This work is licensed under a Creative Commons Attribution 4.0 International License.
September 30, 1997
CAMBRIDGE, MASS.—A heavy public debate over computerized medical records and privacy received a contribution on September 11 from a Clinton Administration statement, which recommended a new law protecting patients. While the administration has clearly listened to the public’s worries and produced a comprehensive diagnosis of the problem, their prescription does not offer a completely effective cure.
There’s no doubt that ordinary Americans are worried. They respond with great personal concern to reports that a health worker has leaked names of HIV-positive victims, or that some employer has pilfered information from its own health plan to make personnel decisions. An ACLU poll in 1994 found that 70% of respondents were worried about insurance companies getting more information from their doctors than necessary, and 75% were worried that insurance companies would put information into databases that other organizations could access.
I myself was amazed at the access I had when I spent a few months as a social work intern many years ago in a mental hospital. During that time, I could request at the complete psychiatric records of any patient. And every year, dozens of young interns like me pass through that institution!
The great publicity with which the Secretary of Health and Human Services, Donna E. Shalala, unveiled her proposals to Congress on September 11 indicates that her recommendations take the issue as far as the administration is intending to go. Thus, what is left out of the recommendations is just as important as what they include. Critics like the ACLU are justified in pointing out many weaknesses that could allow disturbing lapses in privacy for decades to come.
Let’s not be unfair: there is much welcome relief in Shalala’s presentation. The recommendations are far better than the most recent legislative privacy effort, the Bennett-Leahy Medical Records Confidentiality Act that was introduced in October 1995. Even as far as Shalala goes, we can expect a number of strong protections.
Medical information cannot be used for activities outside treatment and payment, such as for use in direct marketing to patients.
Everyone in the chain of health care providers, health insurance companies, and related services are covered by the same rules.
Access cannot be allowed indiscriminately to everybody in an organization; staff must have a legitimate reason for looking at records.
Employers are prevented from misusing medical data for decisions on hiring and promotion.
Patients can see their own records and demand corrections.
Patients must be told when when information is released, and to whom.
Unauthorized disclosures are punished with both civil and criminal penalties.
Minors receive comparable protections to adults (a provision that, if honored, should rule out laws that require family planning clinics to report pregnancies to minors’ parents).
Health providers must provide written policies explaining patients’ privacy rights, models for which Shalala’s agency will draw up.
Records of disclosures must be preserved along with the medical information for the life of the information.
Yet the recommendations leave too many loopholes. Perhaps the worst is the provision leaving an opening for law enforcement to look at records. Shalala offers unpersuasive justifications for this exception to the rules, and remains vague about how much leeway she would offer the police. The Bennett-Leahy bill, as reported in Consumer Project on Technology comments, would have granted enormous powers to a wide range of law enforcement personnel. Give the Clinton Administration’s historic preference for granting them new powers—under the guise of fighting terrorism, for example—we can expect protections to be blasted away.
The privacy community is also worried over an “administrative simplification” provision in a 1996 health act that assigns a unique ID to every American, to be used on all health records throughout that person’s life. It facilitates access to records that is too broad (and even outright database cracking by unauthorized intruders) but Shalala tacitly leaves it in place. As her presentation boasts, the recommendations don’t call for a centralized database—but they don’t rule one out either. The tendency in the health care industry is toward consolidation of information into large databases, which are always attractive targets for intruders.
Furthermore, information recipients that aren’t involved in health care—such as life insurance companies—can do anything they want with the information they receive, subject only to agreements they make with patients. Shalala seems to think that granting information to such institutions as life insurers is voluntary, but the average client is likely to feel pressure to sign whatever the company presents.
The threadbare net of state laws regarding medical privacy definitely needs to be wound tighter with a comprehensive national law. But insurance companies and other organizations with their eyes on sensitive personal data are fighting such efforts. So it does not bode well that the administration is willing to start with serious known gaps in its proposal. In fact, an ACLU press release points out that the proposal may undermine state protections We should offer Secretary Shalala a maintenance dose of public support for the progress she’s already made, but keep up the pressure to improve her regimen.
This work is licensed under a Creative Commons Attribution 4.0 International License.
Editor, O’Reilly Media
Author’s home page
Other articles in
chronological order
Index to other articles