Here’s a great article written by PPR’s Chief Technical Officer, Dr. Adrian Gropper about “why hip replacement surgery costs 5-10 times as much in the US as in Belgium even though it’s the same implant… JAMA publish[ing] research and a superb editorial on the Views of US Physicians About Controlling Health Care Costs and CMS put[ting] out a request for public comment on whether physicians’ Medicare pay should be made public.”
Should researchers control the use of everyone’s genomes?
It’s time for a national debate about when and how our genetic information should be used. The healthcare industry and government are planning that our genomes will soon be part of our electronic health records, so that sensitive data can be used without patient consent. The cost of sequencing a genome will soon drop below $1,000.
But the debate about who should control the use of this unique, personal information must be informed by knowing/tracking the hidden flows of genetic data.
The next phase of theDataMap should track the use, sale, and disclosure of genetic information: from hospitals, labs, and genomic sequencing companies to private biobanks, etc, etc.
We cannot weigh risks vs. benefits of open access to genetic data when the risks are unknown.
While the healthcare industry has made advancements in how they protect our most personal information, those trying to steal our electronic health records have become even more savvy as to how to access them.
Key Quotes from the Article:
“One of the biggest changes during the past decade is the data being targeted. Ten years ago, it was personal identifiable information. Now, said Rick Kam, president and co-founder of ID Experts in Portland, Ore., personal health information is being targeted, mainly because of the value it holds and the relative ease thieves have getting their hands on it.”
“94% of health care organizations have had at least one breach in the previous two years.Because data can now reside in multiple locations, including unsecured smartphones, laptops and tablets, and can be transported to an infinite number of locations, thieves, whether they be outside hackers, device stealers or people who try to use staff to share sensitive information, have more areas to target.”
“According to a recent Black Book Market Research user surveys, the demands of EHR usability can no longer be ignored. 100% of nearly 2,900 practices engaged in the poll report they are employing much stricter selectivity in the replacement market wave and driving more informed decisions as they prepare to swap out original EHR systems.”
To view the full release: Usability Failures Heat Up EHR Replacement Market, Black Book Rankings Survey
The value of personal health information is very high inside and outside of the US healthcare system. At the same time, the US healthcare industry as a whole does a terrible job of protecting health data security. Most health data holders (hospitals and insurers) put health data security protection dead last on the list for tech upgrades.
Besides the lack of effective, comprehensive data security protections, thousands of low-level employees can snoop in millions of people’s health records in every US hospital using electronic records.
- -The latest celebrity example is the Kardashian hospital data breach firings: http://www.huffingtonpost.com/2013/07/14/workers-fired-kim-kardashian_n_3592841.html
The public expects that only their doctors and staff who are part of their treatment team can access their sensitive health records, but that’s wrong. Any staff members of a hospital or employees of a health IT company who are your neighbors, relatives, or stalkers/abusers can easily snoop in your records.
In Austin, TX the two major city hospital chains each allow thousands of doctors and nurses access to millions of patient records.
All this will get much worse when every state requires our health data to be “exchanged” with thousands more strangers. The new state health information exchanges (HIEs) will make data theft, sale, and exposure exponentially worse.
Tell every law maker you know: all HIEs should be REQUIRED by law to ask you to agree or OPT-IN before your health data can be shared or disclosed.
- -many states do not allow you to ‘opt-out’ of HIE data sharing
- -most states do not allow you to prevent even very sensitive health data (like psychiatric records) from being exchanged
There is no way to trust electronic health systems or HIEs unless our rights to control who can see and use our electronic health data are restored.
To view the full article, please visit What is Snowden’s Impact on Health IT?
This is a highly interesting article about the effect of Edward Snowden’s actions on health IT. In the interview with PPR’s own Dr. Deborah Peel, the issues of privacy that our government is currently facing can also be applied to the healthcare industry. As Dr. Peel aptly states, “The Department of Health and Human Services claims its actions are justified to lower healthcare costs. These are obviously very different agencies collecting different kinds of very sensitive personal information, but both set up hidden, extremely intrusive surveillance systems that violate privacy rights and destroy trust in government.”
A key argument that Dr. Peel makes is “The benefits of technology can be reaped in all sectors of our economy without the harms if we restore/update our laws to assure privacy of personally identifiable information in electronic systems. Our ethics, principles, and fundamental rights should be applied to the uses of technology.”
This article expounds upon the implications of Edward Snowden’s actions for the Health IT industry.
Deborah Peel, MD, founder of Patient Privacy Rights, says there are many parallels between the Snowden controversy and the U.S. healthcare system.
According to Peel, the NSA has one million people with top security clearance to 300 million people’s data. The U.S. healthcare system has hundreds of millions of people — none with top security clearances, and the majority with inadequate basic training in security or privacy — who can access millions of patients’ most sensitive health records. Further, we don’t know how many millions of employees of BAs, subcontractors, vendors and government agencies have access to the nation’s health data, she added.
“Corporations and their employees that steal or sell Americans’ health data for ‘research’ or ‘public health’ uses or for ‘data analytics’ without patients’ consent or knowledge are rewarded with millions in profits; they don’t have to flee the country to avoid jail or charges of espionage,” she said.
“The NSA justifies its actions using the war on terror,” Peel added. “The Department of Health and Human Services claims its actions are justified to lower healthcare costs. These are obviously very different agencies collecting different kinds of very sensitive personal information, but both set up hidden, extremely intrusive surveillance systems that violate privacy rights and destroy trust in government.”
“The benefits of technology can be reaped in all sectors of our economy without the harms if we restore/update our laws to assure privacy of personally identifiable information in electronic systems. Our ethics, principles, and fundamental rights should be applied to the uses of technology,” Peel says.
To view the full article, please visit Experts tout Blue Button as enabling information exchange between medical provider and patient.
Blue Button Plus (BB+) and direct secure email technologies could put patients in control of all use and disclosure of their electronic health records. BB+ lets us ‘view, download, and transmit’ our own health data to physicians, researchers, or anyone we choose.
But state Health Information Exchanges (HIEs) don’t allow patients to control the disclosure of personal health data. Some state HIEs don’t even ask consent; the HIE collects and shares everyone’s health records and no one can opt-out. Most state HIEs ask patients to grant thousands of strangers—employees of hospitals, doctors, pharmacies, labs, data clearinghouses, and health insurers—complete access to their electronic health records.
When corporations, government, and HIEs prevent patients from controlling who sees personal health data– from prescriptions, to DNA, to diagnoses– millions of people every year avoid or delay treatment, or hide information.
HIEs that open the door to even more hidden uses of health data will drive even more patients to avoid treatment, rather than share information that won’t be private.
Health IT systems that harm millions/year must be fixed. Technology can put us in control of our data, achieve the benefits and innovations we expect, and prevent harms. We have to change US law to require technologies that put patients in control of their electronic health records.
The NSA knows we are sick because we phone doctors’ offices.
As a mental health professional, Dissent Doe explains in her blog (below) how revealing phone call metadata is:
“Because my phone is used mainly for calls to and from patients and clients, can the NSA figure out who my patients are? And could they, with just a query or bit of analysis, figure out when my patients were going into crisis or periods of symptom worsening? I suspect that they can. And because I am nationally and internationally known as an expert on a particular disorder, could the government also deduce the diagnosis or diagnoses of my patients or their family members? Probably.”
There is a huge national media response to the NSA spying on Americans’ cell phone calls, but the media does NOT report on the far worse systemic corporate and government spying on the nation’s electronic health records.
The US healthcare system is engineered for hidden corporate and government surveillance of personal data about the minds and bodies of all 300 million Americans –from prescriptions to diagnoses to DNA—it’s all collected and sold.
- -For example, see Bloomberg BusinessWeek story about 33 states that sell residents hospital records:http://www.businessweek.com/news/2013-06-05/states-hospital-data-for-sale-leaves-veteran-s-privacy-at-ris
The US media simply repeats industry and government talking points about the benefits of electronic health systems without reporting on the massive harms:
- -Millions of patients/year avoid early diagnosis and treatment of cancer, depression, and sexually transmitted diseases because they know that information will not be private (see citations and statistics in:http://patientprivacyrights.org/wp-content/uploads/2010/08/The-Case-for-Informed-Consent.pdf)
- -1/8 people hide health information because they know that information will not be private
- -Should we use technology that causes millions to suffer bad outcomes?
2013 is a critical year: every state will share your health data with hundreds-thousands more hidden users via Health Information Exchanges (HIEs).
- -Many states to not allow you to ‘opt-out’ of HIEs that exchange your health data.
- -Most states do not allow you to prevent your most sensitive health information from being exchanged.
- -So far, not one state gives patients control over data exchange.
SIGN PPR’s petition and say “no” to data exchange without your consent at: http://patientprivacyrights.org/2013/06/sign-the-petition-for-patient-controlled-exchange-of-health-information/
- -Patients have always controlled who could see and use paper medical records.
- -Now institutions (corporations and government) control who can see and use the nation’s electronic health records.
Great existing technologies can fix badly designed electronic health systems, but we need new laws that require privacy-protective technologies are built into all electronic systems that handle health data.
It’s impossible to stop the tsunami of fraud, ID theft, and medical ID theft until we rebuild US health IT systems to prevent open access to millions of patient records by thousands of hospital and insurance company employees.
Systems should be re-built to allow ONLY those few people who are directly involved with a patient’s treatment to access their health records.
- · ONLY those who carry out the orders of the patient’s physician should be able to access that patient’s electronic health records
- · the other hundreds or thousands of hospital system employees and staff members should not be physically or technically able to access that patient’s records
- · When a patient is admitted, one physician is in charge of diagnosis and treatment.
- · All people the attending physician orders to treat the patient (nurses, consultants, respiratory therapists, etc, etc) work for that physician, the “captain of the ship”
Health data cannot possibly be protected when thousands of people have access to millions of patient records. Employees of the hundreds of separate health technologies used by every hospital also have open access to millions of patient records.
The more people have access to sensitive personal health data, the easier it is to steal, sell, misuse it.