Here’s a great article written by PPR’s Chief Technical Officer, Dr. Adrian Gropper about “why hip replacement surgery costs 5-10 times as much in the US as in Belgium even though it’s the same implant… JAMA publish[ing] research and a superb editorial on the Views of US Physicians About Controlling Health Care Costs and CMS put[ting] out a request for public comment on whether physicians’ Medicare pay should be made public.”
Cullen Hoback, director of the documentary “Terms and Conditions May Apply”, argues Facebook and Google are “public utilities” in an interview, “Is Facebook a Public Utility? Yes, says Filmmaker Cullen Hoback”.
The same argument applies to the US electronic healthcare system—all 300 million Americans are forced touse it, we have no real choices.
The collection and use of the nation’s health data is hidden. There is no full data map tracking all uses and we have no ‘chain of custody’ of our personal health information.
- See the start of the first US health data map at TheDataMap.org.
Quotes from the interview:
- “All data can be tracked and followed.”
- “You have the companies making a fortune off of our data and you have the government getting something that it’s wanted for a very long time, which is this sort of unprecedented access to all of the information of all of its citizens.”
- “It’s hard to say opting out is an option.”
See the trailer for “Terms and Conditions May Apply” at http://www.trackoff.us/
To view the full article, please visit States Review Rules After Patients Identified via Health Records.
Key Quotes from the Article:
- -”Some U.S. states are reviewing their policies around the collection and sale of health information to ensure that some patients can’t be identified in publicly available databases of hospital records.”
- -Bloomberg News, working with Harvard University professor Latanya Sweeney, reported on June 4 that some patients of Washington hospitals could be identified by name and have their conditions and procedures exposed when a database sold by the state for $50 is combined with news articles and other public information.
- -The state probes are focused on whether privacy standards for health information should be tightened as data-mining technologies get more sophisticated and U.S. President Barack Obama’s health-care overhaul drives rapid growth in the amount of patient data being generated and shared.
- -Sweeney’s goal of identifying patients is to show that threats to privacy exist in datasets that are widely distributed and fall outside HIPAA’s regulations.
The value of personal health information is very high inside and outside of the US healthcare system. At the same time, the US healthcare industry as a whole does a terrible job of protecting health data security. Most health data holders (hospitals and insurers) put health data security protection dead last on the list for tech upgrades.
Besides the lack of effective, comprehensive data security protections, thousands of low-level employees can snoop in millions of people’s health records in every US hospital using electronic records.
- -The latest celebrity example is the Kardashian hospital data breach firings: http://www.huffingtonpost.com/2013/07/14/workers-fired-kim-kardashian_n_3592841.html
The public expects that only their doctors and staff who are part of their treatment team can access their sensitive health records, but that’s wrong. Any staff members of a hospital or employees of a health IT company who are your neighbors, relatives, or stalkers/abusers can easily snoop in your records.
In Austin, TX the two major city hospital chains each allow thousands of doctors and nurses access to millions of patient records.
All this will get much worse when every state requires our health data to be “exchanged” with thousands more strangers. The new state health information exchanges (HIEs) will make data theft, sale, and exposure exponentially worse.
Tell every law maker you know: all HIEs should be REQUIRED by law to ask you to agree or OPT-IN before your health data can be shared or disclosed.
- -many states do not allow you to ‘opt-out’ of HIE data sharing
- -most states do not allow you to prevent even very sensitive health data (like psychiatric records) from being exchanged
There is no way to trust electronic health systems or HIEs unless our rights to control who can see and use our electronic health data are restored.
To view the full article, please visit My Routine – Mark Rothstein, Law Professor.
This is a very interesting article about Mark Rothstein’s opinion of current governmental actions involving privacy law. Rothstein asserts, “We live in an age in which consent should not be mistaken for choice. We click through consent on software without even reading it. Even if we technically consented, I doubt very much whether the average person would say, ‘Oh sure, it’s OK for my phone company to accumulate all this data about me.’”
In the interview, Rothstein also comments on the views of Louis D. Brandeis, saying “He felt that the government set the tone for society. If the government doesn’t value privacy and invades people’s privacy, then everybody will do that. He also thought it was very important that government activities be subject to review by the political process and the people.”
To view the full article, please visit What is Snowden’s Impact on Health IT?
This is a highly interesting article about the effect of Edward Snowden’s actions on health IT. In the interview with PPR’s own Dr. Deborah Peel, the issues of privacy that our government is currently facing can also be applied to the healthcare industry. As Dr. Peel aptly states, “The Department of Health and Human Services claims its actions are justified to lower healthcare costs. These are obviously very different agencies collecting different kinds of very sensitive personal information, but both set up hidden, extremely intrusive surveillance systems that violate privacy rights and destroy trust in government.”
A key argument that Dr. Peel makes is “The benefits of technology can be reaped in all sectors of our economy without the harms if we restore/update our laws to assure privacy of personally identifiable information in electronic systems. Our ethics, principles, and fundamental rights should be applied to the uses of technology.”
This article expounds upon the implications of Edward Snowden’s actions for the Health IT industry.
Deborah Peel, MD, founder of Patient Privacy Rights, says there are many parallels between the Snowden controversy and the U.S. healthcare system.
According to Peel, the NSA has one million people with top security clearance to 300 million people’s data. The U.S. healthcare system has hundreds of millions of people — none with top security clearances, and the majority with inadequate basic training in security or privacy — who can access millions of patients’ most sensitive health records. Further, we don’t know how many millions of employees of BAs, subcontractors, vendors and government agencies have access to the nation’s health data, she added.
“Corporations and their employees that steal or sell Americans’ health data for ‘research’ or ‘public health’ uses or for ‘data analytics’ without patients’ consent or knowledge are rewarded with millions in profits; they don’t have to flee the country to avoid jail or charges of espionage,” she said.
“The NSA justifies its actions using the war on terror,” Peel added. “The Department of Health and Human Services claims its actions are justified to lower healthcare costs. These are obviously very different agencies collecting different kinds of very sensitive personal information, but both set up hidden, extremely intrusive surveillance systems that violate privacy rights and destroy trust in government.”
“The benefits of technology can be reaped in all sectors of our economy without the harms if we restore/update our laws to assure privacy of personally identifiable information in electronic systems. Our ethics, principles, and fundamental rights should be applied to the uses of technology,” Peel says.
To view the full article, please visit Experts tout Blue Button as enabling information exchange between medical provider and patient.
Blue Button Plus (BB+) and direct secure email technologies could put patients in control of all use and disclosure of their electronic health records. BB+ lets us ‘view, download, and transmit’ our own health data to physicians, researchers, or anyone we choose.
But state Health Information Exchanges (HIEs) don’t allow patients to control the disclosure of personal health data. Some state HIEs don’t even ask consent; the HIE collects and shares everyone’s health records and no one can opt-out. Most state HIEs ask patients to grant thousands of strangers—employees of hospitals, doctors, pharmacies, labs, data clearinghouses, and health insurers—complete access to their electronic health records.
When corporations, government, and HIEs prevent patients from controlling who sees personal health data– from prescriptions, to DNA, to diagnoses– millions of people every year avoid or delay treatment, or hide information.
HIEs that open the door to even more hidden uses of health data will drive even more patients to avoid treatment, rather than share information that won’t be private.
Health IT systems that harm millions/year must be fixed. Technology can put us in control of our data, achieve the benefits and innovations we expect, and prevent harms. We have to change US law to require technologies that put patients in control of their electronic health records.
As more individuals start posting their genomes or other genetic information online, privacy issues grow. A recent article from GenomeWeb about Prince William’s DNA highlights one of PPR’s concerns about publicly sharing such information: one person’s choice to research and reveal information about themselves reveals information about so many others who had no say in that decision.
To be clear, PPR is not opposed to genetic testing and actually believes there are many new and exciting possibilities that exist within the realm of genetic analysis. However, there are several issues that need to be addressed before people start encouraging others to publicly share their own genetic information. This excerpt from the article sums up the dilemma quite nicely:
“What is noteworthy is the ethics of publishing details of this genetic analysis at all,” Brice says, noting that “one of the major ethical concerns about genetic information and privacy” is that individual information can lead to the disclosures about family members.
The Duke’s cousins are free to have genetic tests if they want, but disclosing information about other, non-consenting individuals, is “highly questionable,” Brice says.
To read the full article, click here. (Note: Free subscription may be required).
This article gives a great explanation of how industry has fought to influence those in government that write the ‘rules’ for how federal law works in practice. The key industry tactic is to complain that complying with the law is too costly, or impossible, or would take too much time. For reasons we don’t understand, the government agency that writes the ‘rules’ takes the side of industry rather than defending patients.
From ABA Health eSource, Jim Pyles, “The Right to Obtain Restrictions Under the HIPAA/HITECH Rule:
A Return to the Ethical Practice of Medicine.”
The Individual’s Right to Restrict Disclosure of Health Information
The HIPAA/HITECH Final Omnibus Rule issued on January 25, 2013 restores the right for Americans to retain some control over the disclosure of their health information as part of the “floor” of federal privacy protections afforded by HIPAA.(1) Under the new rule, individuals have a right to obtain restrictions on the disclosure of health information in electronic or any other form to a health plan for payment or healthcare operations with respect to specific items and services for which the individual has paid the covered entity out of pocket in full.(2) Such requests for restrictions must be granted by the covered entity unless disclosure is required by law. Covered entities must also include this right in their notices of privacy practices.(3) The guidance in the preamble states that only healthcare providers are required to include such a statement in their notices of privacy practices; however, the language of the statute and the regulation itself states that the notice requirement applies to covered entities.(4) The new rule became effective March 26, and covered entities must be in compliance by no later than September 23, 2013.(5)
|1||78 Fed. Reg. at 5628 (January 25, 2013).|
|2||45 C.F.R. § 164. 522(a)(1)(vi).|
|3||45 C.F.R. § 164.520(b)(1)(iv).|
|4||HITECH Act, section 13405(a); 45 C.F.R. § 164.522(a)(1)(vi) (as amended).|
|5||78 Fed. Reg. at 5566.|