Comment from Healthcare Trust Institute

The Notice proposes to modify and republish a system of records containing health benefits service use and cost data for FEHBP and PSHB Program members and enrollees. The system of records would include medical claims, pharmacy claims, encounter data, and provider data that the OPM proposes to use to evaluate the effectiveness of the FEHBP and detect patterns indicative of fraud, waste and abuse in the program. We support OPM’s goal to provide high-quality, affordable care to FEHBP and PSHB members and appreciate the need to perform necessary oversight activities for the programs. However, we are concerned that this proposal exceeds the statutory authority granted to OPM and creates a risk of HIPAA non-compliance for our member organizations while exposing FEHBP and PSHB member and enrollee data to unnecessary privacy and security risks. 5 U.S.C. § 8910 permits OPM to require carriers to furnish “reasonable reports” and to “examine records of the carriers as necessary” to carry out its function. However, it does not authorize OPM to engage in the wholesale collection of all claims-level data for FEHBP and PSHB members. Further, this grant of authority to receive reports and examine carrier records must be read in concert with other applicable law such as HIPAA that governs protected health information (PHI). The proposal described in this Notice raises concerns from our member organizations that are covered entities under HIPAA. The HIPAA Privacy Rule permits covered entities to disclose PHI to health oversight agencies, however, such disclosures are subject to the minimum necessary standard. This standard, which is a key protection of the HIPAA Privacy Rule, mandates that covered entities make reasonable efforts to disclose only the minimum amount of PHI needed to accomplish a specific purpose. Based on the described purposes for which the data is being collected by OPM, OPM does not appear to need identifiable data elements. Indeed, OPM itself states that it will take steps to pseudonymize the data it receives and will use identifiable data only " to create person-level longitudinal records." However, the HIPAA de-identification standard was designed to allow for the creation of longitudinal records, and this is done routinely by HIPAA entities when sharing de-identified data with entities that require longitudinal records for analysis and research. Since OPM itself acknowledges that its analysis can be performed with de-identified data, it puts carriers in an untenable position of risking violating federal law if they provide the requested data and risking violating their contractual obligations if they do not. In addition to the concerns stated above, we are concerned that creation of a database of identifiable FEHBP and PSHB member data will expose this data to a heightened risk of privacy and security breaches. In the Notice OPM states that it intends to pseudonymize records received from OPM OIG to address privacy concerns. However, since OPM will retain member IDs in order to be able to re-identify members for certain purposes, the database will be a vast and rich source of identifiable health data that will immediately become a target for cybercriminals. Even if OPM maintains the highest level of security, this unnecessarily exposes the data to a higher risk for unauthorized disclosure or security breaches. Cybersecurity incidents targeting healthcare and government entities are becoming increasingly common. For this reason, our member organizations seek to take every opportunity to protect PHI, including providing only the minimum amount of data necessary and using de-identified data whenever possible. For the reasons set out above, we strongly urge OPM not to proceed with this proposal, but instead to explore alternative options that would provide OPM with the information necessary to evaluate plan performance and conduct oversight activities in a manner that protects FEHBP and PSHB member data in accordance with HIPAA. For example, OPM could use an “edge server” approach that keeps the data in the carrier’s possession yet allows OPM to run queries and safely and securely extrapolate de-identified data for its own analyses. Use of edge servers are common across healthcare systems, including by the Centers for Medicare and Medicaid, as it allows data to be processed closer to where it is generated. This not only improves reliability, but also avoids privacy and security risks. OPM could also work with a trusted independent non-profit research institute to perform longitudinal cost and quality analysis, or could work directly with carriers to perform specified analyses and produce aggregated reports using de-identified data that could then be used by OPM to manage the FEHB and PSHB programs and perform oversight activities. Sincerely, Tina Grande President, Healthcare Trust Institute