Medical consumers' losing battle to protect their privacy
Alpert, Sheri
SINCE HIPPOCRATES, providers and seekers of medical care have sought to protect the confidentiality of their communications. Medicine has probably done better than most professions in realizing...
...Given the lack of cooperation by Daniel Ellsberg's psychiatrist in the Pentagon Papers investigation a few years before, Boland's statement was the kiss of death...
...The federal Department of Health and Human Services noted that although "many of these individuals have a legitimate need to see all or part of a patient's records, no laws govern who those people are, what information they are able to see, and what they are and are not allowed to do with that information once they have access to it...
...Although the opportunities for indiscriminate use of medical data are greater than twenty years ago, twenty years of effort to curb misuse have yielded protections hardly more far-reaching than those proposed in 1980...
...The reasons for this steady erosion of medical privacy have little to do with the values or wishes of patients—who almost universally would prefer more control over their own information, and less disclosure...
...On April 26, the thirty-day comment period ended on the Bush administration's proposal to further weaken the rule...
...The notion that the tangle of potent and conflicting interests in Americans' medical information could 0 n DISSENT / Summer 2002 be resolved over such a short period now seems little short of quaint...
...Fortunately for many HMOs, such data were easily available and increasingly computerized...
...Most believe that "doctor-patient privilege" protects the confidentiality of their records...
...it would have required that medical facilities prepare written notices to patients describing disclosures that could be made of their medical information, both with and without the patient's consent...
...They have to do with the growing value of medical information...
...Only recently have ordinary citizens begun to comprehend the scope of what's at stake for them...
...The bill would have established a right for patients to inspect, copy, amend, and correct their medical records...
...Few people realize that the privilege has legal force only at the state level, or that such state law is generally weak and piecemeal...
...But many activities bracketed in the Clinton rules as marketing are redefined by the Bush team as "recommending treatment...
...The California Health Care Foundation, in early 1999, found that 60 percent of Americans trust doctors, hospitals, or other health care professionals to keep their information confidential most of the time...
...The less confident we are that information will remain confidential, the less likely we are to supply care providers with all the information needed for our treatment...
...This episode marked the start of an odyssey to establish federal protections for personal medical information—a struggle culminating this year in a clash between privacy interests and the Bush administration's efforts on behalf of what one might call the health care-industrial complex...
...In 1996, Congress passed the Health Insurance Portability and Accountability Act (HIPAA), to improve the efficiency of health care "by encouraging the development of . . . standards and requirements for the electronic transmission of certain health information...
...All these parties can and often do gain access to medical records today—and so do many others...
...Medical Privacy Legislation Unsuccessful attempts to limit invasions of medical privacy go back more than two decades...
...Among the latter was a provision for disclosures without consent for domestic and foreign intelligence purposes...
...Genetic information, personal and family medical history, diet and lifestyle information—such data increasingly reveal not only the patient's past but also his or her likely future...
...The cast of characters began to widen with the passage in 1973 of the Health Maintenance Organization and Resources Development Act, sponsored by Senator Edward Kennedy (D-Mass...
...As MCOs have come to play a larger and larger part in health care delivery and administration, they have invested more and more heavily in information technology...
...The Bush administration treated this as one of the "last minute" rules issued by the outgoing Clinton administration— and hence subject to new scrutiny...
...The Department took until December 28, 2000, to consider all the comments and issue the final rules...
...Democrats and privacy advocates have opposed the relaxation of Clinton-era safeguards...
...SHERI ALPERT is on the faculty of the University of Notre Dame and has been writing about medical and genetic privacy for several years...
...No other medical privacy bill has made it to the floor for a vote since 1980, in either chamber...
...Surprisingly, 71 percent even oppose giving doctors access to their medical records without permission, and 67 percent oppose giving medical researchers access without patient consent...
...Could things turn around...
...Because the bill imposed a higher standard for disclosure of mental health records, Boland reasoned (probably erroneously) that passage might interfere with the conduct of foreign intelligence or Secret Service investigations...
...AND to whoever else requests them for whatever reason...
...This move further entrenched the data collection and analysis practices of MCOs, as the corporate interests sought to maximize profits and minimize costs (by analyzing data on care being provided...
...The Players Who is involved in the quest for data...
...To generalize sweepingly, but not unfairly: in the competition to control the flow of medical information, patients are increasingly losing to better organized, more resourceful parties...
...Would-be employers and providers of medical coverage want to know as much as possible about what is in store for those with whom they deal—which prospective employees are likely to be subject to which job-related complaints, for example, or which applicants for insurance are subject to illnesses requiring expensive treatment...
...The NRC report estimated that spending on electronic medical record systems would grow by 70 percent annually between 1995 and 2000 (with spending in 2000 to be around $1.5 billion...
...This would be the medical equivalent to the outcry over the release of Judge Robert Bork's video rental records during the hearings on his failed nomination to the U.S...
...On December 1, 1980, Representative Edward Boland (D-Mass...
...The upshot, on March 21, was a proposal by the Bush administration to curtail privacy guarantees embodied in the Clinton administration rules, so as to grant insurance companies and other interests access to medical data without patient consent...
...Clearly the role of information is by no means beneficent in these situations...
...Meanwhile, the health care-industrial complex has been working to define patient privacy as a competing interest to medical management, requiring a balancing act, in which private citizens' needs are somehow weighed against those of corporate advantage...
...The purpose of the act was to encourage the establishment or expansion of health maintenance organizations by providing federal grants and loans to public and nonprofit private health care providers and to introduce market-based mechanisms (and some measure of cost containment) into health care...
...Political developments have further sharpened these trends...
...Unfortunately, nothing short of that is apt to galvanize the U.S...
...In a world where access to and use of medical care are governed by highly competitive markets, the struggle for access to such data is intense...
...As Americans increasingly realize, this development has changed doctor-patient relationships— among other things, by injecting a corporate interest into the provision of health care and the use of patients' data...
...Part of that legislation provided that within three years of passage (that is, by August 1999) Congress would have to pass legislation to protect medical privacy...
...Patients, for their part, generally do not want the information they disclose to medical care providers to be shared widely beyond the confines of the clinical encounter...
...Once again, thousands of comments were filed...
...It is hard to imagine any repository of personal data more tempting to a wider array of interests...
...HHS also acknowledges that the number of places maintaining and transmitting individual health information has increased dramatically over the last decade...
...The odd thing about nearly all privacy issues is that even though everyone is affected by them, public activism remains rare...
...stood on the House floor and pronounced the bill a serious threat to national security...
...The new federal rules are unlikely to alter the situation more than incrementally...
...These vested interests constantly pour money into lobbying efCOMMENTS & OPINIONS forts and campaign contributions, in their singleminded determination to preserve their largely unfettered ability to obtain medical data and use such data to shape Americans' access to medical care and other opportunities...
...HIPAA mandated that Congress pass legislation to provide federal protection of health care information...
...The National Research Council (NRC), in a 1997 report, noted the range of entities that share identifiable health information: health insurance companies, clinical laboratories, pharmacies, pharmacy benefits managers, consulting physicians, local hospitals, state and federal statistical agencies, accrediting organizations, employers (particularly if they self-insure), life insurance companies, the insurance industry's Medical Information Bureau, and managed care companies...
...Congress imposed a three-year deadline on itself to accomplish the feat...
...As a result, drug companies could pay pharmacies to hype their products to patients, according to medical needs revealed through the latters' prescriptions...
...Under the terms of the act, the task then fell to the Department of Health and Human Services to promulgate medical privacy regulations...
...Market-driven rationalization of medical care administration and computerization of medical data feed on one another...
...Massaged via sophisticated, computer-based analyses, such data have the potential to foretell what diseases and debilities we could be subject to in years to come...
...Like other sorts of data, these are increasingly included in computerized databases...
...Instead of requiring such consent, the new rules would simply require that patients be notified at some point of the uses being made of "their" data—a relaxation welcomed by the insurance industry and deplored by privacy advocates...
...As California privacy activist Beth Givens relayed it, today's version of the Hippocratic Oath might state, Whatever I see or hear in my attendance on the sick or even apart therefrom will be divulged to physicians, nurses, aides, surgeons, anesthesiologists, dietitians, physical therapists, admitting clerks, billing clerks, utilization review personnel, discharge planners, records coders, medical records filing staff, chaplains, volunteers, performance evaluators, insurers, medical transcriptionists, accrediting agencies, public health officials, other government officials, social workers, and employers...
...No wonder patients want to maintain control over "their" data—or that commercial interests struggle so effectively to COMMENTS & OPINIONS erode that control...
...Congress...
...Several recent surveys attest to the depths of patient anxiety on these counts...
...Whether it is always legal or ever ethical for prospective employers and insurers to gain access to this information is a separate question...
...Not even all of its eighteen co-sponsors voted for the bill in the end...
...The final tally was 97 for and 259 against...
...Only 35 percent trust health plans or government medical programs (such as Medicare) to protect their health records...
...The Stakes The reasons for the ever increasing pressure to record and disclose medical data go well beyond the fact that there are more interested parties than before...
...Indeed, these strategies could not have gone forward so well without computerization...
...Once again, it failed...
...In one bright spot, the administration has proposed to allow patients preemptively to bar their records from dissemination to certain marketing interests...
...The Department of Health and Human Services will propound a final rule, perhaps by fall of this year, which will have the force of law...
...Other changes proposed by the administration would make it easier for parents to gain access to their teenage children's medical records—a measure certain to please the far right...
...Over half of Americans surveyed see the increasing computerization of medical information as the most serious threat to medical privacy...
...DISSENT / Summer 2002 - I I...
...A Gallup Organization survey in September 2000 found strong opposition to access by nonmedical interests to medical records without explicit patient permission...
...This last point doomed the legislation...
...No proposal made it out of committee in either the House or Senate...
...In 1996, Congress tried again to protect medical privacy...
...Instead, they are enmeshed in the rapidly evolving politics and economics of medical care—and in the technologies for generating, transmitting, analyzing, and using patients' medical data...
...Virtually every medical communication or transaction these days—from one's confidences to caregivers to laboratory tests to prescriptions— is noted in medical records...
...Supreme Court—which led, in record time, to the Video Privacy Protection Act...
...Even such regulations coming from HHS would perforce go well beyond present federal law, which (with some narrow exceptions) protects only those records in the custody of the federal government...
...Anyone seeking to challenge or limit such access faces an increasingly unequal struggle...
...And there are good medical reasons for respecting those wishes...
...Over the next several years, HMOs turned to strategies that relied heavily on collecting and analyzing data from clinical encounters between patients and providers to contain costs...
...Unfortunately, few Americans grasp the inadequacy of protections governing their medical records...
...Perhaps the best we can hope for are some dramatic scandals over medical privacy to get the debate properly focused on real abuses to real patients...
...The American Health Information ManDISSENT / Summer 2002 n 9 COMMENTS & OPINIONS agement Association (AHIMA) recently estimated that, on average, 150 people have access to a patient's medical records during a typical hospitalization...
...The pervasive appetite for analysis of trends and patterns in medical care consumption that dominates so much health care administration today is clearly both cause and result of such changes...
...But by the end of the twentieth century, a volatile combination of bureaucratized medicine and sophisticated information technologies had upended those expectations...
...In an arduous process, HHS issued draft rules in late October 1999 and collected more than 52,000 comments by the following February...
...In 1980, for example, the House of Representatives debated the Federal Privacy of Medical Information Act, which would have provided, for the first time, federal protection for medical records...
...Medicine has probably done better than most professions in realizing such aspirations—at least until the last few decades...
...Fully 15 percent of Americans have taken defensive measures to protect their medical privacy: seeking another doctor, paying out-of-pocket to avoid filing an insurance claim, not seeking care to avoid disclosure of an illness or condition to an employer, giving inaccurate or incomplete information to the provider, or asking the provider to omit information from their medical record...
...The bill also embodied special, more stringent criteria for disclosure of psychiatric records...
...By the mid-1990s, profit-seeking businesses had begun to acquire HMOs and other medical care organizations (MCOs...
...The costs of relying on computer technology (particularly data storage) have decreased so dramatically over recent decades that they are no longer a barrier to collecting increasing amounts of information...
...An example of this phenomenon is the Bush administration's proposed easing of restrictions on the release of patients' medical data for a variety of marketing activities, with no ability for patients to opt out...
...These developments have turned data on patients' 8 n DISSENT / Summer 2002 medical conditions into a commodity—and created market pressures for appropriation and use of this commodity regardless of patients' wishes and needs...
...In the vacuum left by the failure of the 1980 measure, institutional interests have shaped medical data collection and management to suit their needs...
...The Bottom Line Though the updated version of the Hippocratic Oath cited earlier may not describe presentday American practice in every respect, it is too close to the truth for comfort...
...As so often happens in market situations, the economic burden shifts to those whose needs are greatest and who can least afford it...
...This situation will only be exacerbated through the continuing computerization of medical data...
Vol. 49 • July 2002 • No. 3
