Health Web Site

Health Web Site standard 4 provides:

The Web site discloses to users: (Primary)
(a) What information is collected about users after the user opts-in to the information collection
and how it is used (including the use of passive tracking mechanisms); (Primary)
(b) The use of passive tracking mechanisms to users and the purpose(s) for which the passive
tracking mechanism will be used; (Primary)
(c) To whom personally-identifiable information may be disclosed, and for what purpose;
(Primary)
(d) How long personally-identifiable information is retained; (Primary)
(e) The rights of users with respect to their personally-identifiable information, including all the
rights enumerated in section IV of these standards; (Primary)
(f) The entity that maintains personally-identifiable information; (Primary)
(g) How users can access, supplement, and amend user-provided personally-identifiable
information and personal health information; and (Primary)
(h) Any limitations on amendment, deletion, or removal of information. (Primary)

The standard, like all of URAC's privacy/confidentiality-related standards, is a mandatory standard.  

It's important to note that Personally Identifiable Information ("PII") is defined as "Any information that can be tied to an individual identifier."

This disclosure requirement is a prerequisite for WS 24, the opt-in requirement for personally-identifiable information PII).  The notion underlying this pair of standards, of course, is that full disclosure is required for true choice.

The disclosures required by this standard are usually on a page called "Privacy Policy," and must be obviously displayed.  We recommend that this be a persistent link in the overall template of the Web site.

Another important issue in connection with this standard has to do with the use of 3rd parties that might collect and use PII, such as a health risk assessment tool.  URAC provides guidance for this scenario in its "Points to Remember" section of the Program Guide.  The essence of that guidance is that the applicant Web site is held to a high standard regarding privacy disclosure, and does not get off the hook by delegating PII-collection to a contractor.

The submission for this standard has the same form as most: a P&P that clearly describes the PII policy, coupled with an easily-locatable link to a comprehensive disclosure page.  

This standard, with a single clause and a relatively low weight of 3, is quite straightforward and easy to meet.  It reads:

The Web site discloses its practices for uses and response times for e-mails, electronic messages, and other communications transmitted via the Web site. (Primary)

As is nearly always the case with Health Web Site standards, a combination of a compliant web page and a P&P that codifies the appropriate procedure is required by URAC.  For this standard, it also will be helpful to provide evidence that staff members charged with communications are trained in the P&P's requirements (e.g., training agendas).  In addition, URAC suggests submitting dated response emails to show that your organization complies with your own turnaround-time policies.   

One of the clearest examples of the way a contact page should look can be seen at A.D.A.M.'s "Contact Us" page.

Be forewarned --  The URAC reviewer might just send you an anonymous email to see if you comply.  Make sure you've implemented your P&Ps on turnaround times!

This mandatory standard reads as follows:

The Web site discloses to users in plain language:
(Primary)
(a) The specific services it provides, such as health content, connectivity, service delivery, personal health management, and/or commerce; (Secondary)
(b) Terms and conditions regarding the provision of services; (Secondary)
(c) Appropriate uses and limitations of those services including limitations (if any) on (Primary)
(i) providing health advice to users; and (Primary)
(ii) emergency health situations; and (Primary)
(d) The rights and responsibilities of users and other participants. (Secondary)

The heart of this standard is subsection (c), which is where the only primary elements in this standard are found.  This reflects URAC's persistent concern with consumer safety, reflected in the requirement that the mandatory disclosure highlight appropriate uses and limitations on the Web site's services, particularly around health advice and emergency health care.  In fact, URAC is quite clear that the "intent of WS 2 (c) (i) is to include a disclaimer so that users know the information is not intended to replace the evaluation of a health care professional."

Documentation required for this standard includes not only the URL of the disclosure page(s), but policies and procedures that institutionalize this disclosure requirement.  This falls under the category of "don't just do it right, but also have a P&P that requires that you do it right" that I wrote about in this post. 

URAC provides a great deal of interpretive information for this standard, reflecting the importance URAC places on disclosure about the Web site's services.  While we encourage a close reading of all the interpretive information for this standard, among the most important of these tips are:

• When medical or health services are supplied through a site, it is prudent and in some cases legally necessary for the site to require users to acknowledge the terms and conditions of the services provided (opt-in). Frequently this is achieved by the user clicking on an “I have read and agreed to the terms” button prior to accessing the service.
• URAC requires explicit opt-in prior to the collection and use of personal health information (PHI). URAC’s Health Website Standards do not require users to formally acknowledge the site’s terms and conditions prior to accessing non-PHI related services.
• Sites should pay close attention to adequately describing the terms and conditions of synchronous and asynchronous interactions between users and licensed medical professionals. Examples of these interactions are forums/community boards and “Ask A Doctor” services.
• Ideally, the link to T&C should be conspicuous and appear on all pages as a persistent link within the overall site template. Applicants should also provide additional links to disclosures about tools, services and information collection where applicable.

This standard is a mandatory standard, and reads:

The Web site discloses to users information regarding: (Primary)
(a) Significant financial investors and interests in the owner or Web site (to include any product, service, or organization mentioned or endorsed on the site); (Primary)
(b) The identity of the Web site owner, including address; legal name; executive team; and (Secondary)
(c) Where to get more information about the owner(s) (such as annual reports). (Secondary)

The standard reflects the notion that the consumer has a right to know who owns a site so they can make assessments about potential conflicts of interest.  The link to the "About Us" or similarly-named page needs to be obvious, easy-to-find.   Note that the review will look not only at this page, but is likely to cross-reference the information he/she finds there against information about the Web site's owner that may be found in news releases or other documents.

In addition to the URL of the "About Us" page, applicants should submit "Articles of incorporation, publicly filed financial reports, and other legal documents delineating investment and ownership of the Web site." 

In upgrading the Web site standards from v. 2.0 to v. 2.1, URAC has merged standards 36, “Policies and Procedures Review”, and 37, “Policies and Procedures Dates”, into a single standard 36.  While there is no substantive change in the language, the merger of the two standards, which in v. 2.0 were weighted 4 and 3, respectively, and the assignment of a weight of 4 to the new, combined standard, accomplishes two things:

It marginally decreases the importance of the P&P maintenance and approval process compared to the rest of the Web site standards, and

It marginally increases the impact of omitting from the P&Ps the effective dates and the date of the most recent revision. 

The new standard reads:

The owner: (Secondary)

(a)    Maintains a master copy of policies and procedures; (Primary)

(b)   Reviews policies and procedures no less than annually, and revises when necessary; and (Secondary)

(c)    Ensures that internal policies and procedures include effective dates, including the date of the most recent revision. (Primary)

For a more complete explanation of URAC’s scoring system, see this blog on the subject.

In moving from v. 2.0 to 2.1, URAC has amended Web Site standard 15 by making all the elements of this mandatory standard “primary”. Previously, both the stem and subsection (a) were secondary. The standard reads:

For health content and health related information, the web site provides: (Primary)
(a) The name of the author, or (Primary)
(b) The source of the material; and (Primary)
(c) The date of the most recent review or update (Primary).

The consequence of this change is that no element of this standard can be missed if the applicant is to achieve full accreditation. Previously, it was possible to omit the name of the author and still receive a full accreditation.

The most straightforward of all the URAC Health Web Site (WS) standards, WS 13, is consistently the most problematic. It has been so from the beginning.

I was on the team that conducted the very first WS reviews -- I did 7 companies, and another consultant did the other 7. And, from the very beginning, we all saw that this standard was simultaneously important and very tough to handle. Let's look at it:

• The web site does not make claims of therapeutic benefit without competent and reliable scientific evidence that supports the claim.

Now, let me say right off the bat that this is a big improvement over the 1.0 version, which used the vague phrase "reasonable support" instead of the more useful v. 2.0 "competent and reliable scientific evidence".

Yet, we aren't out of the woods, despite the improvement.

What's so tough? Well, let's start with "claims of therapeutic benefit". What is that?

The Progam Guide (another improvement over 1.0, which didn't have one) tells us that a claim of therapeutic benefit is "an assertion that something (e.g., procedure, drug, and/or exercise) will promote or enhance well-being by having or exhibiting healing powers."

While that guidance wasn't there in v. 1.0, there should be no change in interpretation: this is the definition that Guy D'Andrea (then URAC's Senior VP), Ryan Lawton (who headed up the HWS program at the beginning), and I came up with for the first wave of applicants. Placing the definition in the Program Guide, though, should make it clear -- if you are going to say that doing X will benefit your health in Y ways, you'd better have some support for that statement.

Further, the Program Guide makes it clear what we stressed from the outset -- citing the author isn't sufficient support. If it were, you wouldn't need a separate standard requiring you to cite the author (WS 15).

OK, so we know what to look out for. But what is required for support? Again, the Program Guide makes explicit what had been our practice from the beginning: the key is that "the average user could, if so desired, go to the publication or organization cited to confirm that, in fact, the publication or organization has provided the support for the claim of therapeutic benefit that is made on the Web site." This is why it's acceptable to cite the American Cancer Society -- an average user can go to that organization and look for more details about ACS's support of the claim.

Here's a practice pointer -- while the application should contain a representative sample of URLs with claims of therapeutic benefit, do not assume that the reviewer will look only at the URLs you provide. Expect the reviewer to roam your website freely, especially in connection with this standard. The Web Site Accreditation Committee has made it crystal clear -- this is among the most important standards of all the WS standards.

One final note -- if you delegate the health content to a contractor, be sure to oversee this standard, even if the contractor is URAC-accredited. The Committee is not likely to let you off the hook on this one whether it's your content or your contractor's.