Who gets a peek at online medical information?
It's 10 a.m. Do you know where your medical records are? That's a question that has a lot of people worried. What if the boss found about that mental health problem you were treated for? Or suppose the life insurance company comes sniffing around to see if you'll be able to keep up with the monthly premiums in a few years. Maybe your cholesterol is higher than you'd like it to be but don't want your family to nag you into giving up cheeseburgers.
Or maybe your company finds out that you've got a genetic time bomb ticking away inside you -- a rare disease that could cause serious health problems for you and send the company's health insurance costs through the roof. Sound like a paranoid nightmare? Not to Terri Sergeant. In 1999, Sergeant, an office manager for an insurance broker in South Carolina, was fired when a genetic test revealed that she had an inherited respiratory disease known as alpha-1-antitrypsin deficiency. The disease, which can be fatal if undetected or untreated, is caused by deficiency of a protein that protects lung cells from infections caused by inflammation. The condition can be effectively managed with weekly intravenous infusions of the missing protein, but the treatment is costly and long-lasting.
It's the "costly" and "long-lasting" parts that appear to have cost Sergeant her job. But the law, at least, was on her side: Sergeant was recently awarded damages from the Equal Employment Opportunity Commission (EEOC), which ruled that she had been discriminated against on the basis of the cost of care.
Nor was Sergeant alone: When the late social scientist Dorothy C. Wertz, PhD, from the University of Massachusetts Medical Center in Worcester, Mass., surveyed U.S. genetics professionals in 1999, she found 693 reported cases where either patients or their family members had been refused life insurance or employment on the basis of their genetic status, even when they showed no symptoms of disease.
Reports such as these, while still uncommon, raise important questions about what happens when sensitive medical information gets into the wrong hands. Many hospitals now have computerized systems that allow access to medical records by anyone with a computer terminal and the right password or authorization code. A few even allow online access to complete medical records by patients themselves.
"Sharing personal medical and health information across the Internet requires a certain leap of faith -- or at least a strong sense of privacy and trust," acknowledge the authors of a Pew Internet and American Life Project report on health information online. Asked whether he would ever share health information with someone he "met" online, one respondent to a Pew survey replied, "ABSOLUTELY NOT. I wouldn't dare. You don't know who you are talking to."
What's to stop a hacker from breaking into one of these systems to steal personal information (such as social security numbers or other personal data)? And even if you've got a system that's harder to break into electronically than it is to get into Fort Knox with a pick and shovel, how do you know who's been looking at your private information?
"I think it's important to understand that with a paper record, you have no idea who's looking at your record," says Daniel Z. Sands, MD, MPH, professor of medicine at Harvard Medical School, and clinical systems integration architect at Beth Israel Deaconess Medical Center in Boston.
"With an electronic record, you can have an audit trail of who's looking at your record, and I think that's very important. There is certainly some risk to having electronic records, and perhaps because they're more accessible, there's more of a risk than with paper records," Sands tells WebMD.
"That being said, nobody has ever died from the inappropriate release of a medical record, but plenty of people have died because people couldn't get access to that information. I think we need to strike a balance between the security and protection of that information and the access to the information."
Many people willingly share some of their most sensitive personal information with web-based merchants, such as credit card numbers and expiration dates, bank accounts, buying preferences, addresses, phone numbers, and even social security data. Why shouldn't medical information be similarly available, as long as the patient can control access to that information?
"I meet people who are terribly afraid of all the potential," says Steven Schwaitzberg, MD, director of the Minimally Invasive Surgery Center at Tufts-New England and Associate professor of surgery at Tufts University School of Medicine in Boston. "They're very afraid of the intrusion on their privacy and demand control of the information."
He points to developments such as so-called radio frequency identification, or RFID technology, currently under development at MIT and other technology centers, in which minuscule radio-transmitting chips can be buried in everything from goods on the supermarket shelf to the clothing on your back. A similar type of technology, using retinal scans, was featured in the Stephen Spielberg sci-fi thriller Minority Report.
"RFID really could improve communication dramatically, but people are afraid of being tagged and watched and being countable," Schwaitzberg tells WebMD.
Still, he says, "millions of Americans are buying something online right now. Americans seem to be happy to give up information about themselves, and yet there is a very stalwart group of people who are very concerned."
Schwaitzberg and others who advocate online health records say many of those fears could be allayed by a well-designed system with checks and balances. For example, patients could use a personal identification number, or PIN code, to get access to an electronic medical record, sharing it with doctors or other health-care providers who need the information, and then changing the code to ensure privacy when necessary.
That way, someone who becomes injured or sick while traveling could grant instant access to health records by local doctors.
A bigger barrier to the flow of information, Schwaitzberg says, is the current hodgepodge of incompatible information systems, many of which are designed for use only in a specific hospital or group of health centers.
Data for Sale?
If you are one of those people who worry that health-care providers will be tempted to sell your private medical information to the highest bidder, you should know that hospitals have an even more powerful incentive to keep that information under electronic lockdown. That incentive is called HIPAA, for the bipartisan Health Insurance Portability and Accountability Act, also known as the Kennedy-Kassebaum Act of 1996.
The act is designed to encourage the use of electronic transactions in health-care while safeguarding the security and confidentially of health information. According to the U.S. Department of Health and Human Services, most health insurers, pharmacies, doctors, and other health-care providers are required to comply with the standards.
Among other things the HIPAA rules are supposed to guarantee:
- Patient access to copies of their medical records within 30 days of request for identification of errors and mistakes the records.
- Notification of how personal health information may be used, and the right to restrict how that information is used, as well as limits imposed on providers. Under the rules, patients need to grant specific authorization for release of records to outside entities such as life insurers, banks, marketing firms, or other businesses.
- Prohibition on sharing of patient information by pharmacies, health plans, and others with marketing firms without the express consent of the patient.
To put some teeth into the measure, Congress provided civil and criminal penalties for individuals or groups that misuse personal health information. Violations of patient civil rights are subject to penalties of up to $100 per violation for a maximum of $25,000 per year.
"Criminal penalties apply for certain actions such as knowingly obtaining protected health information in violation of the law. Criminal penalties can range up to $50,000 and one year in prison for certain offenses; up to $100,000 and up to five years in prison if the offenses are committed under 'false pretenses'; and up to $250,000 and up to 10 years in prison if the offenses are committed with the intent to sell, transfer or use protected health information for commercial advantage, personal gain or malicious harm," according to a fact sheet published by the HHS Office of Civil Rights.
Will all of these measures protect patient privacy? Maybe. But in any case, privacy has long been an uncertain commodity in American life. As Irish playwright and author George Bernard Shaw told a New York audience in 1933, long before the Internet was even dreamed of, "an American has no sense of privacy. He does not know what it means to. There is no such thing in the country."
Originally Published: September 2003