Comments

Region 5 | 09/25/2024

Sentiment: 3 strongly support, 21 support, 2 neutral/abstain, 0 oppose, 0 strongly oppose

Region 5 supported the business membership requirement, and they emphasized that there needs to be individual training as well as organization training available. A member suggested that access to data for research should be considered whenever changes are made. Another member commented there needs to be more details about the process for "developing an ISA" with OPTN. They were supportive of increasing security associated with third party vendors however they don't want the process to make it more difficult to maintain existing agreements. Current institutional agreements with these vendors already include sections regarding IT security. They said it was challenging to complete a data use agreement due to institutional requirements for HECVAT survey.

UC San Diego Health Center for Transplantation | 09/24/2024

The UC San Diego Health Center for Transplantation appreciates the time and effort put forth by the OPTN Network and Operations and Oversight Committee in drafting the proposed Revisions to Conditions for Access to the OPTN Computer System and Reporting Privacy Incidents as well as the opportunity to provide feedback. While supportive of the overall sentiment and need for increased security to ensure the protections of the OPTN computer system, and in general agreement that extending such requirements to all entities or individuals accessing the system is appropriate, the Center does want to ensure that appropriate consideration has been given to the operationalization of the policy, should it come to pass.

•While we recognize that the vast majority of business members are likely to gain access to the OPTN Computer system via contracted labor agreement with an OPTN Transplant Center, OPO or Histocompatibility Member and the proposal does prohibit any organization to access the OPTN Computer System for “research purposes,” we believe that refining the language with regards to permissible reasons for accessing the OPTN Computer system is critical to ensuring appropriate use. We would recommend that the language proposed under 3.1: Access to OPTN Computer System explicitly require that, “facilitating organ transplantation, fulfilling OPTN obligations and quality assurance and performance improvement (QAPI) in support of transplant programs, organ procurement organizations or histocompatibility laboratories” or otherwise include an explicit prohibition against business partners from accessing, using or sharing data for personal gain or profit, ensuring that the data accessed in this manner is only utilized for the intended and authorized purposes. We assert that Business Members maintain the ability to request custom limited datasets via UNet or the OPTN Webpage as the public may do.
•To that end, the Committee may want to consider defining different classes or tiers of external business partners and thus limit the scope of their access based on their support functions, which may provide assurance to current members and the Board of Directors. We recognize that this may require further modifications to the Bylaws; specifically, Appendix M: Definitions and the proposed, 3.1 to include ” assisting OPTN members with activities related to” to further demonstrate control of commercial access to this data. 3.1: Access to OPTN Computer System 11 Transplant hospital, organ procurement organization, and histocompatibility laboratory members are 12 provided access to the OPTN Computer System as members of the OPTN for the purposes of assisting OPTN members with activities related to facilitating organ transplants, quality assurance and performance improvement (QAPI), and fulfilling OPTN Obligations, as defined in Bylaws Appendix M: Definitions. Business members may be granted access to the OPTN Computer System for the purposes of facilitating organ transplants and fulfilling OPTN Obligations, as defined in Bylaws Appendix M: Definitions, on behalf of affiliated transplant hospitals, OPOs, or histocompatibility labs.
•Striking a balance between protection and burden is key; we support the efforts to proposed to reduce barriers for newer and smaller businesses but also must acknowledge that the risk of an IT related security breach does not vary based on the type of size of an organization. All businesses within the organ donation and transplantation community are equally vulnerable due to the high value of the data they manage. Every organization wishing to access the OPTN computer system must invest in the safeguards to mitigate this risk and safeguard this critical information.
•If the proposed policy is approved, it will be crucial for the OPTN to allow ample time for business members, including transplant centers, OPOs, and HLA labs, to align their membership status and establish secure interconnection agreements in order to ensure there is no disruption to the care currently provided to patients. Likewise, Simplicity in Data Use Agreements must be encouraged in order to reduce administrative burdens. While security and data protection are without a doubt, top priorities, the overall administrative load on users should be minimized to maintain system efficiency.

Gift of Life Michigan | 09/24/2024

We appreciate the Committee’s thorough consideration and recommendations.

While some refinement or clarification might be needed for the Interconnection Security Agreement (ISA) and Data Use Agreement (DUA), we fully support their creation and implementation toward optimum system security. All OPTN users should attest to their understanding and acceptance for access to, use of, and responsibility for protection of the sensitive information contained within the OPTN computer system, and to abide by those. Breaches or inappropriate use should be reported immediately and treated as a threat to the security of the entire system.

OPTN Vascularized Composite Allograft Transplantation Committee | 09/24/2024

The Vascularized Composite Allograft Transplantation Committee thanks the NOOC for their work on this proposal. There were no substantial concerns raised by our members regarding the proposal.

Region 3 | 09/24/2024

Sentiment: 1 strongly support, 8 support, 2 neutral/abstain, 1 oppose, 0 strongly oppose

Region 3 generally supported this proposal. During the discussion, one attendee commented that some third-party companies are sending in their equipment, and in some cases their own recovery teams. They added that when these teams cause damage to other organs, there is no way to hold them accountable, which is an issue that needs to be addressed. Other attendees recommended that the timing requirement for an organization to update the account of users no longer associated with the member should be one business day rather than 12 hours. Another attendee agreed that controlling who has access to critical data and PHI is essential as more contracted entities join the transplant system. They added that it is essential to have accurate knowledge of who has access to the system and how they are using the information. 

American Nephrology Nurses Association | 09/24/2024

In response to the posted questions:

 

1.     Do you agree with the bylaw changes for OPTN and membership regarding small and new businesses? We agree that OPTN membership should be a requirement to access the OPTN computer system. We also agree with security requirements and enhancements to protect OPTN and patient data.

2.     Is a proposed transition plan feasible for members? Should this additional information be required?? Yes.

3.     Are there any additional obstacles to completing the transition plan members are aware of? Is this where additional information is required? ANNA does not have enough information to adequately address this question. However, we believe the goal is important and implementation should be made easier to reduce potential barriers to OPTN business membership.

Tempo Organ Procurement Professionals | 09/23/2024

We certainly support the strengthening of the OPTN system. With that said, as a Business Member, we have yet to be invited or assigned to any regional group to participate in so not sure how well the Business Members are being represented. We continue to align and provide the necessary information to maintain a status in good standing. This issue becomes problematic when we can not receive reciprocal information in an effort to validate auditing. For example, I am asked to provide all the login details for our contractors, but we not receive the existing list associated with our membership that would allow us to check for any and all errors. Additionally, when needing to make a change or alter a person's access, we have to place a request which takes time as opposed to having our own site admin. This makes it far too inefficient, especially when discovered after normal business hours and during donor activity. Here are a few questions.

Who will generate or provide the actual ISA or DUA? Will that be generated by the OPTN and then signed by the members, or will the members have to come up with the language etc.?

Will these changes include additional access and management capabilities for Business Admins to monitor and manage their staff? Or will we still have to go thru an application process to change access etc.?

What will be the new/amended requirements for access?

Can OPTN information be accessed/used to validate billing or other costs associated with the process?

What are the penalties for individuals who violate any policies when using the OPTN and how is that decided?

There needs to be a lot more discussion and more importantly, education, on this topic as it relates to the future needs and requirements, especially for outside agencies who will be expected to operate as Business Member. Their wasn't even an option for a business member to respond in the survey.

Region 11 | 09/23/2024

Sentiment: 4 strongly support, 6 support, 0 neutral/abstain, 0 oppose, 0 strongly oppose

Overall, Region 11 supports this proposal. A virtual attendee said the proposal is logical and necessary in an environment full of cyber attacks.

Anonymous | 09/23/2024

We favor adequate security for access to the OPTN computer system. However, we are concerned that this policy is a further limitation to reasonable access for recipients, donors, and patient advocates of independent data and studies. This seems contrary to a movement toward transparency of data and subsequent publication of information on the process and outcomes of the transplant system.

Hardware and software security, and HIPAA compliance is relatively easy to achieve. We must remember that a DUA importantly contains a provision that users will NOT attempt to re-identify a patient, etc. Creating more barriers to transparency and data access must be carefully balanced and in fact lowered for the general public and a wide range of end-users. Allowing greater access will lead to more patient-centered studies and ultimately improved nationwide outcomes.

OPTN Transplant Coordinators Committee | 09/23/2024

The OPTN Transplant Coordinators Committee thanks the OPTN Network Operations Oversight Committee for this proposal.

The Committee agrees that access to the OPTN Computer System is an important issue. It believes that all users – whether businesses, programs, or individuals – should follow the same security rules consistently.

However, the Committee has some concerns about how this policy will work in practice. It suggests developing clearer, simpler policy language that explains exactly what access businesses and their partners would have to the system. The Committee recommends including specific details about when and how businesses can access the OPTN Computer System, such as when supporting transplant hospitals, histocompatibility labs, or organ procurement organizations.

The Committee believes access should remain limited to what's necessary for each business member's work. It advises that the OPTN should be careful about expanding access for business members. The Committee notes that the current system, where transplant programs, organ procurement organizations, or histocompatibility labs grant specific access to businesses, allows for better control over what each business can access.

Finally, the Committee cautions that stricter security requirements might make it harder for small businesses or companies in rural areas to compete in this field.

International Society for Heart and Lung Transplantation | 09/23/2024

attachment

View attachment from International Society for Heart and Lung Transplantation

American Society for Histocompatibility and Immunogenetics (ASHI) | 09/20/2024

This proposal is not pertinent to ASHI or its members.

Region 10 | 09/20/2024

Sentiment: 5 strongly support, 12 support, 2 neutral/abstain, 0 oppose, 0 strongly oppose 

Members of the region are supportive of the proposal. There was concern about how the proposed requirements might affect STAR files and whether a new process would be necessary. It was noted that all data procured is subject to the new requirements, though the specific impact on STAR files remains uncertain. The conversation also touched on the definition of a "business member," questioning if at least a year of business activity is required. Proposed changes are intended to lower entry barriers for newer businesses. There was support for separating STAR files from other data reports, emphasizing the need for the IT system to be both secure and user-friendly. The responsibilities of third-party contractors were discussed, with an emphasis on them following the same security standards as other members. These contractors play a significant role in the transplantation process, and support was expressed for them maintaining "business member" status without facing unreasonable hurdles. Security concerns were raised, emphasizing that the system's security is only as strong as its weakest link. Therefore, exceptions to security policies were discouraged, even for small businesses. There was also an understanding that any changes should not slow down existing or new processes. Additionally, there was a request for more information regarding the inclusion of new business partners with less than a year of operation and the specifics of Data Use Agreements (DUAs).

Anonymous | 09/20/2024

As an organ transplant recipient, I support initiatives to protect the security of my information. The initiatives are especially welcome in light of the fact I received a UNOS notice about a data privacy incident in November 2023 that may have affected some of my personal and health information.

I understand the comments about the burden this could place on current users, as well as the stifling effect on securing the services of qualified small businesses. I encourage the committee to incorporate community feedback to develop streamlined, effective measures that achieve data security without impeding timely, successful transplants.

That being said, users should bear in mind that as burdensome as precautions may seem, the time drain of government regulators investigating a compromise of data could be even more time-consuming.

Finally, while I think broadening the user community if there is a need for the user’s expertise is appropriate, OPTN should limit access to those with a valid need to know and who will be attentive to data security protection measures.

Association of Organ Procurement Organizations | 09/20/2024

AOPO supports the OPTN’s proposal to strengthen its computer system and data protection processes as proposed in the Summer 2024 proposal to “Revise Conditions for Access to the OPTN Computer System.” Importantly, this proposal requires all business organizations that access the OPTN Computer System to obtain an OPTN business membership, allowing the OPTN to apply cohesive privacy and security standards to all users accessing patient data. AOPO is also supportive of the business membership status because it will enable the OPTN to enter into Data Use Agreements (DUAs) directly with all entities that will be granted access to the OPTN’s data, rather than through an intermediary such as an OPO or transplant hospital. The direct relationship between the OPTN and business members will allow the OPTN to control, review, and update the terms of DUAs as appropriate to best protect donor and recipient data. Further, establishing DUAs with member organizations with sufficient terms and conditions to safeguard donor and recipient data is an important aspect of adherence to the National Institute of Standards and Technology (NIST) requirements, a widely regarded and respected cybersecurity framework.

Additionally, AOPO supports the additional requirements proposed by the OPTN related to reporting privacy incidents involving data obtained from the OPTN Computer System and the related reporting timeframes. We recognize the importance of the OPTN ensuring the proper security and permissible utilization of its data following the provision of member access. The requirement for members to report privacy and security incidents involving OPTN data is a proactive measure that ensures the OPTN can take prompt actions to stop security threats, remedy any effects, and prevent recurrence. This reporting requirement also enables the OPTN to reduce the chances of data loss and ensure minimal disruption to the OPTN Computer System. Lastly, AOPO supports this reporting requirement as it will allow the OPTN to keep track of trends and patterns, thereby helping to identify anomalies or non-compliant users and lower security risks overall.

Finally, AOPO appreciates the OPTN’s timeline for implementation of this proposal and its subparts as set forth on pages 12 and 13. AOPO supports the 18-month transition period to implement all portions of the proposal fully, save the security audit requirement. It will be

important for the OPTN to provide members with ample time to implement the costly and complex information security requirements as they also perform lifesaving missions with limited staff and resources during a year in which OPO performance will determine recertification or decertification.

OPTN Patient Affairs Committee | 09/19/2024

The OPTN Patient Affairs Committee does not specifically support or oppose the proposal, but offers the following questions and comments for consideration:

• Has appropriate expertise been engaged in safeguarding this PHI with modern tech practices here? The Committee believes this proposal would benefit from seeking data and associated governance expertise from the private sector, including IT and legal resources, with specific subject matter expertise on these technology landscape practices and topics.

• Which specific roles will manage and implement the security compliance assessments regarding granting access to data? Will this involve minimum requirements/tiered requirements/timeboxed requirements dependent on the level of sensitivity of data to be accessed?

• Are there financial benefits to the OPTN related to increasing membership or reducing the barrier/broadening eligibility for membership?

• The time for developing an interconnection security agreement (ISA) should be reduced to six months, as a template is made available in the proposal. The current proposed timeline would allow companies to continue to do business for up to a year without an ISA in place.

• There is concern regarding this proposal potentially leading to reduced access to OPTN data for the purposes of research. If this is not the case, the policy wording should be clarified.

The Committee is particularly concerned about this proposal considering the data breach letters that went out recently to thousands of patients and living donors, and the security currently in place to protect this sensitive data. Personal data such as social security numbers and medical information were compromised. Committee members raised strong concerns regarding sharing this sensitive information more broadly.

The Committee offered technical expertise and experience as appropriate, requesting the review of any architectural diagrams and governance models of the proposal.

View attachment from OPTN Patient Affairs Committee

Advocate Health | 09/17/2024

Advocate Health appreciates the opportunity to provide feedback to OPTN during this public comment period. Advocate Health is the 3rd largest nonprofit Healthcare Enterprise in the nation in 6 states, 69 hospitals and more than 1,000 sites of care and includes an Enterprise Information Technology Department that includes Cybersecurity. Cybersecurity supports the entirety of the Enterprise that includes multiple OPTN Members within the Enterprise. Advocate Health is requesting the OPTN considers updating its reporting requirements for large health care entities to have a single annual attestation submission process for its security framework assessment. When Advocate Health receives the security framework assessment, which requires 58 questions of 110 to be completed, it responds with the same answers each time. This is redundant and time consuming both on Advocate Health’s end to complete and OPTN’s end to review. We would like to better understand OPTN’s rationale if this is a continued go forward strategy as we assume that there are other large health care entities that would also be completing this attestation in the same manner. Thank you for your consideration.

Sincerely,

Advocate Health

Region 7 | 09/17/2024

Sentiment: 3 strongly support, 9 support, 0 neutral/abstain, 0 oppose, 0 strongly oppose

Members of the region are supportive of the proposal. A concern was raised about the need to ensure compliance with new federal government policies on reporting cybersecurity breaches, with government agencies actively reviewing to ensure adherence to federal rules. The Data Use Agreement has undergone scrutiny by multiple government agencies, coordinated by HRSA, and OPTN members have been asked to complete security surveys. Another concern was expressed about the potential impact on smaller entities. A suggestion was made to monitor the implementation to ensure that barriers to entry are not disproportionately burdensome for smaller organizations compared to larger ones. There was also a call for implementing these changes in a way that does not create undue obstacles to system access and usage, particularly for smaller entities in the organ donation and transplantation community.

Membership and Professional Standards Committee | 09/16/2024

The Membership and Professional Standards Committee (MPSC) appreciates the work of the NOOC in developing this proposal and presenting it to the Committee. Members had some concerns about the inclusion of businesses further into OPTN affairs, somewhat outside or beyond the scope of proposal. A member expressed concern about businesses serving on OPTN Committees and having unfair access to information or the ability to influence policy in their favor over competitors. A member also expressed concern over a business potentially using the information they are granted access to for their own interests beyond what they are contracted for, potentially surpassing the conditions of access to the OPTN computer system. Members noted the increasing use of third-party vendors in the procurement and transplantation process. This increase requires thoughtful consideration of how these groups can be held accountable in the OPTN beyond and regardless of system access. Members are supportive of holding business members accountable for ensuring the OPTN computer system remains secure.

American Society of Transplantation | 09/12/2024

The American Society of Transplantation (AST) generally supports the proposal, “Revise Conditions for Access to the OPTN Computer System and Reporting Privacy Incidents.” While the proposal prohibits any organization accessing the OPTN Computer System for research purposes, the AST believes that refining the language with permissible reasons for accessing the OPTN Computer system is important. The AST recommends that the language proposed under 3.1: Access to OPTN Computer System explicitly require that, “facilitating organ transplantation, fulfilling OPTN obligations, and quality assurance and performance improvement (QAPI) in support of transplant programs or organ procurement organizations.” Additionally, the Committee could consider defining different classes or tiers of external business partners and thus limit the scope of their access based on their support functions, which may provide assurance to current members and the Board of Directors. The AST requests that the OPTN explicitly clarify that the term “facilitating organ transplantation” includes post-transplant follow up of donor data, e.g., final donor culture results. The AST also suggests that the OPTN consider additional clarity to prevent access disruptions for third parties directly accessing the OPTN data systems to identify potential organs for research.

As noted in the proposal, the AST agrees that requiring removal of a user from the system within 12 hours of their last day of employment will pose a burden on OPTN members and may be unattainable in some instances. The AST recommends modifying the proposed policy to require that members make these updates as soon as possible, but no later than 24 hours after a user’s last day of employment or a change in roles or responsibilities.

The AST has questions about who is responsible for the interconnection security agreement (ISA) when a member is using software licensed by another member that uses application programming interfaces (APIs) to access the OPTN computer system. For example, the Epic electronic health record has a transplant module; if it uses APIs, who is responsible for the ISA?

Finally, if the OPTN approves the proposed policy, it will be crucial to allow ample time for business members, transplant centers, OPOs, and HLA labs, to align their membership status and establish ISAs to prevent disruption to patient care. Likewise, simplicity in data use agreements must be encouraged to reduce administrative burdens. While security and data protection are top priorities, the overall administrative load on users should be minimized to maintain system efficiency.

Region 9 | 09/10/2024

Sentiment:  2 strongly support, 12 support, 1 neutral/abstain, 0 oppose, 0 strongly oppose 

Overall, the region supports the proposal. A member requested more support for providing resources to help programs educate their teams.  For example, making a slide presentation that can be downloaded by programs so they can present it to their teams, rather than programs having to recreate the slides themselves.  There were several comments expressing concern that while this proposal has a worthy goal of protecting sensitive data, there needs to be more thought put into executing it in a way that does not overly burden members or make impossible requests of them.  There were two attendees who requested the ability to combine multiple entities within the same institution (for example a histocompatibility laboratory and transplant center) under the same agreement.  A member suggested there should be a blanket DUA for a hospital system that includes multiple entities, since a histocompatibility lab in a hospital system may not be able to execute their own DUA.   An attendee requested that institutional IT departments be able to respond to system security surveys, as they have a better understanding of the system, than the assigned contact person at the transplant center or lab.  

Sarah Patberg | 09/05/2024

Strongly support all increased security measures proposed. However, the way access is currently granted in Security Administration is cumbersome and we would like to see that change. Adding users to security groups is especially inefficient. It would be much easier to add groups to users instead of the current process which requires you to add the user to the group, go to the next organ and then do it again. We are able to delete a user from all groups with one click and it would be wonderful if we could select the groups and add to user with a few clicks instead of navigating through several different areas. Thanks for considering this comment.

OPTN Transplant Administrators Committee | 09/04/2024

The OPTN Transplant Administrators Committee appreciates the opportunity to comment on the OPTN Network Operations Oversight Committee’s proposal on Revise Conditions for the Access of the OPTN Computer Systems.

The Committee offers the following feedback for consideration:

• The Transplant Administrators Committee suggests that the NOOC considers options to create role-based security access that restricts components of the Waitlist and DonorNet modules for third-party vendors to increase data security. 

• The Committee recommends a user access report to monitor associated users’ actions within the system.

• The Committee recommends moving reports in UNet modules into the Data Services portal to limit access to appropriate users (i.e. DonorNet Organ Offer Report).

• The Committee expresses concern regarding requirements that all who access the OPTN computer system to be registered as an OPTN member including specific examples of supportive staffing agencies.

• The Committee expresses worry regarding this proposal’s IT security requirements and the financial burdens it may have on small third-party vendors.

Region 6 | 09/03/2024

Sentiment: 3 strongly support, 8 support, 0 neutral/abstain, 0 oppose, 0 strongly oppose

Region 6 supported the proposal. During the discussion, one attendee commented that if businesses become members of the OPTN, there could be an expectation that in addition to being held accountable for network security policies, they could also be held accountable for other aspects of policies. Another attendee raised questions about what types of businesses could be members, if there would be categories of membership, how much oversight the OPTN will have over these members, and what data they could access. One attendee supported the requirement for a data use agreement but commented that the proposal needs to clarify and communicate to the community the eligibility or criteria for membership. Another attendee commented that giving access to the OPTN computer system to a broader group may add more risk. 

Region 1 | 08/29/2024

Sentiment: 1 strongly support, 3 support, 4 neutral/abstain, 2 oppose, 0 strongly oppose

Overall, the region supports the proposal. A member noted that ISAs would need to be executed between centers and business members. An attendee requested information and guidance for hospital information securities teams to complete the questionnaires and understand the requirements, especially those newer to supporting the transplant and HLA programs. One attendee agreed with the suggestion to increase the categories of people allowed to access the data and to make their access contingent on their role.

UAMS Medical Center | 08/28/2024

After reviewing the proposed changes, we mostly agree with revising the conditions for access to the OPTN computer system. We feel that if changes are made to the current conditions for access, transplant centers should be given ample time to make the necessary changes. The necessary changes should be easily identified, and support should be available to centers to ensure no interruption in care occurs. We agree that data security is critical but work in the OPTN computer system cannot be interrupted during these changes. Right now, the security review and team review required is very time consuming and has a high rate of redundancy. We feel that the proposal needs to be cleaned up significantly before additional layers of work are placed on transplant centers.

Region 8 | 08/27/2024

Sentiment: 6 strongly support, 13 support, 0 neutral/abstain, 1 oppose, 0 strongly oppose

The region supports the proposal to allow third party vendors a pathway to OPTN membership. An attendee pointed out that more OPTN support is needed for the ISA process. They explained that transplant centers must bear the cost of resources, time, and expertise to complete an ISA, so they requested more information on what resources they need to complete the ISA and be in compliance with policy. An attendee commented that this proposal does not seem to significantly impact clinical research but recommended reassurance to the community that the process is not significantly more cumbersome with the proposed changes.

·        An attendee provided the following suggestions based on review of the current DUA with UNOS. The DUA should:

o  set expectations about data integrity/accuracy

o  ensure PHI is handled consistent with HIPAA requirements

o  set expectations about privacy authorized users will have while using the system

o  set parameters for system use (including limitations on 3rd party use)

o  set requirements for notification related to data breach

o  provide clarity on data ownership

o  make clear consequences for violating terms and dispute resolution / governing law.

·        Another member pointed out that the revision of reporting systems leaves the potential for communication gaps that could not only lead to inefficiencies but also may unintentionally exclude certain groups from providing input. For example, the effort to extend data collection into the pre-waitlist period. Forms will be submitted for community feedback through a pathway that is different than the long-established system of OPTN public comment. This could lead to a decrease in healthcare, transplant hospital, and hospital administration engagement. Which bolsters the concern in the healthcare community that transplant professionals hold a diminishing voice with a shift toward greater legislator management at the exclusion of medical professionals.

OPTN Organ Procurement Organization Committee | 08/22/2024

A member raised the question of entities that many OPOs and Transplant hospitals have agreements with that access donors in DonorNet will that be impacted?- Which was answered/confirmed they would have to apply as business partners in order to have access to that data.

Region 4 | 08/19/2024

Sentiment: 7 strongly support, 11 support, 1 neutral/abstain, 0 oppose, 0 strongly oppose 

Region 4 supported the proposal with several attendees commenting that there should be a standardized template for members to use and a standardized process. Attendees also commented that the OPTN should hold business members accountable. Some attendees agreed that cybersecurity is a threat and we have to take measures to keep our systems secure.

Region 2 | 08/16/2024

Sentiment: 7 strongly support, 14 support, 1 neutral/abstain, 1 oppose, 0 strongly oppose 

Members of the region are, overall, supportive of the proposal.  The discussion emphasized the need to prioritize security of the OPTN Computer System, though concerns were raised about the potential complexity and inconvenience of repeated logins during critical work. If the proposed policy is approved, it is crucial for the OPTN to allow ample time for business members, including transplant centers, OPOs, and HLA labs, to align their membership status and establish secure interconnection agreements. This alignment is essential for maintaining the efficiency and reliability of donation and transplant systems, which ultimately benefits patients.  There was also a call for a mechanism that allows necessary access without being overly restrictive. Any changes should avoid being overly burdensome, recognizing that third-party companies often assist with organ offers due to the complexities of the current 24/7/365 organ allocation system. Simplicity in Data Use Agreements is encouraged to reduce administrative burdens, and while security and data protection are acknowledged as top priorities, the overall administrative load on users should be minimized to maintain system efficiency. 

She Gay | 07/31/2024

I frequently use the OPTN information to get updates to use in my speaking engagements as a volunteer with our OPO. The data is more difficult to obtain now that in the past but can be used with determination.

William Pelley | 07/31/2024

There is no sample ISA agreement. It would take me 180 days to work an unknown agreement through our systems. The amount of work effort dealing with the demands of UNOS/OPTN security assessments and surveys and never receiving answers to questions has never been taken in by UNOS/OPTN. These proposals should include the man hours required to perform these tasks at the Transplant Center Level. After all we are bearing all of the costs for these computer security assessments and work product. I estimate that I spent over 100 hours on a security assessment of the hospital's mainframe. And that included having to search for folks that could even understand the questions let alone answer them I am also struggling why any business needs access to the UNET system. We have a contract coordinator group that manages organ offers and of course we have our surgeons and physicians with READ only access. No one else gets access to our patient data, I don't care what the reasoning may be.