Written in response to the following article:
Written in response to the following article:
Proposal to Ease Limits on Disclosure Has Privacy Groups Concerned
Melinda Beck | June 4, 2014 8:12 p.m. ET
Federal officials are proposing to ease 40-year-old restrictions on the release of information about patients’ drug- and alcohol-abuse treatment, so their electronic medical records can be more easily used and shared.
Federal law has long protected substance-abuse-treatment records from being disclosed to anyone without a patient’s explicit consent, so that fear of stigma or discrimination wouldn’t deter those in need from seeking help. If a patient agrees to share substance-abuse records with, say, a doctor or hospital, those records can’t be sent anywhere else unless the patient consents again.
Officials at the Substance Abuse and Mental Health Services Administration, known as SAMHSA, say those rules didn’t envision today’s highly integrated health-care systems that rely on the broad sharing of patients’ detailed electronic medical records to coordinate care. The Obama administration is paying doctors and hospitals $36 billion in incentives to move to such systems, which proponents say can reduce medical errors and duplication and cut costs.
But privacy advocates are concerned that one of the nation’s toughest confidentiality rules could be weakened, and they worry that the wider information is shared in the health-care system, the greater the risk of public disclosure. “If we lose this, people will stop getting treatment,” says psychiatrist Deborah Peel, founder of the nonprofit Patient Privacy Rights Foundation.
Despite anti-discrimination laws, many people in treatment still fear that exposure of their drug or alcohol problems could jeopardize their careers or their ability to get life insurance or retain child custody, addiction and legal experts say.
To view the full article, please visit Drug Treatment Swept Up in Push for Medical-Records Sharing
By Marianne Kolbasuk McGee | healthcareinfosecurity.com
May 29, 2014
The Federal Trade Commission is urging Congress to enact privacy legislation that would provide consumers with more transparency about the activities of data brokers that collect sensitive health and financial data.
Reacting to the FTC recommendation, two consumer advocates say the explosion of data broker activities in recent years, coupled with regulatory gaps, point to the need for some legislative reforms to protect consumer privacy.
A May 27 FTC report that examined nine companies describes data brokers as “companies whose primary business is collecting personal information about consumers from a variety of sources and aggregating, analyzing and sharing that information, or information derived from it, for purposes such as marketing products, verifying an individual’s identity, or detecting fraud.”
The FTC says data brokers raise privacy concerns for consumers because “significantly, data brokers typically collect, maintain, manipulate and share a wide variety of information about consumers without interacting directly with them.”
The report notes: “In light of these findings, the commission unanimously renews its call for Congress to consider enacting legislation that would enable consumers to learn of the existence and activities of data brokers and provide consumers with reasonable access to information about them held by these entities.”
Deborah Peel, M.D., founder of advocacy group Patient Privacy Rights, says federal legislators and regulators need to crack down on data brokers, especially those that deal with sensitive information, such as health data.
“This is clearly a case where the government must pass laws that require personal control over personally identifiable information to restore our rights to privacy, because we can’t possibly do it ourselves,” Peel says. “Worse, the FTC seems not to have a handle on the size of the health data broker industry. … “Personal information is the ‘oil’ of the digital age – and our personal information belongs to each of us. … If the data brokers want our data, they should just ask. If we think the benefits are worth it, we will say ‘yes’.”
To view the full article, please visit FTC Calls for Data Broker Transparency
Patients need and want to use secure, encrypted email to communicate with health professionals. Why should the government be able to look at our email without a warrant?
The 1986 Electronic Communications Privacy Act (ECPA) must be updated to stop the government from reading our email without approval from a judge.
From the letter to President Obama signed by 81 groups, including Patient Privacy Rights, that asked him to champion fixing the ECPA:
“A warrant based on the probable cause standard is required for searches of U.S. mail, searches of a home, or even electronic communications that are not stored with companies like Google or Yahoo.” The same protections are just as important for email between doctors and patients!
Support for “email privacy” is bipartisan, see: #ECPAReform http://bit.ly/1rAW7MY
URL for POLITICO article: http://www.politico.com/morningtech/0414/morningtech13755.html
POLITICO Morning Tech: FIRST LOOK: TECH GROUPS PRESS AGAIN ON ECPA REFORM — A gaggle of tech advocacy and industry groups are again imploring the White House to put their weight behind email privacy reform, and this time making clear that any loopholes for civil agencies would be a nonstarter. The groups, led chiefly by the Digital 4th and Digital Due Process coalitions, have been ramping up their ECPA reform push in the hopes of convincing Washington to tackle an issue that they see as low-hanging fruit. In a letter to President Obama today, they want the White House to know that they won’t support any warrant requirement carve-out for federal agencies like the Securities and Exchange Commission. “Seemingly, the only major impediment to passage is an objection by administrative agencies like the Securities and Exchange Commission, which would like to gut the legislation as a way to expand their investigative authorities,” write the groups, which include TechNet, Reddit, the Electronic Frontier Foundation and the ACLU. “Such an agency carve out would be a major blow to reform efforts, allowing increased government access to our communications during the many civil investigations conducted by federal and state agencies.” Full letter here: http://bit.ly/1kfKrfX
The UK government has been debating illegal disclosures of patient health data: “The issue of which organisations have acquired medical records has been at the centre of political debate in the past few weeks, following reports that actuaries, pharmaceutical firms, government departments and private health providers had either attempted or obtained patient data.”
The article closes with quotes from Phil Booth of medConfidential:
Far worse privacy violations are the norm in the US, yet our government won’t acknowledge that US health IT systems enable hidden sales and sharing of patients’ health data. US patients are prevented from controlling who sees their health records and can’t obtain real-time lists of who has seen and used personal health data.
Learn how the data broker industry violates Americans’ strong rights to control the use of personal health information in IMS Health Holdings’ SEC filing for an IPO:
Data brokers claim they don’t violate our rights to health information privacy because our data are “de-identified” or “anonymized”—-but computer scientists have proven it’s easy to re-identify aggregated, longitudinal data sets:
This blog was written in response to the following article: NHS England patient data ‘uploaded to Google servers’, Tory MP says
When will US bar sale of patient data for commercial use?
1st: Public has to wake up.
2nd: The LIE of sale of patient data for research must be exposed.
US law permits any corporation to buy/sell/sell/share patient data for commerce (i.e. BIG DATA analytics and proprietary products without patient consent or knowledge). This is a fact.
This blog was written in response to the following article: NHS legally barred from selling patient data for commercial use
When hospitals find themselves in the middle of a breach, they usually prioritize improving their security to prevent further security breach incidents.
In addition to defending themselves against data breaches, health systems also need to find the right balance to adequately protect their patients’ privacy.
Since medical information is stored digitally, patients may not be fully aware how crucial it is to protect their data from being seen by unauthorized persons. Some privacy breaches may be avoidable, and learning from these mistakes is essential for health systems to maintain security of sensitive patient information. Here are three reasons why patient security may be lacking at health organizations.
Privacy Is on the Back Burner
When health IT systems are built, ensuring patient privacy is usually not on the forefront of designers’ and engineers’ minds. These IT experts usually put system functions ahead of privacy, which could result in poor privacy protection down the road. Some developers may also leave out privacy features altogether, which could put patient information at risk for being compromised.
In a recent report, psychiatric facilities in Texas suffered a string of data breaches, but the majority of them were caused by human error, The Republic reported.
Deborah Peel, the Austin founder of watchdog group Patient Privacy Rights, said repeated data breach incidents could lead patients to question whether their information is secure, which could cultivate distrust among patients. “Our patients deserve privacy and expect that their information is kept confidential,” said Christine Mann, spokeswoman for the Texas Department of State Health Services.
To view the full article please visit: 3 Reasons Your Medical Records Are at Risk
US citizens have a fundamental Constitutional right to health information privacy—but can’t easily sue. Only federal employees can sue under the Privacy Act of 1974, as vets did when a laptop with millions of health records was stolen. Even with strong state health privacy laws and state constitutional rights to privacy in place, it’s very hard to sue because most courts demand proof of monetary harm. This new digital disaster: exposing and/or selling sensitive personal health data–can’t be stopped without stronger, clearer federal laws. OR if US citizens boycott the corporations that violate their rights to health privacy.
This blog written in response to the following article:
Did Tim Armstrong’s ‘Distressed Babies’ Comment Violate HIPAA Privacy Laws?
By Abby Ohlheiser
The Wire, February 10, 2014
Deborah Peel, MD, Founder and Chair of Patient Privacy Rights
The federal government released an update to the CLIA rule this week that will require all labs to send test results directly to patients. But the regulations fail to achieve the stated intent to help patients. The rule allows labs to delay patient access to test results up to 30 days, and the process for directly obtaining personal test results from labs is not automated.
The new rule also fails to help patients in significant ways:
This rule raises a question: why do so many federal rules for improving the healthcare system fail to require technologies that benefit patients?
Technology could provide enormous benefits to patients, but the US government caters to the healthcare and technology industries, instead of protecting patients.
Current US health IT systems actually facilitate the exploitation of patients’ records via technology. When HHS eliminated patient control over personal health data from HIPAA in 2002, it created a massive hidden US data broker industry that sells, shares , aggregates and discloses longitudinal patient profiles (for an example, see IMS’ SEC filing with details about selling 400M longitudinal patient profiles to 5K clients, including the U.S. government.
Meanwhile, even the most mundane, annoying, repetitive tasks patients must perform today–like filling out new paper forms with personal information every time we visit a doctor–are not automated for our convenience or to improve data quality and accuracy.
Shouldn’t IT improve patients’ experiences, treatment, and restore personal control over sensitive health information?
You can also view a copy of this blog post here