Informational Privacy

Informational privacy—"a state or condition of controlled access to personal information" (Schoeman, 1984; Allen, 1987; Powers, 1993)—is infringed, by definition, whenever another party has access to one's personal information by reading, listening, or using any of the other senses. Such loss of privacy may be entirely acceptable and intended by the indi vidual, or it may be inadvertent, unacceptable, and even unknown to the individual.

This definition of privacy thus reflects two underlying notions. First, privacy in general and informational privacy in particular are always matters of degree. Rarely is anyone in a condition of complete physical or informational inaccessibility to others, nor would they wish to remain so. Second, although information privacy may be valuable and deserving of protection, many thoughtful privacy advocates argue that it does not, in itself, have moral significance or inherent value (Allen, 1987; Faden, 1993).

Nonetheless, informational privacy has value for all in our society, and it accordingly has special claims on our attention. In his pivotal book, Privacy and Freedom, Westin (1967) described it as "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others" (p. 7). This definition served as the foundation for the Privacy Act of 1974 (P.L. 93579; 5 U.S.C. § 552a). This act, arguably the most significant step to protect privacy in recent decades, was enacted to control use of personally identifiable information maintained in federal government databases.

Recordkeeping Privacy

In recent decades, discussions about privacy have almost exclusively addressed the use of information about people to make decisions about some right, privilege, benefit, or entitlement—so-called "recordkeeping privacy." This focus was of particular interest to those framing the Privacy Act of 1974.

More recently the desire for informational privacy has become an important expectation, not because of a benefit or entitlement sought, but for its own sake. Information may be created as a byproduct of some event—for example, an individual's geographic location becomes available when he or she uses a bank card for a financial transaction; similarly, one's preferences are known when one buys goods by mail order or uses a check-verification card at the local supermarket. In yet other cases, information derives from aggregating data from many sources, including public records; such aggregation can also include data that have been derived from computer processing (e.g., buying profiles or dossiers).

Data subjects want informational privacy to be respected in such contexts as well. Many people in the United States would like to believe that data collected about them legitimately, in connection with some transaction or incidentally through participation in the general activities of society, will not be exploited for secondary purposes such as advertising, soliciting, telemarketing, promotional activities, or other actions that are distinct from and unrelated to the activities for which the data were originally collected (see Harris/Equifax, 1993). As should be clear from the discussion in this chapter, however, these hopes are often not realized in general or in relation to health information.

Balancing Benefits of HDOs Against Loss of Informational Privacy

There cannot be much doubt that HDOs will serve legitimate societal interests as described in Chapter 2. Nevertheless, because HDOs will represent one of the most comprehensive and sensitive automated personal record databases ever established, they inevitably implicate interests protected by informational privacy principles. Accordingly, HDO advocates will be well served from an ethical as well as legal viewpoint if they consider what social goods justify possible loss of privacy and such loss can be minimized or prevented.

Whether HDOs can achieve their potential for good in the face of their possible impact on privacy will likely turn on the interplay of three considerations. First, to what extent do the HDOs provide important (and perhaps irreplaceable) health care benefits to their regions and perhaps to the nation? Second, do the societal benefits resulting from the implementation of HDOs outweigh the privacy risks? Third, to what extent have adequate privacy safeguards been incorporated into the HDOs?

Federal and State Privacy Protection

No explicit right to privacy is guaranteed by the Constitution of the United States; in fact, the word "privacy" does not appear. The presumed right as the basis of a civil action is based on legal opinion written by Justice Louis D. Brandeis in 1890, and its constitutional status derives from various amendments to the Bill of Rights.

The issues surrounding the constitutional status of privacy protection are too numerous and controversial to explore in detail here. Most constitutional scholars agree that federal constitutional protections are unlikely to provide the first line of defense for privacy of health information. The Constitution generally has not provided strong protection for the confidentiality of individual health care information; the constitutional protection for informational privacy is thus very limited and derived from case law interpreting the Constitution.

The courts have made clear that, at least theoretically, information privacy principles based on the Constitution limit a government agency's collection and use of personal information to situations in which the use bears a rational relationship to a legitimate governmental purpose. The government's interest in the information program must outweigh the threat to personal privacy posed by the program.⁶

In Whalen v. Roe (429 U.S. 589 [1977]), for example, the Supreme Court balanced the privacy threat posed by a New York State law against the statute's benefits. The New York State statute required pharmacists and physicians to report sensitive health record information to state officials, in this case prescriptions for controlled drugs. It required physicians to report the names of patients receiving certain types of prescription drugs to a state agency. The court concluded that the statute was constitutional on two grounds: the societal interests served by the statute (combating the illegal use of otherwise legal drugs) and extensive privacy and confidentiality protections in the law (redisclosure of the drug information, for example, was prohibited). The court suggested that if the statute had lacked these confidentiality protections it would have been found to violate constitutional privacy principles (Chlapowski, 1991). Thus, privacy rights are to be considered derived and not explicit rights.

In United States v. Westinghouse Electric Corp. (638 F. 2d 570, 578 [3rd Cir. 1980]), the Third Circuit identified seven factors that should be weighed in determining whether to permit a government agency to collect personal information and thus undertake a program that infringes privacy. These were the type of record requested; the subject matter of the information; the potential for harm in a subsequent nonconsensual disclosure; the damage to the relationship in which the record was generated; the adequacy of safeguards to prevent unauthorized disclosure; the degree of need for access; and whether there is an express, statutory mandate, articulated public policy, or other recognizable public interest tilting toward access.

Various state constitutional provisions offer more protection. For one to have a claim for a violation of a constitutional privacy right, however, the individual generally must show that state action caused the violation. California's constitution (Cal. Const., Art. 1, § 1) is an exception to this general rule because it makes privacy rights explicit. California courts have held that the state's constitutional privacy provision can be asserted against private parties who infringe on citizens' privacy; see, for instance Heda v. Superior Court, 225 Cal. App. 3rd 525 (Cal., Dist. Ct., App. 1990) and Soroka v. Dayton Hudson Corp., 1 Cal. Rptr. 2nd 77 (1991). Other common law and statutory remedies, as well as institutional policies and practices, will be of greater immediate importance. This and the relevance of existing laws to HDOs is discussed in the next section.

Confidentiality Obligations in Health Care

Professional obligations to privacy and confidentiality. The importance of confidentiality to the medical profession is reflected in the physician's "Oath of Hippocrates." Adopted in roughly the fourth century B.C.E., it remains a recognized element of medical ethics:

Whatsoever things I see or hear concerning the life of men, in my attendance on the sick or even apart therefrom, which ought not to be noised abroad, I will keep silence thereon, counting such things to be as sacred secrets (Bulger, 1987).

In similar fashion, the American Medical Association Principles of Medical Ethics (AMA, 1992, Section 5.05) states that "The information disclosed to a physician during the course of the relationship between the physician and patient is confidential to the greatest possible degree . . . The physician should not reveal confidential communications or information without the express consent of the patient, unless required to do so by law."

Within the healing relationship, four justifications may be offered for medical confidentiality (adapted from Faden, 1993). First is a respect for privacy and patient autonomy. In the earliest practice of medicine, physicians treated patients in their homes, and medical privacy was an extension of the privacy of the home. The Hippocratic Oath, for instance, does not justify confidentiality on any ground other than respect for privacy. If information concerning a patient's mind and body are viewed as extensions of the patient, than the concept of autonomy requires that the patient be able to control disclosure and use of that information. The value placed on personal autonomy gives rise to the notion of informed consent. As Justice Benjamin N. Cardozo wrote in his opinion in Schloendorff v. Society of New York Hospital, 211 N.Y. 125, "Every human being of adult years and sound mind has a right to determine what shall be done with his body."

A second justification related to respect for privacy is the implicit and sometimes explicit expectation or promise of confidentiality. Third is the special moral character of the doctor-patient relationship, which is characterized by trust and intimacy. Confidentiality can be instrumental in fostering patients' trust in their physicians; when this trust encourages patients to speak freely and disclose information they would otherwise keep secret, it facilitates diagnosis and treatment. Fourth, respecting confidentiality protects patients from harm that might befall them if the information were to become widely available and indiscriminately used.

Legal obligations of confidentiality. Various federal and state laws impose a duty to preserve the confidentiality of personal health information. These laws can be divided into two categories: those imposing confidentiality obligations on recordkeepers and those protecting health information that is deemed highly sensitive. Examples of the former include general confidentiality statutes about health care information such as the Uniform Health Care Information Act (National Conference, 1988) and the California Confidentiality of Medical Information Act (Cal. Civil Code §§ 5656.37 [1992]), as well as various state laws and Medicare and Medicaid regulations. Laws and regulations imposing confidentiality requirements for sensitive personal health information include those related to alcohol and drug abuse records and laws governing nondisclosure of records of patients with acquired immunodeficiency syndrome (AIDS), the results of antibody tests for human immunodeficiency virus (HIV), psychiatric and developmental disability records, and information concerning results of genetics screening and testing.

Courts have also recognized a legal obligation to maintain the confidentiality of personal health care information. In response to harm resulting from unauthorized release of personal health information, courts have granted legal relief under a number of theories: breach of trust, breach of confidence, breach of implied contract, invasion of privacy, defamation, and negligence (Waller, 1992).

Disclosure of Health Information

As one looks beyond the protected sphere of the patient-provider relationship, it is not always clear who is rightly in the community of "knowers," nor is there universal agreement on principles that ought to control disclosure. With the growth of managed care, utilization review, third-party payment systems, and claims administration for self-insured health plans, information sharing for purposes of adjudicating claims and managing high-risk or high-cost cases has become part and parcel of the provision of health care. Westin has described these supporting and administrative activities as "Zone 2" in comparison to "Zone 1," which refers to information flow to support direct medical care (Westin, 1976; Harris/Equifax, 1993). These wide-ranging claims of need for sensitive health information, which are emblematic of modern health care, raise difficult problems for the preservation of privacy and maintenance of confidentiality.

Patients generally understand that, with consent, information in their medical records will be shared widely within a hospital and for insurance and reimbursement purposes. They also expect that data collected about them will be used only for the purpose of the initial collection and that such data will be shared with others only for that same purpose. Outside the health care institution, patients expect that confidential data will not be shared with people or organizations not authorized to have such information and that legitimate users of the data will not exploit such access for purposes other than those for which the information was originally obtained (e.g., see Harris/Equifax, 1993).

Consent. Such exceptions to the rule of confidentiality as described above are rationalized as being conducted by consent of the patient or a patient representative. A patient may be asked to accede to disclosure by signing a blanket consent form when applying for insurance or employment. In such cases, however, consent cannot be truly voluntary or informed. Such authorizations are often not voluntary because the patient feels compelled to sign the authorization or forego the benefit sought, and they are not informed because the patient cannot know in advance what information will be in the record, who will subsequently have access to it, or how it will be used.

Although consent may be the best-recognized way to permit disclosures of private information, consent is so often not informed or is given under economic compulsion that it does not provide sufficient protection to patients. As will be seen in the recommendations section of this chapter, this committee generally does not regard "consent" procedures as sufficient to protect sensitive information from inappropriate disclosure by HDOs, although they are a necessary adjunct to other autonomy protections.

Mandatory reporting and compulsory process. Other situations exist in which sensitive health information about individuals must be disclosed to third parties. Such sharing of health information for socially sanctioned purposes may be truly voluntary; it may also be required through mandatory reporting or coerced by court order.

Mandatory reporting requirements are justified by society's need for information; these include filing reports of births and deaths, communicable diseases, cancer, environmental and occupational diseases, drug addiction, gunshot wounds, child abuse, and other violence-related injuries. Some statutes requiring that records be retained for 10 to 25 years in some cases make past diagnoses retrievable long after they no longer accurately describe the patient. Another type of reporting requirement involves the expectation that third parties require warning about threats to their life.⁷

Physicians and others may also find themselves compelled to divulge patient information when they would otherwise choose not to do so. Such requirements—sometimes termed "compulsory process"—may take the form of subpoenas or discovery requests and may be enforced by court order. In some instances personal health care information may be protected from disclosure in court and administrative proceedings by virtue of the physician-patient privilege, which may be mandated by statute or derive from the common law. Information that is so privileged cannot be introduced into evidence and is generally not subject to discovery.

Weaknesses of Legal Protection for Confidentiality

Legal and ethical confidentiality obligations are the same whether health records are kept on paper or on computer-based media (Waller, 1992). Current laws, however, have significant weaknesses. First, and very important, the degree to which confidentiality is required under current law varies according to the holder of the information and the type of information held.

Second, legal obligations of confidentiality often vary widely within a single state and from state to state, making it difficult to ascertain the legal obligations that a given HDO will have, particularly if it operates in a multistate area. These state-by-state and intrastate variations and inconsistencies in privacy and confidentiality laws are well established among those knowledgeable about health care records law (e.g., see Powers, 1991; Waller, 1991; WEDI, 1992; Gostin et al., 1993; OTA, 1993; for examples ranging across many types of professionals, institutions, and ancillary personnel). This is important because some HDOs will routinely transmit data across state lines. Interstate transmission already occurs with data such as claims or typed dictation. When confidential data are transmitted across state lines, it is not always clear which state's confidentiality laws apply and which state's courts have jurisdiction over disputes concerning improper disclosure of information.

Third, current laws offer individuals little real protection against redisclosure of their confidential health information to unauthorized recipients for a number of reasons. Once patients have consented to an initial disclosure of information (for example, to obtain insurance reimbursement), they have lost control of further disclosure. Information disclosed for one purpose may be used for unrelated purposes without the subject's knowledge or consent (sometimes termed secondary use). For instance, information about a diagnosis taken from an individual's medical record may be forwarded to the Medical Information Bureau in Boston, Massachusetts (MIB, 1989; and see Kratka, 1990) and later used by another insurance company in an underwriting decision concerning life insurance. Redisclosure practices represent a yawning gap in confidentiality protection.

As a practical matter, policing redisclosure of one's personal health information is difficult and may be impossible. At a minimum, such policing requires substantial resources and commitment. With the use of computer and telecommunications networks, an individual may never discover that a particular disclosure has occurred, even though he or she suffers significant harm—such as inability to obtain employment, credit, housing, or insurance—as a result of such disclosure. Pursuing legal remedies may result in additional disclosure of the individual's private health information.⁸

Fourth, in some instances federal law preempts state confidentiality requirements or protections without imposing new ones. For example, the Employment Retirement Insurance Security Act (ERISA) preempts some state insurance laws with respect to employers' self-insured health plans, yet ERISA is silent on confidentiality obligations. Because 74 percent or more of employers with 1,000 or more employees manage self-insured health plans (Foster Higgins, 1991, in IOM, 1993e), such preemption is particularly troublesome.

Last, enforcing rights through litigation is costly, and money damages may not provide adequate redress for the harm done by the improper disclosure.

Inadvertent Release

A form of disclosure that the committee has termed "unthinking" often occurs within medical institutions. Examples include discussions with or about patients within earshot of other patients in waiting areas and discussions of cases in elevators, halls, cafeterias, and social settings. Disclosure related to the human penchant for gossip and carelessness in leaving medical records "lying around" or leaving information displayed on computer terminals is common. Westin (1972) concluded that such disclosures (sometimes to patients' relatives or friends) were less likely to be related to automated databases than to common indiscretion by hospital workers and health care providers. As the nation moves into yet more sophisticated telecommunication systems, such disclosure can include leaving detailed patient information on answering machines, sending information on fax transmissions that accumulate in common areas, or holding conversations about patients or dictating patient histories or notes about patient visits over cellular telephones.

If the diagnosis stigmatizes or indicates a disabling or fatal condition, harm can be especially serious. The harm can be great both to the famous and "VIP" patient and to noncelebrities, especially for coworkers or patients in a small community. One well-known case involved a staff physician whose HIV status became known in his hospital when his diagnosis was discussed by hospital personnel (Estate of Behringer v. Medical Center at Princeton, 249 N.J. Super. 597, 592 A.2d 1251 [1991]).

The committee believes many safeguards exist that can and should be put in place in any health care institution or HDO to anticipate and prevent disclosures of this sort. Preventing disclosure requires greater sensitivity to confidentiality issues and better training of health care workers. The Mayo Foundation, for example, has successfully developed and maintained a culture of adamant protection of the confidentiality of its patients' health information (Mayo Foundation, 1991).

''Routine" Releases or Uses in Accordance with Prevailing Practices

Health information is frequently shared without knowledge of the individual based on "uninformed" or "blanket" consent. In addition to the consent to disclose information routinely obtained from a patient before care is administered or when enrolling in a health insurance plan, another example of data disclosure is the wholesale photocopying of medical records that are forwarded to insurers, when much of the information does not pertain to the given insurance claim. The committee believes that the ability to prevent inappropriate release and use (misuse) must be strengthened. Such protections for data in HDOs are at the heart of this report and its recommendations.

Rerelease to Third Parties Without the Subject's Knowledge or Consent (Secondary Use)

The "secondary use" principle is an important component of fair information practices. It reflects the notion that when personal information is collected for a particular purpose the information should be used for only that purpose or a compatible one.¹⁰

An especially troublesome problem is the difficulty of confining the migration of information to third, fourth, or fifth parties without the individual's knowledge or consent. Examples include the sharing of health record information within organizations in one industry (e.g., between the health insurance and life insurance division of a company or between the personnel benefits division and the personnel or supervisory unit of an employer). Other examples include sharing between organizations in one industry (e.g., between the Medical Information Bureau and a second insurer). Yet a third sort of sharing can occur between organizations in two different industries (e.g., between insurer and credit bureau or between a current employer and a potential employer). A final example involves sharing genetic information with relatives who are at risk of an inherited disorder.

A major concern among commentators writing about the collection and storage of genetic information is that there will be increased pressure on the holders of such information to reveal to other patients and their physicians information gained about family members. These individuals might want to assess their own genetic risks of inheritable disease or use the information when making reproductive decisions. Some indeed have argued that there is an exception to physician duties of confidentiality analogous to that of duties to warn (or protect) people at risk from those with psychiatric disorders or HIV infection.

Given the growth in fringe benefits offered by employers and their subsequent stake in managing the costs of such benefits, there are few limitations on information that can be gathered for use in administering health, disability, and pension plans. Committee members were told repeatedly that self-insured employers are given access, when they insist, to patient-identified health claims information. Indeed, some third-party administrators (TPAs) provide human resources personnel with dial-in capability to perform their own analyses of data concerning a firm's employees and dependents (personal communication, third-party software and services vendor, 1993). Whether employers have the right to data incident to the health care for which they have paid is highly debatable, but this rationale is commonly accepted by TPAs under the pressure of competition, and there is great risk that data will not be partitioned from use in personnel actions. The 1993 Harris/Equifax survey confirmed the public's concern about this problem. Forty percent were somewhat or very concerned that their job might be affected if their medical claims information was seen by their employer. Another example of information that is in some ways mandated and also creates a database of problematic information is that which is compiled by medical review officers in connection with employee drug-testing programs.

Although corporate and professional ethics tend to discourage abuse, few barriers exist to an employer's use of its employees' medical and insurance claims records. The threat of liability under the Americans with Disabilities Act has served as a brake on some employers' access to and use of their employees' health records. In addition, some state laws limit access. Employers, however, may be required by federal or state regulations to access records in order to identify employees who pose threats to security. Information available under such permission may pertain to spouses and dependents as well as employees.

The committee believes secondary use of medical information by employers is common and may be increasing as employers seek to find ways to manage high-cost cases, to adjust their benefit packages to control their health care exposure,¹¹ and perhaps even to identify or terminate high-cost employees or those with high-cost dependents. Real or potential harm ranges from the inconsequential to the calamitous. It is likely that the ability to limit secondary use can be strengthened, and ways to accomplish this are at the heart of the committee's concerns.

An Ideal Personal Identifier

The ideal personal identifier must, whatever its design, minimize or eliminate the risk of misidentification. An ideal identifier would meet certain requirements, including the six discussed below.

First, it must be able to make the transition easily from the present recordkeeping environment to one that will prevail in HDOs (and under national health care reform). Further, organizations will need to know where to apply for new numbers, to verify numbers that patients give verbally, to track down uncertainties in identification, to find current mailing addresses, and to be able to backtrack errors and correct them. This requirement also has technical dimensions. For example, if a new identifier contains more digits or characters (or both) than the 10 used for the Medicare identifier, there will be software repercussions in many systems, and redesign of data-capture forms may be necessary.

Second, the identifier must have error-control features to make entry of a wrong number unlikely. Control implies that errors of many kinds are detectable and possibly correctable on the basis of the digits and characters in the ID alone. Ideally it will protect against transpositions of characters and against single, double, or multiple errors. At a minimum the error-control features must be able to indicate whether the ID is valid and to do so with high confidence (USDHEW, 1973).

Error control is certain to be a system-wide requirement in any automated system. It will involve not only the structure of the ID itself, but also the processing software (or the residual manual processes) in every system that will have to use and verify the ID.¹³

Third, the ID will have separate identification and authentication elements. The distinction between identification and authentication is made where strong security is required. "Identification" implies that (in this case) an individual indicates who he is, but authentication is a separate process with different parameters (known only to the individual) that allow the system to verify with high confidence that the identification offered is valid. Banks, for example, sometimes require an individual to provide his mother's maiden name; a personal identification number (PIN) is another authenticator. In many, perhaps most, medical systems this distinction is not made, and a simple identifier (e.g., insurance plan identification number) is presumed to be correct. In the future, however, some consideration should be given to separating these functions.

1.

Identifying that something is wrong, but not indicating the error,

2.

Detecting and locating a single error,

3.

Detecting and locating multiple errors,

4.

Detecting, locating, and correcting single errors, and

5.

Detecting, locating, and correcting multiple errors.

The number of additional characters needed depends on the degree of error detection and correction that designers think is necessary for the circumstances. For example, a single check digit can identify an error but does not locate which digit is wrong or how. Moreover, it would not catch the common manual error of transposed characters. A simple single-digit check can sometimes say a bad message is good. For such reasons, a single check digit is not a very strong error control mechanism.

The issue of designing error codes becomes complex rapidly. It is essential, however, to realize that any error correction feature added to an established number such as the SSN will have hardware and software consequences—or both. The data fields in storage will have to be longer; the software will have to be modified to handle the longer data fields; additional software—or hardware or both—will have to be added to do whatever calculations the particular error-detection/correction scheme requires.

Error control is a system-level problem, not just an issue of the identifier per se. If one can arrange procedures so that the identifier is always known to be correct at the time it is entered into the automated system, then the problem within the system itself becomes simpler. The method of providing the identifier will result in higher or lower assurance of its accuracy: an individual's memory is probably the least assurance of correctness; an embossed card is better; and an electronic reader for the card is better still.

The present health care information infrastructure runs largely without external visible error controls. Although mainframes and communications equipment almost certainly have error controls to catch equipment malfunctions and communication faults, there is no error control on some, possibly much, of the data in the data base. It relies, instead, on people outside the system to detect errors—providers and patients—and risks major mistakes in processing.

Fourth, the ID must work in any circumstance in which health care services are rendered, whether or not the situation was anticipated in the design of the system. At a minimum, the ID must never be an impediment to the prompt, efficient delivery of health care. For example, it must work when the patient requiring health care is not able to cooperate (e.g., is unconscious or does not speak the same language as the health care personnel) and regardless of the patient's mental and physical abilities.

Fifth, the ID must function anywhere in the country and in any provider's facilities and settings. By extension, it must also be able to link events that have occurred at multiple providers.

Sixth, the ID must help to minimize the opportunities for crime and abuse and perhaps help to identify their perpetrators.

Shortfalls of the SSN as an Identifier

The choice of a personal ID that is satisfactory for the operational needs of health care delivery, but at the same time assures the confidentiality of medical data and the privacy of individuals is neither easy nor casual. Superficially, the choice would be the SSN, Medicare number, or something similar simply because people are accustomed to using them, systems are used to handling them. The government would bear the burden of administering the enumeration system but would avoid the cost of creating a new one. For information management, however, the shortfalls of the SSN are well known. The following list is representative of the problems.

1.

Any 9-digit number rendered with hyphens in the appropriate places—that is, XXX-XX-XXXX—has a high likelihood of being a legitimate SSN that belongs to someone or at least appears to. This provides little security, and data commingling can occur that would result in erroneous records, mistaken conclusions and actions, and incorrect payments.

2.

The allowable entries in each of the three groups in a SSN are well known. Thus, it is easy to counterfeit an SSN and have a high probability that it will not be challenged.

3.

It has no error correcting features. It is fallible to transpositions and single- or multiple-digit mistakes.

4.

The SSN is not coupled to an authenticator. Some organizations, such as banks, attempt to provide such a feature by using some ad hoc data element that an individual is likely to remember but is not common knowledge (e.g., mother's maiden name).

5.

The SSN circulates widely, particularly in the finance industry. It is relatively easy to acquire someone's number and to parlay it into a false identity that supports fraud or other malicious or illegal actions.

6.

There are often multiple holders of the same SSN, which introduces errors and clouds the records. Especially among less well-informed or immigrant households, the purpose of the number is not well understood or is colored by the role that a number might have played in another country or society. For example, all members of a household might use the same SSN because they believe it is intended to apply to all of them. Some numbers have achieved very wide use. The most famous is the ''wallet incident" in which a replica of an SSN card complete with a number was included in an inexpensive, widely sold wallet; an appreciable number of people improperly believed that this SSN was to be used.

7.

The SSN is closely related to the Medicare identifier, which identifies virtually all members of the population over age 65. For married people who receive SSA Title II benefits paid to an individual and the spouse on the basis of one person's earnings, the Medicare number of the primary beneficiary is the SSN followed by an A; for the spouse, the Medicare number is that same SSN followed by a B.

8.

Not everyone needing health care has an SSN; for instance, foreign visitors, newborn infants, and the indigent or homeless are all likely to lack SSNs. This would require that health care providers be prepared to assign substitute numbers.

9.

The crucial, almost overwhelming, objection to the SSN as a medical identifier, however, is that it has no legal protection, and because its use is so widespread, there is no chance of retroactively giving it such protection. As a data element, it is not characterized by law as confidential; hence, organizations that use it are under no legal requirement to protect it or to limit the ways in which it is used. For all practical purposes its use is unconstrained, this makes the risk of commingling health data with all other forms of personal data enormously high.

Constitutional Law

If an entity has a governmental status, whether federal or state, constitutional privacy standards apply to the entity's handling of personal information. As noted earlier, various provisions of the U.S. Bill of Rights are aimed at protecting citizens from governmental abuse, and privacy rights are derived from limited case law (e.g., Whalen v. Roe). For federal or state constitutional protections to apply, an HDO would have to be operated by a governmental entity or pursuant to a governmental charter.

Legislative Charter

Even if HDOs are not operated by federal governmental entities, constitutional information privacy standards can affect their operations in two ways. First, HDOs may well operate under a state legislative charter. If that charter were to require the submission of personally identifiable medical record information (on the part of record subjects, providers, or others), this statutory requirement provides a basis for a challenge on constitutional privacy grounds, just as did the reporting requirements in Whalen.

Second, even if the HDOs are not statutorily chartered, constitutional information privacy concepts are used by the courts as benchmarks for assessing whether a privacy violation has occurred under common law or statute. Accordingly, if an HDO were challenged on tort or other common law or even statutory privacy theories, the extent to which the HDO violates constitutional informational privacy rights could well be influential in determining the outcome.

Freedom of Information Acts

In addition to any constitutional protections (which will be limited at best), a body of statutory law would also apply to HDOs if they were considered to be public agencies. For example, federal agencies and agencies in every state are covered by freedom of information (FOI) or public records acts. These statutes are intended to make records held by government agencies available to the public. The federal FOIA, however, contains express language that exempts from disclosure "personnel and medical files and similar files the disclosure of which would constitute a clearly unwarranted invasion of personal privacy" (5 U.S.C. § 552[b][6]). Most state freedom of information statutes include a similar exemption. Washington State's FOIA, for example, includes an exemption for medical records, pharmacy records, client records held by domestic violence programs, and various types of research data. The Washington courts have also held that medical records are exempt from disclosure under Washington's FOI statute.¹⁶

Fair Information Practices

In addition, the federal government and approximately one-third of the states have adopted fair information practices and statutes covering governmental agencies within each jurisdiction. The federal Privacy Act prohibits federal agencies, or contractors acting on behalf of an agency, from disclosing information accessible by personal identifiers and contained in a system of records without the prior written consent of the individual concerned.¹⁷ The federal government and states that have adopted comprehensive privacy laws are also required by statute to make records relating to a record subject available upon request to that individual. Federal agencies and those in some states can, however, adopt special procedures that bar direct access to medical record data when officials have reason to believe that such access would be harmful to the subject (Cleaver, 1985; Andrussier, 1991).

The right to know about, challenge, control, and correct information about oneself are hallmarks of American privacy law. The elements of fair information practices derive from the report of the Secretary's Advisory Committee on Automated Personal Data Systems (USDHEW, 1973). The five principles in the original code are enumerated in that report (p. 41) as a Code of Fair Information Practices:

1.

There must be no personal data recordkeeping systems whose very existence is kept secret.

2.

There must be a way for an individual to find out what information about him is in a record and how it is used.

3.

There must be a way for an individual to prevent information about him obtained for one purpose from being used or made available for other purposes without his consent.

4.

There must be a way for an individual to correct or amend a record of identifiable information about him.

5.

Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take reasonable precautions to prevent misuse of the data.

The Privacy Act of 1974. The Privacy Act of 1974 (P.L. 93-579; 5 U.S.C. § 552a) concerns databases held by the federal government.¹⁸ Along with FCRA and the Family Educational Rights and Privacy Act of 1974, this act invests record subjects with rights to see, copy, and correct their records, as well as with limited rights with respect to authorizing the collection and disclosure of information.

The Privacy Act of 1974 incorporated the five elements of the Code of Fair Information Practices as eight principles that are manifest as specific requirements (PPSC, 1977a):

1.

There shall be no personal data recordkeeping system whose very existence is secret and there shall be a policy of openness about an organization's personal data recordkeeping policies, practices, and systems (The Openness Principle).

2.

An individual about whom information is maintained by a recordkeeping organization in individually identifiable form shall have a right to see and copy that information (The Individual Access Principle).

3.

An individual about whom information is maintained by a recordkeeping organization shall have a right to correct or amend the substance of that information (The Individual Participation Principle).

4.

There shall be limits on the types of information an organization may collect about an individual, as well as certain requirements with respect to the manner in which it collects such information (The Collection Limitation Principle).

5.

There shall be limits on the internal uses of information about an individual within a recordkeeping organization (The Use Limitation Principle).

6.

There shall be limits on the external disclosures of information about an individual a recordkeeping organization may make (The Disclosure Limitation Principle).

7.

A recordkeeping organization shall bear an affirmative responsibility for establishing reasonable and proper information management policies and practices that assure that its collection, maintenance, use, and dissemination of information about an individual is necessary and lawful and the information itself is current and accurate (The Information Management Principle).

8.

A recordkeeping organization shall be accountable for its personal data recordkeeping policies, practices, and systems (The Accountability Principle).

In addition to establishing privacy guidelines for federal databases, the Privacy Act also created the Privacy Protection Study Commission (PPSC), whose charter required it to examine recordkeeping practices in the private business sector and in selected federal domains (e.g., tax records). The PPSC revisited the Fair Practices doctrine and reoriented the thrust of the Fair Practices somewhat by placing emphasis on promoting consent and participation rights, which it referred to as "fairness protections for individuals" (PPSC, 1977a, pp. 17-18). In fact, the majority of the commission's recommendations relate directly to fairness in recordkeeping. In the case of an individual, essential fairness protections include a right of access to records about oneself for reviewing, copying, and correcting or amending them as necessary, plus some control over the collection and disclosure of information about oneself.

The PPSC offered an illustrative revision of the Privacy Act to incorporate changes it suggested in its report. These modifications included steps in the following areas: amending records; limitations on disclosure; collecting and maintaining information; "propagating corrections" (which involves taking positive steps to correct information); uses for research or statistical records; notices about agency systems; policies and practices; rights of parents and legal guardians; agency implementation; civil remedies and criminal penalties; application to government contractors and grantees; archiving records; giving notice of new systems or alterations to old systems; reporting to the U.S. Congress; the effect of other laws; and prohibitions on selling or renting information for mailing lists (PPSC, 1977b).

A decade later, the Computer Matching and Privacy Protection Act of 1988 (P.L. 100-503) amended the Privacy Act to include a new section of conditions that must be met before computer matching would be permitted. Another new section pertained to computer matching and required: (1) verification of adverse administrative actions and provision for individuals to contest findings and (2) notification of the public and evaluation of the effect of new systems or matching programs.

Federal Preemptive Legislation

The committee considered one important option to be enactment of federal preemptive legislation. Federal preemptive legislation refers to federal law that supersedes any state law or legislation that either covers the same matter or conflicts with the federal legislation. Such preemptive legislation in this area could establish uniform requirements for the preservation of confidentiality and protection of privacy rights for health data about individuals because health data, particularly in electronic form, will cross state boundaries when accessed and disclosed by HDOs.

As noted earlier, existing state laws pertaining to the actions of recordholders will likely not apply to HDOs, but HDOs might wish to comply with them. Yet, state protections for confidentiality of data contributed to HDOs may be lacking, inconsistent, or even in conflict from state to state. Where they exist, they create an extraordinary patchwork of regulations embedded in laws pertaining to a variety of recordkeepers such as hospitals, HMOs, nursing homes, state health departments, insurers, employers, and so forth. A brief review of state statutes indicated that in one state more than 50 different statutes and regulations pertain to the confidentiality of medical information. Compiling, understanding, and complying with conflicting or arcane regulations for each state would be virtually impossible for HDOs operating in numerous states. Making such policies clear to the public would likely be even more hopeless.

During the period of this study, a number of groups were examining the questions of privacy rights with electronic transfer of health information. Among the more significant was the Workgroup on Electronic Data Interchange (WEDI).

In its 1992 report, WEDI identified three principles for databases containing sensitive personal information that could be associated with identifiable persons; these principles involved computer system security, fair information practices, and privacy protection. To satisfy these principles, WEDI recommended federal preemptive legislation. Its proposals referring to the collection, storage, handling, and transmission of data were intended to facilitate and ensure the uniform, confidential treatment of person-identifiable information in electronic environments.

WEDI recommended that federal legislation include the following steps and provisions:

• establish uniform requirements for preservation of confidentiality and privacy rights in electronic health care claims processing and payment;
• apply these requirements to the collection, storage, handling, and transmission of individually identifiable health care data, including initial and subsequent disclosures in electronic transactions by all public and private payers, providers of health care, and all other entities involved in the transactions;
• exempt state public reporting laws;
• delineate protocols for secure electronic storage and transmission of health care data;
• specify fair information practices that ensure a proper balance between required disclosures, use of data, and patient privacy;
• require publication of the existence of health care data banks;
• establish appropriate protections for highly sensitive data, such as data concerning mental health, substance abuse, and communicable and genetic diseases;
• encourage use of alternative dispute resolution mechanisms where appropriate;
• establish that compliance with the act's requirements would be a defense to legal actions based on charges of improper disclosure;
• impose penalties for violations of the act, including civil damages, equitable remedies, and attorneys' fees where appropriate; and
• provide for enforcement by government officials and private, aggrieved parties.

As described earlier in this chapter, protections for data independent of the recordholder is an important option to consider, and federal legislation provides an opportunity to establish such protections.

Privacy advocates see two possible drawbacks to federal legislation. First, such legislation could weaken rather than strengthen protections if the federal legislation is less stringent than good state legislation—hence the need for strong federal law. If federal legislation leaves room for states to implement more stringent standards, multistate HDOs will still, however, be subject to conflicting requirements, and this may add to, rather than decrease, administrative cost and complexity.

Second, to the extent that federal legislation encourages uniform standards that foster interlinkage and creation of a national database, it will contribute to the development of national databases and, by linkage, to non-health-related databases, dossiers, and national identification systems. The committee's dim view of the development of national identification systems has already been noted.

Uniform State Legislation

The main alternatives to federal legislation would be the status quo or enactment of model state acts. Adoption of uniform state legislation would undoubtedly involve a lengthy and cumbersome process and would not ensure adoption by all states. Even if a uniform law were adopted by all the states, it would likely be adopted with variations by some states, much as in the case of the Uniform Commercial Code. Hence, the committee was not sanguine about the utility of this approach.

HDO Access to Data

Notification. At a minimum, HDOs could publish or give record subjects notice that information about them—including information that the individuals provide directly to participating health care providers, insurers, and employers—will be accessible by the HDO. They might also require notification by entities submitting data to HDOs. Presumably this notice would provide individuals with at least a cursory description of the manner in which HDOs or their agents might use their data.²⁰ They would have no further rights, however, in terms of access to the data. Under current law in many states, patient consent will be required to transmit data to or allow access by the HDO (see footnote 18).

General releases. HDOs could be designed so that individuals would simply be notified about their data being accessible to HDOs, but would also sign a general release authorizing participating providers, payers, and employers to share personal data with HDOs. The presumption, of course, is that such a release (and its implications) is well understood by those signing it. Such a general release might also be crafted to give the HDO a blanket authorization to redisclose.

From a legal standpoint, this approach, however modest it may seem, would be adequate except in the case of extremely sensitive health information such as alcohol and drug abuse, mental health treatment, and AIDS information. Extremely sensitive health record data (e.g., that just noted) generally could not be shared with the HDOs or redisclosed by the HDOs pursuant to general release under existing federal and state law.

Another option is for individuals to receive a complete and detailed written description of an HDO's permissible disclosures and other information practices and a complete description of their information rights.

Stronger options would allow individuals the right to revoke their authorization and, in any event, the authorization would be effective only for a limited period. Even stronger options would require that individuals sign a specific consent form (described below) each time they provided data accessible to an HDO or to HDO participants. In this case, each data element might require separate authorization and expiration dates.

Other Consent and Participation Rights

Even if this approach were to meet minimum legal requirements, however, it is likely to be politically unacceptable for issues of database maintenance and disclosure by the HDO. Given the comprehensiveness and sensitivity of HDO databases and the high level of public concern about privacy, the committee expects that privacy advocacy groups, legislators, the media, and other public opinion leaders will insist that HDOs be brigaded with substantial consent and participation rights.

Participation. An HDO offering participation rights at the high end of the ''protection spectrum" would have all or most of the following characteristics:

• Individuals would receive a complete and detailed written description of an HDO's permissible disclosures and other information practices and a complete description of their information rights.
• Record subjects would have a right of access to all data about themselves that are held in the HDO at a nominal charge. Access rights would include the right to receive a copy of their records, not merely a right to review their record.
• Persons would have a right to correct and amend their records and to add a rebuttal statement if the HDO refused to make a requested correction or amendment.
• Record subjects would have a right to inspect an "audit trail" that can identify all uses, disclosures, and other access events involving their own files.
• Alternatively, record subjects would receive notice in the mail each time the HDO discloses their data to third parties or, at the least, each time HDO data are used to make an adverse decision affecting the individual. This latter formulation is not dissimilar to current notice requirements in FCRA.

Disclosure-Oriented Options (Weak Options)

Under a disclosure-oriented policy, all person-identified or person-identifiable data accessible to HDOs would be available to participating parties for any purpose and without specific subject authorization. Exceptions would apply to particularly sensitive kinds of data, such as records on substance abuse, AIDS, and genetic tests. Even under existing law most of these records cannot be made available without specific authorization. Adopting a disclosure-oriented approach would also make most person-identifiable information available to third parties, as long as the user had a legitimate business purpose for accessing the information.

Furthermore, under a disclosure-oriented policy HDOs would routinely make person-identifiable information available in response to subpoenas, other forms of compulsory process, or formal, voluntary requests from law enforcement or regulatory authorities. If a disclosure-oriented policy were adopted, the principal confidentiality restrictions would relate to the handling of sensitive subsets of health record information and to wholesale disclosures of identifiable information to the general public. The committee rejected this broad disclosure-oriented option as incompatible with its values and the effective implementation of HDOs.

Confidentiality-Oriented Options (Strong Options)

In contrast, a confidentiality-sensitive approach to disclosure would include some, if not all, of the elements listed below.²¹

• HDOs could release information only in non-person-identifiable formats except under very restricted circumstances.
• HDOs could not release any information in personally identifiable form from an HDO database to third parties without a specific authorization, either signed or given electronically by the person in question.
• HDOs could opt never to release person-identifiable information even with subject consent, or to release information in a customized format that blocked parts of a subject's record, depending upon the user and use for which it was requested.²²
• HDOs could refuse to provide person-identifiable information to third parties that intended or could use the information to make decisions about an individual's access to particular benefits (standard processing of health insurance claims would be an exception to this policy).
• HDOs could require users to sign "confidentiality agreements." These agreements would obligate users to safeguard information obtained from the HDO and use it only for the purpose for which it was provided. Violations of the agreement would give the HDO (and perhaps record subjects) a claim of either breach of contract or of confidentiality (or both) against the offending user.
• They would adopt a policy of refusing to comply with voluntary requests for access from law enforcement or regulatory agencies.
• In legal matters, HDOs could resist compliance with subpoenas or other forms of compulsory process, assert all available privileges, and notify record subjects of an access request so that they could contest production. (The Uniform Act noted earlier takes a similar approach with respect to compulsory process.)

State-Based Systems

At one end of the governance spectrum, HDOs could be operated by state or local (but not federal) agencies. This kind of structure has privacy benefits. Constitutional privacy protections, for example, would attach if the HDOs were operated by public agencies. Further, governmental operation would increase the likelihood of effective public and regulatory oversight and accountability. Under this formulation, legislative hearings for budgetary and policy purposes could be expected to be a regular feature of the HDO process.

State or local agency operation of an HDO also carries significant dangers to privacy. This level of government involvement would exacerbate concerns about the linkage of HDOs with other sensitive government databases and the creation of a dossier system. Pressure for public access to HDO health record data means that HDOs will need to be exempted from state FOI laws.

Were an HDO to be operated by a state agency, it would resemble in several ways health data commissions now in place in a number of states. Because some of these have operated for some time, typical characteristics are worth reviewing here.

Iowa, for example, created a health data commission as a "statewide health data clearinghouse for the acquisition, compilation, correlation, and dissemination of data from health care providers, the state Medicaid program, third-party payers, and other appropriate sources." The Iowa statute gave the commission authority to require providers, payers, and others to submit medical record information in a person-identifiable format to the commission. It also provided that medical record data furnished to the commission would not constitute a public record and that all of the confidentiality protections available under the laws of Iowa would apply. Data releases suppress patient identifiers and suppress data in small cells. Early in 1993, bills introduced in the Iowa Senate and House called for implementation of a community health management information system (CHMIS) by the Health Policy Corporation of Iowa through its subsidiary, the Health Information Management Center. The main elements of CHMIS entities were given in Chapter 2.

Private-Sector Systems

At the other end of the governance spectrum, HDOs could be operated by purely private, for-profit or not-for-profit entities with no governmental status or legislative charter. Even in this posture, an HDO could take steps in structure and governance to maximize privacy protections. These steps could include:

• establishing a privacy ombudsman to respond to patient problems or complaints;
• establishing an advisory committee of representatives of organizations affected by the HDOs, including consumer, patient, and privacy advocacy groups;
• adopting a comprehensive privacy code to regulate all aspects of the collection, maintenance, use, and dissemination of person-identifiable data;
• designating a high-level employee to assure compliance with applicable privacy policies and standards and to prepare an annual "privacy status and compliance report" for submission to the boards of directors or advisory committees of HDOs;
• initiating a program of periodic audits to gauge compliance with privacy standards and a privacy impact audit of all new programs or functions; and
• creating an employee privacy training program.

Mixed Governance Systems

For privacy, an attractive governance approach is a middle ground, wherein the entity operating the HDO would be a private, not-for-profit organization with a legislative charter. Such an approach is under way in Washington State. A legislative charter could serve at least nine purposes in the protection of privacy.

First, a legislative charter could bring constitutional privacy protections to bear in some circumstances. Second, it could spell out a statutory cause of action for record subjects, which included remedies such as attorneys' fees and liquidated damages. Third, it could give statutory effect to the HDOs' confidentiality and other privacy standards. Fourth, a legislative charter would affect how federal law characterizes HDOs and help to dispel any confusion about the legal status of an HDO (by stating that the entity is not a health care provider, a payer, or a consumer reporting agency). Fifth, it could establish a "shield" to immunize the HDO databases from discovery and other forms of compulsory process in state courts and administrative proceedings. Sixth, it could criminalize egregious information practices such as intentional breaches of security or willful, unauthorized releases of information. Seventh, such a statute could charge the attorney general or some other appropriate state agency or official with oversight and enforcement responsibilities. Eighth, the statutory charter could institutionalize privacy safeguards such as auditing and training. Finally, it could require an annual report to a legislative committee detailing the HDO's compliance with privacy safeguards or otherwise establish an effective oversight mechanism for assisting the HDO in complying with privacy safeguards.

State charter and mixed governance options will continue to be hampered by the possibility that HDOs will operate in multistate areas. In the absence of federal legislation, this lack of uniformity of requirements or predictability of legal consequences of system design and operational characteristics would be major problems.

Arguments for Federal Legislation

The committee concludes that federal preemptive legislation is required to establish uniform requirements for the preservation of confidentiality and protection of privacy rights for health data about individuals because health data, particularly in electronic form, will cross state boundaries when accessed and disclosed by an HDO. In general, the committee subscribes to the positions laid out in the WEDI report (1992) and thus advocates federal preemptive legislation in preference to model state legislation or similar nonfederal approaches. It further advises that Congress enact such legislation as soon as possible. At a minimum, federal legislation should establish a floor and allow states or HDOs to implement more stringent standards so that it does not weaken state-imposed safeguards.

Attaching Privacy Protection to Data

Although current state protections often apply duties of confidentiality to the recordkeeper (e.g., the hospital), this protection is no longer in effect once the data have left the recordkeeper's control. This means that health data can be deprived of legal protection unless such protection is specified by another law; furthermore, such protection is likely to be left to the discretion of the organizations or individuals who acquire such information as secondary data. At the present time, that is little shelter indeed.

Therefore, legislation should clearly establish that the confidentiality of person-identifiable data is an attribute afforded to the data elements themselves, regardless of who holds the data. There is precedent for attaching umbrella protection to sensitive data either by regulation or by law. Examples include Executive Order 12356 (April 12, 1982), which gives defense agencies authority to establish levels of sensitivity and classify information in them; the Tax Reform Act of 1976 (P.L. 94-455), which stipulates that tax information is considered confidential, requires that the IRS and states protect it as such. According confidentiality protections to data, not to holders, would help to remedy the current lack of protections and to simplify the establishment of, compliance with, and communication of health information practices.

Uniform Requirements

The committee has concluded that ensuring an appropriate balance between the protection of confidentiality of health data about individuals and disclosures of database information requires several important features in legislation or implementing regulations. The first is the inclusion and observance of selected fair information practices, such as those found in the Privacy Act of 1974.²³ These practices—not yet available or understood in the health sector—are described in more detail in the following recommendation on data protection boards. Their significance lies (apart from historical precedent) in promulgating uniform expectations and protections for health data.

Second, federal legislation can be expected to encourage standard setting (e.g., connectivity and transmissions standards). As noted in Chapter 2, the lack of standard setting is a major obstacle to the development of automated medical records (GAO, 1991, 1993a); it will be no less a problem for advanced HDOs. Thus, the committee sees federal legislation as one more mechanism for addressing this problem for all computer-based systems dealing with health data.

Specific Elements of Federal Legislation

Good information practices²⁴ include the collection, transmission, and storage of only the information that is needed. They imply (if not explicitly demand) that data not be collected for unlawful purposes. Thus, proper preemptive legislation should also provide for enforcement by government officials and private aggrieved parties and should impose penalties for violations of the legislation. These might include civil damages, equitable remedies, and attorney's fees where appropriate. It will be important that the legislation clarify whether individuals have standing to bring suit.

HDOs may find themselves in complex legal thickets as demands mount for disclosure of various types of information, some of which may well include protected person-identifiable data. If it is likely that such disclosure will be deemed improper, HDOs may be understandably unwilling to release or disclose much information. This stance may in turn stifle the very contributions that HDOs can offer (as discussed in Chapters 2 and 3). To overcome this possible aversion to risk on the part of HDOs, the committee argues that compliance with requirements of any federal legislation in this area ought to be a straightforward and sufficient defense against legal actions based on charges of improper disclosure. In taking this position, however, the committee further stipulates its expectations that federal legislation will have strong privacy and confidentiality protections that meet, if not exceed, the usual provisions of fair information practices statutes or regulations.

Exemption from Compulsory Reporting and Compulsory Process

A special aspect of the committee recommendation concerns federal, state, and local public health reporting laws and compulsory process. Federal legislation should exempt HDOs from these types of requirements on the grounds that the primary dataholders or originators are the proper target for such laws and regulations. The issue may be especially acute where state laws specify reporting by providers or by "anyone who has knowledge of certain events" (e.g., a reportable communicable disease, a gunshot wound, or child abuse). The committee believes that HDOs ought not to be considered, for these purposes, either a provider or an "anyone" with knowledge of reportable events. To make this clear, the committee believes that HDOs should be directly exempted from such reporting requirements. It should be noted, however, that electronic transfer of such data from health providers to an HDO or its databases would facilitate independent reporting to the appropriate health agency by the provider and thus improve the completeness of those agencies' records.

In much the same way, the committee agrees that data that are essential for conduct of authorized activities by, for instance, the Internal Revenue Service, the Federal Bureau of Investigation, or legal authorities through subpoena or court order should be obtained from the primary recordholder, not the HDO. The committee believes that exemptions from compulsory reporting and compulsory process regarding third-party disputes will strengthen the claims regarding, and the actual protections accorded, the confidential person-identifiable health data held by HDOs. Compulsory process should apply, however, in disputes between HDOs and record subjects.

If federal (or state) legislation does not grant such exemptions to HDOs, then the committee's view is that HDOs should adopt a policy of refusing to comply with requests for access from law enforcement or regulatory agencies to the extent permitted by law, and it should actively seek exemptions in future federal and state legislation. They should also adopt policies of resisting compliance with subpoenas or other forms of compulsory process, asserting all available privileges, and notifying record subjects of an access request so that subjects would have an opportunity to contest production of such data.

Establishing a Data Protection Board

The commitment of the governing body and executives of the HDO to protection of confidentiality will be critical, and these objectives should be written at the outset into the organization's bylaws. One useful mechanism for accomplishing these goals is to establish a policy and oversight "data protection" and "data integrity" unit or units to promulgate, publicize, oversee, and enforce formal policies and procedures concerning access to and release of data. Such an entity within an HDO might be known generically as a data protection board, and that is the term employed in this report.²⁵ (Implementation of such policies and procedures would be the responsibility of specific operational arms of the organization, not the policy units themselves.) Such policy boards and their formal policy statements should be in place before HDOs begin operations, and regardless of whether such policies are specified and enacted in federal preemptive legislation. Policies and procedures should explicitly deal with authorized and unauthorized access to and authorized and unauthorized release of information from HDO databases.

Functions and responsibilities. A data protection board would have full authority to monitor data protection activities, intervene in potentially harmful situations, make exceptions to privacy and confidentiality policies on a case-by-case basis, address questions of new uses and new users of information over time, and undertake other responsibilities that will fulfill the spirit and the letter of the organization's policies.

In terms of actions that HDO data protection boards might undertake, they should: (1) promulgate a code of fair health information practices (or implement one if included in federal or state legislation) and make that code available on request to any member of the public; (2) monitor compliance with such a code, audit for breaches of confidentiality, and respond in a timely way to public concerns; (3) establish, publicize, and implement formal policies and procedures concerning access to and release of data before full operation of their databases begins; and (4) ensure that such policies and procedures deal explicitly with authorized and unauthorized access to and authorized and unauthorized release of information from the database.

Drawbacks and limitations. The committee acknowledges that data protection boards will not provide a full solution without external (and probably federal) legislation and commitment from the governing boards and top leadership of HDOs. Moreover, this stance raises the issue of whether a data protection board should be a function of an HDO—which may be private, quasi-public, or public—or a governmental function applicable to all HDOs. Because of the limited powers of an HDO, particularly if it is private or quasi-public, the data protection board will be able to enforce its policies rigorously only within the organization; externally it can merely track the compliance of others that have contractual obligations to the HDO, but it will not have jurisdiction over them. In the absence of a law giving it added powers, the most that such a board could do about breaches of confidentiality by a party that received information would be to pursue legal remedies for breach of contract or any violation that may have occurred.

An additional problem with relying solely on contractual protections is that the real harm from improper disclosure of information will be suffered not by the HDO, but by persons who in all likelihood will not be a party to the contract with the HDO. (The exception might be when all such contracts name as third-party beneficiaries individuals whose information is on the system, but the committee regarded this as a remote possibility.) In the absence of legal action by such third-party beneficiaries, the liability for improper redisclosure may be minimal.

Developing Administrative Policies and Procedures

General administrative points. HDOs should develop and promulgate strong internal policies and procedures concerning the protection of health information with policies on public disclosure of information and evaluation studies. The committee further advises that such policies, which it assumes will be set by the data protection boards, specifically address the following administrative points:

• who in the organization has final responsibility for setting, monitoring, and enforcing policies and procedures;
• who inside the organization is authorized to have access to which data, and under what circumstances;
• who has authority to override policies (i.e., what are the unusual circumstances, to be decided on case-by-case basis, and who will make these decisions); and
• what are the penalties for unauthorized access or disclosure of protected information, and whether they will differ if disclosure is inadvertent, undertaken for financial gain, or for other inadmissible purposes.²⁶

Implementation of such policies would likely be spread throughout the operating organization. For example, the electronic data processing department would be responsible for implementing security procedures, and the personnel department would likely carry out employee training in appropriate conduct. Some blend of oversight and operational officers would determine authorized uses of the data and rule on the exceptional case.

Policies should cover topics such as types and sources of data over time, notice to individuals about the databases accessed by the HDO, and similar matters. As a broad principle, the committee believes that HDOs must draw on the Privacy Act of 1974 and its principles of Fair Information Practices. This code and other significant issues that HDOs should address are discussed below.

Fair Health Information Practices. The committee strongly advises that HDOs include in their policies and procedures fair health information practices such as those provided for in the Privacy Act; it further urges that HDOs consider applicable revisions of the Privacy Act suggested by the PPSC and others. Any HDO should consider this code as the foundation of its privacy framework and depart from it only after careful consideration and explanation. There will be a direct relationship between, on the one hand, the extent to which record subjects are assured of notice, access, consent, and other rights with respect to information maintained in an HDO and, on the other hand, the political acceptability of HDOs as a concept or a reality in a given location. The committee thus sees such fair health information practices as critical elements in the eventual success of HDOs.

One procedural element of fair information practices is notice to subjects of their inclusion in a database. HDOs might provide for public notification in a variety of ways. At a minimum, periodic published notices in newspapers or public interest broadcast spots could alert individuals, indicate how more information could be obtained, and serve a public education function in explaining what HDOs do. Notice might also be given at the time a health service is provided or when enrolling in a health insurance or provider plan; a case in point is when authorization to access the HDO is given.

Types and sources of data. The committee believes that HDOs should collect only personal information that is necessary to achieve their publicly stated purposes and that they should identify, in writing, specific categories of personal information that they will not obtain under any circumstances. Information relating to an individual's exercise of First Amendment rights might be an example.

HDOs should agree to collect personal information to the fullest extent possible directly from record subjects and their health care providers. This stance reflects the approaches of both the Privacy Act and the PPSC.

Management of records over the long term. Databases cannot be permitted to grow without bounds. Given that the committee cannot foresee how the HDOs will function, it cannot be more specific than to urge that HDOs adopt policies and procedures for archiving records. HDO data protection boards will need policies to respond to an individual's request to purge or seal a record.²⁷

Confidentiality agreements. HDOs should require those who are given access to HDO data to sign confidentiality agreements. These legal agreements would obligate users to safeguard information obtained from HDOs and use the information only for the purpose(s) for which it was provided. Violations of the agreement would give the HDO (and perhaps record subjects) a breach of contract and confidentiality claim against the offending user.

The effort to require recipients to protect confidentiality brings one squarely up against the limitations of contract provisions in this area. Without preemptive federal legislation that requires data recipients to protect the data they obtain in the same way that the HDOs are required to protect those data, no protection can be assured. First, HDOs would have to police the uses made of data by all recipients, and they would have to police redisclosures. As a practical matter, these steps are impossible. Second, no mechanism such as a notarized affidavit would suffice, because such an instrument is merely a sworn statement and has no special status as a contract. A representation of intended use in a confidentiality agreement should be sufficient as a contract. In short, contractual protections are weak, so they should be used only as an adjunct to, and not as a substitute for, appropriate new federal legislation to protect the confidentiality of sensitive patient information held by HDOs.

Routine blocking of sensitive data. Legislation and organizational policies have sometimes distinguished among levels of sensitivity of various elements of health-related data in the belief that it is possible to identify categories of data that warrant special protection (IOM, 1991a; WEDI, 1992). For instance, laws protect data related to treatment in federal drug abuse treatment facilities that receive federal funds.

Despite precedent for adopting such a stance, this committee has decided otherwise. It has concluded that a given data element cannot always be reliably designated as inherently sensitive; rather, the sensitivity of data depends on the kinds of harm to which individuals are or believe themselves to be vulnerable if the information were known to others. Such assessments could differ dramatically from one person to another, one circumstance to another, one place to another, and over time as cultural attitudes change. Rather than recommending special protections for certain categories of data, the committee prefers that all data accessed by HDOs be afforded stringent, and essentially equal, protection.

Blocking divulgence by individuals of sensitive data. If no data are routinely to be considered "sensitive" and thus more stringently protected than other types of data, then might it be reasonable to permit individuals to block divulgence of particular kinds of information? That is, should persons be able to flag or label certain data as special or sensitive, so that those particular facts, specific to those individuals, would not be divulged to anyone? This could be accomplished either by: (1) permitting individuals to block information from disclosure without flagging that information as being so blocked or (2) by letting them block the information but labeling it as blocked. The committee concluded that neither of these options, although perhaps attractive from the point of view of autonomy and empowerment, was desirable as a means of protecting privacy.

The main reason for this position is that, unless care is taken in designing the system, flagging information as having been blocked might in some circumstance defeat or even exacerbate the challenge to privacy; such a label or flag would alert anyone reviewing the material that it includes sensitive data. More insidious from the viewpoint of a treating physician— for whom this information may someday be a proxy medical record (as when information is unavailable by some other means)—it would compromise his or her ability to care for the patient. Furthermore, if blocked material is not so flagged or labeled, the consequences for treating physicians could be even more disastrous if that blocked information (e.g., the existence of a serious chronic condition or use of a particular medication) is directly relevant to clinical decisions. Although it is true that patients can always omit information in a face-to-face encounter, it would seem to defeat one of the purposes of a database to allow it to be intentionally incomplete. Thus, the committee does not subscribe to the view that specified material could be blocked (masked), whether labeled that way or not.

Overseeing Data Integrity

HDO data protection boards would oversee safeguards to prevent health information from being disclosed to unauthorized recipients. They may also need to be responsible for oversight of the protection of data from unauthorized alteration and for data accuracy and completeness. (These tasks might, alternatively, be assigned to a "data integrity" unit, board, or committee.)

At a minimum, this board would need to ensure that data and programs are changed only in a specified and authorized manner, and it would be responsible for assessing and reporting the accuracy of the HDO's data. Data integrity may be maintained by implementing security measures, by implementing procedural controls, by assigning responsibility, and by establishing audit trails as described earlier in this chapter.

Security requires proper system design driven by policies that have been determined and approved by the governing board, chiefly because software and hardware vendors are likely to implement only the level of security specified by the HDOs. Access must be limited to authorized users. Mechanisms and procedures must also be developed and implemented before the network becomes operational. These should address how data integrity will be maintained by preventing alteration or loss of data and what steps will be taken for authenticating users and maintaining records of communications with users. Procedures to ensure availability and recovery after unanticipated disruptions (e.g., power loss, fire) are also crucial, including assurance that the systems resume operation in a secure state and that data integrity is guaranteed.

Security in these environments presents special challenges, in part because it is only as adequate as that provided for the least secure database on the network. Further, remote access to computer systems, the possibility of accessing information over public telecommunications systems, and advances in standardization of data elements and transmission requirements will enhance the opportunities for data linkage, but they will also magnify the need for security protections. Data networks will become increasingly attractive to sabotage and access for financial gain and thus require special attention to manage these risks.

The basic intent is to provide assurance that the system, its resources, and information are protected against harm and that the information and resources are properly accessed and used by authorized users. The board should ensure that, at a minimum, the following list of security safeguards would be in place internally for a defined operational system and environment:

• a defined set of users;
• prescribed data and operational programs;
• defined network connections and interactions with other systems; and
• protection against defined threats against the system, its resources, and its data.

Safeguards might include policy guidance in several areas: procedures for granting access to systems and assigning passwords; administration and training of security officers for conduct of audits and disaster preparedness; and oversight of management review of safeguards and inspections.²⁸

HDOs' resources will probably never be sufficient for all the activities and responsibilities envisioned for them. Long-term success is likely to be predicated in part on their ability to protect confidentiality of personal health data, and the committee believes that they will therefore have to devote adequate resources to some form of data protection board. It may well be that monetary or human resources sufficient to maintain independent data protection and data integrity units will not be available; those resource allocation decisions, however, are best left to individual HDOs.

Policies Relating to Access and Disclosure

It is clear that the question of who outside the HDO has access to which data, under what circumstances, is supremely important; this is directly related to questions of disclosure and is the essence of the privacy issue from the patient's point of view. The committee takes up these matters in a series of recommendations (presented below) that refer to person-identified or person-identifiable information only. As laid out in Chapter 3, this committee recommends release and disclosure of information that protects patient identity but provides reliable, valid, timely, and useful descriptive and evaluative information on a full range of health care providers and clinicians. It also acknowledges that some HDOs will have claims processing and payment functions that will require transmittal of person-identified claims information between the provider and payer.

RECOMMENDATION 4.3 RELEASE OF PERSON-IDENTIFIED DATA

The committee recognizes that there must be release of patient-identified data related to the processing of health insurance claims. The committee recommends, however, that a health database organization not release person-identifiable information in any other circumstances except the following:

• to other HDOs whose missions are compatible with and whose confidentiality and security protections are at least as stringent as their own;
• to individuals for information about themselves;
• to parents for information about a minor child except when such release is prohibited by law;
• to legal representatives of incompetent patients for information about the patient;
• to researchers with approval from their institution's properly constituted Institutional Review Board;
• to licensed practitioners with a need to know when treating patients in life-threatening situations who are unable to consent at the time care is rendered; and
• to licensed practitioners when treating patients in all other (non-life-threatening) situations, but only with the informed consent of the patient.

Otherwise, the committee recommends that health database organizations not authorize access to, or release of, information on individuals with or without informed consent.

Consent

In the last item, the committee has specifically recommended that consent for access to the database be a necessary and sufficient condition in only one circumstance: when needed by the treating practitioner. In such a situation it will be important that specific consent techniques be in place. The following requirements, similar to those in the Uniform Health Care Information Act, are based on PPSC recommendations for medical record information consent forms. Patient consent must:

• be in writing or electronically provided in an acceptable manner;
• be signed or authorized electronically by the individual on a date specified;
• be clear about the entities being authorized to disclose information;
• be specific about the nature of the information to be disclosed;
• be specific as to the institutions or persons to whom the information may be disclosed;
• be specific about the purposes for which the information may be used, both at the time of the intended disclosure and at any future time; and
• be specific as to the date when the authorization expires.

Requirements of signed and written consent, which arose at a time when all records were kept on paper, are still valid, but they will require modification to permit consent by computer, such as by keypad attached to a terminal in a treating physician's office.

The Uniform Act expressly states that the signing of an authorization is not a waiver of any privacy rights that the patient may have under other statutes, rules of evidence, or common law. It further requires that providers (or, in this case, HDOs) retain a copy of each authorization and provides that an authorization may not permit the release of health record information relating to health care that is to be provided more than 90 days in the future. (Exceptions are made for disclosures to third-party payers, but they would be irrelevant for HDOs.) Finally, the Uniform Act states that a patient may revoke a disclosure authorization in writing at any time. Even if consent and participation rights are in place, privacy protection is not ensured, because strategies used to obtain consent, in particular, are fallible. As discussed earlier in this chapter, for example, patients experience substantial pressure to sign authorizations and waivers in order to facilitate both access to and payment for health care.

Release of Person-identified Data

In the seven cases listed in Recommendation 4.3, the committee believes that values other than confidentiality justify access to person-identifiable information with or without consent, and that there exist adequate safeguards for the protection of data in these very limited circumstances. Those values include autonomy for patients in accessing their records, fiduciary responsibility for those unable to care for themselves or make health decisions for themselves, beneficence in providing health care in acute situations, and the social benefits of epidemiologic and health services research. The rationale for each case is described below.

The Standing of Other HDOs

HDOs will need to acquire information about out-of-area care provided to persons in their databases and should be able to do so for those specific circumstances. For example, one HDO might ask another to provide information for state residents of given zip codes who have been hospitalized in other states. The committee concludes that if the requesting HDO has confidentiality and security protections that are at least as stringent as those of the HDO that would be releasing the information, the data should be released. Such HDOs might be in adjoining states (e.g., when Vermont residents are hospitalized in New Hampshire) or within a single state; in other cases they might include overlapping geographical areas such as one or more states and a metropolitan area. In all such cases, individuals might be expected to be found in several different HDOs, and in their best interest (insofar as needed health care is concerned), their data ought to be shared or transferred.

The Standing of Persons, Parents, and Legal Representatives

The second case cited in Recommendation 4.3 is self-evident-when—information about themselves is sought by individuals. The third and fourth cases reflect the need to care for minors and persons who are legally incompetent to give consent for themselves.

One important case concerns the parents of a minor child except when certain actions are protected by state law. Such exceptions include, for instance, family planning services. Emancipated minors are those who live away from home or are in the armed forces and manage their own financial affairs. Mature minors, although still dependent on their parents, are judged to be mature enough to understand the treatment or issue in question and to give informed consent for their own care. The committee believes that privacy and confidentiality for emancipated and mature minors should have the same protection as that given to adults. Parental involvement should be related to the age and development of the minor. Current state laws regarding emancipated or mature minors do not consistently protect such information, and uniform federal legislation is desirable.

The other important case involves legal representatives of incompetent patients. Such legal or personal representatives include guardians as well as individuals who are named in advance directives and granted durable power of attorney.

The Special Standing of Research

The fifth case in Recommendation 4.3—researchers with approval from relevant human subjects committees or institutional review boards (IRBs)—is a different category. In this case person-identified information is not being sought by the patient or for care of the patient, but to conduct studies that in some fashion are regarded to be in the public's interest. Such uses of the databases are considered by this committee to be central and vital to the effective implementation of HDOs. For this reason, researchers whose research design and study plans are deemed appropriate and approved by a review panel—typically but not necessarily an IRB at the lead researcher's university or institution-should be permitted access to person—identified or person-identifiable data in the HDO files.

An IRB is a specially constituted review body established to protect human subjects, usually those recruited for biomedical and behavioral research, when that research is conducted under the auspices of the institution (USDHHS, 1993b). Review and approval by an IRB is required for research that is conducted by investigators supported by a department or agency subject to federal policy. IRBs function under policies set by federal legislation (45 CFR 46 for Department of Health and Human Services; Federal Register, 1991a) and by policies of the institution. Members of the IRB carefully weigh the likely risks and benefits of the proposed research and the procedures and protections for the research subjects.

When research involves only the review of records, such as those in HDOs, the IRB is encouraged to determine that an institutional approval or an expedited review is sufficient. It may do so if it is persuaded: (1) of the significance of the research and that use of data in personally identifiable form is necessary, (2) that any risk of harm to subjects is minimal, (3) that adequate safeguards will be implemented to protect the record or information from unauthorized disclosure, and (4) that removal and destruction of identifiers will be carried out when the research is complete. The committee urges institutions to review applications when requested by serious investigators who many not be affiliated with an institution. Alternatively, such requests might be considered as exceptions by the Data Protection Board on a case-by-case basis.

The committee believes it will usually not be necessary for researchers to obtain consent from record subjects for access to person-identified or -identifiable material, but methods should be incorporated for protecting a record subject's privacy, including notification by the HDO of the uses that may be made of the records.

Contacting potential subjects to obtain further information is a more sensitive matter. It requires careful attention and sensitivity to who would make initial contact and what information would be conveyed to potential subjects or their relatives in the course of the contact. The information conveyed should include the purpose of the study and the kind of data that would be collected, the identity of the persons who will have access to the data, the safeguards that will be used to protect the data from inappropriate disclosure, and the risks that could result from disclosure. Such negotiations should also give written assurance that any publications that result will present the data only in aggregate form so that individuals are not identifiable. Research subjects should also be told if they will be contacted in the future (USDHHS, 1993b).

Special Patient Care Considerations

The sixth case in Recommendation 4.3 involves treating licensed practitioners with a need to know in life-threatening situations, whom the committee believes ought to be able to access data about a patient. This requires that the patient be unable to consent at the time care is rendered. A patient in a situation that threatens loss of life or limb sometimes cannot provide coherent but needed medical information because of mental impairment, stress, or substance abuse and is not considered to be a ''reliable historian." In such cases the committee believes it appropriate to access such data, if available, through the HDO. When the patient cannot be identified, access to the HDO might be particularly helpful if biometric (nonvolitional) identifiers are part of the database.

The committee has chosen the term "licensed practitioner" advisedly, a broader concept than "physician." Circumstances justifying access might occur in a hospital emergency department, in an intensive care unit, or outside the hospital when a health care professional is present and determines that in his or her judgment obtaining certain health information is crucial. All such cases presume that a primary medical record is not available and that no one (patient, family, or friend) can reliably provide needed health information in a timely way.

The seventh case—the release of data to licensed practitioners when treating patients in all other (non-life-threatening) situations, but only with the informed consent of the patient—is the only case in which the committee has recommended the use of informed consent to release of person-identifiable information. Such a circumstance might occur when a treating physician wishes to access the HOD database in addition to the medical records he or she keeps. For example, information on medications prescribed by other practitioners might be pertinent. In such cases, the treating practitioner should obtain explicit consent of the patient. As discussed earlier, consent might be given electronically and might be time limited.

Prohibition on Access to Person-identifiable Data

The committee recommended that HDOs not authorize access to or release of health information on individuals, with or without the informed consent of the individual, in any situation or to any requestor other than those stated above.

To ensure that individuals (i.e., patients, parents of minor children, or legal representatives) are not placed in an untenable situation concerning release of information, the committee has opted for a position that does not rely on consent procedures in most uses or disclosures of data. It prefers to rely on stringent policies against disclosure or release of personal information on individuals. It should be noted that the consent procedures described in this recommendation are for release of information by the HDO. Patients will always be able to consent to release of information by each of their care providers. Nevertheless, in some circumstances the committee envisions that consent procedures will be invoked before HDOs will release person-identifiable information.

The importance of consent as a concept, and adequate procedures for implementing consent, is accentuated by the multiplicity of uses of HDOs. Given this multiplicity, it is difficult to argue that, by providing information, record subjects have implied their consent to subsequent uses and redisclosures. It may well turn out that record subjects will have little or no idea of the number or variety of disclosures that could be made from an HDO.

Implications of Recommendations Denying Access

The reason for prohibiting broad disclosure following patient consent is that HDOs may contain a longitudinal record about all health care delivered to a patient and many personal details about the patient. Permitting the same ritual of consent to authorize disclosure of this information will result in an increased abridgment of patient privacy.

The prohibition on access to person-identifiable information is very broad. If this limitation is enacted into law or such a policy is promulgated by the HDO, it would have several consequences. For example, employers could not obtain information about "out-of-health-plan" use by their employees even for case management purposes. No access for law enforcement would be permissible through compulsory process (if prohibited by federal preemptive legislation). Attorneys could not access the database to build a case on behalf of clients except through compulsory process in accordance with governing law. Secret service agents seeking information about a person suspected of being a security threat to an elected official could not seek information from the HDO.

Prohibiting access could result in some disadvantage or inconvenience to the recordholder as well as possible harm to society. Nevertheless, the committee believes that risks to individual privacy and the importance of a clear and unambiguous policy for HDOs outweigh such possible disadvantages.

In some circumstances, the committee foresees difficult situations that seem to present a conflict between policies. For example, an individual might wish to obtain a copy of his information in the database that he could then supply to an attorney who needs it for a malpractice case or to an employer who demands it for determining new assignments or for case management purposes. The committee, as noted elsewhere, sees little way to "protect" patient information when the individual requests the information from an HDO and then transfers it as he or she sees fit.