I learned about the lack of health privacy when I hung out my shingle as a psychiatrist. Patients asked if I could keep their records private if they paid for care themselves. They had lost jobs or reputations because what they said in the doctor's office didn't always stay in the doctor's office. That was 35 years ago, in the age of paper. In today's digital world the problem has only grown worse.
A patient's sensitive information should not be shared without his consent. But this is not the case now, as the country moves toward a system of electronic medical records.
In 2002, under President George W. Bush, the right of a patient to control his most sensitive personal data—from prescriptions to DNA—was eliminated by federal regulators implementing the Health Insurance Portability and Accountability Act (HIPAA). Those privacy notices you sign in doctors' offices do not actually give you any control over your personal data; they merely describe how the data will be used and disclosed.
In a January 2009 speech, President Barack Obama said that his administration wants every American to have an electronic health record by 2014, and last year's stimulus bill allocated over $39 billion to build electronic record systems. Then on March 30, 2010, President Obama signed the Patient Protection and Affordable Care Act (PPACA), H.R. 3590, into law.
The combination of these two bills mandate unprecedented disclosures of Americans' protected health information from electronic health records for a myriad of purposes the public knows nothing about, without informed consent or meaningful notice. For example, the requirements for greatly expanding health quality research in Section 4302 require demographic data, including ethnicity, sex, primary language, and disability status, and data down to the smallest geographic level possible to be reported.
Those privacy notices you sign in doctors' offices do not actually give you any control over your personal data; they merely describe how the data will be used and disclosed.
The many new government reporting requirements for quality improvement, population health, pay for performance, patient safety, fraud and abuse prevention, comparative effectiveness, biosurveillance, and public health research, combined with the existing “research loophole” in HIPAA mean that Americans will have no control over the exposure of their sensitive health records to federal agencies or to any corporation that claims to do “research.”
This new health “research” industry includes health technology vendors and major insurers that sell data, as well as corporations that manage or transfer every kind of personal health data, such as test results or prescriptions. Clearly Congress did not intend to create a massive new industry to data-mine and sell patients' sensitive health information under the guise of doing research. This is what's known as an unintended consequence and will require major legislation and public protest to correct.
Electronic records, President Obama said in his 2009 speech, “will cut waste, eliminate red tape, and reduce the need to repeat expensive medical tests [and] save lives by reducing the deadly but preventable medical errors that pervade our health-care system.”
But electronic medical records won't accomplish any of these goals if patients fear sharing information with doctors because they know it isn't private. When patients realize they can't control who sees their electronic health records, they will be far less likely to tell their doctors about drinking problems, feelings of depression, sexual problems, or exposure to sexually transmitted diseases. In 2005, a California Healthcare Foundation poll found that one in eight Americans avoided seeing a regular doctor, asked a doctor to alter a diagnosis, paid privately for a test, or avoided tests altogether due to privacy concerns.
Today our lab test results are disclosed to insurance companies before we even know the results. Prescriptions are data-mined by pharmacies, pharmaceutical technology vendors, and hospitals and are sold to insurers, drug companies, employers, and others willing to pay for the information to use in making decisions about you, your job, or your
Deborah C. Peel, M.D., a psychoanalyst in private practice, is the founder of Patient Privacy Rights () and leads the bipartisan Coalition for Patient Privacy. She is the former co-chair of the Committee on Government Relations and Insurance.
treatments, or for research. Self-insured employers can access employees' entire health records, including medications. And in the past five years, according to the nonprofit Privacy Rights Clearinghouse, more than 45 million electronic health records were either lost, stolen by insiders (hospital or government-agency employees, health IT vendors, and others), or hacked from outside.
Electronic record systems that don't put patients in control of data or have inadequate security create huge opportunities for the theft, misuse, and sale of personal health information. The public is aware of these problems. A 2009 poll conducted for National Public Radio, the Kaiser Family Foundation, and the Harvard School of Public Health asked if people were confident their medical records would remain confidential if they were stored electronically and could be shared online. Fifty-nine percent responded they were not confident.
The privacy of an electronic health record cannot be restored once the contents are sold or otherwise disclosed. Every person and family is only one expensive diagnosis, one prescription, or one lab test away from generations of discrimination.
The solution is to insist upon technologies that protect a patient's right to consent to share any personal data. A step in this direction is to demand that no federal stimulus dollars be used to develop electronic systems that do not have these technologies.
Some argue that consent and privacy controls are impractical or prohibitively costly. But consent is ubiquitous in health care. Ask any physician if she would operate on a patient without informed consent.
There is no need to choose between the benefits of technology and our rights to health privacy. Technologies already exist that enable each person to choose what information he is willing to share and what must remain private. Consent must be built into electronic systems up front so we can each choose the levels of privacy and sharing we prefer.
My organization, Patient Privacy Rights, is starting a “Do Not Disclose” petition so Americans can inform Congress and the president they want to control who can see and use their medical records [See: ]. We believe Congress should pass a law to build an online registry where individuals can express their preferences for sharing their health information or keeping it private. Such a registry, plus safety technologies for online records, will mean Americans can trust electronic health systems.
Privacy has been essential to the ethical practice of medicine since the time of Hippocrates in the fifth century B.C. The success of health-care reform and electronic record systems requires the same foundation of informed consent patients have always had with paper records systems. But if we squander billions on a health-care system no one trusts, millions will seek treatment outside the system or not at all. The resulting data, filled with errors and omissions, will be worth less than the paper it isn't written on.
Editor's Note: Deborah Peel is a guest columnist; Rick Perlman and Graham Spruiell will be returning in the next issue of TAP