Medical Records Are All Too Often A Leaky Sieve

        By T. Evan Schaeffer

        Since at least 1994, concern about the confidentiality of medical records has been an important, though little known, aspect of the Congressional health care debate.  Though not a headline grabber, the issue of medical privacy is finally attracting some much-deserved attention this Congressional term, as two very different bills are being considered by the House and the Senate. 

        Medical privacy is not a difficult concept.  It means that the secrets revealed to doctors in the examining room should remain secret.

        The difficulty comes when others also want the details.  Insurance companies, drug marketers, medical researchers and employers ask for medical secrets.  But that access should be granted according to standards that properly balance the competing interests and provide patients with an opportunity to be fully informed and to object if necessary along the way.

        While simple enough in the abstract, this is far from what's actually taking place. 

        A number of myths prevail about the confidentiality of medical records.  Many otherwise well-informed consumers remain ignorant about the ways that gaps in the existing law make it possible for others to learn their potentially embarrassing secrets. 

        Some believe that the privacy of medical records is already protected by federal law.  Not so.

        With only a few exceptions, medical privacy is presently governed only by state law.  Many states, however, don't protect the confidentiality of medical records, or do it only in a piecemeal, patchwork way.  The states that do grant some protections don't always recognize a patient's interest in being fully informed about who's looking at their medical records, and why.

        Can patients count on their physicians and hospitals to safeguard their interests?   Not always.

        Even though the sanctity of medical privacy is recognized by the Hippocratic Oath, some hospitals and physicians (though far from all) are lax about privacy.  Others are pressured into revealing sensitive information by entities higher up in the medical food chain.

        Some patients mistakenly believe the information in their medical records is not sensitive enough to warrant a lot of fuss and bother.  Setting aside the fact that a person's medical history changes over the years, even the most innocuous medical records often contain information about where a patient lives, what a patient earns, and other personal information that can be used, or misused, for a variety of purposes. 

        The danger to medical privacy grows more real as physicians, hospitals and health care networks switch from paper-based to computerized medical records.  Eventually, the result will be vast accumulations of patient data that can be easily transmitted by computer.  This benefit for health care administrators will be a problem for patients.  Without proper safeguards, anyone with a password can gain access.

        Against this backdrop of patchwork laws and changing technology, two very different bills are being considered in the House and the Senate.  The Senate bill, called the Medical Records Confidentiality Act or the "Bennett Bill," is the weaker alternative.

        While the bill gives lip service to the concept of patient privacy, one of its primary aims is to give a green light to companies interested in amassing computerized medical information for profit.

        In its present form, the Bennett Bill sanctions the creation of computerized data banks of medical information without patient consent and actually makes access to this information more widely available than it was before.

        Most surprisingly, the Bennett Bill would also preempt-in other words, abolish-all state laws and judge-made rules concerning medical records, thereby wiping out consumer-friendly legislation in those states that have made medical privacy a priority.  The reason?  Differing state standards would be inconvenient for those with an interest in collecting or administering medical records on a nationwide scale.

        The legislation pending in the House is the preferred alternative.  Introduced by Congressman Jim McDermott (D-Wash.), in May, the "Medical Privacy in the Age of New Technologies Act" specifically recognizes a patient's right to consent before medical records are disclosed to others.

        Absent an authorization, which cannot be forced from patients with reasonable objections to disclosure, access is limited to those intimately involved in a patient's care. 

        Best of all, the House bill does not preempt state law, allowing the creation of more stringent standards by states wanting to grant further protections to their residents.

        One doesn't have to be a "privacy advocate" to understand that until patients sign an authorization, their medical secrets should remain confidential.  And while others, such as those who are involved in paying for medical care, may also have legitimate interests to protect, these competing interests shouldn't automatically tip the balance away from patients.

        The reason is simple:  Among all those with an interest in medical privacy, it's the patients who have the most to lose if fear of disclosure makes it difficult or impossible for them to be frank with the doctors who are administering their care. 

Back