Cross-Industry Approaches to Address Risk and Assurance

1. Cross-Industry Approaches to Address Risk and Assurance Lauren Fifield Practice Fusion June 26, 2013 Does not reflect the work/thoughts of the FDASIA regulations subgroup

2. Introduction Survey of Approaches Discussion Topics Today’s Agenda Does not reflect the work/thoughts of the FDASIA regulations subgroup

3. Goals for Today Does not reflect the work/thoughts of the FDASIA regulations subgroup • Broaden horizons • Learn from other industries, good and bad • Remove ourselves from health IT and consider risk of harm and market assurances

4. Why regulate? Does not reflect the work/thoughts of the FDASIA regulations subgroup

5. What already exists Does not reflect the work/thoughts of the FDASIA regulations subgroup • Survey of approaches that coexist now with FDA, ONC and FCC regulation • Looking for areas of redundancy and ambiguitywith what we recommend • Identifying best practices and successful regulatory and non-regulatory tools

6. Questions to Consider Does not reflect the work/thoughts of the FDASIA regulations subgroup • What are some trends across different industries’ regulatory landscapes? • What industries followed a path that could apply to Health IT? • Which specific regulations could be applicable to regulating Health IT? • What would be damaging to innovation or ineffective as applied to Health IT?

7. Introduction Survey of Approaches Discussion Topics Today’s Agenda Does not reflect the work/thoughts of the FDASIA regulations subgroup

8. Does not reflect the work/thoughts of the FDASIA regulations subgroup Government Approaches

9. Federal Trade Commission Does not reflect the work/thoughts of the FDASIA regulations subgroup • The FTC works to prevent fraudulent, deceptive and unfair business practices in the marketplace and to provide information to help consumers spot, stop and avoid them • Provides a mechanism for consumers to file complaints • Enforcement action

11. Federal Trade Commission Does not reflect the work/thoughts of the FDASIA regulations subgroup • In healthcare, currently addresses healthy living, treatment and cures, and weight loss & fitness products • The agency also has oversight over privacy and identity issues to protect consumers

12. FDA: Cosmetics Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Risk of harm/lack of trust due to poorly made or misrepresented cosmetics • Tragedies involving unsafe cosmetic products • In response, FDA passed the Federal Food, Drug and Cosmetic Act in 1938 to mitigate harm and foster trust

13. FDA: Cosmetics Does not reflect the work/thoughts of the FDASIA regulations subgroup Federal Food, Drug and Cosmetic Act : • Prohibits marketing of “adulterated” or “misbranded” cosmetics in interstate commerce • Cosmetic firms must substantiate the safety of their products and their ingredients before marketing • If do not do this, must have a conspicuous warning statement saying, “Warning – the safety of the product has not been determined” • FDA can pursue enforcement action and through the DOJ to remove adulterated or misbranded cosmetics from the market

14. FDA: Cosmetics Does not reflect the work/thoughts of the FDASIA regulations subgroup Successes/Failures of Intervention: • FDA gives the cosmetics industry responsibility and accountability • Led to some unsafe and wrongly advertised products on the market • Virtually all aspects of the cosmetics industry are subject to some form of voluntary Cosmetic, Toiletry and Fragrance Association (CTFA) program Industry • Example: Estee Lauder • Website features commitment to Product Safety and Testing, and Consumer Awareness • Company standards that each product has to meet

15. DOT: Pipeline and Hazardous Material Safety Administration (PHMSA) Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Risk of harm in the design, construction, testing, operation, maintenance and emergency response of pipeline facilities • Needed assurances that pipelines were being regulated and held up to industry standards to ensure public and environmental safety

16. DOT: Pipeline and Hazardous Material Safety Administration (PHMSA) Does not reflect the work/thoughts of the FDASIA regulations subgroup PHMSA Responsibilities: • Incident reporting • Data aggregation and analysis • Response to NTSB recommendations • Establish safety goals • R&D sponsorship to increase safety reliability • Transparency

17. DOT: Pipeline and Hazardous Material Safety Administration (PHMSA) Does not reflect the work/thoughts of the FDASIA regulations subgroup Successes/Failures of Intervention: • Strategy of reporting incidents, analyzing data and then enforcing safety issues is working • Example: careless digging • Common Ground Alliance • High investment associated with reporting body (NTSB)

18. DOT: Performance and Registration Information Systems Management Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Increase of the commercial carrier interstate population was coupled with an increase in crashes • Lack of assurances that the motor carriers were maintaining good safety practices

19. DOT: PRISM Does not reflect the work/thoughts of the FDASIA regulations subgroup • Process for targeting the highest-risk carriers for compliance reviews and roadside inspections • Requires motor carriers improve their identified safety deficiencies or face progressively more stringent sanctions up to the ultimate sanction of a Federal Out-of-Service order and concurrent State registration suspensions • Sanctions provide powerful incentives for unsafe carriers to improve their safety performance • Enforcement: • Identify carriers operating on the highway while out of service • Identify high risk carriers to prevent future accidents

20. DOT: PRISM Does not reflect the work/thoughts of the FDASIA regulations subgroup Successes/Failures of Intervention: • Evolving, learning process: originated as a pilot project mandated by Congress, but was so successful that it was expanded nationally • Pilot program demonstrated that State commercial vehicle registration sanctions are a powerful enforcement tool in Federal and State motor carrier safety efforts • Demonstrated results: PRISM shows improved safety over time

21. DOT: Motorcycle Helmet Regulations Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • High risk of harm for individuals who were wearing helmets that were not properly constructed • The lack of assurances on the quality of helmets led consumers to question if helmets would positively help them in a crash

22. DOT: Motorcycle Helmet Regulations Does not reflect the work/thoughts of the FDASIA regulations subgroup Regulations: • Helmet must undergo an impact attenuation test • Helmet must meet certain configuration standards • Monitors projections inside and outside the helmet shell • Labeling: • Permanent and legible • Manufacturer’s name or identification • Precise model • Size • Month and year of manufacturing • DOT symbol • Instructions to the purchaser about the ability to be damaged • Safety information

23. DOT: Motorcycle Helmet Regulations Does not reflect the work/thoughts of the FDASIA regulations subgroup Success/Failures of Intervention: • Quality products and > trust : • motorcycle Helmets are 37% effective in preventing motorcycle deaths and 67% effective in preventing brain injuries

24. ICC: Deregulation of the Trucking Industry Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Motor Carrier Act of 1935 required new truckers to seek a “certificate of public convenience and necessity” from the ICC • Became extremely hard for truckers to get certificates • Law required motor carriers to file tariffs with the ICC 30 days before they became effective. • If protested by another carrier, ICC suspended the rates pending an investigation of their legality

25. ICC: Deregulation of the Trucking Industry Does not reflect the work/thoughts of the FDASIA regulations subgroup Deregulation: • Competition was reduced and trucking was inefficient • Began in the 1970s and ended in 1995 with the abolishment of the ICC • The Surface Transportation Body was created in 1996 within the DOT with jurisdiction over certain surface transportation economic regulatory matters

26. ICC: Deregulation of the Trucking Industry Does not reflect the work/thoughts of the FDASIA regulations subgroup Successes/Failures of Intervention: • Deregulation dropped rates and improved quality • Has made it easier for nonunion workers to get jobs in the industry • LTL carriers have not engaged in predatory pricing since deregulation • Increased number of firms on most routes, suggesting that deregulation has promoted price competition that is beneficial rather than predatory • Service to small and remote communities did not suffer • Promoted efficiency • Beneficial for consumers

27. Environmental Protection Agency Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Lack of standards in place for safe drinking water • Individuals needed a way to be assured that their drinking water was safe • Safe Drinking Water Act in 1974 established to protect public health by regulating the nation’s public drinking water supply

28. Environmental Protection Agency Does not reflect the work/thoughts of the FDASIA regulations subgroup Safe Drinking Water Act: • EPA sets national health-based standards for drinking water to protect against both naturally occurring and manmade contaminants • Protects drinking water from source to tap • National standards based on sound science to protect against health risks, considering available technology and costs • Sets enforceable maximum contaminant levels • Ways to treat water to remove contaminants • Requirements for water systems to test for contaminants

29. Environmental Protection Agency • Standards • EPA identifies contaminants and runs studies to deduce harm • EPA determines the level of a contaminant in drinking water below which there is no known or expected risk to health • EPA specifies a maximum contaminant level • Becomes a standard • Enforceability • Works to increase water systems understanding and compliance with standards • Annual consumer confidence reports on the source and quality of their tap water from water systems • EPA public, annual summary reports of water system compliance with drinking water safety standards Does not reflect the work/thoughts of the FDASIA regulations subgroup

30. Environmental Protection Agency Does not reflect the work/thoughts of the FDASIA regulations subgroup Success/Failures of Intervention: • Setting standards • Transparency • Defined Goal (Drinking Water Strategy Goals): • Address contaminants as groups to be cost-effective • Foster development of new drinking water technologies • Use the authority of multiple statutes to help project drinking water • Partner with states to develop shared access to all public water systems monitoring data • Still more contaminants that need to be addressed • Cost of research and analysis • Expertise needed

31. Department of the Treasury: Dodd-Frank Act Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Financial crisis in the US led to calls for change • No assurances of trust or integrity within the financial sector • Huge risk to individuals and companies after the financial crisis • Led to the Dodd-Frank Wall Street Reform and Consumer Protection Act in 2010 • Intended to strengthen the economy, stabilize the housing market, end “too big to fail” and streamline the regulatory process

32. Department of the Treasury: Dodd-Frank Act Does not reflect the work/thoughts of the FDASIA regulations subgroup Dodd-Frank Act: • Advance Warning System: creates a council to identify and address systematic risks posed by large, complex companies, products and activities before they threaten the stability of the economy • Transparency & Accountability: eliminates loopholes that allow risky and abusive practices to go unnoted and unregulated • Protects Investors: provides tough new rules for transparency and accountability for credit rating agencies to protect their investors • Aggressive enforcement

33. Department of the Treasury: Dodd-Frank Act Does not reflect the work/thoughts of the FDASIA regulations subgroup • Created the Consumer Financial Protection Bureau and the Financial Stability Oversight Council • Market transparency: requires data collection and publication through clearing houses and swap repositories to improve market transparency and provide regulators important tools for monitoring and responding to risk • Financial safeguards • Requires companies that sell products like mortgage-backed securities to retain at least 5% of the credit risk unless the underlying loans meet standards that reduce riskiness

34. Department of the Treasury: Dodd-Frank Act Does not reflect the work/thoughts of the FDASIA regulations subgroup Successes/Failures of Intervention: • Fear that the Dodd-Frank apparatus will smother financial institutions in red tape that will stifle innovation and ultimately hurt the economy • Lack of clarity in the bill, which could lead to capricious rulings • Too complex • Extremely costly • Overwhelmed finance and under-addressed the financial crisis • Has led to more information for regulators on America’s derivatives markets • A new insolvency procedure is in place for firms like AIG, which lacked an alternative to bankruptcy or bail-out before the crisis

35. Sarbanes-Oxley Act Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Enacted as a reaction to a number of major corporate and accounting scandals, ex: Enron • Scandals cost investors billions of dollars and decreased the nation’s confidence in the nation’s securities markets • Risk of financial harm and lack of assurances of integrity in the securities market led to the Sarbanes-Oxley Act of 2002

36. Sarbanes-Oxley Act Does not reflect the work/thoughts of the FDASIA regulations subgroup Legislation: • Public Accounting Oversight Board • Auditor Independence • Corporate Responsibility • Enhanced Financial Disclosures • Analyst Conflicts of Interest • Studies and Reports • Corporate and Criminal Fraud Accountability • White Collar Crime Penalty Enhancement • Corporate Tax Returns • Corporate Fraud Accountability

37. Sarbanes-Oxley Does not reflect the work/thoughts of the FDASIA regulations subgroup Success/Failures of Intervention: • The law was not broad enough • Enhancement of private sector responsibility (internal controls) • CEOs and CFOs being forced to certify the validity of SEC filings and the PCACB creation all had positive impacts according to polling • Without baseline, hard to measure success • Relies now on full regulation rather than self-regulation • Board failures are still common

38. Does not reflect the work/thoughts of the FDASIA regulations subgroup Private Approaches

39. HITRUST Alliance Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Industry need for a common security framework • Born from the idea that information security should be a core pillar in the adoption of health information systems and exchanges • Common Security Framework (CSF), a certifiable framework that can be used by any and all organizations that create, access, store or exchange personal health and financial information

40. HITRUST Alliance Does not reflect the work/thoughts of the FDASIA regulations subgroup Overview: • HITRUST Academy: offers training courses designed to educate healthcare security professionals about information protection in the healthcare industry and the utilization of HITRUST CSF to manage risk • HITRUST Cyber Threat Intelligence and Incident Coordination Center: protects the healthcare industry from disruption by cyber attacks through a community defense approach • Early identification, coordinated response and incident tracking, and enhanced preparedness for healthcare organizations challenged by cyber attacks

41. HITRUST Alliance Does not reflect the work/thoughts of the FDASIA regulations subgroup Common Security Framework: • Harmonizes requirements of existing standards and regulations including federal, third party and government • Provide organizations with the needed structure, detail and clarity relating to information security tailored to the healthcare industry • CSF Assurance Program: provide assurance to limit the exposure of a breach are operating effectively • Questionnaire • Report • Cost Effective and Rigorous assurance • CSF Assessors: organizations that have been approved by HITRUST for performing assessment and services associated with the CSF Assurance Program and the CSF • Need to meet certain criteria

42. HITRUST Alliance Does not reflect the work/thoughts of the FDASIA regulations subgroup Successes/Failures of Intervention: • Harmonization • Standardization • Transparency • Analysis Industry/Data • Ownership • Benefits of CSF Assurance Program: • Reduced costs and complexity • Managed Risk • Simplified Compliance

43. The Joint Commission Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Public need for improved healthcare • Led to the founding of the Joint Commission in 1951 • Collaborates with stakeholders to improve healthcare by evaluating health care organizations and inspiring them to excel in providing safe and effective care of the highest quality

44. The Joint Commission Does not reflect the work/thoughts of the FDASIA regulations subgroup Overview: • Evaluates and accredits more than 20,000 health care organizations and programs in the United States • Oldest and largest standards-setting and accrediting body in health care • Gives worthy organizations the Joint Commission’s Gold Seal of Approval • Must undergo onsightsurvey, which is data driven, patient centered and focused on evaluating actual care processes • Standards and Survey Process: assesses level of performance in areas such as patient rights, patient treatment, medication safety and infection control • Set forth performance expectations and activities that affect the safety and quality of patient care

45. The Joint Commission Does not reflect the work/thoughts of the FDASIA regulations subgroup • Information and education: • Launched qualitycheck.org to allow consumers to search for accredited and certified organizations, find organizations by type of service provided within a geographic area, download free hospital performance measure results • Joint Commission Resources: global knowledge based organization that provides innovative solutions designed to help heath care organizations improve patient safety and quality • Provides services through: education programs, health care consulting and custom education, online software and publications • Performance measurement and accountability measures for hospitals: • ORYX Initiative integrates outcomes and other performance measurement data into the accreditation process • Categorized performance measures into accountability and non-accountability measures

46. The Joint Commission Does not reflect the work/thoughts of the FDASIA regulations subgroup Successes/Failures of Intervention: • Common set of measure specifications documentation • Goal to minimize data collection efforts for common measures and focus efforts on the use of data to improve the health care delivery process • Conducts Research on health care topics • Sets industry standards • Creates a threshold of quality and patient care

47. Good Housekeeping Seal of Approval Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • Need for individuals to understand if products were healthy and safe • FDA, Consumer Product Safety Commission and regulatory law did not exist • In 1900, created the Good Housekeeping Research Institute • Evaluating products • Issuing Consumer Reports

48. Good Housekeeping Seal of Approval Does not reflect the work/thoughts of the FDASIA regulations subgroup GH History: • In 1902, GH wanted to protect their readers from inaccurate advertising claims and so began evaluating products before allowing them to be advertised • In 1905, GH introduces a “Roll of Honor for Pure Food Products”, a monthly list of packaged foods inspected and approved for purity and safety • Lobbied for Congress to pass the Pure Food and Drugs Act in 1906 • Set best practices in changing sink heights to have the least pressure on backs • In 1917, shows readers what 100-calorie portions look like • Warns of tobacco use and link to diseases in 1921 • Requires documentation of health and safety claims for dietary supplements before they can advertise in the magazine • In 2000, GH tests bicycle helmets and found that many fail to meet standards. This led to a large recall by the CPSC • In 2009, released the Green Good Housekeeping Seal • Meet GH environmental criteria

49. Good Housekeeping Seal of Approval Does not reflect the work/thoughts of the FDASIA regulations subgroup Success/Failures of Intervention: • Trust: due to the integrity of the company, consumers view the seal as a stamp of approval or an indication of a good product • Accountability: Seal offers a limited warranty in the form of a refund, repair, or replacement if the product carrying the Seal is found to be defective within two years of purchase • High quality and reliability: Seal is only awarded to products that deliver on their claims, ensuring the integrity of the seal and the product

50. Florida Oranges Seal of Approval Does not reflect the work/thoughts of the FDASIA regulations subgroup Precipitating Factors: • After being hit hard by four major freezes within 5 years in the 1980s, Florida Oranges needed a way to maintain their image and quality • Brazil was having a large impact on orange juice, but their orange juice was not 100% pure • FL Orange producers were worried that this would hurt the market • In an effort to compete with Brazil and bring back their image, Florida Oranges created a sticker that says, “100% Pure/Florida’s Seal of Approval