1
00:00:00,000 --> 00:00:04,300
Hello and welcome to Health Information Privacy Ask an Expert.

2
00:00:04,320 --> 00:00:05,320
I'm Lucia Savage.

3
00:00:05,320 --> 00:00:08,640
I'm currently Chief Privacy and Regulatory Officer at Omada Health.

4
00:00:08,640 --> 00:00:16,500
Before joining Omada Health, I was Chief Privacy Officer at the Health and Human Services Office of the National Coordinator for Health IT.

5
00:00:16,540 --> 00:00:17,680
Yes, that's a mouthful.

6
00:00:17,680 --> 00:00:19,840
You can just say ONC for short.

7
00:00:19,840 --> 00:00:27,440
And that is the agency that not only brought you regulated electronic health records, but also brought you app-based access to your own information.

8
00:00:27,460 --> 00:00:29,580
And we'll talk more about that later today.

9
00:00:29,620 --> 00:00:34,360
I'm really happy to be here today recording live for the Biohacking Village at DEF CON.

10
00:00:34,620 --> 00:00:40,200
As you know, the format of the show is to cover the basics of a topic and then open the mailbag on that topic.

11
00:00:40,380 --> 00:00:44,540
Today, we're covering how health information privacy is regulated in the U.S.

12
00:00:44,840 --> 00:00:50,680
and the difference between health information in the health care system and outside of it, like on social media.

13
00:00:50,960 --> 00:00:56,900
We're also going to cover why there are lots of news headlines on the topic and what the headlines mean for ordinary people.

14
00:00:57,300 --> 00:00:58,700
Let's get started.

15
00:00:58,940 --> 00:01:03,160
I think the best place to start is why do people want health information privacy?

16
00:01:03,260 --> 00:01:04,460
It's pretty simple.

17
00:01:04,680 --> 00:01:10,240
People want health information privacy to prevent them from being treated badly because of their health status.

18
00:01:10,600 --> 00:01:12,660
There's a few very current examples of that.

19
00:01:12,660 --> 00:01:17,220
Just look at Kim Kardashian's note about her husband's mental health situation.

20
00:01:17,320 --> 00:01:21,060
Or if you want a deeper dive, you can read Carrie Fisher's autobiography.

21
00:01:21,440 --> 00:01:28,560
Or you can check out on social media the Royal Highness's campaign to remove mental health stigma in Britain.

22
00:01:28,560 --> 00:01:36,220
All of those are areas where we have specialized privacy rules because we treat people badly when the health information gets out in public.

23
00:01:36,220 --> 00:01:39,420
And there's many, many areas as well, but those are three current examples.

24
00:01:40,300 --> 00:01:56,220
At the same time, it's really important to remember that here, a fifth of the way through the 21st century, digital health information can be used for really important purposes to help us address inequities, address discrimination, improve the care system.

25
00:01:56,220 --> 00:01:58,780
You can't fix what you can't measure.

26
00:01:58,780 --> 00:02:04,980
One example would be many years ago, we started measuring the rate of breast cancer screening in women.

27
00:02:05,140 --> 00:02:14,280
And because we could measure it and identify the physicians that were not ordering mammograms for their patients, we increased the rate of screening and we saved lives.

28
00:02:14,280 --> 00:02:16,360
That's a really early example.

29
00:02:16,440 --> 00:02:28,960
But some more current examples are things like using the data to measure what kind of languages the healthcare providers speak compared to their patients, or using the data to figure out immunization rates.

30
00:02:30,300 --> 00:02:36,400
So using it is important, but keeping it private is important, and therefore we have regulation.

31
00:02:36,460 --> 00:02:43,240
And I thought today I'd talk a little bit about how is health information regulated, and then open it up to questions from the mailbag.

32
00:02:43,980 --> 00:02:48,680
So the first thing I wanted to say is within the healthcare system, there's a very specific set of rules.

33
00:02:48,680 --> 00:02:51,280
You guys will all have heard the acronym HIPAA.

34
00:02:51,380 --> 00:02:55,500
It stands for Health Insurance Portability and Accountability Act.

35
00:02:55,500 --> 00:02:58,500
And you'll notice that there's no privacy in that acronym.

36
00:02:58,880 --> 00:03:05,400
Privacy is a side product of the original effort, which was to digitize the claims data so we could do this measurement.

37
00:03:05,700 --> 00:03:08,440
But we do have a very robust privacy rule.

38
00:03:08,440 --> 00:03:10,900
And in fact, people equate HIPAA with privacy.

39
00:03:11,160 --> 00:03:20,060
And the way that works is the digital health information within the healthcare system is designed by regulation to move around for ordinary healthcare purposes.

40
00:03:20,060 --> 00:03:29,240
For example, if you go to the doctor's office and you have insurance, you want your doctor to bill the insurance company without you having to do extra paperwork, or at least most people do.

41
00:03:29,240 --> 00:03:35,060
There are definitely a subsection of the American population that wants to manage it all themselves, but that's not most of us.

42
00:03:35,340 --> 00:03:39,760
And so that transaction, care transaction is all digital.

43
00:03:40,000 --> 00:03:46,100
And it goes from your doctor's office to your insurance company, so your doctor can get paid and you get billed whatever your co-insurance is.

44
00:03:46,100 --> 00:03:47,380
And we know that could be high.

45
00:03:47,380 --> 00:03:48,660
That's a different panel.

46
00:03:49,000 --> 00:03:50,460
But you don't have to do anything.

47
00:03:50,460 --> 00:03:51,600
You don't have to collect the data.

48
00:03:51,600 --> 00:03:52,880
You don't have to send it somewhere.

49
00:03:52,880 --> 00:03:54,280
It doesn't have to be printed out.

50
00:03:54,280 --> 00:03:56,620
And all that is designed to happen normally.

51
00:03:56,780 --> 00:04:09,440
In addition, the regulations are also designed to let us do this normalized measurement, to measure that breast cancer screening rate, to measure that immunization rates, to measure language, to measure how expensive it is.

52
00:04:09,440 --> 00:04:11,600
And there's lots and lots of examples of that.

53
00:04:11,820 --> 00:04:21,840
But the last thing is the regulations are designed to not allow the data outside of the healthcare system in an identifiable way without you giving permission to it.

54
00:04:21,840 --> 00:04:33,900
And I don't have time today to give you very specific and detailed technicalities of the regulations, but I will be providing a list of public resources where you can dig in yourself about that.

55
00:04:33,900 --> 00:04:36,580
That's the basics of within the healthcare system.

56
00:04:36,580 --> 00:05:02,360
But again, here we are, it's 2020, almost 2021, and we have lots and lots of health information that's either directly collected from individuals that's outside the healthcare system, like fitness trackers and social media sites, or where we use data that's like grocery shopping data or banking data or driving data to impute health information about people from other data sets.

57
00:05:02,360 --> 00:05:08,280
And all of that, not being in the regular healthcare system, is subject to a completely different regulatory scheme.

58
00:05:08,760 --> 00:05:12,940
So that regulatory scheme is basically about consumer privacy protection.

59
00:05:12,940 --> 00:05:24,540
So it's really the same rules apply to the health information Facebook collects as apply to the fashion information Facebook collects, or the dining information your social media account collects.

60
00:05:24,540 --> 00:05:26,300
It's all the same set of rules.

61
00:05:26,320 --> 00:05:31,900
And that basic construct is, did the organization tell you what it was going to collect?

62
00:05:31,900 --> 00:05:34,120
We can have a long conversation about notice.

63
00:05:34,360 --> 00:05:36,960
And were they honest about it?

64
00:05:36,960 --> 00:05:39,640
So were their actions what they said they were going to be?

65
00:05:39,640 --> 00:05:43,000
Or did they lie about their actions or mislead you about their actions?

66
00:05:43,000 --> 00:05:47,800
So it sounds really good in concept, but very, very hard to prove in the detail.

67
00:05:48,540 --> 00:06:01,260
The ability to prove those consumer violations lies primarily with the Federal Trade Commission, which is a federal agency not in the healthcare system, and as well with state attorneys general.

68
00:06:01,760 --> 00:06:08,260
Then as the 21st century has gone on from 2000 to the present, states have begun to take a role.

69
00:06:08,260 --> 00:06:19,060
And so we have state breach notification laws to protect us from consumer harm when our consumer data is collected and then breached or misused or misdisclosed.

70
00:06:19,060 --> 00:06:26,880
And we have states also beginning to take specific action about health information outside of the healthcare system.

71
00:06:27,260 --> 00:06:34,020
The last thing I want to say about this interplay between inside the healthcare system and outside the healthcare system has to do with states.

72
00:06:34,100 --> 00:06:39,960
So the federal law, HIPAA, is a it's the floor of regulation.

73
00:06:39,960 --> 00:06:45,720
And many states have very specific laws about, in general, clinical verticals.

74
00:06:45,720 --> 00:06:56,760
So they'll have specific laws about HIV AIDS or specific laws about mental health data or specific laws about domestic violence or sexually transmitted diseases.

75
00:06:56,760 --> 00:07:07,660
There's eight or so key areas, and they'll have a specialized rule about that and who gets to use it and what is permission required and do you have to consent to the release of your data.

76
00:07:07,720 --> 00:07:10,440
And all of those rules sit on top of HIPAA.

77
00:07:10,500 --> 00:07:17,900
So in the healthcare system, if you're a healthcare provider like Omada is, you have to think about HIPAA and you have to think about all your state laws.

78
00:07:18,120 --> 00:07:28,080
But again, those laws are about the healthcare system itself and not about particular kinds of data outside the healthcare system in the consumer setting.

79
00:07:29,120 --> 00:07:31,560
Finally, we have an emerging set of laws.

80
00:07:31,560 --> 00:07:35,100
Many people here will have heard of the California Consumer Privacy Act.

81
00:07:35,160 --> 00:07:46,860
And many people, I'm a California resident, will know that we have a ballot initiative coming to us in November where we can vote on an additional privacy law that, ironically enough, the privacy advocates are fighting about whether it's any good.

82
00:07:46,860 --> 00:07:48,560
That's also a conversation for another day.

83
00:07:48,560 --> 00:07:50,140
You can look that up on social media.

84
00:07:50,160 --> 00:08:05,740
But other states are looking to California to see what it does and whether there are things those states can copy from the California landscape to protect their own residents in the absence of federal regulation, which takes me to my final point.

85
00:08:05,860 --> 00:08:08,200
There have been a lot of headlines about this.

86
00:08:08,220 --> 00:08:08,700
Mr.

87
00:08:08,700 --> 00:08:11,800
Zuckerberg has been in front of Congress many times.

88
00:08:12,080 --> 00:08:17,620
Leaders from Google, leaders from Twitter, all have been in front of Congress talking about privacy.

89
00:08:17,720 --> 00:08:20,680
It is an important federal policy question.

90
00:08:20,680 --> 00:08:38,780
And the important question is, will the federal government change anything in the federal landscape to augment the FTC powers, to make the consumer rights more meaningful, to make the consumer rights more particularized, to healthcare information outside of the healthcare system?

91
00:08:38,880 --> 00:08:42,280
So these conversations started in the wake of Cambridge Analytica.

92
00:08:42,280 --> 00:08:47,340
A lot of us privacy advocates had great hopes for something happening.

93
00:08:47,340 --> 00:08:51,540
Remind you, Cambridge Analytica was two years ago now, a little bit more than two years ago now.

94
00:08:51,540 --> 00:08:53,840
So politics moves very, very slowly.

95
00:08:54,020 --> 00:08:55,380
It's an election year.

96
00:08:55,380 --> 00:08:56,800
We have COVID.

97
00:08:58,200 --> 00:09:00,520
Conventional wisdom says nothing's going to happen this year.

98
00:09:00,520 --> 00:09:02,800
And then it's very complicated politically.

99
00:09:02,800 --> 00:09:08,300
There are three or four committees on the Senate side, another half a dozen committees on the House side.

100
00:09:08,300 --> 00:09:10,320
Each of them has jurisdiction.

101
00:09:10,700 --> 00:09:22,840
If you went back to I'm just a bill from School House Rock, you would realize you have to have a bill on each side, then they have to come together and come to a compromise bill, and then both houses have to pass it again, and then the president has to sign it.

102
00:09:22,840 --> 00:09:24,600
So lots and lots of moving parts.

103
00:09:25,200 --> 00:09:32,540
Lots of opportunities, therefore, for people who are interested to still make their voices heard, and we'll talk about that a little bit later.

104
00:09:33,340 --> 00:09:37,680
Eventually, I think we will have something national, but it could take another two to four years.

105
00:09:37,680 --> 00:09:40,660
So I have somebody with me today to help me read the mail.

106
00:09:40,660 --> 00:09:42,000
My friend Nina.

107
00:09:42,120 --> 00:09:43,720
Nina, what's in the mailbag?

108
00:09:44,260 --> 00:09:45,340
First question.

109
00:09:46,020 --> 00:09:52,640
What are the big issues that are being debated in Congress about a nationwide privacy law?

110
00:09:53,000 --> 00:09:57,960
I think the two biggest issues are one is what we call preemption.

111
00:09:57,960 --> 00:10:04,860
So that is the idea that the federal law overtakes and supersedes any active state law.

112
00:10:04,940 --> 00:10:14,400
So if you think about the CCPA construct, if there were a federal law, and if it were preemptive, it would override whatever California enacts in its own law.

113
00:10:14,400 --> 00:10:24,640
So you can see that that could be really contentious because some states might want to be more aggressive or more protective of their consumers than other states or than the federal government.

114
00:10:25,440 --> 00:10:30,700
On the flip side, however, is the more laws there are, the harder it is to assure compliance.

115
00:10:30,700 --> 00:10:36,140
So from a consumer perspective, it might actually be better to have one single law that applies the same everywhere.

116
00:10:36,300 --> 00:10:40,760
So you don't have to be confused or have your rights change as you cross state lines.

117
00:10:40,760 --> 00:10:43,000
Many, many complex trade-offs there.

118
00:10:43,240 --> 00:10:49,080
The other big issue is should individuals be able to bring their own lawsuits for breaches of privacy?

119
00:10:49,400 --> 00:10:54,260
Now, there's a very long complicated history about lawsuits and privacy and damages.

120
00:10:54,660 --> 00:10:57,900
But at the end of the day, it's about how does this get enforced.

121
00:10:57,900 --> 00:11:02,160
So right now, outside of health care, the FTC brings an action.

122
00:11:02,660 --> 00:11:07,060
Consumers under their individual state laws may or may not have the right to sue.

123
00:11:07,060 --> 00:11:11,080
And in health care, consumers have no personal rights under HIPAA to sue.

124
00:11:11,640 --> 00:11:15,680
A federal law could change all that by giving individuals the right to sue.

125
00:11:15,680 --> 00:11:21,320
That can be a really effective enforcement mechanism, as has been true for automobile safety, for example.

126
00:11:21,940 --> 00:11:22,480
Right?

127
00:11:22,680 --> 00:11:25,520
Cars are safer because Ford got sued over the Pinto.

128
00:11:25,860 --> 00:11:29,940
But it also can make the cost of the business much more expensive.

129
00:11:29,940 --> 00:11:33,540
It can be a barrier to innovation because you have to worry about being sued.

130
00:11:34,000 --> 00:11:40,020
There are a lot of downstreams to widely available, empowering a lot of people to bring a lawsuit.

131
00:11:40,020 --> 00:11:41,540
So again, trade-offs there.

132
00:11:41,540 --> 00:11:45,500
Those are probably the two biggest issues that people cannot agree on.

133
00:11:47,500 --> 00:11:49,420
Why can't people get to yes?

134
00:11:51,000 --> 00:11:53,820
There are a lot of economic interests involved in that.

135
00:11:53,820 --> 00:12:03,760
So you can see that the trial attorneys want to make money off the lawsuits, but the small businesses and the innovation community and the venture capitalists want to keep growing new businesses with new ideas.

136
00:12:03,760 --> 00:12:06,780
And they don't want the threat of lawsuits hanging over their heads.

137
00:12:06,780 --> 00:12:08,620
Compliance can be complicated.

138
00:12:08,860 --> 00:12:10,880
There are philosophical differences.

139
00:12:10,880 --> 00:12:17,120
There are people who definitely believe in empowering consumers to sue, and people who don't believe in empowering consumers to sue.

140
00:12:17,120 --> 00:12:19,600
Those fall across the political spectrum.

141
00:12:19,840 --> 00:12:30,460
And that's probably why we can't get to yes, is there isn't enough people in any one particular place on that spectrum to balance the scales to a yes, right?

142
00:12:30,460 --> 00:12:33,240
You have to have a majority vote in both sides.

143
00:12:34,320 --> 00:12:37,460
So what's the impact of CCPA?

144
00:12:38,400 --> 00:12:45,560
So in the healthcare system, CCPA has a very specific carve-out for organizations that are actually already covered by HIPAA.

145
00:12:45,560 --> 00:12:53,100
For example, Omada would fall into that bucket, except for our public website that in a casual... you guys might be browsing it right now.

146
00:12:53,100 --> 00:12:56,540
But our program itself is healthcare delivery, and it's within HIPAA.

147
00:12:56,680 --> 00:13:09,520
But if you are a company who is collecting health information, for example, because you are running a business that offers consumers gift cards to answer surveys about their health conditions, that might be a business model.

148
00:13:09,520 --> 00:13:13,520
That's not within the healthcare system, and CCPA is going to apply.

149
00:13:13,620 --> 00:13:15,560
And all the rules of it are going to apply.

150
00:13:15,560 --> 00:13:21,520
Of course, it's a little bit of a moving target because the law was enacted a year ago.

151
00:13:21,520 --> 00:13:25,480
It took effect in January, but the regulations didn't take effect till July.

152
00:13:25,480 --> 00:13:27,540
And actually, they didn't get finalized till last week.

153
00:13:27,540 --> 00:13:36,100
And that might be upended by a ballot initiative, and who knows what's going to happen if there's court action about the ballot initiative.

154
00:13:36,880 --> 00:13:39,320
I'm not an expert on CCPA.

155
00:13:39,320 --> 00:13:41,600
I think it's something that's really important to people.

156
00:13:41,600 --> 00:13:49,640
But to me, the most important part of it from a consumer is knowing that I can go and say to that organization, what did you collect about me?

157
00:13:49,640 --> 00:13:51,580
And can I please have a copy of it?

158
00:13:51,580 --> 00:13:54,800
That's a really important thing for consumers who want to take action.

159
00:13:55,340 --> 00:13:56,860
I completely agree with that.

160
00:13:56,860 --> 00:14:00,720
So if anything, did COVID change?

161
00:14:01,620 --> 00:14:06,860
You know, COVID hasn't changed very much in the landscape, the overall regulatory landscape.

162
00:14:06,860 --> 00:14:13,880
There have been a couple of little things that have eased because of the public health emergency, but that easement is temporary.

163
00:14:13,920 --> 00:14:33,760
But I think in terms of health information, what the impact COVID has had is really given more people a stronger sense of the possibility that digital health has for us as a way of getting care, maintaining our health, getting the coaching or the assistance we need when we can't go to the doctor's office.

164
00:14:33,760 --> 00:14:42,700
And because of that, I mean, it's great for a digital health company like Omada, but because of that, people are now going to be thinking about their health information a lot more.

165
00:14:42,700 --> 00:14:43,560
That's one.

166
00:14:43,560 --> 00:15:06,860
The second one is I think that the arrival of big tech at the COVID moment with their wide variety of contact tracing apps, you know, that Facebook both runs ads for legitimate academic research about COVID and also runs not legitimate, you know, links to things that are not legitimate research.

167
00:15:07,480 --> 00:15:20,180
Arriving as it has two years after Cambridge Analytica, I think we're suffering from the skepticism that Cambridge Analytica brought to the doorstep of health information outside of HIPAA, really and truly.

168
00:15:20,180 --> 00:15:23,080
People are concerned about the contact tracing apps.

169
00:15:23,080 --> 00:15:24,700
The uptake is very low.

170
00:15:24,960 --> 00:15:34,360
It even bleeds over into human-to-human contact tracing, where I might call you, Nina, and say, hey, you know, it looked like you were at that concert, or did you know there was a big concert?

171
00:15:34,360 --> 00:15:35,100
And were you there?

172
00:15:35,100 --> 00:15:35,860
And who were you with?

173
00:15:35,860 --> 00:15:36,940
And who were they with?

174
00:15:36,940 --> 00:15:39,460
And that's, you know, contact tracing.

175
00:15:39,460 --> 00:15:46,220
We've been doing it for decades, really centuries, because we do contact tracing for sexually transmitted diseases that are contagious.

176
00:15:46,320 --> 00:15:50,900
And so we also have erosion of trust of the human-to-human contact tracing.

177
00:15:50,900 --> 00:15:53,900
And we'll suffer from that as a society for a while.

178
00:15:55,940 --> 00:15:59,620
How important is this issue to Congress?

179
00:16:01,440 --> 00:16:03,020
You know, it's a little bit of...

180
00:16:03,020 --> 00:16:04,800
I hope they get a drink of water before this question.

181
00:16:05,420 --> 00:16:09,000
You know, it's a little bit of Kentucky windage, right?

182
00:16:09,080 --> 00:16:11,660
Issues are important that constituents care about.

183
00:16:12,860 --> 00:16:16,860
And that's pretty much how the democratic process works.

184
00:16:17,100 --> 00:16:20,400
So, right now, constituents care about COVID.

185
00:16:20,480 --> 00:16:25,540
And some constituents care about election security, which is hugely important.

186
00:16:27,040 --> 00:16:32,540
We won't get a privacy anything this year, although I know there are still people working on little pieces of privacy.

187
00:16:32,540 --> 00:16:37,400
I saw a draft bill the other day about COVID and contact tracing apps about a month ago.

188
00:16:37,660 --> 00:16:44,280
But if you as a constituent think this is important, you should tell your congressperson, House or Senate.

189
00:16:44,280 --> 00:16:50,960
And in fact, if you have a senator or a representative who's on a committee of jurisdiction, you should most definitely tell them.

190
00:16:51,080 --> 00:16:59,760
If you think back to 2017, and the original attempts in the current administration to undermine the Affordable Care Act, who went to Congress?

191
00:16:59,820 --> 00:17:02,660
People with sick children and sick family members.

192
00:17:02,800 --> 00:17:04,440
And they were constituents.

193
00:17:04,460 --> 00:17:07,780
So, you know, you call over there, and they will ask what your zip code is.

194
00:17:07,780 --> 00:17:10,140
And you should be honest about that.

195
00:17:10,140 --> 00:17:16,940
I happen to have a representative who chugs along doing what I think is right without ever having me ever having to call her.

196
00:17:16,940 --> 00:17:21,600
But I can imagine being in a different state and having to call my representative every week.

197
00:17:22,680 --> 00:17:29,640
Or ask for an appointment for the office with local staff to say, Hey, did you know this is happening?

198
00:17:29,640 --> 00:17:34,860
And this is how it's impacting our community and me, and you should fix it.

199
00:17:35,020 --> 00:17:37,660
Noise squeaky wheels totally get the grease in politics.

200
00:17:37,660 --> 00:17:39,500
So that's when it becomes important.

201
00:17:40,740 --> 00:17:41,800
Perfect segue.

202
00:17:41,800 --> 00:17:47,540
So how can the biohacking community get involved and move the needle on issues in privacy?

203
00:17:48,140 --> 00:17:59,420
I think there are a few things I'm going to sort of try to list as many as I can in this materials, of bills that people might want to look at and committees of jurisdiction and where you go.

204
00:17:59,420 --> 00:18:00,500
But it's pretty simple.

205
00:18:00,500 --> 00:18:06,720
If you want to know, you go to finance.senate.gov and you look at the members and you figure out if they're your senator.

206
00:18:07,480 --> 00:18:14,000
And then you call your Senate's office, you call them and you say, I'm Lucia Savage, and I'm a resident of blah, blah, blah state.

207
00:18:14,000 --> 00:18:16,980
And I understand that you're looking at such and such an issue.

208
00:18:16,980 --> 00:18:18,440
Here's what I think about it.

209
00:18:18,740 --> 00:18:24,460
And if you have a bunch of friends, you know, you can do a house party and everyone can get on their cell phone.

210
00:18:24,460 --> 00:18:25,620
You can call serially.

211
00:18:26,180 --> 00:18:30,820
You can email, but it's probably not as carefully read or paid attention to as a phone call.

212
00:18:31,420 --> 00:18:33,840
You can do a house party after COVID.

213
00:18:34,160 --> 00:18:37,240
You can do a well, well, you could do a virtual house party, right?

214
00:18:37,240 --> 00:18:42,120
Like set it up on zoom, you can have all the contact information on a document that you're sharing.

215
00:18:42,180 --> 00:18:47,900
People can just, you know, call on mute, they were talking, just have a good time.

216
00:18:49,260 --> 00:18:54,460
So how can biohackers be more involved in the privacy needs and changes that are taking place?

217
00:18:54,460 --> 00:18:59,380
How do we get people to listen aside from talking to our congressional person?

218
00:18:59,840 --> 00:19:02,960
So I think stories are really, really important.

219
00:19:03,400 --> 00:19:05,340
People listen to stories.

220
00:19:05,340 --> 00:19:11,760
So I'm always compelled by, that's why I love that the reference to Kim Kardashian or Carrie Fisher, right?

221
00:19:11,760 --> 00:19:15,880
It gives us a context for why people have privacy issues.

222
00:19:15,880 --> 00:19:18,400
Why are we working on mental health?

223
00:19:18,400 --> 00:19:19,680
Why is there so much stigma?

224
00:19:19,680 --> 00:19:21,620
How do we remove the stigma?

225
00:19:21,620 --> 00:19:23,660
And we analogize that to privacy.

226
00:19:23,660 --> 00:19:34,720
So in your family or in your community, what has been a bad impact of poor privacy practices or poor security practices for that matter?

227
00:19:34,720 --> 00:19:36,460
How has it impacted people?

228
00:19:36,460 --> 00:19:44,860
Whether it's a neighbor who got doxxed and somebody, you know, something terrible happened to them or people that you know, or even yourself.

229
00:19:45,180 --> 00:19:51,680
That's how we got anti-doxxing legislation is people went to their representative and said, hey, this happened to me and there ought to be a law.

230
00:19:52,380 --> 00:19:57,160
So it's really about stories and it's very, politics is very personal.

231
00:19:57,640 --> 00:20:09,200
It's, you know, there are white papers, there are studies, there is data, we can explain all that, but it's really the compelling personal stories that tip the scales when somebody's on the edge.

232
00:20:09,200 --> 00:20:14,900
It's the story about the constituent that's going to push somebody where you want them to go.

233
00:20:16,320 --> 00:20:24,880
And since I don't know about everyone's personal life, who might be listening to this, it's really hard for me to know after that, like what would be a story that would be compelling.

234
00:20:24,960 --> 00:20:35,380
But I know I had a, my mother was bipolar and in all my work as a privacy advocate, and particularly the work I did in the last administration, I would always talk about that.

235
00:20:35,380 --> 00:20:36,520
Like, I get it.

236
00:20:36,520 --> 00:20:37,720
I get stigma.

237
00:20:37,720 --> 00:20:39,180
I get why this is important.

238
00:20:39,180 --> 00:20:41,940
And I get why we need to understand it better.

239
00:20:43,800 --> 00:20:46,020
Can I have my personal moment in here?

240
00:20:46,140 --> 00:20:47,100
Absolutely.

241
00:20:47,620 --> 00:20:54,640
So I give this story a lot about why I'm in healthcare and why this matters so much to me.

242
00:20:54,840 --> 00:21:00,840
My father, fire department of New York, paramedic captain, he was at 9-11.

243
00:21:01,880 --> 00:21:05,740
My mother, stage four, one of the rarest cancers in the world.

244
00:21:05,740 --> 00:21:06,740
And I learned about it.

245
00:21:06,740 --> 00:21:10,600
I learned about both of their, their health issues the same week.

246
00:21:10,900 --> 00:21:12,000
Oh my God.

247
00:21:12,140 --> 00:21:18,820
So my father's issue was that he has bilateral lung nodes from being at the World Trade Center.

248
00:21:18,820 --> 00:21:19,800
Right.

249
00:21:19,960 --> 00:21:25,800
And it's that, it's that very compelling story of I suddenly became a caretaker.

250
00:21:25,800 --> 00:21:27,860
My parents were super independent.

251
00:21:27,860 --> 00:21:28,960
They were doing their things.

252
00:21:28,960 --> 00:21:31,740
And now it's, I own all of their medical data.

253
00:21:31,740 --> 00:21:35,060
I have all of their physician numbers in my phone.

254
00:21:35,060 --> 00:21:38,840
And if something happens, I immediately make a call for them.

255
00:21:38,840 --> 00:21:47,000
And if I'm not available, we, they, they understand that they, the physicians will call me right after to give me that data and the update of their condition.

256
00:21:47,120 --> 00:21:56,760
So I'm, I'm complete agreement with the story is so compelling because we all have something that we can talk about and gives us that emotion to say, there needs to be a change.

257
00:21:56,760 --> 00:21:57,580
It's not a question.

258
00:21:57,580 --> 00:21:59,760
I'm not asking you and telling you that moment.

259
00:21:59,960 --> 00:22:00,940
Two things.

260
00:22:00,940 --> 00:22:11,720
If you think back about the 9-11 fund and you'll remember that Jon Stewart was on that like a dog on a bone week after week, it was embarrassing.

261
00:22:11,900 --> 00:22:17,160
He was intentionally embarrassing the politicians with these really compelling stories and it worked.

262
00:22:17,160 --> 00:22:18,540
So think about that.

263
00:22:18,540 --> 00:22:29,180
The other thing I would say, just on a personal note, Nina, and I don't know if we have time today, but you know, caretakers, we, we are, we baby boomers are a pretty big population and our kids are going to be taking care of us.

264
00:22:29,180 --> 00:22:38,920
And we should all have the ability as a caretaker, not just to call your parents doctor and have them call back, but have online on your phone access to their records.

265
00:22:38,920 --> 00:22:40,480
If they want you to have it.

266
00:22:40,480 --> 00:22:44,000
I had that for my mom through the Kaiser app, she authorized it.

267
00:22:44,000 --> 00:22:46,120
It meant I could help care for her.

268
00:22:46,120 --> 00:22:48,700
And she could call me and say, I don't understand this thing.

269
00:22:48,700 --> 00:22:49,780
What does it mean?

270
00:22:49,780 --> 00:23:02,280
And that is what digital health really means is not keeping data sacrosanct in a box under a cement floor, but putting it where it needs to be and where the patient wants it to be to get the care that they need.

271
00:23:02,280 --> 00:23:05,640
And if that's with a family member, let the family member know.

272
00:23:05,640 --> 00:23:09,160
If that's with a friend from church, let the friend from church know.

273
00:23:09,240 --> 00:23:18,520
If that's you as a person, you're a DIY healthcare person, and you want to broadcast your health status on that big billboard at Times Square, go right ahead.

274
00:23:18,520 --> 00:23:19,280
It's your data.

275
00:23:21,120 --> 00:23:29,460
How do the agencies that command and control healthcare, how do they work together or how do they not work together?

276
00:23:29,660 --> 00:23:31,260
Sure, that's a great question.

277
00:23:31,260 --> 00:23:37,840
And something I forgot earlier on, I wanted to be super clear about who really has authority over privacy.

278
00:23:37,840 --> 00:23:44,100
So in the federal realm, it is solely the Health and Human Services Office for Civil Rights.

279
00:23:44,100 --> 00:23:53,500
They write the privacy regulation, they write the security regulation, they investigate those, they fine people for them, and they enforce them.

280
00:23:53,500 --> 00:24:10,100
Now the FDA, which has a lot to say about digital tools, their remit or their jurisdiction is really about, is the thing safe, clinically safe, like it's not going to cause you, you know, a glucometer isn't going to burn your arm, or whatever.

281
00:24:10,100 --> 00:24:14,580
And is it doing clinically what you say it's going to do?

282
00:24:14,580 --> 00:24:18,180
So remember, it's the Food, Drug, Action, Cosmetics Act.

283
00:24:18,180 --> 00:24:30,980
And the enabling legislation, which dates back to Teddy Roosevelt, is about not having health products in the field that are dangerous.

284
00:24:31,460 --> 00:24:32,200
Right?

285
00:24:32,200 --> 00:24:35,060
And actually, the FDA covers veterinary science as well.

286
00:24:35,060 --> 00:24:37,100
So just think about that in totality.

287
00:24:37,100 --> 00:24:39,220
So I love Bakul.

288
00:24:39,220 --> 00:24:46,880
I know everybody over there, great crowd, really interested in privacy as a concept, but they don't actually regulate privacy.

289
00:24:46,880 --> 00:24:59,400
What they regulate is, did your device that has software in it, secure that software sufficiently that the device data is still accurate and has integrity?

290
00:25:00,300 --> 00:25:02,580
That's pretty much what they regulate.

291
00:25:02,860 --> 00:25:04,660
So that's the FDA.

292
00:25:04,740 --> 00:25:12,620
And then HHS-OCR writes the privacy rule, that applies to health insurance companies, employer-sponsored coverage.

293
00:25:12,620 --> 00:25:25,200
If you have a big employer, like you're at an Apple or Google or health sponsor coverage, physicians or any other provider who bills the government electronically, and then some additional intermediate companies called clearinghouses.

294
00:25:26,840 --> 00:25:31,920
There's always a lot of talk around the medical devices and the security that surround those.

295
00:25:31,920 --> 00:25:37,660
But one of the parts that are normally lacking in conversation are the electronic medical records.

296
00:25:37,660 --> 00:25:41,180
And you talked before about the ONC owning them.

297
00:25:41,340 --> 00:25:44,860
So what's, how does that link in with the agency?

298
00:25:45,120 --> 00:25:45,600
Sure.

299
00:25:45,980 --> 00:25:49,020
So the ONC has three specific powers.

300
00:25:49,020 --> 00:25:54,520
The first one is they write a regulation about what the software in a certified EHR has to do.

301
00:25:54,620 --> 00:25:57,520
And they're EHRs that are not certified, by the way.

302
00:25:57,840 --> 00:26:04,720
So if you have a certified EHR, it has to have these minimum functional requirements, and they've been getting more and more rigorous as time has gone by.

303
00:26:04,720 --> 00:26:12,760
The second thing they have is to educate the provider workforce, primarily, especially the small doctor's offices.

304
00:26:12,760 --> 00:26:19,900
Remember, while there's some really big systems, most healthcare is provided in very small business practices that have two or three physicians in them.

305
00:26:19,900 --> 00:26:29,620
So educate the physicians and the nurses and the people out in the field about how to safely, privately, and securely use EH, use certified EHRs to deliver care.

306
00:26:29,620 --> 00:26:36,580
And the third is to run the policymaking for the agency about both what that software package should be.

307
00:26:36,580 --> 00:26:46,340
It's a very unusual power, a federal agency that writes a prescriptive rule for software, but also, in general, about health information technology policy writ large.

308
00:26:46,380 --> 00:26:53,780
So for example, ONC has a specific duty of coordinating Office of the National Coordinator across agencies.

309
00:26:53,780 --> 00:27:03,980
And I might bring people to the table that would be the FDA and the FTC and Office of Civil Rights to stand up a tool that in fact exists.

310
00:27:03,980 --> 00:27:08,000
So on the FTC website is the mobile health app developer tool.

311
00:27:08,020 --> 00:27:20,120
And if you were to go to that tool, you would see in kind of a Q&A fashion, it moves you through a flowchart to help you make sure if you're a developer, you know which rules you have to deal with for the thing you're envisioning.

312
00:27:20,240 --> 00:27:23,200
So that's an example of coordinating across the agencies.

313
00:27:23,340 --> 00:27:28,420
Enforcement is not really a coordinating event in federal law.

314
00:27:28,420 --> 00:27:38,080
Generally, I'm making a very broad statement, but you know, OCR has its remit and a privacy breach is investigated by OCR and they investigate every single one that's reported to them.

315
00:27:38,480 --> 00:27:45,240
A safety violation by a device would be investigated by the FDA, if that makes sense.

316
00:27:45,240 --> 00:27:51,620
And then, of course, all of these agencies are within Health and Human Services, which is an agency run by Secretary Azar.

317
00:27:51,640 --> 00:28:00,580
And so how the agencies work together is really a factor of whether the secretary is making them work together and how much.

318
00:28:00,580 --> 00:28:03,300
Different secretaries have different approaches to that.

319
00:28:03,300 --> 00:28:05,720
The FDA is a very big agency.

320
00:28:05,720 --> 00:28:07,020
It's called an operating division.

321
00:28:07,020 --> 00:28:13,940
It's kind of freestanding and runs on its own, but the FDA administrator would be part of Azar's sort of kitchen cabinet or his cabinet.

322
00:28:14,100 --> 00:28:17,880
Similarly, CMS, operating division, kitchen cabinet.

323
00:28:17,880 --> 00:28:20,900
NIH, operating division, but in the cabinet.

324
00:28:20,960 --> 00:28:32,140
And then, ONC, Office for Civil Rights, actually report directly through the secretary, also in the cabinet, but literally under more of the secretarial vertical, if you can imagine that.

325
00:28:32,940 --> 00:28:34,480
So how do they work together?

326
00:28:34,480 --> 00:28:36,020
Let me just see if I can summarize it up.

327
00:28:36,240 --> 00:28:44,220
I think the staff work really well together when they're asked to, but people also have very specific portfolios and work that needs to get done.

328
00:28:44,220 --> 00:28:45,860
And so they really focus on that.

329
00:28:46,920 --> 00:28:57,660
So I want to be clear with people that you and I have met once and it was in a coffee shop and I watched you walk in and the conversation we had was extremely powerful.

330
00:28:57,660 --> 00:29:05,420
And I instantly knew that you had so much information that you needed to share it.

331
00:29:05,420 --> 00:29:11,860
And the, I feel like the community that we work in, we focus a lot on the medical devices because it's something very tangible that we can get our hands on.

332
00:29:12,060 --> 00:29:19,700
And this, even with all the knowledge that I have on how things function, this has engaged me and enlightened me.

333
00:29:19,700 --> 00:29:24,320
And now it's, okay, I can't focus so much here because they don't control this one thing that I'm working on.

334
00:29:24,320 --> 00:29:25,800
It's, I need to move over here.

335
00:29:25,800 --> 00:29:29,220
And maybe if I'm working over here, I can gauge this and make things happen.

336
00:29:29,360 --> 00:29:36,260
So that said, what other resources can we find for everything that you're talking about?

337
00:29:36,820 --> 00:29:43,860
So I'll put all these links in a document that you can hand out Nina, but I will tick off a few of them that are going to be in that document.

338
00:29:44,980 --> 00:29:49,360
The we published actually a long white paper for Congress.

339
00:29:49,360 --> 00:30:01,880
So let's just say it's like publication book level clearance and editorial accuracy for 2016 about the way health privacy is regulated in healthcare and outside of healthcare.

340
00:30:01,880 --> 00:30:07,500
And while the names of the companies may have evolved over time, Twitter is still Twitter.

341
00:30:07,500 --> 00:30:09,260
Facebook still operates the same way.

342
00:30:09,260 --> 00:30:15,180
None of the rules or laws that characterize that description have changed.

343
00:30:15,180 --> 00:30:16,800
So that is a public document.

344
00:30:16,800 --> 00:30:22,540
If you wanted to look for it right now, you'd Google ONC, non-covered entity report, and it would pop right up.

345
00:30:22,700 --> 00:30:40,060
Free, paid by the American taxpayer, no matter who else produces anything, the law firms, the consulting houses, the hacker community, this one is going to be the definitive source because it has to go through so many layers, including approval by the White House before it gets released to Congress.

346
00:30:40,060 --> 00:30:41,340
So that will be in there.

347
00:30:41,480 --> 00:30:59,180
I will provide some links to educational materials that ONC and Office for Civil Rights publish about more details about how HIPAA works, not only what people's individual rights are, like you as the caregiver, what are your rights for you and your parents to collectively get the information you need to help them with their care,

348
00:30:59,180 --> 00:31:09,280
but also for people to understand what are the ordinary disclosures that happen within the health care system to make it run between physicians, between physicians and health plans, etc.

349
00:31:09,280 --> 00:31:11,700
So there'll be some of that material in there.

350
00:31:11,700 --> 00:31:15,140
And then I'll probably link to some other think tanks in D.C.

351
00:31:15,140 --> 00:31:34,620
that are working on the federal privacy law space, and people can look at those organizations' websites and decide what's of interest to them, but it would be Brookings Institute, Future of Privacy Forum, Electronic Frontier Foundation, EPIC, Potentially American Enterprise,

352
00:31:34,620 --> 00:31:37,220
New America Foundation, they've all kind of worked in this space.

353
00:31:37,220 --> 00:31:42,780
So we'll put some links together that are those people's websites, and you can just go to them and check it out.

354
00:31:43,220 --> 00:31:45,520
Lucia, thank you so much.

355
00:31:48,620 --> 00:31:52,420
This is the stuff we don't talk about, and that is why this is so important.

356
00:31:52,420 --> 00:31:53,520
So thank you for coming.

357
00:31:53,520 --> 00:31:56,520
I completely and utterly appreciate your brain space.

358
00:31:56,960 --> 00:31:58,760
I'm really happy to be here.

359
00:31:58,760 --> 00:32:04,120
I think that the more people who can bring the stories to the floor, the more likely we are to have traction.

360
00:32:04,120 --> 00:32:20,400
There's a lot of times when it's the same 300 people having this conversation and bringing the new voices, especially of the next generation when they've been specifically impacted by this, or they understand the technology better than some of our older congresspeople.

361
00:32:20,660 --> 00:32:21,480
Awesome.

362
00:32:21,480 --> 00:32:22,800
Totally awesome.

363
00:32:23,640 --> 00:32:24,760
Thank you.

364
00:32:24,760 --> 00:32:25,520
You're welcome.

365
00:32:25,520 --> 00:32:26,280
Thanks for having me.