A Fraying of the Public/Private Surveillance Partnership

To view the full article, please visit: A Fraying of the Public/Private Surveillance Partnership

The lack of data security and privacy on the ‘HealthCare.gov’ triggered national outrage.For the first time patient privacy is a national issue.

Healthcare.gov’s serious technology flaws sparked huge privacy fears even though ONLY one piece of health data is collected, “Do you smoke?”.

The public now fears that the US government and the health IT industry don’t protect sensitive personal health data. Rightly so. See:

 

But current US health IT systems also enable hidden armies of corporations and government agencies to use sensitive personal health data without patient consent.

If our health data was actually private, how could it be sold on the Internet? Three short videos:

 

We have no map of all the hidden flows of our health data. See examples mapping the hidden flows of US health data:

o   states sell health data: http://thedatamap.org/states.html

o   top buyers of health data: http://thedatamap.org/buyers.html

o   data breaches reveal who purchased health data: http://thedatamap.org/history.html

o   health data is easy to re-identify: http://thedatamap.org/risks.html

The consequences of the lack of patient privacy (control over personal health data) are millions people act to keep health data private:

  • Today 40-50 million people/year act to try to keep health data private:

o   37.5 million people every year hide information to try to keep it private

§  November, 2005. National Consumer Health Privacy Survey, California Healthcare Foundation:http://www.chcf.org/publications/2005/11/national-consumer-health-privacy-survey-2005

o   Over 5 million every year avoid or delay early diagnosis for cancer, mental illness, or sexually-transmitted diseases

§  65 Fed. Reg. at 82,779, 65 Fed. Reg. at 82,777, 65 Fed. Reg. at 82,778

§  Or see page 7: http://patientprivacyrights.org/wp-content/uploads/2010/08/The-Case-for-Informed-Consent.pdf

Technology can ensure all the benefits and prevent harms. The idea that we must surrender privacy forever to ‘wire’ the healthcare system is false.

Technology should “do no harm” to patients. The cure is to use tough privacy-enhancing technologies.

How Medical Identity Theft Can Give You a Decade of Headaches

See the full article at How Medical Identity Theft Can Give You a Decade of Headaches.

This article tells us a cautionary tale about how Arnold Salinas had his identity stolen by someone who took out medical care in his name. Now, any time he gets medical treatment, he has to be extremely careful that his records are actually his own or face the possibility that he will get the WRONG treatment.

“Medical identity theft affected an estimated 1.5 million people in the U.S. at a cost of $41.3 billion last year, according to the Ponemon Institute, a research center focused on privacy and data security. The crime has grown as health care costs have swelled and job cuts have left people without employer-subsidized insurance. Making matters worse: The complexity of the medical system has made it difficult for victims to clear their name.”

It is so important that patients control and are kept abreast of their medical records, but the current system does not make this easy. According to the article, medical identity theft cases are some of the most difficult to solve and can take years. What makes it so difficult is that “‘…you have to go provider by provider, hospital by hospital, office by office and correct each record,” said Sam Imandoust, a legal analyst with the Identity Theft Resource Center. ‘The frustrating part is while you’re going through and trying to clean up the records, the identity thief can continue to go around and get medical services in the victim’s name. Really there’s no way to effectively shut it down.’” Another problem is even finding out your identity has been stolen. According to Pam Dixon, founder of World Privacy Forum, “the fractured nature of the health care system makes medical identity theft hard to detect. Victims often don’t find out until two years after the crime, and cases can commonly stretch out a decade or longer”. Banks and other institutions are used to dealing with identity theft, but the medical industry isn’t equipped to handle this kind of infringement.

Health Care Reform: Let’s Not Forget Privacy And Data Security

See the full article at Forbes.com: Health Care Reform: Let’s Not Forget Privacy And Data Security

The Affordable Care Act poses many new threats to patient privacy due to an already over loaded health care system. The influx of new consumers in this market will cause much stress on the already insufficient data privacy infrastructure. Bob Gregg, guest writer for Forbes.com, explains the strains and consequences caused by this new legislation.

“The Supreme Court’s decision to uphold the Affordable Care Act could guarantee health insurance coverage for the majority of the 50 million Americans who are now uninsured. While laudable in theory, this legislation doesn’t account for the strain these millions of new patients will have on an already overburdened healthcare ecosystem, especially when it comes to patient privacy and data security.”

Mr. Gregg looked to Patient Privacy Rights’ own founder, Dr. Deborah Peel, to explain what kind of ramifications this act will have for patients and their data privacy.

“My friend, Dr. Deborah Peel, founder of Patient Privacy Rights, tells me that “patients have no control over who sees or sells personal health information. Our health data is held in hundreds or thousands of places we have never heard of because of hidden data flows.” Thousands of people, including researchers and government agencies, she says, have easy access to this information.”

The article goes on to list the four major issues this new burden on the health care system will cause and how it will affect consumers. The bottom line, he says, is “…The Affordable Care Act is designed to make healthcare available to the masses. But that availability comes at a price. Healthcare providers will have to shift tight budgets toward patient care and away from protecting patient privacy, leaving Americans vulnerable to the increasing frequency and cost of data breaches, medical identity theft, and fraud. Combine that with the HITECH Act, federal legislation that pushes healthcare providers into adopting EHR systems, and you have a perfect storm for unintended consequences surrounding patient privacy and data security.”

For even more information on how you can help keep patient data private visit our International Summit on the Future of Health Privacy website.

PPR Founder Interviewed – America in the Balance

03/14/2012: U.S. citizens are concerned about “ObamaCare”- style health care reform and the escalating loss of personal health information and privacy rights. Today’s guest is Dr. Deborah C. Peel, founder of Patient Privacy Rights. PPR was started in 2004 to speak and advocate for the patient’s right to health privacy. Peel has been chosen one of Modern Healthcare’s “100 Most Influential in Healthcare” 4 times in the last 5 years, and is the leading voice for patient control over the use of sensitive health information. Join us as we discuss HIPPA, mHealth, and the upcoming 2nd Annual International Summit on the Future of Health Privacy to be held in June 2012 in D.C.

You can listen to the article by following this link and scrolling down to the 3/14/12 show.

Re: Pres. Obama appoints Todd Park nation’s CTO

The new US Chief Technical Officer (CTO) was chosen for using “innovative technologies to modernize government, reduce waste and make government information more accessible to the public.”

What role does the CTO have in protecting individuals from technology harms? Whose role is it to protect the public from damaging technologies and “big data”?

Technology could enable break-through health research and improve the quality of healthcare. But we won’t have complete and accurate health data needed for transformative research when millions don’t trust electronic health systems. The 35-40% of the public who are “health privacy intense” realize US law doesn’t adequately protect their rights to health privacy.

The full article by Bernie Monegain in Healthcare IT News: President Obama appoints Todd Park Nation’s CTO

Re: Sizing Up the Family Gene Pool

In response to the New York Times article: Sizing Up the Family Gene Pool

This story is about the fact that genetic testing companies sell people’s test results, compromising families’ and descendants’ future jobs and opportunities. “The NYTimes Ethicist” confirmed a questioner’s fears:

“As for the privacy issue, your concern is well founded. Many of these companies do use customers’ data for medical research or commercial applications, or they sell it to third parties whose interests you might never know. Legally they can’t do that without your consent, but the fine print on those consent forms goes by so quickly that it can be hard to follow.”

Americans’ lack of control over sensitive personal health information in electronic systems is a true national disaster. Not everyone knows this yet, but President Obama does.

On Feb 22, the he introduced historic new privacy principles to guide the use of personal data in the global digital economy. He recognized the lack of privacy in current networked technologies and systems has severe economic consequences. See story on the White House Initiative: http://patientprivacyrights.org/2012/02/wh-initiative-consumer-privacy-bill-of-rights/

President Obama’s new principles address the causes of the privacy violation in the story:

  • Current federal law does not protect the right to health information privacy or the right of consent to use health data
  • neither HIPAA nor Genetic Information Non-Discrimination Act (GINA) prevent the systemic corporate business practice of selling Americans’ highly sensitive personal health information (like genetic test results)

He laid out an historic, tough new Consumer Privacy Bill of Rights to stop the data mining and data theft industries. The first principle is that of individual control: “Consumers have a right to exercise control over what personal data companies collect from them and how they use it.”

Key quotes from the Administration’s new “Framework for Protecting Privacy and Promoting Innovation in the Global Digital Economy”:

  • “Strong consumer data privacy protections are essential to maintaining consumers’ trust in the tech­nologies and companies that drive the digital economy.”
  • The President concluded, “It [privacy] has been at the heart of our democracy from its inception, and we need it now more than ever.”

The only way we can trust the Internet and have a vibrant global digital economy is if individuals control personal information online and in electronic systems. The right of informed consent before personal information is collected or used must be restored.

When will the health IT industry, Congress, and lawmakers across the US act to restore the right to privacy and control over personal information?

WH Initiative: Consumer Privacy Bill Of Rights

In a press release from the White House, February 22nd, 2012:

“The Obama Administration unveiled a “Consumer Privacy Bill of Rights” as part of a comprehensive blueprint to protect individual privacy rights and give users more control over how their information is handled. This initiative seeks to protect all Americans from having their information misused by giving users new legal and technical tools to safeguard their privacy. The blueprint will guide efforts to protect privacy and assure continued innovation in the Internet economy by providing flexible implementation mechanisms to ensure privacy rules keep up with ever-changing technologies. As a world leader in the Internet marketplace, the Administration believes the United States has a special responsibility to develop privacy practices that meet global standards and establish effective online consumer protection. ”

To read more about the proposed bill here are some additional resources:

Read Fact Sheet

Read Full Proposal

Additional White House Press Release

View the Press Conference on CNN’s Video Library

PPR Makes the List: 100 Most Influential People in Healthcare

Each year Modern Healthcare Magazine encourages the public to nominate and vote for the top “100 Most Influential People in Healthcare.” This year we are happy to announce that Dr. Peel is back on the list at #52. You can see the full list here.

She and Patient Privacy Rights are also highlighted in this article in Modern Healthcare: “Under their influence, Washington insiders hold sway over our ’100 Most Influential’ ranking, but real change seems to be coming from elsewhere.” Subscription is required to read the entire story, however one of four sections on the list of 100 addresses privacy, and highlights Patient Privacy Rights and Dr. Deborah Peel as leaders in this area.

Dr. Peel first appeared on the list in 2007 as #4 of the “100 Most Powerful People in Healthcare” for her work to make sure patients control access to their electronic medical records, and continued to be the only privacy advocate on the list in 2008 and 2009. She was nominated but did not make the final list in 2010. Her recognition this year shows that people are aware of privacy being a major issue in health care and that they are starting to realize we still do not have control over who sees our health records.

The road to electronic health records is lined with data thieves

The following is a guest post by Reuters contributor Constance Gustke. The opinions expressed are her own. See the full article at http://blogs.reuters.com/reuters-money/2011/08/05/the-road-to-electronic-health-records-is-lined-with-data-thieves/

“The future of your personal health information involves gigantic Internet-driven databases that connect you to doctors, health information and services no matter where you are and what time it is.

With a big push from President Obama, who wants secure electronic health records for every American by 2014, many health insurance companies, hospitals, private practices and pharmacies are already delivering some patient portals using these records as a backbone.

It’s the future of medicine, says Dr. Raymond Casciari, chief medical officer at St. Joseph Hospital in Orange, California, but for now, he adds, “We’re still in the dark ages.”

The portal approach is intended to be beneficial, letting you share key medical data instantly with your family and consult with specialists on another continent. It’s supposed to lower healthcare costs and provide better services. But the data being stored is sensitive and so far it isn’t very secure, say experts. So it’s important to know how your medical information is being shared and managed, especially as access explodes.

Dr. Deborah Peel, a psychiatrist and founder of Patient Privacy Rights, is dubious about patient medical privacy on portals. She believes that data breaches can have harmful effects, including medical discrimination. “Today, we can’t see who uses our electronic records,” she warns. “And they can be back-door mined.”…”

PPR Comments on the PCAST HIT Report

The President’s Council of Advisors on Science and Technology (PCAST) weighed in on the key problems with how the Administration is building health IT systems and data exchanges. They recommend that patients be able to meta-tag data to protect privacy, that interoperability requires adoption of a common “language”, and that the goal should be a “data-centric” system for research on all health records without consent. The report recommends that HHS and CMS decide when patient data can be used for “secondary” purposes without consent.

See the full PCAST report: http://www.whitehouse.gov/blog/2010/12/08/pcast-releases-health-it-report

Patient Privacy Rights letter of comments to HHS emphasized:

  • Privacy is essential to build in up front.
  • We should not rush to deploy systems and spend billions on electronic systems and data exchanges until we know the privacy technologies PCAST recommends are adequate.
  • The recommendations for de-identifying health data were insufficient. Extensive work needs to be done to ensure that standards for de-identification actually work.

See PPR’s full comments here: http://patientprivacyrights.org/wp-content/uploads/2011/01/PCAST-comments-PPR-Final.pdf

See PPR’s written testimony here: http://patientprivacyrights.org/wp-content/uploads/2011/05/Patient-Privacy-Rights-Testimony-PCAST-WG-Feb-15-2011.pdf