Is Your Medical Information Really Private?

July 23, 2002 -- Think of the painfully personal details we share with doctors, nurses, health-care insurers, and pharmacists everyday. Think it's all private? Think again.

Two ripped-from-the-headlines scenarios illustrate the murky parameters of our medical privacy.

In Florida, an unknown number of residents recently received samples of unsolicited Prozac in the mail, apparently the result of their health records being used for marketing purposes. Prosecutors are investigating the antidepressant's manufacturer Eli Lilly & Co., drugstore chain Walgreen Co. and a Florida doctor's group, but it remains unclear whether the mailings were actually illegal.

In a separate but similar case, the Florida-based Eckerd Corp. pharmacy chain recently got in hot water for selling its customer database to drug companies for marketing materials.

Depending on what state you're in, these practices could be perfectly legal and even commonplace.

"What might have been considered unethical or unthinkable 10 years ago is now just considered part of doing business in the health-care field," said Janlori Goldman, director of the Health Privacy Project at Georgetown University.

In another recent case, a judge in Iowa has ordered a Planned Parenthood clinic to turn over reams of pregnancy tests so local police can cull the records in search of a woman who abandoned a baby who later died.

The clinic's director refuses to hand over the records, and may go to jail if her appeal to the state Supreme Court fails.

"This could be any clinic in America for any test you name," said director Jill June. "If they do it to the women in Storm Lake, Iowa, that puts any test taken by any person in the country at risk of disclosure."

Will New Rules Jeopardize Privacy?

To hear some privacy advocates tell it, every test taken by any person in this country is already at risk of disclosure, and will be even more so when federal medical privacy regulations take effect next April.

"People have to learn that medical records confidentiality is not something that can be assumed," said Robert Gellman, a Washington, D.C., health privacy consultant.

As it stands, there is no federal law governing the release of medical information. Most states have their own laws — actually, dozens of them — but many are outdated and even contradictory.

With this Byzantine system in mind, Congress passed the Health Insurance Portability and Accountability Act in 1996, which among other things set up a new system by which medical information can be electronically transmitted.

Under the law, Congress gave itself three years to write rules governing the privacy of medical information. If lawmakers didn't act, the job would fall to the Department of Health and Human Services. That's what happened.

First, Clinton administration health officials took a stab at the rules. The Bush administration is still reworking its own version, and final language will be announced in the coming months.

When the rules take effect next April, they will override all state laws except those more stringent than the new federal standards.

Blurry Line Between Marketing and ‘Information’

From what has already been released, though, consumer groups and privacy advocates say the Bush rules will likely make it more difficult to protect patient privacy.

Under the proposed regulations, health-care companies, pharmacies, doctors and hospitals will not have to ask patients for consent before transferring their health-related information. Instead, providers would have to notify patients about their privacy practices, giving them the option to switch providers.

The Bush proposal would require pharmacies, health plans and other such entities to get authorization before sending patients any marketing materials, but would allow them to communicate health-related information and treatment options — critics say this line is too blurry to know exactly when mailings constitute health-related information or marketing material.

Under the Bush plan, law enforcement officials would be able to obtain medical records with warrants or subpoenas.

For the first time, which pleases both privacy advocates and industry leaders, patients will be able to obtain a record of their own medical records, just as they can request personal credit information.

Industry: We Need Information to Operate

Administration and health-industry officials say that nixing patient consent actually promotes better, more efficient access to health care.

"The health-care system runs on information. You can't provide it, do it, improve it or evaluate it without information," said Sandy Fuller of the American Health Information Management Association.

But consumer advocates complain that the health-care industry just wants another way to make money at the expense of patient privacy, and pressured the Bush administration to write lax privacy standards.

Worse, some critics predict that when patients find out how many eyes and hands can get at their health information, they may not want to speak openly, or even see, their doctors.

"When most people find out doctors are sharing sensitive medical records with drug companies, they get upset. Damage is being done when people are not seeking care," Goldman said.

A 1999 national survey by the Princeton Survey Research Associates found that about 20 percent of patients engage in what's called "privacy protective behaviors," such as not telling a doctor about a potentially stigmatizing condition, or paying out of pocket for mental health care to keep the information from insurers or co-workers.

Concerns About Patient Care

For their part, many doctors and researchers insist the privacy rules are designed to help administer care, foster patient knowledge and promote public health.

For example, when infections break out in hospitals, quality assurance teams must examine patient information to help identify the problem. Medical researchers may need patient records to conduct a long-ranging study on why certain treatments did not work.

Having easy access to a patient's electronic medical records could alert emergency room physicians to potential drug interactions or allergies after an accident, they say.

"It's important for people to know we are all professionals trying to enhance quality of care. The only way to do that is to look at medical records and study them," said American Medical Association President Yank D. Coble, an endocrinologist in Jacksonville, Fla.

What privacy advocates fear, though, is that unless patient confidentiality is protected, the quality of health care could be at risk.

"If people are afraid to go to Planned Parenthood and certain drug stores and are nervous about taking certain kinds of medication, our nation's health care will suffer at some point," Goldman said.