Health Data Management

[Gary Baldwin]

I’ve pasted in below excerpts from commentary that appeared in the Wall Street Journal recently from Dr. Deborah Peel, a psychiatrist who started Patient Privacy Rights. It generated a ton of discussion, as does any health-related topic these days.

Privacy advocates, no doubt, are a passionate bunch, and Dr. Peel raises many valid points. Yet, I am always intrigued by the disconnect between privacy laws and common human behavior. Many people love to talk about their health conditions, their ailments, their medications, and on and on and on. Granted, there are some health topics we attach stigma to, such as mental health problems and sexual performance. But health problems are one thing we all share in common, and if anything, seek out support groups from people who have faced similar issues.

I’m not dismissing privacy by any means, but compared say, to discussing their financial health, people are much more loose-lipped about health issues. To me, the compelling subject here is not who sees my lab scores, but what happens when they do. I think part of the fervor around the privacy topic is the fear that we will lose health coverage if “the wrong people” find out we have an expensive disease. The other fear is identity theft.

Granted, an electronic health record can be hacked into, and even distributed widely. But at least with the EHR, we can tell when the breach occurred, and who accessed the record on the hospital staff. With a paper chart, there’s no telling who looked, when, why, or under what circumstances. A local physician group here in Chicago learned about that the hard way last week. A janitor was charged with stealing information from 250 patient files, then using the information to charge some $300,000 worth of goods, the Chicago Tribune reported. Multiple arrests were reported.

Gary Baldwin

Your Medical Records Aren't Secure
By Deborah C. Peel

I learned about the lack of health privacy when I hung out my shingle as a psychiatrist. Patients asked if I could keep their records private if they paid for care themselves. They had lost jobs or reputations because what they said in the doctor's office didn't always stay in the doctor's office. That was 35 years ago, in the age of paper. In today's digital world the problem has only grown worse.

A patient's sensitive information should not be shared without his consent. But this is not the case now, as the country moves toward a system of electronic medical records. In 2002, under President George W. Bush, the right of a patient to control his most sensitive personal data—from prescriptions to DNA—was eliminated by federal regulators implementing the Health Insurance Portability and Accountability Act. Those privacy notices you sign in doctors' offices do not actually give you any control over your personal data; they merely describe how the data will be used and disclosed.

In a January 2009 speech, President Barack Obama said that his administration wants every American to have an electronic health record by 2014, and last year's stimulus bill allocated over $36 billion to build electronic record systems. Meanwhile, the Senate health-care bill just approved by the House of Representatives on Sunday requires certain kinds of research and reporting to be done using electronic health records. Electronic records, Mr. Obama said in his 2009 speech, "will cut waste, eliminate red tape and reduce the need to repeat expensive medical tests [and] save lives by reducing the deadly but preventable medical errors that pervade our health-care system."

But electronic medical records won't accomplish any of these goals if patients fear sharing information with doctors because they know it isn't private. When patients realize they can't control who sees their electronic health records, they will be far less likely to tell their doctors about drinking problems, feelings of depression, sexual problems, or exposure to sexually transmitted diseases. In 2005, a California Healthcare Foundation poll found that one in eight Americans avoided seeing a regular doctor, asked a doctor to alter a diagnosis, paid privately for a test, or avoided tests altogether due to privacy concerns.

Today our lab test results are disclosed to insurance companies before we even know the results. Prescriptions are data-mined by pharmacies, pharmaceutical technology vendors, hospitals and are sold to insurers, drug companies, employers and others willing to pay for the information to use in making decisions about you, your job or your treatments, or for research. Self-insured employers can access employees' entire health records, including medications. And in the past five years, according to the nonprofit Privacy Rights Clearinghouse, more than 45 million electronic health records were either lost, stolen by insiders (hospital or government-agency employees, health IT vendors, etc.), or hacked from outside.