The Multiracial Activist - www.multiracial.com

 

Coalition for Patient Privacy

October 18, 2007

The Honorable
Neil Abercrombie
Member of Congress
1502 Longworth House Office Building
Washington, DC 20515-1101

Dear Rep. Abercrombie:

Three fourths of the American public want Congress to ensure that our right to health privacy is protected in electronic systems and that electronic health databases and systems are truly secure . Americans have no Federal statutory right to health privacy today.

Despite the good intentions of the Health Insurance Portability and Accountability Act (HIPAA) and its “Privacy Rule”, the current regulations leave all Americans’ personal health information completely vulnerable and exposed. State laws, common laws and the Constitution are there for protection. Yet the HIPAA “Privacy Rule” is really a “Disclosure Rule” that authorizes more than 4 million entities to use and disclose an individual’s health information. This disclosure is without the individual’s consent and over their objections.

We, the undersigned organizations, urge Congress to establish basic privacy protections this year.

Setting national privacy standards is a job for Congress, not unelected agency appointees, who for the most part represent industry. An overwhelming majority of American consumers (86%) are somewhat or very concerned about the health industry’s ability to protect the privacy of personal health information in deploying Electronic Health Records (EHRs).

It is imperative to the millions of members of our organizations that NO health IT legislation pass without enforceable basic health privacy rights for all consumers. Alternatively, Congress should pass a comprehensive health privacy bill that ensures consumers the right to control disclosure of their personal health information before passing any Health IT bills. Senator Leahy’s Health Information Privacy and Security Act (HIPSA), S. 1814, is a good example of what is needed to protect our privacy.

The private sector, communities, states and federal agencies are racing to build EHR systems without adequate privacy protections. Congress has fallen far behind in protecting Americans’ right to health privacy. We hear about violations and abuses of privacy and of records almost weekly. Current laws do not adequately protect electronic health records, leaving the marketplace for “personal health records” and other products the “gold rush” of Health IT. Companies can now do virtually whatever they want with this sensitive information once consumers provide their information, including selling it in secondary markets. No American should be forced to have his or her information entered into this system.

Meanwhile, the President and federal agencies continue to push EHRs via Executive Orders and regulations that ignore what consumers want and Congress intended when it authorized HIPAA.

The reality is that Americans’ personal health information currently is accessed and used without first obtaining informed consent. “Informed consent” means that the person whose health is affected must know and understand the risks involved in disclosing the information. “Secondary” uses of our health records, which have nothing to do with improving our health, have become the primary uses of our health records. Researchers are using our most intimate information without informed consent and without requiring state-of-the-art security measures. These trends are unwelcome and dangerous. It is denying Americans opportunities; these practices must be stopped.

“Garbage In, Garbage Out.”

Without Congressional input or oversight, a national electronic health system will be built that will destroy privacy, and more importantly Americans’ trust in their health care system.

While many argue that electronic health records can help improve efficiency, lead to research breakthroughs, and lower the costs of health care, these outcomes are only remotely possible if and when informed consent is required for all uses. When patients do not trust doctors or the health care system to protect their privacy, they withhold information, they delay or avoid care, and they become sicker.

One in 8 Americans admit to putting their health at risk by engaging in privacy-protective behavior such as:

• Avoiding their regular doctor
• Asking a doctor to alter a diagnosis
• Paying privately for a test
• Avoiding tests altogether

Without control and trust, patients will not see physicians or use the health care system in an effective manner. Wary health care consumers will drive up costs and increase the danger to others. Further, the data collected and stored will be incomplete and filled with inaccuracies and omissions. Corrupted, incomplete and false data will not enhance or improve medical outcomes or research – it will make them exponentially worse.

The proper balance to ensure timely access to medical records for treatment, and preserve patient control of health records, is to allow access in emergencies if consent cannot be obtained. But require patient permission before records are disclosed in all other situations.

We urge you to build a foundation for heath IT that is based on the following privacy principles and protections:

• Recognize that patients have the right to health privacy
• Recognize that user interfaces must be accessible so that health consumers with disabilities can individually manage their health records to ensure their medical privacy.
• The right to health privacy applies to all health information regardless of the source, the form it is in, or who handles it
• Give patients the right to opt-in and opt-out of electronic systems; i.e. the right for patients to give or withhold their consent for the use and disclosure of their health information.
• Give patients the right to segment sensitive information
• Give patients control over who can access their electronic health records
• Health information disclosed for one purpose may not be used for another purpose before informed consent has been obtained
• Require audit trails of every disclosure of patient information
• Require that patients be notified promptly of suspected or actual privacy breaches
• Ensure that consumers cannot be compelled to share health information to obtain employment, insurance, credit, or admission to schools, unless required by statute
• Deny employers access to employees’ health records before informed consent has been obtained
• Preserve stronger privacy protections in state laws
• No secret health databases. Consumers need a clean slate. Require all existing holders of health information to disclose if they hold a patient’s health information
• Provide meaningful penalties and enforcement mechanisms for privacy violations detected by patients, advocates, and government regulators

In summary, most Americans are “highly concerned” about the privacy of their health information. Without ironclad health privacy protections, a nationwide interoperable health system will fail. Americans simply will NOT trust doctors or the health care system if they do not control access to their most intimate personal information.

We urge you to take pro-active steps to safeguard our health privacy and ensure our loved ones are not wrongfully denied opportunities because of an illness or genetic risk of disease. We look forward to working with you and your staff on this urgent problem.

Respectfully,

The Coalition for Patient Privacy

AIDS Action www.aidsaction.org
American Association of People with Disabilities www.aapd.org
American Association of Practicing Psychiatrists
American Chiropractic Association www.acatoday.org
American Civil Liberties Union www.aclu.org
American Conservative Union www.conservative.org
American Psychoanalytic Association www.apsa.org
Association of American Physicians and Surgeons
Bazelon Center for Mental Health Law www.bazelon.org
Bob Barr (former Congressman R-GA)
Citizens for Health www.citizens.org
Citizen Outreach Project
Clinical Social Work Association www.cswf.org
Consumer Action www.consumer-action.org
Consumers for Health Care Choices www.chcchoices.org
Cyber Privacy Project
Doctors for Open Government
Ethics in Government Group
Fairfax County Privacy Council www.fairfaxcountyprivacycouncil.org
Family Research Council www.frc.org
Free Congress Foundation www.freecongress.org
Georgians for Open Government
Gun Owners of America www.gunowners.org
Health Administration Responsibility Project, Inc. www.harp.org
Just Health (California Consumer Health Care Council) www.justhealthnow.org
The Liberty Coalition www.libertycoalition.net
The Multiracial Activist www.multiracial.com
Microsoft Corporation, Inc. www.microsoft.com
The National Center for Transgender Equality www.nctequality.org
The National Coalition for Mental Health Professionals and Consumers
National Whistleblower Center www.whistleblowers.org
The Natural Solutions Foundation www.healthfreedomusa.org
The New Grady Coalition
Pain Relief Network www.painreliefnetwork.org
Patient Privacy Rights Foundation www.patientprivacyrights.org
Privacy Activism www.privacyactivism.org
Privacy Rights Now Coalition www.privacyrightsnow.org
Private Citizen, Inc. www.privatecitizen.org
Republican Liberty Caucus www.rlc.org
The Student Health Integrity Project (SHIP)
TexPIRG www.texpirg.org
Thoughtful House Center for Autism www.thoughtfulhouse.org
Tolven, Inc. www.tolven.org
Tradition, Family, Property, Inc.
Universata, Inc. www.universata.com
U.S. Bill of Rights Foundation
You Take Control, Inc. www.y-t-c.com

“Anyone today who thinks the privacy issue has peaked is greatly mistaken…we are in the early stages of a sweeping change in attitudes that will fuel political battles and put once-routine business practices under the microscope.” Forrester Research

cc: Every Member of the U.S. House of Representatives
Every Member of the U.S. Senate For additional information please contact:

Deborah Peel, MD
Founder & Chair
Patient Privacy Rights
(O) 512-732-0033
(C) 512-970-9007
This email address is being protected from spam bots, you need Javascript enabled to view it
www.patientprivacyrights.org

Be first to comment this article | Add as favourites (57) | Quote this article on your site | Views: 907

EMBARGOED FOR RELEASE UNTIL 10:00 A.M. EST, OCTOBER 4, 2007

For Immediate Release October 4, 2007
Contact: \n This email address is being protected from spam bots, you need Javascript enabled to view it This e-mail address is being protected from spam bots, you need JavaScript enabled to view it , Patient Privacy Rights or 512.732.0033

Download a PDF copy

Microsoft Raises the Bar for Privacy in Electronic Health Record Solutions

PatientPrivacyRights.Org, a national consumer watchdog group, works with technology giant Microsoft to put consumers in control of their electronic health records.

Austin, TX - Earlier this year Microsoft sought advice from PatientPrivacyRights.Org about building privacy protections into their new consumer health platform, HealthVault.  Today Microsoft’s HealthVault system goes “live” and proves that technology can give consumers complete control over who can see or use the information in their health accounts.  HealthVault proves that privacy is not an obstacle to building useful and safe technology to improve health.

Fifty years ago today, the Soviets launched Sputnik in space and provided a wake up call for Americans, changing what we thought was possible and jolting industry.  The privacy protection in HealthVault is Health IT’s Sputnik.  Microsoft proves that privacy works in real-world electronic health systems and it cannot be ignored. “Consent is essential for consumer trust and participation in digital health systems,” says PatientPrivacyRights.Org’s founder, Dr. Deborah Peel. HealthVault requires consumers to give informed consent before any use or disclosure of personal health information.

“Corporate claims to offer privacy mean nothing unless they are willing to take the same steps Microsoft has taken in building HealthVault," says Peel. Microsoft has committed to independent third party audits to verify their pledge to protect privacy.  “Audits are essential,” says Peel.  “Technology companies have got to do better than telling consumers to just ‘trust us.’  Consumers shouldn’t trust anyone but themselves to decide who can see and use their sensitive health information.”

Microsoft was very receptive to concerns about the unchecked loss of consumer control of personal health information and the abuse of Americans’ rights to health privacy.  Microsoft is the first major multinational technology corporation to collaborate with PatientPrivacyRights.Org and use the 2007 Privacy Principles created by the bi-partisan Coalition for Patient Privacy as the basis for the consumer controls of the health data stored in HealthVault.

Microsoft’s use of the Coalition’s strong principles ensures that consumers alone control the personal health information they store in HealthVault accounts. No one: not insurers, employers, hospitals, application partners, advertisers, data miners, or even Microsoft will access consumers’ electronic health accounts without consent.  Microsoft’s application partners are held to the same privacy standards as HealthVault.  Partners are prohibited from data mining or data aggregation contractually and by technical design, and no onward transfer of data is permitted without explicit informed consent. Advertisers are contractually required to protect any data transferred from HealthVault, and HealthVault’s privacy policies are simple and easy to understand. 

In advance of the launch, Microsoft presented the security and privacy features of HealthVault to the Coalition for Patient Privacy.  A number of issues were raised, and Microsoft pledged to continue to improve HealthVault’s protections and features and address new concerns as they emerge with the Coalition going forward.

Finally, Microsoft’s new health search engine allows people to search for health information anonymously. Search information may be saved to your Health Vault account where your searches are kept private and secure. Today, virtually all health sites data mine whatever you read and study, and sell that along with your identifying information. So at last it’s possible to search without fear that someone will know about what your concerns are.

PatientPrivacyRights.Org founder, Dr. Deborah C. Peel, will stand with Microsoft in Washington, D.C today at a press conference to announce the launch of HealthVault. PatientPrivacyRights.Org applauds Microsoft’s implementation of the most stringent existing standards for privacy in HealthVault. Microsoft’s willingness to incorporate the Coalition’s strictest privacy standards is truly revolutionary and sets a new, very high bar for the entire industry.

Microsoft’s HealthVault gives Americans a private, secure, trusted place for collecting and storing their personal health information. No consumer should trust any digital health system or technology product that does not follow the same best practices for privacy and security that HealthVault has put into action.   PatientPrivacyRights.Org looks forward to standing with other technology corporations as they step up and employ best practices for privacy and security.

Be first to comment this article | Add as favourites (42) | Quote this article on your site | Views: 718

Be first to comment this article | Add as favourites (50) | Quote this article on your site | Views: 913

Be first to comment this article | Add as favourites (32) | Quote this article on your site | Views: 2043