On Wednesday, the Office of Personnel Management released two formal notices in the Federal Register that outline how the agency and the Inspector General's office will use the Health Claims Data Warehouse, a database containing health claims information on millions of U.S. residents, Computerworld reports (Vijayan, Computerworld, 6/16).
In late October 2010, the Center for Democracy and Technology and 15 other organizations sent a letter to OPM Director John Berry asking for more information on the health claims database and expressing concern about OPM's plans to share the data with law enforcement, third-party researchers and other entities.
The organizations argued that OPM should not establish the database without allowing the public to review its plans (iHealthBeat, 11/9/10).
The notices put restrictions on the scope of the database, limit the circumstances under which data from it will be used and specify that only de-identified data will be released outside of OPM.
OPM will establish a direct data feed with the Federal Employees Health Benefits Program to collect, manage and analyze data. The agency will use that data to create long-term health records for each individual in the database. The inspector general's office will have access to the database to identify potential fraud and waste.
Another significant change is that OPM no longer plans to pull information from the Pre-Existing Condition Insurance Program and Multi-State Option Plan for the database.
The revised notices also provide more information about privacy protections, including specific information about who has access to identifiable data.
Harley Geiger, policy council at CDT, said that revised plans address many of his organization's original privacy concerns but that some other issues such as database architecture and data anonymity still need to be addressed.
Citing concerns about the use of a centralized data repository, Geiger said that OPM could achieve its goals by accessing the FEHBP data directly, rather than pulling it into a separate database. He added the use of fully identifiable data is unnecessary and that the planned analyses could be done with de-identified data.
OPM is set to begin work on the database on July 15 (Computerworld, 6/16).