Dr. Jeffrey Singer, a frequent contributor to these pages, wrote Feb. 23 of the threat to privacy that the federal Health Insurance Portability and Accountability Act (HIPAA) poses in the name of protecting privacy.
HIPAA, to be administered by the U.S. Department of Health and Human Services, was intended to protect the unauthorized sharing of electronic medical files with interests outside a doctor’s office or hospital, according to Ian Marquand, freedom of information committee chairman for the national Society of Professional Journalists.
“However, when considering its rules, HHS ignored the issue of a compelling public interest for certain health and medical information of admitted hospital patients,” Marquand said. “Thus, the rules contain no provision for hospitals to release information if there's a pressing public need.”
Singer highlighted that provisions of the act, to become effective in April, will enable federal officials to have access to every doctor’s and patient’s medical records, including psychotherapy notes, in a twisted attempt to insure that doctors are keeping patient records private themselves.
As frightening as that is, as Marquand points out, HIPAA presents even more disturbing realities: Denial of access to medical information to family, friends and clergy of patients — or to anyone who wants to know who was hurt and how badly.
Imagine you’re expecting a visit from your brother, but he is long overdue. There’s no one at his home and he hasn’t answered his cell phone. Your TV shows you a live report from the scene of a serious auto accident along the route your brother usually takes. Strangely, the reporter doesn’t give the names of any injured people. Concerned, you call nearby hospitals to find out if your brother is there.
Before HIPAA, that information would have been available. Under HIPAA, it won’t be. Either your brother walks through your door unharmed, or you will be getting a visit from a police officer telling you something happened to him. But you’ll have to wait for either to happen; there’s no way for you to find out.
And there was a reason that reporter didn’t inform the public who was injured in that accident. Under HIPAA, ambulance workers or hospital employees fear prosecution for revealing such information.
No public interest exemption exists under the law. Harsh penalties await violators. This means hospitals will crack down on patient information, Marquand said, even if those hospital employees believe there might be a public interest involved. Only through a patient’s written permission will a hospital be able to acknowledge that a patient was even admitted, much less about how serious is his or her condition.
Unconscious patients who suffer injuries from accidents are not in a position to sign anything. These patients could be as dear to us as our brother, or as important to the community as a high-ranking public official.
And what about the dangers posed by growing threats of terrorism, such as major infectious disease outbreaks, toxic spills or releases or another health-related disaster?
Charles N. Davis, executive director of the Freedom of Information Center at the University of Missouri, recently wrote that the key phrase in HIPAA is "individually identifiable health information," which as currently defined as any health information that identifies or can be used to identify the individual.
“Imagine how much worse the chaos of the terrorist attacks in New York, for example, had medical facilities been barred from disclosing the number of people who were injured and the seriousness of the injuries,” Davis wrote in a publication of the Investigative Reporters & Editors. “A dramatic example, but then think about the many contexts in which information about the medical condition of individuals becomes paramount: environmental or natural disasters, neighborhood crime, the medical condition of public officials, misconduct by health care providers, health epidemics or plagues, injuries caused by consumer products, and even births or deaths in a community.”
HIPAA is an example of much about government intrusion: It starts with the best intentions and becomes the worst nightmares. It codifies privacy for privacy’s sake, on the notion that all publicly held information about individuals should be shut off to public access.
But when the law allows government officials to be the only ones with access to information about you, the damage that could be wrought by abuse of that access are far greater. As Davis wrote:
“Medical records tell us about poorly managed health care systems, the abuse of elderly nursing homes, unethical research projects and abuse of children in foster care. They have told us about the overstated effects of highly touted drugs, and helped tell the story of the effects of drunk driving and illegal drug use. They also let us read in the next day’s newspaper that the family in the accident we drove past last night is OK. “The public interest in access to newsworthy medical information often outweighs the privacy interest in nondisclosure.”
Congress should amend HIPAA to provide exemptions for matters of public interest that still protect privacy rights — and equally protect citizens from an unchecked government.