Deven McGraw, Deputy Director at HHS, Office For Civil Rights

Deven McGraw Deputy Director, Office For Civil Rights at HHS

Mark Masselli: This is Conversations on Healthcare , I am Mark Masselli.

Margaret Flinter: And I am Margaret Flinter.

Mark Masselli: Well Margaret scientists are learning more a bout the zika virus and its
potential harm.

Margaret Flinter: The link to microcephaly has already been confirmed , but there are
also some additional birth defects being blamed on zika exposure in utero . These
include sight and hearing impairment as wel l as mental retardation not specifically
related to microcephaly they are really [ Inaudible 00:00:27 ] back to the days of rubella
and German measles the epidemics we haven’t thought about in a long - long time.

Mark Masselli: Quite scary. And the scope of the neurological illness in those adults
who are infected with zika is also a growing concern , and we are starting to see a
number of cases in United States.

Margaret Flinter: About 600 cases reported in this country so far Mark, but all to date
being attributed to exposure to the virus in people who are travelling abroad and brining
it back to the US , b ut experts are cautioning it's only the tip of the iceberg . Public health
officials are bracing for the arrival of the mosquito b reeds known to carry the virus and
later spring into summer and much of the country is expected to be impacted by late
summer.

Mark Masselli: President has asked for $1.9 billion in emergency funds to help confront
the threat of zika’ s arrival in America but so far, congress has failed to act on this
request not willing to wait for the action though the Whitehouse is shifted about $500
million from the Ebola preparedness fund to help the zika effort and Dr. Anthony Fauci
who we have ha d on the show recently told us there is no time to waste in order to be
prepared.

Margaret Flinter: Well Dr. Fauci is leading the efforts at the National Institute of Health .
They are working very closely in concert with the Centers for Disease Control, the
Department of Health and Human Services as well as the number of global health
agencies to get us fully prepared for what's to come on the zika front.

Mark Masselli: And speaking of health and human services, many people may not be
aware of the agen cies Office of Civil Rights, our guest today is Deputy Director of
Health Information Privacy in that division, Deven McGraw oversees the protection of
patient health privacy data as well as the adherence of HIPAA regulations.

Deven McGraw Deputy Director, Office For Civil Rights at HHS

Margaret Flinter : Well Lori Robertson will also be stop ping by, the managing editor of
FactCheck.org , she looks at misstatements made about health policy in the public
domain. And no matter what the topic remember , you can hear all of our shows by
going to chcradio.com.

Mark M asselli: And as always if you have comments , please email us at
[email protected] or find us on Facebook or Twitter ; we love hearing from you.
Margaret Flinter: We will get to our interview with Deven McGraw in just a moment.

Mark Masselli: But first here is our producer Marianne O'Hare with this week's headline
news.

(Music)

Marianne O'Hare: I'm Marianne O'Hare with these healthcare headlines. It's been a
surge in coverage in the past years of the number of Latinos gaining coverage under
the Affordable Care Act. According to the latest numbers , a third of all newly insured
Americans were Hispanic, a sector of the population that has had a disproportionate
number of uninsured , i t's the single largest share of gained coverage in any
demographic group. And according to analysis done by the New York Times while the
nation’s uni nsured rate remains high around 30 million or so, so many low income
residents gained covered by the end of 2014 that it ended a decades long growing
divide between haves and have - nots in terms of actually having coverage. The
uninsured rate remain ed rela tively high doing part to the 19 states that refused to
expand the Medicaid to those living closer to the poverty line.

The nation’s health care workforce is made up of roughly 3.4 million nurses the largest
professional group represented in healthcare an d as frontline care - deliverers they also
report a large amount of stress related to their work. According to a recent study,
roughly a quarter of all intensive care nurses reported symptoms of post traumatic
stress disorder. Experts say, adding staff won 't be enough, the problem can be linked
to poorly managed work flow and active hospital environments that leave nurses no
time to detach or even stop for a quick meal during long 12 hour shifts.

And vaping and teens, the numbers are up, while the numbers of teens smoking
traditional cigarettes has steadily dropped in the past decade, there is an alarming trend
when it comes to the use of vaping or e cigarette s. Teen s’ use of these inhalation
products is increased 10 fold in the past four years amounting t o about 4.7 million kids
and teens who use tobacco , the age at which addiction is most likely to take hold.

Deven McGraw Deputy Director, Office For Civil Rights at HHS

Tobacco industry claims these products aren’t as likely to cause harm to health but the
jury is out . The vapor which contains nicotine is still an affected delivery system and
some of the compounds shift at toxic substances when tuned into vapor. E cigarettes
sales have exploded to a $3.5 billion a year industry. I am Marianne O'Hare with these
healthcare headlines.

(Music)

Mark Masselli: We are speaking today with Deven McGraw, Deputy Director for Health
Information Privacy at the US Department of Health and Human Services Office of Civil
Rights. M s . McGraw was partner at Manatt, Phelps & Phillips as the Co - chair of Privacy
Security and D ata Practice with focus on IT implementation and health information
exchange issues. In 2009 she was appointed by HHS Secretary Kathleen Sebelius
through the Federal Health IT Policy Committee serving as co - chair of the Privacy and
Security Workgroup. Ms . McGraw has served as Director of the Center for Democracy
and Technology. She earned her masters in Public Health at Johns Hopkins School of
Public Health and her law degree from Georgetown School of Law. Welcome Deven
back to Conversations on Healthca re.

Deven McGraw: Thank you very much I am really pleased to be here.

Mark Masselli: We have really seen the dramatic change in the landscape for health
information technology and you ha ve incredible reputation as a thought - leader on the
sort of emergent disciplines of health information technology , how have health IT
security and patient privacy issues shifted in this era of accelerated adoption in reform.

Deven McGraw: Well when I fir st started doing this work, you know really t he focus was
on trying to get healthcar e providers, physicians, healthcare professionals to be digital,
to be able to sort of brin g the advances of the digital age into the traditional healthcare
system. And we focused a lot on what we might need to do to HIPAA , to both
strengthen privacy and security protections in this traditional environment as well as to
make sure that information for appropriate purposes like treating patients or securing
payment for care o r doing research would be able to flow.

But frankly , the uploading and the sharing of personal health information by consumers
usin g social networking and through mobile apps has almost eclipsed the volume of
information that gets shared through those traditional routes. And so I am not sure that
any of us necessarily, except perhaps those who bought stocks in some of these
companies that were wildly fixes this up for could have foreseen that you know some of

Deven McGraw Deputy Director, Office For Civil Rights at HHS

the most important issues in privacy and security would arise completely out side of the
HIPAA ecosystem.

Margaret Flinter: You have a pretty big directive leading policy enfor cement and
outreach efforts related to HIPAA Privacy Security Breach Notification Rules but maybe
let's start with some basic clarification about HIPAA, the Health Insurance Portability
and Accountability Act which I think most people assume that P stands for privacy but
there is still quite a lot of confusion about what it actually requires of clinicians when
sharing patient data and I think equally important what it doesn’t. Maybe clarify what
HIPAA is really all about as well as the recent updates to th e regulations issues by your
office.

Deven McGraw: Sure. The HIPAA privacy and security rules were really aimed at
making sure that the electronic transactions that were really put in place to support
payment for care and try to build administrative e fficiencies into the health care system,
that those electronic transactions would take place in a private and secure way you
know recognizing that patient data whether it's a medical records or claims records is
very sensitive. And so while we were trying to digitize some very common transactions
in health care, we needed to put privacy and security in place, that’s really what HIPAA
focused on. And so consequently, HIPAA only applies to most healthcare providers
who transact business with payers electron ically and then of course the contractors who
get sensitive health information in order to perform a service for healthcare provider or
health plan like billing for example is a common one. So it really had a very narrow
focus.

HIPAA was also built aroun d the concept that we expect this information to be shared
for treatment purposes , and we exp e ct it to be shared for payment , and we expect it to
be reportable to sa ve for the CDC for public health. And on top of that there are some
basic rights like the right to request an amendment or the right to get a copy of your
health information . And so often times there is a lot of misinformation about what
HIPAA does and doesn’t do because people exp e ct that a privacy rule means don’t, you
know don’t share. And when in fact if you rea l ly look at HIPAA and sort of see what it
really says, you will see that it actually accommodates most of the sharing that
healthcare providers need to routinely do to operate their businesses. Again the rights
of the individual to get copies of their information is another HIPAA provision that’s
commonly mi s understoo d and it was actually a topic on which we issued a bunch of
guidance that’s available on our website to understand what those oblig ations are.

Mark Masselli: You know increasingly wearables and tracking devices are producing
reams of data, we had Jeff Williams from Apple and there is a lot of transformation

Deven McGraw Deputy Director, Office For Civil Rights at HHS

going on in that space, but much of the data doesn’t seem to be protected un der HIPAA
and it's also being used by manufacturers in a multibillion dollar data marketing and
mining sector, could you talk to our listeners about this emerging market of wearable
health tracking monitors?

Deven McGraw: Most of these wearables and apps and other devices that are
marketed directly to consumers are not likely to be covered by HIPAA. So unless these
apps or devices are being offered by an entity that is covered under HIPAA like a health
plan might offer you an app to interface with your c laims record or a healthcare provid e r
might offer you a way to look at your medical record. This doesn’t mean that there are
no privacy or security protections because the Federal Trade Commission has the
authority from congress to crack down on unfair or deceptive practices.

The FTC can enforce or go after companies that refuse to adhere to the commitments
that the company makes to the consumer either in the user agreements . So what I
usually advise to consumers is to review the information about how the data is going to
shared by the company that’s offering the app because that’s really the source of the
protections that consumer has to decide, you know what they are willing to tolerate with
respect to uses of data. Often times these apps or devices might be offered to a
consumer for free which could mean that the business model for the app, because very
rarely people really things for free right, it's likely that there is some sort of monetization
going on off the data. And that really should be explained to the consumer as part of,
again the user agreement or the license agreement and that’s where your protections
are. So that’s what you need to look at.

Margaret Flinter: W ell thinking back to our conversation with Jeff Williams talking about
Apple HealthKit and Apple ResearchKit platforms , and they had very strict adherence to
encryption rules for privacy protection and you know you are on our show in the past,
it's has bee n a couple of years but you talked then about the importance of encryption
and how you felt at the time anyway it was being underutilized in healthcare. So help us
understand, what the government might need to do to promote and protect the
encryption of h ealth data.

Deven McGraw: So we think that encryption is a critical security tool . It doesn’t protect
against all threats but it certainly does protect against a good many of them for entities
that are covered by the HIPAA security rule requires entitie s to address encryption. And
that means they are suppose to adopt encryption for data that’s either stored or data in
motion it's often supposed to be secured through encryption. If encryption is not in
appropriate safeguard then an entity may adopt an a lternative safeguard. We also have
under HIPAA in our breach notification requirements a safe harbor for entities that adopt

Deven McGraw Deputy Director, Office For Civil Rights at HHS

encryption standards that are recommended by the National Institute for Science and
Technology. What we have upon our website now I will admit is much more geared to
our covered entity community. We are actually right now in the process of developing
much more consumer friendly. We are working with our sister agency at HHS the Office
of the National Coordinator for Health IT. And we hope to have some materials that are
really geared towards consumers and much more easy for them to understand , we
hope to have those out by the summer.

Mark Masselli: We are speaking today with Deven McGraw, Deputy Director for Health
Information Pr ivacy at the US Department of Health and Human Services Office for Civil
Rights. Deven, my god I am scared to death every time I listen to the radio and I hear
the story about Ransomware you know for hospitals totally shut down unless they pay
up . So we are seeing this enormous amount of healthcare hacks, your department is
one of many focuses on this issue and you recently said your agency is relatively small
in the face of the growing threats, but talk to our listeners about how your office and
other government agencies work together to address these security challenges.

Deven McGraw: We are very aware of course of the threats of Ransomware. And in
fact, we have a listserv that folks can sign up for where we regularly put out information,
we have one for privacy and one for security and we have been using our security
listserv to put out alerts on cyber security threats . And we had actually sent out
information on Ransomware much earlier this year and started sort of hearing about the
attacks that were occurring. Really the cyber threats that we are seeing are aimed at
the traditional healthcare system where there is very valuable data and the mechanism
of Ransomware is to essentially wall the information off. HHS also recently appointed a
H ealthcare Cybersecurity Task Force, the task force will provide us with some very
important recommendations on how we can do a better job in healthcare of securing
what is a very important data resource.

Margaret Flinter: Well Deven, part of the concern we want in need the public to have
that trust because we hope that patients will consider sharing their data for broader
research protocols , certainly e - prescribing has become the norm across the country,
maybe you could tal k with us just a little bit about the pockets where health information
is being very effectively shared and utilized to advance larger goals.

Deven McGraw: W hile we need to provide an environment where people can trust that
their information is going to be used appropriately, we also need to make sure that the
laws that we put into pl a ce to help make information secure still enable us to actually
leverage health information for the good because privacy and security is not about, so
we make that lock box stronger so that nobody can see this information . The data is not

Deven McGraw Deputy Director, Office For Civil Rights at HHS

valuable unless it's used to care for people as individual patients and also to contribute
to the greater learning about what types of treatments and interventions work best and
for which population of people. You really need to have both lots of pockets of you
know promising work being done on you know data collection and exchange i n the
Patient - Centered Outcomes Research Institute and the work that they are funding lots
of work that NIH is funding.

And another initiative that’s really just beginning at our office is actively participating in is
the President’s Precision Medicine In itiative and the hope to have a million plus people
voluntarily contributing their data and bio - specimens for research purposes and then of
course the vice president’s initiative on the Cancer Moonshot . There is so much going
on I mean it's actually a hea lthy dialog to have to be talking both about the need to
protect the confidentiality as data and make sure that it's appropriately secured while in
the very same conversation talking about how we can more robustly leverage it for the
good.

Mark Masselli: Speaking about health data and with the advent of electronic health
records I think some of us looked at that the earlier stage that it was sort of the Tower of
Babel it couldn’t talk to anybody. And unfortunately we haven’t done such a great job
making that data interoperable, what tools is your office making available so that
innovation they are developing will advance the quest for interoperability.

Deven McGraw: So we have been working very closely with the Office of the National
Coordinator for Hea lth IT as well as the Centers for Medicare and Medicaid Services to
think about what we can do in order to advance interoperability. And the guidance that
we put out on the ability of an individual to be able to get copies of her records and have
those co pies sent directly to any third party that she chooses and upload that
information into a mobile app that helps her manage that information and may be she is
a care - giver either for children or for aging parents but we also work ed with ONC to
make clear th at HIPAA is not the obsta c le. Very often entities would say, well we can't
share for treatment purposes because HIPAA will not allow it or it's not clear to us how
we can share information electronically . So we have put out some factsheets with ONC
that you can find either on ONC’s website or on ours on how HIPAA permits uses and
disclosures for treatment and care - coo r dination. HIPAA is the enabler to sharing for the
right reasons and we have tried really hard to put out the truth about what providers
need to do to be able to share with one another, to make this environment much more
interoperable.

Margaret Flinter: We have been speaking today with Deven McGraw, Deputy Director
for Health Information Privacy at the US Department o f Health and Human Services

Deven McGraw Deputy Director, Office For Civil Rights at HHS

Office for Civil Rights. You can learn more about her work by going to hhs.gov/ocr and
you can follow her on Twitter @HealthPrivacy. Deven, thank you so much for joining us
today on Conversations on Healthcare.

Deven McGraw: Thank you very much Margaret and Mark, both of you it's really been a
pleasure.

(Music)

Mark Masselli: At Conversations on Healthcare, we want our audience to be truly in the
know when it comes to the facts about healthcare reform and policy. Lori Rob ertson is
an award - winning journalist and managing editor of FactCheck.org, a nonpartisan,
nonprofit consumer advocate for voters that aim to reduce the level of deception in US
politics. Lori what have you got for us this week?

Lori Robertson: The Whit ehouse recently published a factsheet on the threat climate
change poses to human health saying that, e xtreme heat can be expected to cause an
increase in the number of premature deaths and cited a nationwide model that predicts
roughly 11,000 deaths in th e year 2030 and more than 27,000 deaths in 2100 from
extreme heat exposure compared with a 1990 baseline. But that ignores another model
from the same study that predicts significantly fewer premature deaths , 6,950 in 2030
and 19,509 in 2100. The Obama A dministration also ignored a predict ed a decrease in
the number of premature deaths from extreme cold temperatures. The net number of
additional deaths from extreme temperatures in the model cited by the White House are
4,665 in 2030 and 9,632 in 2100 , t hat’s thousands fewer than what the Whitehouse
cited.

Furthermore, the Whitehouse made no mention of future adaptation to extreme heat
which could reduc e premature deaths, such as greater accessibility to air conditioning
and increased vegetation in cit ies. The report on Climate Change on Human Health is
from the US Global Change research Programs. It's made up of research teams from
13 federal departments and agencies. The report explained that U.S. average
temperatures have increased since 1895 due to elevated greenhouse gas emissions.
And scientists predict ed that the trend will continue with a 3° F to 10° increase in
average temperature by 2100 .

Temperature extremes can lead to a greater number of premature deaths through both
hyperthermia and hypothermia and by worsening chronic conditions, such as
cardiovascular and respiratory diseases. Scientists have high confidence that heat
deaths will increase in the future, but the Whitehouse cherry - picks estimate d number of

Deven McGraw Deputy Director, Office For Civil Rights at HHS

such death from the more extreme model. And that’s my fact check for this week, I am
Lori Robertson Managing Editor of FactCheck.org.

Margaret Flinter: FactCheck.org is committed to factual accuracy from the country's
major political players and is a project of t he Annenberg Public Policy Center at the
University of Pennsylvania. If you have a fact, that you would like checked, email us at
www.chcradio.com . We will have FactCheck.org's Lori Robertson check it out for you
here on Conversations on Healthcare.

(Music)

Mark Masselli: Each week Conversations highlights a bright idea about how to make
wellness a part of our communities and everyday lives. Currently about 2 million people
around the world are suffering from End Stage Renal Disease or Acute Kidney Failure.
There are basically two options for these patients; kidney transplant s which are costly
and severely lacking in available donor kidneys or dialysis, also costly as well as time
consuming, requiring patients to undergo blood filtering treatments at medical facilitates,
lasting up to five hours per treatment, costing about $9 0,000 per year.

A Montreal teen science project just may pave the way for another solution. Anya
Pogharian, developed a portable home dialysis kit that cost about $500 to produce far
less than the $30,000 dialysis machines currently in use. Her idea inspired by her high
school internship working at a Dialysis Center in Montreal.

Anya Pogharian: Even have to make your way to the hospital which is a problem for a
lot of patients, it's not necessarily easy to go three times a week to the hospital
especially if you have ma y be limited mobility.

Mark Masselli: Pogharian says , hundreds of hours of research led her to build a
prototype of the dialysis machine which is about the size of a typical game board but
pumps and purifies blood just as large scale dialysis machines do . Her invention has
earned her numerous awards and scholarships and the attention of one of Canada’s
key hematology labs now supporting her continued research. She hopes this device
can be developed throughout the world, especially third world countries where
significant percentage of the population doesn’t have access to either transplant surgery
or dialysis leading to early deaths of those patients.

Anya Pogharian: 10% of patients living in India and Pakistan who need the treatment
cannot afford it or can't have it , and anyway it's not accessible , so that’s really what
motivated me to continue.

Deven McGraw Deputy Director, Office For Civil Rights at HHS
Mark Masselli: A relatively cheap, portable, easily assembled dialysis machine that
could alleviate the cost and treatment hurdles of ongoing dialysis, keepin g patients
healthier longer, allowing them to be treated at home, now that’s a bright idea.
(Music)
Margaret Flinter: This is Conversations on Healthcare, I am Margaret Flinter.
Mark Masselli: And I am Mark Masselli, peace and health.
Conversations o n Healthcare, broadcast from the campus of WESU at Wesleyan
University, streaming live at www.wesufm.org and brought to you by the Community
Health Center.