Psychoanalysts await the implications of the Affordable Care Act (ACA) as it unfurls in fits and starts. Psychoanalysts sometimes speak as if we are the only clinicians affected by significant changes in health care, when in fact it is a concern for all Americans, clinicians and patients. Psychoanalysts, who have witnessed the false promises of managed care organizations and preferred provider organizations to improve the quality of care and to reduce costs, now wait to see if the ACA can fulfill its promises, hoping, despite dwindling reimbursements and increasing insurance reviews in the fee-for-service model, there will be a viable path for psychoanalysis.
But health care is only one shining scale on the dragon of societal transformation wherein privacy is subjected to balance testing and pragmatic analysis. The privacy of customers in relation to corporations and, more important, the privacy of citizens in relation to the government are both undergoing similar transformations. The penumbral references to privacy in the Constitution refer to the citizen's right to privacy in relation to the government and are an essential part of the social contract; but it is fair to say privacy has also been the essential principle in the clinician-patient contract since Hippocrates. The promise of privacy underlies trust in one's doctor and in one's government.
It is worrisome that credit card readers at Target get hacked with malware, breaching sensitive information of 100 million customers, and another worry that Google, Yahoo, and Amazon keep tabs on personal information of their customers and sell that information without customer consent. It is a quantum leap of worry however, when the Justice Department listens in on personal telephone conversations of reporters and their contacts without a warrant, or NSA conducts surveillance of Americans on the Internet, telephone conversations, business transactions, and text messages without proper oversight by the Foreign Intelligence Surveillance Act (FISA) court.
But trust goes by the wayside when the President of the United States on 37 separate occasions promised American citizens that they could keep their doctors and insurance, when he knew that millions of Americans could not. On one of those occasions President Obama explicitly said, “No matter how we reform health care, I intend to keep this promise: If you like your doctor, you'll be able to keep your doctor; if you like your health care plan, you'll be able to keep your health care plan.” Upon being confronted about this misstatement, President Obama made a further mis-statement when he said, “Now, if you have or had one of these plans before the Affordable Care Act came into law and you really liked that plan, what we said was you can keep it if it hasn't changed since the law passed,” when in fact he did not originally include that stipulation. Imagine that in the United States it would be up to the president to determine whether citizens could keep their doctors or insurance.
There is not much that APsaA's Committee on Government Relations and Insurance (CGRI) or other clinicians can do to address malware on credit card readers or to curb Internet corporations about their use of information they collect from customers. Nor is there much CGRI can do about surveillance of citizens by the Department of Justice or NSA, or misleading statements by the president, except to affirm that all citizens—especially patients—have a right to privacy guaranteed by the U.S. Constitution, and that government surveillance without a warrant or judicial order represents a gross violation of that right.
In this respect, CGRI has a responsibility to jealously defend patient privacy and the right to freely contract in private practice according to professional ethics. Despite reassurance from some of our members, CGRI objected vehemently to the elimination of the consent requirement in HIPAA which allowed transmission of personal health information without patient consent for billing, treatment, and health care operations.
CGRI efforts initially succeeded when President Clinton at the end of his term reinstated the consent requirement largely due to the advocacy of Bob Pyles and Jim Pyles as well as other privacy groups, all of whom predicted that the removal of the consent requirement would spell the end of patient privacy. Both of the Pyles brothers received commendations from President Clinton for their patriotism. President George H.W. Bush initially agreed with President Clinton about the removal of the consent requirement and briefly referred to himself as the “privacy president,” but he then eliminated the consent requirement, resulting in the loss of patient consent and ownership (regulatory control) of personal health information. Consequently, our government for the first time in history could lawfully disclose personal health information without patient consent, contradicting a central tenet of consent in the Constitution and medical ethics.
Graham L. Spruiell, M.D., is co-chair of the Committee on Government Relations and Insurance and a member of the Program in Psychiatry and the Law, Beth Israel Deaconess Medical Center, Boston.
The prediction of the Pyles brothers has largely come to pass as it has become clear that the HIPAA Privacy Rule was no longer about patient privacy but had morphed into a rule about unconsented disclosures. True, HIPAA technically protected patient privacy in certain respects, but while the front door was bolted tightly, the back door was left ajar, and what was intended to be the “floor” of privacy protection for patients has become the “ceiling.” Such is the case in Hawaii, where pharmaceutical companies, insurance companies, and employers pressured legislators to forgo stronger state laws in lieu of less restrictive HIPAA regulations.
Since HIPAA went into effect, patient privacy has continued to be degraded. In Sorrell v. IMS Health Inc. , the United States Court of Appeals for the First Circuit concluded that a Vermont law banning data mining companies from selling prescription information to pharmaceutical companies was unconstitutional. This decision was appealed to the United States Supreme Court in 2011 by the state of Vermont, but the Supreme Court upheld the decision of the First Circuit and agreed that the Vermont law limited the right to free speech of the data mining companies, arguing that since the government already had access to this information for purposes of research, industry should have similar access.
This begs the question about why the government should have access to such data to conduct research without patient consent and is contrary to the Nuremberg Code, which largely forms the basis of the Code of Federal Regulations issued by HHS to govern federally funded human subject research. Here the research interests of the government and the commercial interest of data mining companies trump the right of patients.
Consequent to this decision, in January of this year one such data mining company, IMS Health Holdings, announced it would begin selling stock on the New York Stock Exchange. It along with other listed corporations are deriving significant revenue from the sale of personal health data to over 5,000 clients. Our own Deborah Peel of Patient Privacy Rights stated in her blog, “All purchases and subsequent sales of personal health records are hidden from patients.” She stated further, “Despite claims that the data sold is ‘anonymous,’ computer science has long established that re-identification is easy.”
IMS Health Holdings boasted, “We have one of the largest and most comprehensive collections of health care information in the world, spanning sales, prescription and promotional data, medical claims, electronic medical records and social media. Our scaled and growing data set, containing over 10 petabytes of unique data, includes over 85 percent of the world's prescriptions by sales revenue and approximately 400 million comprehensive, longitudinal, anonymous patient records.” Such data mining companies profit from information derived from patients without their knowledge and without compensating them, which should be considered a form of confiscation and a violation of the sovereign rights of patients and clinicians. Again, anonymity is a term that had more meaning before the computer age.
The inevitable distrust of patients when they realize that their personal health information is being sold in the marketplace will be exacerbated when they learn that the federal health insurance exchanges are not subject to the suboptimal privacy protections of HIPAA, and if there is a breach of medical records on federal exchanges, patients would not be notified unless “harm” could be demonstrated.
In an effort to restore trust in the transformed health care system, Jim Pyles has written a letter to Congressman Joe Pitts (R-PA) in behalf of APsaA supporting the Health Exchange Security and Transparency Act of 2014 that would require notification of patients in the event of breaches of personally identifiable information through federal exchanges. That bill has already passed in the House of Representatives and is expected to pass in the Senate.
Sixty million Americans have had their personal health information breached since 2005, 21 million since September 2009. We are certain that there will be breaches in the exchanges. When those breaches occur, it will be in the backdrop of wider societal concerns about the loss of privacy in relation to corporations and the government, affording an opportunity for CGRI to reintroduce the Patients' Bill of Rights. Our aim is to reinforce trust in health care by recognizing sovereignty of patients to contract freely with clinicians without sacrificing privacy.