Congress sits on hands as health privacy wanes

By David Pittman | Politico.com | 6/12/14 5:00 AM EDT

Everyone from legal scholars to patient privacy advocates — and even the White House — are saying the country’s landmark health privacy law is antiquated and needs to be updated.

But Congress doesn’t appear to be moving any legislation on the issue.

Backers of tougher health data privacy rules argue that much has changed in how people’s health information is collected and handled since the law governing patient records was passed in 1996. Protections added in 2009 don’t fully address the problem, they say.

The Health Insurance Portability and Accountability Act — commonly called HIPAA — largely applies to use of data by health care providers and insurance companies. But they are a smaller and smaller slice of who deals with patient information today.

For example, employee wellness programs, which are increasingly popular and hold potentially private information such as pregnancy status, don’t fall under the HIPAA umbrella. Hospital discharge data is sold by 33 states, according to the Federal Trade Commission, but only three do so in a HIPAA-compliant fashion.

“I think HIPAA does a really good job where it’s relevant,” said Kirk Nahra, a privacy and information security lawyer at Wiley Rein. “What’s happened in the last 15 years is that the space where it’s not relevant has been what’s growing.”

HIPAA governs the doctor-patient and doctor-payer relationships, but it didn’t envision the rest of the universe, and that’s where there is a need for new privacy protections, Nahra said.

Health and fitness apps — of which there are nearly 100,000 available today — are probably the biggest concern. They fall outside HIPAA and are free to collect and share information on their users.

The Privacy Rights Clearinghouse concluded last year that mobile health and fitness apps “are not particularly safe” when it comes to protecting user privacy. They found 26 percent of the free apps and 40 percent of paid apps didn’t have a privacy policy. Furthermore, 39 percent of free apps and 30 percent of paid apps sent data to a third party not disclosed by the developer.

The FTC mapped where data was being sent from 14 free health and fitness apps. One transmitted data to 18 different third parties with diet, workout, personal identifiers and other information. Fourteen third parties received consumers’ names and email addresses, and 22 received gender, location and symptom-search information.

The free use of consumer information by app makers is one reason privacy advocates are concerned that Apple is entering the game. The tech giant announced last week it would make its HealthKit part of its iOS 8 operating system, set to be released later this year.

The FTC sees all of this as a problem and is looking to Congress for help.

In a recent report on data brokers, the commission recommended Congress consider legislation to force tech companies to obtain express consent from consumers before information is collected or shared.

A White House report on big data and privacy last month noted that current policy “may not be well-suited” in the future. While health data exchanges will help realize technology’s potential, the information often is shared “in ways that might not accord with consumer expectations of the privacy of their medical data.”

“Health care leaders have voiced the need for a broader trust framework to grant all health information, regardless of its source, some level of privacy protection,” the report said.

Despite the pleas for new rules on use of consumer health information, Congress appears to be sitting on its hands. Little legislation exists, and the issue has yet to gain traction.

“The only thing that is likely to get congressional interest is for there to be a major data tragedy,” said Nicolas Terry, health law professor at Indiana University law school. “It’s very hard at the moment to see much consensus out there. Everyone says they believe in privacy. Privacy is very important. Privacy is a right. But actually moving the ball forward to protect consumers, given the massive weight of the information lobby, seems very hard.”

Congress has been working on data security and breach notification issues — especially in light of recent high-profile cases involving Target and others — with a decent chance of passing something by the end of the year.

Privacy is another issue. “There’s no consensus on broader privacy issues,” Nahra said.

Lawmakers on Capitol Hill have taken some steps to improve consumer privacy protections since HIPAA was passed. Seeing the dawn of the advent of electronic medical records, they included several provisions in the 2009 HITECH Act, including a ban on the sale of personal health information, breach notification requirements and penalties for privacy violators.

One possible source of inaction is the seemingly immovable lobbying force. Companies such as Microsoft, Google, Siemens, the Mayo Clinic, WebMD, IMS Health and IBM all spent money lobbying Congress last year on health privacy issues, according to disclosure forms.

Even Nike — maker of the popular fitness app Nike+ that’s implanted on all iPhones — disclosed lobbying on privacy issues in 2013.

Terry said consumers could incite change if they demanded it. Automobile makers lobbied hard against safety regulations in the 1960s and 1970s, but car safety is ubiquitous today because of pressure from car buyers, he said.

The FTC has the authority to halt companies’ deceptive practices if they fail to disclose certain data uses to consumers, notes Justin Brookman, director of consumer privacy at the Center for Democracy & Technology, which advocates stronger protections.

As long as the FTC and Congress remain inactive, and consumers remain passive, it’s up to Washington power brokers to point out HIPAA’s inadequacies.

“I do believe it’s time that we look beyond [HIPAA],” Karen DeSalvo, national coordinator for health IT, said at the recent Health Privacy Summit. “As this field rapidly evolves, we need to think about what additional protections might need to be in place.”

To view online:
https://www.politicopro.com/go/?id=35019

 

 

WPF Report — Paying out of Pocket to Protect Health Privacy: A New but Complicated HIPAA Option; A Report on the HIPAA Right to Restrict Disclosure

San Diego & Washington, D.C. — The World Privacy Forum published a new report today that helps patients understand and use the new HIPAA right to restrict disclosure of their medical information to health plans when treatment is paid for out of pocket in full. The report contains practical advice and tips for patients about how to navigate the new right, which went into effect last year. Paying Out of Pocket to Protect Health Privacy: A New But complicated HIPAA Option; A Report on the HIPAA Right to Restrict Disclosure is one of the first reports on this topic written for patients.

“The new HIPAA right that lets patients restrict disclosures of their health information is actually not well known yet, and that needs to change,” said Pam Dixon, Executive Director of the World Privacy Forum. “This report has specific, concrete tips and information that will help patients use this important new right.” The report, written by Bob Gellman and Pam Dixon is available free of charge at www.worldprivacyforum.org.

Key points:

  • A patient has the right to prevent a health care provider from reporting information to a health insurer if the patient pays in full.
  • In order to prevent disclosure of information to a health plan, patients must make a Request to Restrict Disclosure.
  • Under the new changes to HIPAA, a patient has the firm right to demand, not just request, that a provider not disclose PHI to a health plan when certain conditions are met.
  • The conditions to be met can be complex, and work best with some advance planning.

Additional tips are in the report.

The bipartisan Coalition for Patient Privacy worked to get this key consumer protection into HITECH.

Bob Gellman and Pam Dixon are available to discuss tips and advice for patients on how to use the new HIPAA right.

Links:

The report Paying Out of Pocket to Protect Health Privacy: A New But complicated HIPAA Option; A Report on the HIPAA Right to Restrict Disclosure is available in PDF or in text.

Permalink: http://www.worldprivacyforum.org/2014/01/wpf-report-paying-out-of-pocket-to-protect-health-privacy/

Contact:

Bob Gellman 202-543-7023

Pam Dixon 760-712-4281

info@worldprivacyforum.org

Will Texans Own Their DNA?

Will Texans Own Their DNA?

Greg Abbott, candidate for Governor, thinks they should

 

On November 12th, Abbott released his “We the People Plan” for Texas. Clearly he’s heard from Texans who want tough new health data privacy protections.

 

Topping his list are four terrific privacy recommendations for health and genetic data:

  • “Recognize a property right in one’s own DNA.”
  • “Make state agencies, before selling database information, acquire the consent of any individual whose data is to be released.”
  • “Prohibit data resale and anonymous purchasing by third parties.”
  • “Prohibit the use of cross referencing techniques to identify individuals whose data is used as a larger set of information in an online data base.”

 

The Omnibus Privacy Rule operationalized the technology section of the stimulus bill. It also clarified that states can pass data privacy laws that are stronger than HIPAA (which is a very weak floor for data protections).

 

Texans would overwhelmingly support the new state data protection laws Abbott recommends . If elected, hopefully Abbott would also include strong penalties for violations. Contracts don’t enforce themselves. External auditing and proof of trustworthy practices should be required.

 

Is this the beginning of a national trend?  I think so.

 

The more the public learns about today’s health IT systems, the more they will reject health surveillance technologies that steal and sell sensitive personal health data.

The Reports of the Death of Privacy Were Exaggerated: California Breathes New Life into the Privacy Rights of its Residents

Vast NSA troves of phone and email data and the huge focus on HealthCare.gov’s website provoked intense public concern about hidden uses and sales of personal data…..especially personal health data.

But there is great news from California:  tough new laws to protect data privacy were enacted in September.  See: “The Reports of the Death of Privacy Were Exaggerated: California Breathes New Life into the Privacy Rights of its Residents”, Tuesday, November 19, 2013, by Sharon R. Klein and Odia Kagan

States like CA and TX (HB 300) passed new laws because state residents are demanding stronger data privacy protections, and Congress and federal agencies have failed to act.

Key new data privacy protections in CA:

“Business(es) offering software or hardware to consumers… designed to maintain medical information or to assist in the diagnosis and treatment of individuals” must:

Press your state lawmakers to pass strong new data protection laws like California’s.  People want technology that protects privacy. They won’t trust companies and government that eliminate privacy and use personal data without consent.

Court of Appeals hearing case on potential Privacy Rights Suit

New York’s Highest Court is hearing arguments Tuesday on whether or not a patient can sue a Steuben County Clinic for a violation of his privacy rights.

To view the full article, please visit Court of Appeals hearing case on potential Privacy Rights Suit.

A Fraying of the Public/Private Surveillance Partnership

To view the full article, please visit: A Fraying of the Public/Private Surveillance Partnership

The lack of data security and privacy on the ‘HealthCare.gov’ triggered national outrage.For the first time patient privacy is a national issue.

Healthcare.gov’s serious technology flaws sparked huge privacy fears even though ONLY one piece of health data is collected, “Do you smoke?”.

The public now fears that the US government and the health IT industry don’t protect sensitive personal health data. Rightly so. See:

 

But current US health IT systems also enable hidden armies of corporations and government agencies to use sensitive personal health data without patient consent.

If our health data was actually private, how could it be sold on the Internet? Three short videos:

 

We have no map of all the hidden flows of our health data. See examples mapping the hidden flows of US health data:

o   states sell health data: http://thedatamap.org/states.html

o   top buyers of health data: http://thedatamap.org/buyers.html

o   data breaches reveal who purchased health data: http://thedatamap.org/history.html

o   health data is easy to re-identify: http://thedatamap.org/risks.html

The consequences of the lack of patient privacy (control over personal health data) are millions people act to keep health data private:

  • Today 40-50 million people/year act to try to keep health data private:

o   37.5 million people every year hide information to try to keep it private

§  November, 2005. National Consumer Health Privacy Survey, California Healthcare Foundation:http://www.chcf.org/publications/2005/11/national-consumer-health-privacy-survey-2005

o   Over 5 million every year avoid or delay early diagnosis for cancer, mental illness, or sexually-transmitted diseases

§  65 Fed. Reg. at 82,779, 65 Fed. Reg. at 82,777, 65 Fed. Reg. at 82,778

§  Or see page 7: http://patientprivacyrights.org/wp-content/uploads/2010/08/The-Case-for-Informed-Consent.pdf

Technology can ensure all the benefits and prevent harms. The idea that we must surrender privacy forever to ‘wire’ the healthcare system is false.

Technology should “do no harm” to patients. The cure is to use tough privacy-enhancing technologies.

Healthcare.gov sends user information to third parties, violating its own privacy policy

You might be interested in this story “Healthcare.gov sends user information to third parties, violating its own privacy policy.” 

The site sends user information to third parties like Pingdom and DoubleClick that are hidden data collectors.  Here you can find a screenshot in which Ghostery is used to show 7 hidden trackers: Healthcare.gov trackers

 

Prescription drug database bill stalls in Pa. House

To view the full article, please visit: Prescription drug database bill stalls in Pa. House

“A bill that would create a prescription drug database intended to help law enforcement nab doctor-shoppers and pill mills hit a hurdle Wednesday in the state House.”

Medical Info for Sale Online

In this article the News4 I-Team discovered how anyone with internet access and who is willing to pay just a few hundred dollars can easily have access to and purchase private medical records online.  This contributes to between “one and two million Americans being affected by medical identity theft each year”.

Read more in this article here and learn where stolen medical information goes, who is selling the information, and where they are getting it from in the first place.  Are YOU at risk?

 

Patient privacy evangelist, analytics officer spar over data rights

To view the full article, please visit: Patient privacy evangelist, analytics officer spar over data rights

“…At the HIMSS Media/Healthcare IT News Privacy and Security Forum in Boston, patient privacy advocate Deborah Peel, MD, of Patient Privacy Rights, and UPMC Insurance Services Division Chief AnalyticsOfficer Pamela Peele took the stage to debate the highly-contested issue of whether patients should have full consent over how and with whom their personal health information records are shared.”

Key quotes from Dr. Peel:

“Forty to 50 million people a year do one of three things: avoid or delay diagnosis for critical conditions like cancer, depression and sexually transmitted diseases, or they hide information,” said Peel. “There’s the economic impact of having a system that people don’t trust.”

“He found that only a whopping 1 percent of the public would ever agree to unfettered research use of their data. Even with de-identified data, only 19 percent would agree to the use of their data for research without consent,” said Peel. “On the other hand, when people are asked if they want to participate or have their data used with consent, the public is very altruistic, so we get something very different fuller information, more complete information when the public knows what you’re doing with it and they support the project.”