The Privacy Symposium/HIPAA Summit Healthcare Privacy: The Perspective of a Privacy Advocate

1. The Privacy Symposium/HIPAA Summit Healthcare Privacy: The Perspective of a Privacy Advocate Tuesday, August 19, 2008 Deborah C. Peel, MD

2. “Anyone today who thinks the privacy issue has peaked is greatly mistaken…we are in the early stages of a sweeping change in attitudes that will fuel political battles and put once-routine business practices under the microscope.” Forrester Research an independent technology and market company that provides advice to global leaders in business and technology

3. Overview • What ‘privacy’ means and what consumers want • Consumer control over PHI is essential for trust in HIT • Harms from lack of privacy • Unintended consequences • Why HIPAA isn’t enough to protect privacy • How to ensure privacy

4. What does ‘privacy’ mean? • The Hippocratic Oath says “Whatsoever I shall see or hear of the lives of men or women which is not fitting to be spoken, I will keep inviolably secret.”

5. What does ‘privacy’ mean? • The Code of Fair Information Practices (1974) says “There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person's consent.”

6. What does ‘privacy’ mean? • The NCVHS (June 2006, Report to Sec. Leavitt) defined health information privacy as “an individual’s right to control the acquisition, uses, or disclosures of his or her identifiable health data”. (Definition originally from the IOM)

7. What does ‘privacy’ mean? Privacy means control over personal information. No control = no privacy HHS and Congress have no definition of privacy

8. 7 Million Americans Want Privacy The Coalition for Patient Privacy, 2008 AIDS Action Just Health American Association of People with DisabilitiesMultiracial Activist American Association of Practicing Psychiatrists Microsoft Corporation Inc. American Chiropractic Association National Center for Transgender Equality American Civil Liberties Union The National Center for Mental Health Prof. & Consumers American Conservative Union National Whistleblower Center American Psychoanalytic Association National Workrights Institute Association of American Physicians and Surgeons Natural Solutions Foundation Bazelon Center for Mental Health Law New Grady Coalition Bob Barr (former Congressman R-GA) Pain Relief Network Citizens for Health Patient Privacy Rights Foundation Citizen Outreach Project Privacy Activism Clinical Social Work Association Privacy Rights Now Coalition Consumer Action Private Citizen, Inc. Consumers for Health Care Choices Republican Liberty Caucus Cyber Privacy Project Student Health Integrity Project Doctors for Open Government TexPIRG Ethics in Government Group Thoughtful House Center for Autism Fairfax County Privacy Council Tolven, Inc. Family Research Council Tradition, Family, Property, Inc. Free Congress Foundation Universata, Inc. Georgians for Open Government U.S. Bill of Rights Foundation Gun Owners of America You Take Control, Inc. Health Administration Responsibility Project, Inc.

9. Privacy principles consumers wantCoalition for Patient Privacy • Recognize that patients have the right to health privacy • Recognize that user interfaces must be accessible so that health consumers with disabilities can individually manage their health records to ensure their health privacy. • The right to health privacy applies to all health information regardless of the source, the form it is in, or who handles it • Give patients the right to opt-in and opt-out of electronic systems • Give patients the right to segment sensitive information • Give patients control over who can access their electronic health records • Health information disclosed for one purpose may not be used for another purpose before informed consent has been obtained • Require audit trails of every disclosure of patient information

10. Require that patients be notified promptly of suspected or actual privacy breaches • Ensure that consumers can not be compelled to share health information to obtain employment, insurance, credit, or admission to schools, unless required by statute • Deny employers access to employees’ medical records before informed consent has been obtained • Preserve stronger privacy protections in state laws • No secret health databases. Consumers need a clean slate. Require all existing holders of health information to disclose if they hold a patient’s health information • Provide meaningful penalties and enforcement mechanisms for privacy violations detected by patients, advocates, and government regulators

11. Harms from lack of Privacy • HHS estimated that 586,000 Americans did not seek earlier cancer treatment due to privacy concerns. • HHS estimated that 2,000,000 Americans did not seek treatment for mental illness due to privacy concerns. • Millions of young Americans suffering from sexually transmitted diseases do not seek treatment due to privacy concerns. 65 Fed. Reg. at 82,777

12. Harms from lack of Privacy The California Health Care Foundation found that 1 in 8 Americans have put their health at risk because of privacy concerns: Avoid seeing their regular doctor Ask doctor to alter diagnosis Pay for a test out-of-pocket Avoid tests

13. Harms from lack of Privacy The Rand Corporation found that 150,000 soldiers suffering from PTSD do not seek treatment because of privacy concerns The lack of privacy contributes to the highest rate of suicide among active duty soldiers in 30 years “Invisible Wounds of War”, the RAND Corp., p. 436, (2008)

14. Without Privacy, Quality Suffers • The entire health delivery system is based upon the willingness of the individual to trust a health care practitioner sufficiently to disclose to the practitioner the most intimate details of his or her life. • An assurance of privacy of health information is necessary to secure effective, high quality health care. 65 Fed. Reg. at 82,467.

15. IOM Survey: People Won’t Trust Research Without Privacy by Dr. Alan F. Westin, October 2, 2007 Only 1% agreed that researchers would be free to use personal medical and health information without consent Only 19% agreed that personal medical and health information could be used as long as the study “never revealed my personal identity” and it was supervised by an Institutional Review Board.

16. “It’s pretty clear that the public is afraid of taking advantage of genetic testing,” said Dr. Francis S. Collins, director of the National Human Genome Research Institute at the National Institutes of Health. “If that continues, the future of medicine that we would all like to see happen stands the chance of being dead on arrival.”

17. Unintended consequences • Increases costs • Delayed treatment • Decreases quality • Suffering • Deaths • Can’t get needed research • People fear participation • Absent, limited, or erroneous data

18. Unintended consequences • Decreases competition • HIT vendors can’t compete by • offering individuals more control • and better privacy protections • No transparency • Without audit trails, we won’t • know where our data flows or how • many secret data bases exist with • our PHI

19. Unintended consequences • Job loss/ denial of promotions • People are judged on health information, not qualifications, abilities, or experience • Insurance discrimination • Credit denial • Denial of admission to schools • Unwanted marketing to consumers and physicians • New classes of citizens who are unemployable and uninsurable

20. Employers Discriminate 35% of Fortune 500 companies admit to using medical records for hiring and promotions 65 Fed.Reg. 82,467.(BEFORE the amended HIPAA Privacy Rule)

21. Why HIPAA is not enough to protect privacy

22. Elimination of Consent Congress passed HIPAA, but didnot pass a federal medical privacy statute, so the Dept. of Health and Human Services (HHS) was required to develop regulations that specified patients’ rights to health privacy. “… the Secretary of Health and Human Services shall submit to [Congress]…detailed recommendations on standards with respect to the privacy of individually identifiable health information.” 1996 “….a covered health care provider must obtain the individual’s consent, in accordance with this section, prior to using or disclosing protected health information to carry out treatment, payment, or health care operations.” President Bush implemented the HHS HIPAA “Privacy Rule” which recognized the “right of consent”. 2001 “The consent provisions…are replacedwith a new provision…that provides regulatory permission for covered entities to use and disclose protected health information for treatment, payment, healthcare operations.” HHS amended the HIPAA “Privacy Rule”, eliminating the “right of consent”. 2002

24. HIPAA ensures data mining Nex2, Inc. (Sold to United Healthcare in 2002) • In stealth-mode, Nex2 built what are arguably the largest, near-realtime drug history databases in the world, with over 200 million Americans’ five-year running drug histories online (over 12 TB total). The databases are updated every 24 hours by every retail pharmacy in America via the PBMs... [these] prescription profiles act as a powerful surrogate for the medical record itself. • All of this is HIPAA compliant because the insurance company always has the release, signed by the individual applicant. • United Healthcare's Ingenix unit now runs these massive virtual database operations, still in stealth-mode, for obvious reasons.

25. Businessweek July 23, 2008: “They Know What's in Your Medicine Cabinet, How insurance companies dig up applicants' prescriptions—and use them to deny coverage"http://www.businessweek.com/magazine/content/08_31/b4094000643943.htm?chan=magazine+channel_in+depth

26. Constitutionalrights to privacy

27. Our constitutional rights “In fact, the constitutionally protected right to privacy of highly personal information is so well established that no reasonable person could beunaware of it.”Sterling v. Borough of Minersville, 232 F.3d 190, 198 (3rd Cir. 2000). Federal courts have found consistently that the right to informational privacy, as distinct from the right to decisional privacy, is protected by the Fourteenth,Fifth and Fourth Amendments to the United States Constitution.Whalen v. Roe, 97 S. Ct. 869, 877 (1977); Ferguson v. City of Charleston, 121 S. Ct. 1281, 1288 (2001). “The reasonable expectation of privacy enjoyed by the typical patient undergoing diagnostic tests in a hospital is that the results of those tests will not be shared with non-medical personnel without her consent.”;U.S. v. Scott, 424 F.3d 888 (9th Cir. 2005); Douglas v. Dodds, 419 F.3d 1097 (10th Cir. 2005).

28. How to ensure privacy

29. Smart solutions ‘Smart’ legislation ‘Smart’ technology Health trusts or banks Independent consent management tools State-of-the art security ‘Smart’ certification

30. Trusted Certification PrivacyRightsCertified, Inc. Consumer-led organization offering a Good Housekeeping Privacy Seal-of-Approval for HIT systems and products that ensure consumer control of PHI Privacy Rights Certified will ensure Americans UNDERSTAND PHRs and EHRs, CHOOSE wisely, and take steps to PROTECT their most intimate information.

31. Restoring consent Is radical. Privacy is radical. Consent is a burden. Consent is too costly. Taking personal information without consent is radical. Restoring consent is conservative. Eliminating privacy is radical. Taking information was never legal before HIPAA. Contacting millions electronically is automatic, easy, instantaneous. and cheap. Privacy Myths

32. Relying on consent leads to ‘blanket’ consents. Consent is an obstacle for HIE. Privacy is an obstacle for HIE. Electronic consents make ‘blanket’ consents obsolete. Information can be segregated at the data item level. Consent actually enables information sharing. Genetic, sexual, and mental health information cannot be shared without consent. Privacy Myths

33. Privacy is not realistic. “Data stewardship” protects privacy. We can build an HIT system without privacy. Microsoft, Tolven, Universata, Y-T-C and other vendors have built consent into their systems. “Data Stewards” can use information without notice or consent, and will not be trusted. “The entire health delivery system is based upon the willingness of the individual to trust a health care practitioner sufficiently to disclose to the practitioner the most intimate details of his or her life.” (HHS) Privacy Myths

34. We need to ‘balance’ privacy against the common good. ALL health records must be available to get good care. Personal health information is a valuable asset, like money. You would never agree to “balance” the rights of those who want to steal money from your bank account with your right to control your own money. Patient reaction: if it’s for my own good why do you have to take it from me? Taking my information without consent tells me its not for my own good—its for your good. Privacy Myths

36. Progress with PrivacyPatient Privacy Rights www.patientprivacyrights.org Deborah C. Peel, MD Founder and Chair dpeelmd@patientprivacyrights.org Ashley Katz, MSW Executive Director akatz@patientprivacyrights.org 512.732.0033 (office) www.patientprivacyrights.org

37. ADDENDAEthical rights, legal privileges, and common law Health IT- inadequate security and privacy

38. Ethical rights to privacy, legal privileges, common law

39. Ethics protect health privacy “Privacy and confidentiality [of health information] are neither new concepts, nor absolutes. Since the time of Hippocrates physicians have pledged to maintain the secrecy of information they learn about their patients, disclosing information only with the authorization or the patient or when necessary to protect an overriding public interest, such as public health. Comparable provisions are now contained in the codes of ethics of virtually all health professionals.” Report to HHS, NCVHS (June 22, 2006) The ethical codes of all the health professions require informed consent before use or disclosures of personal health information.

40. Research ethics protect privacy • World Medical Association Declaration of Helsinki June 1964 • Ethical Principles for Medical Research Involving Human Subjects • A. INTRODUCTION • 5. In medical research on human subjects, considerations related tothe well- being of the human subject should take precedence over the needs and interests of society. • B. BASIC PRINCIPLES FOR ALL MEDICAL RESEARCH • 10. It is the duty of the physician in medical research to protect the life, health, • privacy, and dignity of the human subject. • 21. The right of research subjects to safeguard their integrity must always be respected. Every precaution should be taken to respect the privacy of the subject, the confidentiality of the patients information, and to minimize the impact of the study on the subject’s physical and mental integrity and on the personality of the subject.

41. Legal Privileges • A physician-patient privilege is recognized in the laws of 43 states and the District of Columbia. • The State of Health Privacy, Health Privacy Project (2000) • A psychotherapist-patient privilege is recognized in the laws of all 50 states and the District of Columbia. • Jaffee v. Redmond, 116 S. Ct. 1923, 1929 (1996)

42. Common Law • All 50 states and the District of Columbia recognize in tort law a common law or statutory right to privacy of personal information. • HHS finding 65 Fed. Reg. at 82,464 • Ten states have a right to privacy expressly recognized in their state constitutions.

43. Health IT: inadequate privacy and security

44. EHRs and PHRs: No privacy, weak security, secondary uses No privacy • Over 4 million providers can access protected health information (PHI) for treatment, payment, and healthcare operations (TPO) Weak security • Easy to hack from the outside • No role-based access, i.e., no consumer access controls (hacking from the inside) Secondary uses • The business model for many EHRs and PHRs is selling data for secondary use and data mining No trusted seal-of-approval for privacy and security (yet)

45. EMR vendor to share patient data with genetics research firm Healthcare IT News, 3/20/2008 by Richard Pizzi “Perlegen Sciences, Inc., a company exploring the clinical application of genetic research, plans to collaborate with an undisclosed electronic medical records vendor to identify and develop genetic markers that predict how patients are likely to respond to specific medical treatments. Under the terms of the agreement, Perlegen, based in Mountain View, Calif. , will have exclusive access to the EMR vendor's database of U.S. records for the purpose of assessing and selecting patients from whom appropriate genetic samples could be collected.”

46. Practice Fusion expands, shows signs of rapid growth Practice Fusion subsidizes its free EMRs by selling de-identified datato insurance groups, clinical researchers and pharmaceutical companies. Howard said he does not expect data-sharing will be a concern to physicians who use Practice Fusion's EMRs. “Every healthcare vendor is selling data.”

48. Personal health information is for sale

49. Medicare and Medicaid data is for sale

50. In August, 2006, a large insurer, with plans in all 50 states, announced the creation of a new business unit to aggregate and sell the claims and health records of 79 million enrollees: The Medical Director said that the intended use of the database is to “service the big employers that pay the bills and want to pay smaller bills for health insurance.” He was “very enthralled about the ability to help multi-state employers fix their healthcare costs.” During the one and one-half years that the plan had been building the database, he had “never heard about privacy concerns.”