Schatz, Gerald S.

English

The Catholic University of America Columbus School of Law

Journal of Contemporary Health Law & Policy (1985-2015) Volume 18 Issue 3 Article 11 2002 Health Records Privacy and Confidentiality: Pending Questions Gerald S. Schatz Follow this and additional works at: https://scholarship.law.edu/jchlp Recommended Citation Gerald S. Schatz, Health Records Privacy and Confidentiality: Pending Questions, 18 J. Contemp. Health L. & Pol'y 685 (2002). Available at: https://scholarship.law.edu/jchlp/vol18/iss3/11 This Comment is brought to you for free and open access by CUA Law Scholarship Repository. It has been accepted for inclusion in Journal of Contemporary Health Law & Policy (1985-2015) by an authorized editor of CUA Law Scholarship Repository. For more information, please contact edinger@law.edu. HEALTH RECORDS PRIVACY ANDCONFIDENTIALITY: PENDING QUESTIONSGerald S. Schatz*"Privacy" and "confidentiality" of medical data and records in healthcare and biomedical research on human subjects are the stuff of myth andillusion, often more symbolic than substantive. Let me begin with somedefinitions and my perspective, then mention some emerging technologiesand point to some important, lingering questions.As I use these terms: The right to privacy refers to the right of theperson to be left alone in ordinary circumstances, to be free from arbitraryintrusion into one's affairs by government and by other persons. Asagainst government, privacy may be a constitutional or statutoryprotection. In the United States, to the extent that privacy protectionsexist, they are enforceable in the courts in civil litigation and due processclaims. Confidentiality refers to safeguarding privacy. Records may besubject to varying degrees of confidentiality in order to protect the privacyof the persons who are the subjects of those records. Medical, health andbiomedical, as used here, include behavioral and social science and socialservices. Technology is used here in the anthropological sense, to referbroadly to how we work in a cultural and societal context. This isespecially important. Ultimately, people, not organizations or machines,are the requestors, suppliers, processors, manipulators, users, buyers andsellers of information. People are the devisors of systems for processinginformation.First, let me provide some perspective. After my wife emerged from thecancer ward of a local hospital, that institution's contract fund-raiser calledand asked how her stay went on the cancer floor. A few weeks later, shebegan getting targeted mail from the funeral industry. Today, the creditcard industry sends her offer after offer, praising her creditworthiness andpromising huge credit lines. Alas, she has been dead for nine months. The* Of the District of Columbia Bar. Mr. Schatz teaches Biomedical EthicsLaw at the Graduate School of the Foundation for Advanced Education inthe Sciences, Inc., and in September 2002 became a visiting scholar at theCenter for Clinical Bioethics, Georgetown University Medical Center. Hehas been a public member of the Institutional Review Board of theNational Institute of Child Health and Human Development, and he is apublic member of the Hematopoietic Progenitor Cell Standards ProgramUnit of the American Association of Blood Banks.Journal of Contemporary Health Law and Policy [Vol. 18:685business world that would exploit health and medical records is neithermonolithic, nor invariably smart.More perspective, the Hippocratic Oath obliges the physician to protectthe patient's privacy-including the privacy of the patient's house-butonly in part. The Oath bars the physician's disclosure only of what oughtnot to be divulged from the physician-patient relationship. What ought tobe divulged is, in the Oath, a societal matter. The standard of care, so tospeak, does not include absolute confidentiality, although many physiciansbelieve, or dearly wish, to the contrary. The myths of absolute privacy ofthe patient or biomedical research subject persist, as do myths concerningthe right and obligation of a caregiver or researcher to protect thepatient's or subject's privacy and to safeguard the health record. Ofcourse, there are readily acknowledged departures-chiefly for publichealth and child safety and to interact with other persons and entities inthe patient's behalf. The cherished medical obligation of confidentialityhas both ethical and legal roots and is in continuing tension with societaldemands. In the United States, courts long ago cut deeply into the doctor-patient privilege. The United States Government and state governmentslong have had access to health records in connection with health-caresubsidy, public benefit programs, schools, clinics, prisons, public andprivate occupational safety and health, public hospitals and biomedicalresearch-including behavioral and social research. Law enforcementagencies are establishing DNA databanks. The world's financial andbusiness structures and their regulation have changed. A large firm maybe involved simultaneously in banking insurance, and other businesses, allin addition to its involvement in employee health benefits andoccupational health. At the same time, that firm may be subject tomultiple regulatory structures in each of several countries and in severaljurisdictions of federal states. Far smaller, independent firms may beinvolved in some aspects of processing medical information.Increasingly and dramatically, payment for health care in the UnitedStates has shifted away from classic insurance and toward a combinationof government-subsidized facilities and care, government insurance, andmanaged care in which insurance firms administer not so much their ownmoney as employers' benefit funds, employee premiums, and businessarrangements include drug company tie-ins. Information on the patient'scondition and treatment joins the financial record.Accordingly, much may depend upon the uses and misuses of the healthrecord. Efficient use of information technologies in diagnosis, therapy,prophylaxis, and research and development redounds to the benefit ofHealth Records Privacy and Confidentialitypatients, the public and insurance providers, as does efficientadministration of health benefit and public health programs.But the easy availability of private information also lends itself toinvidious discrimination. For example social stigma or Kafkaesque denialsof mortgages or employment to qualified applicants whose health recordsmark them as health insurance risks. Similarly, the easy and un-policedacquisition and sharing of personal data lends itself to targeted marketing,which some may deem a service and which others may deem an un-consented exploitation. Accordingly, the need to protect the privacy ofpatients and research subjects and to protect the confidentiality of theirhealth records is a deeply felt, continuing concern of patients, researchsubjects, ethicists, and healthcare professionals.Legislation and regulation reflect the pendency of these concerns.These concerns are not new. The National Research Council ComputerScience and Engineering Board sought in its report Databanks in a FreeSociety to clarify the interrelationships of responsibility, confidentiality,and technology: "It is the increased feasibility of data sharing, and not anysignificant changes in either privacy or due-process interests, that will bethe most important effect of advances in computer technology" in theseregards. Clear implications then, in the Board's view, included extending"the zones of personal and group freedom from compulsory datacollection," providing "greater rights of access by individuals to therecords maintained about them," providing greater rights to contest thoserecords, questioning the need for data collection case by case, andabolishing some old files altogether." The criteria for data collectionwould be demonstrable of a need to know and share. Why was the databeing sought? What uses would be made of it, and by whom? The reportby the Computer Science and Engineering Board was published in 1972.These questions persist.The emerging technologies of interest in this respect are, first of all,organizational changes. Persons, subject to no health professional ethicalstrictures have become negotiators, gatekeepers, processors, exploiters,and vendors of patients' secrets. Research subjects and medical patientsare not negotiators in the international trade harmonization arena.In ordinary, non-exotic health care, the use of the contract of adhesionwith respect to personal data is increasingly common. Some havecharacterized it as "sign or die."The emerging Internet technologies, including web-based medicine andpharmacies; email; malicious coding; data-mining; and computer-basedprivate investigations all acquire and share personal data. Among the2002]Journal of Contemporary Health Law and Policy [Vol. 18:685problematic emerging technologies, anticipated in that report twenty-nineyears ago, is a black market in personal data.Pharmacogenomics, tailoring drugs to individuals, is an area of greatinterest in medical research and development, but poses considerabledanger to health privacy absent adequate controls over acquisition,verification, and sharing of personal information.Genetic testing and disease prediction increase the severity ofconsequences of breaches of confidentiality.Tissue banking, cross-linkage studies, and longitudinal studies posedifficult problems. Further, in some U.S. hospitals, patients are pressuredto provide tissue samples for use in the biotechnology industry. Overseveral years, a great deal of tissue has been acquired in the course ofresearch, and by cross-linking with medical records it has become possibleto infer relationships between genetics and medical conditions expressedlater in life. Finding and tracking the individual subjects may raise issuesof unconsented invasions of privacy. Again, the consequences ofinformation leaks here can be severe for the individual patient andconfidentiality should not be a cover for violation of rights. However, thatshield may have to be penetrated in limited circumstances; for example toascertain that the taking of tissues did not come from coercivecircumstances.Behavioral genetics, whether based on actual genetics or on familybackground, behavioral genetics and related social research, may beparticularly troubling. Many proponents of research in this area see it asthe search for a key to' finding the predictors of behavior to facilitatetimely and effective. interventions. Studies of children deemed byresearchers to be "at risk" for behavioral problems fall into this category.Often, these studies target slum school populations and involve schoolpersonnel. Misuse and leaks of personal information from these studiescan be devastating in their effects. Students may be labeled and channeledinto ostensibly remedial or preventive programs without due process oflaw. Predictions of antisocial behavior may become self-fulfillingprophecies. The predictions may come to haunt these children in lawenforcement proceedings and in searches for employment. The lawenforcement and security industry has been trying to sell the District ofColumbia Government a schoolchildren's identity card system. The cardwould include health information. The processing system and facilitieswould be managed by the D.C. Department of Motor Vehicles.This is a troubling set of factual challenges, the more complicated bothin the United'States and Europe because of complex and seeminglycomprehensive regulatory structures. Notwithstanding the structure andHealth Records Privacy and Confidentialitycontent of regulation, the big questions remain: Why is the data sought?How will it be used? By whom? What rights does the subject of the datahave?The European Union's Directive 95/46/EC, on the Protection ofIndividuals with Regard to the Processing of Personal Data and on theFree Movement of Such Data, requires member states to legislate privacyprotections that begin with personal privacy as the default position, ismore protective than U.S. legislation and regulation on confidentiality ofpersonal records. The directive's efficacy remains open to question,however. Thus, the draft Charter of Fundamental Rights of the EuropeanUnion provides in Article 8 for "Protection. of Personal Data" thatinstrument leaves open the question of remedy.For all their gaps, these European developments have left U.S.international companies scrambling to conform their personal datapractices to requirements in the European Union. This has been nosimple task, inasmuch as those same companies must conform to U.S.requirements that do not make privacy and confidentiality the defaultposition. Rather, Gramm-Leach-Bliley, the Financial ServicesModernization Act, seems comprehensive as to consumer privacy butpermits a great deal of data sharing unless consumers opt out. Recentregulations promulgated under the Health Insurance Portability andAccountability Act of 1996 seem comprehensive at first glance, and wereannounced by the Department of Health and Human Services onDecember 20, 2000, as "Protecting the Priyacy of Patients' HealthInformation." The HIPAA regulation is a records managementregulation. Neither HIPAA nor the regulation addresses comprehensivelythe big questions such as; Why require the data? Who will use the data,and for what purpose? The HIPAA regulation spells out certainrequirements for health records management, and it partly limits datasharing. The Continuing Legal Education industry in the United Stateshas gone to work to train lawyers in HIPAA compliance counseling.Perhaps more because of fear of government inquiry than because of therule itself, there are good-faith efforts to comply-although I doubt that therule will withstand judicial scrutiny or last long in its present form.The thirty-one-page rule and its 338-page preamble constitute awonderful exercise for teaching administrative law. Consider: Does thepreamble correctly state its constitutional and statutory authority? Doesthe preamble make sense? Notwithstanding whether it makes sense, is itconsistent with legal authority? Does the rule respond to an intelligibleprinciple in the legislation? That requires in turn that one look at thelegislation for an intelligible principle, and that is a difficult task. How is2002]Journal of Contemporary Health Law and Policy [Vol. 18:685the rule designed to work in practice? It does not appear that any thoughthas been given to how the rule would actually work in practice. Whatprotections does the rule provide and for whom? Who is exempted fromthe rule's obligations? Law enforcement agencies and any public bodythat wants to make an inquiry with an administrative subpoena or datarequest is exempted from the rule's obligations. Who is exempted fromthe rule's protections? Approximately eight million Americans who areeither prisoners or detainees. Detainees are people who have beenarrested but who have not been tried. Under what circumstances is therule superceded by more protective state law? The default is to thefederal requirement. How does the rule apply to various Federal and stateentities? These issues are effectively unaddressed. When is fullcompliance expected? At least two years from the effective date of therule. What right of remedy is provided? None. What mechanism forenforcement is provided? None. Yet these are basic tests for the efficacyof any administrative rule in American law. Now with these questions inmind, look again at the rule.These are basic tests for efficacy. With these questions in mind, look atthe rule. It mandates certain health records management procedures, butits exemptions are many and its enforcement provisions are empty. Someof its interlaced paragraphs give, while others take back. Nevertheless, thegood-faith compliers will try to reorganize and reprogram their datamanagement to meet the requirements of the HIPAA and Gramm-Leach-Bliley rules, and the transnational firms will try to adapt to the variousEuropean national implementations of the E.U. privacy directive. Wellbefore HIPAA, some U.S. health management organizations andhealthcare institutions instituted exemplary data-confidentiality measures.That's expensive, it's not easy, and it is not the national pattern.In several of the United States there are miscellaneous anti-discrimination statutes. Tort law still exists, and there are Federal statutesthat address discrimination. However, whether in the United States orelsewhere, legislation and regulation notwithstanding, vindication of rightsis slow and expensive. There remain those nagging big questions. Are wecaptive of emerging technologies? Consider these extracts from thatNational Research Council report:"Our task is to see that appropriate safeguards for the individual'srights to privacy, confidentiality, and due process are embedded in everymajor record system...""... What is collected, for what purposes, with whom information isshared, and what opportunities individuals have to see and contest recordsare all matters of policy choice, not technological determinism."2002] Health Records Privacy and Confidentiality 691We "cannot escape ... social or moral responsibilities by murmuringfeebly that 'the Machine made me do it."'That report has been around for more almost three decades. The issuesthat it raised still await ethical, efficacious answers.

Health Records Privacy and Confidentiality: Pending Questions

bepress Legal Repository

https://scholarship.law.edu/cgi/viewcontent.cgi?article=1210&amp;context=jchlp

Health Records Privacy and Confidentiality: Pending Questions

Abstract

Similar works

Full text

Available Versions

The Catholic University of America Columbus School of Law

bepress Legal Repository