June 28, 2000

Support Amendments To Strengthen Medical Privacy Act

Dear Member of the House Banking Committee:

The undersigned organizations write to express serious concerns about the version of the Medical Financial Privacy Protection Act (H.R. 4585) scheduled to be marked up by the House Banking Committee tomorrow.

As introduced, H.R. 4585 could fairly be considered a pro-privacy bill. At the Committee's hearing on June 14, 2000, consumer and privacy-oriented witnesses proposed ways in which the protections in the bill could be strengthened. In particular, several groups proposed that the bill be expanded beyond medical privacy to address other privacy gaps in the Gramm-Leach-Bliley law. But at least the bill as introduced provided a baseline of protections for health information.

Regrettably, a Chairman's Mark has now been circulated that incorporates numerous changes weakening the privacy protections in the original bill. It appears to us that the financial services industry has convinced the bill's sponsors to adopt these changes so that they may continue practices that violate the privacy of consumers. Among our objections to the Chairman's Mark - some of which are unresolved flaws in H.R. 4585 as introduced -- are the following:

• The Mark contains expansive exceptions to the privacy protections in the bill. Under a new exception banks will be able to freely share sensitive health information about their customers with third parties for marketing and for any purpose related to the customers' account. In the absence of a provision limiting the existing loopholes in Gramm-Leach-Bliley, this new exception simply further erodes meaningful protections. Another exception will allow insurance agents and brokers to share sensitive health information about employees in a group health plan.

• The current version of the bill enables banks to avoid obtaining consumer consent. For example, a bank does not have to give their customers the ability to consent to the sharing of their health information if the information is used to "facilitate customer service." This could mean banks will use sensitive health information for just about any purpose, including telemarketing -- all in the name of providing a customer service.

• There is nothing in the Chairman's Mark to prevent banks from coercing individuals to agree to consent to the sharing of their information.

• The draft only applies to health information, not to sensitive financial information, such as data about purchases and other transactions. Consumers should be able to consent before any sensitive information is shared.

• While the bill provides additional protections for "especially sensitive health information," designated as mental health information and HIV status, the exceptions will apply to those categories as well.

• The Chairman's Mark still only limits the use of health information to decisions about credit or loans. A bank could use health information to price other financial products or services.

• The bill appears to apply prospectively only in that it does not limit the use of information previously collected to make credit and loan decisions about customers.

We understand that amendments may be offered to limit or strike these exceptions, and to add some of the additional protections we have recommended. These amendments will likely delete the marketing exception, narrow the customer service exception, prohibit coercion of consumers regarding the consent agreement, and allow consumers to consent before a bank can share any personally identifiable sensitive information.

The Banking Committee should work to ensure that sensitive medical information is truly protected by allowing consumers to consent before that information is shared by adopting those amendments. If the Chairman's Mark is not improved significantly, we urge members to oppose the bill.

Sincerely,

Ron Weich
American Civil Liberties Union

Ken McEldowney
Consumer Action

Travis Plunkett
Consumer Federation of America

Nicole Beason
Frank Torres
Consumers Union

Andrew Shen
EPIC

Ed Mierzwinski
U.S. Public Interest Research Group

Mary Rouleau
Int'l Union, United Automobile, Aerospace and Agricultural Implement Workers of America

Robert Bulmash
Private Citizen, Inc.

Beth Givens
Privacy Rights Clearinghouse

Copyright 1999, The American Civil Liberties Union