[This Transcript is Unedited]
UNIDENTIFIED PARTICIPANT: Hello? Hello?
UNIDENTIFIED PARTICIPANT: Hello, I'm just – a visitor calling in.
UNIDENTIFIED PARTICIPANT: Me too.
UNIDENTIFIED PARTICIPANT: I'm just a visitor as well.
UNIDENTIFIED PARTICIPANT: I think we're early, maybe two minutes.
UNIDENTIFIED PARTICIPANT: Yeah, I think so too. Well, at least we know we're online.
JIM SCANLON (ph): Wonder if they are ready. Hi, this is Jim Scanlon (ph). Anyone online?
UNIDENTIFIED PARTICIPANT: Yes.
DEBBIE JACKSON (ph): Hi, Debbie Jackson (ph) just plugged in.
SCANLON (ph): OK. Who else?
KAREN (ph): KAREN GLYCORN HARRIS (ph).
UNIDENTIFIED PARTICIPANT: Debbie's sitting in here. (INAUDIBLE).
SCANLON (ph): No, Debbie, I think is calling.
UNIDENTIFIED PARTICIPANT: OK.
SCANLON (ph): (INAUDIBLE).
JACKSON (ph): Yeah.
SCANLON (ph): You're over at Hyattsville, Debbie, right?
JACKSON (ph): I'm in the -- in the office actually, in the building.
SCANLON (ph): OK.
JACKSON (ph): I was over at the hearing. So, instead of heading over to Hyattsville, I came out over to HHS.
UNIDENTIFIED PARTICIPANT: Well, come over here to Room 440-B, our conference room.
SCANLON (ph): Yeah.
JACKSON (ph): I didn't know about it. Your 440B, is that where you all are?
UNIDENTIFIED PARTICIPANT: Sure.
JACKSON (ph): OK. I'll come on down.
UNIDENTIFIED PARTICIPANT: That's great. (INAUDIBLE). I didn't realize that's what you were here for.
UNIDENTIFIED PARTICIPANT: Yeah, we'll save – we'll save one of the telephones (INAUDIBLE)
JACKSON (ph): Thanks.
JOHN (ph): I'm John (ph) (INAUDIBLE).
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) how are you? (INAUDIBLE)
UNIDENTIFIED PARTICIPANT: Are you with Jeff ?
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) I work for Ann Murphy (ph) (INAUDIBLE)
UNIDENTIFIED PARTICIPANT: (INAUDIBLE)
UNIDENTIFIED PARTICIPANT: What? You did that?
MARK ROTHSTEIN, CHAIRMAN, PRIVACY AND CONFIDENTIALITY SUBCOMMITTEE: Hi, this is Mark.
UNIDENTIFIED PARTICIPANT: Sure.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE)
ROTHSTEIN: Is that you, Jim?
SCANLON (ph): Yes, is that Mark?
ROTHSTEIN: Yes.
SCANLON (ph): Well, hi Mark. How are you?
ROTHSTEIN: I'm well. It's been a whole a day since I spoke to you.
SCANLON (ph): That's right. I think I've gotten a case of laryngitis from Ron (ph) I can't (INAUDIBLE)
ROTHSTEIN: OK.
SCANLON (ph): I think we're still waiting, Mark, for other people to sign in.
ROTHSTEIN: OK. According to my records, Jeff ...
BLAIR: Yes.
ROTHSTEIN: Is that you, Jeff ? Hello.
STEPHANIE: Hello?
ROTHSTEIN: Hi, Stephanie.
STEPHANIE: Hi, how are you?
ROTHSTEIN: OK.
UNIDENTIFIED PARTICIPANT: Hi, Debbie.
SCANLON (ph): Debbie, which members of the subcommittee, if you remember, (INAUDIBLE)
ROTHSTEIN: Yes, I'll just start to go through the list, Jim, and ...
SCANLON (ph): OK.
ROTHSTEIN: The ones who I'm expecting ...
SCANLON (ph): OK.
ROTHSTEIN: Are Simon, Kepa (ph), Richard, and Jeff .
SCANLON (ph): OK.
ROTHSTEIN: I just got an e-mail this morning from John (ph) (INAUDIBLE) who cannot make it.
SCANLON (ph): OK. Well, people are calling in. So, we'll probably get everyone in a few minutes.
ROTHSTEIN: Right.
SCANLON (ph): Mark, you must be getting ready for the Kentucky Derby.
ROTHSTEIN: Well, this is the – this is the time of the year when I start scrounging around begging for tickets. I have a sandwich board and I wear it down broadway and (INAUDIBLE) will do (INAUDIBLE) for derby tickets.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) marketing?
UNIDENTIFIED PARTICIPANT: I think I have seen you on Rockville Pike here.
UNIDENTIFIED PARTICIPANT: When is the derby?
ROTHSTEIN: It's May 4th.
UNIDENTIFIED PARTICIPANT: Mark, did you get the stuff I sent you last night?
ROTHSTEIN: Yes, I did, thank you.
SCANLON (ph): Debbie, how did the hearing go this morning?
COHN: Hello?
ROTHSTEIN: Hello?
COHN: Simon.
ROTHSTEIN: Hi, Simon.
COHN: Hi.
UNIDENTIFIED PARTICIPANT: Jim is (INAUDIBLE), Mark, Simon.
UNIDENTIFIED PARTICIPANT: OK. Do we have Richard on?
ROTHSTEIN: Not yet.
UNIDENTIFIED PARTICIPANT: Yeah.
ROTHSTEIN: We're waiting for Richard and Kepa (ph) and Jeff .
UNIDENTIFIED PARTICIPANT: Jeff .
SCANLON (ph): Who just came on?
ROTHSTEIN: Well, it could be a – just a public listener because it is – the call is open to the public.
UNIDENTIFIED PARTICIPANT: That's right. OK.
UNIDENTIFIED PARTICIPANT: Is that OK, because I'm a public listener?
ROTHSTEIN: Absolutely.
SCANLON (ph): Sure, that's fine, yeah..
UNIDENTIFIED PARTICIPANT: I mean I'm with Missouri Medicare Part B, but I wasn't on anyone's list, but I'm here.
SCANLON (ph): That's fine.
ROTHSTEIN: That's fine.
SCANLON (ph): That's fine.
ROTHSTEIN: Once everyone is – once we have a quorum, then we will ask everyone including the (INAUDIBLE) if they so desire to identify themselves.
UNIDENTIFIED PARTICIPANT: OK.
SCANLON (ph): OK. (INAUDIBLE).
ROTHSTEIN: Jim, do you know if anyone from OCR is planning to – other than Stephanie – is planning to be on the call?
UNIDENTIFIED PARTICIPANT: Jim just left the room ...
LOUIS: I'm Louis Alterescu
ROTHSTEIN: Hi, Louis (INAUDIBLE) Vision. Hi.
ROTHSTEIN: Welcome ...
LOUIS: So, it's myself and Stephanie.
ROTHSTEIN: OK, great.
MCANDREW (ph): Louis
LOUIS: Hi Stephanie
STEPHANIE: Hi Lewis.
MCANDREW (ph): This is Sue McMcAndrew I'm also listening.
LOUIS: I'm sorry. OK.
ROTHSTEIN: OK.
MCANDREW (ph): That's OK, Lou?
LOUIS: Good, keep me honest.
SCANLON (ph): And I will never get a straight (INAUDIBLE).
MCANDREW (ph): I heard that.
SCANLON (ph): OK, sorry.
ROTHSTEIN: (INAUDIBLE).
SCANLON (ph): I think some folks from (INAUDIBLE) were going to come over as well for calling Jenny (ph). Jenny (ph), (INAUDIBLE)
JENNY (ph): I'm here.
SCANLON (ph): Jenny (ph), OK, you're on. Is John (ph) going to call in or ...
JENNY (ph): (INAUDIBLE)
SCANLON (ph): You're John (ph).
JENNY (ph): (INAUDIBLE) available today.
JOHN (ph): You can come to 440B Jenny (ph), if you want to see it.
ROTHSTEIN: Hi, John (ph).
JOHN (ph): Hello.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) Ann Marie.
ROTHSTEIN: Is there ...
UNIDENTIFIED PARTICIPANT: She's there – she is ...
ROTHSTEIN: Is Debbie Jackson (ph) or ...
JACKSON (ph): Hi, I'm here with the (INAUDIBLE) crew.
ROTHSTEIN: I'm wondering if you can double check to make sure that Richard and Kepa (ph) and Jeff are still going to be on the call.
MARIETTA (ph): Hi, Mark. This is Marietta (ph), I just signed on.
ROTHSTEIN: OK. I wonder if you could check that, please?
UNIDENTIFIED PARTICIPANT: Marietta (ph) (INAUDIBLE) can check to see about the other members who are – if I get to attend the call on that's Kepa (ph) and Jeff and (INAUDIBLE).
ROTHSTEIN: Yes.
MARIETTA: Richard is not going to be on the call.
ROTHSTEIN: He is not?
MARIETTA: He e-mailed yesterday and said he wouldn't be able to take the call.
SCANLON (ph): OK.
JEFF BLAIR: This is Jeff Blair. I'm here.
SCANLON (ph): Hi Jeff .
ROTHSTEIN: Welcome, Jeff .
MARIETTA: And I'll call Kepa (ph).
SCANLON (ph): So, just let (INAUDIBLE).
ROTHSTEIN: OK. So, he's the last person.
JACKSON: While we're waiting, I'll just mention, if we could remind people, almost periodically give out the calls to identify themselves before their commentary and it will make the transcript a lot more effective.
ROTHSTEIN: Yes, thank you for reminding me of that.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) subcommittee something (INAUDIBLE) they are going to be deciding it, they want to make anybody (INAUDIBLE) so probably (INAUDIBLE) OK, thank you.
BLAIR: Well, just to make the rest of you feel miserable, this is Jeff, I'm sitting in my office in my denim – in my jeans – denim stuff and the temperature outside here in New Mexico is in the ‘70s, it's dry it’s sunny it’s comfortable. I feel like I'm on a vacation.
ROTHSTEIN: Well, we're going to put you to work, Jeff, so that will be the end of your vacation.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) Jeff .
HARDING: This is – this is Richard, I'm on.
ROTHSTEIN: Great.
BLAIR: Hello, Richard.
HARDING: I'm sorry. My phone was – it was ringing and ringing and then I re-dialed and it was OK. So, I'm sorry to be a little late.
ROTHSTEIN: That's OK. We're just waiting to hear about whether Kepa (ph) is on the call and then we're going to get started because we've got a lot of work to do.
HARDING: OK.
MARIETTA: Mark, Kepa (ph) is about to call in.
ROTHSTEIN: Very good. Thank you.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) Jeff (INAUDIBLE).
UNIDENTIFIED PARTICIPANT: OK.
UNIDENTIFIED PARTICIPANT: Did I hear you're waiting for ...
ROTHSTEIN: We are waiting for Kepa (ph).
UNIDENTIFIED PARTICIPANT: Kepa (ph).
KEPA (ph), MEMBER, COMMITTEE AND SUBCOMMITTEE: I'm here. Kepa's (ph) here.
ROTHSTEIN: Kepa (ph) OK. Welcome. I am sorry. Well then, the meeting of the subcommittee is called to order. The first thing we need to do is remind everyone that we are being recorded, and so that for purposes of the transcript, I'm going to ask everyone to identify themselves before you speak. It will help the transcribers a great deal. And before we get started on the agenda and other items, let's all identify ourselves, beginning with the members of the subcommittee, followed by the HHS folks, and then, other members of the public if they want to identify themselves. So, to begin with, I am Mark Rothstein, the chair of the Privacy and Confidentiality Subcommittee.
JEFFREY BLAIR, MEMBER, PRIVACY AND CONFIDENTIALITY SUBCOMMITTEE: This is Jeff Blair. I'm a member of the Privacy and Confidentiality subcommittee.
RICHARD HARDING, MEMBER, PRIVACY AND CONFIDENTIALITY SUBCOMMITTEE, PRESIDENT, AMERICAN PSYCHIATRIC ASSOCIATION: This is Richard Harding. I'm a member of the committee and the subcommittee and I am also the President of the American Psychiatric Association.
KEPA (ph): This is Kepa (ph). I'm a member of the committee and subcommittee.
SIMON COHN, MEMBER, NATIONAL COUNCIL FOR VITAL AND HEALTH STATISTICS, AND SUBCOMMITTEE ON PRIVACY AND CONFIDENTIALITY: This is Simon Cohn. I am a member of the committee and subcommittee.
STEPHANIE KAMINSKY, OFFICE FOR CIVIL RIGHTS, DEPARTMENT OF HEALTH AND HUMAN SERVICES: I guess for the subcommittee members on the line, this is Stephanie Kaminsky from the Office for Civil Rights of the Department of Health and Human Services.
JAMES SCANLON, HHS: Here at Humphrey Building, this is Jim Scanlon from HHS.
LOUIS ALTARESCU, OFFICER, GENERAL COUNCIL, CIVIL RIGHTS DIVISION OF HHS: Louis Altarescu, Officer General Council, Civil Rights Division of HHS.
JOHN FANNING (ph), OFFICE OF THE ASSISTANT SECRETARY FOR PLANNING AND EVALUATION, HHS: John Fanning (ph), Office of the Assistant Secretary for Planning and Evaluation, HHS.
DEBBIE JACKSON (ph), STAFF, NCVHS: Debbie Jackson (ph), NCVHS staff.
JIM HART, HHS: Jim Hart (ph), HHS (INAUDIBLE)
JENNY HARWELL (ph), HHS: Jenny Harwell (ph) HHS (INAUDIBLE)
MCANDREW (ph): Sue McAndrew (ph), OCR.
SUZANNE (ph): Suzanne (ph) for the HHS people.
ROTHSTEIN: OK. Thank you and now if anyone would like to identify themselves, who is not a federal employee or member of the committee.
JIM HOLLANDER, VANDERBILT UNIVERSITY MEDICAL CENTER: This is Jim Hollander (ph) with Vanderbilt University Medical Center in Nashville, Tennessee.
ROTHSTEIN: Welcome.
ELIZA KEENA (ph), ASSOCIATION FOR HEALTH CARE PHILANTHROPY: This is Eliza Keena (ph) with the Association for Healthcare Philanthropy in Falls Church, Virginia.
NANCY GREGOVICH (ph), CALIFORNIA PACIFIC MEDICAL CENTER FOUNDATION: This is Nancy Gregovich (ph) from the California Pacific Medical Center Foundation.
ROTHSTEIN: Welcome.
KAREN GLYCORN HARRIS (ph), MISSOURI MEDICARE PART B: This is Karen Glycorn Harris (ph) with Missouri Medicare, Part B.
PATTIE HOFFMAN (ph), AMERICAN HOME PATIENT: This is Pattie Hoffman (ph) and Terri (INAUDIBLE) with American Home Patient in Brentwood, Tennessee.
ROTHSTEIN: Anyone else? OK. Well, thank you and welcome to all our listeners. I think all the members of the subcommittee should have before them a copy of the proposed agenda that was distributed and there are two sections to the agenda, the first one being the five items that were specifically included in the three letters that we sent to the secretary beginning October 1st of last year, and the second other issues that we may want to discuss, I want to mention to everyone that this is going to be a too brief call. We have to end at 3 p.m. and therefore, there will be no opportunity for public comments regarding the NPRM, and on behalf of the department, I would urge that you submit any comments that you have directly to them in accordance with the notice. Before we get started on the substance, I want to talk a bit about the timetable for submitting our comments because this comes out of the executive committee conference call that we held yesterday and it's – let me go through a proposal and see what the members of the subcommittee say. If we – assuming that we reach some closure and I think we have to on at least five main issues today, it would be my plan to have a draft letter sent to you by (INAUDIBLE) by Monday April 15th, and then you would have, depending on how much time you need, I don't know people's travel schedules are in the next couple of days, it would be my hope that we could have the comments in perhaps two or three days at the most with a revisions completed by the – by the 19th of April, and then a full – a conference call of the full committee some time during the first three days of April 20 – the week of April 22nd, you know, the 22nd, 23rd, or 24th and those – the availability list is being circulated now by (INAUDIBLE) and as a result of the full committee conference call, then we would only basically have – have a day or so according to my schedule (INAUDIBLE) till Thursday April 25th, close of business, to complete any revisions that the full committee wanted us to make and get the draft letter back to the department. How does that sound to the members of the subcommittees? Is that feasible?
HARDING: It's tight, but it’s the reality.
ROTHSTEIN: Well, yeah, it really is tight, but I don't – I don't know…
HARDING: No.
ROTHSTEIN: We have any other alternatives.
HARDING: That's right, it's reality, let's – let's do it.
ROTHSTEIN: Is that acceptable to you Jeff , and Simon and Kepa (ph) as well?
UNIDENTIFIED PARTICIPANT: Yeah, it's tight, but ...
UNIDENTIFIED PARTICIPANT: Yes.
UNIDENTIFIED PARTICIPANT: That's it.
ROTHSTEIN: OK. Well, thank you. Let's then talk about the substance. Would the members of the subcommittee agree to the suggestion that I had distributed and that is that we should first focus on the five issues that we specifically commented on earlier to the secretary on. Does that make sense?
BLAIR: This is Jeff, I concur.
ROTHSTEIN: OK. And two of them, of course, I think consent and marketing are likely to take up a great deal of the time because they have most of the changes or the major changes from the prior rule. Let me also ask you, I hope you have it in front of you, to take a look at the October 1 letter that we sent to Secretary Thompson and what I think might be easier for us to do at some point is just to follow on with the things that we included in our recommendation for each of these five areas. However, with the consent issue, one of the things that I would like to propose that we do initially is to talk about the very significant change that was made from the final role to this NPRM and that is the change from requiring consent for treatment payment health care operations to simply requiring that notice be provided to individuals, and I think even though we didn't – did not specifically include something like that, we did not take up that issue per se in our letter dealing with consent, I think we would be remise not to comment on it. And with the I will say consent or the agreement of the subcommittee, I'd like to open the floor to discussion of what might be said with regard to the change that was made.
HARDING: Well, I'll start. This is Richard.
ROTHSTEIN: Thank you.
HARDING: May be – may be the staff could help a little bit. Was it the intent to switch back to the statutory consent or regulatory consent or whatever you want to call it. Was that – that was just an issue of feeling that – that would reduce the burden on providers and the entities, I mean was that the main impetus to switch back?
MIKE (ph): This is Mike (ph) and I’ll take a stab at it.
HARDING: OK.
MIKE (ph): I think the impetus was to make sure that the privacy rule didn't get between the doctor and the patient when it came to exchanging information that would benefit the quality of care for the patient or would benefit the efficiency with which the system operated.
UNIDENTIFIED PARTICIPANT: Well, and from the – from the explanation that was published, I think there was the assertion that it would – it would be a burdensome formality.
MIKE (ph): Right. It's still burdensome. I don't see that the burden has been reduced much at all. But it does mean that pharmacist can do their business and the hospitals can do their business in terms of contacting patients or billing for services without seeing the patient when necessary to make sure they get the right drug or get admitted at the right time. But the provider still has to present to the patient, here is my privacy rule practices – my notice of privacy practices' and get the patient's signature. And that will still lead to discussion about privacy practices where or not there is a consent form, we still have to find something or if the patient refuses to sign, make a notation in the record, for example.
UNIDENTIFIED PARTICIPANT: Yeah, Mike (ph), but the – the timing has changed, before they would require to get the consent before they could do anything, and now they have some leeway to present the notice of practices at the first available opportunity, although by then they may have already rendered certain services or they've an appointment schedule in order to (INAUDIBLE).
MIKE (ph): That's right. But I don't – I don't see that it changes the burden. I see that it does permit some necessary practices to go on that are beneficial to the health and that reduces the – the burden for pharmacists and for hospitals, but in terms of the provider, he needs to get that from the patient, he still have to get that from – the patient, he still has to get the signature back or make a notation on the record.
MARK ROTHSTEIN, CHAIRMAN, PRIVACY & CONFIDENTIALITY SUBCOMMITTEE: So – this is Mark. Mike, I'm not that clear where you're going down on it. Are you saying that this is a valuable change?
MIKE (ph): Well, I guess – personally, I – the original notice of proposal making said no consent, the privacy rule said did consent, now the notice – the current notice says no consent, I can go either way because I think it is understood what the obligations are, whether or not the patient signs the consent form or not. I'm comfortable with – without having the patient sign the consent form.
UNIDENTIFIED PARTICIPANT: Could I add a point of clarification Mr. Louis Altarescu.
LOUIS ALTARESCU, OFFICER, GENERAL COUNCIL, CIVIL RIGHTS DIVISION OF HHS: Please.
UNIDENTIFIED PARTICIPANT: The proposed rule said no consent in terms of, consent was not permitted. The proposal now is a middle rule between the proposed and the final rule, in that consent is voluntary that – it would not prohibit a provider from getting consent in order to use information or a treatment payment or operation.
UNIDENTIFIED PARTICIPANT: Louis is exactly right.
UNIDENTIFIED PARTICIPANT: Well, in terms of the burden on the physician, if there is a referral to a specialist, the specialist would be able to look at those records without having to get the prior consent. So, there would be that reduction of a burden for the provider.
ROTHSTEIN: Or, I don't know if burden is the right word or practical obstacle in certain treatment situations. So, there still is a burden of getting the, you know, privacy notice be signed, you know, (INAUDIBLE).
UNIDENTIFIED PARTICIPANT: That would be done at the first delivery – first opportunity for delivery of services as opposed to when he is actually reading the files.
RICHARD HARDING, MEMBER, PRIVACY AND CONFIDENTIALITY SUBCOMMITTEE, PRESIDENT, AMERICAN PSYCHIATRIC ASSOCIATION: This is Richard. You know, I – I'm trying to understand and, you know, I think you all know that I kind of think consent is important, but what I'm trying to figure out is that if this becomes the final rule, what it makes me think about is the definition of health care operations, and that – if I had thought this was going to be the rule, then health care operations in my mind should be narrowly defined, as opposed to more openly defined, as we kind of did, that would be, I mean, just for protection sake, because we have a pretty broad health care operations definition throughout the – the rule.
ROTHSTEIN: This is Mark, just to get us moving along again, I've drafted a sort of sample paragraph that sets out a possible physician for the sub-committee and with your indulgence, let me read it to you keeping in mind that both the substance and the wording are obviously subject to change, but I think it's important for the committee to comment on this rather important change, and so here's what I would just put on the table. Consent for disclosures of PHI, for TPO which seems to further patient's interest in privacy and autonomy. In practice however, it might simply be another piece of paper for a patient to sign without much thought or discussion with the health care provider. Signing the consent form can merely be made a condition for obtaining treatment. The NPRM asserts, hang on a minute, written so many things here. I'm sorry. That the notice requirement fulfills the same purpose as a consent form by notifying individuals about how their records may be used and permitting individuals to forego treatment if they do not want their PHI to be used for these purposes. Effective privacy protections for PHI are much more likely to result from substantive government-imposed regulation of the disclosure of PHI. Then from patient-imposed limits on the use of PHI as a consequence of signing a consent form. Removal of the consent requirement, however, must be accompanied by measures to restrict the disclosure of PHI and TPO to essential uses.
UNIDENTIFIED PARTICIPANT: Mark?
ROTHSTEIN: Yeah.
UNIDENTIFIED PARTICIPANT: I know that had all sounded pretty good, I don't know exactly what it means, in terms of – is there a recommendation that ...
ROTHSTEIN: Well, what I – what I'm trying to say is in this paragraph is that the committee accepts the revision and this is why we accept the revision because, as you know, this is probably the most controversial of the changes.
UNIDENTIFIED PARTICIPANT: OK.
ROTHSTEIN: And that, but we want to be clear that you just can't – change this consent to notice without also being very careful about what kinds of disclosures can be made without consent.
UNIDENTIFIED PARTICIPANT: OK. I guess that – there's going to be another paragraph coming on here at some point.
ROTHSTEIN: Well the – I suppose we can write another paragraph saying that – saying more or less what I just said.
ROTHSTEIN: Well, No I just – I was just sort of listening to what you are saying and I – and I obviously, I think – sharing a high level of your concerns, I just don't know that if I were the – HHS I would know what to do with a – I mean, I think what you are doing is supporting with – what HHS has done which – I just don't know if you're suggesting other changes need to be made and I couldn't tell that.
ROTHSTEIN: Well, I think, what I'm – what I'm attempting to do is set the stage for some of the other things that we haven't considered yet. There are some things that I think need to be changed in the rule that others of you may agree or disagree with, but you may well have other things as well, but what I am saying is that I think there are places that the rule needs to be tightened up a little bit.
UNIDENTIFIED PARTICIPANT: OK. So, Mark, do you have a draft letter that you just haven't shared with the committee, that you're ...
ROTHSTEIN: No, I don't. I – this is the only paragraph that I drafted.
HARDING: OK. Obviously, because if you had I was going to say e-mail it out to us, so we can read along with you.
ROTHSTEIN: Because this is the only one where I felt like I needed to put on paper what I – what I felt like I needed to say. The others are – many of them are expressed in our letters.
HARDING: Well let's – I guess my, you know, my view on this one is sort of, I mean, possible support of this, but of course not knowing where exactly we are going with that last sentence.
ROTHSTEIN: I'll take that as a qualified ...
HARDING: Qualified, yes.
ROTHSTEIN: Yes, and I suppose what we need to do now is to call the other members of the committee to see if there are people on the sub-committee who feel strongly that we should object to the change.
JEFFREY BLAIR, MEMBER, PRIVACY & CONFIDENTIALITY SUBCOMMITTEE: This is Jeff . My part, I would suggest, that you revise the way you've written that paragraph where the first thing you do is to state the agreement in the balance that has been struck in the proposed change to the consent rule. So that is the first thing we say ...
ROTHSTEIN: OK.
UNIDENTIFIED PARTICIPANT: Is that we are in agreement with the new proposal for consent. The second thing is, I think we should say what you articulated to Simon, just a moment ago is that beyond stating opposition of agreement, there's certain conceptual thoughts that we have, that we want to set forth because those are going to be the foundation for some additional positions that we will be taking. Because I think that's why you wanted that paragraph as a foundation for other comments. Is that correct?
ROTHSTEIN ROTHSTEIN, CHAIRMAN, PRIVACY & CONFIDENTIALITY SUBCOMMITTEE: That's part, well that's certainly – my thought was the very end of it, but I think it's important that we not just go on the record as saying, we support the revision, but saying why we do so. Because this may well be, you know, one of the provisions that is under particular attack. Speaking just for myself, I think, the notion of having people sign a consent form is going to make things great, is really unrealistic, and the way we're going to protect privacy is through substantive limitations on what Healthcare entities can do with the information, and I also believe that certain notices need to be provided to individuals, and we are going to talk about all those things I hope, on this call in the last hour.
UNIDENTIFIED PARTICIPANT: OK.
STEPHANIE KAMINSKY, OFFICER FOR CIVIL RIGHTS, DEPARTMENT OF HEALTH AND HUMAN SERVICES: This is Stephanie Kaminsky and I just wanted to ask, Richard, you had earlier said that you thought that the Healthcare (INAUDIBLE) was the part of the removal of the consents that you were the most, sort of, troubled by and I'm wondering if there are particular activities that are part of the definition of Healthcare operations that really make you cringe.
RICHARD HARDING, MEMBER, PRIVACY AND CONFIDENTIALITY SUBCOMMITTEE, PRESIDENT, AMERICAN PSYCHIATRIC ASSOCIATION: Well, I don't have all the things listed in front of me, but there are many activities that even start getting down into the areas of case management and all those kinds of things that I was kind of willing to go along as long as people consented to that, they knew what they were getting into, but it doesn't seem like with this. They know what they are getting into and that it's more up to the law to narrow the things that they can do that could use their information because people themselves won't have as much knowledge of that in the regulatory consent.
MIKE (ph): Richard, this is Mike. I think even before when you signed a consent, that you still had to refer to the privacy notice to find out just how the physician was going to handle your protected health information.
HARDING: Right, or talk to them, you know.
MIKE (ph): And so, this doesn't change that. What it does change, I think, here you are expressing in your mind is that, without signing the consent the patient may not realize the importance of just acknowledging the privacy practices that there is no official yes, I condone it. They might feel that they have any right to negotiate that.
KEPA (ph), MEMBER, COMMITTEE AND SUBCOMMITTEE: I think that another big problem is that and then, first of all let me say – this is Kepa – let me say that I agree with this removal requirement for consent, and it is much cleaner and easier, but a problem that is introduced is that the patient no longer has the ability to present consent, whereas before the patient could say I did get a consent. But if it gets to a point where I don't want my (INAUDIBLE) information to be used any more, I can (INAUDIBLE) that and then you'll have to stop using it. That's all. And that was very burdensome for the providers. (INAUDIBLE) of the consent and the burden in that sense has been greatly relieved, but there is – there has been one ultimately that has to do this (INAUDIBLE).
JIM (ph): Mark, this is Jim. The only other parenthetical remark I would make is that I think the – a lot of the changes reflected in the proposed rule kind of responded directly to the NCVHS recommendations on October 1st.
ROTHSTEIN: Yes, I think that's right.
JIM (ph): And you might want to acknowledge that and then come into your other recommendations.
ROTHSTEIN: Thank you. That's a good point. We, speaking for myself, we certainly appreciate the care with which OCR and HHS reviewed our recommendations and the – and their acknowledgment throughout the NPRM of our – of our hearings and our influences. So I certainly will, you know, call that to the secretary's attention in my draft letter. So hearing no objections, I will try to work into a draft letter this – some of these general sentiments that were – that were mentioned by the sub committee members as well as its paragraph and we'll see what it looks like. If you would take a look at the letter, the October 1 letter under consent, we have a variety of specific things that we called to the secretary's attention and in fact seven of them. And those seven, if you don't have the letter in front of you, deal with emergency access such as SPA disclosure, continuing use of information obtained before HIPAA, initial contacts and first encounters, revocation of consent – consent by minors, disclosure for accreditation and Healthcare quality purposes and involuntary commitment. And it seems to me that virtually all of these are affected by the general change in approach and there are some other specific issues that the NPRM specifically requested comment on such as the SPA disclosure, and what's the disclosure, we have the am I missing any others. Stephanie have I missed any?
KAMINSKY: I got to get my list ...
ROTHSTEIN: (INAUDIBLE).
KAMINSKY: I'll let you know in a second.
ROTHSTEIN: OK. But I think that was the one, at least the one that was where new comments were solicited.
KAMINSKY: Sir, from that list, yes. I think that's the only one.
ROTHSTEIN: Now I suppose.
UNIDENTIFIED PARTICIPANT: What's going on?
UNIDENTIFIED PARTICIPANT: I don't know.
UNIDENTIFIED PARTICIPANT: On the first list of seven items, it seems like the proposed modification dealing with consent addresses, I think all of them except number six, and that's addressed under the issue of the persons (INAUDIBLE) ...
UNIDENTIFIED PARTICIPANT: Right.
UNIDENTIFIED PARTICIPANT: In terms of the (INAUDIBLE) information.
UNIDENTIFIED PARTICIPANT: OK. Well, thank you. Let me open the floor to the sub committee members who want to, are we still on?
UNIDENTIFIED PARTICIPANT: Yeah.
UNIDENTIFIED PARTICIPANT: Yes.
UNIDENTIFIED PARTICIPANT: I think there is some paper shuffling going on right by the microphone.
UNIDENTIFIED PARTICIPANT: Who want to make specific recommendations or comments about any one of these seven, this – seven or eight additional issues dealing – or seven issues through involuntary commitment in our initial letter. While you are thinking about that I will present one that I have. If you can turn to page 14,784 ...
UNIDENTIFIED PARTICIPANT: I had my finger right on that page.
UNIDENTIFIED PARTICIPANT: I have a paper clip there.
ROTHSTEIN: OK, this deals with the issue that we addressed earlier in initial contacts, and it deals with the issue of when notice must be provided and the NPRM says that notice must be provided at "first service delivery." And I would like to propose that we consider change – recommending a change in that to be "at first contact" and the reason that I suggest that is that if an individual goes to a, let's say a hospital, to pick up their medical records that were generated before HIPAA and to give those records to, you know, a new physician, that would not be a service delivery, but it would be a first contact with the individual and I think at that point the individual should be, on picking up the records should – should be presented with a notice and told what will be done with those records or other records, you know, these may be only copied and so the originals would still be in the file.
UNIDENTIFIED PARTICIPANT: Mark what that would mean is that you're using the contact with the hospital ...
ROTHSTEIN: OK…
UNIDENTIFIED PARTICIPANT: Information. But it would also mean that contact with any other provider for any other reason would be a place where we can get the information – (INAUDIBLE) signature and it would also mean that every time, at least for the first couple of years, every time any patient has any contact with any physician, somebody will have to review the patient's medical record to find out if they previously have signed the information practices (INAUDIBLE) ...
UNIDENTIFIED PARTICIPANT: Or get them to sign a new one?
UNIDENTIFIED PARTICIPANT: Or get them to sign a new one – and it would be just every single contact, you would have to go through this process, you wouldn't know whether it is first or not – whether if it is their first service. You are going to pull the records – make the records for that first service or for any service, so I think the burden would be much less.
COHN: Yeah, this is Simon I guess that in turn, I guess I would also echo some concern that depending on how it was interpreted, what you were suggesting. It might also begin to get involved with this issue of people making appointments which is a contact, but not a service delivery and things that we'd already been complaining about in our letter that we wanted to sort of make sure that people were not prevented from making appointments prior to signing a consent.
ROTHSTEIN: Simon that is a good point and – and certainly you could make that very easily for his personal – in-person contact or some thing like that, but before we talk about whether language changes would clean up your concerns, let me ask the members of the sub committee whether you think that the issue that I raised is of sufficient concern that we are to look into making some changes.
COHN: Mark, what is the change that you propose again. I forgot.
ROTHSTEIN: Well, the way it's currently raised is that the notice must be given at first service delivery and I am suggesting that we might want to consider that the notice be given at the first in-person contact because there're many situations in which individuals who have generated pre-HIPAA medical records may not have any service delivery rendered in the future and yet if we think that notice is valuable to apprise people of their statutory rights, when they come in to talk about their bills or they come in to obtain copies of their records or films or what have you, it seems to me that they should be given a copy of the notice.
COHN: OK. I see your point now.
BLAIR: This is Jeff. Could I suggest a possible compromise because I think my first reaction was to say let's leave it the way it is with service delivery, but what if we were to say, the first contact or the first opportunity in preparation for service delivery. So, it’s not just any time somebody walks in to deal with past billing records or anything else like that, but it is still tied to service delivery, but it is the first personal contact in preparation or preliminary to service delivery.
ROTHSTEIN: Jeff, this is Mark, what would be the advantage of your amendment over the status quo?
BLAIR: The status quo just simply says ...
ROTHSTEIN: For service delivery, but I mean how – how is the – how is the "compromise deal" advancing the – sort of the information process, that is what I'm saying.
BLAIR: Well, I thought it was reaching out to address your concern a little bit that the issue of a patient being informed of their proxy protection rights wouldn't wait until the last minute immediately before service is delivered, but it would be at the first opportunity in preparation for service delivery that the rights would be shared with the patient.
KEPA (ph): I think it is just way too (INAUDIBLE) every single opportunity, every single contact is going to require reviewing the medical records for the patient to see if the signature was obtained in that. I think that if he is going back to refer (INAUDIBLE) obtain the signature in the first place, maybe just wait for service.
BLAIR: So we should leave it the way it is?
KEPA (ph): I think the way it is fine. We may want to put some or give the (INAUDIBLE) some encouraging words to say that providers should be encouraged to get this in order to contact, there are non service contact, but it should be just encouraged (INAUDIBLE) required.
ROTHSTEIN: Kepa (ph), I'm curious as to why you think this is – this proposal is so burdensome. I – basically what I'm suggesting is that, for records generated pre-HIPAA, that at some point, somebody would say, have you received the privacy notice, and there would be a big stack of them, and I would think you would – you would – we would want to encourage people to have several of them. An (INAUDIBLE) on the side of giving people more stock than not giving that out at all.
KEPA (ph): Well, I think that we're saying the same thing. So, it is the intent is for the provider to say have you received the privacy notice and here is the copy and you – if you haven't signed this before, go ahead and sign it.
ROTHSTEIN: Right.
KEPA (ph): That is – I'm not saying (INAUDIBLE) have the privacy notice signed. I think that if you put it as a requirement, then the provider would have to actually verify whether there is one or not in the file.
ROTHSTEIN: Now because the rule as it reads now only says you have to have – make reasonable efforts and I certainly would support language that would put say reasonable efforts to supply the privacy notice.
KEPA (ph): I think it is reasonable effort to obtain the signature ...
ROTHSTEIN: Correct.
KEPA (ph): I don't know, I feel, let me think about it, if you want.
UNIDENTIFIED PARTICIPANT: Yeah, Kepa, I guess I'll sort of jump in here today. I sort of agree with you. I guess – I guess I'm just concerned about a number of things, I mean, I'm trying to think of all the unintended consequences of this particular proposal which Kepa (ph) has addressed a little bit. I'm also a little concerned with the whole conference call they wind up being the discussion on this particular point.
ROTHSTEIN: OK.
UNIDENTIFIED PARTICIPANT: Seems to me to be sort of a small point, and maybe I'm off on that one, but I did look at the agenda and it seems like there's a whole bunch of issues we have to discuss.
ROTHSTEIN: How right you are Simon. And unless someone else wants to support this, I will consider that it is – that it has died a death from lack of interest.
UNIDENTIFIED PARTICIPANT: Amen.
ROTHSTEIN: OK.
UNIDENTIFIED PARTICIPANT: Thank you for your forbearance. You're so blunt, Mark.
ROTHSTEIN: And I'm already dead for lack of interest. OK. Does anyone have any particular other proposals dealing with the issue of consent? OK. We may want to mention in our discussion that many of our issues were dealt with by the change in the language. Now, we move to minimum necessary. And you'll see, for those of you who have this memorized, that on page 14,787, the department specifically adopted our recommendations with regard to minimum necessary.
UNIDENTIFIED PARTICIPANT: What page the reference was again? Sorry, Mark
ROTHSTEIN: 14,787. And well, I'll just read it you for those of you who don't have it handy. In addition, the NCVHS recommended that the department provide education to address the increasing concerns about liability and defensive information, et cetera. The NCVHS generally recommended the department issue advisory opinions, publish best practices and make available model policies, procedures and forms to assist in the alleviating the cost and administrative burden that will be incurred when developing policies and procedures as required by the minimum necessary provision. The department agrees with the NCVHS about the need for further guidance on the minimum necessary standard and intends to issue further. Let's see, issue further guidance to clarify issues causing confusion and concern in the industry as well as provide additional technical assistance materials to help covered entities implement the provisions. So, if you'll see in our letter, the only (INAUDIBLE) what is minimum necessary, we asked for additional clarifications, suggested that defensive practices were a concern and called for opinions, advisory opinions, best practices et cetera., all of which are included in that paragraph that I read. Is there anything in the area of minimum necessary that subcommittee members think should be discussed in our newest letter? OK. Hearing none, I apologize that's the siren outside my window. We'll move now to the November 21st letter to secretary Thompson (ph) in which we deal with the issue of research.
KEPA (ph): Mark, wait a minute. On the minimum necessary, are we including in here the de-identification?
ROTHSTEIN: No. The de-identification, that comes up under research.
KEPA (ph): Research, yeah.
ROTHSTEIN: So, if you see the research letter. If you can look at that, that's the November 21st letter, and there are six aspects of research. The first one that we dealt with in our letter was the relationship with the common rule, and on page 14,794, the NPRM agreed with our recommendation on this point of the need to provide additional guidance and clarification, that's page 14,794.
UNIDENTIFIED PARTICIPANT: Could I just ask a question? Is that letter on the website?
ROTHSTEIN: Yes, it is.
UNIDENTIFIED PARTICIPANT: Yes.
UNIDENTIFIED PARTICIPANT: On the NCVHS website.
ROTHSTEIN: All three letters are on the website.
UNIDENTIFIED PARTICIPANT: OK. I am looking to – letter on marketing and fundraising (INAUDIBLE) MRI HIPAA.
UNIDENTIFIED PARTICIPANT: May be go to the privacy and subcommittee part?
UNIDENTIFIED PARTICIPANT: OK.
UNIDENTIFIED PARTICIPANT: End of report. (INAUDIBLE)
UNIDENTIFIED PARTICIPANT: You can go ahead. I didn't mean to interrupt anything.
UNIDENTIFIED PARTICIPANT: OK.
UNIDENTIFIED PARTICIPANT: I just couldn't find the letter.
ROTHSTEIN: OK. It should – it should be available here.
UNIDENTIFIED PARTICIPANT: Yes, the reports and recommendations button on the main entry website, I think that at the upper left.
UNIDENTIFIED PARTICIPANT: OK.
UNIDENTIFIED PARTICIPANT: Would you like the address?
UNIDENTIFIED PARTICIPANT: I've got it here, it's ncvhs.hhs.gov
UNIDENTIFIED PARTICIPANT: /011121lp.htm.
UNIDENTIFIED PARTICIPANT: OK.
ROTHSTEIN: So, was it your consent, I want to just run through very quickly, my view of the research provisions of our letter, maybe this will help, get us moving, and my view of what was done in the NPRM on each of them, and certainly Louis or Sue or somebody, if I have misdated, please jump in.
On the first point, the relationship with the common law as I suggested earlier, the NPRM agreed with recommendations to provide additional guidance and clarification on that relationship. On the second issue, consent versus authorization, it agreed with us that authorization or IRB approval is necessary as the members of the subcommittee may recall that there was a proposal that research should be included within treatment payment, operations and research, and we oppose that as did the department. The third issue was on de-identified information and the committee recommended reconsideration of this issue, and on page 14,794, in the NPRM comments were specifically solicited on the de-identification issue. As you all recall, we were concerned that the stringent requirements for de-identification might actually interfere with research. On number four, recruiting research subjects, we requested as a committee, additional guidance. The NPRM made – did not specifically address that issue although acknowledging our concerns, the NPRM said, however, that the rule would now permit authorization for research in a database with an unspecified time limit, and that appears on page 14,796. Number five, accounting for disclosures, the committee in its letter supported accounting, but asked for further guidance. In the NPRM, HHS proposed to withdraw the accounting requirement for disclosures pursuant to an authorization under the theory that the authorization would already provide the individual with knowledge about how the information was to be used, and number six on education, the committee called for more education on the issue of research and the NPRM acknowledged that in the text, but did not specifically indicate that education on research would occur, although throughout the NPRM, more education and outreach was indicated as one of the goals of the department. So, I hope that fairly summarizes both what we recommended in our November 21 letter and what the NPRM would do on each of those points.
UNIDENTIFIED PARTICIPANT: I just, I think that on the recruiting of research subjects, I'm trying to find it, maybe Louis or Sue can help me out, but there was a slight change proposed, but maybe I am misunderstanding what we've done here, slightly different than what you said, Mark.
ROTHSTEIN: OK.
UNIDENTIFIED PARTICIPANT: So, Louis, am I understanding the research piece well enough?
UNIDENTIFIED PARTICIPANT: Well, we did simplify the waiver criteria if that's what you might be thinking of.
UNIDENTIFIED PARTICIPANT: No. I'm talking about recruiting research subjects. Yes, that's what I guess that is, that you don't need a waiver authorization, I thought that there was some sort of lightening up there. I'll try to find what I'm looking for, sorry.
UNIDENTIFIED PARTICIPANT: Mark, I'm actually delighted obviously to see that we have, I think our recommendations have found a way into the NPRM. I just have one question that may be almost an issue of confusion regarding to the changes in the disclosure piece and how that all applies because I'm seeing you're going, you know, if you had somebody sign a disclosure, you don't have to pack it any more for research purposes, but now, am I to understand right that if you actually have an IRB waiver, then you do have to track the disclosure for research?
UNIDENTIFIED PARTICIPANT: Right you have to be able to provide an accounting of disclosures that you make for research purposes.
UNIDENTIFIED PARTICIPANT: I see, when they – when they haven't been signed as part of the disclosure.
UNIDENTIFIED PARTICIPANT: Or authorization.
UNIDENTIFIED PARTICIPANT: When the individual didn't sign in authorization, the (INAUDIBLE) being that if somebody signed an authorization telling you that they would like you to disclose information, they've already given – received notice that such a disclosure will be made. So, it didn't seem like this, significant benefit in requiring an accounting of the disclosure that the individual already specifically authorized.
UNIDENTIFIED PARTICIPANT: Well, I would ...
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) a research disclosure.
ROTHSTEIN: This is Mark again. I would like to propose an alternative view of that. I believe personally that it was a bad idea for the NPRM to withdraw the accounting requirement for any authorization based disclosure. I think if you're going to retain accountability and the accounting requirement, it should apply to all disclosures and the reason I say that is that there is no time limit now required for these disclosures, and people conceivably may be authorizing many disclosures, and to assume that just because he signed a piece of paper in 1995, you will know all the – all the particulars about what your information is being used for, I think it's just not realistic, and so personally, I would propose that we recommend that a change be made and that accounting for disclosures not be, there will not be an exception for disclosures pursuant to an authorization.
UNIDENTIFIED PARTICIPANT: ROTHSTEIN, are you referring to that in all cases of disclosures?
ROTHSTEIN: Yes.
UNIDENTIFIED PARTICIPANT: Authorization?
ROTHSTEIN: Yes.
UNIDENTIFIED PARTICIPANT: You mean so basically if I sign – so, basically if I know that I am sending something off to another insurance company or otherwise, you have to keep that around?
ROTHSTEIN: If you ...
UNIDENTIFIED PARTICIPANT: If it's further than treatment (INAUDIBLE) health operations.
UNIDENTIFIED PARTICIPANT: Yeah, – but then, I guess a new – I can't understand whether you're referring specifically to the research issue.
ROTHSTEIN: Yes.
UNIDENTIFIED PARTICIPANT: Which I – or are you referring to the – to the broader issue of all disclosures that you may get signed for which ...
ROTHSTEIN: I'm referring to the – I'm very concerned about the marketing issue which we're going get to shortly. I would be willing to limit the requirement to research and marketing and accept the other kinds of authorizations, but I feel very strongly about those two areas.
UNIDENTIFIED PARTICIPANT: But would you say, just to follow up on this one a little bit. Do you think that the issue here is the open-endedness versus (INAUDIBLE) of the use? And then really what we we're talking about is, if you're really giving an open-ended authorization for disclosure at that point, maybe it does need to be tracked, but if you're really giving a specific authorization for a time limited basis for a specific purpose, maybe it doesn't really need to?
ROTHSTEIN: Well, if we see if we put a time limit on authorizations, that will be much more comfortable, but assuming that there is no such thing ...
UNIDENTIFIED PARTICIPANT: Somebody just put us on hold.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE)
UNIDENTIFIED PARTICIPANT: That music.
ROTHSTEIN: Yeah, well ...
UNIDENTIFIED PARTICIPANT: Hi, Mark.
ROTHSTEIN: Yes.
UNIDENTIFIED PARTICIPANT: This is (INAUDIBLE) I just want make sure that in session, it's clear that the relaxation on the expiration date for the authorization is solely limited to where the entity is maintaining some sort of research database.
ROTHSTEIN: Right.
UNIDENTIFIED PARTICIPANT: It's not research in general and it certainly isn't marketing.
ROTHSTEIN: But ...
UNIDENTIFIED PARTICIPANT: Except that one instance.
ROTHSTEIN: Well, not in this – not under this area, but in, I want to talk about marketing later. So, maybe I'll just hold this point and wait till you get to the marketing. How's that?
UNIDENTIFIED PARTICIPANT: Yes.
ROTHSTEIN: Any other research issues? OK. Let's turn out to our March 1st letter, and I hope you all have a copy of that, and that deals with the issue of marketing and fundraising. And on the marketing issue, this was a bigger change from the final role which considered, well, everybody knows what the final role is. And now, marketing does require in general, the signing of an authorization. So, our seven specific recommendations, you’ll be dealing with marketing I think are somewhat tossed up in the air by this – by this basic change of course. The department also solicited comments in which commenters are asked to identify specific types of communication that should or should not be considered marketing. Let me open the floor to the committee members to ask for comments about the change, and we debated this, of course, in subcommittee as well as committee from the presumption that it's covered under the consent to now the presumption that you need an authorization. Any comments? OK. I've got a bunch of them. Well, you know you keep swinging, you're going to hit something or someone. OK. The first thing I want to talk about is the definition.
UNIDENTIFIED PARTICIPANT: All right.
ROTHSTEIN: And let me call your attention to page in the definition area, it's obviously – it's 164.501. I'm looking for the type of register or page number.
LOUIS: 14,811.
ROTHSTEIN: Thank you, Louis. It's, you see the definition that is included in the proposal that says marketing means to make a communication about a product or service to encourage recipients of the communication to purchase or use the product or service. I would propose a change and I'll explain it in a minute to put a period after the first service. So, the definition I'm proposing would be marketing means to make a communication about a product or service. By including the rest of that of the sentence in there, I know we wanted to get or the department wanted to get away from the issue of intent, but I still think that to encourage recipients of the communication to purchase or use the product or service, you could have a situation where the purpose is to get the recipient to get somewhere else to purchase a product or to use a service or it's and I've seen a variety of ways in which that language has been construed, one commenter who sent me a copy of his comments said that you could have a non-solicitation – solicitation in which you had a disclaimer that this communication informing you about, you know, massage mattresses is not intended to be a communication about a product or service that only of educational nature. So, I think we would – we could capture the same intent by just putting a period after the word service.
UNIDENTIFIED PARTICIPANT: Boy, I guess I'm lost on that one because I think if you put a period after the word service, then you – then you open things up to be abused that you just described.
ROTHSTEIN: No, we would – we would include that, we would say marketing means to make a communication about a product or service, and at that point, because it is marketing, you would need an authorization. I think it's a – it's a broader definition.
UNIDENTIFIED PARTICIPANT: Well, does it distinguish it from anything else, though?
ROTHSTEIN: Well, the question is that it – that if I'm making it broader, do we scoop up things that we don't want to scoop up, right?
UNIDENTIFIED PARTICIPANT: Yes.
ROTHSTEIN: (INAUDIBLE) Mike.
UNIDENTIFIED PARTICIPANT: That's right.
UNIDENTIFIED PARTICIPANT: Actually, I feel like, when you narrow that, you wound up – what you wanted to do was exclude education – phrasing things as education as a vehicle to really try to encourage somebody to purchase.
ROTHSTEIN: Or to encourage somebody to encourage somebody else to purchase.
UNIDENTIFIED PARTICIPANT: Right. But now, you've made – you've made the definition so narrow that basically it could be equivalent to and include education, and there is valid education that then would fall under marketing when you make it so narrow.
ROTHSTEIN: No – well then of course, the next sentence says marketing exclusive communication made to an individual and it lists three things; to describe the entities participating in the Healthcare provider network or Healthplan network. It describes the network, a product or services or payment for such product or services that are provided by a covered entity, for treatment of that individual or for case management or care coordination for that individual or to direct or recommend alternative treatment therapy, Healthcare providers with settings of care to that individual. So I think – I think education, legitimate education, is specifically excluded.
UNIDENTIFIED PARTICIPANT: OK. I could buy that.
ROTHSTEIN: I don't know what to say. I'm getting some support for this.
UNIDENTIFIED PARTICIPANT: Unaccustomed physician.
ROTHSTEIN: Yes. All right. Well ...
UNIDENTIFIED PARTICIPANT: I think we need to see this – I need to see this in writing.
ROTHSTEIN: OK.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE) I get a little confused as we're talking about it.
ROTHSTEIN: All right, let me move right on to the next one as long as I'm on a roll here.
UNIDENTIFIED PARTICIPANT: If I can say something, what's always helpful in any comments like this, is not so much what words you would add on or take off, but your rationale about what you're trying to achieve.
ROTHSTEIN: Yes.
UNIDENTIFIED PARTICIPANT: Because then it would make us easy – make it easier for the policy makers in the department if they agree with your intent to craft the language accordingly. So, that would help prevent some of the unattended consequences if you make as much effort as possible to explain what you're trying to achieve.
ROTHSTEIN: Why, thank you for that comment because that's important. You might hate my wordings, but like the rationale and you want to come up with your own words if you buy the rationale.
UNIDENTIFIED PARTICIPANT: Well we – if the department buys the rationale, they'd want to come up with words that, do what you want to do and hopefully don't do what you don't want to do.
ROTHSTEIN: Right. Let me ask you now to turn to page 14,812, which is a proposal dealing with section 164.508. This is a review.
UNIDENTIFIED PARTICIPANT: (INAUDIBLE), page number ...
ROTHSTEIN: Sorry, I'm sorry. 14,813.
UNIDENTIFIED PARTICIPANT: My (INAUDIBLE) does not have that many pages.
ROTHSTEIN: Well, I will read what their proposal is here.
UNIDENTIFIED PARTICIPANT: That must be New Mexico.
ROTHSTEIN: At 164.508 is used as in disclosures for which an authorization is required, and particularly I want talk about A3 under marketing. Notwithstanding any other provision of this sub-part, a covered entity must obtain an authorization for any user disclosure of protected health information from marketing, except if the communication is in the form of, then we have, A, and you'll remember these, face-to-face communication made by a covered entity to an individual, or B, a promotional gift of nominal value provided by the covered entity, et cetera. And my reading of this is that it would permit business associates to engage in face-to-face solicitation of individuals.
UNIDENTIFIED PARTICIPANT: On behalf of the covered entity or on behalf of the third party?
ROTHSTEIN: Without ...
UNIDENTIFIED PARTICIPANT: OK.
ROTHSTEIN: Without an authorization.
UNIDENTIFIED PARTICIPANT: I think that's right. If they're acting on behalf of the covered entity, I think you're right.
ROTHSTEIN: OK. And that's a situation that I really think is not desirable and I would propose that we permit face-to-face contact and promotional gifts only if performed by a Healthcare provider or at a Healthcare institution.
UNIDENTIFIED PARTICIPANT: Now that maybe a question for OCR is – is when they – if a business associate is making face-to-face contact, is the associate acting as the provider? Or do they not have that right?
UNIDENTIFIED PARTICIPANT: I would read this provision as covering actions of the agents of a covered entity such as a business associate.
UNIDENTIFIED PARTICIPANT: OK. Then, I think – that Mark has the right interpretation.
UNIDENTIFIED PARTICIPANT: It seems so, yes.
UNIDENTIFIED PARTICIPANT: Yeah. So, Mark your concern is to – is to limit it what the person has to be a provider?
ROTHSTEIN: Well, I – yeah because I'm afraid that the way it's currently crafted, you could have the business associates, you know, who would knock on doors without an authorization, and that would be permissible under the current reading.
SIMON COHN, MEMBER, NATIONAL COUNCIL FOR VITAL AND HEALTH STATISTICS, AND SUBCOMMITTEE ON PRIVACY AND CONFIDENTIALITY: You know, I – Mark, I'm listening to you – this is Simon Cohn. And I'm here for (INAUDIBLE) I'm not a lawyer and so I'd always think about all the things that could possibly happen. Recognizing that there are sort of, large bar-doors open in this area until now, I don't think I've received any home visits recently of anybody trying to sell me a medical device. And I'm just trying to figure out what – I guess, my bigger concern on this one is what problem exactly we're trying to solve and is there something bad going on here right now?
ROTHSTEIN: Well, there are lot of things that are in these regs that are not necessarily designed to clean up scandals. But I think it's important that if we are crafting rules of wide applicability, that we craft them the way we intend them to operate and I can't imagine that the department would have intended this result whether, you know, it's a problem now or not. And so, I think it would be relatively easy to clean up if we just add it, you know, either by a Healthcare provider or, you know, on the premises of a Healthcare provider etc.
UNIDENTIFIED PARTICIPANT: I guess, I really have no objection. I guess I'm fine with that I'd be, you know, may be we can move on?
ROTHSTEIN: OK. Richard, Jeff , Kepa (ph)?
UNIDENTIFIED PARTICIPANT: Yeah, I'm OK with it.
UNIDENTIFIED PARTICIPANT: OK.
UNIDENTIFIED PARTICIPANT: How about health plans? Will they ever do face-to-face marketing, maybe some training seminars or something in the premises where they're promoting Lipitor (ph) or something?
ROTHSTEIN: I think they would already be exempt under the definition of marketing that we read earlier under 164.501.
UNIDENTIFIED PARTICIPANT: I'm just trying to make sure that when you restrict this to Healthcare providers facility or in the presence of the health care provider that you're not excluding somebody else unintendedly.
ROTHSTEIN: Well, you're going to have an opportunity to think about this because I'm – you're going to have several chances to comment. And so, maybe you just want to think about it and see if there are any situations where you think it would hurt, you know, health care plans and networks etc. But I think – I think it's certainly not my intent to do that. I think they're saved under 164.501.
UNIDENTIFIED PARTICIPANT: OK. That's fine. That's all.
ROTHSTEIN: Let me call your attention to something that was not done, one of our recommendations that the department did not pick up on, and that is number seven, which says, in marketing pursuant to an authorization and in health care reminders and in disease management, PHI should not be disclosed by a voice-mail or unattended fax or through other methods of communication that are not secure. And that was not adopted. There's nothing in there that deals with that. And I am, you know, I remain concerned this is obviously paternalism, but I think we need to place some limits on the use of PHI in marketing. People will sign all sorts of things. If they don't know what they're signing and I'm concerned about somebody getting – even not just faxes and voice-mail, but people getting, you know, promotional literature where on the outside it says a special offer for people with mental illness. There might be somebody stupid enough to send a letter like that and they – I don't think they should be able to use protected health information in any ways that they see fit just because somebody signed an authorization to be contacted.
UNIDENTIFIED PARTICIPANT: Your language talks about a number seven that are not secure.
ROTHSTEIN: Right.
UNIDENTIFIED PARTICIPANT: Now it's like you're talking also about that are confidential in terms of not revealing certain information on the envelope.
ROTHSTEIN: Correct.
UNIDENTIFIED PARTICIPANT: That doesn't seem to be encompassed in your – in number seven.
ROTHSTEIN: Well, perhaps number seven needs to be written more carefully or revised, but I think you know, what we are to trying to say, I don't think that the confidentiality of protected health information should be compromised in marketing of any kind, even though – even if it is pursuant to an authorization.
UNIDENTIFIED PARTICIPANT : Now, you know the provisions in 522 B still apply in terms of confidential communication. So at least a provider must permit individuals to request and they must accommodate reasonable request for confidential communications which would include not putting information on the return envelop, and providers have to also do that in cases where there's some risk of harm to the individual.
ROTHSTEIN: But suppose...
UNIDENTIFIED PARTICIPANT : This would be on request of the individual.
ROTHSTEIN: Right and also if once to get to the first marketer that – then redisclosures of that information would not be even bound by the patient based request, am I correct?
UNIDENTIFIED PARTICIPANT: Well, there is – if the marketers acting as a business associate, then the business associate cannot use this for any other purposes other than as provided in the agreement with the covered entity.
UNIDENTIFIED PARTICIPANT: Even if there is an authorization for marketing limits – for marketing.
UNIDENTIFIED PARTICIPANT: No, that's right. If this ...
UNIDENTIFIED PARTICIPANT: So you ...
UNIDENTIFIED PARTICIPANT: If you sign in authorization allowing disclosure of the marketing purposes and then you use a marketer as a business associate, do that for you to send out information, that's still a business associate.
ROTHSTEIN: But a marketer doesn't have to be a business associate, if you – if you sign an authorization.
UNIDENTIFIED PARTICIPANT: Yeah, I hear what you're saying, I guess it depends what the authorization provides. Whether provides you to send out information, meaning you or your business associate or whether an authorized disclosure to a marketing organization.
ROTHSTEIN: Right.
UNIDENTIFIED PARTICIPANT: And usually the authorization would be to allow you to send out information or you or your business associate to send out information?
ROTHSTEIN: There are couple of other things, well, what is the view of the subcommittee on this?
UNIDENTIFIED PARTICIPANT: Mark, I am little confused. How come a marketer not the business associate, you're saying that the may be a health care institution would be selling out the list of people that have given the authorization, selling it out to marketing companies that are going to do the marketing on their own for other things and that's for the appreciation covers. That seems like a – I mean, I'm not saying it is not possible, but seems like that would make that protected health information available to everybody without any controls at that point.
ROTHSTEIN: Right.
UNIDENTIFIED PARTICIPANT: It's just releasing it out to the public.
ROTHSTEIN: I think – I think – I think that is not out of the question. I think we need to tighten up the marketing restrictions in a couple of ways. I think it was very helpful that we moved it to require authorizations. But I think that that marketing is still too open-ended. We recommended, for example, in number four authorizations permit health care marketing should be limited to products or services that are directly related to the health of patient. And should clearly indicate that they are comprehensive, that is the authorization. And it can include sensitive protected health information. That was not adopted, I think that the marketing authorization should include that. You know, these are vulnerable people who will sign anything that you put in front of them. They are at a vulnerable time and you can sign away practically all your rights, and then you’re contacted, there is no requirements that you'll be notified about how you can opt out of future contacts. There is no requirement that there are bans on redisclosure, no time limits, no business associate agreement is needed et cetera so no accounting any more.
BLAIR: This is Jeff , Mark.
ROTHSTEIN: Yeah.
BLAIR: Mark, I agree with the concern that you're raising and I think there's probably enough ways you could have language to be able to address that, whether you just simply reiterate the fact that the marketing organization is a business partner and still a subject to the constraints of protecting the privacy of the information, even if authorization was given to them for marketing purposes, that's one way to phrase it, and anyway – I probably don't necessarily feel it may be useful for us to crack the phrasing, but I do feel as if the concern that you've raised is a valid one and easily addressed by indicating that the marketing organizations continues to have the responsibility to protect the privacy of PHI.
ROTHSTEIN: Thank you Jeff , let me make a – broader proposal to the members of the subcommittee. Rather than going through this sort of longer list of things that concern me, may be what I can do is simply refer to the general tenor of the recommendations that we made to the secretary with regard to marketing and as that the department consider ways to tighten up marketing even – even marketing pursuant to an authorization to accomplish the ends that we set up generally in our prior letter, would that be all right?
BLAIR: We'll take a look at it, drafts and comments.
ROTHSTEIN: OK.
UNIDENTIFIED PARTICIPANT: Yeah.
BLAIR: Mark I guess I should ask at this point, you've obviously gotten pretty specific on all the stuff and got about another, it is like about a 180 seconds before the phone goes dead, I would imagine.
ROTHSTEIN: Right.
UNIDENTIFIED PARTICIPANT: How we're going to handle the other nine items?
ROTHSTEIN: Well, OK. The other nine items ...
UNIDENTIFIED PARTICIPANT: That what we stated, the other eight items.
ROTHSTEIN: Yeah. I think on the issue of fund raising, it was not addressed in the NPRM unless I missed it, thereby leaving it within TPO containing the same limitations in our letter, we did not specifically ask for anything other than transitional rules of fund raising, and we also asked for some limits on disclosure by a voice mail and we also asked HHS to explore the procedures for the disclosure of clinical department of service information which the department did not do. So we can restate our position on fund raising unless somebody wants to add something new.
UNIDENTIFIED PARTICIPANT : In the interest of time, I think we have two minutes left, there's something like that.
ROTHSTEIN: Yeah.
UNIDENTIFIED PARTICIPANT: Why don't we just take the same approach with all of the areas that were not addressed in the proposed additions to the NPRM if our recommendation -- of our recent recommendations were not included that we simply remind OCR that we're looking for them to address.
ROTHSTEIN: I think patient is the only one where that applies.
UNIDENTIFIED PARTICIPANT: I think so.
ROTHSTEIN: So, I think we're all in agreement ...
END
We welcome your feedback on this transcript. Please go to http://www.emediamillworks.com/feedback/ or call Erica Corwin at 301-883-2482 x114.
04/25/02