Have Your cake and Eat It, Too: How States Could Leverage Data on Quality to Promote Health Care Transparency & Patient Privacy within Consumer-Driven Health Care Initiatives HAVE YOUR CAKE AND EAT IT, Too: How STATES COULD LEVERAGE DATA ON QUALITY TO PROMOTE HEALTH CARE TRANSPARENCY & PATIENT PRIVACY WITHIN CONSUMER-DRIVEN HEALTH CARE INITIATIVES Julia Hudson* ABSTRACT....................................... 663 I. CONSUMER-DRIVEN HEALTH CARE..................664 A. Background ............................... 664 B. CDHC Initiatives ...................... ..... 668 1. Public ............................. ...... 669 2. Private ............................ ...... 674 C. Accumulation of Health Data............. ..... 677 II. PRIVACY & SECURITY CONCERNS .................. 678 A. CDHC & HIPAA ....................... ..... 679 1. Regulatory Framework ............... ...... 679 2. Application to CDHC .................. ..... 682 B. Re-identification of Health Data ............... 684 III. STATE ACTION TO PROMOTE TRANSPARENCY AND PROTECT PRIVACY ....................................... 687 A. APCDs for Quality Transparency .............. 688 1. APCD Legislation. ..................... .... 688 2. Focus on Quality Measures .................. 689 B. Incentivize Secondary Use Stewardship... ...... 693 1. Market Demand for Quality Information ....... 693 2. Stewardship Policies .................. ..... 695 IV. STRENGTHS & LIMITATIONS. ......... ............ 697 ABSTRACT Under the auspices of consumer-driven health care, employers, health insurance companies, and governments are promoting the use of health insurance claims data to J.D. Candidate, 2013 Indiana University Robert H. McKinney School of Law; M.P.H. Candidate, 2013 Indiana University Richard M. Fairbanks School of Public Health; B.S., Economics, Sociology, 2008 Creighton University. INDIANA HEALTH LAW REVIEW support informed health care decision-making among consumers. The hope among stakeholders is that consumers will use this information to make efficient health care choices, ultimately driving down health care spending. However, the rich databases derived in the course of these initiatives may also be used in ways that threaten the patient privacy rights envisioned under the Health Insurance Portability and Accountability Act. Part I of this paper addresses how consumer-driven health care currently facilitates commercial practices related to the "secondary use" of health data. Part II describes the nature of the privacy threat, and, finally, Part III suggests specific state- action that may be taken to allow the public to enjoy the best of both worlds: effective transparency initiatives and stewardship of health data. I. CONSUMER-DRIVEN HEALTH CARE A. Background The role of the discriminating consumer is central to a well-functioning market economy.' Comparisons of price and quality should lead to higher-value purchases by consumers, as well as overall market gains as sellers respond to consumers' behaviors. 2 The wide variation in medical prices in the U.S. suggests that engaged consumers have an opportunity to impact the health care market.3 With health care costs rising independent of improvements in health care outcomes, 4 many see an empowered 1 Paul B. Ginsburg, Shopping for Price in Medical Care, 26 HEALTH AFF. w208, w209 (2007). 2 Id 3 Anna D. Sinaiko & Meredith B. Rosenthal, Increased Price Transparency in Health Care-Challenges and Potential Effects, 364 NEW ENG. J. MED. 891, 891 (2011). 4 See DARTMOUTH INST. FOR HEALTH POLICY & CLINICAL PRACTICE, IMPROVING QUALITY AND CURBING HEALTH CARE SPENDING: OPPORTUNITIES FOR THE CONGRESS AND THE OBAMA ADMINISTRATION 2 (2008) (describing research findings that expensive, resource-intensive care does not correlate to improved outcomes); see generally Ezekiel J. Emanuel, It Costs More, but is it Worth More?, N.Y. TIMES 664 Vol. 10:2 HEALTH CARE TRANSPARENCY consumer role as an important tool to controlling health care costs.5 Under consumer-driven health care (CDHC), consumers are expected to compare cost and quality of care across providers and use this information to make efficient choices about what providers to use and what services to obtain.6 However, when services are covered by insurance, the value of price information to consumers hinges largely on their plan's benefit structure.7 To sensitive consumers to the cost of medical care, CDHC embraces the utilization of high- deductible health plans (HDHPs),8 which pair catastrophic insurance coverage with large deductibles. 9 Consumer- directed health plans (CDHPs) are HDHPs that include a tax-advantaged account consumers can use to pay for copayments, coinsurance, and other eligible expenses that are not covered under the health plan. 10 CDHPs may be coupled with a health savings account (HSA) or flexible savings account (FSA).11 Employers may also offer CDHPs based on a health reimbursement arrangement (HRA), OPINIONATOR BLOG (Jan. 2, 2012, 10:18 PM), http://opinionator.blogs. nytimes.com/2012/01/02/it-costs-more-but-is-it-worth-more/; Ezekiel J. Emanuel, Spending More Doesn't Make Us Healthier, N.Y. TIMES OPINIONATOR BLOG (Oct. 27, 2011, 12:53 PM), http://opinionator.blogs. nytimes.com/2011/10/27/spending-more-doesnt-make-us-healthier/. 5 Ginsburg, supra note 1. 6 Id. 7 Id. at w211. 8 HDHPs are defined as "a private health plan with an annual deductible of not less than $1,200 for self-only coverage or $2,400 for family coverage." MICHAEL E. MARTINEZ & ROBIN A. COHEN, HEALTH INSURANCE COVERAGE: EARLY RELEASE OF ESTIMATES FROM THE NATIONAL HEALTH INTERVIEW SURVEY 29 (2011), available at http://www.cdc.gov/nchs/data/nhis/earlyrelease/insur201109.pdf. 9 Nicolas P. Terry, Personal Health Records: Directing More Costs and Risks to Consumers., 1 DREXEL L. REV. 216, 230 (2009), available at http://www.earlemacklaw.drexel.edu/-/media/Files/aw/law%20review/ terry.ashx. 10 GOVERNMENT ACCOUNTABILITY OFFICE, CONSUMER-DIRECTED HEALTH PLANS: HEALTH STATUS, SPENDING, AND UTILIZATION OF ENROLLEES IN PLANS BASED ON HEALTH REIMBURSEMENT ARRANGEMENTs 6 (2010) [hereinafter HEALTH PLANS], available at http://www.gao.gov/new.items/d10616.pdf. 11 MARTINEZ & COHEN, supra note 8. 6652013 INDIANA HEALTH LAW REVIEW which is a type of account that reimburses employees for certain medical expenses. 12 Because consumers are financially responsible for a larger share of their health care expenses, they are supposed to be motivated to seek out high-quality, low-cost health care services.13 CDHC is affecting an increasing number of Americans through their enrollment in HDHPs and other forms of cost sharing.14 Between 2006 and 2011, for example, the percentage of Americans enrolled in employer-sponsored HDHPs increased from 10 percent15 to 27 percent. 16 Over 52 percent of individuals who purchase their own health insurance were enrolled in a HDHP in 2011.17 As of January 2012, enrollment in a HDHP with a HSA, in particular, reached 13.5 million Americans.' 8 With greater proportions of the nation's health care consumers facing significant financial implications from health care purchasing decisions, the need for transparent cost and quality information is growing.19 More specifically, Americans need price and quality information that is easy to access and "actionable." Consumers' ease of access to price and quality information is a foremost determinate of the success of CDHC as a 12 HEALTH PLANS, supra note 10, at 7. 13 ANN TYNAN, ALLISON LIEBHABER & PAUL B. GINSBURG, A HEALTH PLAN WORK IN PROGRESS: HOSPITAL-PHYSICIAN PRICE AND QUALITY TRANSPARENY 1 (2008) [hereinafter TYNAN]. 14 See MARTINEZ & COHEN, supra note 8, at 6 ("HDHPs con-stitute a growing share of both employment-based and directly purchased health plans."). 15 GOVERNMENT ACCOUNTABILITY OFFICE, HEALTH CARE PRICE TRANSPARENCY: MEANINGFUL PRICE INFORMATION IS DIFFICULT FOR CONSUMERS TO OBTAIN PRIOR TO RECEIVING CARE 1 (2011) [hereinafter PRICE TRANSPARENCY], available at http://www.gao.gov/new.items/ d11791.pdf. 16 MARTINEZ & COHEN, supra note 8, at 6. 17 Id. 18 AHIP CENTER FOR POLICY RESEARCH, JANUARY 2012 CENSUS SHOWS 13.5 MILLION PEOPLE COVERED BY HEALTH SAVINGS AC- COUNT/HIGH-DEDUCTIBLE HEALTH PLAN (HSA/HDHPS) 1 (2012), available at www.ahip.org/HSA2012/. 19 DENISE LOVE ET AL., ALL-PAYER CLAIMS DATABASES: STATE INITIATIVES TO IMPROVE HEALTH CARE TRANSPARENCY 1 (2010). 666 Vol. 10:2 HEALTH CARE TRANSPARENCY reform tool. 2 0 Historically, however, consumers (and other stakeholders)21 have faced significant, if not impenetrable, barriers to obtaining price information for health care services.22 Obviously, consumers cannot use information that they do not have. Consumers are also unable to use information that is not meaningful to them. Price information must be presented in a meaningful way in order for it to effectively enable consumers. 23 "Actionable" price information must (1) enable comparisons between different providers and different treatment options, (2) include the complete cost to the consumer, and (3) be linked to quality data.24 A consumer's complete health care cost should total all costs associated with a given episode of care (including, for instance, lab fees and physician services typically billed separately); reflect any negotiated insurance discounts; and identify the consumer's direct, out-of-pocket expense. 25 Quality of care information provides consumers with a context in which to evaluate price differences and apportion health care value. 26 Overall, consumers "require credible and accessible information on a wide range of issues, from evidence on what diagnostic and therapeutic strategies are effective to 20 Terry, supra note 9, at 229. 21 Anne B. Claiborne et al., Legal Impediments to Implementing Value-Based Purchasing in Healthcare, 35 Am. J.L. & MED. 442, 477 (2009) ("As a result, consumers (and payors and employer purchasers) often do not understand what they are paying for their healthcare and cannot link cost to quality to derive the overall value of their healthcare."); see also, e.g., Shawn Leavitt, Employers Need Healthcare Price Transparency, THE HILL'S CONGRESS BLOG (Jan. 31, 2012, 11:37 AM), http://thehill.com/blogs/congress-blog/healthcare/207631-shawn-leavitt- vice-president-global-compensation-and-benefits-at-carlson (last visited May 8, 2013). 22 See generally PRICE TRANSPARENCY, supra note 15, at 12. 23 Ginsburg, supra note 1, at w211. 24 CALIFORNIA HEALTHCARE FOUNDATION, MAKING HEALTH CARE COSTS MORE TRANSPARENT TO CONSUMERS: A SUMMARY FOR POLICYMAKERS 1 (Susan B. Kanaan ed., 2008). 25 PRICE TRANSPARENCY, supra note 15, at 2. 26 Id. at 9. 2013 667 INDIANA HEALTH LAW REVIEW how providers compare on dimensions of cost and quality"27 in order to function effectively within CDHC. B. CDHC Initiatives Many health care stakeholders agree that transparency in health care is essential for a higher performing health care system. 28 Supporting cost-conscious health care "shopping" through transparency initiatives generally enjoys bipartisan support among policymakers, 29 because of the potential to reduce health care costs without disrupting current payment and delivery systems. 30 Among the private sector, the Health Care Opinion Leaders Survey commissioned by the Commonwealth Fund in 2007 found that 84 percent of business leaders consider increased transparency in the quality and price of health care services to be important. 31 Reflecting this interest, various efforts have been initiated in recent years within the public and private sectors to make health care information available to consumers. Between 2010 and 2011, the Government Accountability Office (GAO) performed a study of select price transparency initiatives around the country. 32 The GAO defined "price transparency initiative" to include "initiatives that make 27 Price and Quality Transparency of Medical Services: Hearing on Making Health Care Work for American Families' Saving Money, Saving Lives, 111th Cong. 3 (2009) (statement of Paul B. Ginsburg, President, Center for Studying Health System Change) [hereinafter Hearing], available at http://democrats.energycommerce.house.gov/ Press_11 1/20090402/testimony-ginsburg.pdf. 28 KRISTOOF STREMIKIS ET AL., HEALTH CARE OPINION LEADERS' VIEWS ON TRANSPARENCY AND PRICING 3 (2010) (finding more than nine out of ten opinion leaders think public access to information on clinical quality, cost, and patient experience is either important or very important), available at http://www.commonwealthfund.org/Surveys/ View-All.aspx; but see Hearing, supra note 27 ("I continue to be concerned that the promise of transparency is being oversold and overhyped .... ). 29 Hearing, supra note 27. 30 Ginsburg, supra note 1, at 893. 31 STREMIKIS ET AL., supra note 28. 32 See generally PRICE TRANSPARENCY, supra note 15. 668 Vol. 10:2 HEALTH CARE TRANSPARENCY provider-specific price information on a specific health care service available to consumers and other interested parties."33 The GAO found that the information provided by these initiatives varies based on the available data, and that few are able to provide estimates of consumers' complete costs due to limited data and "other obstacles."34 Overall, the initiatives tend to provide information about a limited set of hospital or surgical services that are common, comparable, or planned in advance, such as knee replacement or a diagnostic test.35 Most of the initiatives also provide a wide range of nonprice information, such as quality of care measures or patient volume. 36 The availability of information on physician quality is less common than hospital quality reporting, "probably because of the difficulty of developing and collecting meaningful statistical quality measures when each physician sees relatively few patients."37 This section will expand upon certain leading public and private transparency initiatives and their emergence in the market. 1. Public Government-funded transparency initiatives are being conducted at both federal and state levels. In 2001, the Centers for Medicare and Medicaid Services (CMS) launched the Quality Initiative to empower consumers with quality of care information and encourage providers to improve the quality of care they deliver.38 This initiative 33 Id. at 5. 34 Id at 17 (referring to various legal factors cited among re- spondents as being a barrier). 35 Id. at 1. 36 Id. at 22. 37 Kristin Madison, The Law and Policy of Health Care Quality Reporting, 31 CAMPBELL L. REV. 215, 219 (2009). 38 CENTERS FOR MEDICARE & MEDICAID SERVICES, HOSPITAL QUALITY INITIATIVE OVERVIEW (2008), available at https://www.cms.gov/ Medicare/Quality-Initiatives-Patient-Assessment-Instruments/Hospital Qualitylnits/downloads/HospitalOverview.pdf. 2013 669 INDIANA HEALTH LAW REVIEW has developed substantially since then.39 Now, consumers can compare hospitals based on quality information, patient satisfaction survey information, and pricing information for specific procedureS40 using CMS's Hospital Compare online platform.41 Consumers can also access information and make comparisons, to varying degrees, about nursing homes, physicians, home health providers, dialysis facilities, and Medicare supplemental insurance plans. 42 However, even CMS's more robust hospital comparison measures do not provide specific price information, let alone information about the complete cost to a particular consumer. Instead, prices are presented as either higher or lower than the national average and do not reflect beneficiary's cost-sharing obligations.43 Because of this and many other limitations to the effective use of Compare data, this initiative does not fit within the focus of this paper and will not be discussed further. However, it is worth mentioning that, pursuant to Section 10332 of the Affordable Care Act, CMS now makes available standardized extracts of Medicare claims data to qualified entities for purposes of measuring provider performance. 44 As Medicare claims data represent a substantial portion of health care utilization, cost, and outcomes that is otherwise challenging if not impossible to collect, 45 meaningful access to this information could significantly improve the comprehensiveness of transparency initiatives. State governments are responding to CDHC by taking action to gather and make available robust information 39 See generally About Hospital Compare Data, MEDICARE.GOV, http://www.medicare.gov/HospitalCompare/Data/AboutData/About.aspx (last visited May 3, 2013). 4 0 Id. 41 See Hospital Compare, MEDICARE.GOV, http://www.medicare. gov/hospitalcompare/ (last visited May 3, 2013). 4 2 Id. 43 See Medicare Payment, MEDICARE.GOV, http://www.medicare. gov/HospitalCompare/About/HOSInfolMedicare-Payment. aspx (lastvisited May 3, 2013). 44 See Medicare Program: Availability of Medicare Data for Performance Measurement, 76 Fed. Reg. 76541 (Dec. 7, 2011). 45 LOVE ET AL., supra note 19, at 3. 670 Vol. 10:2 HEALTH CARE TRANSPARENCY about the cost and performance of health care providers operating in their state.46 The current data systems in many states leave critical gaps in information. 47 For instance, although almost every state has a hospital discharge data reporting program that includes all patient data for inpatient hospital stays, this data does not include the actual amount of payment made to the facility. 48 Nearly twenty states are also missing data from the majority of ambulatory care and pharmacy services, which account for a majority of health care expenditures. 49 To supplement existing reporting requirements and achieve a system-wide view of health care cost and quality, many states are developing All Payer Claims Databases (APCDs).50 APCDs are "databases, created by state mandate, that typically include data derived from medical claims, pharmacy claims, eligibility files, provider files, and dental claims from private and public payers. In states without a legislative mandate, there may be voluntary reporting of these data."5 1 In other words, APCDs contain 'service-level' information based on valid claims processed by health payers, which include data on diagnoses, procedures, care locations, providers, provider payments, and patient demographics. 52 Health insurance plans routinely aggregate claims data into their own administrative databases, and APCDs combine the data from all payers in a state. 53 As a result, APCDs contain the information needed to derive a deeper understanding of costs, quality, and utilization patterns. 54 46 Id.at1. 47 See id. at 3 -4. 48 Id. at 3. 49 Id. 50 Id. at 4. 51 Id. at 2. 52 NAT'L CONFERENCE OF STATE LEGISLATORS, PUB, COLLECTING HEALTH DATA: ALL-PAYER CLAIMS DATABASES 1 (2010) [hereinafter NCSL]. 53 LOVE ET AL., supra note 19, at 2. 54 Id. at 2. 2013 671 INDIANA HEALTH LAW REVIEW While voluntary reporting occurs in some states, broad legislative authority appears necessary for the on-going collection and publication of complete, state-wide information.5 5 Among other barriers, privacy laws may make it difficult for health plans to release detailed patient data without express legal authority.56 Pursuing legislation to ensure participation across the entire spectrum of health care payers is worthwhile because of the capabilities that this level of transparency makes possible: With transparency comes access, for a wide variety of stakeholders, to information that has never before been available, thus creating the ability for actionable and accountable measures. For providers, APCDs have the potential to promote quality improvement. Payers have information to reward the delivery of high value efficient care. And, consumers have information to make rational choices based on cost and quality information.57 Consumers, providers, purchasers, policymakers, and other health care stakeholders are currently using APCDs in eight states: Kansas, Maine, Massachusetts, Maryland, Minnesota, New Hampshire, Utah, and Vermont.5 8 Soon, these databases will also be available in Colorado, Oregon, and Tennessee. 59 Using data from their APCDs, several states have developed websites to communicate cost 55 Id. at 2-3, 7-8 (reporting that most voluntary APCD initia-tives cover a limited geographic area or subset of claims data or were established for one-time claims aggregation, and later explaining that voluntary reporting may pose challenges to the public release of comparative reports). 56 Id. at 8. 57 DENISE LOVE ET AL., ALL-PAYER CLAIMS DATABASES: AN OVER- VIEW FOR POLICYMAKERS 6 (2010) [hereinafter LOVE ET AL. 21. 58 LOVE ET AL., supra note 19, at 2 (adding that limited, voluntary initiatives have been established in Louisiana, Wisconsin, and Washington State). 59 Id. (adding that limited, voluntary initiatives have been es- tablished in Louisiana, Wisconsin, and Washington State). 672 Vol. 10:2 HEALTH CARE TRANSPARENCY information to consumers. Massachusetts,6 0 Maine, 61 and New Hampshire 62 offer websites that allow consumers to view quality ratings and/or compare pricing of certain medical procedures by health care provider."8 Among these states, New Hampshire is leading the use of APCD data to further CDHC. In 2003, New Hampshire passed a law to create the New Hampshire Comprehensive Health Information System (CHIS).64 Health carriers and third party administrators are required to disclose claims data to the state for aggregation into CHIS.6 5 The data are then to be made "available as a resource for insurers, employers, providers, purchasers of health care, and state agencies . .. to enhance the ability of New Hampshire consumers and employers to make informed and cost-effective health care choices." 66 Towards this end, New Hampshire has created a consumer- focused 67 website, New Hampshire HealthCost,68 which uses CHIS data to provide consumers with comparative information about the median total cost 69 a hospital, surgery center, physician or other health care professional receives for its services. 70 Insured individuals can input information about their health benefits coverage, and HealthCost will calculate their out-of-pocket cost as well as a total cost that is inclusive of any negotiated discounts on 60 See MYHEALTHCAREOPTIONS, http://hcqcc.hcf.state.ma.us/Default. aspx (last visited May 3, 2013). 61 See MAINEHEALTH, http://www.mainehealth.org/mhbody.cfm? id=6536 (last visited May 3, 2013). 62 See NH HEALTHCOST, http://www.nhhealthcost.org/ (last vis- ited May 3, 2013). 63 LOVE ET AL. 2, supra note 57. 64 N.H. REV. STAT. § 420-G:11; see generally New Hampshire Comprehensive Health Care Information System, http://www.nhchis. org/ (last visited May 3, 2013). 65 N.H. REV. STAT. § 420-G:11. 66 N.H. REV. STAT. § 420-G:11. 67 LOVE ET AL. 2, supra note 57, at 5-6. 68 NH HEALTHCOST, supra note 62. 69 Health Cost for Consumers - Methodology, NH HEALTHCOST, http://www.nhhealthcost.org/method.aspx (last visited May 3, 2013). 70 NCSL, supra note 52, at 2. 6732013 INDIANA HEALTH LAW REVIEW providers' billed charge.71 Thus, HealthCost provides consumers with an estimate of the complete health care cost for a given service. 72 New Hampshire has also been able to use CHIS data to create a tiered-network insurance product for the small group marketplace. 73 Overall, having access to claims data has allowed New Hampshire to produce health care cost and quality information relevant to a wide range of stakeholders. 74 2. Priva te In contrast to many public transparency initiatives, private sector transparency initiatives have been established voluntarily in response to demand in the marketplace from a variety of sources. 75 More individuals enrolled in HDHPs means that more consumers need help accessing and using price and quality information.76 Many health plans, especially national insurers, are providing this information to enrollees in an effort to serve as a valued intermediary and gain competitive advantage.77 A strength of the transparency initiatives developed by health plans is that they provide consumers with even more thoroughly tailored information. For example, Aetna's price transparency website incorporates, in real-time, an enrollee's partially exhausted deductible into calculations of out-of-pocket costs.7 8 Ultimately, health plans are hoping 71 PRICE TRANSPARENCY, supra note 15, at 25. 72 Id, 73 LOVE ET AL. 2, supra note 57, at 1. 74 See, e.g., id. (allowing employers to compare variations in the cost and utilization of services by geographic area and provider setting); NCSL, supra note 52, at 2 (allowing employers to compare health plan premiums and benefits across health insurance carriers). 75 PRICE TRANSPARENCY, supra note 15, at 10. 76 TYNAN, supra note 13, at 7. 77 Id.; see, e.g., Press Release: WellPoint Announces New Suite of Online Tools to Support Consumer-Driven Health, WELLPoINT (Sept. 21, 2005), http://ir.wellpoint.com/phoenix.zhtml?c= 130104&p=irol-news Article&ID=759332&highlight= (last visited May 8, 2013) ("Subimo is delighted to expand our relationship with WellPoint as they look to lead in consumer-driven health care."). 78 PRICE TRANSPARENCY, supra note 15, at 25. 674 Vol. 10:2 HEALTH CARE TRANSPARENCY that enrollees with access to provider price and quality information will be more likely to use physicians and hospitals that provide efficient, high-value health care services. 79 Many of the benefits to consumers from transparency initiatives also apply to employers, particularly those offering CDHPs.80 Large employers realize that a broad consumerism strategy, where employees are taking more responsibility for health care costs and treatment decisions, requires the availability of price and quality information.81 The pressure by large employers for health plans to provide price and quality information has been a significant factor in spurring the developing of transparency initiatives.82 Thus, embracing transparency has been one way for health plans to create new value for employer clients, as well. 8 3 Similarly, financial institutions may develop transparency initiatives in response to the steady increase in the number of individuals enrolled in CDHPs.84 Financial institutions are related to CDHC in their capacity as administrators of HSAs, FSAs, and HRAs. Many employers who offer CDHPs with these types of accounts provide employees with a health benefit card, which is essentially a debit card pre-loaded with the funds contributed to the employee's HSA, FSA, or HRA account.85 For example, since at least 2006, U.S. Bank has been providing cost and quality information to the bank's institutional clients' employees and retail customers. 8 6 In addition, many large, self-insured employers are interested in providing transparency tools for their 7 TYNAN, supra note 13. so LOVE ET AL. 2, supra note 57, at 6. 81 TYNAN, supra note 13. 82 Id. at 2. 83 Id. at 2. 84 Karen Krebsbach, HSAs: US. Bank, Subimo to Share Platform, AMERICAN BANKER (Feb. 1, 2006, 2:00 AM), http://www.americanbanker. com/magazine/116_2/-270255-1.html?zkPrintable=true (last visited May 3, 2013). 85 Card Holders, SIGIS, http://www.sig-is.org/card-holders (last visited May 3, 2013). 86 Krebsbach, supra note 84. 2013 675 INDIANA HEALTH LAW REVIEW employees directly.87 However, these employers may be challenged by the fact that they have employees enrolled under multiple health plans, making it necessary to aggregate claims across payer systems. For example, EMS, a Hopkins, Massachusetts-based company, realized it had employee claims scattered across thirty-eight different health plans when it began to plan its own transparency initiative. 88 Furthermore, such employers may want to adopt consumer platforms that not only provide employees with price and quality information, but also enable employees to manage health data in personal health records in an effort to realize greater cost savings by encouraging employees to take responsibility for lifestyle choices as well as treatment decisions.89 Needless to say, these initiatives are a significant undertaking for employers, financial institutions, and insurers, alike. To address the technology issues associated with CDHC initiatives, employers, health plans, and financial institutions are turning to health information and application vendors.90 In the GAO's study of transparency initiatives, it found that most health plans use a vendor to aggregate or manage all of the measures and data sources necessary for their transparency initiatives, with Subimo, which was actually acquired by WebMD in 2006,91 being the 87 Bill Roberts, Modeling Better Health Care: Online Tools Help Employees Make Wiser Health Care Decisions, 51 HR MAGAZINE 93, 94 (2006). 88 Joanne Wojcik, EMC Creates Data Warehouse to Analyze Health Costs. Effort Produces Data-Rich PHRs for Employees, BUSINESS INSURANCE (June 26, 2011, 6:00 AM), http://www. businessinsurance.com/article/20110626/ISSUEO3/306269988 (last visited May 8, 2013). 89 Kenneth D. Mandl & Isaac S. Kohane, Tectonic Shifts in the Health Information Economy, Sounding Board, 358 NEW ENG. J. MED. 1732, 1732 (2008); see, e.g., Wojcik, supra note 88. 90 Kate Ackerman, Consumers Tap Online Tools to Better Man -age Their Health, IHEALTHBEAT (Jan. 29, 2008), http://www.ihealthbeat. org/features/2008/consumers-tap-online-tools-to-better-manage-their- health.aspx (last visited May 3, 2013). 91 See Eric Wicklund, WebMD to Acquire Subimo, HEALTHCARE IT NEWS (Nov. 2, 2006), http://www.healthcareitnews.com/news/webmd- acquire-subimo (last visited May 8, 2013). 676 Vol. 10:2 HEALTH CARE TRANSPARENCY most common vendor used.92 However, a number of other vendors also offer consumer-focused platforms and data management services, including CastLight Health, 93 OptumInsight, 94 and Compass Healthcare Advisors. 9 5 Overall, the technology companies supplying the backbone to CDHC initiatives are taking an integral and transformative role in the management of health care information. C. Accumulation of Health Data The result of all this activity around CDHC may be "the largest, richest, and most up-to-date body of health data on a group of individuals."96 Collecting a large body of claims into one data system permits a longitudinal view on the health status and health care utilization of individual patients. 97 The comprehensive nature of this data and its related ability to reveal utilization patterns makes it immeasurably more valuable for commercial uses. 98 Furthermore, the consumer-driven model of data aggregation has the effect of significantly enhancing data liquidity. 99 In effect, "the potential for abuse is immense. 00 The desirability of this data is significant because organizations with health data often sell it.101 Typically, 92 TYNAN, supra note 13, at 5. 93 CASTLIGHT HEALTH, http://www.castlighthealth.com/ (last vis- ited May 3, 2013). 94 OPTUMINSIGHT, http://www.optuminsight.com/ (last visited May 3, 2013). 95 SMARTSHOPPER, https://www.compasssmartshopper.com/ (last visited May 3, 2013). 96 Mandl & Kohane, supra note 89, at 1734. 97 See Nicolas P. Terry, What's Wrong With Health Privacy?, 5 J. HEALTH & BIOMEDICAL L. 1, 20 (2009) [hereinafter Health Privacy] (consolidating information silos creates longitudinal patient data). 98 Id. at 23. 99 Mandl & Kohane, supra note 89, at 1733. 100 Health Privacy, supra note 97, at 23. 101 Marc A. Rodwin, Patient Data: Property, Privacy, & the Public Interest, 36 AM. J.L. & MED. 586, 588 (2010). The unsettled issues surrounding patient data ownership are important but outside the scope of this paper. 6772013 INDIANA HEALTH LAW REVIEW this data is first anonymizedl 02 and then sold to entities like commercial aggregators or data miners. 103 The term "medical information organization" refers to the specialized firms that broker the buying and selling of medical data.104 The commercial collection, compilation, and manipulation of health information are "secondary uses" of health data, a term which may be applied to any use of health data that is not for treatment, payment, or health care operations. 05 Concerns have been mounting that the growing market for secondary uses of longitudinal patient data and the development of new technologies for manipulating these databases presents a significant threat to the patient confidentiality regime envisioned under HIPAA.106 II. PRIVACY & SECURITY CONCERNS Assessing the privacy threat posed by the secondary use of data derived through CDHC transparency initiatives requires understanding the ways in which HIPAA does and does not regulate health information and the entities that possess it. 102 Id. 103 C. Christine Porter, De-identified Data and Third Party Da-ta Mining The Risk of Re-identfication of Personal Information, 5 SHIDLER J.L. COM. & TECH. 3, at para. 2 (2008), available at http:/ digital.law.washington.eduldspace-law/bitstream/handle/1773.1/417/vol5 nol_art3.pdf. 104 Rodwin, supra note 101, at 590. 105 NAT'L COMM. ON VITAL HEALTH STATISTICS, ENHANCED PRO- TECTIONS FOR USES OF HEALTH DATA: A STEWARDSHIP FRAMEWORK FOR "SECONDARY USES" OF ELECTRONICALLY COLLECTED AND TRANSMITTED HEALTH DATA 11 (2007), available at http://www.ncvhs.hhs.gov/ 0712211t.pdf. 106 See Nicolas P. Terry, Legal Issues Related to Data Access, Pooling, and Use, in CLINICAL DATA AS THE BASIC STAPLE OF HEALTH LEARNING: CREATING AND PROTECTING A PUBLIC GOOD 151, 159-161 (Claudia Grossmann et al., eds., 2010). 678 Vol. 10:2 HEALTH CARE TRANSPARENCY A. CDHC & HIPAA 1. Regulatory Framework The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was enacted to effectuate standards for the electronic exchange, privacy, and security of certain health information.107 The HIPAA Privacy Rule108 (Privacy Rule) establishes national standards governing the use and disclosure of individuals' medical records and other personal health information. 109 These standards are operationalized into specific safeguards under the HIPAA Security Rule 10 (Security Rule)."' Collectively, these rules are intended to protect patient privacy without hindering the delivery of medical treatment or public health and well-being. 112 HIPAA's privacy and security standards apply to protected health information held by covered entities1 13 and their business associates. 114 "Protected health information" (PHI) includes individually identifiable health information transmitted or maintained in electronic form. 15 "Individually identifiable health information" includes information that "relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual" if such information identifies the individual or one could reasonably believe that the 107 DEP'T HEALTH & HUMAN SERVS., OCR PRIVACY BRIEF, SUM-MARY OF THE HIPAA PRIVACY RULE 1 (2003). 108 See 45 C.F.R. § 160 (2012); 45 C.F.R. § 164(A-E) (2012). 109 OCR PRIVACY BRIEF, supra note 107. 110 See 45 C.F.R. § 160 (2012); 45 C.F.R. § 164(A, C) (2012). 111 Summary of the HIPAA Security Rule, HHS.gov, http://www. hhs.gov/ocr/privacy/hipaa/understanding/srsummary.html (last visited May 3, 2013). 112 OCR PRIVACY BRIEF, supra note 107 (describing a "major goal" of the Privacy Rule); Summary of the HIPAA Security Rule, supra note 111 (describing a "major goal" of the Security Rule). 113 45 C.F.R. §§ 164.302; 164.500 (2012). 114 42 U.S.C. §§ 17931; 17934. 115 45 C.F.R. § 160.103 (2012). 6792013 INDIANA HEALTH LAW REVIEW information could be used to identify the individual. 116 Thus, HIPAA attempts to protect only a subset of health data. 117 Similarly, only certain custodians of "individually identifiable health information" are subject to the Privacy Rule and Security Rule. 118 These "covered entities" are health plans, health care clearinghouses, and health care providers who engage in HIPAA electronic transactions. 119 Third party vendors are also subject to HIPAA in their capacity as a "business associate" of a covered entity. A "business associate" performs a function or activity or provides a service on behalf of a covered entity that requires the use or disclosure of personally identifiable health information.120 HIPAA requires that covered entities establish written agreements - commonly referred to as "business associate agreements" (BAAs) - in order to disclose the necessary1 21 PHI to a business associate. 122 BAAs must "establish the permitted and required uses and disclosures of [PHI] by the business associate,"123 and "may not authorize the business associate to use or further 116 Id. 117 See 45 C.F.R. § 160.103 (2012) (stating that "individually identifiable health information is information that is a subset of health information"). 118 HIPAA Privacy Rule & Public Health: Guidance from CDC and US. Department of Health & Human Services, CDC (Apr. 11, 2003), http://www.cdc.gov/mmwr/preview/mmwrhtml/m2e41lal.htm (last visited May 8, 2013) [hereinafter Guidance from ODC} (pointing out that other entities who regularly use, disclose, or store "individually identifiable health information," like auto or life insurers, are not subject to the Privacy Rule). 119 45 C.F.R. § 160.103 (2012). 120 Id. 121 "When using or disclosing protected health information . . . , a covered entity must make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose .. . ." 45 C.F.R. § 164.502(b)(1). 122 45 C.F.R. § 164.502(e)(1) (2012) ("A covered entity may dis-close [PHI] to a business associate and may allow a business associate to create or receive [PHI] on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information."). 123 45 C.F.R. § 164.504(e)(2)(i) (2012). 680 Vol. 10:2 HEALTH CARE TRANSPARENCY disclose the information in a manner that would violate [the Privacy Rule], if done by the covered entity . . . ."124 In effect, BAAs bind business associates to the same restrictions and limitations on the use and disclosure of PHI that apply to the covered entity.125 Beyond contractual obligations, business associates are also directly accountable for compliance with certain provisions in the Privacy Rule and Security Rule. First, the "Health Information Technology for Economic and Clinical Health" (HITECH) Act, Title XIII of the American Recovery and Reinvestment Act of 2009, extends the application of civil and criminal penalties permitted under HIPAA to include business associates who use or disclose PHI in violation of their BAA.126 Second, HITECH makes business associates directly subject to certain provisions in the Security Rule and related civil and criminal penalties. 127 In these respects, business associates are regulated under HIPAA as if a covered entity. HIPAA requires covered entities (and, thus, their business associates) to ensure the confidentiality of electronic PHI and protect against reasonably anticipated threats to the security of such information or uses or disclosures prohibited under the Privacy Rule.128 The Privacy Rule effectively prohibits all uses or disclosures of PHI that are not expressly permitted or required under its terms.129 Generally, covered entities are permitted to use or disclose PHI to carry out treatment, payment, or health care operations (TPO).130 The Privacy Rule also permits covered entities to use or disclose PHI as necessary for certain public health activities 131 or to comply with a law,132 124 45 C.F.R. § 164.504(e)(2)(i) (2012). 125 THOmAS D. BIXBY & DEBORAH MARINE, HITECH ACT CHANGES To HIPAA: WHAT THEY MEAN FOR HEALTH PLANS 2-3 (2009), available at http://www.healthlawyers.org/Events/Programs/Materials/Documents/ PPMC09/bixby-marine.pdf. 126 42 U.S.C. § 17934(c) (2012). 127 42 U.S.C. § 17931(a) (2012). 128 45 C.F.R. §§ 164.306(a); 164.512 (2012). 129 45 C.F.R. § 164.502(a) (2012). 130 45 C.F.R. § 164.506(a) (2012). 131 45 C.F.R. § 164.512(b) (2012). 6812013 INDIANA HEALTH LAW REVIEW including state and local reporting laws and regulations. 133 Another permitted use of PHI is to create health information that is not "individually identifiable health information." 134 Covered entities may disclose PHI to business associates for that purpose, as well, regardless of whether or not de-identification is on behalf of the covered entity.135 In other words, business associates are permitted to de-identify PHI for their own, independent purposes. Covered entities or business associates must follow one of two "implementation specifications" for de-identification of PHI:136 statistical de-identification or the safe harbor method. 137 Statistical de-identification requires a qualified statistician to conclude that the risk of the information being used, alone or in combination with other information, to identify the individual to whom the information pertains is "very small."13 8 More commonly, de-identification occurs by removing seventeen specified identifiers, as well as any other unique identifying code. 139 Health information that has been de-identified in accordance with these specifications is no longer "individually identifiable health information,"140 or, therefore, PHI. Once individually identifiable health information has been de-identified, "it requires no individual privacy protections" and may be used or disclosed without regard to the Privacy Rule.141 2. Application to CDHC Whether the Privacy Rule and Security Rule are relevant to CDHC initiatives depends initially on whether 132 45 C.F.R. § 164.512(a) (2012). 133 Guidance from CDC, supra note 118, at 2. 134 45 C.F.R. § 164.502(d)(1) (2012). 135 Id. ("A covered entity may . . . disclose protected health infor- mation only to a business associate for such purpose, whether or not the de-identified information is to be used by the covered entity."). 136 45 C.F.R. §§ 164.502(d)(2); 164.514(b) (2012). 137 Guidance from CDC, supra note 118. 138 45 C.F.R. § 164.514(b)(1) (2012). 139 45 C.F.R. § 164.514(b)(2) (2012). 140 45 C.F.R. § 164.502(d)(2) (2012). 141 Guidance from CDC, supra note 118. 682 Vol. 10: 2 HEALTH CARE TRANSPARENCY claims data is PHI and whether entities engaged in transparency initiatives are "covered entities" or "business associates." Claims data are generated for billing purposes, and therefore necessarily contain identifying information related to an individual's health condition and/or treatment(s) received. In other words, claims data contain "individually identifiable health information." In addition, the entities engaged in transparency initiatives are "covered entities" or "business associates." First, state agencies managing APCDs probably meet the definition of a covered entity as a healthcare clearing house, 142 but data privacy and security is typically addressed by the enabling legislation or implementing regulations. 143 Second, health plans, including those offered by large, self-insured employers, are specifically identified as a covered entity.14 4 A financial institution is a "business associate" when it administers HSAs, FSAs, or health benefit cards on behalf of a health plan.145 Generally, financial institutions146 are exempt from HIPAA regulations when using or disclosing information for payment administration services for health plan premiums or health care when payment is made by "any means, including a credit, debit, or other payment card . . . ."147 However, the term "other payment cards" was not intended to include health benefit cards, which are used for identification of individual, plan, and benefits. 148 Thus, financial institutions engaged in CDHC initiatives are subject to HIPAA. Finally, technology companies that serve as health information and application vendors for these entities are 142 45 C.F.R. § 160.103 (2012). 143 NCSL, supra note 52, at 3. 144 45 C.F.R. § 160.103 (2012). 145 Jan Hertzberg & Cindy Davis, What Health Care Legislation Means for Financial Institutions, CURRENCY, Feb. 2010, at 2. 146 See definition of "financial institution" at 12 U.S.C. § 3401(1). 147 42 U.S.C. § 1320d-8 (2012). 148 Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,617 (Dec. 28, 2000) (Part II. Section-By-Section Description of Rule Provisions), available at https:// federalregister.gov/a/00-32678 (last visited Apr. 22, 2013). 2013 683 INDIANA HEALTH LAW REVIEW performing a function for covered entities requiring the use of PHI, and thus are business associates under HIPAA. BAAs must be established in order for financial institutions, employers, and health plans to disclose PHI to companies like WebMD for purposes related to CDHC initiatives. However, in practice, BAAs often do not specifically describe the permitted uses of PHI.149 Instead, these contracts include vague statements such as, "the contract covers use and disclose of protected health information only as permitted or required or as otherwise required by law."1 50 Without explicit enumeration of the extent and nature of a business associate's use of PHI, BAAs only require compliance with HIPAA. Thus, technology companies assisting in transparency initiatives may de-identify PHI in accordance with HIPAA standards. As de-identified data is not protected under HIPAA, technology companies and their agents may then use de- identified data without regard to the BAA. 151 B. Re-identification of Healtl2 Data Like many, if not most, companies that collect personal information, 152 technology companies engaged in CDHC initiatives assure customers that their information will be released only in an anonymous or "patient de-identified" form. 1 53 The underlying assumption, present here as well as within HIPAA's regulatory framework, is that what constitutes "identifiable patient information" is a fixed set of attributes, like name and address. 154 Remove these 149 NAT'L COMM. ON VITAL HEALTH STATISTICS, supra note 105, at 18. 150 Id 151 Id. at 28. 152 Arvind Narayanan & Vitaly Shmatikov, Myths & Fallacies of 'Personally Identifiable Information," 53 COMMC'N ACM 24, 25 (2010), available athttp://www.cs.utexas.edu/-shmat/shmatcacm10.pdf. 153 See Castlight Health Privacy Policy, CASTLIGHT HEALTH (June 10, 2011), http://www.castlighthealth.com/privacy-policy-2011/ (last visited Apr. 22, 2013). 154 Narayanan & Shmatikov, supra note 152. 684 Vol. 10:2 HEALTH CAHI TRANSPARENCY identifiers, and there is complete anonymity to the individual data subjects.15 5 In contrast, the ability to re-identify health data, even after applying the HIPAA definition of de-identification, was noted by the National Committee on Vital and Health Statistics (NCVHS) as an area of concern in 2007.156 Re- identification is the linkage of de-identified personal information with an overt identifier that belongs or is assigned to an individual. 15 7 Re-identification is a growing concern because of the vast amounts of personal information available online and in off-line records systems, as well as new technological abilities158 that challenge the notion of "identifiable" as a binary state.159 A major challenge for de-identification is that the amount of information available about individuals is huge.160 Any information that distinguishes among individuals can be used to re-identify de-identified information.161 Increasingly, consumers are submitting health information into internet websites like WebMD and social network sites, which maintain this information in combination with other personal information.162 The NCVHS's concern about re-identification was particularly pronounced in regards to data stored in these types of merged databases.163 The more personal data that is 155 Robert Gellman, The Deidentification Dilemma: A Legisla-tive and Contractual Proposal, 21 FORDHAM INTELL. PROP. MEDIA & ENT. L.J. 33, 38 (2010). 156 Letter from Simon P. Cohn, Chairman, Nat'l Comm. on Vital and Health Statistics to Michael 0. Leavitt, Secretary, Dep't of Health & Human Servs. (Dec. 21, 2007), available at http://www.ncvhs.hhs.gov/ 0712211t.pdf. 157 Gellman, supra note 155, at 34. 158 Paul M. Schwartz & Daniel J. Solove, The PIIProblem: Privacy and a New Concept of Personally Identifiable Information, 86 N.Y.U.L. REV. 1814, 1846 (2011). 159 Gellman, supra note 155, at 40. 160 Id. at 36. 161 Narayanan & Shmatikov, supra note 152. 162 See Gellman, supra note 155, at 36-37. 163 NAT'L COMM. ON VITAL HEALTH STATISTICS, supra note 105, at 5. 2013 685 INDIANA HEALTH LAW REVIEW available, the easier it becomes to trace de-identified information to its data subject. 164 In addition, technology increasingly enables the combination of seemingly non-identifiable information to produce identifiable information.165 Researchers have demonstrated the potential for advanced algorithms to re- identify de-identified data.166 However, it should be noted that in most instances when re-identification is known to have occurred, health data was not involved.167 Furthermore, the health data was often not de-identified according to HIPAA standards.168 When it was, the success rate was very low (.013% of records re-identified).169 On the other hand, most published instances of re-identification were conducted by researchers as demonstration projects.170 It is reasonable to suspect that successful re-identification efforts by other parties are not brought to the public's attention, making it difficult to assess the actual threat posed by re-identification based on the published literature. What is known, however, is that organizations do acquire health data by purchasing HIPAA de-identified data.171 Some of these organizations then link the data to provider databases to market to providers, or use the data to market to a circumscribed population that is likely to include a population of interest to the organization.172 164 Geilman, supra note 155, at 36. 165 Schwartz & Solove, supra note 158, at 1842. 166 For examples of various exercises conducted by researchers to demonstrate the ease and/or possibility of re-identification see Gellman, supra note 155, at 37-39. 167 Khaled El Emam et al., A Systematic Review of Re- Identification Attacks on Health Data, 6 PLOS ONE, Dec. 2, 2011, at 4, available at http://www.plosone.org/article/info%3Adoi%2F10.1371%2F journal.pone.0028071 (finding six of fourteen re-identification attacks involved health data) (last visited Apr. 22, 2013). 168 Id. at 6 (finding five out of six involved health data not fully de- identified). 169 Id. at 9. 170 Id. at 5. 171 NAT'L COMM. ON VITAL HEALTH STATISTICS, supra note 105, at 22. 172 Id 686 Vol. 10:2 HEALTH CARE TRANSPARENCY Given the high value Americans place on privacy173 and the potential harm from an erosion of trust in the confidentiality within which one's personal health information is supposed to be held within the health care system, 74 the issue of re-identification merits a closer look. As Robert Gellman puts it: There will always be a tradeoff of some sort, involving the degree of identifiability of the data, the usability of the data, the privacy of the data subjects, and the cost of the deidentification process... What legislation can do, however, is establish a statutory framework that will allow the data disclosers and the data recipients to agree voluntarily on externally enforceable terms that provide privacy protections for the data subjects.175 III. STATE ACTION TO PROMOTE TRANSPARENCY AND PROTECT PRIVACY CDHC is a priority among many health care stakeholders. The resulting accumulation of health information has the potential to effectuate improved health care decision making and quality of care. However, the potential secondary uses of such valuable patient information threaten the integrity of the patient privacy rights envisioned under HIPAA. This section proposes that states respond to this issue with a two-step approach 173 INSTITUTE OF MEDICINE, BEYOND THE HIPAA PRIVACY RULE: ENHANCING PRIVACY, IMPROVING HEALTH THROUGH RESEARCH 78 (Sharyl J. Nass et al. eds., 2009). 174 See NAT'L COMM. ON VITAL HEALTH STATISTICS, supra note 105, at 5 (describing the negative impacts that may result from an erosion of trust). 175 Gellman, supra note 155, at 47. Gellman's proposal is generally consistent with the proposal described in this paper, but the author fails to provide any basis on which to realistically expect (or understand why) data disclosers and data recipients would voluntarily subject themselves to data use limitations and potential criminal penalties and sanctions. 2013 687 INDIANA HEALTH LAW REVIEW designed to support CDHC transparency initiatives as well as patient privacy. A. APCDs for Quality Transparency The first step of the two-step approach is for states to pass laws to create APCDs, but to use the databases to promote quality transparency rather than creating consumer platforms for price comparisons. 1. APCD Legislation APCDs are most likely to be successful when authorized through legislation.176 Although voluntary efforts are underway, they typically do not capture all claims in the state. For example, the Wisconsin Health Information Organization is a private nonprofit organization incorporated in 2006 by insurers, employers, and providers. However, the initiative only captures no more than half of the health care claims in the state.177 To be effective, APCD legislation should confer broad legal authority for the collection of data from all relevant sources, including health plans, pharmacy benefit managers (PBMs), and third-party administrators (TPAs).178 Specific legal authority is particularly important for ensuring reporting by PBMs and TPAs.179 In addition, legislation should include or authorize enforcement provisions that penalize these entities for failing to comply with data reporting requirements. 80 States that enact broad and meaningful legislative authority are in a stronger position to enforce reporting compliance and maintain a robust APCD.181 Establishing APCDs through legislation also reduces barriers imposed by the HIPAA Privacy Rule, which may 176 LOVE ET AL., supra note 19, at 7. 177 NATIONAL CONFERENCE OF STATE LEGISLATORS, supra note 52, at 3. 178 LOVE ET AL., supra note 19, at 7. 179 Id 180 Id 181 Id 688 Vol. 10:2 HEALTH CARE TRANSPARENCY otherwise make it difficult for private entities to share detailed patient data. 8 2 The majority of APCD legislation authorizes a state agency to collect, manage, and disseminate the data.183 Thus, disclosure of PHI by health plans and other covered entities to the particular state agency is permitted under HIPAA to the extent "required by law."s 4 Some states also contract with a private vendor to provide this service, subject to oversight by the authorized state agency.185 Furthermore, it may be advantageous for state agencies to partner with an academic organization to perform the data analysis and reports.186 Guidance on the HIPAA Privacy Rule suggests that, once disclosure has been exempted as "required by law," the state agency may then share or subcontract their research mandate and related PHI to affiliated organizations. 87 2. Focus on Quality Measures However, future initiatives should differ from existing APCDs in two ways. First, state reporting requirements should not include price information. Second, states should not expend resources developing online consumer platforms for price comparisons. Instead, the focus of state efforts should be on using APCDs to develop valid quality measures across health care providers. Such a change in direction is justified because APCD initiatives have not been effective, primarily attributed to a lack of valid and reliable quality information. Although the empirical evidence is limited, research does not suggest that public price transparency initiatives are effective at reducing prices or price variation. First, the California hospital price transparency initiative has been found to have caused a negligible, if any, effect on hospital 182 Id. at 8. 183 Idat 7. 184 45 C.F.R. § 164.512(a) (2012). 185 LOVE ET AL., supra note 19, at 7. 186 Id 187 Claiborne et al., supra note 21, at 503. 2013 689 INDIANA HEALTH LAW REVIEW prices. 188 This finding is not surprising because California's initiative was the public disclosure of hospitals' chargemaster data,189 which is not "actionable" consumer information. However, the gold-standard for APCD initiatives does not appear to be successful, either. A study of the effect of New Hampshire's initiative was not able to find a decrease in price variation for 30 (mostly imaging or outpatient surgical) procedures one year after pricing information was made available. 190 Why haven't these initiatives been successful? One reason may be that the efforts necessary to temper concerns about the release of insurers' proprietary information and potential for anticompetitive behavior among providers result in price information that is less meaningful to consumers. When the GAO interviewed insurance companies about sharing negotiated rates for transparency initiatives, insurers repeatedly raised concerns about the disclosure of proprietary information.191 For instance, one official from an insurer association cited the Uniform Trade Secrets Act as prohibiting insurers from sharing their negotiated rates.192 Irrespective of the legal merits of such concerns, insurers' resistance to APCD initiatives can be a significant barrier. In Florida, officials have not been able to follow through with their legislative authority to collect claims data in part because of the challenges posed by the proprietary concerns of insurers and providers.193 The general lack of competition in many health care markets also raises concerns that the public disclosure of negotiated prices between providers and health plans could support anticompetitive behavior that may actually lead to 188 D. Andrew Austin & Jane G. Gravelle, CONGRESSIONAL RE- SEARCH SERVICE, PUB. No. RL34101, DOES PRICE TRANSPARENCY IMPROVE MARKET EFFICIENCY? IMPLICATIONS OF EMPIRICAL EVIDENCE IN OTHER MARKETS FOR THE HEALTH SECTOR CRS 26 (2008). 189 Id. (referring to the effect of legislation requiring hospitals to make chargemaster data public). 190 Sinaiko & Rosenthal, supra note 3, at 893. 191 GOVERNMENT ACCOUNTABILITY OFFICE, supra note 15, at 15-16. 192 Id 193 Id. at 27. 690 Vol. 10:2 HEALTH CARE TRANSPARENCY higher, not lower, prices.194 Pricing information could result in higher prices by facilitating collusion among competing providers, or by simply changing providers' assumptions about how competitors would respond if they decided to reduce prices for an insurer.195 Indeed, a lack of competition among providers was cited as the reason why New Hampshire's initiative has not been effective. 196 But price transparency may also result in anticompetitive behavior by insurers, who also could collectively agree to exclude certain providers from their networks.197 Considering that antitrust analysis is highly fact-specific, any risk of challenge under the antitrust laws may be sufficient to deter providers and insurers from supporting price transparency initiatives.198 To temper these concerns, transparency initiatives make efforts to mask specific rates paid to individual providers for particular services.199 For example, price information may be presented as a range or as the median price paid for the service. Consumers may also be given a price aggregated across all health plans. While these efforts address concerns about the release of proprietary information and anticompetitive behavior, pricing information becomes less representative of the cost that consumers will actually pay, making it less meaningful to consumers. Consumers tend not to act on information that is not perceived as useful.200 One of the greatest fears associated with transparency initiatives is that consumer misinterpretation of pricing information will lead to greater health care costs. 2 01 The concern is that, in the absence of useful quality information, consumers will interpret high price as being indicative of 194 Ginsburg, supra note 1, at w214. 195 Id. 196 Sinaiko & Rosenthal, supra note 3, at 893. 197 Claiborne et al., supra note 21, at 479. 198 Id. at 479-480. 199 See GOVERNMENT ACCOUNTABILITY OFFICE, supra note 15, at 21 (describing various methods of presenting price information). 200 Madison, supra note 37, at 227. 201 TYNAN, supra note 13, at 6. 2013 691 INDIANA HEALTH LAW REVIEW high quality and seek out higher-cost providers. 202 While transparency initiatives typically provide some sort of quality indicator alongside pricing information, consumers may be reluctant to rely on this information for a variety of reasons. First, quality information often regards hospital care, an area in which consumers typically have little discretion.203 In addition, the lack of independent information on clinical quality measures may lead consumers to question their validity, and rely instead on traditional sources of information - word of mouth or physician recommendation. 204 The validity of quality measures is, in fact, a concern shared by health care providers, researchers, policymakers, and other health care stakeholders. 2 0 5 Consumers need meaningful information about quality alongside prices in order to make the comparisons that are necessary for high-value health care decisions.206 Ultimately, many of the challenges posed by APCDs are due to the public disclosure of payment information.207 Both providers' and insurers' are resistant to reporting these payments, and they are capable of posing significant challenges to states that attempt to undertake price transparency initiatives. 208 At the same time, insurers have shown that they are fully capable of facilitating price transparency on their own, by delivering meaningful price information through consumer-friendly online platforms.209 Given that state initiatives have not demonstrated effectiveness and the understanding that transparency initiatives, in general, are limited by the unavailability of 202 Id.; Sinaiko & Rosenthal, supra note 3, at 892 (citing re-search that found that higher prices cause a placebo effect that improves patients' response to treatments). 203 See Madison, supra note 37, at 227-228 (explaining that hos- pital admissions are rare, usually guided by referring physicians, and generally limited to the local geographic area). 204 Sinaiko & Rosenthal, supra note 2, at 892. 205 Madison, supra note 37, at 233. 206 Sinaiko & Rosenthal, supra note 2, at 893. 207 LOVE ET AL., supra note 57, at 9. 208 GOVERNMENT ACCOUNTABILITY OFFICE, supra note 15, at 27. 209 See Ginsburg, supra note 1, at w215. 692 Vol. 10:2 HEALTH CARE TRANSPARENCY useful quality information, states should focus on forming APCDs in order to develop valid and reliable quality information for CDHC initiatives. B. Incentivize Secondary Use Stewardship The second step of the two-step approach is for states to leverage access to the resulting quality information as an incentive for the voluntary adoption of secondary use stewardship policies. 1. Market Demand for Quality Information Persuading private entities involved in transparency initiatives to limit their commercial use of health information will require offering a powerful incentive.210 These entities have invested significant amounts in their transparency initiatives. 211 However, they nonetheless face several significant impediments to measuring and publishing information about quality.212 If states focus on producing quality information for use by the various private entities engaged in CDHC, states will be filling a critical gap and providing significant value to transparency initiatives. The potential for APCDs to yield meaningful quality measures is therefore critical to the adoption of a stewardship policy. Many health plans view the ability to provide quality information as an important competitive advantage. 213 At present, however, most plans are merely conduits for the 210 Cf William Crown, Characteristics of the Marketplace for Medical Care Data, in CLINICAL DATA AS THE BASIC STAPLE OF HEALTH LEARNING: CREATING AND PROTECTING A PUBLIC GOOD: WORKSHOP SUMMARY 143, 150 (Claudia Grossmann et al., eds., The National Academies Press 2010), available at http://www.nap.edulopenbook. php?recordid=12212&page=139 (describing the hesitation of data aggregators to contribute towards a pooled database unless they are able to recoup a value on par with the investment into constructing their database). 211 Id. 212 Claiborne et al., supra note 21, at 466. 213 TYNAN, supra note 13, at 6. 6932013 INDIANA HEALTH LAW REVIEW generalized quality information that is publicly available from governments and other third-party sources. 214 As mentioned previously, this information is seriously lacking in physician quality measures. 215 Some health plans use their own claims data systems to derive quality and utilization reports that they share with physicians and enrollees.216 This capability is limited by the fact that a single insurer's database is often not large enough to yield statistically significant results at the individual physician level,217 especially if the insurer has a small market share.218 As a result, only a few plans are able to offer substantial quality information on physicians. 219 Despite limitations to available quality measures, many health plans have pursued the creation of "high- performance networks" or other performance rating programs for physicians. 220 These networks restructure benefit designs so that consumers are directly incentivized to choose low-price, high-quality providers. 221 But, with each insurer using only its own claims data to develop its quality measures, these efforts are typically not perceived as credible222 and may damage relationships with physicians. 223 Rating and tiering programs have faced legal challenges and public scrutiny due to concerns about the validity of the measures used, the accuracy of the underlying data, and the conflation of quality and cost criteria. 224 Thus, there is an interest among payers to get access to "invaluable physician quality performance metrics," as evidenced by the recent partnership between 214 Id. at 8. 215 Madison, supra note 37, at 227-28. 216 LOVE ET AL., supra note 57, at 7. 217 Id. 218 TYNAN, supra note 13, at 5-6. 219 [d 220 Id. at 6. 221 Claiborne et al., supra note 21, at 474-75. 222 Hearing, supra note 27, at 5. 223 Madison, supra note 37, at 236-37. 224 Id. at 239; see Claiborne et al., supra note 21, at 481-83 (dis- cussing potential legal challenges and public scrutiny by New York Attorney General). 694 Vol. 10:2 HEALTH CARE TRANSPARENCY Castlight Health and Minnesota Community Measurement.225 Reliable and uniform third-party quality that can assist health plans in improving both the perception and effectiveness of tiering programs 226 would have significant commercial value. 2. Ste wardshii Policies By offering an attractive trade, entities involved in CDHC initiatives may be very willing to adopt data stewardship practices. Health data stewardship refers to the responsibility to safeguard the appropriate use of data derived from individuals' health information. 227 Health data stewardship may be accomplished by strengthening accountability through practices that apply to all entities who collect, view, store, exchange, aggregate, analyze, and use22 8 both identified and de-identified data.22 9 NCVHS suggests the following general recommendations for enhanced protections of health data (1) build upon existing legislation and regulation when possible, (2) reduce excessive administrative burden (2) enable improvements in the healthcare delivery system, and (4) maintain or strengthen individual's health information privacy.230 This proposal aims to meet these recommendations through the addition of fairly simple and straightforward language in BAAs. The stewardship policy advocated here involves two primary dimensions. First, consistent with a 225 Press Release, Castlight Health, Castlight Health and Minnesota Community Measurement Partner to Deliver Vital Physician Quality Data to Users (Feb. 27, 2012), available at http-//www. healthcareitnews.com/press-release/castlight-health-and- minnesota- community- measurement-partner-deliver-vital-physician-q. 226 Madison, supra note 37, at 238. 227 NATIONAL COMMITTEE ON VITAL HEALTH STATISTICS, HEALTH DATA STEWARDSHIP: WHAT, WHY, WHO, How 4 (2009), available at http://www.ncvhs.hhs.gov/0909301t.pdf. 228 Id. at 1. 229 Id. at 4. 230 See NAT'L COMM. ON VITAL HEALTH STATISTICS, supra note 105, at 26. 6952013 INDIANA HEALTH LAW REVIEW recommendation of the NCVHS, covered entities should be specific in the terms of their BAAs and what PHI maybe used and for what purpose, by both the business associate and any additional contracting agents. 231 These specifications should include the particular purposes for which PHI may be de-identified. Second, BAAs should expressly prohibit de-identification if any purpose of the de- identification is to sell the de-identified data to one or more third parties for direct or indirect remuneration. This prohibition builds on existing HIPAA regulations to stop the further flow of de-identified data away from the covered entity with minimal additional administrative burden. The adoption of this stewardship policy will enable improvements in the healthcare delivery system because the state agency will serve as the source for de-identified claims data. Although the policy limits availability of de- identified data critical to realizing health system improvements, it limits access to potential sources of the information, not access to the data itself. Entities desiring this information for legitimate public purposes (i.e., health improvement and/or research activities) will have access to the data through the state's APCD. Admittedly, determining what data and information will be released, and to whom, has been "the most sensitive aspect" of APCD implementation. 23 2 As in New Hampshire, APCD enabling legislation should provide that, "[tlo the extent allowed by HIPAA, the data shall be available as a resource for insurers, employers, providers, purchasers of health care, and state agencies to continuously review health care utilization, expenditures, and performance."233 The authorized state agency must then establish regulationS234 that take care to ensure that data access and release policies permit the many beneficial uses of APCD data. In this way, data stewardship will protect individual privacy from the risk of re-identification without inhibiting the legitimate use of de-identified health information. 231 See id at 7. 232 LOVE ET AL., supra note 19, at 10. 233 N.H. REV. STAT. ANN. § 420-G:11-a (2012). 234 LOVE ET AL., supra note 19, at 10. 696 Vol. 10:2 HEALTH CARE TRANSPARENCY IV. STRENGTHS & LIMITATIONS The proposal presented in this paper is subject to two primary limitations, related to information technology and financial sustainability. First, the implementation of APCDs requires states to resolve numerous technical challenges related to the development of large-scale information systems. 235 Typically, data aggregation is challenging because of the lack of a standardized format across provider and/or organizational information systems.236 This factor may be less of a barrier to the development of APCDs because the claims have all been developed for billing purposes. Other issues that will need to be addressed include the varying capacity of payer information systems to report the data and problematic data fields like the National Provider Identifier. 237 Accurately identifying providers has been a major challenge for states with APCDs.238 Mapping the National Provider Identifier to other data elements, such as state license number or physician name, can be difficult and expensive. 239 Moreover, states need to be cognizant of the administrative burden on national health plans as more states implement APCDs.240 Efforts to establish uniform reporting specifications across states would reduce this administrative burden as well as improve the comparability of data from state to state.241 Securing adequate funding to sustain APCDs will also be a challenge for many states. Like all information systems, start-up and maintenance costs are significant. 242 For 235 Id. at 7. 236 Steven Waldren, Large Health Database Aggregation, in CLINICAL DATA AS THE BASIC STAPLE OF HEALTH LEARNING: CREATING AND PROTECTING A PUBLIC GOOD 122, 124 (Claudia Grossmann et al., eds., National Academies Press 2010), available at http://www.nap.edul openbook.php?recordid= 122 12&page= 122. 237 LOVE ET AL., supra note 19, at 7. 238 Id. at 12. 239 Id 240 Id. at 11. 241 [d 242 LOVE ET AL., supra note 57, at 9. 6972013 INDIANA HEALTH LAW REVIEW example, Vermont estimated that implementing its APCD would cost approximately $500,000 in 2009. Utah's APCD was appropriated $625,000 in 2008, and annual expenses are estimated at $1 million. However, unlike other state information systems, APCDs are typically are not supported through federal funding.243 Where APCDs have been established through legislation, funding often comes from general state funds or mandatory fees from providers and insurers. 244 In addition, it should be noted that many states are planning to rely on funding from data product sales.2 4 5 While not all data sales would be discouraged under the proposal presented here, greater scrutiny may be applied, which could limit data sales as a potential source of revenue. Funding is a crucial issue, as the inability to pay for the costs of collecting and storing the claims data has prevented at least one state from following through with APCD legislative authority.246 At the same time, APCDs have the potential to yield substantial value for the health care system through CDHC initiatives. While out-of-pocket costs for primary care physicians tend to be similar among insured individuals, 247 these physicians are often patients' initial points of entry into the health care system, 248 and their referral behaviors may have a significant impact on health care costs across time. CDHC initiatives would benefit from access to robust, longitudinal information which enable more meaningful distinctions regarding physician performance than simple price information would permit. Health care transparency initiatives could be more effective overall when information is used to identify an efficient primary care provider or a delivery system that patients can use on a regular basis, rather than the present focus on 'a la carte' shopping for individual services.249 While it may never be possible to 243 Id. 244 Id. 245 Id. 246 GOVERNMENT ACCOUNTABILITY OFFICE, supra note 15, at 27 (describing Florida's experience). 247 TYNAN, supra note 13, at 4. 248 Madison, supra note 37, at 251. 249 Ginsburg, supra note 1, at w215. 698 Vol. 10:2 2013 HEALTH CARE TRANSPARENCY 699 eliminate the risk for re-identification generated by CDHC initiatives, negative externalities can be reduced through state action to incentivize data stewardship while simultaneously promoting improved transparency and accountability in the health care system.