Site moved to, redirecting in 1 second...

« October 2012 | Main | December 2012 »

5 posts from November 2012

November 27, 2012

OCR releases HIPAA privacy rule guidance on de-identifying PHI

HHS OCRJust two and a half years after hosting a workshop on the HIPAA Privacy Rule's de-identification standard, OCR has issued its "Guidance Regarding Methods for De-identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule." Like they say, it's not rocket surgery -- and there are few surprises here. One area worth reviewing is the expert determination section -- for those of you using, or considering the use of, expert opinions to guide your de-identification programs. Reproduced below is a table describing some of the principles used by experts in determining whether information has been de-identified:


Table 1. Principles used by experts in the determination of the identifiability of health information.

Replicability Prioritize health information features into levels of risk according to the chance it will consistently occur in relation to the individual. Low: Results of a patient’s blood glucose level test will vary
High: Demographics of a patient (e.g., birth date) are relatively stable
Data source Availability Determine which external data sources contain the patients’ identifiers and the replicable features in the health information, as well as who is permitted access to the data source. Low: The results of laboratory reports are not often disclosed with identity beyond healthcare environments.
High: Patient name and demographics are often in public data sources, such as vital records -- birth, death, and marriage registries.
Distinguishability Determine the extent to which the subject’s data can be distinguished in the health information. Low: It has been estimated that the combination of Year of Birth, Gender,and 3-Digit ZIP Code is unique for approximately 0.04% of residents in the United States.  This means that very few residents could be identified through this combination of data alone.
High: It has been estimated that the combination of a patient’s Date of Birth, Gender, and 5-Digit ZIP Code is unique for over 50% of residents in the United States.  This means that over half of U.S. residents could be uniquely described just with these three data elements.
Assess Risk The greater the replicability, availability, and distinguishability of the health information, the greater the risk for identification. Low: Laboratory values may be very distinguishing, but they are rarely independently replicable and are rarely disclosed in multiple data sources to which many people have access.
High: Demographics are highly distinguishing, highly replicable, and are available in public data sources.

One element of the expert determination worth noting is the notion that a determination should perhaps be time-limited.  Since that which is de-identified today may not be de-identified tomorrow (thanks in part to the rapid growth in the volume of data that is made available to the public on the internet).  Here is the relevant FAQ:

How long is an expert determination valid for a given data set?

The Privacy Rule does not explicitly require that an expiration date be attached to the determination that a data set, or the method that generated such a data set, is de-identified information.  However, experts have recognized that technology, social conditions, and the availability of information changes over time.  Consequently, certain de-identification practitioners use the approach of time-limited certifications.  In this sense, the expert will assess the expected change of computational capability, as well as access to various data sources, and then determine an appropriate timeframe within which the health information will be considered reasonably protected from identification of an individual.

Information that had previously been de-identified may still be adequately de-identified when the certification limit has been reached.  When the certification timeframe reaches its conclusion, it does not imply that the data which has already been disseminated is no longer sufficiently protected in accordance with the de-identification standard.  Covered entities will need to have an expert examine whether future releases of the data to the same recipient (e.g., monthly reporting) should be subject to additional or different de-identification processes consistent with current conditions to reach the very low risk requirement.

It is also worth noting that the guidelines suggest that a data use agreement is not required to be put in place in connection with the sharing of data de-identified in accordance with an expert determination. However, use of such agreements is common, whether or not data has been de-identified, and may contain other provisions of value to the parties.

(I was also tickled to learn the identity of the seventeen ZIP code tabulation areas -- identified by the first three digits of their ZIP codes-- that include fewer than 20,000 residents each per the 2000 Census, and therefore must be listed as 000 in order for a record containing one of them to be condidered de-identified.) 

When it comes to HIPAA compliance, these guidelines provide a greater measure of certainty regarding the privacy rule for folks in the secondary use of health data market. It remains to be seen whether the market has anticipated the content of these guidelines or whether there will be an uptick in the secondary use market, and further growth of "big data" in health care and/or an increase in the proliferation of health management tools (including mHealth apps using this population health data), as a result of the guidelines' release.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

November 26, 2012

Top Ten HHS Management and Performance Challenges

The OIG produces its list of Top Management and Performance Challenges (TMC) every year, and to no one's surprise, implementation of health reform tops the list this year.  The rest of the list includes a collection of fraud and abuse, quality of care and consumer protection priorities, plus a couple of interesting issues, such as protecting integrity and security of health IT systems and data and fostering an ethical and transparent environment.

ACA implementation efforts have come out from under wraps post-Election Day, and last week, HHS issued proposed rules on a number of health insurance issues (pre-existing condition nondiscrimination, essential health benefits and employment-based wellness programs) that must be in place before January 1, 2014.

A little more detail from the HHS presser; these rules include:

  • A proposed rule that, beginning in 2014, prohibits health insurance companies from discriminating against individuals because of a pre-existing or chronic condition.  Under the rule, insurance companies would be allowed to vary premiums within limits, only based on age, tobacco use, family size, and geography.  Health insurance companies would be prohibited from denying coverage to any American because of a pre-existing condition or from charging higher premiums to certain enrollees because of their current or past health problems, gender, occupation, and small employer size or industry. The rule would ensure that people for whom coverage would otherwise be unaffordable, and young adults, have access to a catastrophic coverage plan in the individual market.  For more information regarding this rule, visit:
  • A proposed rule outlining policies and standards for coverage of essential health benefits, while giving states more flexibility to implement the Affordable Care Act. Essential health benefits are a core set of benefits that would give consumers a consistent way to compare health plans in the individual and small group markets. A companion letter on the flexibility in implementing the essential health benefits in Medicaid was also sent to states.  For more information regarding this rule, visit
  • A proposed rule implementing and expanding employment-based wellness programs to promote health and help control health care spending, while ensuring that individuals are protected from unfair underwriting practices that could otherwise reduce benefits based on health status.  For more information regarding this rule, visit:

David Harlow
The Harlow Group LLC
Health Care Law and Consulting


November 21, 2012

Engage With Grace

As patients, as family members, as friends, as health care providers, we have all faced end-of-life issues at one time or another, and we will face them again. And again. 

Having been through this process twice in the past year, I can only repeat that it is important to have The Talk, to help ensure that your family members' and friends' wishes about end-of-life care are clear, are documented and, as a result, are followed. If it helps to get the conversation going, use the Five Questions in the slide at the end of this post. 

Download your copies of the Massachusetts health care proxy form or other states' proxy or living will forms -- and add specific instructions about nutrition, hydration, and anything else that is important to you so that everything is crystal clear.  Having the conversation is a starting point; we all need to follow through and make sure that our loved ones' wishes are documented, placed in medical records, discussed with physicians and other caregivers, and honored.

And with that I turn it over to @engagewithgrace for #blogrally12 (the latest edition from a group of us kickstarted by Alexandra Drane, Matthew Holt and Paul Levy.) If you blog, consider copying the rest of this post, and putting it up now through the end of Thanksgiving weekend. 

- O -

One of our favorite things we ever heard Steve Jobs say is… ‘If you live each day as if it was your last, someday you'll most certainly be right.’

We love it for three reasons:

1) It reminds all of us that living with intention is one of the most important things we can do.
2) It reminds all of us that one day will be our last.
3) It’s a great example of how Steve Jobs just made most things (even things about death – even things he was quoting) sound better.

Most of us do pretty well with the living with intention part – but the dying thing? Not so much.

And maybe that doesn’t bother us so much as individuals because heck, we’re not going to die anyway!! That’s one of those things that happens to other people….

Then one day it does – happen to someone else. But it’s someone that we love. And everything about our perspective on end of life changes.

If you haven’t personally had the experience of seeing or helping a loved one navigate the incredible complexities of terminal illness, then just ask someone who has. Chances are nearly 3 out of 4 of those stories will be bad ones – involving actions and decisions that were at odds with that person’s values. And the worst part about it? Most of this mess is unintentional – no one is deliberately trying to make anyone else suffer – it’s just that few of us are taking the time to figure out our own preferences for what we’d like when our time is near, making sure those preferences are known, and appointing someone to advocate on our behalf.

Goodness, you might be wondering, just what are we getting at and why are we keeping you from stretching out on the couch preparing your belly for onslaught?

Thanksgiving is a time for gathering, for communing, and for thinking hard together with friends and family about the things that matter. Here’s the crazy thing - in the wake of one of the most intense political seasons in recent history, one of the safest topics to debate around the table this year might just be that one last taboo: end of life planning. And you know what? It’s also one of the most important.

Here’s one debate nobody wants to have – deciding on behalf of a loved one how to handle tough decisions at the end of their life. And there is no greater gift you can give your loved ones than saving them from that agony. So let’s take that off the table right now, this weekend. Know what you want at the end of your life; know the preferences of your loved ones. Print out this one slide with just these five questions on it.

Have the conversation with your family. Now. Not a year from now, not when you or a loved one are diagnosed with something, not at the bedside of a mother or a father or a sibling or a life-long partner…but NOW. Have it this Thanksgiving when you are gathered together as a family, with your loved ones. Why? Because now is when it matters. This is the conversation to have when you don’t need to have it. And, believe it or not, when it’s a hypothetical conversation – you might even find it fascinating. We find sharing almost everything else about ourselves fascinating – why not this, too? And then, one day, when the real stuff happens? You’ll be ready.

Doing end of life better is important for all of us. And the good news is that for all the squeamishness we think people have around this issue, the tide is changing, and more and more people are realizing that as a country dedicated to living with great intention – we need to apply that same sense of purpose and honor to how we die.

One day, Rosa Parks refused to move her seat on a bus in Montgomery County, Alabama. Others had before. Why was this day different? Because her story tapped into a million other stories that together sparked a revolution that changed the course of history.

Each of us has a story – it has a beginning, a middle, and an end. We work so hard to design a beautiful life – spend the time to design a beautiful end, too. Know the answers to just these five questions for yourself, and for your loved ones. Commit to advocating for each other. Then pass it on. Let’s start a revolution.

Engage with Grace.

Engage With Grace

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

November 12, 2012

Health Reform After the Election: Accountable Care Organizations and Population Health

Much has been written and said about the effect of the election on the implementation of federal health reform initiatives.  The commentariat, including the blogerati and twitterati wings, have focused on the budget battles of the future to come from Capitol Hill, the flurry of regulations to come from HHS, and the last stand of the boys in red in certain state capitals around the country against implementation of health insurance exchanges and Medicaid expansion under the ACA.

I spoke recently about the importance of the Accountable Care Organization law and regulations, and related initiatives being undertaken by the Center for Medicare and Medicaid Innovation (CMMI) at CMS, and the ways in which these initiatives are likely to affect the next phase in the development of the health care system in this country.  I thought I'd share a few of the highlights here.

We have built a system of sick care in the USA, not health care, and the disruptive forces contained in the Affordable Care Act, including the ACO provisions, have the potential power to change our system to a system of health care – by changing the focus, by changing the incentives, by changing the behaviors of both patients and providers.

The goal for all of us in health care these days is to be better integrated with other parts of the system, so that we can do more with less in the future. We all know -- or should know by now -- that we will have to do more with less. The key to future success will be managing patients’ care and its attendant costs over the long term, managing an episode of care that extends beyond an inpatient surgery to encompass pre-admission and post-discharge services, managing a chronic condition with a multidisciplinary approach using medicine, nursing and even social media and game theory to motivate patient behavior modification. We need to move from reimbursement-based medicine to evidence-based medicine.

When the ACA was enacted, folks likened the ACO to the unicorn: Nobody's ever seen one, but everyone knows exactly what it looks like.  Once the ACO regulations were finalized, I called it as I saw it: the ACO is a camel -- a horse designed by committee. And now I see the ACO and related initiatives under the ACA as a camel with its nose in the tent: a disruptive force beginning to change the world as we know it.

When the final ACO rules came out about a year ago, CMS actuaries predicted that there would eventually be about 270 Medicare ACOs -- including large and small organizations and urban and rural organizations -- by the end of three years (we are less than one year in at this point), providing care to up to 2 million Medicare beneficiaries.  We're on track to get there and beyond, with over 150 Medicare ACOs already approved and several hundred more applications queued up for the future. (Keep in mind there are approximately 150 commercial ACOs out there as well – according to an inventory updated this spring by Leavitt Partners.) 

In addition to the estimated 270 Medicare ACOs, HHS estimates up to $1 billion in savings to Medicare over four years, and the Congressional Budget Office estimates $5 billion in savings over eight years.  At first blush, these look like impressive figures, until we recall that there are 6000 hospitals in the US, nearly 50 million Medicare beneficiaries, and that Medicare is a $500 billion line item in FFY 2013 alone. The ACO initiative is a drop in the bucket.

The ACO initiative is generating a lot more interest than perhaps they should, based on these numbers – but this is legitimate, for a couple of reasons.  ACOs really form the conceptual building blocks for a new approach to achieving the Triple Aim – which is now the mission of CMMI: Better Healthcare, Better Health and Lower Costs Through Improvement. CMMI seeks to: "Encourage better health for entire populations by addressing underlying causes of poor health, such as physical inactivity, behavioral risk factors, lack of preventive care and poor nutrition."  It is using the levers of the ACO program to enlist ACOs in the execution of this element of its mission.

So, the camel’s nose is in the tent – we're at the leading edge of a significant disruption built around the Affordable Care Act’s provisions on ACOs and related initiatives: a sea change in the way health care is conceptualized, and radical change in delivery and payment systems.  We’re ahead of the curve on these issues in Massachusetts, with a law passed this summer that will move us into ACOs for all -- not just Medicare beneficiaries -- and away from fee-for-service medicine, and a local Blue Cross-Blue Shield plan known as the Alternative Quality Contract that has been working on this basis -- budgeted caps with quality kickers -- for several years already. It’s the latest form of pay for performance, or value-based payment.

An ACO has to have at least 5000 Medicare beneficiaries attributed to it, but the beneficiaries cannot be forced to enroll in a closed network. Because Congress sees elimination of choice of provider as a third rail of health care, ACOs do not know for certain which patients will have more than 50% of their primary care encounters with an ACO PCP in any given year and thereby be attributed to the ACO, Thus, in order to succeed, ACOs must be focused on population health, on prevention and wellness in a population, not just on individual encounters with patients.

CMMI is also using the power of the purse -- its $10 billion budget, to be spent over ten years on experiments with the health care system.  Nearly two dozen experiments are already under way, including three flavors of ACOs. While CMMI is experimenting with a wide variety of methods to incentivize health care providers to change the way they provide care (check out the CMMI "What We're Doing" page), the health care providers participating in these innovations should be laser-focused on the 10% of chronically ill Medicare beneficiaries whose health care expenses consume 50% of the Medicare dollar. If they change their approach to managing these patients' care through patient-centered medical homes or otherwise, there are great opportunities to achieve significant savings through avoiding preventable hospitalizations and the like.

The keys to success will be clinical integration -- not just in word but in deed -- and turning data into actionable intelligence.  Health care systems that can achieve these two interim goals will be well-positioned to achieve the broader goals of improving population health and quality of care while bending the cost curve -- and not just for Medicare beneficiaries attributed to Accountable Care Organizations.

David Harlow
The Harlow Group LLC
Health Care Law and Consulting

November 08, 2012

David Harlow is keynote speaker at Louisiana Hospital Association 2012 Health Law Symposium

This morning I am in Baton Rouge, at the Louisiana Hospital Association conference center, sharing my perspectives on ACOs and the broad range of innovation in health care delivery and financing being ushered in under the Affordable Care Act.

I am also speaking about the use of health care social media in the face of concerns from legal, compliance and regulatory departments.