What is Sensitive Health Data?
Do Patients have a legal right to keep such personal information Confidential?
Should some information be exchanged?
By Stacey Ober, RN, JD

Reflect for a moment on how technology has changed your daily life over the past twenty years. Certainly advances in technology have touched our professional lives as nurses. Technologies also now allow easy access to information; including personally identifiable information. In recent years, the electronic world has raised public concerns about privacy, confidentiality and the threat of discrimination.

In the health care industry, health information is now easily collected, correlated and widely transmitted. The ease of transmitting health information has served important societal goals. The broad collection and use of high quality data has helped consumers to make informed choices among health plans and health care providers. The sharing of data has improved the cost effectiveness of health services while providing more effective clinical care via health-care related research. However, it also may present new challenges for individual health care providers and their patients.

The National Coalition for Patients Rights website www.nationalcpr.org reports real stories about confidences betrayed. What has happened to patients whose private medical information becomes public? In one instance, a terminally ill patient accompanied by her daughter to an appointment with her internist discovered a video camera hiding in the corner of the exam room. The medical practice brochure explained the camera this way: "A closed circuit television monitoring system allows the faculty to directly observe visits. You may request the cameras to be disconnected if observation of the physician might make you uncomfortable".

Patients have a fundamental right to privacy in their relationship with health care providers. Patient-provider relationships have long been governed by mutual respect and honesty. In fact, professional ethics mandate the protection of patient confidentiality. Without this privilege, the ability to collect accurate information from patients about their condition or lives would be lost. Patients who are less willing to divulge sensitive details to their clinician, risk a true diagnosis and successful treatment.

Federal Remedies Proposed

The stakes are extremely high. In 1997 Congress set an August 21, 1999 deadline for it to either pass federal legislation or allow the Department of Health and Human Services, "HHS" to regulate privacy protections. Thus, striking a balance as to what protective legal framework should be enacted has evolved into an important public policy debate this year.

So far, members of the Senate Committee on Health, Education, Labor and Pensions, "HELP", have failed to reach consensus legislation setting Federal privacy standards for health records. The hottest dispute has been whether patients should be allowed to sue if their health care records have been illegally disclosed. The Chairman of the Committee, Senator James Jeffords (R-Vt) has proposed a compromise which allows lawsuits only if the disclosure was "willful and intentional" while capping the patient's non-economic damages at $ 50,000. Other areas of disagreement include: whether adolescents in states allowing minors to consent to receive health care services should be afforded equal privacy rights, the ability of patients to have a separate consent form for sensitive health information release, the confidentiality of a deceased individual's records and the procedure for law enforcement agencies to follow when obtaining access to personal records.

In addition, different versions of Federal legislation would block any state without privacy protection law enacted before the August 21, 1999 deadline from passing stronger protections for patients in the future. ANA is actively participating in the Consumer Coalition for Health Privacy. The Consumer Coalition has agreed to a set of principles which should govern the Federal Legislation without pre-empting stronger state law.

If Congress does not act, or does not extend the deadline, HHS will promulgate regulations. There is strong opposition to the proposed regulations announced by HHS. First, the regulatory protections would only govern electronic health records and these only make up a tiny fraction of records in use. Second, opponents are threatened by the fact that the regulations would not limit law enforcement agency use. For example, increased government interest in prosecuting health care fraud has increased government access to medical records. This has resulted in the public disclosure of intimate details of people's lives recorded in court documents.

Massachusetts Takes Action

Should HHS promulgate the proposed privacy regulations, the good news is that the individual states would be free to create their own privacy protections. Here in Massachusetts, a large Coalition for Patient Confidentiality has been working together over the past two years. MNA is an active member of the Coalition. This legislative session, state legislation has been filed and heard before the Joint Committee on Health Care. MNA invited the Massachusetts Association of Occupational Health Nurses, an MNA Organizational Affiliate, to testify in May with the Coalition.

In June, H. 4494 "An Act Protecting the Privacy of Medical Records," was sent with a favorable recommendation to the House Ways & Means Committee. This proposed legislation would:

• reaffirm our fundamental right to expect that the privacy of our medical records and that of our provider-patient relationship will be protected.
• encourage the use of health care information for medical purposes only; proscribing its use for marketing, employment or non-medical reasons
• require informed consent before any identifiable information is released
• give patients the right to a statement of privacy protection practices and procedures employed by their health care provider
• require an audit trail to serve as a permanent record of those accessing a patient's medical file
• give patients the right to inspect, copy, amend or append their own record
• limit access to sensitive and clinical information without impending emergency care or legitimate business, research, public health activities
• create severe civil and criminal penalties for violations of privacy
• establish an ombudsman in the Department of Public Health responsible for encouraging privacy protection and providing technical assistance and guidance to health care providers, insurers and patients.