Privacy Group Comments on ONC’s Patient Data Matching Report

December 23, 2013 – “At an Office of the National Coordinator for Health IT meeting last week, advocacy group Patient Privacy Rights said that initial findings from an ONC report on how to match patients with their health data addressed problems with current health IT systems and data exchanges but missed an opportunity to create and leverage patient engagement in controlling their own health data, Health Data Management reports (Goedert, Health Data Management, 12/20).”

To view PPR’s comments and a copy of the full article, please visit: Privacy Group Comments on ONC’s Patient Data Matching Report

Brokers Trade on Sensitive Medical Data with Little Oversight, Senate Says

“Marketers maintain databases that purport to track and sell the names of people who have diabetes, depression, and osteoporosis, as well as how often women visit a gynecologist, according to a Senate report published Wednesday.

The companies are part of a multibillion-dollar industry of “data brokers” that lives largely under the radar, the report says. The report by the Senate Commerce Committee says individuals don’t have a right to know what types of data the companies collect, how people are placed in categories, or who buys the information.

The report came in advance of a committee hearing on industry practices Wednesday afternoon.

The report doesn’t contain any new evidence of wrongdoing by the industry, but it underscores the tremendous increase in the sale and availability of consumer information in the digital age. An industry which began in the 1970s collecting data from public records to help marketers send direct mail has become an engine of a global $120 billion digital-advertising industry, helping marketers deliver increasingly targeted ads across the web and on mobile phones.”

To view the full article please visit: Brokers Trade on Sensitive Medical Data with Little Oversight, Senate Says

The Truth About HIPAA – It Hasn’t Changed

Everyone thinks HIPAA protects personal health data. It doesn’t.

The most valuable data collected and sold by US “data brokers” is sensitive personal health information.

US “data brokers” capture sensitive health information by tracking our searches, social media, phone apps and GPS data. The majority of US healthcare institutions, health-related state and federal government agencies, and health technology vendors are also “data brokers”.

HIPAA gave millions of hidden institutions, healthcare providers, and technology vendors the right to control, use, and sell our medical records, prescriptions, lab tests, claims data, and more. HIPAA gave them the right to be “data brokers”.

If the President’s Consumer Privacy Bill of Rights (CPBOR) was the law of the land AND also was applied to the healthcare system, patients could control who collects and uses health data—not “data brokers”.

The CPBOR’s strong new rights to control the use of personal data could end the use of data for discrimination in every area of life, including  jobs, credit, mortgages, and opportunities.

The EU got it right:  no government agency or corporation in the EU can collect, use, or sell personal data without permission.

deb

This blog was written in response to the following article: Senators call for consumer privacy protections

 

Testimony of Deborah C. Peel, MD at the ONC’s Patient Matching Stakeholder Meeting

WASHINGTON, DC (December 16, 2013) – Patient Privacy Rights’ (PPR) founder and chair, Deborah C. Peel, MD, submitted written testimony to the U.S. Department of Health and Human Services’ Office of the National Coordinator (ONC) at today’s Patient Matching Stakeholder Meeting. The meeting discussed the initial findings from the ONC’s dedicated initiative to assess which aspects of patient identification matching are working well, where there are gaps, and where improvements are needed.

 

In her prepared testimony, Dr. Peel said that “the Initial Findings address the problems caused by current institutional health information technology (health IT) systems and data exchanges.” However, she also stated that the findings may not adequately address future needs, nor do they foresee how the meaningful use requirements for the Health Information Technology for Clinical Health (HITECH) Act can resolve many of the current problems with patient identity and patient matching.

 

Arguing that the findings present a tremendous opportunity to create and leverage genuine patient engagement, Dr. Peel said that “patients have more interest and stake in data integrity and safety than any other stakeholder.” Describing PPR’s vision of the future, Dr. Peel outlined how meaningful patient engagement will eliminate many of the complex problems caused by current patient identity systems, matching technologies, and algorithms. She also said that meaningful patient engagement means that patients can access, control, or delegate how their personal information is used and disclosed, as well as monitor all exchanges of their health data in real time.

 

Additionally, Dr. Peel discussed key elements for meaningful patient engagement based on Fair Information Practices (FIPs) and federal law. She said that all data holders and all health data aggregators should operate as HIPAA covered entities and should be known to patients. In order to provide accountability and transparency, she said that each data aggregator should provide Notice of Privacy Practices (NPPs), voluntary patient-controlled IDs, patient and physician portals, Direct Secure email between patients and physicians Blue Button Plus (BB+), and real time accounting of disclosures.

 

In her concluding remarks, Dr. Peel stated that polices and best practices should consider how future health IT systems and data exchanges will operate, and should “anticipate meaningful patient and physician engagement, lowering costs, improving data quality, integrity and patient safety.” She urged the ONC to require, promote, and incentivize the rapid adoption of technologies that meaningfully engage patients as described in her testimony.
The complete text of this testimony is here.

Can Big Data Make Healthcare Better, Cheaper?

December 12, 2013
Medical records are being digitized on a massive scale to bring down the costs of healthcare and, maybe, to produce better outcomes. It also means a loss of patient privacy. President Obama’s Affordable Care Act promotes the digitization of millions of medical records to measure outcomes and contain costs. Big Data may also help doctors better understand many diseases, who’s most likely to get them and what the best treatments might be. It also makes the most intimate kind of personal information available to the government, insurance and drug companies — even prospective employers. Should patients be able to say “yes” or “no?”

 

Host, Warren Olney of NPR affiliate KCRW, interviews Dr. Deborah Peel, to discuss the risks and the benefits of Big Data in the field of medicine. She is joined by fellow panelists Joel Dudley, Department of Genetics and Genomic Sciences, Mt. Sinai Medical School, Iya Khalil, Executive VP and Co-Founder, GNS Healthcare, and Nortin Hadler, Professor of Medicine and Microbiology/Immunology, University of North Carolina at Chapel Hill.
Subscribe to this Podcast:
PodcastiTunes Podcast
Listen to/Watch entire show:
ListenDownloadAdd to My Shows

ACP Supports Creating National Rx Drug Monitoring Database

Wednesday, December 11, 2013
 
The American College of Physicians supports the development of a national prescription drug monitoring program, which would create a single database that physicians and pharmacies could electronically review before prescribing controlled substances, according to a position paper, CBS News reports. The paper was published in the Annals of Internal Medicine on Monday (Jaslow, CBS News, 12/9).

 

A new national drug data base will extend the failed “War on Drugs”, criminalize millions more, increase patients’ reluctance to use controlled substances, and NOT improve treatment for addiction. US prescriptions are already collected and sold daily by prescription data aggregators like IMS Health, Merck Medco, SureScripts, etc., etc. These businesses all sell the nation’s prescription data to any willing buyers.Meanwhile neither physicians nor patients can get electronic copies of prescription data to improve care.Who should health technology benefit? Patients or corporations?

Why not use patients’ prescription data, already being collected by the hidden data aggregation industry, to improve patient health?

Why not use technology to strengthen the patient-physician relationship and to ensure effective diagnosis and treatment?

For example, here is one way technology could be re-designed to help patients:

Anytime a patient gets a controlled substance prescription, existing systems could automatically search for any prior controlled substance prescriptions the patient received in the last month. If a second or third prescription is found, the physician(s) and patient could be automatically notified and resolve together whether it should be filled or not—and how best to treat the patient’s symptoms

Technology should give patients and doctors they data they need for effective TREATMENT. It’s sad that such a prominent physician group supports giving law enforcement automatic access to every controlled substance prescription in the US. Law enforcement should only be able to access such sensitive patient data AFTER someone has committed a crime or with a judge’s approval.

Why open ALL prescriptions to law enforcement surveillance when the vast majority of patients taking controlled substances are not criminals?

Addiction is NOT a crime, it’s a very treatable medical illness.

deb

 

Can we at least try not to kill 440,000 patients per year?

Check out the latest from Doc Searls, courtesy of Doc Searls Weblog.

Obamacare matters. But the debate about it also misdirects attention away from massive collateral damage to patients. How massive? Dig To Make Hospitals Less Deadly, a Dose of Data, by Tina Rosenberg in The New York Times. She writes,

Until very recently, health care experts believed that preventable hospital error caused some 98,000 deaths a year in the United States — a figure based on 1984 data. But a new report from the Journal of Patient Safety using updated data holds such error responsible for many more deaths — probably around some 440,000 per year. That’s one-sixth of all deaths nationally, making preventable hospital error the third leading cause of death in the United States. And 10 to 20 times that many people suffer nonlethal but serious harm as a result of hospital mistakes.

The bold-facing is mine. In 2003, one of those statistics was my mother. I too came close in 2008, though the mistake in that case wasn’t a hospital’s, but rather a consequence of incompatibility between different silo’d systems for viewing MRIs, and an ill-informed rush into a diagnostic procedure that proved unnecessary and caused pancreatitis (which happens in 5% of those performed — I happened to be that one in twenty). That event, my doctors told me, increased my long-term risk of pancreatic cancer.

Risk is the game we’re playing here: the weighing of costs and benefits, based on available information. Thus health care is primarily the risk-weighing business we call insurance. For generations, the primary customers of health care — the ones who pay for the services — have been insurance companies. Their business is selling bets on outcomes to us, to our employers, or both. They play that game, to a large extent, by knowing more than we do. Asymmetrical knowledge R them.

Now think about the data involved. Insurance companies live in a world of data. That world is getting bigger and bigger. And yet, McKinsey tells us, it’s not big enough. In The big-data revolution in US health care: Accelerating value and innovation (subtitle: Big data could transform the health-care sector, but the industry must undergo fundamental changes before stakeholders can capture its full value), McKinsey writes,

Fiscal concerns, perhaps more than any other factor, are driving the demand for big-data applications. After more than 20 years of steady increases, health-care expenses now represent 17.6 percent of GDP—nearly $600 billion more than the expected benchmark for a nation of the United States’s size and wealth.1 To discourage overutilization, many payors have shifted from fee-for-service compensation, which rewards physicians for treatment volume, to risk-sharing arrangements that prioritize outcomes. Under the new schemes, when treatments deliver the desired results, provider compensation may be less than before. Payors are also entering similar agreements with pharmaceutical companies and basing reimbursement on a drug’s ability to improve patient health. In this new environment, health-care stakeholders have greater incentives to compile and exchange information.

While health-care costs may be paramount in big data’s rise, clinical trends also play a role. Physicians have traditionally used their judgment when making treatment decisions, but in the last few years there has been a move toward evidence-based medicine, which involves systematically reviewing clinical data and making treatment decisions based on the best available information. Aggregating individual data sets into big-data algorithms often provides the most robust evidence, since nuances in subpopulations (such as the presence of patients with gluten allergies) may be so rare that they are not readily apparent in small samples.

Although the health-care industry has lagged behind sectors like retail and banking in the use of big data—partly because of concerns about patient confidentiality—it could soon catch up. First movers in the data sphere are already achieving positive results, which is prompting other stakeholders to take action, lest they be left behind. These developments are encouraging, but they also raise an important question: is the health-care industry prepared to capture big data’s full potential, or are there roadblocks that will hamper its use

The word “patient” appears nowhere in that long passage. The word “stakeholder” appears twice, plus eight more times in the whole piece. Still, McKinsey brooks some respect for the patient, though more as a metric zone than as a holder of a stake in outcomes:

Health-care stakeholders are well versed in capturing value and have developed many levers to assist with this goal. But traditional tools do not always take complete advantage of the insights that big data can provide. Unit-price discounts, for instance, are based primarily on contracting and negotiating leverage. And like most other well-established health-care value levers, they focus solely on reducing costs rather than improving patient outcomes. Although these tools will continue to play an important role, stakeholders will only benefit from big data if they take a more holistic, patient-centered approach to value, one that focuses equally on health-care spending and treatment outcomes.

McKinsey’s customers are not you and me. They are business executives, many of which work in health care. As players in their game, we have zero influence. As voters in the democracy game, however, we have a bit more. That’s one reason we elected Barack Obama.

So, viewed from the level at which it plays out, the debate over health care, at least in the U.S., is between those who believe in addressing problems with business (especially the big kind) and those who believe in addressing problems with policy (especially the big kind, such as Obamacare).

Big business has been winning, mostly. This is why Obamacare turned out to be a set of policy tweaks on a business that was already highly regulated, mostly by captive lawmakers and regulators.

Meanwhile we have this irony to contemplate: while dying of bad data at a rate rivaling war and plague, our physical bodies are being doubled into digital ones. It is now possible to know one’s entire genome, including clear markers of risks such as cancer and dementia. That’s in addition to being able to know one’s quantified self (QS), plus one’s health care history.

Yet all of that data is scattered and silo’d. This is why it is hard to integrate all our available QS data, and nearly impossible to integrate all our health care history. After I left the Harvard University Health Services (HUHS) system in 2010, my doctor at the time (Richard Donohue, MD, whom I recommend highly) obtained and handed over to me the entirety of my records from HUHS. It’s not data, however. It’s a pile of paper, as thick as the Manhattan phone book. Its utility to other doctors verges on nil. Such is the nature of the bizarre information asymmetry (and burial) in the current system.

On top of that, our health care system incentivizes us to conceal our history, especially if any of that history puts us in a higher risk category, sure to pay more in health insurance premiums.

But what happens when we solve these problems, and our digital selves become fully knowable — by both our selves and our health care providers? What happens to the risk calculation business we have today, which rationalizes more than 400,000 snuffed souls per annum as collateral damage? Do we go to single-payer then, for the simple reason that the best risk calculations are based on the nation’s entire population?

I don’t know.

I do know the current system doesn’t want to go there, on either the business or the policy side. But it will. Inevitably.

At the end of whatever day this is, our physical selves will know our data selves better than any system built to hoard and manage our personal data for their interests more than for ours. When that happens the current system will break, and another one will take its place.

How many more of us will die needlessly in the meantime? And does knowing (or guessing at) that number make any difference? It hasn’t so far.

But that shouldn’t stop us. Hats off to leadership in the direction of actually solving these problems, starting with Adrian Gropper, ePatient Dave, Patient Privacy RightsBrian Behlendorf, Esther Dyson, John Wilbanks, Tom Munnecke and countless other good people and organizations who have been pushing this rock up a hill for a long time, and aren’t about to stop. (Send Doc more names or add comments directly to this blog here.)

Courtesy of Doc Searls Weblog

What Makes 23andMe “Terrifying”?

In a recent “warning letter” to 23andMe, the FDA informed the genetic testing company that they are marketing their Saliva Collection Kit and Personal Genome Service (PGS) to the public without the proper marketing clearance or approval from the FDA. The FDA then went on to say that 23andMe needs to discontinue marketing the PSG kit until the company has received FDA approval to do so. The Genomics Law Report outlines some background and details of the cease and desist letter in two posts, here and here. If you’re interested in more of the legalities and potential implications of the FDA v. 23andMe battle, the posts are a great read.

However, what really resonated with PPR was this Scientific American article by Charles Seife, also prompted by the recent FDA/23andMe kerfuffle: 23andMe is Terrifying, But Not for the Reasons the FDA Thinks. Seife also touches on the regulatory issue with the FDA, but really captures what we see to be the bigger problem with 23andMe with this:

But as the FDA frets about the accuracy of 23andMe’s tests, it is missing their true function, and consequently the agency has no clue about the real dangers they pose. The Personal Genome Service isn’t primarily intended to be a medical device. It is a mechanism meant to be a front end for a massive information-gathering operation against an unwitting public.

As Seife also reports, the company wants to become the “Google of personalized health care.” Well, yikes.

For now, 23andMe says they won’t sell your information without your explicit consent, but we’ve seen enough policies and rules change over time (e.g., Google’s constantly changing policies, HIPAA and the elimination of consent, etc.) to know that “guarantee” isn’t written in stone. Sure, it’s possible that the company wants to use the data it collects for research that proves beneficial to the public, but…it doesn’t seem like a huge leap to say that 23andMe isn’t gathering all that data for altruistic purposes.

Ultimately, as Seife says, the real issue here is what 23andMe (and any other company or organization that collects personal health information) should be allowed to do with the data it collects. There are a number of privacy problems that must be considered when answering that question, which Seife also outlines quite well in the article. Of course, the debate over how we can best manage privacy concerns vs. public benefit and other interests is complex and varied. But at the very least, PPR believes you should be in charge of how your personal information is used. And, you should be able to see who all has access to it, when someone has accessed it, and why.

 
Side Note: As always, we want to point out that we’re not trying to stand in the way of the very cool things happening with research and technology. In fact, we are very excited about the possibilities offered by advancements in these fields. We like you, research and technology, we really like you. But we like research and technology that does what the public expects and truly protects your privacy; that doesn’t allow your personal information to be used or shared in hidden ways; that allows you to be in charge and aware of what’s happening with your personal information at all times; that you can trust to honor your wishes regarding how your sensitive health information is used.

Canadian Woman Denied Entry To U.S. Because Of Her Medical History

This story deeply troubles me as a practicing psychiatrist and Freudian psychoanalyst. It’s appalling to see technology used in ways that increase the harms and stigma people with mental illness and addiction endure.
 
 
The story is about a disabled Canadian woman denied the right to travel by a U.S. Customs and Border Protection agent because of her history of hospitalization for Depression.
 
Quotes from the story about the agent who denied her US entry for the cruise:
  •   He cited the U.S. Immigration and Nationality Act, Section 212, which denies entry to people who have had a physical or mental disorder that may pose a “threat to the property, safety or welfare’’ of themselves or others.
  •    The agent gave her a signed document which stated that “system checks’’ had found she “had a medical episode in June 2012’’ and that because of the “mental illness episode’’ she would need a medical evaluation before being accepted.
How did the US obtain electronic health data on Canadian citizens?
How frequently is the US Government accessing the electronic health records of Canadians?
How frequently is the US Government (and state governments) accessing our electronic health records?
 
Partial answers come from a CBC News story with information from Wikileaks. Quotes:
  • According to an RCMP (Royal Canadian Mounted Police) website, the CPIC (Canadian Police Information Centre) database stores 9.6 million records in its investigative databanks.
  • The RCMP and U.S. law enforcement agencies provide reciprocal direct access to each other’s criminal databases in order to stem the flow of narcotics and criminal dealings into North America, according to the WikiLeaks cable.
  • When asked about the sharing of police information for security purposes, Kamenitz says the government is “obviously not considering what the impact of that can be and how much that can alter a person’s life.”
 
How does the US use electronic health information on American citizensor people with histories of treatment for mental illness or hospitalization?  
 
This is ominous because of the proliferation of federal laws requiring that state data bases of involuntary commitments for hospitalization be reported to the National Instant Criminal Background Check System (NICS) to prevent violent mentally ill people from buying gunsand the proliferation of state Prescription Drug Monitoring Programs (PDMs) for controlled substances. 
  • (FYI—-Currently US patients are denied their federal rights to have a list of who used their electronic health records and why—the war over the regulations to implement this critical consumer protection is intense. Industry has held this up for almost 5 years claiming its too hard, too expensive, no technology exists, it will burden and scare patients to see how many 1000s of access there are every day, etc, etc.)
There is a huge state and national push to build/use data bases about mental illness or addiction for many purposes. 

 

It’s the same phenomena we saw in 2009 when the technology industry got $29B in subsidies for health IT written into the stimulus bill—despite the absence of interest or support of the majority of patients and physicians. See story by Robert O’Harrow on “The Machinery Behind Healthcare Reform”: http://www.washingtonpost.com/wp-dyn/content/article/2009/05/15/AR2009051503667.html 
Every family and every person is close to someone suffering from Depression, addiction, or another mental illnesses. The lack of privacy already drives over 2 million people a year away from treatment for Depression and major mental illness.
 
This is truly a national tragedy. Knowing the US government accesses the nation’s electronic health records will discourage even more people from seeking treatment for serious mental illnesses that are VERY treatable.  
 
Best,
Deborah

Texas Election 2014: Abbott Pledges to Safeguard DNA

“Texas gubernatorial frontrunner Greg Abbott recently released an extensive list of items he says he’ll push for once elected.. Ths list includes gun rights, campaign ethics, and blocking implementation of the Affordable Care Act, but the number one item is safeguarding your DNA according to KUT News.”

To view the full article, please visit: Texas Election 2014: Abbott Pledges to Safeguard DNA