about or harmed by collections, uses, or disclosures of  their  information.Ultimately, to be successful in the use of health information exchange  to  improve health and health care, we need to earn the trust of both consumers    and physicians.

III. SPECIFIC RECOMMENDATIONS REQUESTED

ONC has asked the Tiger Team for specific recommendations in the following areas:

            • Use of intermediaries or third party service providers in identifiable health  information exchange;

            • Trust framework to allow exchange among providers for purpose of treating  patients;

            • Ability of the patient to consent to participation in identifiable health information  exchange at a general level (i.e., yes or no), and how consent should be  implemented;

            • The ability of technology to support more granular patient consents (i.e., authorizing  exchange of specific pieces of information while excluding other records); and

            • Additional recommendations with respect to exchange for Stage I of Meaningful Use – treatment, quality reporting, and public health reporting.

All of our recommendations and deliberations have assumed that participating individuals and entities are in compliance with applicable federal and state privacy and security laws.

We evaluated these questions in light of FIPs and the core values discussed above.

1.    Policies Regarding the Use of Intermediaries/Third Party Service Providers/ Health Information Organizations (HIOs)

In the original deliberations of the Privacy and Security Work Group of the HIT Policy Committee, we concluded that directed exchange among a patientʼs treating providers – the sending of personally identifiable health information from “provider A to provider B” – is generally consistent with patient expectations and raises fewer privacy concerns, assuming that the information is sent securely.

However, the Tiger Team recognized that a number of exchange models currently in use are known to involve the use of intermediaries or third party organizations that offer valuable services to providers that often facilitate the effective exchange of identifiable health information (“third party service organizations”). A common example of a third party service organization is a Health Information Organization (HIO) (as distinguished from the term “health information exchange” (HIE), which can be used to refer to information exchange as a verb or a noun.) The exposure of a patientʼs personally identifiable health information to third party service organization raises risk of disclosure and misuse, particularly in the absence of clear policies regarding that organizationʼs right to store, use, manipulate, re-use or re-disclose information.

Our recommendations below regarding third party service organizations aim to address the following fair information practices:           

             Individual Access
            Correction
✔        Openness and Transparency 
            Individual Choice
✔        Collection, Use, and Disclosure Limitation
             
Data Quality and Integrity Safeguards
✔        Accountability

Tiger Team Recommendation 1: With respect to third-party service organizations:

                    Collection, Use and Disclosure Limitation: Third party service organizations   may not collect, use or disclose personally identifiable health information for   any purpose other than to provide the services specified in the business   associate or service agreement with the data provider, and necessary  administrative functions, or as required by law.

                      Time limitation: Third party service organizations may retain personally identifiable health information only for as long as reasonably necessary to  perform the functions specified in the business associate or service agreement  with the data provider, and necessary administrative functions.

                        Retention policies for personally identifiable health information must be established,   clearly disclosed to customers, and overseen. Such data must besecurely returned or destroyed at the end of the specified retention period, according to established NIST standards and conditions set forth in the business associate or service agreement.

                      Openness and transparency: Third party service organizations should be obligated to disclose in their business associate or service agreements with  their customers how they use and disclose information, including without   limitation their use and disclosure of de-identified data, their retention policies   and procedures, and their data security practices.(3)

            • Accountability: When such third party service organizations have access to  personally identifiable health information, they must execute and be bound by  business associate agreements under the Health Insurance Portability and   Accountability Act regulations (HIPAA). (4) However, itʼs not clear that those agreements have historically been sufficiently effective in limiting a third-partyʼs use or disclosure of identifiable information, or in providing the required transparency.

               • While significant strides have been made to clarify how business associates  may access, use and disclose information received from a covered entity, business associate agreements, by themselves, do  not address the full complement of governance issues, including oversight,
——————————————-
(3) This is the sole recommendation in this letter that also applies to data that qualifies as de-identified under HIPAA. The “Tiger Team” intends to take up de-identified data in a more comprehensive way in subsequent months.
(4)  45 CFR 164.504(e).
———————————–
accountability, and enforcement. We recommend that the HIT Policy  Committee oversee further work on these governance issues.

2. Trust Framework For Exchange Among Providers for Treatment

The issue of provider identity and authentication is at the heart of even the most basic exchange of personally identifiable health information among providers for purposes of a patientʼs treatment. To an acceptable level of accuracy, Provider A must be assured that the information intended for provider B is in fact being sent to provider B; that providers on both ends of the transaction have a treatment relationship with the subject of the information; and that both ends are complying with baseline privacy and security policies, including applicable law.

Our recommendations below regarding trusted credentialing aim to address the following fair information practices:
           
Individual Access Correction
✔        Openness and Transparency 
            Individual Choice Collection, Use, and Disclosure Limitation
✔        Data Quality and Integrity 
            Safeguards    
✔        Accountability

 Tiger Team Recommendation 2.1:

            • Accountability: The responsibility for maintaining the privacy and security of        a patientʼs record rests with the patientʼs providers, who may delegate    functions such as issuing digital credentials or verifying provider identity, as  long as such delegation maintains this trust.  

                        o To provide physicians, hospitals, and the public with an acceptable  level of accuracy and assurance that this credentialing responsibility is  being delegated to a “trustworthy” organization, the federal government   (ONC) has a role in establishing and enforcing clear requirements about     the credentialing process, which must include a requirement to validate   the identity of the organization or individual requesting a credential.

                         o State governments can, at their option, also provide additional rules  for credentialing service providers so long as they meet minimum  federal requirements.  

We believe further work is necessary to develop policies defining the appropriate level of assurance for credentialing functions, and we hope to turn to this work in the fall. A trust framework for provider-to-provider exchange also must provide guidance on acceptable levels of accuracy for determining whether both the sending and receiving provider each have a treatment relationship with the person who is the subject of the information being exchanged. Further, the trust framework should require transparency as to whether both senders and recipients are subject to baseline privacy and security policies. We offer the following recommendations on these points:

Tiger Team Recommendation 2.2:  

Openness and transparency: The requesting provider, at a minimum, should provide attestation of his or her treatment relationship with the individual who is subject of the health information exchange.  

Accountability: Providers who exchange personally identifiable health information should comply with applicable state and federal privacy and security rules. If a provider is not a HIPAA-covered entity or business associate, mechanisms to secure enforcement and accountability may include:  

o Meaningful user criteria that require agreement to comply with the HIPAA Privacy and Security Rules;  

o NHIN conditions of participation;  

o Federal funding conditions for other ONC and CMS programs; and  

o Contracts/Business Associate agreements that hold all participants to HIPAA, state laws, and any other policy requirements (such as those that might be established as the terms of participation).

Openness and transparency: Requesting providers who are not covered by HIPAA should disclose this to the disclosing provider before patient information is exchanged.  

3.    Right of the patient or provider to consent to identifiable health information       exchange at a general level — and how are such consents implemented

The Tiger Team was asked to examine the role that one of the fair information practices – individual choice or patient consent – should play in health information exchange. The recommendations cover the role of consent in directed exchange, triggers for when patient consent should be required (beyond what may already be required by law), the form of consent, and how consent is implemented. We also set forth recommendations on whether providers should be required to participate in certain forms of exchange. We must emphasize that looking at one element of FIPs in isolation is not optimal and our deliberations have assumed strong policies and practices in the other elements of FIPs required to support the role of individual consent in protecting privacy. 

            Our recommendations below regarding patient consent aim to address the following fair information practices:

            Individual Access 
  
          Correction            
            Openness and Transparency
✔        Individual Choice
          
Collection, Use, and Disclosure Limitation
         
 Data Quality and Integrity  
           Safeguards 
           Accountability

 A.   Consent and Directed Exchange

 Tiger Team Recommendation 3.1:

            • Assuming FIPs are followed, directed exchange for treatment does not  require patient consent beyond what is required in current law or what has been customary practice.

 Our recommendation about directed exchange is not intended to change the patient-provider relationship or the importance of the providerʼs judgment in evaluating which parts of the patient record are appropriate to exchange for a given purpose. The same considerations and customary practices that apply to paper or fax exchange of patient health information should apply to direct electronic exchange. As always, providers should be prepared and willing to discuss with patients how their information is disclosed; to take into account patientsʼ concerns for privacy; and also ensure the patient understands the information the receiving provider or clinician will likely need in order to provide safe, effective care.

B. Trigger for Additional Patient Consent
     Tiger Team Recommendation 3.2: 
 

      •     When the decision to disclose or exchange the patientʼs identifiable health  information from the providerʼs record is not in the control of the provider or  that providerʼs organized health care arrangement (“OHCA”), (5) patients   should be able to exercise meaningful consent to their participation. ONC    should promote this policy through all of its levers.  

            •   Examples of this include:  

                        o A health information organization operates as a centralized model, which retains identifiable patient data and makes that information available to other parties.  

                        o A health information organization operates as a federated model and                                 exercises control over the ability to access individual patient data.            

                        o Information is aggregated outside the auspices of the provider or OHCA and comingled with information about the patient from other    sources.
___________________________
(5)
Organized health care arrangement (45 CFR 160.103) means: (1) A clinically integrated care setting in which individuals typically receive health care from more than one health care provider; (2) An organized system of health care in which more than one covered entity participates and in which the participating covered entities: (i) Hold themselves out to the public as participating in a joint arrangement; and (ii) Participate in joint activities that include at least one of the following: (A) Utilization review, in which health care decisions by participating covered entities are reviewed by other participating covered entities or by a third party on their behalf; (B) Quality assessment and improvement activities, in which treatment provided by participating covered entities is assessed by other participating covered entities or by a third party on their behalf; or (C) Payment activities, if the financial risk for delivering health care is shared, in part or in whole, by participating covered entities through the joint arrangement and if protected health information created or received by a covered entity is reviewed by other participating covered entities or by a third party on their behalf for the purpose of administering the sharing of financial risk. [provisions applicable to health plans omitted]
___________________________

             • As we have noted previously, the above recommendation on consent applies  to Stage 1 Meaningful Use (thus, if consent applies, it applies to exchange for    treatment). We will need to consider potential additional triggers when we start  to discuss exchange beyond Stage One of Meaningful Use.  

            An important feature of meaningful consent criteria, outlined further below, is  that the patient be provided with an opportunity to give meaningful consent    before the provider releases control over exchange decisions. If the patient does not consent to participate in an HIO model that “triggers” consent, the   provider should, alternatively, exchange information through directed    exchange. There are some HIOs that offer multiple services. The provider may still contract with an HIO to facilitate directed exchange as long as the      arrangement meets the requirements of recommendation 1 of this letter.

C. Form of Consent

Consent in our discussions refers to the process of obtaining permission from an individual to collect, use or disclose her personal information for specified purposes. It is also an opportunity to educate consumers about the decision, its potential benefits, its boundaries, and its risks.

While the debate about consent often devolves into a singularly faceted discussion of opt-in or opt-out, we have come to the conclusion that both opt-in and opt-out can be implemented in ways that fail to permit the patient to give meaningful consent. For example, consider the case in which patients are provided with opt-in consent, but the exercise of consent and education about it are limited – the registration desk provides the patient with a form that broadly describes all HIO uses and disclosures and the patient is asked to check a box and consent to all of it. As another example, consider the case in which patients have a right to opt-out – but the patient is not provided with time to make the decision and information about the right or how to exercise it can only be found in a poster in the providerʼs waiting room or on a page of the HIOʼs website. It would jeopardize the consumer trust necessary for HIOs to succeed to simply provide guidance to use “opt-in” or “opt-out” without providing additional guidance to assure that the consent is meaningful.

Tiger Team Recommendation 3.3: Meaningful Consent Guidance When Trigger Appliesʼs consent is “triggered,” such consent must be meaningful (6) in that it:

In a circumstance where patient

            Allows the individual advanced knowledge/time to make a decision. (e.g., outside of the urgent need for care.)          

            • Is not compelled, or is not used for discriminatory purposes. (e.g., consent to participate in a centralized HIO model or a federated HIO model is not a  condition of receiving necessary medical services.)

            • Provides full transparency and education. (i.e., the individual gets a clear   explanation of the choice and its consequences, in consumer-friendly language that is conspicuous at the decision-making moment.)

            • Is commensurate with the circumstances. (I.e., the more sensitive, personally  exposing, or inscrutable the activity, the more specific the consent   mechanism. Activities that depart significantly from patient reasonable    expectations require greater degree of education, time to make decision,  opportunity to discuss with provider, etc.)

            • Must be consistent with reasonable patient expectations for privacy, health, and safety; and

            • Must be revocable. (i.e., patients should have the ability to change their consent preferences at any time. It should be clearly explained whether such    changes can apply retroactively to data copies already exchanged, or whether  they apply only “going forward.”)

 D. Consent Implementation Guidance

Further considerations for implementation includes the following guidance:

Tiger Team Recommendation 3.4 :

            • Based on our core values, the person who has the direct, treating    relationship with the individual, in most cases the patientʼs provider, holds the    trust relationship and is responsible for educating and discussing with
————————————————–
(6)
http://www.connectingforhealth.org/phti/reports/cp3.html
————————————————–
 patients about how information is shared and with whom.            • Such education should include the elements required for meaningful choice, as well as understanding of the “trigger” for consent (i.e., how information is being accessed, used and disclosed).            • The federal government has a significant role to play and a responsibility to educate providers and the public (exercised through policy levers).            • ONC, regional extension centers, and health information organizations  should provide resources to providers, model consent language, and educational materials to demonstrate and implement meaningful choice. HIOs  should also be transparent about their functions/operations to both providers  and patients.            • The provider/provider entity is responsible for obtaining and keeping track of  patient consent (with respect to contribution of information from their records.) However, the provider may delegate the management/administrative functions to a third party (such as an HIO), with appropriate oversight.The Tiger Team was asked whether providers should have a choice about participating in exchange models.

E. Provider Consent to Participate in Exchange

Tiger Team Recommendation 3.5: Yes! Based on the context of Stage I Meaningful Use, which is a voluntary program, ONC is not requiring providers to participate in any particular health information exchange.Our recommendations below regarding granular consent aim to address the           following fair information practices:Individual Access                  
                        Correction
                        Openness and Transparency
           
✔        Individual Choice
                       
Collection, Use, and Disclosure Limitation
                        Data Quality and Integrity
                        Safeguards
                        Accountability
In making recommendations about granular consent and sensitive data, we have the following observations:

4. The current ability of technology to support more granular patient consents.

            • All health information is sensitive, and what patients deem to be sensitive is likely to be dependent on their own circumstances.

            • However, the law recognizes some categories of data as being more sensitive than others.            

            • Unless otherwise required by law and consistent with our previous recommendation 3.1, with respect to directed exchange for treatment, the presence of sensitive data  in the information being exchanged does not trigger an additional requirement to  obtain the patientʼs consent in the course of treating a patient.

            • Our recommendations on consent do not make any assumptions about the capacity for an individual to exercise granular control over their information. But since this capability is emerging and its certainly fulfills the aspiration of individual control, we  sought to understand the issue in greater depth.

            • The Tiger Team considered previous NVHS letters and received a presentation of  current NCVHS efforts on sensitive data. We also held a hearing on this topic to try to understand whether and how current EHR technology supports the ability for patients to make more granular decisions on consent – in particular, to give consent to the providers to transmit only certain parts of their medical record.

            • We learned that many EHR systems have the capability to suppress psychotherapy notes (narrative). We also learned that some vendors offer the individual the ability to suppress specific codes. We believe this is promising. With greater use and demand, this approach could possibly drive further innovations.

            • We also note, however, that the majority of witnesses with direct experience in    offering patients the opportunity for more granular control indicated that most patients (7) agreed to the use of their information generally and did not exercise   granular consent options when offered the opportunity to do so. The Tiger Team also learned that the filtering methodologies are still evolving and improving, but that challenges remain,
————————————
(7) Witnesses offered estimates of greater than 90%.
——————————————–
 particularly in creating filters that can remove any associated or related information  not traditionally codified in standard or structured ways.

            • While it is common for filtering to be applied to some classes of information by commercial applications based on contractual or legal requirements, we understand that most of the commercial EHR systems today do not provide this filtering capability at the individual patient level. There are some that have the capability to allow the user to set access controls by episode of care/encounter/location of  encounter, but assuring the suppression of all information generated from a particular episode (such as prescription information) is challenging.

            • Preventing what may be a downstream clinical inference is clearly a remaining   challenge and beyond the state of the art today. Even with the best filtering it is hard to guarantee against “leaks.”

            • The Tiger Team believes that methodologies and technologies that provide filtering capability are important in advancing trust and should be further explored. There are several efforts currently being piloted in various stages of development. We believe   communicating with patients about these capabilities today still requires a degree of  caution and should not be over sold as fail-proof, particularly in light of the reality of             downstream inferences and the current state of the art with respect to free text.    Further, communicating to patients the potential implications of fine-grained filtering  on care quality remains a challenge.

            • We acknowledge that even in the absence of these technologies, in very sensitive cases there are instances where a completely separate record may be maintained and not released (abortion, substance abuse treatment, for example). It is likely that  these practices will continue in ways that meet the expectations and needs of  providers and patients.

            • In our ongoing deliberations, we discussed the notion of consent being bound to the data such that it follows the information as it flows across entities. We know of no    successful large-scale implementation of this concept in any other sector (in that it achieved the desired objective), including in the case of digital rights management   (DRM) for music. Nonetheless, we understand that work is being done in this emerging area of technology, including by standards organizations.

            • While popular social networking sites are exploring allowing users more granular control (such as Facebook), the ability of individuals to exercise this capability as     intended is still unclear.(8) In addition, the data that
————————————–
(8) See http://www.nytimes.com/2010/05/13/technology/personaltech/13basics.html  and http://www.nytimes.com/interactive/2010/05/12/business/facebook-privacy.html .
————————————-

                        populates a Facebook account is under the userʼs control and the user has unilateral access to it. Health data is generated and stored by myriad of entities in addition to the patient.

            • Even the best models of PHRs or medical record banks provide individuals with control over copies of the individualʼs information. They do not provide control over the copy of the information under the providerʼs control or that is generated as a part of providing care to the patient. They also do not control the flow of information once    the patient has released it or allowed another entity to have access to it.

            • Discussions about possible or potential future solutions were plentiful in our deliberations. But the Tiger Team believes that solutions must be generated out of  further innovation and, critically, testing of implementation experience.

            • The Tiger Team also considered previous NCVHS letters and received a presentation of current NCVHS efforts on sensitive data.

            • The Tiger Team therefore asked whether and what actions ONC might take to stimulate innovation and generate more experience about how best to enable patients to make more granular  consent decisions.

Tiger Team Recommendation 4: Granular ConsentThe technology for supporting more granular patient consent is promising  but is still in the early stages of development and adoption. Furthering   experience and stimulating innovation for granular consent are needed.This is an area that should be a priority for ONC to explore further, with a wide vision for possible approaches to providing patients more granular  control over the exchange and use of their identifiable health information, while also considering implications for quality of care and patient safety, patient educational needs, and operational implications.The goal in any related endeavor that ONC undertakes should not be a search for possible or theoretical solutions but rather to find evidence (such as through pilots) for models that have been implemented successfully and in   ways that can be demonstrated to be used by patients and fulfill their expectations. ONC and its policy advising bodies should be tracking this issue in an ongoing way and seeking lessons learned from the field as health information exchange matures.

            • In the interim, and in situations where these technical capabilities are being developed and not uniformly applied, patient education is  paramount: Patients must understand the implications of their decisions and the extent to which their requests can be honored, and we  encourage setting realistic expectations. This education has implications for providers but also for HIOs and government.                       Our additional recommendations below regarding Stage 1 of Meaningful Use aim to address the following fair information practices:
                       
Individual Access
                        Correction
                        Openness and Transparency
           
✔        Individual Choice
           
✔        Collection, Use, and Disclosure Limitation
                         
Data Quality and Integrity
                        Safeguards
                        Accountability
Tiger Team Recommendation 5:

5. Exchange for Stage 1 of Meaningful Use – Treatment, Quality reporting, Public health reporting

                      • Individual Consent: The exchange of identifiable health information for “treatment” should be limited to treatment of the individual who is the subject of the information, unless the provider has the consent of the subject individual to access, use, exchange or disclose his or her  information to treat others. (We note that this recommendation may  need to be further refined to ensure the appropriate care of infants or  children when a parentʼs or other family members information is needed to provide treatment and it is not possible or practical to obtain even a general oral assent to use a parentʼs information.)Collection, Use and Disclosure Limitation: Public health reporting by providers (or HIOs acting on their behalf) should take place using the least amount of identifiable data necessary to fulfill the lawful public  health purpose for which the information is being sought. Providers   should account for disclosure per existing law. More sensitive identifiable data should be subject to higher levels of protection.  
                        o In cases where the law requires the reporting of identifiable data (or where identifiable data is needed to accomplish the  lawful public health purpose for which the information is sought),                                    identifiable data may be sent. Techniques that avoid identification, including pseudonymization, should be considered, as appropriate.

            • Collection, use and Disclosure Limitation: Quality data reporting by providers (or HIOs acting on their behalf) should take place using the least amount of identifiable data necessary to fulfill the purpose for which the information is being sought. Providers should account for disclosure. More  sensitive identifiable data should be subject to higher levels of protection.

            • The provider is responsible for disclosures from records under its control, but    may delegate lawful quality or public health reporting to an HIO (pursuant to a business associate agreement) to perform on the  providerʼs behalf; such delegation may be on a “per request” basis or  may be a more general delegation to respond to all lawful requests.

IV. CONCLUSION

The foregoing recommendations were targeted to address set of questions raised by ONC. They should not be taken as the definitive or final word on privacy and security and health IT/health information exchange; they are instead a set of concrete steps that the Tiger Team believes are critical to establishing and maintaining trust. As we have said from the outset, these recommendations can only deliver the trust necessary when they are combined with the full implementation of all the FIPs. Only a systemic and comprehensive approach to privacy and security can achieve confidence among the public. In particular, our recommendations do not address directly the need to also establish individual access, correction and safeguards capabilities, and we recommend these be considered closely in the very near future, in conjunction with a further detailed assessment of how the other FIPs are being implemented.

We look forward to continuing to work on these issues.

Sincerely,
Deven McGraw Chair
Paul Egerman Co-Chair

Appendix A—Tiger Team Members
Deven McGraw, Chair, Center for Democracy & Technology
Paul Egerman, Co-Chair
Dixie Baker, SAIC
Rachel Block, NYS Department of Health
Carol Diamond, Markle Foundation
Judy Faulkner, EPIC Systems Corp.
Gayle Harrell, Consumer Representative/Florida
John Houston, University of Pittsburgh Medical Center; NCVHS
David Lansky, Pacific Business Group on Health
David McCallie, Cerner Corp.
Wes Rishel, Gartner
Latanya Sweeney, Carnegie Mellon University
Micky Tripathi, Massachusetts eHealth Collaborative

ONC Launches SHARP Web site for Strategic Health IT Advanced Research Projects

ONC Launches SHARP Web site for Research Programs
The Office of National Coordinator for Health IT launched its new Web site area on August 20, 2010 for the four research initiatives within the Strategic Health IT Advanced Research Projects Program  overseen by Wil Yu, Special Assistant of Innovations and Research, who  serves as Senior Project Officer for SHARP program.

SHARP Overview

SHARP Overview

Excerpted from ONC Site on August 21, 2010:

“SHARP awardees are currently conducting research along the following areas:

“AREA ONE: Security and Health Information Technology – The University of Illinois at Urbana-Champaign is helping develop technologies and policy recommendations that reduce privacy and security risks and increase public trust.

“AREA TWO: Patient-Centered Cognitive Support – Innovative cognitive research is being led by the University of Texas, Houston to harness the power of health IT to integrate and support physician reasoning and decision-making as providers care for patients.

“AREA THREE: Health Care Application and Network Design – Harvard University is leading platform based research to create new and improved system designs that facilitate information exchange while ensuring the accuracy, privacy, and security of electronic health information.

“AREA FOUR: Secondary Use of EHR Information – Mayo Clinic of Medicine is developing strategies to improve the overall quality of healthcare by leveraging existing EHR data to generate new, environmentally appropriate, best practice suggestions.”

SHARP Project Officer:
Wil Yu, Special Assistant, Innovations
ONC, Office of the Chief Scientist

Resources:
Facts-At-A-Glance
Frequently Asked Questions
Original Funding Announcement

Direct Links to Programs
Security and Health Information Technology:  http://sharps.org
Patient-Centered Cognitive Support: http://sharpc.org
Health Care Application and Network Design: .http://www.smartplatforms.org
Secondary Use of EHR Information: http://sharpn.org/
#                     #                  #

For more on project officer Wil Yu, see e-Healthcare Marketing blog.

Previous e-Healthcare Marketing posts on SHARP Program:
June 7, 2010: Updates on ONC’s SHARP — Strategic Healthcare IT Advanced Research Projects
April 7, 2010: Blumenthal Letter #11: Research and Innovation that Translates to Practice–SHARP Grants  includes Health IT Buzz Blog Post from Dr. Charles Friedman, Chief Scientific Officer, ONC: “SHARP: Confronting IT Challenges Head-on and Investing in the Future of Health Care”

State Medicaid Directors Letters on Health IT from CMS

State Medicaid Directors Letters from CMS on Health IT Programs
2010 and 2009 Letters
This post includes both the latest letter from 2010 in PDF and html formats, that was issued this week; and a link to letter from about one year ago in 2009 in PDF format only .
August 17, 2010 Letter: 
          Federal Funding for Medicaid HIT Activities 
          ARRA of 2009 Section 4201
          PDF Version  (Excerpted below in html)

September 1, 2009 Letter: 
          Federal Funding for Medicaid HIT Activities 
          ARRA of 2009 Section 4201
          PDF Version
 

August 17, 2010 CMS Letter to State Directors on Health IT:
DEPARTMENT OF HEALTH & HUMAN SERVICES
Centers for Medicare & Medicaid Services
Baltimore, Maryland
Center for Medicaid, CHIP and Survey & Certification  
SMD# 10-016

August 17, 2010
Re: Federal Funding for Medicaid HIT Activities

Dear State Medicaid Director:

This letter provides guidance to State Medicaid agencies regarding implementation of section 4201 of the American Recovery and Reinvestment Act of 2009 (the Recovery Act), Pub. L. 111-5, and our recently published regulations at 42 CFR Part 495, Subpart D. Section 4201, as well as our final regulations, will allow the payment of incentives to eligible professionals (EPs) and eligible hospitals to promote the adoption and meaningful use of certified electronic health record (EHR) technology.

The Recovery Act provides 100 percent Federal financial participation (FFP) to States for incentive payments to eligible Medicaid providers to adopt, implement, upgrade, and meaningfully use certified EHR technology, and 90 percent FFP for State administrative expenses related to the program.

The Centers for Medicare & Medicaid Services (CMS) issued a State Medicaid Director (SMD) letter on September 1, 2009, that provided guidance to States on allowable expenses for activities supporting the administration of incentive payments to providers. CMS has now promulgated final regulations that also govern State administrative expenses related to administering the program. Both the SMD letter and our regulations at 42 CFR section 495.318 explain that, in order to qualify for the 90 percent FFP administrative match, a State must, at a minimum, demonstrate to the satisfaction of the Secretary compliance with three requirements:

•           Administration of Medicaid incentive payments to Medicaid EPs and eligible hospitals;

•           Oversight of the Medicaid EHR Incentive Program, including routine tracking of meaningful use attestations and reporting mechanisms; and

•           Pursuit of initiatives that encourage the adoption of certified EHR technology for the promotion of health care quality and the electronic exchange of health information.

Page 2 – State Medicaid Director

This letter and the accompanying enclosures provide more detailed guidance from CMS on the expectations relating to the activities and potential uses of the 90/10 matching funds.

I.          Administration of the Medicaid EHR Incentive Program

Title IV, Division B of the Recovery Act established the Medicare and Medicaid EHR incentives programs, as one component of the Health Information Technology for Economic and Clinical Health (HITECH) Act. This initiative supports the goals of health reform by helping to improve

Americans’ health, and increase safety and efficiency in health care through expanded use of EHRs. Accordingly, States’ administration of the Medicaid EHR Incentive Program, and their role in fostering adoption and meaningful use of certified EHR technology, are essential components of broader reforms. States can receive the enhanced FFP for approved design, development, and implementation of systems and processes that are necessary to effectively administer the Medicaid EHR Incentive Program. When developing their implementation timelines, States should consider the critical role the Medicaid EHR Incentive Program plays in the success of related HITECH programs. In order for States to benefit most from available Federal resources, including time-limited funding and technical assistance, timely initiation of their Medicaid EHR Incentive Programs (i.e., as soon as possible in 2011) is important.

Enclosure A outlines CMS’ expectations and provides examples of potentially allowable activities and reasonable costs related to State administration of the program.

II.        Oversight of the Medicaid EHR Incentive Program

Under section 1903(t)(9)(B) of the Social Security Act and our recently published regulations at 42 CFR Part 495, Subpart D, States are required to conduct adequate oversight of the Medicaid EHR Incentive Program. Although the provider incentive payments are paid by the States, they are 100 percent reimbursable under Medicaid. States must ensure that the program meets all statutory and regulatory requirements and is implemented in a manner that minimizes the potential for fraud, waste and abuse. The 90 percent matching rate for FFP is available to States for approved processes, systems, and activities necessary to ensure that the incentive payments are being properly made to the appropriate providers, in the appropriate circumstances, and in an auditable and defensible manner. We emphasize that an effective and efficient oversight strategy is one that is timely, targeted, and balances risk with available auditing resources.

Enclosure B provides additional information about CMS’ initial expectations for States’ auditing and oversight of their Medicaid EHR Incentive Program.

III.       Pursuing Initiatives to Encourage the Adoption of Certified EHR Technology and Health Information Exchange

CMS expects that State Medicaid agencies will have a role in the promotion of EHR adoption and health information exchange. HITECH provided several funding sources, including various grant programs through the Office of the National Coordinator for HIT (ONC) for States to achieve improved health care outcomes through health information technology (HIT). Medicaid plays an important role as both a payer and a collaborator with these other HIT initiatives to produce the desired impact on the health care system. Where possible, CMS encourages State Medicaid agencies to collaborate on HIT initiatives with Federal programs and other partners in

Page 3 – State Medicaid Director

the States, such as public health departments, county governments, and local governments. Costs will be distributed equitably across all payers following fair share and cost allocation principles, per section 495.358.

Enclosure C outlines the CMS guiding principles for the availability of the 90 percent FFP administrative matching funds for basic administration and oversight of the Medicaid EHR Incentive Program, as well as efforts to promote its success among eligible Medicaid providers.

IV.       State Medicaid Health Information Technology Plan (SMHP) and HIT Implementation Advance Planning Document (HIT IAPD)

The SMHP (the product of the initial HITECH planning funds awarded to States) should outline the State’s current (“As-Is”) and future (“To-Be”) HIT landscape and plan for the administration and oversight of its Medicaid EHR Incentive Program in compliance with our regulations. As States establish the broad vision for their Medicaid EHR Incentive Programs in the SMHP, however, not all activities will necessarily be eligible for FFP under HITECH. States must use the HIT Implementation Advance Planning Document (IAPD) to request FFP and receive approval before implementing proposed State Medicaid HIT plan activities and services or acquire equipment. There may be activities that are more appropriately reimbursed as Medicaid Management Information Systems (MMIS) or general program administration expenditures, or may not be eligible for any CMS funding at all.

Enclosure D outlines the CMS process for reviewing the SMHP and associated funding request documents (HITECH and MMIS).

CMS expects that States will take an incremental approach to the initial implementation of their Medicaid EHR Incentive Programs. For example States may begin by focusing on provider outreach and registration, then on provider attestation and verification of eligibility, next on provider payments, and finally on capturing meaningful use data. Toward that end, we have identified elements of an SMHP that are considered critical for the initial submission and those that may be deferred for future updates. States must outline their timeline, noting critical benchmarks and dependencies. An updated template for the SMHP for States to use as a guide is available on the CMS Web site for download at: http://www.cms.gov/EHRIncentivePrograms/91_Information_for_States.asp#TopOfPage .

CMS will seek ONC input as we review SMHPs to ensure a coordinated approach for the State EHR Incentive Program and health information exchange (HIE) efforts. While the SMHP focuses on the Medicaid strategy for moving toward meaningful use of certified EHR technology, it should be consistent with and complementary to the overall State HIT strategy developed under section 3013 of the Public Health Service Act (PHS). CMS and ONC will work together in the review of both strategies to prevent duplicative efforts of statewide HIT/HIE activities, provider outreach activities, and Medicaid HIT activities.

We encourage States to use the resources, tools, Frequently Asked Questions, and information available at the Federal level, particularly through the CMS EHR Incentive Program Web site: http://www.cms.gov/EHRIncentivePrograms/  and the ONC Web site: http://www.healthit.gov. We look forward to collaborating with State Medicaid agencies and learning from your experiences as we provide technical assistance, policy guidance, and Federal resources to ensure successful development and implementation of Medicaid EHR Incentive Programs. CMS believes that health information technology can be a transformative tool, improving the quality,

Page 4 – State Medicaid Director

efficacy, timeliness, and safety of patient care. With the States, as our partners, we can leverage the momentum provided by the Recovery Act’s EHR incentive programs to ensure that the innovations enabled by technology can support the framework of health care reform.

For further information or clarification on this State Medicaid Director letter, please contact Mr. Rick Friedman at CMS…

Enclosures:
A) Administering the Medicaid EHR Incentive Program
B) Oversight of the Medicaid EHR Incentive Program
C) Guiding Principles for the Use of the 90 Percent FFP for EHR Promotion
D) SMHP/IAPD Review Process

cc:
CMS Regional Administrators

CMS Associate Regional Administrators
Division of Medicaid and Children’s Health Operations

Ann C. Kohler
NASMD Executive Director
American Public Human Services Association

Joy Wilson
Director, Health Committee
National Conference of State Legislatures

Matt Salo
Director of Health Legislation
National Governors Association

Debra Miller
Director for Health Policy
Council of State Governments

Christine Evans, M.P.H.
Director, Government Relations
Association of State and Territorial Health Officials

Sincerely,
/s/
Cindy Mann Director

Page 5 – State Medicaid Director

Alan R. Weil, J.D., M.P.P.
Executive Director
National Academy for State Health Policy

David Blumenthal, M.D.
National Coordinator
Office of the National Coordinator for HIT

Page 6 – State Medicaid Director

Enclosure A
Administering the Medicaid EHR Incentive Program

Under the Recovery Act, States have the option to participate in the Medicaid EHR incentive program. States may receive 90 percent FFP for reasonable administrative expenditures incurred in planning and implementing the program.

States will undertake a number of activities relative to the administration of the Medicaid EHR Incentive program. As indicated in the CMS Electronic Health Record Incentive Program Final Rule at § 495.332, States will be expected to describe in detail in the State Medicaid HIT Plan (SMHP) a number of activities that CMS considers vital to the effective administration of the EHR Incentive Program. In order for States to claim the 90 percent FFP match, they must submit both a State Medicaid HIT Plan and an HIT Implementation Advance Planning Document (HIT IAPD). We recognize that not all States will administer the program using the same systems and processes; therefore we will assess each State’s SMHP to determine which activities would most appropriately be funded with the HITECH enhanced match and which might be better applicable to MMIS or regular program administration funding, or which may not be eligible for any CMS funding at all. In order to be eligible for the HITECH 90 percent FFP, activities must be directly related to the success of the Medicaid EHR Incentive Program, as described further in Enclosure C. In addition, please see Enclosure D for additional details about submitting SMHPs with HIT IAPD’s for both HITECH and MMIS funding.

States may potentially receive 90 percent FFP for the following program administration activities (not an exhaustive list), subject to CMS prior approval. (Note, as required by § 495.358, all costs are subject to cost allocation rules in 45 CFR Part 95.):

  • System and resource costs associated with the National Level Repository (NLR)
  • Interface System and resource costs associated with State interfaces of a Health Information Exchange (HIE)–(e.g., laboratories, immunization registries, public health databases, other HIEs, etc.)
  • Creation or enhancement of a Data Warehouse/Repository (should be cost allocated)
  • Development of a Master Patient Index (should be cost allocated)
  • Communications/Materials Development about the EHR Incentive Program and/or EHR Adoption/meaningful use
  • Provider Outreach Activities (workshops, webinars, meetings, presentations, etc).
  • Provider Help-Line/Dedicated E-mail Address/Call Center (hardware, software, staffing)
  • Web site for Provider Enrollment/FAQs
  • Hosting Conferences/Convening Stakeholder Meetings
  • Business Process Modeling
  • System and resource costs associated with the collection and verification of meaningful use data from providers’ EHRs
  • System and resource costs to develop, capture, and audit provider attestations
  • Evaluation of the EHR Incentive Program (Independent Verification (IV) & Validations (V) and program’s impact on costs/quality outcomes)
  • Data Analysis, Oversight/Auditing and Reporting on EHR Adoption and Meaningful Use
  • Environmental Scans/Gap Analyses SMHP updates/reporting; IAPD updates
  • Developing Data Sharing & Business Associate Agreements (legal support, staff)

Page 7 – State Medicaid Director

  • Ongoing costs for Quality Assurance activities
  • Multi-State Collaborative for Health IT annual dues
  • Staff/contractual costs related to the development of State-Specific meaningful use and patient volume criteria
  • Medicaid Staff Training/Prof. Development (consultants, registration fees, etc.)

CMS strongly encourages States to collaborate with other State-level and local partners in the design, development, and even procurement of systems needed to administer their EHR Incentive Programs. Doing so would make more effective use of both CMS’ and States’ share of the cost and would shorten the timeline for actually dispersing incentive payments to eligible providers. CMS is available to provide technical assistance to States interested in exploring collaborative approaches, and will disseminate information on approved and successful models.

CMS also strongly encourages States to consider the activities they plan to undertake to administer their EHR Incentive Program and to identify any that may overlap with other Federally-funded activities, such as provider outreach, development of a Master Patient Index, external inquiry management, etc. Where possible, these activities should be accomplished collaboratively, in which case costs are allocated across partners.

Budgeting for the 90 Percent FFP

States will be responsible for estimating the expenditures for the Medicaid EHR Incentive Program on the State’s quarterly budget estimate reports via Form CMS-37. These reports are used as the basis for Medicaid quarterly grant awards that would be advanced to the State for the Medicaid EHR incentive program. These forms are submitted electronically to CMS via the Medicaid and State CHIP Budget and Expenditure System (MBES/CBES). On Form CMS-37, States should include any projections of administration related expenditures for the implementation costs. On Form CMS-64, a State submits on a quarterly basis actual expenses incurred, which is used to reconcile the Medicaid funding advanced to States for the quarter made on the basis of the Form CMS-37. (Refer to Enclosure D and its section on State Reporting of Estimates, Expenditures, and Timing of the Grant Award Letter.)

To assist States in properly reporting expenditures using the MBES/CBES, the CMS-37 and CMS-64 reports will include a new category for reporting the 90 percent FFP match for State administrative expenses associated with the Medicaid EHR Incentive Program. The new category will be called “Health Information Technology Administration.” This reporting category is located on the 64.10 base page lines 24A and 24B for Administration. Implementation expenditures are included on lines 24C and 24D.

CMS will monitor State agency compliance through systems performance reviews, focused reviews, and audits of the processes documented in the SMHP, and other planning documents. CMS may review States’ EHR Incentive Programs using a variety of audit/review tools, including, but not limited to, financial audits, State Program Integrity Reviews, and payment data analysis. CMS is allowed to suspend payments if the State fails to provide access to information, per our final regulations, § 495.330.

Page 8 – State Medicaid Director

In order to track progress made towards the nationwide implementation of the Medicaid EHR Incentive Programs, CMS requests that States indicate to us through their State Medicaid HIT Plans, the target date by which they plan to launch their program. For consistency’s sake, we will consider a State’s Medicaid EHR Incentive Program ready to launch when a State has met all of the following criteria:

The State has an approved SMHP and an approved IAPD. The State has initiated outreach and communications about the Medicaid EHR Incentive Program, including posting information on its Web site. The State has an effective and tested interface to accept provider registration information from the CMS NLR (i.e., has successfully tested with the NLR). The State is now capable, or will be capable within 3 months, of accepting provider attestations. The State is now capable, or will be capable within 5 months, of making provider incentive payments. The State has sufficient controls in place to ensure that the right incentive payments are made to the right providers before initiating provider incentive payments.

Prior to the release of the 100 percent FFP provider incentive funding, CMS will require that States provide a brief written update regarding the launch criteria above.

Page 9 – State Medicaid Director

Enclosure B
Oversight of the Medicaid EHR Incentive Program

Under Section 1903(t)(9)(B) of the Social Security Act, States are required to conduct adequate oversight of the Medicaid incentive program. Our regulations, including §§ 495.318(b), 495.332, 495.366, and 495.368, also require States to conduct oversight to monitor, among other things, provider eligibility, payments, fraud, waste, and abuse.

In addition, CMS is developing a joint Medicare/Medicaid audit strategy. In the interim, this enclosure provides initial CMS expectations regarding State responsibilities for oversight and audit in the early stage of EHR incentive program implementation. CMS will expand and build upon these requirements after the joint strategy is finalized and States begin implementing their programs.

CMS expects States to implement a risk-based auditing approach to prevent making improper Medicaid EHR Incentive payments and to monitor the program for potential fraud, waste, and abuse. For 2011, CMS expects that, at a minimum, States will focus their auditing resources on the following specific items:

Provider eligibility: for example, an identified means to verify that providers are credentialed, not-sanctioned, not hospital-based, practicing predominately, and are one of the types of eligible professionals or institutions under the EHR incentive program. Patient volume: for example, an identified means to audit or verify the attestation data, including use of proxy data (such as claims) where appropriate to identify risk. Adopt, implement, or upgrade (AIU): for example, have an identified means to audit or verify that providers have actually adopted, implemented, or upgraded certified EHR technology. (Note: CMS does not anticipate that States will audit meaningful use in 2011 as all eligible Medicaid providers can receive an EHR incentive payment for AIU in their first participation year.) Certified EHR technology: for example, States should collect the certified EHR technology code (see below) as part of provider attestation for AIU, and should verify that the code is on the Office of the National Coordinator (ONC) list of certified EHR technology prior to issuing an incentive payment to that provider.

Prior to January 2011, ONC will make available through a public Web service (URL is still to- be-determined), a list of all certified EHR technology, including the name of the vendor and product, the product’s unique certification code, and the meaningful use criteria for which the product was certified. After January 2011, the ONC Web service is expected to have additional functionality related to combinations of certified EHR modules. For combinations of separate certified EHR technology that collectively could achieve meaningful use (e.g., modules), the ONC Web service would allow providers to enter the codes from the different certified modules and request a unique certification code that represents that specific combination. The Web service would then store and reflect for other providers that particular combination of certified EHR technology and the unique code associated with it. States should utilize the ONC Web service to automate the pre-payment verification of providers’ attestations regarding use of certified EHR technology. States should plan to test this process prior to accepting provider attestations. CMS will provide further details as soon as they become available.

Page 10 – State Medicaid Director

Using either their attestation system or other means, States must notify providers that it is the provider’s responsibility to ensure that its certified EHR technology code is listed on the ONC Web service before attesting to the State. Otherwise, the State’s verification system might produce a false negative result (e.g., the EHR technology was certified but there was a delay before it was added to the ONC Web service).

States may receive enhanced matching funds for the following audit/oversight activities, subject to CMS prior approval:

Auditing contractor(s)/Auditing In-House Activities Systems costs for interfaces to verify provider identity/eligibility (e.g., provider enrollment, license verification, sanctions, patient volume) System and Resource Costs associated with Provider Appeals for EHR Incentive Payments Staff and resources for data analysis and reporting requirements for the CMS EHR Incentive Program Privacy/Security Controls

We strongly recommend that States consider the data sources and partners (such as Regional Extension Centers and HIEs, etc.) that are available to support their auditing and oversight responsibilities- including using them as tools for conducting risk assessments for fraud, waste and abuse. For example, where appropriate, States should utilize reliable third-party data sources rather than conduct resource-intense individual on-site reviews. As noted above, we will be issuing further guidance related to oversight and auditing of meaningful use in the Medicare and Medicaid EHR Incentive Programs. At that time, CMS will share with States its auditing plans for the Medicare EHR Incentive Program. We will look for opportunities where appropriate to leverage Federal efforts on behalf of the States, including, but not limited to our auditing strategy for hospitals that are eligible for both Medicare and Medicaid EHR incentive payments. Further details regarding potential State and CMS collaboration on the auditing of meaningful use for hospitals that are eligible for both incentive payments is forthcoming. States should recognize that it is their sole responsibility to audit hospitals that are Medicaid-only (e.g., children’s and cancer hospitals).

The primary means for CMS and States to avoid duplicate payments to eligible professionals is through joint use of the National Level Repository (NLR). States must interface with the NLR not just to receive provider registration data and to ensure that there are no duplicative payments prior to issuing provider incentives, but also to notify the NLR when they have made an incentive payment. CMS expects that States will notify the NLR that an incentive payment has been made within 5 business days. Similarly, if a State has determined that the provider is ineligible for a payment, CMS expects that the State will notify the NLR within 5 business days. Finally, in accordance with our regulations, § 495.332, the State must make a payment within 45 days of completing all eligibility verification checks. In the case of providers registering at the end of a calendar year, a payment for that year must be made no later than 60 days into the next calendar year for EPs, or fiscal year, for hospitals. The full requirements document and interface control document developed for States’ interface with the NLR was made available to States through the CMS regional offices, with the July 13, 2010, release of the CMS final rule.

Page 11 – State Medicaid Director

CMS will monitor State agency compliance with audit and oversight requirements through systems performance reviews, focused reviews, and audits of the processes documented in the SMHP, and other planning documents. CMS may review States’ EHR Incentive Programs using a variety of audit/review tools, including, but not limited to, financial audits, State Program Integrity Reviews, and payment data analysis. CMS is allowed to suspend payments if the State fails to provide access to information, per our final regulations, § 495.330.

In accordance with the CMS final rule, Medicaid agencies must implement a provider appeals process.     See § 495.370 of our final regulations for details regarding provider appeals, as well as the SMHP template, which is located on the CMS Web site at: http://www.cms.gov/EHRIncentivePrograms/91_Information_for_States.asp#TopOfPage. Enclosure E also discusses information regarding provider appeals in the context of the SMHP contents.

Page 12 – State Medicaid Director

Enclosure C
Guiding Principles for Use of the CMS 90 Percent Administrative Matching Funds for the Medicaid EHR Incentive Program

State Medicaid agencies can receive enhanced matching funds at a 90-percent rate for their administration and oversight of the Medicaid EHR incentive program. CMS also expects that States will request the enhanced matching funds for reasonable administrative expenses related to their efforts to promote the adoption of certified EHR technology and health information exchange (HIE).

We recognize that not all States will implement their programs in the same manner, and each State may face unique barriers to adoption and meaningful use. The principles below provide an overarching framework by which CMS will consider State requests for 90 percent FFP. Each proposal will be examined by CMS (with input from ONC) to ensure funds provide direct support to the success of the Medicaid EHR incentive program, are coordinated with other State HIT-related activities, do not duplicate other funding sources, and are implemented in the most efficient and effective manner. In addition, we strongly encourage States to collaborate with other States and local partners in the design, development, and procurement of any new systems.

CMS will consider approval for 90 percent FFP for EHR/HIE promotion initiatives that will meet all of the following criteria:

  • Serve as a direct accelerant to the success of the State’s Medicaid EHR Incentive Program and facilitate the adoption and meaningful use of certified EHR technology. Expenses that do not directly correlate to the EHR Incentive Program will not be approved. Examples that may correlate include:
                      – Expenditures related to provider needs assessments, provider outreach about adoption and meaningful use of certified EHR technology, staff training, identification and development of tools to connect to health information exchanges, record locater services, secure messaging gateways, provider directories, development of privacy and governance policies and procedures, master patient indexes, interfaces for data (e.g., laboratory) that is important to Medicaid providers to be fully successful in an HIE environment, and procuring technical assistance for Medicaid providers to achieve meaningful use.
  • Are consistent with the ONC long-term vision for health information exchange, and are supportive of the activities prioritized by ONC cooperative agreement funding, namely secure messaging, the electronic reporting of structured laboratory data and enabling e- prescribing.
  • Are not duplicating meaningful use technical assistance efforts conducted by the ONC- funded Regional Extension Centers, Workforce Grantees, Beacon Grantees or other Federally-funded projects whose target population is the same, as well as ONC cooperative agreement grant funding for the development of HIE.

Page 13 – State Medicaid Director

  • Will, to the extent possible, be normalized and integrated into the Medicaid business enterprise. Examples include:          
                    -Expenditures related to technical bridges between Medicaid and health information exchanges or all-payer clinical/claims data warehouses or technologies to authenticate providers and beneficiaries (e.g., master provider or patient indices).
  • Cannot otherwise be funded by the MMIS matching funds. MMIS will be examined as a more appropriate funding source before HITECH because HITECH funds should be targeted toward scenarios that contribute to the transformation of the MMIS into a clinical- and claims-based engine that supports Medicaid’s broader health care reform goals. Examples of expenditures that relate to the Medicaid EHR Incentive Program but that might more appropriately be funded through the enhanced MMIS match include:
                   -  Expenditures related to the design, development, and testing of a standard continuity of care record (CCR) or continuity of care document (CCD) based upon Medicaid claims; or building a portal between the MMIS and a clinical data repository or an immunization registry.
  • Are designed to be well-defined, developmental, and time-limited projects, with specific goals that would enable eligible Medicaid providers who qualify for the Medicaid EHR Incentive Program to achieve meaningful use of certified EHR technology.
                   – Providers’ transactional and on-going expenses derived from participation in health information exchange would not be eligible for the 90 percent HITECH Medicaid administrative match. Instead, CMS believes such costs are more appropriately addressed through State reimbursement to providers. CMS will entertain State plan amendments that speak to payment policies designed to incentivize providers to report data, such as the medical home per-member/per- month model.
  • Are not intended to be permanent initiatives but will lead within a reasonably short timeframe to sustainable outcomes.
                    - Sustainability refers to the responsibility for on-going costs for operations and maintenance of systems initially developed or enhanced using HITECH funding. After a defined milestone, funding sources other than HITECH must be used.
                   – Personnel costs for those who work directly on the Medicaid EHR Incentive Program are permissible expenditures for the enhanced match over the short term; however, States must plan to absorb or bear those costs in the future.
  • Are developed in accordance with Medicaid Information Technology Architecture (MITA) principles, as required by §495.332.
  • Are distributed equitably across all payers following the fair share principle. CMS recognizes that Medicaid is often one of the largest insurers in a State and, as such, stands to benefit from efficiencies associated with health information exchange and meaningful use of EHRs. However, Medicaid’s contribution to health information technology should be weighted and allocated based on contributions by other payers, and not be the sole or primary source of start-up or operational funding.

Page 14 – State Medicaid Director

  • Are cost-allocated per Office of Management and Budget (OMB) Circular A-87. CMS will work with States on an individual basis to determine the most appropriate cost allocation methodology.
                   -  HITECH cost allocation formulas should be based on the direct benefit to the Medicaid EHR incentive program, taking into account State projections of eligible Medicaid provider participation in the incentive program.
                   -  Cost allocation must account for other available Federal funding sources, the division of resources and activities across relevant payers, and the relative benefit to the State Medicaid program, among other factors.
                   -  Cost allocations should involve the timely and ensured financial participation of all parties so that Medicaid funds are neither the sole contributor at the onset nor the primary source of funding. Other payers who stand to benefit must contribute their share from the beginning. The absence of other payers is not sufficient cause for Medicaid to be the primary payer.

Page 15 – State Medicaid Director

Enclosure D
State Medicaid HIT Plan and Implementation Advance Planning Process

This Enclosure provides guidance on the following topics regarding the State’s Medicaid HIT Plan (SMHP) and the State’s HIT Implementation Advance Planning Document (HIT IAPD):

  • HIT IAPD Preparation and On-Going Planning Activities
  • Budget Preparation Tips
  • State Submission and CMS Review and Approval Process for the SMHP and the HIT IAPD
  • State Reporting of Estimates, Expenditures, and Timing of the Grant Award Letter
  • Retroactive Requests for Planning Activities Funded at 90/10 Federal Financial Participation (FFP)

HIT IAPD Preparation and On-Going Planning Activities

Since the publication of the State Medicaid Director’s Letter on September 1, 2009, nearly every State and Territorial Medicaid agency has been approved to conduct HIT planning activities through the HIT Planning Advance Planning Document process (HIT PAPD), with the remaining agencies expected to submit funding requests in the coming months. A required deliverable of the HIT PAPD is the completion of a State Medicaid HIT Plan (SMHP), which must include the elements contained at §495.332 of the Medicare and Medicaid Programs’ EHR Incentive Program Final Rule. Once approved, the SMHP and the results of the planning activities must be included in the States’ HIT Implementation Advance Planning Document (HIT IAPD). The HIT IAPD is a plan of action that requests FFP and approval to acquire and implement the proposed State Medicaid HIT Plan activities, services or equipment. The end result of implementation will be the ability for the State Medicaid agency to successfully operate its EHR Incentive Program. States will then be able to make provider incentive payments with 100 percent FFP for State expenditures.

To the extent possible, the HIT IAPD must include the list of the HIT IAPD required elements that are contained in the Final Rule at: §495.338. In addition, the State should consider incorporating the optional SMHP elements included in the revised SMHP template located on the CMS Web site at: http://www.cms.gov/EHRIncentivePrograms/91_Information_for_States.asp#TopOfPage . It is possible that some planning activities may be on-going. In these instances, the State should continue to describe on-going planning activities using the As-Needed HIT Advance Planning Document Update (HIT APDU) process to request funding approval for project continuation, scope, and schedule changes, for incremental funding authority and project continuation when approval is being granted by phases.

Page 16 – State Medicaid Director

Budget Preparation Tips

We believe the provisions of the HITECH Act provide the necessary assistance and technical support to providers, enable coordination and alignment within and among States, establish connectivity to the public health community in case of emergencies, and ensure that the workforce is properly trained and equipped to be meaningful users of certified EHR technology. It is therefore important that the HIT IAPD include information about any grants, State or local funds, or other funding sources that are available to the State and that will contribute to the costs of activities for which the State is requesting HITECH matching funds. This information is not meant to duplicate what is in the SMHP but rather to provide CMS with adequate information to determine if the proposed cost allocation and/or division of labor and responsibilities among the various State partners are appropriate to existing rules and regulations and CMS expectations. For example, if a State wishes to build System X, it should indicate all other sources of funding that will contribute to System X, including other Federal HIT grant funding.

Example:

Grant/Funding Source:    

Share of the Cost Allocation    

Timing of the Funding Contribution (e.g., current, FY11, TBD)    

Lead Agency    

Contact Information    

State HIE Cooperative Agreement Program    

$5,000,000    

State Office of E-Health    

NamePhone numberE-mail  

ONC Regional Extension Center Cooperative Agreement Program    

$3,500,000    

State University of XYZ    

NamePhone numberE-mail  

Follow this link for a full description of each grant, listed in the bullets below:

.
 
 

 

.

State Health Information Exchange Cooperative Agreement Program Health Information Technology Extension Program Strategic Health IT Advanced Research Projects (SHARP) Program Beacon Community Program

Community College Consortia to Educate Health Information Technology Professionals Program Curriculum Development Centers Program Program of Assistance for University-Based Training

Competency Examination for Individuals Completing Non-Degree Training Program

The HIT IAPD proposed budget should follow the requirements at § 495.338 in the Final Rule and include the source of all funds which will be utilized by the State Medicaid agency for the

Page 17 – State Medicaid Director

specific activities outlined in the IAPD. This includes the following grants to the Medicaid agency:

CHIPRA Quality Demonstration Grant, if HIT related Medicaid Transformation Grant Primary Care Stabilization Grant

Enhancements to the State’s MMIS, such as building an interface to a source of HIT data, or shared reporting between the multiple projects, which will be cost allocated between the different projects, should be described in a separate MMIS APD. The separate MMIS APD may be included in the submission of the State’s HIT IAPD and, as an example, may be titled Part 1 – HIT, Part 2 – MMIS. Recovery funds must be tracked separately. That is the reason for separating the two documents. Funding requests for the MMIS APD should follow MMIS-specific guidance about the matching levels and permitted expenditures.

State Submission and CMS Review and Approval Process for the SMHP and the HIT IAPD

The State may simultaneously submit to CMS for approval both the SMHP and the HIT IAPD; or the State may choose to submit the SMHP first, receive CMS approval, and then submit the HIT IAPD to CMS. Either way, implementation activities cannot begin until the SMHP and the HIT IAPD have both been approved by CMS. As with the HIT Planning Advance Planning Document (PAPD), prior approval is required for States requesting FFP before conducting implementation activities. Exceptions will be made for States that have previously conducted planning activities and are requesting retroactive approval for 90 percent FFP for activities that occurred on or after February 18, 2009. Instructions for submitting these requests are described below under the heading, “Retroactive Approval of FFP with an Effective Date of February 18, 2009.”

CMS will determine which activities will be eligible for a 90 percent FFP match for State expenses for administration of the incentive payments and for promoting EHR adoption implementation activities. States should contact their CMS regional office representatives regarding funding questions. Enclosures A, B, and C contain examples of partial lists of implementation expenditures/activities that may be considered eligible for 90 percent FFP for administrative expenses to implement the activities contained in the State’s SMHP and HIT IAPD.

CMS will be using a joint Central Office/Regional Office review approach. In addition, CMS will share the States’ SMHPs with the Office of the National Coordinator for HIT (ONC) to ensure a coordinated approach for the State EHR Incentive Program and HIE efforts. While the SMHP focuses on the Medicaid strategy for moving toward meaningful use of certified EHR technology, it should be consistent with and complementary to the overall State HIT strategy developed under section 3013 of the Public Health Service Act (PHS). CMS and ONC will work together in the review of both strategies to prevent duplicative efforts of statewide HIT/HIE activities, provider outreach activities, and Medicaid HIT activities.

Page 18 – State Medicaid Director

State Reporting of Estimates, Expenditures and Timing of the Grant Award Letter

For the purposes of this guidance, CMS is using the term “grant award” when approving Federal funding for allowable Medicaid expenditures. This should not be confused with competitive grant awards (e.g., Transformation Grants, CHIPRA grants, etc.) made by CMS or other Federal agencies, such as ONC, for HITECH activities. Once CMS has officially approved the SMHP and HIT IAPD, a CMS HIT approval letter will be issued notifying the State of the approved funding to conduct implementation activities. Only then may a State request to receive the grant award on a quarterly basis. On the Forms CMS-37.9 and CMS-37.10, the new line items listed below have been added to reflect provisions under section 4201 of the Recovery Act:

Line 24A – HIT: Planning: Cost of In-house Activities Planning Activities for administrative expenses to oversee incentive payments made to providers: Cost of In- house Activities

Line 24B – HIT: Planning: Cost of Private Contractors Planning Activities for administrative expenses to oversee incentive payments made to providers: Cost of Private Sector Contractors

Line 24C – HIT: Implementation and Operation: Cost of In-house Activities Implementation Activities for administrative expenses to oversee incentive payments made to providers: Cost of In-house Activities

Line 24D – HIT: Implementation and Operation: Cost of Private Contractors Implementation Activities for administrative expenses to oversee incentive payments made to providers: Cost of Private Sector Contractors

In addition, the CMS 64.10 report includes expenditure reporting for the following line items:

Line 24A – HIT Planning: Cost of In-house Activities Line 24B – HIT Planning: Cost of Private Contractors Line 24C – HIT Implementation and Operation: Cost of In-house Activities Line 24D – HIT Implementation and Operation: Cost of Private Contractors

For both the CMS 37.9, 37.10 and 64.10 reports, estimates and expenditures only pertain to HITECH and not to MMIS reporting for the line items listed above. In that regard, do not include any projections or expenditures of provider incentive payment for this provision for either FY 2010 or FY 2011 on the CMS-37.9, CMS-37.10, or 64.10 reports. When State staff are preparing the budget for the HIT IAPD, it is critical that both program and financial staff communicate with each other to ensure consistent State reporting to CMS’ Financial Management Group in order to eliminate discrepancies in both the APD estimates and the information being reported by the State fiscal staff pertaining to Form CMS-37.9 and Form CMS-37.10.

On the quarterly CMS-37 budget submission, a State may request to receive its HIT IAPD CMS grant award by including an estimated HIT IAPD expenditure in the CMS-37.10 Form. This estimated expenditure will result in a grant award to cover those expenses specified for that quarter. Therefore, it is imperative to accurately estimate the HIT IAPD expenditures by quarter.

Page 19 – State Medicaid Director

CMS will finalize the HIT IAPD grant award against the 64 HIT IAPD expenditures. The HIT IAPD grant award will be issued separately with a specified Payment Management System subaccount code.

If a State has not received its HIT IAPD approval letter, the State may still include a footnote in the Form CMS-37.12 of anticipated HIT IAPD expenditures, broken out by quarter.

Retroactive Approval of 90/10 FFP with an Effective Date of February 18, 2009

For administrative activities performed by a State, prior to having an approved HIT PAPD, which are in support of administrative expenditures for planning activities for incentive payments to providers, a State may request consideration of retrospective FFP by including a request in a HIT advance planning document or implementation advance planning document update.  In considering such a request, the agency takes into consideration overall Federal interests which may include any of the following:

(a) The acquisition must not be before February 18, 2009.

(b) The acquisition must be reasonable, useful, and necessary.

(c) The acquisition must be attributable to payments for reasonable administrative expenses per our regulations in §495.362.

The activities must be related to planning, and can be requested in the HIT APD that is active at the time of the request. As an example, if the HIT PAPD has ended and the State is preparing the HIT IAPD, then this request can be included in a separate section titled: “Request for Retroactive HIT Planning Funding” and must follow the criteria above. It can also be included in an Update or in the Annual APD report due 60 days from the approved APD anniversary date.

Rite Aid Agrees to Pay $1 Million to Settle HIPAA Privacy Case

Rite Aid Agrees to Pay $1 Million to Settle HIPAA Privacy Case
Company agrees to substantial corrective action to safeguard consumer information 

July 27, 2010 Press Release from HHS:
Rite Aid Corporation and its 40 affiliated entities (RAC) have agreed to pay $1 million to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, the U.S. Department of Health and Human Services (HHS) announced today. In a coordinated action, RAC also signed a consent order with the Federal Trade Commission (FTC) to settle potential violations of the FTC Act.

Rite Aid, one of the nation’s largest drug store chains, has also agreed to take corrective action to improve policies and procedures to safeguard the privacy of its customers when disposing of identifying information on pill bottle labels and other health information. The settlements apply to all of Rite Aid’s nearly 4,800 retail pharmacies and follow an extensive joint investigation by the HHS Office for Civil Rights (OCR) and the FTC.

The OCR, which enforces the HIPAA Privacy and Security Rules, opened its investigation of RAC after television media videotaped incidents in which pharmacies were shown to have disposed of prescriptions and labeled pill bottles containing individuals’ identifiable information in industrial trash containers that were accessible to the public. These incidents were reported as occurring in a variety of cities across the United States.  Rite Aid pharmacy stores in several of the cities were highlighted in media reports.

Disposing of individuals’ health information in an industrial trash container accessible to unauthorized persons is not compliant with several requirements of the HIPAA Privacy Rule and exposes the individuals’ information to the risk of identity theft and other crimes.  This is the second joint investigation and settlement conducted by OCR and FTC. OCR and FTC settled a similar case involving another national drug store chain in February 2009.

“It is critical that companies, large and small, build a culture of compliance to protect consumers’ right to privacy and safeguard health information. OCR is committed to strong enforcement of HIPAA,” said Georgina Verdugo, director of OCR. “We hope that this agreement will spur other health organizations to examine and improve their policies and procedures for protecting patient information during the disposal process.”

The HIPAA Privacy Rule requires health plans, health care clearinghouses and most health care providers (covered entities), including most pharmacies, to safeguard the privacy of patient information, including such information during its disposal.

Among other issues, the reviews by OCR and the FTC indicate that:

  • Rite Aid failed to implement adequate policies and procedures to appropriately safeguard patient information during the disposal process;
  • Rite Aid failed to adequately train employees on how to dispose of such information properly; and
  • Rite Aid did not maintain a sanctions policy for members of its workforce who failed to properly dispose of patient information.

Under the HHS resolution agreement, RAC agreed to pay a $1 million resolution amount to HHS and must implement a strong corrective action program that includes:

  • Revising and distributing its policies and procedures regarding disposal of protected health information and sanctioning workers who do not follow them;
  • Training workforce members on these new requirements;
  • Conducting internal monitoring; and
  • Engaging a qualified, independent third-party assessor to conduct compliance reviews and render reports to HHS.

Rite Aid has also agreed to external, independent assessments of its pharmacy stores’ compliance with the FTC consent order. The HHS corrective action plan will be in place for three years; the FTC order will be in place for 20 years.

The HHS Resolution Agreement and Corrective Action Plan can be found on the OCR website at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html.

OCR has FAQs that address the HIPAA Privacy Rule requirements for disposal of protected health information.  They can be found on the OCR website at http://www.hhs.gov/ocr/privacy/index.html.

Information about the FTC Consent Order agreement is available at http://www.ftc.gov.

Health Information Exchange: From Princeton to Washington, DC Conferences

July 22, 2010: HIE Day in Two Cities
WASHINGTON, DC (July 22, 2010) — With more than 400 delegates to the National HIE Summit from 38 states meeting in the nation’s capital today and over 125 delegates to the New Jersey HIE Summit & Expo meeting in Princeton, NJ, you can see federalism at work in Health IT.

In the Washington, DC Conference produced by the national eHealth Initiative, and hosted at the Omni Shoreham Hotel, the the topics of the day are:
Getting Started: What to do first?
Sustainability: What works?
Getting to Meaningful Use
Inter-State Coordination
Understanding and Connecting to the NHIN
Engaging Consumers in Health Information Exchange
Measuring Your Progress: What Really Matters?
Beyond Implementation: Planning for Privacy

The Washington session ends with a networking reception.

The Princeton, NJ Conference produced by NJTC (New Jersey Technology Council), and hosted at the New Jersey Hospital Association Conference Center, will cover:
NJ Health IT Extension Center (NJ-HITEC)
Colleen Woods, newly appointed Statewide Health IT Coordinator for New Jersey, will make a presentation.
Components of a Successful HIE
                 Developing a Sustainable Business Model for HIE
                 Managing an Effective Procurement Process
                 Engaging and Supporting Physicians in the Adoption of Heath IT
                 Building Public Private Sector Partnerships for HIE
HIPAA HITECH – Audits, Breaches & Fines
Navigating the Winding Road
                 Know Your Obligations
                 Identify and Address Gaps
                 Security Rule Compliance
                 Test Your Program and Consider Lessons Learned now Your Obligations
HIE Privacy, Security and Compliance
                 Understanding Meaningful Use Requirements
                 Understanding and Applying the New Standards Requirements
                 Developing and Implementing Strong Privacy and Security Policies
                 Advancing Administrative Simplification Efforts

Technologies that Transform Patient Care    

The Princeton session ends with an ice cream reception.   

Personal Notes
In Princeton, Vikas Khosla, President and CEO of  BluePrint Healthcare IT (and my boss), is participating in a panel discussion and focusing on  ”Developing and Implementing Strong Privacy and Security Policies” and joining two of my colleagues Gregory Michaels, Director, Security and Compliance; and Pam Kaur, Client Services Team Lead, who will be attending and working BluePrint’s exhibit table.

In Washington, as VP, Strategic Development and Public Policy, for BluePrint (and as e-Healthcare Marketing blogger), I will be listening, learning, meeting, and greeting state HIE coordinators and Health IT folks from across the country. And we’ll compare notes when the day is done.

BluePrint also issued a press release July 21, 2010 announcing two products that support secure health information exchange by lowering barriers to HIE interoperability and promoting patient confidence: HIE Secure and EMR Secure.

While e-Healthcare Marketing independently collects and reports information on Health IT including EHRs, ONC, CMS, and public policy, a view of the blogger and his business colleagues seemed worth noting today. Thank you for reading.
Mike Squires

ONC Blogs on ‘EHR Security: A Top Priority’

EHR Security: A Top Priority
Monday, July 19th, 2010 | Posted by:
Dr. Deborah Lafky, MSIS Ph.D. CISSP on ONC’s Health IT Buzz Blog and republished in e-Healthcare Marketing
With the passage of the HITECH Act, Congress made health IT security a top priority. ONC is committed to making electronic health information as secure as technically and humanly feasible.

That’s why ONC on April 1, 2010, launched an 18-month, multi-million dollar effort to improve the state of security and cybersecurity across the health IT spectrum. Key initiatives include:

  • Increasing health IT security by systematically assessing risk and providing tools and guidance to minimize it, including product configuration manuals and checklists to help assure secure health IT installations;
  • Educating the health IT community about security awareness with training, video, literature, and other materials;
  • Equipping the health IT workforce with the knowledge they need to manage health IT securely; and
  • Creating support functions such as back-up, recovery, and incident response plans to help when security emergencies strike.

Our ultimate goal is to protect patient information and create confidence in health IT’s security. These initiatives, and others, will help us do just that.

ONC recognizes that breaches are a serious issue. Despite stronger laws regarding breach notification, we must be vigilant and ensure they are reported. What may be surprising are the statistics. For example, we know that in the past 5 years, 80 percent of reported lost records were the result of hard drives, laptops, and other storage devices that disappeared. Interestingly, less than 10 percent of health care information breaches resulted from hacking or Internet crime.

So what does this mean in terms of security? It shows that simply preventing the theft or loss of data storage devices would have a huge impact on the security of our electronic health records. Fortunately, this doesn’t require a major investment in equipment or training. Instead, it requires some clear, common sense policies, such as:

  • Securing all computers that contain patient data;
  • Protecting laptops with a combination of physical, technology, and policy-related methods;
  • Locking drive bays to prevent hard drives from being removed;
  • Placing servers in secure areas, strictly limiting access, and maintaining entry/exit logs; and
  • Establishing security policies that require the use of a high-grade encryption algorithm.

As we roll out these ONC initiatives, I hope some of the readers of this blog will share their own best practices: What security measures have you taken or observed? How do you ensure the security of EHRs in your daily work? Share with us what has worked for you – and what has not. We can all learn from experience.

Watch the ONC website for updates on our available security materials and to see our progress.
#                     #                      #
To comment directly to this post on ONC’s  Health IT Buzz Blog, please click here.

Final Rules for EHRs: Incentives, Certification, Standards –Preliminary Roundup

Guide to Initial Stories on Final Rules for Incentives, Certification, Standards

Stakeholders still assessing final meaningful use rule
July 14, 2010 | Diana Manos, Senior Editor
“Initial response seemed to be cautiously optimistic, but the American Hospital Association expressed concerns.”

HIMSS’s Government HealthIT
Lower bar to meaningful use assures more EHR participation
By Mary Mosquera   Wednesday, July 14, 2010
“If initial reactions are anything to go by, the Centers for Medicare and Medicaid Services hit a home run with its final rule for meaningful use of electronic health records, simultaneously lowering the requirements bar and increasing the likelihood of more healthcare providers participating in the CMS’ incentive program and adopting EHRs.”

CMS abandons absolutes, adds flexibility to meaningful use
By Mary Mosquera             Tuesday, July 13, 2010
“In its final meaningful rule published today, the Center for Medicare and Medicaid Services has abandoned its original all-or-nothing approach to offering incentives for electronic health record adoption and opted for flexibility.”

Public comments reshaped CMS final rule
By Mary Mosquera    Tuesday, July 13, 2010
“The Centers for Medicare and Medicaid Services received some 2,000 comments after it published its proposed meaningful use rule in January, and they were key both to changes in the scope of the final rule published today and to the speed with which it was adopted.”


ModernHealthcare.com

Meaningful-use regulations released
By Andis Robeznieks
      Posted: July 13, 2010
“ ‘After reviewing the comments, we agree that requiring that (eligible professionals), eligible hospitals, and (critical access hospitals) satisfy all of the objectives and their associated measures in order to be considered a meaningful EHR user would impose too great a burden and would result in an unacceptably low number of EPs, eligible hospitals, and CAHs being able to qualify as meaningful EHR users in the first two years of the program,’the rule states.”

AMDIS members take on ‘meaningful use’
By Joseph Conn / HITS staff writer Posted: July 15, 2010
“The recent release of the new rules on meaningful use of electronic health-record systems dominated the discussion during the opening day of the Association of Medical Directors of Information Systems’ annual Physician Computer Connection Symposium in Ojai, Calif., on Wednesday.”

John Halamka’s Life as  Healthcare CIO blog
A Do it Yourself Presentation on the Standards Rule
July 14, 2010
“Just as I did with the Meaningful Use Rule, I’ve prepared a presentation that you can use for your Board and stakeholders to review the Standards Final Rule.”

A Do it Yourself Presentation on the Meaningful Use Final Rule
July 14, 2010
“Just as I did in January with the Meaningful Use NPRM, I’ve prepared a presentation that you can use for your Board and stakeholders to review the requirements the final Meaningful Use Rule. Feel free to use it without attribution to me.”

An Analysis of the Final Standards Rule
July 13, 2010
“At 10am today, the final Standards Rule was released as described on my previous blog. Here are additional details for stakeholders who want a technical analysis.”

Meaningful Use and the Standards are Finalized
July 13, 2010
“Today at 10am, CMS and ONC released the final rules that will guide electronic health record rollouts for the next 5 years…Here’s my analysis of the key changes in the Final Rule.”

New York Times
Standards Issued for Electronic Health Records
By ROBERT PEAR     Published: July 13, 2010
“The rules significantly scale back proposed requirements that the health care industry had denounced as unrealistic.”

The Wall Street Journal’s Health Blog
‘Meaningful Use’ Regs for Electronic Medical Records Finally Drop!
By Katherine Hobson  July 13, 2010
“The final regulations — all 864 pages of them – on what will constitute “meaningful use” of electronic medical records are now here. And the changes they include make it easier for hospitals and doctors to qualify next year for the first round of incentive payments for adopting EMRs.”
 (Probably requires paid subscription.)

iHealthBeat
Final Rules on ‘Meaningful Use,’ EHR Standards Released Today
iHealthBeat
story roundup. “Blumenthal said the final meaningful use rule offers health care providers more flexibility than the proposed regulations released in January.”

CMIO
AMDIS: Health execs initially pleased with meaningful use rules
By Mary Stevens, July 14, 2010
“OJAI, Calif.—A first look at the 864-page final rule for Meaningful Use and EHR Certification shows that policymakers “listened and responded” to some physicians’ concerns, said speakers Pat Wise, RN, vice president of healthcare information systems at HIMSS, and Michael Zaroukian, MD, PhD, CMIO and associate professor of medicine at Michigan State University, during a presentation at the annual AMDIS Physician-Computer Connection Symposium Wednesday.”

CMS, ONC release meaningful use final rules
By CMIO Editorial Staff       July 13, 2010
“In the final regulation is divided into two groups: a set of core objectives that constitute a starting point for meaningful use of EHRs and a separate menu of additional important activities from which providers will choose several to implement in the first two years, Blumenthal explained.”

e-Healthcare Marketing posts
See previous post on e-Healthcare Marketing for Final Rules PDFs, Press Release, Fact Sheets, and additional info.
See Dr. Blumenthal’s blog post on same subject as above, republished on e-Healthcare Marketing.
See Letter #17 from Dr. Blumenthal.

Blumenthal Blogs on Future of Healthcare with EHRs and New Rules

Advancing the Future of Health Care with Electronic Health Records
Tuesday, July 13th, 2010 | Posted by: Dr. David Blumenthal on Health IT Buzz Blog and reposted here by e-Healthcare Marketing here. 

Today, we’ve taken great steps forward in bringing America’s health records into the 21st century. Widespread and meaningful use of fully functional electronic health record systems combined with a robust infrastructure for broad-based health information exchange can improve the quality, safety, and efficiency of health care for all Americans.

As more organizations adopt electronic health records, physicians will have greater access to patient information, allowing faster and more accurate diagnoses. Complete patient data helps ensure the best possible care.

Patients too will have access to their own information and will have the choice to share it with family members securely, over the Internet, to better coordinate care for themselves and their loved ones.

Digital medical records make it possible to improve quality of patient care in numerous ways. For example, doctors can make better clinical decisions with ready access  to full medical histories for their patients—including new patients, returning patients, or patients who see several different providers. Laboratory tests or x-rays downloaded and stored in the patient’s electronic health record make it easier to track results. Automatic alerts built into the systems direct attention to possible drug interactions or warning signs of serious health conditions. E-prescribing lets doctors send prescriptions electronically to the pharmacy, so medications can be ready and waiting for the patient.

And while electronic health records require an initial investment of time and money, clinicians who have implemented them have reported saving money in the long term. With the efficiencies that electronic health records promise, their widespread use has the potential to result in significant  cost savings across our health care system.

The future looks bright, but the vision can’t become reality without first laying a firm foundation.

Helping us in this endeavor are the providers, software developers, health care administrators, patients, and others on the frontlines of health care. We talked with them about their experiences and expectations of health IT. We heard their aspirations and their reservations.   Our commitment to ensure privacy and security of electronic health records and health information exchange will remain at the forefront of all our efforts.  We are confident that what we’ve learned from these ongoing conversations will lead to the development of a structure designed to support and improve health care in this country.

The final rules recently released are the blueprints for that structure. The standards and certification final rule, released on July 13, 2010, helps ensure that certified electronic health records will have the capabilities necessary to achieve our goals. And now, with the release of the final rule for the meaningful use of electronic health records, we have a plan for how those capabilities can lead to better health care.

These rules are not an end in and of themselves, but provide us with a plan for the future.

I recognize the challenges and obstacles before us. Fundamental changes are difficult to undertake but I saw the difference an EHR made in my practice and I can clearly see where meaningful use of health information technology can take us.

Now that we have the foundation in place and the blueprints in hand, I encourage you to continue  your electronic health record adoption and implementation efforts so we can transform our vision into reality.

– Dr. David Blumenthal, National Coordinator for Health Information Technology
To comment directly on ONC’s Health IT Buzz Blog, click here.

See previous post on e-Healthcare Marketing for Final Rules PDFs, Press Release, Fact Sheets, and additional info.

NIST Claims Software Security Patent Will Help Improve Health IT Privacy

The July 6 Press Release from a Department of Commerce agency claims “A computer security invention patented a decade ago at the National Institute of Standards and Technology (NIST) is now poised to help safeguard patient privacy in hospitals.”

“Patent: J. Barkley. “Workflow Management Employing Role-Based Access Control,” U.S. Patent No. 6,088,679. July 11, 2000. Available at http://www.itl.nist.gov/div897/staff/barkley/6088679.pdf ”

“The invention—an algorithm that can be built into a larger piece of software—is designed to control access to information systems, and it has attracted the attention of a company that is putting it to use in the health care field. John Barkley, the algorithm’s creator, says the idea could solve one of the pervasive issues in the country’s health care system.

“ ’We think this software will provide dramatically improved security and privacy to patients,’ says Barkley, now retired from NIST’s Software and Systems Division and now consulting with Virtual Global, which is commercializing the product. ‘It solves the problem of overly broad access to patient information, which is widespread.’

“Barkley’s efforts stretch back to the 1980s, when the computer tools available for protecting electronic information were poor. Generally, access to information was available to anyone whose name was on a specific list of authorized users, but a large organization might have thousands of restricted files, each with its own access list—making security management awkward. Help came with the creation of Role-Based Access Control (RBAC), in which a person’s job function, not name, was the key to accessing a particular file. However, even RBAC could allow large numbers of people to have unlimited access to information—a particular problem in health care, where it is crucial but difficult to guarantee patient privacy.

“ ’We didn’t invent RBAC, but we wanted to systematize it and standardize it,’  says Richard Kuhn of NIST’s Computer Security Division and Barkley’s former supervisor. ‘While we were working on this, John [Barkley] came up with a way to control access by using RBAC within the context of a lengthy, multistep task, and I suggested he patent it.’

“In essence, the patent covers a method of ensuring that access to information is available to those who need it, but only when necessary. For example, at a hospital, the patient admission procedure involves a number of steps, and in each step someone needs access to the patient’s medical records for a specific purpose, like registering the patient or verifying their insurance information.

“ ’Once you’ve been admitted to the hospital, the admissions staff doesn’t necessarily need access to your records anymore. But in many hospitals, those staff members nonetheless continue to have access to every record on file,’ Barkley explains. ‘Using the algorithm we patented, those staffers would only be able to access your record during admission processing. After that, they would find your information unavailable—though the doctor who was treating you would still have access to it.’

“NIST released a Small Business Innovation Research solicitation in an effort to find a company to develop a product from the patent in 2008, which happened to be when Virtual Global, Inc., was searching for a way to protect electronic records for its clients. The company purchased the rights to it shortly thereafter and integrated the invention into its ‘HealthCapsule’ cloud platform. Virtual Global is now using HealthCapsule to create a pilot security system for LIFE Pittsburgh, a long-term care facility.’ “

ONC: Building Trust in HIE, Changes to HIPAA Privacy/Security Proposed

Blumenthal, ONC; and Verdugo, HHS Office of Civil Rights Release
“Statement on Privacy and Security”
 
Plus New Web site, FAQs, HHS Press Release, Blog Post

Joint ONC/OCR Statement on Privacy and Security
David Blumenthal
, M.D., M.P.P., National Coordinator for Health Information Technology, U.S. Department of Health and Human Services (HHS); and
Georgina Verdugo, Director, Office for Civil Rights, HHS

As the Department of Health and Human Services (HHS or The Department) continues its efforts to improve the health and care of all Americans by promoting the advancement of health information technology (IT), one of the Department’s guiding principles is that the benefits of health IT can only be fully realized if patients and providers are confident that electronic health information is kept private and secure. HHS’s goal, as directed by the 2009 Health Information Technology for Clinical and Economic Health (HITECH) Act, is to improve the nation’s health care system by enabling health information to follow the patient wherever and whenever it is needed. The HHS Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR) are working jointly on a number of projects to ensure that this electronic exchange of health information is built on a foundation of privacy, and security.

On July 8, 2010, HHS announced proposed regulations under the Health Insurance Portability and Accountability Act (HIPAA) of 1996 that would expand individuals’ rights to access their information and restrict certain disclosures of protected health information to health plans, extend the applicability of certain of the Privacy and Security Rules’ requirements to the business associates of covered entities, establish new limitations on the use and disclosure of protected health information for marketing and fundraising purposes, and prohibit the sale of protected health information without patient authorization. In addition, the proposed rule is designed to strengthen and expand OCR’s ability to enforce HIPAA’s Privacy and Security provisions. This rulemaking will strengthen the privacy and security of health information, and is an integral piece of the Administration’s efforts to broaden the use of health information technology in health care today. We urge consumers, providers, and other stakeholders to read these proposals and offer comments during the 60-day comment period, which will officially open on July 14, 2010. Information about posting comments will be available at http://www.regulations.gov.

Additionally, over the past few months, ONC and OCR have embarked on a number of other initiatives that serve to integrate privacy and security into the nation’s health IT efforts. As directed by HITECH, ONC established a new Chief Privacy Officer (CPO) position to provide critical advice to the National Coordinator in developing and implementing ONC’s privacy and security programs. The new CPO, Joy Pritts, JD, will play a key role in helping ONC design new policies to address privacy and security issues in every phase of health IT development and implementation.

On August 24, 2009, OCR issued an interim final breach notification regulation, which improves transparency and acts as an incentive to the health care industry to improve privacy and security by requiring HIPAA covered entities to promptly notify affected individuals, the HHS Secretary and, in some cases the media, of a breach. This new federal law holds covered entities and business associates accountable to the Department and to individuals for proper safeguarding of the private information entrusted to their care.

ONC is coordinating with the Centers for Medicare & Medicaid Services (CMS) on CMS’s development of a final regulation on the Medicare and Medicaid Electronic Health Record Incentives Programs. The incentives programs promote critical privacy and security measures and business practices. ONC also is developing a final regulation on standards and certification criteria to ensure that electronic health records (EHRs) contain the capabilities to support needed privacy and security requirements.

With respect to security, the Department also embarked on a number of initiatives. OCR coordinated with the National Institute of Standards and Technology to host a conference focused on the HIPAA Security Rule. OCR also issued draft guidance in conducting a HIPAA Security Risk Analysis to assist organizations in identifying and implementing the most effective and appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information. Additionally, an advisory committee on HIT standards held hearings to better understand security priorities, the effectiveness of security procedures, and vulnerabilities.

All these activities only serve as a prelude to our ongoing efforts to ensure that electronic health information is private and secure. In addition:

  • ONC and OCR are working together with representatives of consumer and industry groups to promote the adoption of privacy and security safeguards as essential components of implementing health information technology.
  • ONC is ensuring that the technical and policy foundations of the nationwide health information network will demonstrate methods for achieving trust among entities exchanging information while integrating best practices for privacy and security. A privacy and security workgroup (known as a “Tiger Team”) of the Health Information Technology Policy Committee (HITPC) was convened with strong consumer representation to hold public deliberations and make recommendations related to patient choice in how health information is exchanged; consumer access to health information; personal health records (PHRs); segmentation of health information; and transparency about information sharing and protections.
  • ONC staff is working with the President’s cybersecurity initiative and other Federal partners to solicit input from the best security minds in the federal government. Based on these activities, ONC will provide direction on security best practices and standards to technical and policy decision makers for inclusion in health information exchange programs.
  • Finally, the Department is working to provide the private sector with greater resources for improving privacy and security. Regional Extension Centers will educate providers about necessary privacy and security measures. Curriculum Development Centers Programs will incorporate necessary information into standard curricula for Community College Consortia, where a new cadre of HIT professionals will be trained, and for University-Based Training Programs, where health professionals will learn about HIT. State Health Information Exchange Cooperative Agreements and Beacon Communities grants will provide living examples of how privacy and security are successfully implemented and brought to scale.
Our Nation is poised to harness the power of information technology to improve health care. Transforming our health care system into a 21st century model is a bold agenda. As we enter into a new age of electronic health information exchange, it is more important than ever to ensure consumer trust in the privacy and security of their health information and in the industry’s use of new technology.
#                                 #                                  #

Excerpted from ONC Health IT Buzz Blog on July 8, 2010:
Privacy and Security

Thursday, July 8th, 2010 | Posted by: Joy Pritts, Chief Privacy Officer on Health IT Buzz Blog and republished here by e-Healthcare Marketing.
Privacy and security are the bedrock of building trust in health information exchange. The proposed modifications to the HIPAA Privacy & Security Rules, announced today, are a significant step forward in HHS’s efforts to protect patient privacy rights while encouraging the adoption of electronic health information exchange.  The next phase of this process is just as important—obtaining public feedback and suggestions concerning the proposed rules.   The comment period will begin once the rule is published in the Federal Register on July 14.  You can  submit your comments electronically through http://www.regulations.gov/ or via mail (original and 2 copies) to the Office for Civil Rights at: Office for Civil Rights, Attention: HITECH Privacy Rule Modifications, Hubert H. Humphrey Building, Room 509F, 200 Independence Avenue, S.W., Washington, D.C. 20201.  HHS is looking forward to receiving your input.
#                                 #                                  #

HHS Press Release on July 8, 2010:
HHS Strengthens Health Information Privacy and Security through New Rules
New health privacy website launched

HHS Secretary Kathleen Sebelius today announced important new rules and resources to strengthen the privacy of health information and to help all Americans understand their rights and the resources available to safeguard their personal health data.  Led by the Office of the National Coordinator for Health Information Technology (ONC) and the HHS Office for Civil Rights (OCR), HHS is working with public and private partners to ensure that, as we expand the use of health information technology to drive improvements in the quality and effectiveness of our nation’s health care system, Americans can trust that their health information is protected and secure.

“To improve the health of individuals and communities, health information must be available to those making critical decisions, including individuals and their caregivers,” said HHS Secretary Kathleen Sebelius. “While health information technology will help America move its health care system forward, the privacy and security of personal health data is at the core of all our work.”

Through the Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted as part of the American Recovery and Reinvestment Act of 2009, current health information privacy and security rules will now include broader individual rights and stronger protections when third parties handle individually identifiable health information.

The proposed rule announced today would strengthen and expand enforcement of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Enforcement Rules by:

  • expanding individuals’ rights to access their information and to restrict certain types of disclosures of protected health information to health plans. 
  • requiring business associates of HIPAA-covered entities to be under most of the same rules as the covered entities;
  • setting new limitations on the use and disclosure of protected health information for marketing and fundraising; and
  • prohibiting the sale of protected health information without patient authorization.

“The benefits of health IT can only be fully realized if patients and providers are confident that electronic health information is kept private and secure at all times,” said Georgina Verdugo, OCR director at HHS. “This proposed rule strengthens the privacy and security of health information, and is an integral piece of the administration’s efforts to broaden the use of health information technology in health care today.”

HHS is also looking more closely at entities that are not covered by HIPAA rules to understand better how they handle personal health information and to determine whether additional privacy and security protections are needed for these entities.

“Giving more Americans the ability to access their health information wherever, whenever and in whatever form is a critical first step toward improving our health care system,” said HHS’ national coordinator for health information technology, David Blumenthal, M.D., M.P.P. “Empowering Americans with real-time and secure access to the information they need to live healthier lives is paramount.”

HHS also launched today a privacy website at http://www.hhs.gov/healthprivacy/index.html to help visitors easily access information about existing HHS privacy efforts and the policies supporting them. The site emphasizes HHS’ deep commitment to privacy in the collection, use, and exchange of personally identifiable information. This new resource provides Americans with confidence that their personal information is secure and underscores HHS’ goal of greater openness and transparency in government.

The HITECH Act established the position of Chief Privacy Officer in ONC. Joy Pritts recently assumed the new position and is leading HHS efforts to develop and implement privacy and security programs and polices related to electronic health information.

“HHS strongly believes that an individual’s personal information is to be kept private and confidential and used appropriately by the right people, for the right reasons,” said Pritts.  “Without such assurances, an individual may be hesitant to share relevant health information.”

For more information about the proposed rule announced today visit http://www.ofr.gov/OFRUpload/OFRData/2010-16718_PI.pdf  

For other HHS Recovery Act programs, see
http://www.hhs.gov/recovery/programs/index.html#Health.

#                      #                               #
New HHS Web Site:
Health Data Privacy and Security Resources
http://www.hhs.gov/healthprivacy
The contents of the Health Data Privacy and Security Resources section have been excerpted below on July 8, 2010.
HHS respects the privacy of your personal information, and this page will help you find privacy resources throughout HHS.

This page provides key messages and access to resources emphasizing HHS’ commitment to privacy as a fundamental consideration in its collection, use, and exchange of personally identifiable information. This central resource helps visitors easily access information about existing HHS privacy efforts and the policies supporting them.

In support of HHS’ vision for Open Government and Transparency, this resource is to provide further confidence in the expectations Americans have for the privacy of their personal information and is to inspire added trust in HHS’ efforts to improve our nation’s health through safe and secure health information exchanges. HHS strongly believes that an individual’s personal information is to be kept private, confidential and used appropriately by the right people, for the right reasons. Without such assurances, an individual may be hesitant to share relevant health information.

More information about HHS’ commitment to health data privacy can be found in the notice of proposed rulemaking (NPRM) issued July 8, 2010; in the Frequently Asked Questions (FAQs); and the OCR/ ONC Joint statement on the NPRM.

You can access more information on health data privacy through the links provided below.

Privacy Policies

HHS Privacy Impact Assessments

The Privacy Act

Your Right to Federal Records: Questions and answers on the Freedom of Information Act and Privacy Act.

Health Information Portability and Accountability Act

Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules

Electronic Health Information Exchange Privacy and Security

Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information

Department Privacy Resources

Privacy Protection for Research Subjects: Certificates of Confidentiality

National Center for Health Statistics

HHS Privacy Committee

#                                #                               #
 
1.  What is the role of the Chief Privacy Office in the Office of the National Coordinator for Health Information Technology (ONC)?
Section 13101 of the HITECH Act (2009) required that a new Chief Privacy Officer (CPO) position be established in ONC.  The CPO will advise the National Coordinator on critical privacy and security policies and will play a key role in the design of new policies to assure that privacy and security is addressed in every phase of health IT development and implementation.  The Chief Privacy Officer will also coordinate with other federal agencies, states and regions, and international efforts.  
2.  What are respective roles of ONC and OCR regarding privacy and security?
The Office for Civil Rights (OCR) within the Department of Health and Human Services has the regulatory authority for the HIPAA Privacy and Security rules.  OCR also issues guidance and interpretations on HIPAA Privacy and Security rules, including how these rules apply to electronic health records, personal health records, and health information technology.  OCR has enforcement authority to ensure compliance with the HIPAA Privacy and Security Rules through investigation and the ability to impose civil monetary penalties. The HITECH Act of 2009 enhanced many of the Privacy Rule provisions, including extending certain requirement to business associates; limiting uses and disclosure of protected health information for marketing; prohibiting the sale of protected health information (PHI) without patient authorization; expanding individuals’ rights to access their information and restrict certain PHI disclosures to health plans; and providing greater enforcement authority to OCR.  The Office of the National Coordinator (ONC) for Health Information Technology is charged with the development of a nationwide health information technology infrastructure that allows for the electronic use and exchange of health information.  This includes examining and recommending policy,  technology, and practices that protect privacy and promote security. In addition, ONC  develops regulations for the certification of electronic medical records, engages public input, and implements grant programs, such as those to initiate state health information exchanges, the Regional Extension Centers that provide technical assistance to provided to reach meaningful use of EHRs, and Beacon Communities grants that will establish and demonstrate best practices for middle and later adopters of HIT.

3.  What are the roles of the HITPC and HITSC in privacy and security?
HITECH (Section 13101) required the establishment of a Health Information Technology Policy Committee (HITPC) to make recommendations on the policies needed to enable the electronic exchange and use of health information.  The HITPC recently formed a privacy and security work group (called a “Tiger Team”) with strong consumer representation to make recommendations on patient choice in health information exchange; consumer access to their health information; personal health records; segmentation of health information; and transparency about information sharing practices.  The Health Information Technology Standards Committee (HITSC) deliberates on the technical HIT standards required for electronic exchange.  HITSC held hearings to better understand security priorities, the effectiveness of security procedures, vulnerabilities, and is currently soliciting information related to data segmentation and privacy.  The Committees submit their recommendations to the National Coordinator. The National Coordinator evaluates the Committees’ recommendations and advises the Secretary of Health and Human Services.

4.  What is ONC doing to promote privacy in health information exchange (HIE)?
ONC is working with the federal Health Information Technology Policy Committee (HITPC) and HIT Standards Committee (HITSC) to explore policy and technical methods for enabling patient choice in health information exchange, including a one-day conference on available technical capabilities to support patient consent.  White papers on patient consent models and state consent laws were issued and a paper on data segmentation is underway.  A study of the privacy and security practices of entities not subject to HIPAA will support a report to Congress in which ONC will, in consultation with the Federal Trade Commission, make recommendations on the privacy and security requirements for non-covered entities, with an emphasis on personal health records.  A Request for Information on the same topic is being released to solicit information from the public.  ONC is organizing a series of listening sessions to engage the public in a national dialogue about health information exchange.  The Office of the Chief Privacy Officer is working with ONC divisions to assure the integration of privacy into all facets of ONC activities and projects.  In addition, ONC is working to ensure that the technical and policy foundations of the nationwide health information network will demonstrate methods for achieving trust among entities exchanging information while integrating best practices for privacy and security.

5.  What ONC activities are targeted to assure sufficient security capabilities in HIE?
ONC federal advisory committees have been active in collecting information, deliberating on key issues, and making recommendations to the National Coordinator on measures related to security of health information exchange.  In addition to the activities of the Health Information Technology Policy Committee (HITPC), the Health Information Technology Standards Committee held hearings to better understand security priorities, the effectiveness of security procedures, and vulnerabilities.  ONC also embarked on a multi-phase cybersecurity program that includes an assessment of HIT risks and threats and the development of a multi-pronged approach to combating them.  ONC also is collaborating with the President’s cybersecurity initiative along with other federal partners to solicit input from the best security minds in the government on security best practices and standards.  Meaningful use requirements for Medicare and Medicaid incentive payments include measures to protect security and privacy, and ONC’s interim final rule certification standards for EHRs includes the technical capabilities required to assure that information is adequately protected.