Deven McGraw, Director of the Health Privacy Project at the Center for Democracy and Technology

(Music)

Mark Masselli: This is Conversations on Health C are . I am Mark Masselli.

Margaret Flinter: And I am Margaret Flinter.

Mark Masselli: Well Margaret , we are seeing a flurry of activity across the nation
a s states jockey into position with the health insurance exchanges , even those
states who have declined to set up their own state - bas ed ex changes.

Margaret Flinter: And in states like Texas and Oklahoma , the so - called Red
States where opposition to the Affordable Care Act has been fierce , ther e are
marketing campaigns underway now from various non - government sectors
seeking to inform residents about the health care law.

Mark Masselli: Blue Cross Blue Shield is going to offer plans in all 50 states in
both the state - bas ed ex changes as well as the federal exchanges and the
insurance company is focusing its promotional effort in those states deferring to
the fe deral government w here there is little or no promotion underway due to
political resistance.

Margaret Flinter: Well it's particularly im portant in those states like Oklahoma
where 20% of the population is uninsured and most of the folks will qualify for
some kind of subsidy on the exchange s . So getting the message out about
Obamacare continu es to pose perhaps the biggest challenge a s we r oll towards
full implementation.

Mark Masselli: And of course they are still talking in Congress about holding up
st
the national budget on October 1 , if any of the budget has funds dedicated to
the promotion of the Affordable Care Act.

Margaret Flinter: Some day Mark this will all be a memory and hopefully near
universal insurance will be the law of the land. But it will be interesting to see
st
how consumers navigate the exchanges after October 1 when the y officially
open for business. In Connecticut , exchange director Kevin Counihan expects
th at we are not going to see significant p articipation in the exchanges until after
the first of the year and more likely closer to the March deadline for signing up for
the exchanges . That’s when he thinks folks will get to either that comfort level o r
necessity level with the online insurance marketplaces.

Mark Masselli: And they will also be motivated by the promise of a tax subsidy
as well . The bottom - line here is that many millions of Americans who have
exi sted outside the protection of decent health coverage will soon have the
confidence of knowing they are covered both for preventative as well as
catastrophic care.

Margaret Flinter: An d Mark , there i s one area that we really haven’t spent a lot of
time t alking about on the show but it's critical to patients and providers as well
and that’s the entrusting of data to the system , the assurance of patient privacy ,
and that’s something our guest today has been analyzing for years.

Mark Masselli: Deven McGraw is Director of the Health Privacy Project at the
Center for Democracy & Technology . She will be talking about their effort to
promote legislation that will protect patient health data w hile also enhancing
systems that will effectively share data to promo te research and quality
improvement.

Margaret Flinter: And we get to have another visit from Lori Robertson,
Ma naging Editor of FactCheck.org who is always on the hunt for misrepresented
facts in health policy.

Mark Masselli: But as always , no matter w hat the topic , you can hear all of our
shows by Googling CHC Radio .

Margaret Flinter: And if you have comments or questions , please reach out to us
at www.chcradio.com or find us on Facebook or Twitter because we love hearing
from you.
Mark Masselli: But first , here is our producer Marianne O'Hare with this week's
Headline News.
(Music) Marianne O'Hare: I am Marianne O 'Hare with th e s e Healthcare Headlines .
Michigan and Medicaid e xpansion , the state ’ s leadersh ip had originally refused
expansion of Medicaid under the Affordable Care Act to include half a million uninsured low income residents but they have since changed their tune and recently voted to expand Medicaid in that state . The vote positions Michigan to
become the largest state control led by Republicans to support a major
component of the new federal health care law. Meanwhile, Medicaid e xpansion
and the rural poor , it appears many will be left out in the cold when it comes to
coverage . A study publi shed in a recent edition of The Economist shows many
of the nation ’ s rural poor live in states that have opted out of Medicaid e xpansion
to cover more low income residents . More than half the nation ’ s low income
residents live in th e s e rural settings .
Me anwhile, in Texas, where they are no t expanding Medicaid under the
Affordable Care Act , the move is going to generate close to a 10% increase in
insurance premiums for the un insured . About 1.3 million uninsured low income
or self - employe d Texans would hav e qualified to gain coverage under Medicaid
e xpansion. The premium hike is expected because folks in the low income

bracket tend to be less healthy and their health care cost s will have to be
shouldered by the industry.

Good news under the World Health O rganization , women are living longer
globally but there is still much work to do . While life expectancy has grown
globally for women around the world w ho a re over 50 , still far too many die early
from preventable causes like undiagnosed early stage cancer s and uncontrolled
heart disease. While the report suggests more comprehensive preventive care i s
needed , we can look to Japan for some answer s . There, women live on average
longer than any other nationality. I will have the seaweed and sushi please. I am
Marianne O'Hare with th e s e Healthcare Headline s .

(Music)

Mark Masselli: We are speaking today with Deven McGraw , Director of Health
Privacy Project at the Center for Democracy & Technology, which is focused on
developing workable privacy and securit y protections for electronic personal
health information . Ms. McGraw was appointed by Health & Human Services
Secretary Kathleen Sebelius to serve on the Health Information Technology
Policy Committee . Ms. McGraw holds a Master ’ s in Public Health from Jo hns
Hopki ns and a law degree from George to wn where she was the Executive Editor
of the Law Journal . Ms. McGraw , welcome to Conversation s on Health Care.

Deven McGraw : Thank you very much . I am very glad to be here.

Mark Masselli: So Deven , you have b een at the forefront of one of the most fluid
areas of health reform , and that’s the protection of patient health data and
privacy . And the HITECH Act , which was part of the Stimulus Bill , provided
billions of dollars and incentives for hospitals and prac tices to make the switch to
electronic health records. So first , give us an assessment of the scope of
changes that has occurred in terms of electronic health record adoption and why
these convergent policies to protect the privacy of patient health infor mation are
so vital to th e success of building this new HIT infrastructure.

Deven McGraw: Sure . I think people don’t realize that efforts to refo rm the
health care system really began back in 2009 with the enactment of the Stimulus
legislation which inc luded billions of dollars in tax incentives to facilitate the
adoption and use of electronic medical records by health care providers, doctors
and hospitals. And we are well into the implementation of that program, which
began in 2011 a nd what we have rea lly seen has been a pretty astronomical rate
of adoption , much more th an was expected of digital health records by hospitals
in particular and even physicians . I think well more than three quarters in fact of
hospitals , of eligible hospitals , have adopted , and physicians eligible for the
program we have about half of them having implemented electronic health
records , and that’s a really good sign . But obviously , the digitization of data that
used to be kept customarily in paper records raises a number of privacy issues

and security issues as well . And it's when you digitize a record , it really
magnifies the potential when a mistake or a misuse of a record occur s.

So breach of records is a perfect example . Back in the paper record days , if you
lost a pap er file , you lost one patient’s record , or a box of files might have been
20 patients ’ records. Now if you have an issue with respect to dat a breach , it's
often thousands or tens of thousands or even hundreds of thousands of patient
record . So the magnit ude of the potential for inappropriate access really
increases with the digital records , and so it was pretty critically important for
Congress to address gaps in privacy r u les at the same time that they provide d a
lot of taxpayer money in order to facilit ate adoption of electronic records.
Because at the end of the day , patients and health care providers as well , but the
patients in particular need to trust that the information that’s being uploaded or
downloaded or shared protects their privacy at least to the degree that it was
protected in a paper - based environment.

Margaret Flinter: But Deven , you carry many titles , but among them , you are the
Chair of the Office of the National Coordinator ’ s Tiger Team , a team that I don’t
think most of us were awar e existed so we are going to want to hear more about
that Tiger Team , finding workable solutions to a wide range of privacy and
security issues that relate to this health information technology domain. Now you
recently outlined four key areas of health in formation technology that you think
require very targeted attention in terms of privacy protection . Tell us about these
key areas that you think really need this particular focus and attention.

Deven McGraw: I think four of the top areas are better educ ation about what the
rules are for protecting health data and also what patients ’ rights are with respect
to their health information , paying more attention to health data security which
has never been as much of a priority as it should be for the health c are industry,
dealing with the fact that HIPAA doesn’t cover all health data, that it only covers
health data when it's in the hands of entities that are sort of part of our traditional
health care system , right , doctors , hospitals , health plans but health data that ’s
shared for example by a p atient on the Internet isn’t covered by HIPAA at all, and
then what are the rules for data analytics or analytic use of data that’s collected
initially for purposes of treating you for example but then the need to sort of
examine that data in order to improve our health care system and being able to
sort of analyze treatment patterns and figure out what works best and what
population is going to really be critical to reversing those trends. And so those
are the four ar eas .

And the education piece is really, really critical in context of health privacy . We
want to actually encourage the sharing of health data w here doing so is going to
improve the health of an individual and improve the health of population s. So it's
always easier and less risky to say well I am worried about the privacy of that
information so I am not going to share it , because that’s the only way I am going
to guarantee m y patient’s privacy , oh and by the way I don’t think HIPAA allows

me to share it . Believe it or not , that excuse is used a lot , and that’s not true .
And it doesn’t help the patient at all to have privacy be used as an excuse for not
sharing information in circumstances when it should be shared. Patients have
long had the r ight to b e able to access their health information but they are
frequently told HIPAA doesn’t let you . And that’s not true either. The security
issue , the health care industry focuses a lot on delivering you good care and
maybe less on protecting the information that comes out of that care because
that’s not necessarily what they have training and expertise in , and so as a result ,
we have seen a lot of breaches, largely due to inadequate data security.

Mark Masselli: Deven , I want to sort of pull the thread a li ttle on your comment
about data breaches , and it is clearly a n area that’s got lot s of people , patien ts as
well as provider s, very nervous . A day doesn’t go by that I am not reading the
front page of either the New York Times that I don’t read about th is sort of
breaches that are going on daily, so . But you have also noted that one in six
patients will actually keep some data out of their electronic health record because
they are afraid of discovery. So tell us what you think some best practices are .

De ven McGraw: Well the good news is that in fact there are technologies th at
keep data very secure . And right now , those technologies are encryption
technologies , using encryption standards that are customarily required actually of
government contractors f or example . I mean encryption means that even if
somebody is able to figure out your user name and password and get into your
ac count , they can't read or understand the data unless they actually have the
encryption key. So encryption, encryption, encrypt ion is the way to go . Health
care has been very slow to ad a pt to encryption technologies , and so , as p art of
the Stimulus Legislation , Congress established a r ight for patients to be notified
of breaches of their health care information, they actually inc luded an enormous
incentive for the health care industry to encrypt , by saying , hey if you encrypt this
data then you don’t have to notify of a breach incident because essentially
nobody will have been harmed unless you haven’t used encryption properly.
W ell even with that incentive we still see the health care industry very, very slow
to encrypt data .

An industry that I w ould point to that’s been encrypting data for years is the
financial services industry . You don’t hear about breaches , in the way that you
do in health , of banking . So they figured this out and yet the health care industry
again has been very slow to encrypt . And to be honest , I am not a 100% sure
why . When I have asked entities within the health care system why they don’t
encrypt , so me of the common excuses are it costs too much , it slows down
access to data, when I come back to my encryption experts , they look at me like I
have six heads , right . Because encryption maybe used to be expensive but the
costs have been reduced significan tly and in fact it's not that costly. And we are
seeing that disconnect on a daily basis with respect to the breaches that have
occurred.

Margaret Flinter: Well Deven , it has been just unprecedented how fast things
have changed . Mark and I were recentl y at a national meeting of community
health centers . I think the figure that was quoted was more than 90% of the
11,000 health centers across the country . We probably implemented it maybe
seven years ago in our organization but Kaiser Permanente and the VA of course
have more than a decade of experience in that arena . What do you point to in
terms of the success of electronic health record and this technology in im proving
the health not just of individuals in health care but the population as well?

Deve n McGraw: The re definitely are pockets of evidence that in fact moving to
digital records improve s care coordination which has an enormous impact on the
quality of care as well as ultimately on cost. But I think th e evidence on cost
savings in the use of electronic health records , we have not seen it yet , and there
is a couple of reasons for that . One is that the very early stages of the Stimulus
Program focus ed primarily on getting people just to do the initial steps on the
adoption curve and to start u sing it at least internally in delivering care for your
patients . And to some extent , that’s going to result in an up take in costs because
diabetics for example who haven’t been getting their foo t exams , now we have
an electronic record system that is goi ng to be able to identify who they are for
the physician, which results in more care.

Now , we are pl a ying a little bit of catch - up in terms of the electronic systems
identifying patients and getting them the care that they need . But later stages of
the i ncentive program are focused on actually sharing data for care coordination,
making sure that transitions in care such as when a patient leaves the hospital
that all of the information about their medications , what kind of care they received
in the hospita l can in fact be acted on and are acted on in order to ensure that
they don’t end up back in the hospital . So we may be sort of seeing some short
term increases but over the long term we should be able to see decreases in
care, and in fact some of the sys tems that have been operational with health care
records for a longer period of time like Kaiser Permanente, like the VA , are
already showing the evidence and have been showing the evidence for quite
sometime. The other evidence I would point to is the ab ility of patients to get
their data and to get it in a form that’s usable for them , that they can take action
on it.

Mark Masselli: We are speaking today with Deven McGraw , Director of the
Health Privacy Project at the Center for Democracy & Technology , which is
focused on developing workable privacy and security protection for electronic
personal health information. We want to let our listeners think a little more about
HIPAA which is the acronym HIPAA for the Health Insurance Portability and
Accountabi lity Act . So talk to our listeners , who are consumers , a little more
about what the red letter issues are around HIPAA but also to some of the
practices really are kind of afraid of sharing this data.

Deven McGraw: HIPAA is , in the view of someone like me who is a privacy
advocate , HIPAA is a wonderful wall. It really set s some boundaries for how your
doctor and the hospital that you might go to, there are specific rules that they
need to follow about what they can and cannot do with health data . And w hile
the rule is not perfect , it certainly is far better to have those rules in place th a n to
have the type of environment that patients face when they do health searches on
the Internet for example , or they share health information on Facebook because
it’ s valuable to them to be able to network with other people who have their
disease, or they are using a mobile app to manage their health care. Those
technologies are not covered by HIPAA. It’s just an artifact of HIPAA really being
about getting the heal th care industry to use standardized claims and to bill
electronically. And so it was never enacted as an overarching privacy law , and
the privacy rules as a result only apply to the entities that are within that
ecosystem . And so when you as an individu al are entering health data into the
less regulated marketplace, it's really incumbent on you to read the policies of the
entities with whom you are sharing data . So whether you download a health app
on your phone , the extent of your protections are in th at privacy policy , and if you
read it and you don’t understand it or you see information sharing language in
there that makes you uncomfortable , your recourse is really not to use it . I call it
being aware before you share.

Now , in terms of getting your data from your health care providers , you are
exactly right that a lot of providers are really reluctant to do this . Some of them
genuinely think that HIPAA doesn’t allow them to share data with patients and
other s would just prefer not to share data with patients out of fear of what the
patient might do with that data. And the reality is th at the providers don’t have
the ability to say no . HIPAA gives patients a right to their information , and when
you make a request , they need to comply with that reque st within 30 days . If you
go to your health care provider and you ask for a copy of your record and they
say no , they are wrong, and you can complain actually to the Office for Civil
Rights , which is in the Department of Health and Human Services that you r
HIPAA rights have been violated because that information you have a right to
access it. But at the end of the day what's really going to move the needl e on
patients being able to access their data is when more and more physicians and
hospitals realize t hat sort of patients are partners in delivering good care and it's
actually to their advantage to provide patients with their data . Because most
patients don’t sue, right? Patients want to get their data because it's about them
and it's relevant to their health care , and at the end of day, most providers that
have taken steps to look at patients as equal participants in their care and
provide information regularly, really see the gains in terms of how well their
patients do and how their patient s feel abo ut the doctor - patient relationship . It
makes a difference and it makes a positive difference in those circumstances.

Margaret Flinter: We have been speaking today with Deven McGraw , Director of
the Health Privacy Project at the Center for Democracy & Te chnology . You can

learn more about her work by going to www.cdt.org . And Deven , thank you so
much for joining us on Conversations on Health Care today.

Deven McGraw: Thank you.

(Music)

Mark Masselli: At Conversati ons on Health Care, we want our audience to be
truly in the know when it comes to the facts about health care reform and policy.
Lori Robertson is an award - winning journalist and managing editor of
FactCheck.org, a nonpartisan, nonprofit consumer advocate for voters that aim to
reduce the level of deception in US politics. Lori, what have you got for us this
week?

Lori Robertson: Well, Representative Louie Gohmert claims that a poor guy out
there making $14,000 is going to suffer under the Affordable Ca re Act . Gohmert
wrongly says the person earning that amount would pay extra income tax “ If he
cannot afford to pay the several thousand dollars for an Obama c are p olicy ”. But
this so - called poor guy would be eligible for Medicaid or heavily subsidized
pri vate insurance depending on where he lives, and he can’t be penalized if he
decides he can’t afford it. The law expands Medicaid to include those earning up
to a 138% of the federal poverty level. $14000, the figure Gohmert uses, is a
122% of the poverty level, making this hypothetical person eligible for Medicaid.
Of course, not every state is going to expand Medicaid. 21 states are opposed to
the expansion, including Gohmert’s home state of Texas. In those states,
someone earning $14000 would be elig ible for significant federal subsidies to
help pay for private insurance on the exchanges. But if this person decides not
to buy that insurance, he can’t be subject to a tax penalty for not doing so. He is
eligible to receive a hardship exemption from th e individual mandate . The
st
Department of Health and Human Services published a final rule on July 1 that
said anyone who is ineligible for Medicaid , because a state decides not to
expand it, would be exempt from the requirement to have insurance . And th at’s
my fact check for this week. I am Lori Robertson, Managing Editor of
FactCheck.org.

Margaret Flinter: FactCheck.org is committed to factual accuracy from the
country's major political players and is a project of the Annenberg Public Policy
Center a t the University of Pennsylvania. If you have a fact, that you would like
checked, email us at www.chcradio.com . We will have FactCheck.org's Lori
Robertson check it out for you here on Conversations on Health Car e.
(Music) Margaret Flinter: Each week, Conversations highlights a bright idea about how to make wellness a part of our communities and everyday lives. When Derreck

Kayongo was a young refugee living in Africa , he learned the true meaning of
survival.

Derreck Kayongo: Child of war can be simply described as a kid caught between
a rock and a hard place. It's finding all your pieces and trying to put them back
together.

Margaret Flinter: Rescued by an aid organization and brought to the United
States , he knew he had to do something to make a difference in the lives of
those many children left behind, children displaced by war, orphaned by disease,
living in extreme poverty . 2. 4 million children die each year from lack of access
to basic sanitation.

Derreck Kayongo: We have about two million kids that die of sanitation issues
mainly because they don’t wash their hands.

Margaret Flinter: And when Kayongo learned th at hotels around the United
States dispose off 800 million bars of soap every year , he knew that was a
resource to tap into.

Derreck Kayongo: 800 million bars of soap that the hotels throw away in the US
alone every year.

Margaret Flinter: He founded the Global Soap Project . The discarded soaps are
gathered and processed at a plant tha t sanitizes , melts and reforms new bars of
soap that will be distributed around the world to children and families living in
poverty or in disasters zones like Haiti. And with it , the children are given
lessons in basic hygiene , some learn ing for the firs t time how to thoroughly wash
their hand s and why. The Global Soap Project ear ned Kayango the distinction of
one of CNN’s Hero finalists , and he was also a winner in the Annual CLASSY
Awards , which support philanthropic work that improves health and welln ess
around the globe . A simple idea , repurposing the waste of soap and providing
one of the most simple tools of hygiene to those in need around the world , now
that’s a bright idea.

(Music)

Margaret Flinter: This is Conversations on Health Care. I am Margaret Flinter.

Mark Masselli: And I am Mark Masselli, peace and health.

Conversations on Health Care, broadcast from the campus of WESU at
Wesleyan University, streaming live at www.wesufm.org and brought to yo u by
the Community Health Center.