Health privacy in the electronic age

Journal of Legal Medicine

Volumn 28, Issue 4, 2007, Pages 487-501

  Rothstein, Mark A ^a  

^a University of Louisville School of Medicine   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CONFIDENTIALITY; ELECTRONIC MEDICAL RECORD; HEALTH CARE; HEALTH CARE ORGANIZATION; HEALTH CARE SYSTEM; HEALTH INSURANCE; INFORMATION TECHNOLOGY; LAW; LAW ENFORCEMENT; MEDICAL ETHICS; MEDICAL INFORMATION; MEDICOLEGAL ASPECT; ORGANIZATION; PATIENT INFORMATION; PRIVACY; PUBLIC OPINION; REVIEW;

CONFIDENTIALITY; HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; HUMANS; MEDICAL RECORDS SYSTEMS, COMPUTERIZED; UNITED STATES;

EID: 36849006090     PISSN: 01947648     EISSN: 1521057X     Source Type: Journal    
DOI: 10.1080/01947640701732148     Document Type: Review

References (69)

1. Christine Borger et al., Health Spending Projections Through 2015: Changes on the Horizon, 25 HEALTH AFFAIRS WEB EXCLUSIVE 2, w61 (Mar./Apr. 2006), available at http://content.healthaffairs. org/cgi/reprint/25/2/w61 (last accessed June 1, 2007) (estimating 2006 expenditures at $2.16 trillion).
2. UNITED STATES DEPARTMENT OF HEALTH AND HUMAN SERVICES, HEALTH, UNITED STATES, 2006 WITH CHARTBOOK ON TRENDS IN THE HEALTH OF AMERICANS 373 (National Center for Health Statistics 2006).
3. See generally DAVID M. CUTLER, YOUR MONEY OR YOUR LIFE: STRONG MEDICINE FOR AMERICA'S HEALTH CARE SYSTEM (2004);
4. MAGGIE MAHAR, MONEY-DRIVEN MEDICINE: THE REAL REASON HEALTH CARE COSTS SO MUCH (2006).
5. DEPARTMENT OF HEALTH AND HUMAN SERVICES, supra note 2, at 173 (ranking the United States twenty-eighth in infant mortality).
6. Id. at 174 (ranking the United States twenty-sixth in life expectancy).
7. See NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS, INFORMATION FOR HEALTH: A STRATEGY FOR BUILDING THE NATIONAL HEALTH INFORMATION INFRASTRUCTURE (Nov. 2001), available at http://www.ncvhs.hhs.gov/nhilayo.pdf (last accessed June 2, 2007).
8. See MARKLE FOUNDATION, CONNECTING AMERICANS TO THEIR HEALTH CARE: A COMMON FRAMEWORK FOR NETWORKED PERSONAL HEALTH INFORMATION (Dec. 2006), available at http:/www.connectingforhealth.org/commonframework/docs/p9_networkedphrs.pdf (last accessed June 2, 2007).
9. Incentives for the Use of Health Information Technology and Establishing the Position of the National Health Information Technology Coordinator, Exec. Order No. 13335, 69 Fed. Reg. 24,059 (Apr. 30, 2004).
10. Id.
11. See MARKLE FOUNDATION, supra note 7, at 14-16.
12. See generally UNITED STATES GOVERNMENT ACCOUNTABILITY OFFICE, HEALTH INFORMATION TECHNOLOGY: EARLY EFFORTS INITIATED BUT COMPREHENSIVE PRIVACY APPROACH NEEDED FOR NATIONAL STRATEGY, GAO-07-238 (Jan. 2007).
13. The National Committee on Vital and Health Statistics is the statutory public advisory body to the Secretary of Health and Human Services on health information policy. See www.ncvhs.hhs.gov.
14. NATIONAL COMMITTEE ON VITAL AND HEALTH STATISTICS, PRIVACY AND CONFIDENTIALITY IN THE NATIONWIDE HEALTH INFORMATION NETWORK (June 2006), available atwww.ncvhs.hhs.gov/060622lt.htm (last accessed June 2, 2007).
15. Id.
16. Id.
17. Id.
18. MARKLE FOUNDATION, CONNECTING FOR HEALTH, SURVEY FINDS AMERICANS WANT ELECTRONIC PERSONAL HEALTH INFORMATION TO IMPROVE OWN HEALTH 1 (Nov. 2006) available at http://www.markle.org/downloadable_assets/research_doc_120706.pdf (last accessed June 2, 2007).
19. Conceptually, security issues are much easier to resolve than privacy and confidentiality issues. There is unanimity in the view that personal health information should be accessible only to people with authorization. By contrast, rules for privacy and confidentiality are much more contentious because they involve a difficult balancing of individual autonomy and dignitary interests with health care quality, public health, efficiency, and other valid interests.
20. See NATIONAL COMMITTEE, supra note 13.
21. Under HIPAA Privacy Rules, individual consent or authorization is not required for disclosures for treatment, payment, or health care operations (TPO). 45 C.F.R. § 164.506 (2006). Although it could be argued the purpose of the network, ultimately, is to enhance TPO, the immediate purpose of the disclosure is not for TPO. Even if it were, an argument could be made that this provision of the Privacy Rule is insufficiently protective of patient privacy.
22. See generally Baruch A. Brody, Informed Consent and Refusal, in MEDICAL ETHICS: ANALYSIS OF THE ISSUES RAISED BY THE CODES, OPINIONS, AND STATEMENTS 421 (Baruch A. Brody et al. eds., 2001).
23. See, e.g., Baruch A. Brody, Research Ethics, in MEDICAL ETHICS, supra note 21, at 791.
24. 45 C.F.R. § 164.508 (2006).
25. If substantial numbers of people do not want to participate in the NHIN, then the answer is to make the benefits of participation outweigh the risks, rather than coercing participation or enrolling individuals without their knowledge or consent.
26. A related issue is whether patients will be able to elect to opt into the NHIN on a one-time basis. For example, a patient may decline to participate in the NHIN, but be perfectly willing to allowthe transmittal of his or her EHR to another physician for treatment purposes. In such an event, the physician probably would obtain one-time consent for transmittal. It remains to be seen whether this "single token" model of the NHIN will become popular with patients who have concerns about the privacy, confidentiality, and security of NHIN entities, but who want to take advantage of the benefits of electronic exchange of health information.
27. Standards for Privacy of Individually Identifiable Health Information; Final Rule, 65 Fed. Reg. 82,462 & 82,810 (Dec. 28, 2000) (codified at 45 C.F.R. Parts 160 & 164); 45 C.F.R. § 164.506 (2000).
28. Standards for Privacy of Individually Identifiable Health Information, as amended, 67 Fed. Reg. 53,182 (Aug. 14, 2002) (codified at 45 C.F.R. Parts 160 & 164); 45 C.F.R. § 164.506 (2002).
29. 45 C.F.R. § 164.520 (2006).
30. Id. § 164.520(c)(2)(ii).
31. See National Committee on Vital and Health Statistics, Letter to Secretary Tommy G. Thompson (Sept. 27, 2002), available at http://www.ncvhs.hhs.gov/020927lt.htm (last accessed June 3, 2007).
32. 45 C.F.R. § 164.506 (2006).
33. Id. § 164.501 (definition of "marketing" excludes communications about products used in case management).
34. AMERICAN MEDICAL ASSOCIATION CODE OF MEDICAL ETHICS § 7.05 - Retention of Medical Records (2006).
35. Id.
36. See NATIONAL COMMITTEE, supra note 13.
37. See JOY PRITTS & KATHLEEN CONNOR, THE IMPLEMENTATION OF E-CONSENT MECHANISMS IN THREE COUNTRIES: CANADA, ENGLAND, AND THE NETHERLANDS (THE ABILITY TO MASK OR LIMIT ACCESS TO DATA), A REPORT TO THE SUBSTANCE ABUSE AND MENTAL HEALTH SERVICES ADMINISTRATION 5-6 (2007), available at http://ihcrp.georgetown.edu/pdfs/prittse-consent.pdf (last accessed June 3, 2007).
38. Laura Plantinga et al., Disclosure, Confidentiality, and Families: Experiences and Attitudes of Those with Genetic Versus Nongenetic Medical Conditions, 119 AM. J. MED. GENETICS PART C 51, 55 (2003).
39. 45 C.F.R. § 164.501 (2006).
40. Other sensitive health information may be recorded by social workers, marriage counselors, or other professionals who are not covered entities under HIPAA because, for example, they do not submit claims for their services in electronic format.
41. Public Health Service Act, 42 U.S.C. § 290dd-2 (2006); 42 C.F.R. Pt. 2 (2006).
42. Genetic Information and Nondiscrimination Act of 2007, H.R. 493, 110th, Cong. 1st Sess. (2007).
43. The state laws are compiled by the National Conference of State Legislatures and are available at www.ncsl.org/programs/health/genetics (last accessed June 3, 2007).
44. But see, e.g., Mark A. Rothstein, Genetic Privacy and Confidentiality: Why They Are So Hard to Protect, 26 J.L. MED. & ETHICS 198 (1998).
45. See, e.g., Thomas H. Murray, Genetic Exceptionalism and "Future Diaries": Is Genetic Information Different from Other Medical Information?, in GENETIC SECRETS: PROTECTING PRIVACY AND CONFIDENTIALITY IN THE GENETIC ERA (Mark A. Rothstein, ed. 1997);
46. Deborah Hellman, What Makes Genetic Discrimination Exceptional?, 29 AM. J.L. & MED. 77 (2003);
47. Mark A. Rothstein, Genetic Exceptionalism and Legislative Pragmatism, 35 HASTINGS CENTER REP. NO. 4, at 27(2005);
48. Sonia M. Suter, The Allure and Peril of Genetic Exceptionalism, 79 WASH. U.L.Q. 669 (2001);
49. Susan M. Wolf, Beyond "Genetic Discrimination": Toward the Broader Harm of Geneticism, 23 J.L. MED. & ETHICS 23 (1995).
50. Mark A. Rothstein & Meghan K. Talbott, Compelled Disclosure of Health Information: Protecting Against the Greatest Potential Threat to Privacy, 295 J.A.M.A. 2882 (2006).
51. Mark A. Rothstein & Meghan K. Talbott, Compelled Authorizations for Disclosure of Health Records: Magnitude and Implications, 7 AM. J. BIOETHICS 38 (2007).
52. Id.
53. 42 U.S.C. § 12112(d)(3) (2000).
54. See EQUAL EMPLOYMENT OPPORTUNITY COMMISSION, ENFORCEMENT GUIDANCE ON PREEMPLOYMENT INQUIRIES UNDER THE AMERICANS WITH DISABILITIES ACT (1994).
55. AMERICAN MEDICAL ASSOCIATION, CODE OF MEDICAL ETHICS § 5.07(4) (2006).
56. See NATIONAL COMMITTEE, supra note 13, at Recommendations R-9 to R-11.
57. See 2002 NCVHS Letter, supra note 30.
58. See Department of Health and Human Services, Standards for Privacy of Individually Identifiable Health Information, 65 Fed. Reg. 82,462, 82,469 (Dec. 28, 2000).
59. Id.
60. 42 U.S.C. § 1320d-2 (2000).
61. Id. § 1320d-1(a).
62. Id. § 1320d-1(a)(3).
63. 20 U.S.C. § 1232g (2000); 34 C.F.R. Pt. 99 (2006).
64. There is precedent for Congress to add new covered entities to HIPAA. When it enacted the Medicare Prescription Drug, Improvement, and Modernization Act of 2003, Pub. L. No. 108-173 (2003), Congress added prescription drug card sponsors to the list of HIPAA covered entities. 42 U.S.C. § 1395w-141(h)(6)(A) (West 2004).
65. United States Department of Health and Human Services, Office for Civil Rights, HIPAA Privacy Rule Compliance Summary, available at http://www.hhs.gov/ocr/privacy/enforcement/ (follow "Privacy Rule Enforcement Highlights" hyperlink) (last accessed June 7, 2007) (as of Mar. 31, 2007, there were 26, 408 complaints).
66. Id. (384 referrals to the Department of Justice).
67. See NATIONAL COMMITTEE, supra note 13, Recommendation R-17.
68. Id. Recommendation R-15.
69. GOVERNMENT ACCOUNTABILITY OFFICE, supra note 11, at 14.