start	end	text
0	5820	Hello and welcome to Health Information Privacy Ask an Expert. I'm Lucia Savage. I'm currently
5820	10600	Chief Privacy and Regulatory Officer at Omada Health. Before joining Omada Health, I was
10600	15400	Chief Privacy Officer at the Health and Human Services Office of the National Coordinator for
15400	20960	Health IT. Yes, that's a mouthful. You can just say ONC for short. And that is the agency that
20960	26020	not only brought you regulated electronic health records, but also brought you app-based access to
26020	30900	your own information. And we'll talk more about that later today. I'm really happy to be here
30900	36140	today recording live for the Biohacking Village at DEF CON. As you know, the format of the show
36140	41460	is to cover the basics of a topic and then open the mailbag on that topic. Today, we're covering
41460	46400	how health information privacy is regulated in the U.S. and the difference between health
46400	51880	information in the health care system and outside of it, like on social media. We're also going to
51880	56000	cover why there are lots of news headlines on the topic and what the headlines mean for ordinary
56000	62200	people. Let's get started. I think the best place to start is why do people want health information
62200	67700	privacy? It's pretty simple. People want health information privacy to prevent them from being
67700	72660	treated badly because of their health status. There's a few very current examples of that.
72660	78000	Just look at Kim Kardashian's note about her husband's mental health situation. Or if you want
78080	82740	a deeper dive, you can read Carrie Fisher's autobiography. Or you can check out on social
82740	89220	media the Royal Highness's campaign to remove mental health stigma in Britain. All of those
89220	94460	are areas where we have specialized privacy rules because we treat people badly when the health
94460	98500	information gets out in public. And there's many, many areas as well, but those are three current
98500	104260	examples. At the same time, it's really important to remember that here, a fifth of the way through
104260	110580	the 21st century, digital health information can be used for really important purposes to
110580	117660	help us address inequities, address discrimination, improve the care system. You can't fix what you
117660	123600	can't measure. One example would be many years ago, we started measuring the rate of breast cancer
123600	128480	screening in women. And because we could measure it and identify the physicians that were not
129140	133780	ordering mammograms for their patients, we increased the rate of screening and we saved
133780	138600	lives. That's a really early example. But some more current examples are things like
138600	143760	using the data to measure what kind of languages the healthcare providers speak
143760	148960	compared to their patients, or using the data to figure out immunization rates.
150300	156400	So using it is important, but keeping it private is important, and therefore we have regulation.
156460	160440	And I thought today I'd talk a little bit about how is health information regulated,
160440	163240	and then open it up to questions from the mailbag.
163980	166780	So the first thing I wanted to say is within the healthcare system,
166780	171280	there's a very specific set of rules. You guys will all have heard the acronym HIPAA.
171380	176340	It stands for Health Insurance Portability and Accountability Act. And you'll notice that there's
176340	182020	no privacy in that acronym. Privacy is a side product of the original effort, which was to
182020	188080	digitize the claims data so we could do this measurement. But we do have a very robust privacy
188080	193260	rule. And in fact, people equate HIPAA with privacy. And the way that works is the digital
193260	198260	health information within the healthcare system is designed by regulation to move around for
198260	203900	ordinary healthcare purposes. For example, if you go to the doctor's office and you have insurance,
203900	208140	you want your doctor to bill the insurance company without you having to do extra paperwork,
208140	212240	or at least most people do. There are definitely a subsection of the American population that
212240	217680	wants to manage it all themselves, but that's not most of us. And so that transaction,
217680	222620	care transaction is all digital. And it goes from your doctor's office to your insurance company,
222620	226520	so your doctor can get paid and you get billed whatever your co-insurance is. And we know that
226520	230760	could be high. That's a different panel. But you don't have to do anything. You don't have
230760	234280	to collect the data. You don't have to send it somewhere. It doesn't have to be printed out.
234280	239440	And all that is designed to happen normally. In addition, the regulations are also designed
239440	243740	to let us do this normalized measurement, to measure that breast cancer screening rate,
243740	249520	to measure that immunization rates, to measure language, to measure how expensive it is. And
249520	254840	there's lots and lots of examples of that. But the last thing is the regulations are designed
254840	260560	to not allow the data outside of the healthcare system in an identifiable way without you giving
260560	268360	permission to it. And I don't have time today to give you very specific and detailed technicalities
268360	272260	of the regulations, but I will be providing a list of public resources where you can dig
272260	277400	in yourself about that. That's the basics of within the healthcare system. But again, here we
277400	282960	are, it's 2020, almost 2021, and we have lots and lots of health information that's either directly
282960	287900	collected from individuals that's outside the healthcare system, like fitness trackers and
287900	296100	social media sites, or where we use data that's like grocery shopping data or banking data or
296100	303600	driving data to impute health information about people from other data sets. And all of that,
303600	307080	not being in the regular healthcare system, is subject to a completely different regulatory
307080	313360	scheme. So that regulatory scheme is basically about consumer privacy protection. So it's really
313360	318880	the same rules apply to the health information Facebook collects as apply to the fashion
318880	324540	information Facebook collects, or the dining information your social media account collects.
324540	330920	It's all the same set of rules. And that basic construct is, did the organization tell you what
330920	336300	it was going to collect? We can have a long conversation about notice. And were they honest
336300	340800	about it? So were their actions what they said they were going to be? Or did they lie about their
340800	345880	actions or mislead you about their actions? So it sounds really good in concept, but very, very hard
345880	354940	to prove in the detail. The ability to prove those consumer violations lies primarily with
354940	359620	the Federal Trade Commission, which is a federal agency not in the healthcare system, and as well
359620	366420	with state attorneys general. Then as the 21st century has gone on from 2000 to the present,
366420	371720	states have begun to take a role. And so we have state breach notification laws to protect us from
371720	379060	consumer harm when our consumer data is collected and then breached or misused or misdisclosed.
379060	385640	And we have states also beginning to take specific action about health information outside of the
385640	390760	healthcare system. The last thing I want to say about this interplay between inside the healthcare
390760	396260	system and outside the healthcare system has to do with states. So the federal law, HIPAA, is a
397220	404700	it's the floor of regulation. And many states have very specific laws about, in general,
404700	410000	clinical verticals. So they'll have specific laws about HIV AIDS or specific laws about mental
410000	416760	health data or specific laws about domestic violence or sexually transmitted diseases.
416760	423160	There's eight or so key areas, and they'll have a specialized rule about that and who gets to use
423160	427660	it and what is permission required and do you have to consent to the release of your data.
427720	432980	And all of those rules sit on top of HIPAA. So in the healthcare system, if you're a healthcare
432980	437060	provider like Omada is, you have to think about HIPAA and you have to think about all your state
437060	444020	laws. But again, those laws are about the healthcare system itself and not about particular kinds of
444020	451560	data outside the healthcare system in the consumer setting. Finally, we have an emerging set of laws.
451560	456400	Many people here will have heard of the California Consumer Privacy Act. And many people, I'm a
456400	460420	California resident, will know that we have a ballot initiative coming to us in November where
460420	465700	we can vote on an additional privacy law that, ironically enough, the privacy advocates are
465700	469120	fighting about whether it's any good. That's also a conversation for another day. You can look that
469120	474680	up on social media. But other states are looking to California to see what it does and whether
474680	480140	there are things those states can copy from the California landscape to protect their own
480140	485740	residents in the absence of federal regulation, which takes me to my final point.
485860	490680	There have been a lot of headlines about this. Mr. Zuckerberg has been in front of Congress many
490680	496660	times. Leaders from Google, leaders from Twitter, all have been in front of Congress talking about
496660	502540	privacy. It is an important federal policy question. And the important question is,
502540	510580	will the federal government change anything in the federal landscape to augment the FTC powers,
510580	515080	to make the consumer rights more meaningful, to make the consumer rights more particularized,
515080	519860	to healthcare information outside of the healthcare system? So these conversations
519860	525640	started in the wake of Cambridge Analytica. A lot of us privacy advocates had great hopes
525640	530500	for something happening. Remind you, Cambridge Analytica was two years ago now, a little bit
530500	535920	more than two years ago now. So politics moves very, very slowly. It's an election year. We have
535920	542000	COVID. Conventional wisdom says nothing's going to happen this year. And then it's very complicated
542000	547300	politically. There are three or four committees on the Senate side, another half a dozen committees
547300	553600	on the House side. Each of them has jurisdiction. If you went back to I'm just a bill from School
553600	557160	House Rock, you would realize you have to have a bill on each side, then they have to
557160	561260	come together and come to a compromise bill, and then both houses have to pass it again,
561260	564600	and then the president has to sign it. So lots and lots of moving parts.
565200	570320	Lots of opportunities, therefore, for people who are interested to still make their voices heard,
570320	575200	and we'll talk about that a little bit later. Eventually, I think we will have something
575200	579520	national, but it could take another two to four years. So I have somebody with me today to help
579520	585340	me read the mail. My friend Nina. Nina, what's in the mailbag? First question.
586020	592640	What are the big issues that are being debated in Congress about a nationwide privacy law?
593000	599320	I think the two biggest issues are one is what we call preemption. So that is the idea that
599320	605840	the federal law overtakes and supersedes any active state law. So if you think about the
605840	612080	CCPA construct, if there were a federal law, and if it were preemptive, it would override whatever
612080	617700	California enacts in its own law. So you can see that that could be really contentious because
617700	622720	some states might want to be more aggressive or more protective of their consumers than other
622720	628820	states or than the federal government. On the flip side, however, is the more laws there are,
628820	632760	the harder it is to assure compliance. So from a consumer perspective, it might actually be
632760	637880	better to have one single law that applies the same everywhere. So you don't have to be confused
637880	643000	or have your rights change as you cross state lines. Many, many complex trade-offs there.
643240	649080	The other big issue is should individuals be able to bring their own lawsuits for breaches of privacy?
649400	654260	Now, there's a very long complicated history about lawsuits and privacy and damages.
654660	659060	But at the end of the day, it's about how does this get enforced. So right now,
659060	665020	outside of health care, the FTC brings an action. Consumers under their individual state laws may or
665020	670040	may not have the right to sue. And in health care, consumers have no personal rights under HIPAA
670040	675980	to sue. A federal law could change all that by giving individuals the right to sue. That can
675980	681320	be a really effective enforcement mechanism, as has been true for automobile safety, for example.
681940	688580	Right? Cars are safer because Ford got sued over the Pinto. But it also can make the cost of the
688580	692500	business much more expensive. It can be a barrier to innovation because you have to worry about
692500	699100	being sued. There are a lot of downstreams to widely available, empowering a lot of people
699100	703740	to bring a lawsuit. So again, trade-offs there. Those are probably the two biggest issues that
703740	709420	people cannot agree on. Why can't people get to yes?
711000	715940	There are a lot of economic interests involved in that. So you can see that the trial attorneys
715940	719980	want to make money off the lawsuits, but the small businesses and the innovation community
719980	723760	and the venture capitalists want to keep growing new businesses with new ideas.
723760	728620	And they don't want the threat of lawsuits hanging over their heads. Compliance can be complicated.
728860	732980	There are philosophical differences. There are people who definitely believe in empowering
732980	737120	consumers to sue, and people who don't believe in empowering consumers to sue.
737120	742460	Those fall across the political spectrum. And that's probably why we can't get to yes,
742460	749500	is there isn't enough people in any one particular place on that spectrum to balance the scales to a
749500	753240	yes, right? You have to have a majority vote in both sides.
754320	757460	So what's the impact of CCPA?
758400	763780	So in the healthcare system, CCPA has a very specific carve-out for organizations that are
763780	768660	actually already covered by HIPAA. For example, Omada would fall into that bucket, except for
768660	773960	our public website that in a casual... you guys might be browsing it right now. But our program
773960	779000	itself is healthcare delivery, and it's within HIPAA. But if you are a company who is collecting
779000	785220	health information, for example, because you are running a business that offers consumers gift
785220	789520	cards to answer surveys about their health conditions, that might be a business model.
789520	794820	That's not within the healthcare system, and CCPA is going to apply. And all the rules of it are
794820	800680	going to apply. Of course, it's a little bit of a moving target because the law was enacted a year
800680	805860	ago. It took effect in January, but the regulations didn't take effect till July. And actually,
805860	811400	they didn't get finalized till last week. And that might be upended by a ballot initiative,
811400	816100	and who knows what's going to happen if there's court action about the ballot initiative.
816880	822280	I'm not an expert on CCPA. I think it's something that's really important to people. But to me,
822280	828200	the most important part of it from a consumer is knowing that I can go and say to that organization,
828200	832520	what did you collect about me? And can I please have a copy of it? That's a really important
832520	839240	thing for consumers who want to take action. I completely agree with that. So if anything,
839240	846160	did COVID change? You know, COVID hasn't changed very much in the landscape, the overall regulatory
846160	850560	landscape. There have been a couple of little things that have eased because of the public
850560	856200	health emergency, but that easement is temporary. But I think in terms of health information, what
856200	863080	the impact COVID has had is really given more people a stronger sense of the possibility
863080	869320	that digital health has for us as a way of getting care, maintaining our health,
869320	873760	getting the coaching or the assistance we need when we can't go to the doctor's office.
873760	877740	And because of that, I mean, it's great for a digital health company like Omada, but because
877740	883560	of that, people are now going to be thinking about their health information a lot more. That's one.
883560	890380	The second one is I think that the arrival of big tech at the COVID moment with their
891060	899500	wide variety of contact tracing apps, you know, that Facebook both runs ads for legitimate
899500	905240	academic research about COVID and also runs not legitimate, you know, links to things that are
905240	912200	not legitimate research. Arriving as it has two years after Cambridge Analytica, I think we're
912200	917440	suffering from the skepticism that Cambridge Analytica brought to the doorstep of health
917440	922600	information outside of HIPAA, really and truly. People are concerned about the contact tracing
922600	928380	apps. The uptake is very low. It even bleeds over into human-to-human contact tracing, where I might
928380	933460	call you, Nina, and say, hey, you know, it looked like you were at that concert, or did you know
933460	936940	there was a big concert? And were you there? And who were you with? And who were they with? And
937500	941920	that's, you know, contact tracing. We've been doing it for decades, really centuries,
941920	946220	because we do contact tracing for sexually transmitted diseases that are contagious.
946320	950900	And so we also have erosion of trust of the human-to-human contact tracing.
950900	953900	And we'll suffer from that as a society for a while.
955940	959620	How important is this issue to Congress?
961440	963020	You know, it's a little bit of...
963020	964800	I hope they get a drink of water before this question.
965420	969000	You know, it's a little bit of Kentucky windage, right?
969080	971660	Issues are important that constituents care about.
972860	978840	And that's pretty much how the democratic process works. So, right now, constituents
978840	985540	care about COVID. And some constituents care about election security, which is hugely important.
987040	991160	We won't get a privacy anything this year, although I know there are still people working
991160	995520	on little pieces of privacy. I saw a draft bill the other day about COVID and contact
995520	1001760	tracing apps about a month ago. But if you as a constituent think this is important,
1001760	1006520	you should tell your congressperson, House or Senate. And in fact, if you have a senator or
1006660	1010240	a representative who's on a committee of jurisdiction, you should most definitely tell
1010240	1016400	them. If you think back to 2017, and the original attempts in the current administration to undermine
1016400	1022660	the Affordable Care Act, who went to Congress? People with sick children and sick family members.
1022800	1027080	And they were constituents. So, you know, you call over there, and they will ask what your zip code
1027080	1033740	is. And you should be honest about that. I happen to have a representative who chugs along doing
1033740	1038500	what I think is right without ever having me ever having to call her. But I can imagine being in a
1038500	1044500	different state and having to call my representative every week. Or ask for an appointment for the
1044500	1051100	office with local staff to say, Hey, did you know this is happening? And this is how it's impacting
1051620	1056980	our community and me, and you should fix it. Noise squeaky wheels totally get the grease
1056980	1062760	in politics. So that's when it becomes important. Perfect segue. So how can the
1062760	1067540	biohacking community get involved and move the needle on issues in privacy?
1068140	1073460	I think there are a few things I'm going to sort of try to list as many as I can in this materials,
1073460	1079500	of bills that people might want to look at and committees of jurisdiction and where you go. But
1079500	1084460	it's pretty simple. If you want to know, you go to finance.senate.gov and you look at the members
1084460	1090140	and you figure out if they're your senator. And then you call your Senate's office, you call them
1090140	1094940	and you say, I'm Lucia Savage, and I'm a resident of blah, blah, blah state. And I understand that
1094940	1099900	you're looking at such and such an issue. Here's what I think about it. And if you have a bunch of
1099900	1104820	friends, you know, you can do a house party and everyone can get on their cell phone. You can call
1104820	1110120	serially. You can email, but it's probably not as carefully read or paid attention to as a phone
1110120	1116580	call. You can do a house party after COVID. You can do a well, well, you could do a virtual house
1116580	1121180	party, right? Like set it up on zoom, you can have all the contact information on a document that
1121180	1127900	you're sharing. People can just, you know, call on mute, they were talking, just have a good time.
1129260	1134460	So how can biohackers be more involved in the privacy needs and changes that are taking place?
1134460	1139380	How do we get people to listen aside from talking to our congressional person?
1139840	1146960	So I think stories are really, really important. People listen to stories. So I'm always compelled
1146960	1152340	by, that's why I love that the reference to Kim Kardashian or Carrie Fisher, right? It gives us a
1152340	1158780	context for why people have privacy issues. Why are we working on mental health? Why is there
1158780	1165300	so much stigma? How do we remove the stigma? And we analogize that to privacy. So in your family
1165300	1173300	or in your community, what has been a bad impact of poor privacy practices or poor security
1173300	1178920	practices for that matter? How has it impacted people? Whether it's a neighbor who got doxxed
1178920	1183480	and somebody, you know, something terrible happened to them or people that you know,
1183480	1189100	or even yourself. That's how we got anti-doxxing legislation is people went to their representative
1189100	1194100	and said, hey, this happened to me and there ought to be a law. So it's really about stories
1194100	1200420	and it's very, politics is very personal. It's, you know, there are white papers, there are studies,
1200420	1205500	there is data, we can explain all that, but it's really the compelling personal stories that
1205500	1212400	tip the scales when somebody's on the edge. It's the story about the constituent that's going to
1212400	1219300	push somebody where you want them to go. And since I don't know about everyone's personal life,
1219300	1223500	who might be listening to this, it's really hard for me to know after that, like what would be a
1223500	1230080	story that would be compelling. But I know I had a, my mother was bipolar and in all my work as a
1230080	1234880	privacy advocate, and particularly the work I did in the last administration, I would always talk
1234880	1240620	about that. Like, I get it. I get stigma. I get why this is important. And I get why we need to
1240620	1249900	understand it better. Can I have my personal moment in here? Absolutely. So I give this story a lot
1250720	1257820	about why I'm in healthcare and why this matters so much to me. My father, fire department of New
1257820	1265100	York, paramedic captain, he was at 9-11. My mother, stage four, one of the rarest cancers
1265100	1269700	in the world. And I learned about it. I learned about both of their, their health issues the same
1269700	1278100	week. Oh my God. So my father's issue was that he has bilateral lung nodes from being at the World
1278100	1285800	Trade Center. Right. And it's that, it's that very compelling story of I suddenly became a caretaker.
1285800	1290860	My parents were super independent. They were doing their things. And now it's, I own all of
1290860	1295960	their medical data. I have all of their physician numbers in my phone. And if something happens,
1295960	1301080	I immediately make a call for them. And if I'm not available, we, they, they understand that
1301080	1306360	they, the physicians will call me right after to give me that data and the update of their
1306360	1311540	condition. So I'm, I'm complete agreement with the story is so compelling because we all have
1311540	1316760	something that we can talk about and gives us that emotion to say, there needs to be a change.
1316760	1321180	It's not a question. I'm not asking you and telling you that moment. Two things. If you
1321180	1328600	think back about the 9-11 fund and you'll remember that Jon Stewart was on that like a dog on a bone
1328600	1334560	week after week, it was embarrassing. He was intentionally embarrassing the politicians with
1334560	1339240	these really compelling stories and it worked. So think about that. The other thing I would say,
1339240	1343660	just on a personal note, Nina, and I don't know if we have time today, but you know, caretakers,
1343660	1348460	we, we are, we baby boomers are a pretty big population and our kids are going to be taking
1348460	1353700	care of us. And we should all have the ability as a caretaker, not just to call your parents
1353700	1359420	doctor and have them call back, but have online on your phone access to their records. If they
1359420	1364740	want you to have it. I had that for my mom through the Kaiser app, she authorized it. It meant I
1364740	1368960	could help care for her. And she could call me and say, I don't understand this thing. What does
1368960	1375580	it mean? And that is what digital health really means is not keeping data sacrosanct in a box
1375580	1380420	under a cement floor, but putting it where it needs to be and where the patient wants it to be
1380420	1385640	to get the care that they need. And if that's with a family member, let the family member know.
1385640	1391320	If that's with a friend from church, let the friend from church know. If that's you as a person,
1391320	1396360	you're a DIY healthcare person, and you want to broadcast your health status on that big
1396360	1399280	billboard at Times Square, go right ahead. It's your data.
1401120	1408000	How do the agencies that command and control healthcare, how do they work together or how do
1408000	1413140	they not work together? Sure, that's a great question. And something I forgot earlier on,
1413140	1419720	I wanted to be super clear about who really has authority over privacy. So in the federal realm,
1419720	1426160	it is solely the Health and Human Services Office for Civil Rights. They write the privacy regulation,
1426160	1431820	they write the security regulation, they investigate those, they fine people for them,
1431820	1438920	and they enforce them. Now the FDA, which has a lot to say about digital tools, their remit or
1438920	1445380	their jurisdiction is really about, is the thing safe, clinically safe, like it's not going to
1445380	1451900	cause you, you know, a glucometer isn't going to burn your arm, or whatever. And is it doing
1451900	1457120	clinically what you say it's going to do? So remember, it's the Food, Drug, Action, Cosmetics
1457120	1464120	Act. And the enabling legislation, which dates back to Teddy Roosevelt, is about not having
1465940	1474060	health products in the field that are dangerous. Right? And actually, the FDA covers veterinary
1474060	1480020	science as well. So just think about that in totality. So I love Bakul. I know everybody
1480020	1485680	over there, great crowd, really interested in privacy as a concept, but they don't actually
1485680	1493360	regulate privacy. What they regulate is, did your device that has software in it,
1493940	1499400	secure that software sufficiently that the device data is still accurate and has integrity?
1500300	1507780	That's pretty much what they regulate. So that's the FDA. And then HHS-OCR writes the privacy rule,
1507780	1513620	that applies to health insurance companies, employer-sponsored coverage. If you have a big
1513620	1518620	employer, like you're at an Apple or Google or health sponsor coverage, physicians or any other
1518620	1523940	provider who bills the government electronically, and then some additional intermediate companies
1523940	1530400	called clearinghouses. There's always a lot of talk around the medical devices and the security
1530400	1536340	that surround those. But one of the parts that are normally lacking in conversation are the
1536340	1542280	electronic medical records. And you talked before about the ONC owning them. So what's,
1542280	1549600	how does that link in with the agency? Sure. So the ONC has three specific powers. The first one
1549600	1555660	is they write a regulation about what the software in a certified EHR has to do. And they're EHRs
1555660	1561020	that are not certified, by the way. So if you have a certified EHR, it has to have these minimum
1561020	1564720	functional requirements, and they've been getting more and more rigorous as time has gone by.
1564720	1570880	The second thing they have is to educate the provider workforce, primarily, especially the
1570880	1575740	small doctor's offices. Remember, while there's some really big systems, most healthcare is
1575740	1579900	provided in very small business practices that have two or three physicians in them.
1579900	1584920	So educate the physicians and the nurses and the people out in the field about how to safely,
1584920	1591680	privately, and securely use EH, use certified EHRs to deliver care. And the third is to run
1591680	1596900	the policymaking for the agency about both what that software package should be. It's a very
1596900	1602300	unusual power, a federal agency that writes a prescriptive rule for software, but also,
1602300	1609900	in general, about health information technology policy writ large. So for example, ONC has a
1609900	1614560	specific duty of coordinating Office of the National Coordinator across agencies. And I might
1614560	1621600	bring people to the table that would be the FDA and the FTC and Office of Civil Rights to stand up
1621700	1628260	a tool that in fact exists. So on the FTC website is the mobile health app developer tool. And if
1628260	1633700	you were to go to that tool, you would see in kind of a Q&A fashion, it moves you through a flowchart
1633700	1638560	to help you make sure if you're a developer, you know which rules you have to deal with for
1638560	1643200	the thing you're envisioning. So that's an example of coordinating across the agencies.
1643340	1649720	Enforcement is not really a coordinating event in federal law. Generally, I'm making a very
1649720	1655420	broad statement, but you know, OCR has its remit and a privacy breach is investigated by OCR and
1655420	1661120	they investigate every single one that's reported to them. A safety violation by a device would be
1661120	1667680	investigated by the FDA, if that makes sense. And then, of course, all of these agencies are within
1667680	1673700	Health and Human Services, which is an agency run by Secretary Azar. And so how the agencies work
1673700	1679820	together is really a factor of whether the secretary is making them work together and how
1679820	1685720	much. Different secretaries have different approaches to that. The FDA is a very big agency.
1685720	1689260	It's called an operating division. It's kind of freestanding and runs on its own, but the FDA
1689260	1695420	administrator would be part of Azar's sort of kitchen cabinet or his cabinet. Similarly, CMS,
1695420	1702720	operating division, kitchen cabinet. NIH, operating division, but in the cabinet. And then, ONC,
1702720	1707320	Office for Civil Rights, actually report directly through the secretary, also in the cabinet,
1707320	1712140	but literally under more of the secretarial vertical, if you can imagine that.
1712940	1717780	So how do they work together? Let me just see if I can summarize it up. I think the staff work
1717780	1723280	really well together when they're asked to, but people also have very specific portfolios and work
1723280	1729720	that needs to get done. And so they really focus on that. So I want to be clear with people that
1729720	1735700	you and I have met once and it was in a coffee shop and I watched you walk in and the conversation
1735700	1744280	we had was extremely powerful. And I instantly knew that you had so much information that you
1744280	1748860	needed to share it. And the, I feel like the community that we work in, we focus a lot on
1748860	1751860	the medical devices because it's something very tangible that we can get our hands on.
1752060	1759100	And this, even with all the knowledge that I have on how things function, this has engaged me and
1759100	1763300	enlightened me. And now it's, okay, I can't focus so much here because they don't control this one
1763300	1767040	thing that I'm working on. It's, I need to move over here. And maybe if I'm working over here,
1767040	1773960	I can gauge this and make things happen. So that said, what other resources can we find
1774520	1779740	for everything that you're talking about? So I'll put all these links in a document that you
1779740	1785380	can hand out Nina, but I will tick off a few of them that are going to be in that document. The
1785380	1791340	we published actually a long white paper for Congress. So let's just say it's like
1791860	1799300	publication book level clearance and editorial accuracy for 2016 about the way health privacy
1799300	1804120	is regulated in healthcare and outside of healthcare. And while the names of the companies
1804120	1809260	may have evolved over time, Twitter is still Twitter. Facebook still operates the same way.
1809260	1816220	None of the rules or laws that characterize that description have changed. So that is a public
1816220	1821140	document. If you wanted to look for it right now, you'd Google ONC, non-covered entity report,
1821140	1826380	and it would pop right up. Free, paid by the American taxpayer, no matter who else produces
1826380	1833000	anything, the law firms, the consulting houses, the hacker community, this one is going to be
1833000	1837940	the definitive source because it has to go through so many layers, including approval by the White
1837940	1843120	House before it gets released to Congress. So that will be in there. I will provide some links
1843120	1849160	to educational materials that ONC and Office for Civil Rights publish about more details about how
1849160	1854340	HIPAA works, not only what people's individual rights are, like you as the caregiver, what are
1854340	1858720	your rights for you and your parents to collectively get the information you need to help them with
1858720	1864420	their care, but also for people to understand what are the ordinary disclosures that happen
1864420	1868340	within the health care system to make it run between physicians, between physicians and health
1868340	1873280	plans, etc. So there'll be some of that material in there. And then I'll probably link to some
1873280	1879460	other think tanks in D.C. that are working on the federal privacy law space, and people can
1879460	1884740	look at those organizations' websites and decide what's of interest to them, but it would be
1884740	1890100	Brookings Institute, Future of Privacy Forum, Electronic Frontier Foundation,
1891860	1896320	EPIC, Potentially American Enterprise, New America Foundation, they've all kind of
1896320	1900820	worked in this space. So we'll put some links together that are those people's websites, and
1900820	1909820	you can just go to them and check it out. Lucia, thank you so much. This is the stuff we don't
1909820	1914560	talk about, and that is why this is so important. So thank you for coming. I completely and utterly
1914560	1920080	appreciate your brain space. I'm really happy to be here. I think that the more people
1920080	1924220	who can bring the stories to the floor, the more likely we are to have traction. There's
1924440	1929600	a lot of times when it's the same 300 people having this conversation and bringing the new
1929600	1934580	voices, especially of the next generation when they've been specifically impacted by this,
1934580	1941480	or they understand the technology better than some of our older congresspeople. Awesome.
1941480	1946280	Totally awesome. Thank you. You're welcome. Thanks for having me.