Patient Privacy Rights Presses HHS for Greater Safeguards and Transparency to Protect Patient Data

Last Thursday, September 12, PPR sent a letter to U.S. Health and Human Services (HHS) Secretary Kathleen Sebelius, urging the immediate implementation of tough new patient privacy protections for digital health records.  With privacy now leading the the list of major issues troubling the public in the digital age, PPR believes meaningful and comprehensive data privacy protections are critical components when it comes to restoring patient trust.

In the letter, PPR recommends that HHS:

  • Allocate 1% of HIE (Health Information Exchange) funding to ensure all patients can choose an “HIE of One” a program that directs all personal data disclosures, which are visible to the patient without restriction or delay.
  • Mandate portals for patients and physicians and require the use of voluntary patient email addresses be used for Record Locator Services (RLS). With these technologies, every state can easily and inexpensively offer an “HIE of One” to those who want to decide who may use their data.
  • Require health IT systems to build technology so patients can segment their data for privacy, research, and any other disclosures – allowing patients to decide whether any sensitive data may be used.
  • Provide funding to build and maintain a complete health data map, a service that allows patients to see and understand data flows across the nation and throughout the world. As present, Americans have no “chain of custody” for personal health data and no way to know who is collecting and using health data.

Read the full letter here.

Read the press release here.

Experts tout Blue Button as enabling information exchange between medical provider and patient

Blue Button Plus (BB+) and direct secure email technologies could put patients in control of all use and disclosure of their electronic health records. BB+ lets us ‘view, download, and transmit’ our own health data to physicians, researchers, or anyone we choose.

But state Health Information Exchanges (HIEs) don’t allow patients to control the disclosure of personal health data. Some state HIEs don’t even ask consent; the HIE collects and shares everyone’s health records and no one can opt-out. Most state HIEs ask patients to grant thousands of strangers—employees of hospitals, doctors, pharmacies, labs, data clearinghouses, and health insurers—complete access to their electronic health records.

When corporations, government, and HIEs prevent patients from controlling who sees personal health data– from prescriptions, to DNA, to diagnoses– millions of people every year avoid or delay treatment, or hide information.

HIEs that open the door to even more hidden uses of health data will drive even more patients to avoid treatment, rather than share information that won’t be private.

Health IT systems that harm millions/year must be fixed. Technology can put us in control of our data, achieve the benefits and innovations we expect, and prevent harms.  We have to change US law to require technologies that put patients in control of their electronic health records.

Sign the Petition for Patient-Controlled Exchange of Health Information

Sign the petition asking Congress to put you in control of exchanging your sensitive health data via Health Data Exchanges (HIEs)!

Sign the petition here.

By the end of the year, every state must have one or more Health Information Exchange (HIEs) so your health data can be transferred to other doctors, the state, the federal government, insurers, technology companies, researchers, commercial users, and many other institutions.

Today those institutions and organizations decide when and to whom to transfer your health data—not you.

KEY PRINCIPLES FOR DATA EXCHANGE USING HIEs:

• You should control whether or not your health information is exchanged.

• You should have full access to electronic copies of all your health information.

• You should know what information the HIE exchanges, stores or collects, with whom your data is shared, and the purpose for using it.

View and sign the petition asking Congress to strengthen the law so Americans can trust electronic health systems and data exchanges.

Putting Health IT on the Path to Success

“The promise of health information technology (HIT) is comprehensive electronic patient records when and where needed, leading to improved quality of care at reduced cost. However, physician experience and other available evidence suggest that this promise is largely unfulfilled.

Comprehensive records require more than having every physician and hospital use an electronic health record (EHR) system. There must also be an effective, efficient, and trustworthy mechanism for health information exchange (HIE) to aggregate each patient’s scattered records into a complete whole when needed. This mechanism must also be accurate and reliable, protect patient privacy, and ensure that medical record access is transparent and accountable to patients.”

*Subscription needed to see full article.

CommonWell Is a Shame and a Missed Opportunity

This is a story about how major data holders are moving to consolidate THEIR control over the collection and use of our personal health information.

Instead of building electronic health systems that enable us to decide who can see and use our health data, we are locked out and have no way to know who is using our data or what it’s used for.

-Deborah Peel

From The Health Care Blog article: CommonWell Is a Shame and a Missed Opportunity

“The big news at HIMSS13 was the unveiling of CommonWell (Cerner, McKesson, Allscripts, athenahealth, Greenway and RelayHealth) to “get the ball rolling” on data exchange across disparate technologies. The shame is that another program with opaque governance by the largest incumbents in health IT is being passed off as progress. The missed opportunity is to answer the call for patient engagement and the frustrations of physicians with EHRs and reverse the institutional control over the physician-patient relationship. Physicians take an oath to put their patient’s interest above all others while in reality we are manipulated to participate in massive amounts of unwarranted care.

There’s a link between healthcare costs and health IT. The past months have seen frustration with this manipulation by industry hit the public media like never before. Early this year, National Coordinator for Health Information Technology Farzad Mostashari, MD, called for “moral and right” action on the part of some EHR vendors, particularly when it comes to data lock-in and pricing transparency. On February 19, a front page article in the New York Times exposed the tactics of some of the founding members of CommonWell in grabbing much of the $19 Billion of health IT incentives while consolidating the industry and locking out startups and innovators. That same week, Time magazine’s cover story is a special report on health care costs and analyzes how the US wastes $750 Billion a year and what that means to patients. To round things out, the March issue of Health Affairs, published a survey showing that “the average physician would lose $43,743 over five years” as a result of EHR adoption while the financial benefits go to the vendors and the larger institutions…”

Patient Privacy Rights Calls for Patient Control Over Data Exchange on the Nationwide Health Information Network (NwHIN)

In our comments about the NwHIN, Patient Privacy Rights (PPR) urged the Office of the National Coordinator for Health IT (ONC) to use this critical opportunity to address the fatal privacy and security flaws in current systems and state and federal data exchanges. “Multi-stakeholder” public-private governance at the state and federal level has failed to gain public trust.  Public-private governance assures that industry, research, and government interests trump the public’s rights to health information privacy.

To restore public trust, PPR strongly believes:

  • All state and federal data exchanges should be certified to assure that patients control the exchange of their health data. Privacy certification should be designed by a non-profit, patient-led organization with expertise in health privacy;
  • Data should only be exchanged using the Direct Project for secure email between patients, physicians, and other health professionals (with rare exceptions);
  • Patients should always give meaningful informed consent before their information is disclosed; and
  • Sensitive personal health information should only flow to those directly involved in an individual’s treatment, or to those who are conducting research in which an individual has agreed to participate.

Without a network designed to make sure individuals decide who sees their health records, Americans will grow even more wary of seeking needed treatment. We urge the ONC to act now to create a nationwide network that requires comprehensive data privacy and security measures to protect patients’ intimate personal health data. See comments here.

PPR at RSI 2012 Conference in Montreal

Deborah C. Peel, Founder and Chair of PPR, will present at the upcoming RSI 2012 conference in Montreal, discussing the health care system in the United States related to HIT and Data Exchanges.

When: May 3rd, 2012, 1:30pm – 2:20pm
Where: Hyatt Regency Montréal , 1255, rue Jeanne-Mance, Montreal (Québec)·mai 3, 2012

Title: Not even a Fig Leaf for Privacy: American’s Health IT Systems and Data Exchanges

Complexity, legacy architectures divorced from privacy rights, a powerful health data mining industry, government interest in health data, and $27 billion in federal funding have created a health IT environment based on open access to 300 million people’s most sensitive  personal information and the elimination of individual privacy rights. Patient Privacy Rights’ role is to be the voice of the public, to educate decision makers, and to create a movement to build innovative health IT systems worthy of trust.

Baby’s death spotlights safety risks linked to computerized systems

Check out this very relavant story from the Chicago Tribune Health section, “Baby’s death spotlights safety risks linked to computerized systems,” written by Judith Graham and Cynthia Dizikes.

As a topic discussed a lot in Session 3.2 of the Health Privacy Summit, “Control of patient information – Health Information Exchanges,” this subject is the tip of the iceberg on the many risks of electronic health records that must be addressed as billions of stimulus dollars go into creating a health IT infrastructure.

Baby’s death spotlights safety risks linked to computerized systems, Chicago Tribune, by Judith Graham and Cynthia Dizikes, June 27, 2011

Re: They’ve got an app for that

In response to Modern Healthcare’s article: They’ve got an app for that

On Feb 15th and 16th , the President’s Council on Science and Technology (PCAST) report was discussed in DC by the national HIT Policy PCAST Worgroup. A key PCAST recommendation was that data be meta-tagged for many uses—one key use is so patients can add tags that say: “do not disclose this sensitive data unless I say so”. Patient Privacy Rights and the Coalition for Patient Privacy have LONG argued that all health IT systems and data exchanges MUST restore patient control over the most sensitive personal information that exists: electronic health data.

We are glad to see privacy-enhancing technologies being demonstrated and used in the nation’s largest electronic health system: the military health system covering 9 million lives.

This story shows how the VA is actually ALREADY using data meta-tags so patients can control who sees what health data—see the video that goes along with the story below at: http://www.modernhealthcare.com/article/20110224/VIDEO/302249949/-1

PPR Comments on the PCAST HIT Report

The President’s Council of Advisors on Science and Technology (PCAST) weighed in on the key problems with how the Administration is building health IT systems and data exchanges. They recommend that patients be able to meta-tag data to protect privacy, that interoperability requires adoption of a common “language”, and that the goal should be a “data-centric” system for research on all health records without consent. The report recommends that HHS and CMS decide when patient data can be used for “secondary” purposes without consent.

See the full PCAST report: http://www.whitehouse.gov/blog/2010/12/08/pcast-releases-health-it-report

Patient Privacy Rights letter of comments to HHS emphasized:

  • Privacy is essential to build in up front.
  • We should not rush to deploy systems and spend billions on electronic systems and data exchanges until we know the privacy technologies PCAST recommends are adequate.
  • The recommendations for de-identifying health data were insufficient. Extensive work needs to be done to ensure that standards for de-identification actually work.

See PPR’s full comments here: http://patientprivacyrights.org/wp-content/uploads/2011/01/PCAST-comments-PPR-Final.pdf

See PPR’s written testimony here: http://patientprivacyrights.org/wp-content/uploads/2011/05/Patient-Privacy-Rights-Testimony-PCAST-WG-Feb-15-2011.pdf