Maine Civil Liberties Union
Comments and Proposed Amendments to LD
1653,
An Act to Amend the Law
Governing the Confidentiality of Health
Care Information
By Sally Sutton
MCLU Executive Director
The intent of the original confidentiality bill appeared to preserve and document the treatment of confidential information, putting the emphasis on the patient's right to protect that information. The bill sought authorization from the patient in most circumstances for disclosure of the information, outside of disclosures necessary for clinical treatment.
Although there may have been some flaws in the original bill, the affirmative duty of the provider was to seek authorization to release medical information, including the fact of hospitalization, from the patient.
Facilities may "own" the record, but the information contained therein belongs to the patient. The original bill required that facilities add to the patient's medical record an authorization to release certain information so the individual's wishes would be on file. In the case of emergency admission to the hospital or when the patient is incompetent to indicate his wishes, this bill attempts to provide for a surrogate to make those decisions.
Historically, laws and policies regarding confidentiality of medical information have always required some form of consent, whether oral or written, to disclose information except under requirement of law. Laws requiring disclosure without consent have typically related to public health and safety and criminal investigations. The amendments in LD 1653 will create a lawful demand for disclosure of confidential information that is unrelated to any of these overriding public concerns. The amendments diminish rather than protect the individual's right to control medically confidential information. Therefore, the MCLU has no choice but to oppose this legislation until that control is restored to the individual.
Proposed Amendments to LD 1653
- 1711 - C2. Confidentiality of health information; disclosure - Release of information for one specific purpose does not mean that it should be released for other purposes. This legislation needs to have a provision that prohibits re-disclosure of information, particularly when that information is being passed on by a provider or facility covered under this bill to another provider or facility that is also covered.
- 1711 - C3-B. Authorization to disclose provided by a surrogate - We oppose the use of the term "unable to provide," without a specific definition as to what it means. We agree there are times when an individual may be incompetent and that a surrogate must be found for those times, but this phrase, without a clearer definition, is to vague and may allow for others to decide on behalf of an individual, when in fact, that individual does have the ability to make a decision. We also believe it is necessary that the person making the health care treatment decisions for the incompetent patient must also be the one making decisions about whether or not to disclose information. The proposed amendment does not address this issue, and in fact may set up a conflict situation between family members, with one person making a decision about disclosure of information, and another family member making decisions about treatment.
- 1711 - C6. Disclosure without authorization - The MCLU has concerns about the broad sweep release of information that is allowed in this section. Not only is the list quite numerous, establishing a "right to know" for almost anyone who has any reason to use a patient's health information over the patient's right to keep the information confidential. But, it also contains no provision that the patient is notified when a disclosure is made and to whom, no requirement that the disclosure be documented, and no limitations on the amount of information that may be shared as a result of the disclosure. For example the disclosure to a family member could reach well beyond information relevant to the current situation to a release of the patient's entire medical history, or the information released to an insurer could reach into a time period before the patient was even covered by that insurer.
- 1711 - C6 A (2). We oppose the release of information outside an office,
practice, or facility without obtaining a new authorization. When an
individual enters a doctors office or a hospital they have a perception that
information will be kept confidential and not shared beyond those people
involved with their care in that practice or facility. There are many
reasons why an individual would not want their medical information to go
beyond that practitioner or group without their knowledge or consent. LD
1653 places convenience over the right of the patient to know and control
who has access their medical information. Under the proposed bill sensitive
health information is released without the patient's knowledge or consent as
to who it is being released as well as without their knowledge that there is
even the potential that it will be released.
We also have concern that the phrase "diagnosis, treatment or care" in 6-A can be interpreted quite broadly so that, for example, a pharmacist who may be offered a cash payment by a drug or insurance company to promote a specific drug and switch patients to that drug, can under this provision, contact a physician directly, without the patient's knowledge or consent, to sell this new drug to the physician, and change the patients prescription. These are practices that can occur under the guise of "diagnosis, treatment or care," but are actually a sales and merchandising activity that should not occur without the patient's knowledge or consent. This type of practice can be prohibited by requiring authorization for release of information outside a practice or facility as well as by adding a provision that sales and marketing is prohibited.
- 1711 - C6 C. Release of health information to a family or household
member - We are very much opposed to the release of information to family
members without the patient's consent. The amended bill extends to family
members the right to receive information regarding their family member
without the specific consent of the patient, unless the patient expressly
states what information and to whom it may not be released. Although many
patients consent to and want their family members to know about their
general medical condition, this also is the patient's and not the
institution's or provider's choice. Consider the situation in which a family
member or other member of the public should not receive information because
of threat to patient safety. In the context of automatic disclosure to these
groups, how will we protect against not merely unwanted but potentially
harmful disclosures. Again, control regarding such disclosures should reside
with the individual to indicate to the facility and practitioner whether
such information should be disclosed to family members or hospital
directories. (See AMA Code of Medical Ethics listed under Number 5.05
Confidentiality.)
There is s simple solution to this problem in health care facilities by the adoption of a Next of Kin form that give's the patient the right to object to the release of information and limits that which is disclosed as to information relating to current health care services.
- 1711 - C6 E. Release of information to governmental entities - There should be a requirement that all state or local agencies obtaining health care information pursuant to this section must promulgate rules establishing their record acquisition, retention, and security policies consistent with this bill.
- 1711 - C6 F. Before there is release pursuant to a court order there should be a requirement that the patient be provided notice about what information is sought, from whom it is sought, and the date for compliance. Without the consent of the patient the health care provider or facility should not comply unless notice has been given to the patient.
- 1711 - C6 L. Release of information for payment - This section is not only unnecessary, but also once again sacrifices patient control over information to the convenience of the insurers. It is unnecessary because part of the underlying contract an insurer has with the insured already provides some limited form of authorization. Why do insurance companies need further statutory rights? What is the problem that this provision is seeking to correct? Isn't this issue more appropriately addressed in the insurance code? Patient control over who has access to a medical record should not be sacrificed for the convenience of insurers.
- 1711 - C6 M. This provision expands access to information when no cases were made for why this expanded access needed to occur. All of these institutions already have procedures in place for obtaining the information needed about immunizations, and absent an argument or justification from these entities as to why the situation should be changed, it is inappropriate for automatic access to be expanded at the expense of the privacy of the individual.
- 1711 - C6 N. Appointments - We do not oppose a provision in the bill that would allow confirmation and reminders about appointments. We question the wording of the suggested amendment, who is the "person" to whom the information about an appointment is to be released? And, is the individual patient notified that a reminder will be provided, and given an opportunity to decline the reminder or set restrictions on the notification?
- 1711 - C6 P. We are uncertain of the need for this group of entities to be broken out from others who have need for directory information and suggest that the committee study further the potential ramifications of this authorization. Who is the "person representing" the entity? Why is this provision not limited to health care facilities? We have serious concerns about why the "person representing" these entities will be contacting health care providers, and need a clearer understanding and justification of the need for these contacts.
- 1711 - C6 Q,R and S. The MCLU is very much opposed to the expansion of
groups receiving automatic information pursuant to these provisions. The
perception that the media has a "right to know" has no basis in law, and is
once again placing the desire by health care facilities to increase
administrative efficiency and convenience to deal with a variety of interest
groups, over the rights of the patient. Of course these groups should have
the ability to offer their services to or communicate with patients, but
what has happened to the threshold requirement for patient consent in the
process. This bill shifts the burden from the health care facility or
provider from having to obtain consent for the release of information to the
patient, so that unless the patient expressly states that information cannot
be released and to whom it may not be released, the patient must assume that
their private medical information will released to every one who asks for
the information, without their knowledge or consent.
This bill goes against the AMA's own Code of Medical Ethics which states with regard to the media: "When information concerning a specific patient is requested by the media, the physician must obtain the consent of the patient or an authorized representative before releasing such information." With regard to the general release of information the Code states: "The information disclosed to a physician during the course of the relationship between physician and patient is confidential to the greatest possible degree. The patient should feel free to make a full disclosure of information to the physician in order that the physician may most effectively provide needed services. The patient should be able to make this disclosure with the knowledge that the physician will respect the confidential communications or information without the express consent of the patient, unless required to do so by law."
There is a solution to this problem that is not unduly burdensome but merely a simple administrative task for hospitals at the time of admission to present inpatients with a form indicating the patient's wish to receive clerical visits or to provide general directory information. The alternative, as is proposed in this bill, simply turns over information automatically, and essentially deprives the individual of the right to say no. I doubt that most members of the public believes there is an inherent right in the media or clergy of all faiths to know about one's admission to the hospital or one's medical condition. Passage of this proposed bill would have the effect of deeming this information no longer confidential and, therefore, appropriately in the public domain, or that the public interest should be weighed as more important than the individual's own interest in his or her confidential medical record. Neither conclusion is supportable by any common law or statute.
LD 1653 proposes no opportunity for a patient in a health care facility to be notified that they may object to release of this information, and in fact a reading of 1711 - 6 - "A health care practitioner or facility may disclose, or when required by law must disclose, health care information without authorization to disclose" could be interpreted to mean that disclosure to the press, clergy and family would be required by this law and that a patient, even if they objected to having their information released, would no longer have a right to keep the information confidential.
Attached to these comments is a proposed amendment for how to treat directory and, that still for the most part will allow access to the type of information sought under these provisions, but still would provide patient control over the disclosure. Any individual should be able to seek treatment in a health care facility in Maine without fear of having their health conditions all over the papers, or spread around the churches in their community, without their knowledge or consent.
- 1711C - 13. Enforcement - We have concerns that the enforcement section
of both the earlier law and this proposed amendment are so weak as to make
bringing actions under this law almost. The removal of the "negligent"
violation removes from health care providers and facilities the
responsibility for taking steps to protect information and comply with the
law. We have concerns that with the work load of the Attorney General's
office, what may seem to them to be a minor violation of the law, but
significant to the individual who has been harmed, will not be prosecuted.
Consequently, the individual will have to bring a private action against only intentional violations, for which they can obtain no attorney fees if they win, and any penalties that are paid go to the State. This means that bringing any action will have costs associated with it that are prohibitively expensive, and must be absorbed by the plaintiff, even if they win the suit. We recommend that this committee consider adopting penalty provisions comparable to those contained in the companion insurance bill that passed last year. There is no justification for why an individual should have less protection from the illegal release of their medical information by a health care provider or facility than they do by an insurance company.
- 1711C - 15. Immunity - We have serious concerns that this section may not only conflict with but negate other Maine law. As is stated in 1711C - 2. Confidentiality of health information; disclosure: "Nothing in this section prohibits a health care practitioner or health care facility from adhering to applicable ethical or professional standards provided that these standards do not decrease the protection of confidentiality granted by this section." By removing any ability to bring actions under any other laws for releases of information allowed under this law but not others, this law essentially negates any greater privacy protections that may be provided in those ethical or professional standards, or as provided anywhere else in Maine law. This section should be eliminated.
