LEXIS-NEXIS® Congressional Universe-Document

Search Terms: medical w/5 information w/5 privacy, House or Senate or Joint

Document 106 of 124.

View Related Topics

APRIL 27, 1999, TUESDAY

SECTION: IN THE NEWS

LENGTH: 5177 words

HEADLINE: PREPARED TESTIMONY OF
RONALD WEICH
PARTNER
ZUCKERMAN, SPAEDER, GOLDSTEIN, TAYLOR & KOLKER, L.L.P.
LEGISLATIVE CONSULTANT TO THE AMERICAN CIVIL LIBERTIES UNION
ON BEHALF OF THE AMERICAN CIVIL LIBERTIES UNION
BEFORE THE SENATE COMMITTEE ON HEALTH, EDUCATION, LABOR, AND PENSIONS
SUBJECT - "MEDICAL RECORDS CONFIDENTIALITY
IN A CHANGING HEALTH CARE ENVIRONMENT"

BODY:

Mr. Chairman and Members of the Committee: My name is Ronald Weich. I am a partner in the law firm of Zuckerman, Spaeder, Goldstein. Taylor & Kolker, and a legislative consultant to the American Civil Liberties Union (ACLU). I am pleased to appear before you today on behalf of the ACLU to discuss the issue of medical records confidentiality, and, more specifically, to address the question of law enforcement access to medical records.
The ACLU is a nationwide, non-partisan organization of nearly 300,000 members dedicated to protecting the principles of liberty, freedom and equality set forth in the Bill of Rights to the United States Constitution. For almost 80 years, the ACLU has sought to preserve and strengthen privacy in all aspects of American life. In addition to representing the ACLU, I bring two additional perspectives to this hearing. First, I served as an Assistant District Attorney in New York City from 1983 to 1987 and prosecuted numerous criminal cases in which medical evidence was at issue. Second, from 1989 to 1997 1 served as counsel to this Committee and then to the Senate Judiciary Committee, and participated in the development of federal criminal justice and health care policy during those years. Of particular relevance is my work for Senator Kennedy on mental health and substance abuse issues, two fields in which the confidentiality of medical records is essential.
My testimony is divided into three parts. The first section presents an overview of the ACLU's views on the privacy of medical records. The second section specifically addresses the circumstances under which law enforcement authorities should be granted access to an individual's medical records. The final section discusses other civil liberties implications of the medical records bills under consideration by the Committee.I. OVERVIEW
Advances in technology have brought about a revolution in every aspect of health care, including the manner in which medical information is maintained and disseminated. Today, medical data can be collected, combined, collated, analyzed and distributed faster and easier than ever before. Huge quantities of health-related information can be stored electronically and transmitted across the country and around the globe with the click of a computer mouse. Much of this electronic activity benefits individual patients and facilitates public health efforts as well. But, like many technological advances, society's increased reliance on computerized medical records presents significant challenges to privacy.
Computer technology makes medical record keeping vastly more efficient. In the absence of legal safeguards, however, it also allows for virtually unlimited access to medical records without the knowledge or consent of the patient whose records are accessed. Health care providers and researchers are motivated to gather and share such information to improve the quality of care. But other entities may gather medical information for commercial and other non-medical purposes: pharmaceutical companies may want to solicit potential new customers, insurance companies may want to insure healthy policy holders and avoid unhealthy ones, employers may want to avoid hiring or keeping unhealthy employees on the payroll, and law enforcement agencies may be tempted to view computerized medical records as a vast new centralized data base to search for clues to crime.Privacy is vital in the health care context because trust is a fundamental component of the doctor-patient relationship. Since medical records contain particularly sensitive and intimate information, patients are susceptible to humiliation and discrimination in the event information from their medical records is improperly disclosed. The horror stories are well known, but a few bear repeating:
- In Maryland, a banker improperly accessed a medical database to determine which of his borrowers had been diagnosed with cancer. Once such individuals had been identified, the bank improperly attempted to terminate its lending relationship with them.
- The chain drug store CVS, and grocery chain Giant Food recently conceded that they had disclosed their customers' prescription records to a direct mail company that then tracked customers and solicited them to consider alternative treatments. After media reports sparked public concern, both companies discontinued this practice.
- A study by the University of Illinois found that thirty five percent (35%) of Fortune 500 companies admitted to checking medical records prior to hiring or promoting employees.
- A 1997 survey by the American Management Association found that as many as ten percent (10%) of the 6,000 companies surveyed used genetic testing for employment purposes. The Council for Responsible Genetics, a Massachusetts based advocacy group, has documented hundreds of cases in which healthy people have been denied insurance coverage or employment based largely upon genetic "predictions" regarding their future health.
All of these examples involve the use of medical records for a purpose that does not benefit -- and indeed may harm -- the patient whose records are used. As a general matter in our country, property owned by an individual may not be used by a custodian of the property for any purpose without the owner's consent, and certainly not for a purpose that would harm the owner. But current law does not adequately recognize a patient's "ownership" of his or her medical records.
The ACLU believes that patients own their medical records, and that health care providers or insurance companies who maintain those should be viewed as custodians of the patients' property. We believe that medical records in the possession of health care professionals or third party payors are like client files in the possession of attorneys. The patient or the client retains ultimate control over the disclosure of information in their records. If follows that (1) patients may reasonably expect that their personally identifiable health information will not be disclosed to anyone unless they have given specific and express written consent, and (2) medical records must be protected from unauthorized access to the fullest extent practicable.
These straightforward objectives are elusive because the United States lacks a coherent and consistent medical privacy policy. A patchwork of state laws affords varying levels of protection to citizens in some jurisdictions. That is insufficient. A nationwide law, such as those under consideration by this Committee, is needed to establish a baseline of medical privacy protections at the dawning of the digital communication age.
Congress itself has recognized the need for federal legislation. As this Committee well knows, the 1996 Health Insurance Portability and Accountability Act includes a provision setting an August 1999 deadline for enactment of a comprehensive medical privacy law. If Congress does not act by that date, the Secretary of Health and Human Services is authorized to enact privacy protections by regulation.

With the deadline only four months away, attention is focused on three Senate bills: (1) S. 573, the Medical Information Privacy and Security Act proposed by Senators Leahy, Kennedy, Daschle and Dorgan ("Leahy-Kennedy"); (2) S. 578, the Health Care Personal Information Nondisclosure Act proposed by Senators Jeffords and Dodd ("Jeffords- Dodd"); and (3) a bill soon to be introduced by Senators Bennett and Mack.*
The ACLU commends all of the Senators who have introduced or will introduce bills on this subject for seeking to enhance privacy, and we especially applaud Chairman Jeffords for introducing a bill this year that contains significant improvements over the bill he introduced last year, especially in the area of preemption. Nonetheless, the American Civil Liberties Union has formally endorsed S. 573, the Leah?Kennedy bill, which we believe includes privacy safeguards superior to those contained in the other bills introduced in this and prior Congresses. In the balance of this statement I will explain our decision to support that bill, and propose some additional protections.
II. LAW ENFORCEMENT ACCESS TO MEDICAL RECORDS
I have been asked to focus my attention today on the issue of law enforcement access to medical records, and it is an aspect of the policy debate in which the ACLU's preference for the Leahy-Kennedy bill is especially strong. This is true because we believe in the principle, embodied in S. 573, that government agents should be required to obtain judicial approval under a meaningful probable cause standard before they are granted access to medical records containing personally identifiable information.
Both the Jeffords-Dodd and Leahy-Kennedy bills appropriately establish limits on law enforcement access to medical records. Both bills recognize that the computerized medical records of ordinary law abiding Americans are not to be viewed as a centralized law enforcement database like the mugshots or fingerprints of convicted criminals currently maintained by the police. But only Leahy-Kennedy requires law enforcement officers to obtain a court order, or its functional equivalent, before gaining access to medical records, and only Leahy-Kennedy sets a sufficiently high legal standard for such court orders.
Under section 208 of the Leahy-Kennedy bill, a law enforcement agent who wants to view medical records would be required to demonstrate probable cause to believe that (1) the information is relevant and material to an ongoing criminal investigation; (2) the investigative needs of the agent cannot reasonably be satisfied by de-identified health information or by any other information; and (3) the law enforcement need for the information outweighs the privacy interest of the individual to whom the information pertains.
In effect, this legal standard would bring requests for medical records within the protection of the warrant requirement of the Fourth Amendment, notwithstanding the fact that the records are not physically within the possession of the patient. If an individual happens to maintain his or her own x-rays in a desk drawer at home, the Fourth Amendment applies, of course, to an effort by the police to search the desk and seize the x-rays -- a search warrant issued by a neutral magistrate based on probable cause would be required. The Leahy-Kennedy bill recognizes that a patient maintains the same ownership interest in x-rays maintained in a doctor's office or in a hospital's computer as in the x-rays kept at home. Applying a Fourth Amendment-like standard to medical records maintained by a third party makes sense, because the Fourth Amendment itself balances the interests of individuals to be secure in their personal papers and effects on the one hand, and the legitimate needs of law enforcement officials on the other.
Moreover, this provision is similar to the protection that Congress has already afforded to individuals with respect to the contents of their electronic communications generally (18 U.S.C. Section 2703), information pertaining to video rentals (18 U.S.C. Section 2710). and subscriptions to cable programming (47 U.S.C. Section 551). Certainly, stored electronic communications, video rental records and cable subscriptions are no less deserving of privacy protection than statements made to a health care provider during the course of medical treatment. Personal medical records should be entitled to no less statutory protection than that currently in federal law for these other everyday transactions.
In addition to establishing a strong legal standard for the issuance of a court order or warrant, the Leahy-Kennedy bill limits the use of protected health information after its disclosure. Specifically, Leahy-Kennedy provides that where protected health information has been disclosed in one investigation, it cannot be used in any other investigation unless the secondary investigation arises out of or is directly related to the investigation for which the protected health information was initially obtained. This balanced approach permits law enforcement officers to conduct legitimate investigations and follow the natural progression of those investigations to conclusion while assuring that protected health information will not be used in an unrelated investigation absent the same type of probable cause proffer that led to the original court order or warrant.Finally, the Leahy- Kennedy bill contains the important protection of notice to the person whose records are to be searched and an opportunity for that person to contest the appropriateness of the search. It is entirely consistent with notions of due process in our adversarial system of justice that a judge considering whether or not a prosecutor's application for access to medical records meets the legal standard for such access should hear from the other side of the dispute. If there is any risk that notice to the individual would lead to destruction of the records, Leahy-Kennedy permits waiver of the notice requirement. But in an ordinary investigation, notice is appropriate, fair and not unduly burdensome.
As we have noted, the Jeffords-Dodd bill also contains limits on lax,,, enforcement access to medical records, but there are four basic reasons why the ACLU prefers the Leahy-Kennedy approach to this subject:
First, while Leahy-Kennedy requires the police to obtain a court order or a grand jury subpoena to access medical records, the Jeffords-Dodd bill permits access to records by means of an administrative subpoena or a summons, neither of which is reviewed by a court or even issued in the name of a court-supervised body like a grand jury. Administrative subpoenas are typically used by regulatory agencies like the Department of Agriculture or the Occupational Safety and Health Administration to inspect industrial facilities. Summonses are simply demand letters issued on law enforcement stationery. The ACLU believes that personal medical records should not be searched based on summary, self-interested, non-judicial legal instruments such as these. After all, the police are engaged in what Justice Cardozo called the "often competitive enterprise of ferreting out crime," Johnson v. United States, 333 U.S. 10 (1948), and cannot be
- expected to balance neutrally the competing goals of privacy and law enforcement.
Second, the probable cause standard contained in the Jeffords-Dodd bill is not as comprehensive as its counterpart in Leahy-Kennedy. The standard in each bill requires a showing of relevance, although Leahy- Kennedy calls for a more particularized showing of need. More important, the Leahy-Kennedy standard contains two prongs that JeffordsDodd does not -- it requires law enforcement to demonstrate that its needs could not be satisfied using de-identified or other information rather than protected health information, and that the need for the information outweighs the individual's privacy interests. These additional prongs in the Leahy-Kennedy standard still fall within a probable cause test, so they do not pose an insurmountable barrier to law enforcement access. But privacy considerations get a fuller airing under the Leahy-Kennedy probable cause standard than under the Jeffords-Dodd probable cause standard.
Third, the law enforcement access section of the Leahy-Kennedy bill, unlike the parallel provisions of Jeffords-Dodd, requires, if practical, prior notice to the individual whose health records are to be searched. The absence of a notice requirement in JeffordsDodd is a serious omission in the ACLU's view, because we believe that privacy interests can best be asserted by the person whose privacy is about to be violated. Indeed, we believe that federal law should go a step further than Leahy-Kennedy and require that, where prior notice is not practical, the patient receive after-the-fact notice of the search so that he or she may pursue legal remedies to limit the use of information that has been obtained. But at least Leahy-Kennedy provides for notice and an opportunity to be heard in most circumstances - without notice, a patient's right to privacy in this context will too often remain unarticulated.
Fourth and finally, Leah?
Kennedy more scrupulously guards against derivative use of the private health information obtained by law enforcement. Jeffords-Dodd provides that protected health information obtained by a law enforcement agency may only be used "for purposes of a legitimate law enforcement inquiry.

" In contrast, Leah? Kennedy actually prohibits use of the information in any administrative, civil or criminal action against the patient unless the subsequent action arises out of or is directly related to the initial inquiry. In light of the fact that Jeffords-Dodd does not require that the subject of the protected health information be given notice either before or after the disclosure, the absence of any nexus between the initial request and the ultimate use of the records significantly reduces the value of the privacy protection in that bill.
In fairness to the Chairman and Senator Dodd, I hasten to point out that their law enforcement access provision contains at least one important privacy protection that the Leah?Kennedy bill does not. We welcome section 210(f) of the Jeffords-Dodd bill, which explicitly excludes improperly obtained protected health information from court proceedings. The judiciary would likely find such an exclusionary rule to be implicit in Leahy-Kennedy, but that is not certain, and we therefore urge that this component of the Jeffords-Dodd bill be included in any legislation the Committee ultimately reports to the full Senate. Of course, the value of an exclusionary rule in any privacy bill depends on the extent of the protections that the exclusionary rule enforces, and the Jeffords-Dodd protections fall short, for the reasons already discussed. The ACLU seeks a bill with strong protections and an explicit exclusionary rule to give those protections teeth.
The Chairman's bill also deserves praise because it omits a potential privacy loophole regrettably included in Leahy-Kennedy. I refer to section 208(i) of the Leahy-Kennedy bill, which creates a blanket exception to the bill's protections for information gained while in "hot pursuit" of a suspect. Traditionally, the hot pursuit doctrine has been applied by courts in cases where a suspect might evade arrest or evidence might be destroyed if the police interrupted pursuit to obtain a warrant. That doctrine would seem to have no relevance to an effort to obtain non-mobile evidence such medical records, and in any event is adequately addressed by subsection (d)(2)(B) of the bill, which waives the notice requirement if there is a risk of destruction or non-availability of the evidence. We therefore urge deletion of section 208(i) in S. 573.
Thus far I have listed the ways in which the Leahy-Kennedy bill is generally more protective of privacy vis a vis law enforcement than the Jeffords-Dodd bill, and noted two ways in which Jeffords-Dodd is more protective of privacy vis a vis law enforcement. But that analysis raises a more fundamental query,: why should privacy interests ever outweigh the needs of law enforcement? I will answer my own question from three perspectives:
As a former prosecutor, I report to you that law enforcement can function very effectively within a probable cause framework. Respect for the Fourth Amendment and the privacy values it embodies do not unduly hamper police and prosecutors; indeed, in my experience, the exercise of prosecutorial and police power within rules that protect privacy actually increases citizen trust in law enforcement and encourages law abiding behavior. When law enforcement officers are seen as overzealous or overly intrusive, the breakdown in trust and cooperation between government and its citizens has a corrosive and dangerous effect on police and prosecutorial effectiveness.
As a former health policy staffer, I suggest to you that high quality medical treatment relies on candor. Health care providers cannot adequately treat a patient without detailed, intimate information about the patient's medical history and current condition. This is particularly true in such sensitive fields as mental health and substance abuse, where patients may actually avoid treatment altogether if they fear that their treatment records are subject to routine scrutiny. Rules that safeguard the integrity of medical records facilitate the exchange of information between patients and doctors, and that makes for better health care.
Finally, as a civil libertarian, I contend that privacy is itself a value, however intangible, that civilized society must nurture and protect even at the expense of efficient law enforcement. The police would catch a lot more criminals if they could search citizens without cause on the streets and in their homes. But that is not the constitutional system that the Founding Fathers bequeathed to us, and thankfully so.
III. OTHER CIVIL LIBERTIES IMPLICATIONS OF PENDING MEDICAL PRIVACY BILLS
Beyond law enforcement access, the Leahy-Kennedy bill provides more comprehensive privacy protections than other pending medical privacy bills in a number of respects, the most important of which are outlined below: .
A. Authorization.
Both Leahy-Kennedy and Jeffords-Dodd require informed consent before patient records are disclosed to third parties, with certain exceptions such as the law enforcement access provisions already discussed. But the Leahy-Kennedy bill approaches the authorization issue in a manner more protective of privacy because the scope of their general release obtained for reimbursement purposes does not extend to "health care operations" or related research carried out within the payor organization. Rather, those activities would properly be subject to regulations regarding health research and concomitant review by an Institutional Review Board.
Leahy-Kennedy also permits patients to exercise a greater degree of control over access to their medical records because the authorization mandated by that bill would inform the patient of the nature of information to be disclosed, the type of person to whom information would be disclosed, and the purposes for which disclosures would be made. In addition, the authorization under Leahy-Kennedy would permit the patient to restrict disclosure of information to certain individuals. Jeffords-Dodd offers no comparable rights.
B. Public Health.
Both Leahy-Kennedy and Jeffords-Dodd appropriately seek to preserve public health functions without unduly infringing on privacy values. Again, however, the ACLU supports the approach set forth in Leahy- Kennedy because it offers individuals greater protection with respect to their medical records. Leahy-Kennedy permits personally identifiable medical records to be disclosed to a public health authority without consent only where the information relates to a specific public health purpose, is reasonably likely to achieve that purpose and cannot be achieved without access to personally identifiable information. Leahy-Kennedy also clearly defines the terms "public health purpose," thereby reducing the risk of improper disclosure.-
In contrast, Jeffords-Dodd simply permits the disclosure of personally identifiable health information if it is used for (1) a disease or injury report, (2) public health surveillance, or (3) public health investigation or intervention. Jeffords-Dodd does not require the public health authority to establish any nexus between the personally identifiable information and the purpose of the disclosure. The broad authority of public health authorities to receive personally identifiable health information under this provision, however well intentioned, is at odds with the expressed purpose of the legislation. The more personal health information in general circulation, the greater the potential for abuse of that information and the less trust between patients and health care providers.
Similarly, while both bills provide for the disclosure of protected health information to health oversight agencies, Leahy-Kennedy takes account of the purpose for which the information will be used, and contemplates safeguards to protect the integrity of health information so disclosed. In contrast, Jeffords-Dodd contains no provision protecting individuals from unwarranted disclosures by an oversight agency. The LeahyKennedy bill, therefore, offers superior privacy protection in this regard.
C. Medical research.
High quality biomedical and behavioral research benefits all Americans and is a hallmark of our health care system. Both bills address concerns that new privacy protections might inadvertently impair research activities.
Neither Leahy-Kennedy nor Jeffords-Dodd restricts in any way the use of anonymous or de-identified medical records for research. The bills only regulate research that employs medical records containing personally identifiable information. Moreover, federally funded medical research, clinical investigations using human subjects and certain other research subject to the Federal Policy for the Protection of Human Subjects. are already regulated and, therefore, would not be affected by the pending legislation.
Leahy-Kennedy would apply a uniform standard of accountability and oversight when personally identifiable data is used in either federally funded or non-federally funded medical research.

Thus all research using personally identifiable information would be subject to review by Institutional Review Boards ("IRBs"), which currently evaluate whether personally identifiable health information is necessary to a research project that receives federal funding. In contrast, Jeffords-Dodd excludes investigations conducted in connection with "health care operations" from the definition of health research. Thus, under Jeffords-Dodd a managed care provider could use personally identifiable health information for its internal research without review. In addition, under Jeffords-Dodd, use of personally identifiable health information in connection with privately funded research and research supported by commercial entities remains unchecked by Institutional Review Boards.
For privacy purposes, we perceive no basis to differentiate among entities conducting health research using protected health information. Nor should the source of funding control the analysis. Rather, the better rule is to subject all health research to the same minimum standard of review before access to protected health information is granted. The ACLU therefore prefers the research provisions in Leahy-Kennedy.
We wish to propose one additional protection not contained in either bill. The use of even de-identified health information should be limited to the purposes of the Act,including research, and unauthorized use of de-identified information should constitute a violation of the Act. Our concern here is that the de-identification process may not always be absolute; in order to avoid unintended violations of privacy, even de-identified health records should not be recklessly or carelessly disseminated.
D. Civil litigation.
Consistent with the goal of privacy, disclosure of protected health information in civil litigation should occur only after it has been established that the information is material to the adjudication, such as when a litigant has placed his or her medical condition at issue. Both bills provide a mechanism under which protected health information is made available to litigants, but in our view LeahyKennedy offers a better balance between the interests of litigants and the rights of non-parties.
Leahy-Kennedy permits a court to order the disclosure of protected health information upon a showing that the information is necessary for the adjudication of a material fact and the need cannot be satisfied using de-identified information. Also, absent exigent circumstances, Leahy-Kennedy requires notice to given to the individual who is the subject of the records before any disclosure occurs.
Under Jeffords-Dodd a court may order disclosure of protected health information after a litigant has established that presentation of its claims or defenses would be impaired without the information. The ACLU believes that this lower standard is insufficient to outweigh the important privacy rights of the patient whose records are sought. However, Jeffords-Dodd directs the court to impose specific obligations on the parties to the litigation in order to protect the privacy of the medical records, an important refinement not present in Leahy-Kennedy.
E. Preemption.
The ACLU strongly supports the non-preemption policy embodied in the LeahyKennedy bill. While the Jeffords-Dodd bill preempts far fewer state laws than the bill introduced by the Chairman last Congress, it would unacceptably preempt efforts by states to enact more stringent privacy laws in the future.
It has been argued by others that preemption of state medical records privacy laws is necessary to avoid confusion over which state law applies in an era of nationwide health care plans and insurance companies. But the Leahy-Kennedy bill solves that problem by establishing the principle that patients own their own medical records. Therefore, the domicile of each patient serves as a concrete reference for the determination of whether additional privacy protections enacted by a particular State would apply. Under Leahy- Kennedy, a State would remain free to address privacy needs -- some local in nature -- that may arise in the future.
As a rule, federal privacy laws outside the health care arena -- such as those described earlier in this testimony -- have not preempted state laws. The examples of coexisting Federal and State regulations are legion, and there is simply no justification for usurping the longstanding rights of States to legislate privacy protections for their citizens. Any federal law should set the foundation upon which privacy protections rest without inhibiting states from acting to enhance those protections.IV. CONCLUSION
For the reasons described above, the American Civil Liberties Union has endorsed S. 573, the Leahy-Kennedy medical records privacy bill. But we again wish to praise Chairman Jeffords and all the other members of the Senate who have taken steps to address this important subject, and we look forward to working with the Committee to make sure that a strong medical records privacy bill is signed into law prior to the August deadline.
ENDNOTE:
* We understand that Senators Bennett and Mack may introduce their bill the day before this hearing, too late to be included in this written analysis. The ACLU would be pleased to supplement its submission to include a comparison of the Bennett-Mack bill with the two bills already introduced, if the Committee so requests.
END

LOAD-DATE: April 28, 1999

Document 106 of 124.


Search Terms: medical w/5 information w/5 privacy, House or Senate or Joint
To narrow your search, please enter a word or phrase: