What's Your Story Idea? April 6, 2009, 3:43PM EST

Putting Patient Privacy in Peril?

New legislation urging doctors and hospitals to keep electronic, rather than paper, health records may not go far enough in shielding sensitive information

Related Items

The idea for "Putting Patient Privacy in Peril?" came from BusinessWeek.com reader WP, a pseudonym for a U.S. federal government employee who wishes to remain anonymous.

Story Tools

More than 1,000 people, many of them celebrities, have had their health records inappropriately viewed by hospital employees at UCLA medical facilities since 2003, according to legal complaints against the center and published reports. In one case, a worker received payments from the National Enquirer in exchange for information. In many cases, hospital employees simply wanted to satisfy their curiosity about the conditions of such people as Britney Spears, Maria Shriver, and Farrah Fawcett. Soon, it may not be just public figures who need to worry about the privacy of electronic medical records.

The recent stimulus bill gives financial incentives to doctors and hospitals to digitize medical records for every American by 2014. "Our recovery plan will invest in electronic health records and new technology that will reduce errors, bring down costs, ensure privacy, and save lives," President Barack Obama told members of Congress on Feb. 24. Privacy and civil liberties advocates already are expressing concern that privacy provisions in the legislation don't go far enough to protect records from prying eyes, whether they belong to nosy hospital workers, health insurance companies, a potential employer, or even the U.S. government.

Drafters of the stimulus law took steps to broaden existing privacy regulations, such as by requiring health plans to notify individuals if there is a breach of unsecured protected health information. The stimulus law also expands some penalties for those who break the rules. Yet it fails to make changes to an existing rule that allows for the disclosure of private health information without an individual's consent when it is shared with health-related organizations for the purposes of treatment, payment, or other health-care operations.

Info Is Shared and Sold

That's cause for concern, says Sue Blevins, founder and president of the Institute for Health Freedom, a nonpartisan, nonprofit, Washington-based think tank. "We've been consistently calling for patient consent before information is shared because that is the only way to gain privacy," Blevins says. There are 600,000 health-related organizations that could potentially see this information, which could include genetic data, she contends. Under the new law, individuals can ask a doctor or hospital not to share their information with health plans, but consumers can only exercise this right if they pay out of pocket in full, a condition most people don't meet. The law also is silent on whether individuals can opt out of computerized records altogether, the Institute for Health Freedom says.

Privacy advocates also want to ensure the legislation goes far enough in protecting patients against the sale of their personal information. Currently, pharmacies are able to sell detailed records of patient medications to clearing houses, which then sell that information to interested parties such as insurance companies. "They create profiles on individuals and sell that information to insurance companies for underwriting purposes," says Ashley Katz, executive director of Patient Privacy Rights, a nonprofit based in Austin, Tex. Insurance companies, in turn, have denied coverage to individuals seeking private insurance based on this data.

As written, the stimulus legislation allows for records to be sold for public health and research purposes. "On the surface, the exception for public health and research sounds reasonable, but all those things are incredibly broadly defined and you have the potential for a huge loophole with any exception," Katz says.

Some are also concerned about the government's access to patient records. Today, certain government agencies don't need patient consent in order to view medical records. The Secretary of the Health and Human Services Dept. legally has access to every citizen's health records, including psychotherapy notes, according to Blevins.