tions, researchers, and others who make use of the information. Having a neutral party like the Department of Health and Human Services, which is also involved in the development of standards for electronic data exchange, privacy, and security, take a more active role in educating patients may help improve patients' understanding of health data flows and generate a more informed public debate. Studies could examine the use of current public media such as magazines, community college-based seminars, and local news media as vehicles for informing the general public about these issues.

Recommendation 3.3: Professional societies and industry groups¹¹ should continue and expand their leadership roles in educating members about privacy and security issues in their conference discussions and publications. These are the primary organizations for reaching health care professionals who use health information. Although each already has some initiatives under way regarding privacy, such programs need to be given higher priority. These organizations, whose members have a strong interest in the use of patient information in a clinical setting, could work with privacy advocates and patient representatives to gain a deeper, more comprehensive view of patient concerns regarding privacy and would then be in a better position to develop sound recommendations in this area.

Recommendation 3.4: The Department of Health and Human Services should conduct studies to determine the extent to which—and the conditions under which-users of health information need data containing patient identities. Attempts to limit or control the flows of data to users not involved in the provision of care-whether through legislative or other means-will have to be based on a thorough analysis of the types of uses that different types of organizations have for health information. Secondary users make many claims that patient-identifiable data are necessary for legitimate uses such as fraud detection and benefits management. These claims originated at a time in which public concerns for privacy were far less intense than they are today and in which technologies to protect anonymity were far less developed. A fresh look to determine the minimum set of patient-identifiable data needed for these stated goals could result in a significant reduction of collected data that