Privacy and the Health Information Domain: Properties, Models and Unintended Results

European Journal of Health Law

Volumn 10, Issue 3, 2003, Pages 223-237

  Terry, Nicolas P ^a  

^a SAINT LOUIS UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AUSTRALIA; CONCEPT FORMATION; DOCTOR PATIENT RELATION; EUROPE; HEALTH CARE ACCESS; MEDICAL INFORMATION SYSTEM; PATIENT CARE; PRIVACY; PROFESSIONAL SECRECY; REVIEW; SOCIOECONOMICS; TECHNOLOGY; UNITED STATES;

AUSTRALIA; CONFIDENTIALITY; DECISION MAKING; EUROPE; HUMANS; SECURITY MEASURES; UNITED STATES;

EID: 0347355239     PISSN: 09290273     EISSN: None     Source Type: Journal    
DOI: 10.1163/157180903770847517     Document Type: Review

References (107)

1. See generally A Transatlantic Perspective on Regulating Health Information, BMJ 20 02;324:602-606 (9 March), http://bmj.com/cgi/reprint/324/7337/602.pdf
2. See e.g., Senate Blocks Privacy Project, New York Times, January 24, 2003 (reporting US Senate vote against Pentagon project to search for terrorists by scanning information in Internet mail and, inter alia, databases of health companies).
3. Cf. In re Grand Jury Investigation in New York County, 98 N.Y.2d 525, 779 N.E.2d 173, 749 N.Y.S.2d 462 (2002) (placing limits on statutory exception to physician-patient privilege that obliges hospitals and medical professionals to report gunshot and knife wounds).
4. See e.g., Doe v. Marselle, 236 Conn. 845, 675 A.2d 835 (1996) (discussing legislative reasoning behind confidentiality provisions in Connecticut's AIDS/HIV reporting statute).
5. See e.g., Janet Corrigan, Linda Kohn, and Molla Donaldson, To Err Is Human: Building a Safer Health System (1999).
6. See e.g., BBC News, Prescription blunders 'kill 1,200 a year' 18 December, 2001, http://news.bbc.co.uk/hi/english/health/newsid_1716000/1716130.stm.
7. See e.g., Joint Commission on Accreditation of Healthcare Organizations, Reporting of Medical Health Care Errors, http://www.jcaho.org/accredited+organizations/patient+safety/hc_errors.htm.
8. See e.g., Heart surgery deaths made public, BBC News HEALTH, Thursday, 17 January, 2002, http://news.bbc.co.uk/hi/english/health/newsid_1765000/1765692.stm; http://www.washingtonpost.com/ac2/wp-dyn?pagename=article&node= &contentId=A63784-2001Oct15&-notFound=true; Sunday Times Good Hospital Guide, January 14, 2001, http://www.sunday-times.co.uk/news/pages/sti/2001/01/14/stipatcon01001. html#top; CMS, Nursing Home Compare http://www.medicare.gov/nhcompare/home.asp.
9. See e.g., Heart surgery deaths made public, BBC News HEALTH, Thursday, 17 January, 2002, http://news.bbc.co.uk/hi/english/health/newsid_1765000/1765692.stm; http://www.washingtonpost.com/ac2/wp-dyn?pagename=article&node= &contentId=A63784-2001Oct15&-notFound=true; Sunday Times Good Hospital Guide, January 14, 2001, http://www.sunday-times.co.uk/news/pages/sti/2001/01/14/stipatcon01001. html#top; CMS, Nursing Home Compare http://www.medicare.gov/nhcompare/home.asp.
10. See e.g., Heart surgery deaths made public, BBC News HEALTH, Thursday, 17 January, 2002, http://news.bbc.co.uk/hi/english/health/newsid_1765000/1765692.stm; http://www.washingtonpost.com/ac2/wp-dyn?pagename=article&node= &contentId=A63784-2001Oct15&-notFound=true; Sunday Times Good Hospital Guide, January 14, 2001, http://www.sunday-times.co.uk/news/pages/sti/2001/01/14/stipatcon01001. html#top; CMS, Nursing Home Compare http://www.medicare.gov/nhcompare/home.asp.
11. See e.g., Heart surgery deaths made public, BBC News HEALTH, Thursday, 17 January, 2002, http://news.bbc.co.uk/hi/english/health/newsid_1765000/1765692.stm; http://www.washingtonpost.com/ac2/wp-dyn?pagename=article&node= &contentId=A63784-2001Oct15&-notFound=true; Sunday Times Good Hospital Guide, January 14, 2001, http://www.sunday-times.co.uk/news/pages/sti/2001/01/14/stipatcon01001. html#top; CMS, Nursing Home Compare http://www.medicare.gov/nhcompare/home.asp.
12. See e.g., Robert M. Veatch, Abandoning Informed Consent, Hastings Ctr. Rep., Mar./Apr. 1995.
13. See generally Christos Ilioudis, George Pangalos, A Framework for an Institutional High Level Security Policy for the Processing of Medical Data and their Transmission through the Internet Journal of Medical Internet Research 2001;3(2):e14, http://www.jmir.org/2001/2/e14/index.htm
14. See e.g., Eli Lilly Settles FTC Charges Concerning Security Breach, January 18, 2002, http://www.ftc.gov/opa/2002/01/elililly.htm.
15. By way of contrast consider the comprehensive voluntary policy of WebMD, of the leading health web sites, http://my.webmd.com/who_we_are/privacy/default.htm.
16. See e.g., Gladden v. Cadillac Motor Car Division, 83 N.J. 320, 416 A.2d 394 (1980) (automobile tire "warranty").
17. See e.g., URAC, http://www.urac.org/; Electronic Healthcare Network Accreditation Commission, http://www.ehnac.org/.
18. See e.g., URAC, http://www.urac.org/; Electronic Healthcare Network Accreditation Commission, http://www.ehnac.org/.
19. See e.g., The Health on the Net Foundation HonCode, http://www.hon.ch/HONcode/Conduct.html; Hi-Ethics, http://www.hiethics.org/.
20. See e.g., The Health on the Net Foundation HonCode, http://www.hon.ch/HONcode/Conduct.html; Hi-Ethics, http://www.hiethics.org/.
21. See e.g., The Online Personal Privacy Act 2002 (S 2201, Sen. Hollins), http://www.techlaw-journal.com/cong107/privacy/hollings/20020418summary.asp.
22. See e.g., The Online Privacy and Disclosure Act of 2002 (AB 2297) (California).
23. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, Art. 8.2(a).
24. Id. See generally Theo Hooghiemstra, Introduction to the Special Privacy Issue, European Journal of Health Law 9: 181-188, 2002.
25. Art. 6(1)(b). See also Art 6(1)(c), providing for an additional proportionality test and Art. 6(1)(e), essentially limiting the time data may be stored.
26. Art. 8.1.
27. Art. 8.2a.
28. Art. 8.2c.
29. Art. 8.3 ("where processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy.")
30. Art. 12.
31. See e.g., French Medical Records Act 2002, Loi n° 2002-303 du 4 mars 2002 art. 11-7 Journal Officiel du 5 mars 2002. See also Woman sues over mistakes in her medical records, The Times (London), December 2, 2002, at T2, page 10.
32. See e.g., French Medical Records Act 2002, Loi n° 2002-303 du 4 mars 2002 art. 11-7 Journal Officiel du 5 mars 2002. See also Woman sues over mistakes in her medical records, The Times (London), December 2, 2002, at T2, page 10.
33. Art. 18.
34. Security and Electronic Signature Standards; Proposed Rule 63: 155 Federal Register: August 12, 1998. http://aspe.hhs.gov/admnsimp/nprm/secnprm.txt.
35. Data Protection Act 1998, s. 2 "In this Act 'sensitive personal data' means personal data consisting of information as to ... (e) his physical or mental health or condition."
36. Data Protection Act 1998, Schedules 2 and 3. See e.g., Sch 3, s. 8, (1) The processing is necessary for medical purposes and is undertaken by- (a) a health professional, or (b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional. (2) In this paragraph "medical purposes" includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.
37. DOH Information Policy Group, Building the Information Core: Protecting and Using Confidential Patient Information - a strategy for the NHS, 2001, http://www.doh.gov.uk/ipu/confiden/strategyv7.pdf.
38. Directive 2002/58/EC Concerning the Processing of Personal Data and the Protection of Privacy in the Electronic Communications Sector, 2002 O.J. (L 201) 37, http://europa.eu.int/ eur-lex/pri/en/oj/dat/2002/1201/1_20120020731en00370047.pdf.
39. See Safe Harbor Privacy Principles and other documents at http://www.ita.doc.gov/td/ecom/ menu.html.
40. FTC Chairman Announces Aggressive, Pro-Consumer Privacy Agenda, October 4, 2001, http://www.ftc.gov/opa/2001/10/privacy.htm.
41. The FTC amended its own Children's Internet Privacy Rule to extend the sliding scale approach for verifying parental consent. http://www.ftc.gov/os/2002/O4/67fr18818.pdf.
42. Health Insurance Portability and Accountability Act of 1996, Pub. L No. 104-191, 110 Stat. 1988 (codified as amended scattered in portions of 29 U.S.C., 42 U.S.C. and 18 U.S.C.).
43. 42 USCS § 1320d-2(d)(2).
44. 45 CFR Parts 160, 162 and 164. A consolidated version incorporating the modifications made during the Bush administration is available at http://www.hhs.gov/ocr/combinedreg-text.pdf.
45. See Robert O'Harrow Jr., Protecting Patient Data, Wash. Post, Mar. 23, 2001, at E01.
46. Press Release, HHS Press Office, Statement by HHS Secretary Tommy G. Thompson Regarding the Patient Privacy Rule, Apr. 12, 2001, available at http://www.hhs.gov/news/press/2001pres/20010412.html
47. See HHS Press Release, HHS Issues First Major Protections for Patient Privacy, August 9, 2002, http://www.hhs.gov/news/press/2002pres/20020809a.html.
48. Statement of Senator Edward M. Kennedy, Committee on Health, Education, Labor, and Pensions, Hearing on Medical Privacy, April 16, 2002, http://labor.senate.gov/Hearings-2002/april2002/041602wit/Kennedy.pdf.
49. See e.g., Cal. Civ. Code § 56.10.
50. Uniform Health Care Information Act, Proposed Revisions 2000, http://www.law.upenn.edu/bll/ulc/uhcia/hci0600.pdf
51. See note 37, above.
52. Directive 95/46/EC Art 2(d).
53. See e.g., 45 C.F.R. § 164.504(e), dealing with 'business associate' contracts.
54. 45 C.F.R. § 160.102.
55. § 164.502(a).
56. Directive 95/46/EC Art. 2(a).
57. 45 C.F.R. § 164.502(b)(1).
58. § 164.502(b)(2).
59. § 164.512.
60. § 164.508.
61. § 164.506.
62. Consumers International, Privacy@net: An international comparative study of consumer privacy on the internet, January 2001, 5-7, http://www.consumersinternational.org/news/ pressreleases/fprivreport.pdf.
63. See generally Angela Choy, Zoe Hudson, Joy Pritts and Janlori Goldman, Exposed Online: Why the new federal health privacy regulation doesn't offer much protection to Internet users, November 2001 http://www.healthprivacy.org/usr_doc/PIP_HPP_HealthPriv_report.pdf; Pew Internet & American Life Project, Federal health privacy regulation does not cover most Internet medical searches, services, or purchases, 11/19/01 http://www.pewinter-net.org/releases/release.asp?id=33. Cf. In re Pharmatrak, 329 F.3d 9 (1st Cir. 2003) (applying the Electronic Communication Privacy Act (ECPA), the court found in favor of plaintiffs, Internet users, where they alleged defendants, a web-monitoring corporation and pharmaceutical corporations, secretly intercepted and accessed their personal information). ECPA amended the Federal Wiretap Act by extending protection to data and electronic transmissions. To have a successful cause of action under the ECPA, a plaintiff must show that "a defendant (1) intentionally (2) intercepted or endeavored to intercept ... (3) the contents of (4) an electronic communication (5) using a device. This showing is subject to certain statutory exceptions, such as consent."
64. See generally Angela Choy, Zoe Hudson, Joy Pritts and Janlori Goldman, Exposed Online: Why the new federal health privacy regulation doesn't offer much protection to Internet users, November 2001 http://www.healthprivacy.org/usr_doc/PIP_HPP_HealthPriv_report.pdf; Pew Internet & American Life Project, Federal health privacy regulation does not cover most Internet medical searches, services, or purchases, 11/19/01 http://www.pewinter-net.org/releases/release.asp?id=33. Cf. In re Pharmatrak, 329 F.3d 9 (1st Cir. 2003) (applying the Electronic Communication Privacy Act (ECPA), the court found in favor of plaintiffs, Internet users, where they alleged defendants, a web-monitoring corporation and pharmaceutical corporations, secretly intercepted and accessed their personal information). ECPA amended the Federal Wiretap Act by extending protection to data and electronic transmissions. To have a successful cause of action under the ECPA, a plaintiff must show that "a defendant (1) intentionally (2) intercepted or endeavored to intercept ... (3) the contents of (4) an electronic communication (5) using a device. This showing is subject to certain statutory exceptions, such as consent."
65. See e.g., Victorian Health Privacy Principles extracted from the Health Records Act 2001 (Vic), http://www.health.vic.gov.au/hsc/hppextract.pdf.
66. Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, http://www1.oecd.org/dsti/sti/it/secur/prod/PRIV-EN.HTM.
67. Effective from December 21, 2001. For the consolidated legislation see http://www.privacy.gov.au/publications/privacy88.pdf.
68. Privacy Amendment (Private Sector) Act 2000, Schedule 3, http://www.privacy.gov.au/ publications/npps01.html.
69. Principles 1, http://www.privacy.gov.au/publications/npps01.html#a;10, http://www.privacy.gov.au/publications/npps01.html#j.
70. Principle 8, http: //www.privacy.gov.au/publications/npps01.html#h.
71. Principle 2, http: //www.privacy.gov.au/publications/npps01.html#b.
72. Principle 3, http://www.privacy.gov.au/publications/npps01.html#c.
73. Principle 4, http://www.privacy.gov.au/publications/npps01.html#d.
74. Principle 6, http://www.privacy.gov.au/publications/npps01.html#f.
75. Consolidated Act s. 27 "Functions of Commissioner."
76. Id. pursuant to s. 27(e).
77. Office of the Federal Privacy Commissioner, Guidelines on Privacy in the Private Health Sector (October 2001), http://www.privacy.gov.au/publications/hg_01.html.
78. Id. at 1.2.
79. Id. a 2.
80. Id. at 2.3.
81. See, e.g., Wis. Stat. § 146.84(c) (2001) ("An individual may bring an action to enjoin any violation of § 146.82 or 146.83 or to compel compliance with § 146.82 or 146.83 and may, in the same action, seek damages as provided in this subsection."). See also Cal. Civ. Code § 56.35 (West 2001); Haw. Rev. Stat. Ann. § 323(c) (Michie 2001).
82. See, e.g., Wis. Stat. § 146.84(c) (2001) ("An individual may bring an action to enjoin any violation of § 146.82 or 146.83 or to compel compliance with § 146.82 or 146.83 and may, in the same action, seek damages as provided in this subsection."). See also Cal. Civ. Code § 56.35 (West 2001); Haw. Rev. Stat. Ann. § 323(c) (Michie 2001).
83. See, e.g., Wis. Stat. § 146.84(c) (2001) ("An individual may bring an action to enjoin any violation of § 146.82 or 146.83 or to compel compliance with § 146.82 or 146.83 and may, in the same action, seek damages as provided in this subsection."). See also Cal. Civ. Code § 56.35 (West 2001); Haw. Rev. Stat. Ann. § 323(c) (Michie 2001).
84. See, e.g., Hurvitz v. Hoefflin, 101 Cal. Rptr. 2d 558 (Cal. Ct. App. 2001); Berger v. Sonneland, 26 P.3d 257 (Wash. 2001).
85. See, e.g., Hurvitz v. Hoefflin, 101 Cal. Rptr. 2d 558 (Cal. Ct. App. 2001); Berger v. Sonneland, 26 P.3d 257 (Wash. 2001).
86. United States v. Sutherland, 143 F. Supp. 2d 609, 612 (W.D. Va. 2001).
87. Art. 23.
88. Data Protection Act 1998 Sec. 13(1) "An individual who suffers damage by reason of any contravention by a data controller of any of the requirements of this Act is entitled to compensation from the data controller for that damage."
89. Data Protection Act 1998 Secs. 55, 60.
90. 45 C.F.R. § 164.530.
91. 45 C.F.R. §§ 160.300-312.
92. Art. 28.
93. Data Protection Act 1998 Sec. 40 et seq.
94. Privacy Act 1988 Sec. 52 et seq.
95. Data Protection Act 1998 Sec. 51.
96. Art. 27.
97. See Privacy Act 1988 Sec. 16A. See generally http://www.privacy.gov.au/business/codes/index.html.
98. Privacy Act 1988 Sec. 27. See also Federal Privacy Commissioner, "What does the Office of the Federal Privacy Commissioner do?" http://www.privacy.gov.au/publications/pial.html.
99. See e.g., 45 C.F.R. § 164.524(a)(1) (2001); Cal.Civ.Code § 56.07.
100. See e.g., Data Protection Act 1998 Sec. 7 (UK); Guidelines on Privacy in the Private Health Sector, 6 Access and correction (AU).
101. See generally Nicolas P. Terry, An eHealth Diptych: The Impact of Privacy Regulation on Medical Error and Malpractice Litigation, 27 Am. J. Law & Med. 361-419 (2001) http://papers.ssrn.com/so13/papers.cfm?abstract_id=286778.
102. Nat'l Comm. on Vital And Health Statistics, NHII Workgroup on the Nat'l Health Information Infrastructure (2000), http://ncvhs.hhs.gov/NHII2kReport.htm.
103. Nicolas P. Terry, Structural and Legal Implications of E-Health, 33 J. Health L. 605, 605 n.1 (2000).
104. http.//www.doh.gov.uk/ipu/develop/index.htm.
105. http://www.health.gov.au/healthonline/.
106. http//www.nhii.org/.
107. http://europa.eu.int/information_society/topics/health/index_en.htm.