Jodi Daniel on Writing Privacy Rules Patients Can Trust

Melanie Marcus: Welcome, Jodi. It is so great to have you here on the program.

Jodi Daniel: Thank you so much, Melanie. It’s great to be here. Quickly, I just want to give one disclaimer: All comments I make are my personal thoughts. They don’t represent the positions of Wilson Sonsini or any of my clients, and they’re not legal advice.

Marcus: Thanks for that. Let’s start with our signature question. We are a podcast called There’s a Better Way: Smart Talk on Healthcare and Technology. So, what’s your better way in healthcare, and how does it show up for patients in real life?

Daniel: I spend a lot of time thinking about health data and health data privacy. I’ve been doing this for many decades. I think one of the most important things is making sure that we build trust from the beginning, and that we think about everything through a patient lens. There are a lot of folks who say, “If we focus on privacy, it’s going to slow down progress or innovation,” and I think it’s a little unfair to treat this as an either/or choice.

Marcus: That’s why I’m so glad you’re here talking with us, because a lot of times on this program we end up talking about trust, but you’ve spent a career orchestrating trust. Take us back to a moment—maybe your own, maybe one you’ve heard—where a patient’s trust in the healthcare system was shaken because of how their data was shared or even withheld. What did it reveal?

Daniel: There was one story that really stuck with me. It’s a very sensitive topic, and there’s a lot of discussion and different opinions on reproductive healthcare. There was a story about an individual who sought healthcare services out of state and paid out of pocket for reproductive healthcare services.

Some months later, when she saw her clinician for routine care back in her home state, the clinician said, “I saw that you had reproductive healthcare services provided in XYZ state.” That was quite shocking to her, because she thought she had taken steps to protect the privacy of that data. It really frustrated her expectations of privacy, even though it was for treatment purposes.

What really strikes me is that the disclosure probably happened through a health information exchange. It was probably perfectly lawful. It was a disclosure, I’m sure, for treatment purposes. It was probably important information for that provider to have. But it didn’t weigh the risk of harm to that individual or the expectations she had about how her data was being shared.

To me, that highlights that you can comply with the law and still interfere with trust. It’s not just about the purpose. Understanding the benefits and the risks of disclosures of health information is really important when you’re talking about patient trust.

Marcus: That makes a lot of sense. Health information isn’t just personal. It’s actually permanent. It often can’t be separated from someone’s identity or future opportunities. So, what is it about health data that makes it so different from financial or retail data, and worth its own detailed set of rules?

Daniel: It’s a great question. We always say healthcare is different, and some people say, “Why? It shouldn’t be different. Why can’t we do it just like financial records?” I think there are a couple of things.

First, health information is often longitudinal, not transactional. What happened to you 10 years ago can have an impact on your healthcare today, so a clinician might need access to all that data, or something that’s inappropriately released can impact you 10 years later. And there isn’t an easy way to protect against it. If somebody accesses your bank account, you can change your bank account. You can change what bank you’re using. You can put a credit freeze on your credit report. There are things you can do to protect yourself, and there aren’t similar ways to do that in healthcare.

Second, health information can reveal information about others. When you provide family health history, it can reveal information about your children, your parents, your siblings. There’s something different there than in other kinds of information.

And third, there are more limitations on your ability to negotiate the collection and use of the data, or to opt out of its use. When a patient is seeking healthcare services, opting out isn’t really a realistic choice. There are also unequal power dynamics between patients and providers. A lot of patients don’t want to question providers. The benefit of getting access to the healthcare service or the technology means the individual isn’t thinking about their privacy at that moment or doesn’t feel like they can raise those questions at a time when they’re vulnerable and looking for care.

So, there are a lot of differences in healthcare that make the data either more sensitive or more difficult to protect, whether that’s in releasing it or in asking for protections.

Marcus: And you’ve already said it: Most of this information is being used for treatment. Can you describe that a little for our listeners?

Daniel: The HIPAA rules allow for appropriate uses and disclosures of health data. If you go to your doctor, you expect that your doctor is going to use that information to treat you. They might talk to a colleague if you have a complex case. They’re going to have to submit claims to an insurance company to get reimbursed so that you’re not paying the full cost of care. And they might need it just to manage their business, for example, if a health oversight agency is coming in to review their provision of healthcare services.

So, there are lots of reasons for use of health data that are necessary and appropriate in the context of healthcare delivery and payment. When you go to the doctor, it’s expected that your information will be used for what we call treatment, payment and healthcare operations purposes.

There are other purposes for disclosing data that are authorized in state or federal law as well. And some of the rules don’t cover all data or all entities. There are gaps in those protections that are also relevant when we think about privacy and health data.

Marcus: You helped write the original HIPAA Privacy Rule. Can you take us back? What problem was this rule trying to solve, and how did it come together?

Daniel: What’s interesting, just to start, is that HIPAA did not start as a privacy law. The relevant section of the statute began as administrative simplification provisions designed to make the health system work more efficiently for financial and administrative processes.

This was in the mid-to-late 90s, when there were more data and more electronic transactions. The payers wanted standardized transactions so they could pay claims faster, and that was really the original goal. But as Congress was trying to get standards in place to simplify these electronic transactions, they recognized that greater electronic exchange of health data would require public trust and protections for that data.

So, Congress directed HHS, the Department of Health and Human Services, to develop privacy regulations. There were only two requirements they put forward. One was to establish the uses and disclosures of such information, and the second was to identify individual rights with respect to that information.

Marcus: What made this rule necessary, and how did it take shape?

Daniel: I’ll give you a little story. The HIPAA rules came out in the early 2000s. At the time we didn’t have smartphones, and most doctors and hospitals did not have electronic health records. Most of the data was still in file cabinets in the doctor’s office, in silos, and the electronic health data was really just these financial and administrative transactions.

Fast-forward and there was interest in pushing adoption of electronic health records, with the goal of improving the availability of data so it could follow the patient through their care journey. That way we could reduce unnecessary duplicate testing, reduce medication errors because there was better data, and reduce other safety incidents.

Under the Health Information Technology for Economic and Clinical Health Act—the HITECH Act—in 2009, my old office, the Office of the National Coordinator for Health Information Technology, or ONC, got the authority to create regulations for electronic health records and health IT. The Centers for Medicare & Medicaid Services, CMS, got authority to provide incentives for the meaningful use of that health IT. So, we created standards and pushed adoption of EHRs, and CMS paid $34 billion in incentives to doctors and hospitals to adopt and meaningfully use electronic health records.

The goal was interoperability: to get the data out of the silos and have it follow the patient. And what happened was, there were all these standards, the technology was adopted, and after spending $34 billion, the data wasn’t flowing. So, we started looking at why. The technology was there. The standards were there. What was getting in the way were policies and business practices.

It wasn’t in a hospital’s interest to share information with the hospital down the street. If you were a patient of hospital A and hospital A had all your data, you’d probably go back to hospital A if you had a problem. Why would I give your data to hospital B? The same was true of electronic health record companies. They were managing the data for hospital A, and they didn’t want to make it easy for hospital B to get access, because then that data could go into another EHR. So, there were business incentives to keep the data. The data was valuable.

Congress asked us to look at this. The term that came up was “information blocking”—practices that were blocking data from flowing from one place to another. I was responsible for drafting a congressional report. We explained the issue and proposed a legislative standard that described what information blocking was: interference with data sharing, knowledge of the interference, and no reasonable justification. Congress adopted that into legislation in the 21st Century Cures Act and directed ONC, within the Department of Health and Human Services, to come up with regulations.

Marcus: The federal government is pursuing the most significant HIPAA update since HITECH. Along with that, a growing number of states are passing their own health privacy laws, and AI is moving into clinical and administrative workflows. So, a lot seems to be happening all at once. Can you tell us about a real patient moment—yours or one you’ve heard—where getting or not getting their data changed what happened to them?

Daniel: This should not have been a problem because we do have the ability to share information and we do have the information blocking rules in place. But I had a family member across the country who ended up in an emergency at a regional hospital, and the doctor was recommending bypass surgery—a very serious surgery—in two days’ time. Nobody could be there to talk to the doctor and figure out what was going on. I had a friend who was a prominent cardiologist at a very large health system, so I called him and asked for advice, or a second opinion, and he was absolutely willing to do it. He said, “Well, you have to get me the patient chart.” And I said, “Can you just pull that? You’re at a health system. Can I get this individual’s permission?” And he said, “I won’t be able to get it in time.”

This is a doctor I’m asking to get information from another clinician, and he was saying that he didn’t have a relationship with that regional hospital. Luckily, it did not have a negative impact. This individual did have surgery. It was the right decision, and it went fine. But it made us uncomfortable that in this day and age we weren’t able to get a quick second opinion without being there and facilitating it ourselves.

Marcus: Let’s complete the circle with providers. From a clinician’s side, where have you seen a provider’s ability to care for someone hinge on whether the data showed up? We’ve talked a little about this, but do you have another example?

Daniel: During Hurricane Katrina—we’re going in our way-back machine—most of the data was not in electronic format, and the paper records were destroyed in the flooding. People were displaced in all different places. They didn’t have the names of their medications, they didn’t have a supply of their medications, and there was a real drive to get people back on their meds—if somebody has hypertension, or they’re taking cancer drugs or heart medication, whatever it is.

There was no easy way to access that data, and the providers in the Superdome or in the clinics that were set up couldn’t provide the right care, because the individuals couldn’t explain their diagnosis. They didn’t remember the name of the medication. They didn’t remember the dosage.

I remember working with Surescripts, with the Louisiana Medicaid department and with other folks to figure out how we could get at least the medication data available to the clinicians on site, so they could provide the right care to patients. We successfully did that, and it was a real success story.

Marcus: When it comes to the information blocking rule and its intended purpose, where’s the biggest remaining gap between the data patients are entitled to and the data they actually get?

Daniel: First, the data still isn’t always accessible, even though it should be. Patients have a right to access their data, and it’s in electronic format, but there are still roadblocks and barriers to patients accessing their own data, for a variety of reasons.

The second is the scope of the data. Even when you can access the data, what tends to happen is there’s a data set in the patient portal—like the USCDI, the United States Core Data for Interoperability—and patients can go into their portals and download that specific set of data. But that might not be all the data they need, or all the data they’re entitled to under the HIPAA right of access. An individual is entitled to their entire medical record. That’s not 20 data elements. It’s their entire medical record. So sometimes it’s a struggle for patients to get access to all the electronic health information they’re entitled to, rather than a subset.

The third problem is that there’s a lot of health data outside the scope of the information blocking rules. Interestingly, patients have a right to access their information held by their health plans, but health plans by and large are not subject to the information blocking rules. Those rules cover healthcare providers, electronic health record vendors, and health information networks and exchanges. They don’t directly cover plans, unless a plan is also doing one of those other things. So, a patient has the right to access data held by a plan, but the information blocking rules don’t play a role.

And even though CMS has rules about patient access to plan data, those rules apply to CMS-regulated health plans, not to all commercial plans. So, there may be a lot of plans that don’t need to provide patient access application programming interfaces, or APIs.

Marcus: People see the final rule, and it’s like this finished novel sitting on the shelf. But what goes into developing a rule like HIPAA or information blocking? Who’s in the room? What gets fought over?

Daniel: I’ve heard a lot of people ask, “How come it takes so long to get a regulation out the door?” It’s a really complicated process, and a lot has to go into it. Usually there’s one agency leading the rulemaking. In the case of the information blocking rules, that was ONC. In the case of HIPAA, it was the Assistant Secretary for Planning and Evaluation, which, I think, has never written a rule before or since. The lead agency will often work with the Office of the General Counsel to understand its statutory authority and the scope of what it needs to do, and to talk through definitions, limitations and so on.

Every HHS regulation gets approved across the Department of Health and Human Services, and then goes to the White House, which also approves it or sends it to other agencies outside HHS—the Department of Veterans Affairs, the Department of Defense or others—to review.

As far as what goes into it, it’s a really complex process. Policymakers are constantly trying to balance competing positions. With HIPAA, they were supposed to come up with uses and disclosures and individual rights. Well, how are you going to do that? HHS looked at other privacy laws that existed. There was one in Hawaii—it never actually got finalized or adopted, I think, but it was very comprehensive. We looked to the Hawaii law, and we looked to the Fair Information Practices. You look at other things that might help you figure out what you should be regulating.

Then there’s balancing competing policy goals. If we come up with a consent regime, it might interfere with treatment, so we can’t require consent before treatment. And you think about how it will impact different stakeholders. You don’t want to make it hard for Medicaid plans if they need to use health data in a certain way, for example. So, it’s balancing all of that.

Then there’s a ton of coordination. With HIPAA, we talked to the Centers for Disease Control and Prevention, because they were talking about health data for public health purposes. We talked to the Food and Drug Administration, and to the National Institutes of Health about research. We talked to the Department of Labor about plans under the Employee Retirement Income Security Act. We talked to CMS about the Medicare and Medicaid programs. There’s a lot of collaboration going on, and again, it takes a lot of time.

That’s the proposed rule.

For the final rule, there’s already a framework. You put out a proposal, and the agency gets all these comments. People always wonder whether those comments matter. Somebody reads every single comment. I can tell you that. I’ve never seen that not happen.

Marcus: So that’s the federal level. We’ll talk a little about state and a little about AI before we go into the overarching privacy discussion. States are increasingly passing their own comprehensive privacy laws to cover data HIPAA doesn’t reach. What’s driving that, and what should we make of this growing patchwork of rules?

Daniel: There are two things: the interaction with healthcare, and then more broadly.

Technology is generally raising new questions about privacy and data use, and there is no comprehensive federal privacy law. States are reacting to the fact that there are broader uses of health data and no federal protection for use of data and technology more broadly.

On the healthcare side, this goes back to what I mentioned about HIPAA and its scope. HIPAA wasn’t designed to regulate all health data. It’s an entity- and relationship-based law. It was designed to protect data held by healthcare providers, health plans and the business associates that help them do what they do. So, HIPAA doesn’t cover all health data. It doesn’t cover your wearable data. It doesn’t cover that direct-to-consumer, self-pay telehealth provider. There are a lot of gaps, and states are reacting to that.

So, we see some health-specific state laws, like Washington’s My Health My Data Act, which, rather than regulating traditional healthcare entities, reaches broadly to cover consumer health data and imposes requirements around that kind of data.

There’s this growing patchwork, with states acting as policy laboratories responding to gaps in federal law. At the same time, it’s leading to a lot of complexity and compliance burden for the entities that have to figure out how to comply if they’re providing a product or service across all 50 states.

So, there’s real tension right now between the states trying to fill the gaps, the federal government not getting something passed at a national level, and then what you do with the state laws even if a federal law did pass. Is there preemption? Is there not? Do you let all flowers bloom?

Marcus: And your health data doesn’t know about state boundaries. It just doesn’t.

Daniel: Right. Which is great—your data is protected in Washington state, but then it’s not protected in Iowa.

Marcus: Right. So, AI. It’s now part of clinical decision-making, documentation and even prior authorization. What does trustworthy AI in healthcare require from the standpoint of privacy and governance?

Daniel: The first thing I always like to start with when people say, “Oh my God, AI, we need all these new laws, what do we do?” is that there are frameworks, and they have been applied to new technology over time. When HIPAA came out, most doctors and hospitals didn’t have electronic health records. HIPAA still works in the context of EHRs. It still works in the context of health information exchange. So, HIPAA provides a foundation for protections, and I think it’s important to start there.

It provides limitations on use and disclosure that apply to AI-enabled technologies used by healthcare organizations—limitations on use and disclosure, limitations on sale of data, minimum necessary, all of that. And it’s important, particularly for health systems or health plans incorporating AI-enabled technology into clinical decision-making, to review their HIPAA policies and to routinely conduct risk assessments, so they understand how that technology affects their risk profile from a privacy and security standpoint.

Then the question is, what’s different? Start with your foundation, then ask where the gaps are. Are there new risks that should be addressed? I will say there are. For instance, think about de-identified data. De-identified data is not subject to HIPAA, but it’s routinely being used to develop and train AI models for healthcare decision-making. As we use more de-identified data, and as we have more computing power, the ability to re-identify that data is increasing. So now there’s a gap. What do you do about that? Is there a responsible use of de-identified data? As a health system making patient data available in de-identified format to a tech company, do you have an obligation to put in data use restrictions or have a data use agreement?

So, there are things that build on what we have today, and de-identified data is just one of them.

Then governance, since you asked about privacy and governance. It’s really important for health systems incorporating AI into clinical decision-making to think about how to do that in a way that builds trust and ensures safe use of the technology. Beyond privacy issues, it’s safety, safe use, transparency with consumers, and of course training for providers.

One thing I would say is that I don’t think the regulations have caught up with some of these questions, and I’m seeing more and more in the private sector—standards, thought leadership and activities. For example, The Joint Commission has put out guidelines for responsible use of health data focused on de-identified data and for responsible use of AI in healthcare. And they have a voluntary certification that health systems can undergo to have a guidepost for what they should be thinking about.

Marcus: That makes a lot of sense. It’s not the same thing as healthcare, but from a marketing point of view, we’re just finishing a major class on marketing AI leadership, and the focus was: How do you govern it? Not unlike healthcare. Where do you put a human in the loop—human first, human last, or right in the high-risk areas? And of course, how do you build in the kill switch, so it stops before it drifts too far?

Daniel: Yes. All important things.

Marcus: All important things. Let’s look ahead 12, 18 months. Not too far ahead, but just enough, because things are moving fast. What should healthcare leaders and patients watch for on privacy, HIPAA modernization and AI governance?

Daniel: There’s a lot happening. I think there are opportunities for a lot more, and there are still gaps. On the privacy side, I think we’ll continue to see pressure on frameworks that were largely built around traditional healthcare entities, as more and more data goes through nontraditional tools—consumer apps, digital health platforms.

So, there’s going to be continued debate about HIPAA modernization, federal privacy law and state consumer health privacy laws. There’s also a growing number of state laws focused on use of AI in clinical contexts, like mental health chatbots. This will still be a very active area to pay attention to at both the state and federal levels.

Then, more concretely, the Privacy Rule. There was a proposed modification to the Privacy Rule about five years ago. HHS picked it back up, and there are final Privacy Rule modifications under review at the White House right now that are expected to come out at any time. The focus is on coordinated care, so it’s more about access to data than about restricting access. One thing I’d predict it will cover is promoting patient access to data through third-party apps—patient-facing applications. That’s something to pay attention to.

There was also a proposed Security Rule, and they just kicked the can down the road on that one. The goal was to increase security protections because of all the cybersecurity incidents. They got a lot of feedback that the rules would be very difficult and expensive to implement, so that’s postponed until 2027, at least on the regulatory calendar.

We’re going to see information blocking changes in the HTI-5 final rule, which should also be coming out in the near future. HHS has said it’s going to do more enforcement on information blocking, and I think they just put more budget in place to do that. So that’s something to watch.

And one of the most important developments to watch—not related to privacy—is FDA oversight of AI-enabled healthcare technologies. The FDA just published a discussion paper on generative AI-enabled medical devices, with a new competency-based approach to evaluation. We’ve been spending a lot of time looking at that and talking to technology companies incorporating AI about whether there’s an opportunity to provide feedback to the FDA. It’s just a discussion paper, and they’re looking for comment. But what the FDA is doing will be a really interesting place to watch right now, because it gets to safety and the clinical use of AI.

Marcus: Super interesting. Those are all things to watch. Let’s wrap up our conversation where we started: with the patient and our search for a better way. So, let’s return to a variation of our signature question: If you could get every leader in healthcare focused on just one change to how we protect and share patient data, what would it be?

Daniel: Put the patient at the center. I know I said that at the beginning, but I really think it’s important that we share information about the patient with the patient’s input—or at least their perspective—front of mind. And not make that just a consent regime, which I think can put too much onus on individuals to self-protect, but really think about transparency, risk, responsible use and consequences of misuse, from the perspective of what this means for the patient and what harm could occur if data isn’t available, or if data is made available improperly.

Marcus: That’s great. Healthcare information is so important to each of us as patients, to our doctors and to our care providers. It’s been so interesting to focus on the privacy element of health information and how complex it is, and I’m glad we have people like you overseeing it. Thank you for your time and perspective on the show today.

Daniel: Thank you so much. This was really fun. I’m really glad you invited me to do this.