WEBVTT 00:00.000 --> 00:04.300 Hello and welcome to Health Information Privacy Ask an Expert. 00:04.320 --> 00:05.320 I'm Lucia Savage. 00:05.320 --> 00:08.640 I'm currently Chief Privacy and Regulatory Officer at Omada Health. 00:08.640 --> 00:16.500 Before joining Omada Health, I was Chief Privacy Officer at the Health and Human Services Office of the National Coordinator for Health IT. 00:16.540 --> 00:17.680 Yes, that's a mouthful. 00:17.680 --> 00:19.840 You can just say ONC for short. 00:19.840 --> 00:27.440 And that is the agency that not only brought you regulated electronic health records, but also brought you app-based access to your own information. 00:27.460 --> 00:29.580 And we'll talk more about that later today. 00:29.620 --> 00:34.360 I'm really happy to be here today recording live for the Biohacking Village at DEF CON. 00:34.620 --> 00:40.200 As you know, the format of the show is to cover the basics of a topic and then open the mailbag on that topic. 00:40.380 --> 00:44.540 Today, we're covering how health information privacy is regulated in the U.S. 00:44.840 --> 00:50.680 and the difference between health information in the health care system and outside of it, like on social media. 00:50.960 --> 00:56.900 We're also going to cover why there are lots of news headlines on the topic and what the headlines mean for ordinary people. 00:57.300 --> 00:58.700 Let's get started. 00:58.940 --> 01:03.160 I think the best place to start is why do people want health information privacy? 01:03.260 --> 01:04.460 It's pretty simple. 01:04.680 --> 01:10.240 People want health information privacy to prevent them from being treated badly because of their health status. 01:10.600 --> 01:12.660 There's a few very current examples of that. 01:12.660 --> 01:17.220 Just look at Kim Kardashian's note about her husband's mental health situation. 01:17.320 --> 01:21.060 Or if you want a deeper dive, you can read Carrie Fisher's autobiography. 01:21.440 --> 01:28.560 Or you can check out on social media the Royal Highness's campaign to remove mental health stigma in Britain. 01:28.560 --> 01:36.220 All of those are areas where we have specialized privacy rules because we treat people badly when the health information gets out in public. 01:36.220 --> 01:39.420 And there's many, many areas as well, but those are three current examples. 01:40.300 --> 01:56.220 At the same time, it's really important to remember that here, a fifth of the way through the 21st century, digital health information can be used for really important purposes to help us address inequities, address discrimination, improve the care system. 01:56.220 --> 01:58.780 You can't fix what you can't measure. 01:58.780 --> 02:04.980 One example would be many years ago, we started measuring the rate of breast cancer screening in women. 02:05.140 --> 02:14.280 And because we could measure it and identify the physicians that were not ordering mammograms for their patients, we increased the rate of screening and we saved lives. 02:14.280 --> 02:16.360 That's a really early example. 02:16.440 --> 02:28.960 But some more current examples are things like using the data to measure what kind of languages the healthcare providers speak compared to their patients, or using the data to figure out immunization rates. 02:30.300 --> 02:36.400 So using it is important, but keeping it private is important, and therefore we have regulation. 02:36.460 --> 02:43.240 And I thought today I'd talk a little bit about how is health information regulated, and then open it up to questions from the mailbag. 02:43.980 --> 02:48.680 So the first thing I wanted to say is within the healthcare system, there's a very specific set of rules. 02:48.680 --> 02:51.280 You guys will all have heard the acronym HIPAA. 02:51.380 --> 02:55.500 It stands for Health Insurance Portability and Accountability Act. 02:55.500 --> 02:58.500 And you'll notice that there's no privacy in that acronym. 02:58.880 --> 03:05.400 Privacy is a side product of the original effort, which was to digitize the claims data so we could do this measurement. 03:05.700 --> 03:08.440 But we do have a very robust privacy rule. 03:08.440 --> 03:10.900 And in fact, people equate HIPAA with privacy. 03:11.160 --> 03:20.060 And the way that works is the digital health information within the healthcare system is designed by regulation to move around for ordinary healthcare purposes. 03:20.060 --> 03:29.240 For example, if you go to the doctor's office and you have insurance, you want your doctor to bill the insurance company without you having to do extra paperwork, or at least most people do. 03:29.240 --> 03:35.060 There are definitely a subsection of the American population that wants to manage it all themselves, but that's not most of us. 03:35.340 --> 03:39.760 And so that transaction, care transaction is all digital. 03:40.000 --> 03:46.100 And it goes from your doctor's office to your insurance company, so your doctor can get paid and you get billed whatever your co-insurance is. 03:46.100 --> 03:47.380 And we know that could be high. 03:47.380 --> 03:48.660 That's a different panel. 03:49.000 --> 03:50.460 But you don't have to do anything. 03:50.460 --> 03:51.600 You don't have to collect the data. 03:51.600 --> 03:52.880 You don't have to send it somewhere. 03:52.880 --> 03:54.280 It doesn't have to be printed out. 03:54.280 --> 03:56.620 And all that is designed to happen normally. 03:56.780 --> 04:09.440 In addition, the regulations are also designed to let us do this normalized measurement, to measure that breast cancer screening rate, to measure that immunization rates, to measure language, to measure how expensive it is. 04:09.440 --> 04:11.600 And there's lots and lots of examples of that. 04:11.820 --> 04:21.840 But the last thing is the regulations are designed to not allow the data outside of the healthcare system in an identifiable way without you giving permission to it. 04:21.840 --> 04:33.900 And I don't have time today to give you very specific and detailed technicalities of the regulations, but I will be providing a list of public resources where you can dig in yourself about that. 04:33.900 --> 04:36.580 That's the basics of within the healthcare system. 04:36.580 --> 05:02.360 But again, here we are, it's 2020, almost 2021, and we have lots and lots of health information that's either directly collected from individuals that's outside the healthcare system, like fitness trackers and social media sites, or where we use data that's like grocery shopping data or banking data or driving data to impute health information about people from other data sets. 05:02.360 --> 05:08.280 And all of that, not being in the regular healthcare system, is subject to a completely different regulatory scheme. 05:08.760 --> 05:12.940 So that regulatory scheme is basically about consumer privacy protection. 05:12.940 --> 05:24.540 So it's really the same rules apply to the health information Facebook collects as apply to the fashion information Facebook collects, or the dining information your social media account collects. 05:24.540 --> 05:26.300 It's all the same set of rules. 05:26.320 --> 05:31.900 And that basic construct is, did the organization tell you what it was going to collect? 05:31.900 --> 05:34.120 We can have a long conversation about notice. 05:34.360 --> 05:36.960 And were they honest about it? 05:36.960 --> 05:39.640 So were their actions what they said they were going to be? 05:39.640 --> 05:43.000 Or did they lie about their actions or mislead you about their actions? 05:43.000 --> 05:47.800 So it sounds really good in concept, but very, very hard to prove in the detail. 05:48.540 --> 06:01.260 The ability to prove those consumer violations lies primarily with the Federal Trade Commission, which is a federal agency not in the healthcare system, and as well with state attorneys general. 06:01.760 --> 06:08.260 Then as the 21st century has gone on from 2000 to the present, states have begun to take a role. 06:08.260 --> 06:19.060 And so we have state breach notification laws to protect us from consumer harm when our consumer data is collected and then breached or misused or misdisclosed. 06:19.060 --> 06:26.880 And we have states also beginning to take specific action about health information outside of the healthcare system. 06:27.260 --> 06:34.020 The last thing I want to say about this interplay between inside the healthcare system and outside the healthcare system has to do with states. 06:34.100 --> 06:39.960 So the federal law, HIPAA, is a it's the floor of regulation. 06:39.960 --> 06:45.720 And many states have very specific laws about, in general, clinical verticals. 06:45.720 --> 06:56.760 So they'll have specific laws about HIV AIDS or specific laws about mental health data or specific laws about domestic violence or sexually transmitted diseases. 06:56.760 --> 07:07.660 There's eight or so key areas, and they'll have a specialized rule about that and who gets to use it and what is permission required and do you have to consent to the release of your data. 07:07.720 --> 07:10.440 And all of those rules sit on top of HIPAA. 07:10.500 --> 07:17.900 So in the healthcare system, if you're a healthcare provider like Omada is, you have to think about HIPAA and you have to think about all your state laws. 07:18.120 --> 07:28.080 But again, those laws are about the healthcare system itself and not about particular kinds of data outside the healthcare system in the consumer setting. 07:29.120 --> 07:31.560 Finally, we have an emerging set of laws. 07:31.560 --> 07:35.100 Many people here will have heard of the California Consumer Privacy Act. 07:35.160 --> 07:46.860 And many people, I'm a California resident, will know that we have a ballot initiative coming to us in November where we can vote on an additional privacy law that, ironically enough, the privacy advocates are fighting about whether it's any good. 07:46.860 --> 07:48.560 That's also a conversation for another day. 07:48.560 --> 07:50.140 You can look that up on social media. 07:50.160 --> 08:05.740 But other states are looking to California to see what it does and whether there are things those states can copy from the California landscape to protect their own residents in the absence of federal regulation, which takes me to my final point. 08:05.860 --> 08:08.200 There have been a lot of headlines about this. 08:08.220 --> 08:08.700 Mr. 08:08.700 --> 08:11.800 Zuckerberg has been in front of Congress many times. 08:12.080 --> 08:17.620 Leaders from Google, leaders from Twitter, all have been in front of Congress talking about privacy. 08:17.720 --> 08:20.680 It is an important federal policy question. 08:20.680 --> 08:38.780 And the important question is, will the federal government change anything in the federal landscape to augment the FTC powers, to make the consumer rights more meaningful, to make the consumer rights more particularized, to healthcare information outside of the healthcare system? 08:38.880 --> 08:42.280 So these conversations started in the wake of Cambridge Analytica. 08:42.280 --> 08:47.340 A lot of us privacy advocates had great hopes for something happening. 08:47.340 --> 08:51.540 Remind you, Cambridge Analytica was two years ago now, a little bit more than two years ago now. 08:51.540 --> 08:53.840 So politics moves very, very slowly. 08:54.020 --> 08:55.380 It's an election year. 08:55.380 --> 08:56.800 We have COVID. 08:58.200 --> 09:00.520 Conventional wisdom says nothing's going to happen this year. 09:00.520 --> 09:02.800 And then it's very complicated politically. 09:02.800 --> 09:08.300 There are three or four committees on the Senate side, another half a dozen committees on the House side. 09:08.300 --> 09:10.320 Each of them has jurisdiction. 09:10.700 --> 09:22.840 If you went back to I'm just a bill from School House Rock, you would realize you have to have a bill on each side, then they have to come together and come to a compromise bill, and then both houses have to pass it again, and then the president has to sign it. 09:22.840 --> 09:24.600 So lots and lots of moving parts. 09:25.200 --> 09:32.540 Lots of opportunities, therefore, for people who are interested to still make their voices heard, and we'll talk about that a little bit later. 09:33.340 --> 09:37.680 Eventually, I think we will have something national, but it could take another two to four years. 09:37.680 --> 09:40.660 So I have somebody with me today to help me read the mail. 09:40.660 --> 09:42.000 My friend Nina. 09:42.120 --> 09:43.720 Nina, what's in the mailbag? 09:44.260 --> 09:45.340 First question. 09:46.020 --> 09:52.640 What are the big issues that are being debated in Congress about a nationwide privacy law? 09:53.000 --> 09:57.960 I think the two biggest issues are one is what we call preemption. 09:57.960 --> 10:04.860 So that is the idea that the federal law overtakes and supersedes any active state law. 10:04.940 --> 10:14.400 So if you think about the CCPA construct, if there were a federal law, and if it were preemptive, it would override whatever California enacts in its own law. 10:14.400 --> 10:24.640 So you can see that that could be really contentious because some states might want to be more aggressive or more protective of their consumers than other states or than the federal government. 10:25.440 --> 10:30.700 On the flip side, however, is the more laws there are, the harder it is to assure compliance. 10:30.700 --> 10:36.140 So from a consumer perspective, it might actually be better to have one single law that applies the same everywhere. 10:36.300 --> 10:40.760 So you don't have to be confused or have your rights change as you cross state lines. 10:40.760 --> 10:43.000 Many, many complex trade-offs there. 10:43.240 --> 10:49.080 The other big issue is should individuals be able to bring their own lawsuits for breaches of privacy? 10:49.400 --> 10:54.260 Now, there's a very long complicated history about lawsuits and privacy and damages. 10:54.660 --> 10:57.900 But at the end of the day, it's about how does this get enforced. 10:57.900 --> 11:02.160 So right now, outside of health care, the FTC brings an action. 11:02.660 --> 11:07.060 Consumers under their individual state laws may or may not have the right to sue. 11:07.060 --> 11:11.080 And in health care, consumers have no personal rights under HIPAA to sue. 11:11.640 --> 11:15.680 A federal law could change all that by giving individuals the right to sue. 11:15.680 --> 11:21.320 That can be a really effective enforcement mechanism, as has been true for automobile safety, for example. 11:21.940 --> 11:22.480 Right? 11:22.680 --> 11:25.520 Cars are safer because Ford got sued over the Pinto. 11:25.860 --> 11:29.940 But it also can make the cost of the business much more expensive. 11:29.940 --> 11:33.540 It can be a barrier to innovation because you have to worry about being sued. 11:34.000 --> 11:40.020 There are a lot of downstreams to widely available, empowering a lot of people to bring a lawsuit. 11:40.020 --> 11:41.540 So again, trade-offs there. 11:41.540 --> 11:45.500 Those are probably the two biggest issues that people cannot agree on. 11:47.500 --> 11:49.420 Why can't people get to yes? 11:51.000 --> 11:53.820 There are a lot of economic interests involved in that. 11:53.820 --> 12:03.760 So you can see that the trial attorneys want to make money off the lawsuits, but the small businesses and the innovation community and the venture capitalists want to keep growing new businesses with new ideas. 12:03.760 --> 12:06.780 And they don't want the threat of lawsuits hanging over their heads. 12:06.780 --> 12:08.620 Compliance can be complicated. 12:08.860 --> 12:10.880 There are philosophical differences. 12:10.880 --> 12:17.120 There are people who definitely believe in empowering consumers to sue, and people who don't believe in empowering consumers to sue. 12:17.120 --> 12:19.600 Those fall across the political spectrum. 12:19.840 --> 12:30.460 And that's probably why we can't get to yes, is there isn't enough people in any one particular place on that spectrum to balance the scales to a yes, right? 12:30.460 --> 12:33.240 You have to have a majority vote in both sides. 12:34.320 --> 12:37.460 So what's the impact of CCPA? 12:38.400 --> 12:45.560 So in the healthcare system, CCPA has a very specific carve-out for organizations that are actually already covered by HIPAA. 12:45.560 --> 12:53.100 For example, Omada would fall into that bucket, except for our public website that in a casual... you guys might be browsing it right now. 12:53.100 --> 12:56.540 But our program itself is healthcare delivery, and it's within HIPAA. 12:56.680 --> 13:09.520 But if you are a company who is collecting health information, for example, because you are running a business that offers consumers gift cards to answer surveys about their health conditions, that might be a business model. 13:09.520 --> 13:13.520 That's not within the healthcare system, and CCPA is going to apply. 13:13.620 --> 13:15.560 And all the rules of it are going to apply. 13:15.560 --> 13:21.520 Of course, it's a little bit of a moving target because the law was enacted a year ago. 13:21.520 --> 13:25.480 It took effect in January, but the regulations didn't take effect till July. 13:25.480 --> 13:27.540 And actually, they didn't get finalized till last week. 13:27.540 --> 13:36.100 And that might be upended by a ballot initiative, and who knows what's going to happen if there's court action about the ballot initiative. 13:36.880 --> 13:39.320 I'm not an expert on CCPA. 13:39.320 --> 13:41.600 I think it's something that's really important to people. 13:41.600 --> 13:49.640 But to me, the most important part of it from a consumer is knowing that I can go and say to that organization, what did you collect about me? 13:49.640 --> 13:51.580 And can I please have a copy of it? 13:51.580 --> 13:54.800 That's a really important thing for consumers who want to take action. 13:55.340 --> 13:56.860 I completely agree with that. 13:56.860 --> 14:00.720 So if anything, did COVID change? 14:01.620 --> 14:06.860 You know, COVID hasn't changed very much in the landscape, the overall regulatory landscape. 14:06.860 --> 14:13.880 There have been a couple of little things that have eased because of the public health emergency, but that easement is temporary. 14:13.920 --> 14:33.760 But I think in terms of health information, what the impact COVID has had is really given more people a stronger sense of the possibility that digital health has for us as a way of getting care, maintaining our health, getting the coaching or the assistance we need when we can't go to the doctor's office. 14:33.760 --> 14:42.700 And because of that, I mean, it's great for a digital health company like Omada, but because of that, people are now going to be thinking about their health information a lot more. 14:42.700 --> 14:43.560 That's one. 14:43.560 --> 15:06.860 The second one is I think that the arrival of big tech at the COVID moment with their wide variety of contact tracing apps, you know, that Facebook both runs ads for legitimate academic research about COVID and also runs not legitimate, you know, links to things that are not legitimate research. 15:07.480 --> 15:20.180 Arriving as it has two years after Cambridge Analytica, I think we're suffering from the skepticism that Cambridge Analytica brought to the doorstep of health information outside of HIPAA, really and truly. 15:20.180 --> 15:23.080 People are concerned about the contact tracing apps. 15:23.080 --> 15:24.700 The uptake is very low. 15:24.960 --> 15:34.360 It even bleeds over into human-to-human contact tracing, where I might call you, Nina, and say, hey, you know, it looked like you were at that concert, or did you know there was a big concert? 15:34.360 --> 15:35.100 And were you there? 15:35.100 --> 15:35.860 And who were you with? 15:35.860 --> 15:36.940 And who were they with? 15:36.940 --> 15:39.460 And that's, you know, contact tracing. 15:39.460 --> 15:46.220 We've been doing it for decades, really centuries, because we do contact tracing for sexually transmitted diseases that are contagious. 15:46.320 --> 15:50.900 And so we also have erosion of trust of the human-to-human contact tracing. 15:50.900 --> 15:53.900 And we'll suffer from that as a society for a while. 15:55.940 --> 15:59.620 How important is this issue to Congress? 16:01.440 --> 16:03.020 You know, it's a little bit of... 16:03.020 --> 16:04.800 I hope they get a drink of water before this question. 16:05.420 --> 16:09.000 You know, it's a little bit of Kentucky windage, right? 16:09.080 --> 16:11.660 Issues are important that constituents care about. 16:12.860 --> 16:16.860 And that's pretty much how the democratic process works. 16:17.100 --> 16:20.400 So, right now, constituents care about COVID. 16:20.480 --> 16:25.540 And some constituents care about election security, which is hugely important. 16:27.040 --> 16:32.540 We won't get a privacy anything this year, although I know there are still people working on little pieces of privacy. 16:32.540 --> 16:37.400 I saw a draft bill the other day about COVID and contact tracing apps about a month ago. 16:37.660 --> 16:44.280 But if you as a constituent think this is important, you should tell your congressperson, House or Senate. 16:44.280 --> 16:50.960 And in fact, if you have a senator or a representative who's on a committee of jurisdiction, you should most definitely tell them. 16:51.080 --> 16:59.760 If you think back to 2017, and the original attempts in the current administration to undermine the Affordable Care Act, who went to Congress? 16:59.820 --> 17:02.660 People with sick children and sick family members. 17:02.800 --> 17:04.440 And they were constituents. 17:04.460 --> 17:07.780 So, you know, you call over there, and they will ask what your zip code is. 17:07.780 --> 17:10.140 And you should be honest about that. 17:10.140 --> 17:16.940 I happen to have a representative who chugs along doing what I think is right without ever having me ever having to call her. 17:16.940 --> 17:21.600 But I can imagine being in a different state and having to call my representative every week. 17:22.680 --> 17:29.640 Or ask for an appointment for the office with local staff to say, Hey, did you know this is happening? 17:29.640 --> 17:34.860 And this is how it's impacting our community and me, and you should fix it. 17:35.020 --> 17:37.660 Noise squeaky wheels totally get the grease in politics. 17:37.660 --> 17:39.500 So that's when it becomes important. 17:40.740 --> 17:41.800 Perfect segue. 17:41.800 --> 17:47.540 So how can the biohacking community get involved and move the needle on issues in privacy? 17:48.140 --> 17:59.420 I think there are a few things I'm going to sort of try to list as many as I can in this materials, of bills that people might want to look at and committees of jurisdiction and where you go. 17:59.420 --> 18:00.500 But it's pretty simple. 18:00.500 --> 18:06.720 If you want to know, you go to finance.senate.gov and you look at the members and you figure out if they're your senator. 18:07.480 --> 18:14.000 And then you call your Senate's office, you call them and you say, I'm Lucia Savage, and I'm a resident of blah, blah, blah state. 18:14.000 --> 18:16.980 And I understand that you're looking at such and such an issue. 18:16.980 --> 18:18.440 Here's what I think about it. 18:18.740 --> 18:24.460 And if you have a bunch of friends, you know, you can do a house party and everyone can get on their cell phone. 18:24.460 --> 18:25.620 You can call serially. 18:26.180 --> 18:30.820 You can email, but it's probably not as carefully read or paid attention to as a phone call. 18:31.420 --> 18:33.840 You can do a house party after COVID. 18:34.160 --> 18:37.240 You can do a well, well, you could do a virtual house party, right? 18:37.240 --> 18:42.120 Like set it up on zoom, you can have all the contact information on a document that you're sharing. 18:42.180 --> 18:47.900 People can just, you know, call on mute, they were talking, just have a good time. 18:49.260 --> 18:54.460 So how can biohackers be more involved in the privacy needs and changes that are taking place? 18:54.460 --> 18:59.380 How do we get people to listen aside from talking to our congressional person? 18:59.840 --> 19:02.960 So I think stories are really, really important. 19:03.400 --> 19:05.340 People listen to stories. 19:05.340 --> 19:11.760 So I'm always compelled by, that's why I love that the reference to Kim Kardashian or Carrie Fisher, right? 19:11.760 --> 19:15.880 It gives us a context for why people have privacy issues. 19:15.880 --> 19:18.400 Why are we working on mental health? 19:18.400 --> 19:19.680 Why is there so much stigma? 19:19.680 --> 19:21.620 How do we remove the stigma? 19:21.620 --> 19:23.660 And we analogize that to privacy. 19:23.660 --> 19:34.720 So in your family or in your community, what has been a bad impact of poor privacy practices or poor security practices for that matter? 19:34.720 --> 19:36.460 How has it impacted people? 19:36.460 --> 19:44.860 Whether it's a neighbor who got doxxed and somebody, you know, something terrible happened to them or people that you know, or even yourself. 19:45.180 --> 19:51.680 That's how we got anti-doxxing legislation is people went to their representative and said, hey, this happened to me and there ought to be a law. 19:52.380 --> 19:57.160 So it's really about stories and it's very, politics is very personal. 19:57.640 --> 20:09.200 It's, you know, there are white papers, there are studies, there is data, we can explain all that, but it's really the compelling personal stories that tip the scales when somebody's on the edge. 20:09.200 --> 20:14.900 It's the story about the constituent that's going to push somebody where you want them to go. 20:16.320 --> 20:24.880 And since I don't know about everyone's personal life, who might be listening to this, it's really hard for me to know after that, like what would be a story that would be compelling. 20:24.960 --> 20:35.380 But I know I had a, my mother was bipolar and in all my work as a privacy advocate, and particularly the work I did in the last administration, I would always talk about that. 20:35.380 --> 20:36.520 Like, I get it. 20:36.520 --> 20:37.720 I get stigma. 20:37.720 --> 20:39.180 I get why this is important. 20:39.180 --> 20:41.940 And I get why we need to understand it better. 20:43.800 --> 20:46.020 Can I have my personal moment in here? 20:46.140 --> 20:47.100 Absolutely. 20:47.620 --> 20:54.640 So I give this story a lot about why I'm in healthcare and why this matters so much to me. 20:54.840 --> 21:00.840 My father, fire department of New York, paramedic captain, he was at 9-11. 21:01.880 --> 21:05.740 My mother, stage four, one of the rarest cancers in the world. 21:05.740 --> 21:06.740 And I learned about it. 21:06.740 --> 21:10.600 I learned about both of their, their health issues the same week. 21:10.900 --> 21:12.000 Oh my God. 21:12.140 --> 21:18.820 So my father's issue was that he has bilateral lung nodes from being at the World Trade Center. 21:18.820 --> 21:19.800 Right. 21:19.960 --> 21:25.800 And it's that, it's that very compelling story of I suddenly became a caretaker. 21:25.800 --> 21:27.860 My parents were super independent. 21:27.860 --> 21:28.960 They were doing their things. 21:28.960 --> 21:31.740 And now it's, I own all of their medical data. 21:31.740 --> 21:35.060 I have all of their physician numbers in my phone. 21:35.060 --> 21:38.840 And if something happens, I immediately make a call for them. 21:38.840 --> 21:47.000 And if I'm not available, we, they, they understand that they, the physicians will call me right after to give me that data and the update of their condition. 21:47.120 --> 21:56.760 So I'm, I'm complete agreement with the story is so compelling because we all have something that we can talk about and gives us that emotion to say, there needs to be a change. 21:56.760 --> 21:57.580 It's not a question. 21:57.580 --> 21:59.760 I'm not asking you and telling you that moment. 21:59.960 --> 22:00.940 Two things. 22:00.940 --> 22:11.720 If you think back about the 9-11 fund and you'll remember that Jon Stewart was on that like a dog on a bone week after week, it was embarrassing. 22:11.900 --> 22:17.160 He was intentionally embarrassing the politicians with these really compelling stories and it worked. 22:17.160 --> 22:18.540 So think about that. 22:18.540 --> 22:29.180 The other thing I would say, just on a personal note, Nina, and I don't know if we have time today, but you know, caretakers, we, we are, we baby boomers are a pretty big population and our kids are going to be taking care of us. 22:29.180 --> 22:38.920 And we should all have the ability as a caretaker, not just to call your parents doctor and have them call back, but have online on your phone access to their records. 22:38.920 --> 22:40.480 If they want you to have it. 22:40.480 --> 22:44.000 I had that for my mom through the Kaiser app, she authorized it. 22:44.000 --> 22:46.120 It meant I could help care for her. 22:46.120 --> 22:48.700 And she could call me and say, I don't understand this thing. 22:48.700 --> 22:49.780 What does it mean? 22:49.780 --> 23:02.280 And that is what digital health really means is not keeping data sacrosanct in a box under a cement floor, but putting it where it needs to be and where the patient wants it to be to get the care that they need. 23:02.280 --> 23:05.640 And if that's with a family member, let the family member know. 23:05.640 --> 23:09.160 If that's with a friend from church, let the friend from church know. 23:09.240 --> 23:18.520 If that's you as a person, you're a DIY healthcare person, and you want to broadcast your health status on that big billboard at Times Square, go right ahead. 23:18.520 --> 23:19.280 It's your data. 23:21.120 --> 23:29.460 How do the agencies that command and control healthcare, how do they work together or how do they not work together? 23:29.660 --> 23:31.260 Sure, that's a great question. 23:31.260 --> 23:37.840 And something I forgot earlier on, I wanted to be super clear about who really has authority over privacy. 23:37.840 --> 23:44.100 So in the federal realm, it is solely the Health and Human Services Office for Civil Rights. 23:44.100 --> 23:53.500 They write the privacy regulation, they write the security regulation, they investigate those, they fine people for them, and they enforce them. 23:53.500 --> 24:10.100 Now the FDA, which has a lot to say about digital tools, their remit or their jurisdiction is really about, is the thing safe, clinically safe, like it's not going to cause you, you know, a glucometer isn't going to burn your arm, or whatever. 24:10.100 --> 24:14.580 And is it doing clinically what you say it's going to do? 24:14.580 --> 24:18.180 So remember, it's the Food, Drug, Action, Cosmetics Act. 24:18.180 --> 24:30.980 And the enabling legislation, which dates back to Teddy Roosevelt, is about not having health products in the field that are dangerous. 24:31.460 --> 24:32.200 Right? 24:32.200 --> 24:35.060 And actually, the FDA covers veterinary science as well. 24:35.060 --> 24:37.100 So just think about that in totality. 24:37.100 --> 24:39.220 So I love Bakul. 24:39.220 --> 24:46.880 I know everybody over there, great crowd, really interested in privacy as a concept, but they don't actually regulate privacy. 24:46.880 --> 24:59.400 What they regulate is, did your device that has software in it, secure that software sufficiently that the device data is still accurate and has integrity? 25:00.300 --> 25:02.580 That's pretty much what they regulate. 25:02.860 --> 25:04.660 So that's the FDA. 25:04.740 --> 25:12.620 And then HHS-OCR writes the privacy rule, that applies to health insurance companies, employer-sponsored coverage. 25:12.620 --> 25:25.200 If you have a big employer, like you're at an Apple or Google or health sponsor coverage, physicians or any other provider who bills the government electronically, and then some additional intermediate companies called clearinghouses. 25:26.840 --> 25:31.920 There's always a lot of talk around the medical devices and the security that surround those. 25:31.920 --> 25:37.660 But one of the parts that are normally lacking in conversation are the electronic medical records. 25:37.660 --> 25:41.180 And you talked before about the ONC owning them. 25:41.340 --> 25:44.860 So what's, how does that link in with the agency? 25:45.120 --> 25:45.600 Sure. 25:45.980 --> 25:49.020 So the ONC has three specific powers. 25:49.020 --> 25:54.520 The first one is they write a regulation about what the software in a certified EHR has to do. 25:54.620 --> 25:57.520 And they're EHRs that are not certified, by the way. 25:57.840 --> 26:04.720 So if you have a certified EHR, it has to have these minimum functional requirements, and they've been getting more and more rigorous as time has gone by. 26:04.720 --> 26:12.760 The second thing they have is to educate the provider workforce, primarily, especially the small doctor's offices. 26:12.760 --> 26:19.900 Remember, while there's some really big systems, most healthcare is provided in very small business practices that have two or three physicians in them. 26:19.900 --> 26:29.620 So educate the physicians and the nurses and the people out in the field about how to safely, privately, and securely use EH, use certified EHRs to deliver care. 26:29.620 --> 26:36.580 And the third is to run the policymaking for the agency about both what that software package should be. 26:36.580 --> 26:46.340 It's a very unusual power, a federal agency that writes a prescriptive rule for software, but also, in general, about health information technology policy writ large. 26:46.380 --> 26:53.780 So for example, ONC has a specific duty of coordinating Office of the National Coordinator across agencies. 26:53.780 --> 27:03.980 And I might bring people to the table that would be the FDA and the FTC and Office of Civil Rights to stand up a tool that in fact exists. 27:03.980 --> 27:08.000 So on the FTC website is the mobile health app developer tool. 27:08.020 --> 27:20.120 And if you were to go to that tool, you would see in kind of a Q&A fashion, it moves you through a flowchart to help you make sure if you're a developer, you know which rules you have to deal with for the thing you're envisioning. 27:20.240 --> 27:23.200 So that's an example of coordinating across the agencies. 27:23.340 --> 27:28.420 Enforcement is not really a coordinating event in federal law. 27:28.420 --> 27:38.080 Generally, I'm making a very broad statement, but you know, OCR has its remit and a privacy breach is investigated by OCR and they investigate every single one that's reported to them. 27:38.480 --> 27:45.240 A safety violation by a device would be investigated by the FDA, if that makes sense. 27:45.240 --> 27:51.620 And then, of course, all of these agencies are within Health and Human Services, which is an agency run by Secretary Azar. 27:51.640 --> 28:00.580 And so how the agencies work together is really a factor of whether the secretary is making them work together and how much. 28:00.580 --> 28:03.300 Different secretaries have different approaches to that. 28:03.300 --> 28:05.720 The FDA is a very big agency. 28:05.720 --> 28:07.020 It's called an operating division. 28:07.020 --> 28:13.940 It's kind of freestanding and runs on its own, but the FDA administrator would be part of Azar's sort of kitchen cabinet or his cabinet. 28:14.100 --> 28:17.880 Similarly, CMS, operating division, kitchen cabinet. 28:17.880 --> 28:20.900 NIH, operating division, but in the cabinet. 28:20.960 --> 28:32.140 And then, ONC, Office for Civil Rights, actually report directly through the secretary, also in the cabinet, but literally under more of the secretarial vertical, if you can imagine that. 28:32.940 --> 28:34.480 So how do they work together? 28:34.480 --> 28:36.020 Let me just see if I can summarize it up. 28:36.240 --> 28:44.220 I think the staff work really well together when they're asked to, but people also have very specific portfolios and work that needs to get done. 28:44.220 --> 28:45.860 And so they really focus on that. 28:46.920 --> 28:57.660 So I want to be clear with people that you and I have met once and it was in a coffee shop and I watched you walk in and the conversation we had was extremely powerful. 28:57.660 --> 29:05.420 And I instantly knew that you had so much information that you needed to share it. 29:05.420 --> 29:11.860 And the, I feel like the community that we work in, we focus a lot on the medical devices because it's something very tangible that we can get our hands on. 29:12.060 --> 29:19.700 And this, even with all the knowledge that I have on how things function, this has engaged me and enlightened me. 29:19.700 --> 29:24.320 And now it's, okay, I can't focus so much here because they don't control this one thing that I'm working on. 29:24.320 --> 29:25.800 It's, I need to move over here. 29:25.800 --> 29:29.220 And maybe if I'm working over here, I can gauge this and make things happen. 29:29.360 --> 29:36.260 So that said, what other resources can we find for everything that you're talking about? 29:36.820 --> 29:43.860 So I'll put all these links in a document that you can hand out Nina, but I will tick off a few of them that are going to be in that document. 29:44.980 --> 29:49.360 The we published actually a long white paper for Congress. 29:49.360 --> 30:01.880 So let's just say it's like publication book level clearance and editorial accuracy for 2016 about the way health privacy is regulated in healthcare and outside of healthcare. 30:01.880 --> 30:07.500 And while the names of the companies may have evolved over time, Twitter is still Twitter. 30:07.500 --> 30:09.260 Facebook still operates the same way. 30:09.260 --> 30:15.180 None of the rules or laws that characterize that description have changed. 30:15.180 --> 30:16.800 So that is a public document. 30:16.800 --> 30:22.540 If you wanted to look for it right now, you'd Google ONC, non-covered entity report, and it would pop right up. 30:22.700 --> 30:40.060 Free, paid by the American taxpayer, no matter who else produces anything, the law firms, the consulting houses, the hacker community, this one is going to be the definitive source because it has to go through so many layers, including approval by the White House before it gets released to Congress. 30:40.060 --> 30:41.340 So that will be in there. 30:41.480 --> 30:59.180 I will provide some links to educational materials that ONC and Office for Civil Rights publish about more details about how HIPAA works, not only what people's individual rights are, like you as the caregiver, what are your rights for you and your parents to collectively get the information you need to help them with their care, 30:59.180 --> 31:09.280 but also for people to understand what are the ordinary disclosures that happen within the health care system to make it run between physicians, between physicians and health plans, etc. 31:09.280 --> 31:11.700 So there'll be some of that material in there. 31:11.700 --> 31:15.140 And then I'll probably link to some other think tanks in D.C. 31:15.140 --> 31:34.620 that are working on the federal privacy law space, and people can look at those organizations' websites and decide what's of interest to them, but it would be Brookings Institute, Future of Privacy Forum, Electronic Frontier Foundation, EPIC, Potentially American Enterprise, 31:34.620 --> 31:37.220 New America Foundation, they've all kind of worked in this space. 31:37.220 --> 31:42.780 So we'll put some links together that are those people's websites, and you can just go to them and check it out. 31:43.220 --> 31:45.520 Lucia, thank you so much. 31:48.620 --> 31:52.420 This is the stuff we don't talk about, and that is why this is so important. 31:52.420 --> 31:53.520 So thank you for coming. 31:53.520 --> 31:56.520 I completely and utterly appreciate your brain space. 31:56.960 --> 31:58.760 I'm really happy to be here. 31:58.760 --> 32:04.120 I think that the more people who can bring the stories to the floor, the more likely we are to have traction. 32:04.120 --> 32:20.400 There's a lot of times when it's the same 300 people having this conversation and bringing the new voices, especially of the next generation when they've been specifically impacted by this, or they understand the technology better than some of our older congresspeople. 32:20.660 --> 32:21.480 Awesome. 32:21.480 --> 32:22.800 Totally awesome. 32:23.640 --> 32:24.760 Thank you. 32:24.760 --> 32:25.520 You're welcome. 32:25.520 --> 32:26.280 Thanks for having me.