Protecting privacy is a first step toward public trust

Protecting patients data — both keeping it private and keeping it secure — is a fundamental part of creating public trust in health IT

A lot of my Friday blogs in the last couple of weeks have focused on privacy — companies not keeping health data protected, international laws that can sometimes delay regulatory and oversight issues, and different perspectives on privacy across patients, consumers and the government.

But protecting a patient’s privacy is important but is part of a much bigger issue — and that is one of trust. In Nordic countries, there is a much higher level of trust in the government than in the US. It makes it possible for Denmark to have a national database of patient health information — something that seems unthinkable in the US. The US relies more on the private sector for health data collection and analysis, and the public tends to put more trust in the private sector to manage health data — despite recent calls for more regulation and oversight for sensitive data.

Protecting patients’ information — both their privacy and the security of their data–is a fundamental part of establishing trust.

This idea of trust makes me want to highlight two things that have happened this week.

First, the GAO report on the CDC and its response to the Covid-19 pandemic highlighted some of the failures that the CDC had in response to the pandemic. Data was not collected correctly (or not at all), messaging was confusing to the public, and the culture within the CDC contributed to a blunted response to the pandemic.

The CDC has a trust problem. And it’s a problem that will need a comprehensive approach to solve. While I can’t speak to the specifics of the CDC culture (except in my external interactions with the CDC when I was in the government), we can (and should) talk about trust, the CDC and the health data that they collect.

Part of the solution being proposed by the CDC is that they need broader authority to collect more data, to compel states and individuals to send data to them. The CDC argues that this will help address the problems identified in the CDC response to Covid-19.

But if trust is the fundamental issue, then broader authorities will not solve the trust problem, and in fact, may make things worse. The CDC has often not seen itself as a part of the broader healthcare ecosystem — the CDC uses different health IT vocabularies, different technologies, and different computer formats to collect data — many of which are not well integrated into the rest of the health care system. These systems hampered the CDC response to the pandemic. And broader authorities to create yet another one-off system will not solve the CDC data or trust issues.

And this brings me to my second observation this week. The ONC’s “E Pluribus Unum” blog post. The Secretary for HHS has issued a new management policy that puts ONC in the center of health IT — for interactions with EHRs, HIEs, and hospitals and providers AND for coordination across all agencies within HHS.

This is a big deal.

This means that ONC is charged with coordinating HIT efforts with CMS, NIH, FDA, AND CDC. It means that the ONC will be charged with restoring public trust in how their health data is used both within HHS (in agencies like CDC) and across the health IT sector.

Trust is easy to lose and hard to earn. The ONC presented on Wednesday their plan for public health at their HITAC committee meeting — and is beginning to articulate a plan for how the CDC can restore trust.

Broader authorities are not the answer when the public perception is that the CDC did not use its existing authorities effectively. But I’m pleased with the ONC efforts to bring the CDC (and other HHS agencies) into the broader health ecosystem, and begin the process of restoring trust in our health data systems. New approaches to protecting patient privacy that didn’t exist when I was in the federal government should drive novel ways to protect patient privacy while still enabling population level analytics to help drive analysis and policy.

It’s a daunting charge for the ONC and one that will require that the public trusts their approach. Since its inception, ONC has used the patient as a north star for their approach to how health data should be used. If they continue that approach — putting patient privacy first, and providing patients with the ability to provide both input and transparency– these new authorities should not only create a more resilient and responsive way to manage health care data, but restore public trust in how their health data is protected and used for the public good.