Privacy and Security Considerations for Emerging Health Information Exchanges: Notes from Utah and New York

Earlier this month the Utah Department of Health issued a press release describing a cyber attack on its server, in which hackers removed information for approximately 780,000 individuals. According the Department of Health, the information contained personal records of individuals within the state, including Medicaid and Children’s Health Insurance Plan recipients.

Permutations of this scenario- whether hacking into a computer server, losing a USB key, or a stolen laptop- are all familiar news headlines announcing a security breach of individuals' health and personal information. Human error and human opportunism make it likely that we will continue to see such information breaches in the future, despite steps to mitigate potential security threats.

As states begin to develop legislation and promulgate rules to govern their electronic health information exchanges (HIE), they should carefully balance residual security and privacy risks with the potential promises of a functional HIE when determining policies relating to how a system enters an individual’s electronic health record (EHR) and what portion of the EHR the state enters into the HIE.

Last month, the New York Civil Liberties Union (NYCLU) issued a report, Protecting Patient Privacy: Strategies for Regulating Electronic Health Records Exchange, which articulated numerous privacy, security, and functional concerns with the state’s emerging HIE. Currently, New York employs a blanket consent procedure for record access and enrolls patients of participating providers into the state's regional health information organizations (RHIOs). 

Among numerous concerns, NYCLU’s Report highlights two distinct issues with this approach:

(1) New York does not provide a mechanism for patients to limit sharing stigmatizing sensitive information such as substance abuse records or mental health treatment if they consent to participate in the exchange; and

(2) Although physicians must obtain consent to view patient information in the exchange, participating providers enter patient medical information into the exchange without patient consent and patients cannot opt-out of the record locator system.

The Office of the National Coordinator for Health Information Technology’s HIT Policy Committee has asserted that a form of granular control over health data can protect the confidentiality of narrow categories of sensitive health information while fostering patient autonomy, promoting trust in medical providers, and building confidence in the growing use of HIT. Although too much data segmentation or exclusion options could confuse patients and undermine the purpose of the HIE as a comprehensive record system, some groups, such as the NYCLU, argue that existing state law requires the capacity for granular control over statutorily identified categories of sensitive medical information. This assertion serves as a reminder that each state contains varied protected categories of sensitive medical information as well as different standards defining additional measures relating to sharing and accessing this information. Earlier this month, the New York Department of Health and the New York eHealth Collaborative established the State Health Information Network of New York Policy Committee to examine these and numerous other concerns over the state’s current policies and procedures governing the exchange.

Patients may also be wary of the security of their identifying records available in the HIE registry system, as a breach could reveal both personal information and the entirety of the patient’s medical records that providers have entered into the HIE. A breach of the HIE would not only invade the patient’s abstract notion of privacy over sensitive information, but could also expose the patient to quantifiable concrete harms such as identity theft, fraud, and the costs associated with investigation and mitigation.

Some victims involved in major medical security breaches have asserted that once information such as social security numbers, patient demographic information, and medical records are accessible in a breach, victims face an imminent and continuing risk arising from the security breach itself regardless of whether an outside party has used the information. Currently, some courts have ruled that even where a third party steals media containing patient information, if the victims cannot prove that a third party actually accessed or used the information, then claims for future financial harm arising from a security breach are insufficient to constitute an actionable injury. To address these legitimate concerns, jurisprudence should evolve with the recognition that potential third party use of this information may be difficult to identify and costly to monitor. Further, months may pass following the initial breach before victims notice fraudulent activity, such as in the substantial TRICARE data breach.

State legislatures should remain cognizant of both patients' desire for privacy and their corresponding wish to limit access to sensitive medical information as well as security concerns from both accidental as well as intentional breaches of patient information during the initiation or expansion of the state's HIE .

-Katherine Drabiak-Syed

Mercy Health Plan's Medical Data Security Breach Should Inform OCR's Harm Standard

A recent medical data security breach occurring in Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan in Philadelphia lends support to removing the harm threshold written into the Interim Final Rule of HIPAA and the HITECH Act before promulgating the Final Rule. In August of 2009, the Office of Civil Rights (OCR) published the Interim Final Rule with request for comments on breach notification of protected health information (PHI), which set forth additional definitions and standards to relating to the Privacy Section. OCR is expected to issue the Final Rule by the end of this year or early next year.

When OCR published the Interim Final Rule last year, the media jumped on the inclusion of instructing the covered entity responsible for a breach of PHI to perform a risk assessment as a deciding factor of whether or not to disclose the breach to the individuals and the Department of Health and Human Services (HHS). Eight members of Congress expressed their concern by writing a letter to Kathleen Sebelius, noting that the American Recovery and Reinvestment Act (ARRA) that sets forth the statutory mandates relating to privacy of PHI does not include nor imply a harm standard and urged HHS to repeal or revise the harm threshold standard.

Section 13402 of the ARRA states that health care entities must notify the individual when there is an “unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of that information.” In order to decide whether a breach compromises the individual’s security or privacy, the Interim Final Rule set forth a risk assessment criteria and translated a “compromise” of security or privacy to mean a “significant risk of financial, reputational, or other harm” to the individual. Problematically, the covered entity is tasked with assessing the risk of harm to determine whether it meets the threshold for disclosing the breach to the individual and HHS. The Interim Final Rule states that the covered entity should consider to whom the information was disclosed, the type and amount of information, and whether the information contained materials relating to potentially stigmatizing health conditions.

The letter written on behalf of eight Congressional representatives clarified that Congress specifically excluded a threshold for harm when promulgating Section 13402. Furthermore, requiring mandatory disclosure serves as a powerful incentive to health care entities to enact strict privacy and security protections to decrease the likelihood of a breach even occurring.

The Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan (MHP) incident is only the latest in a long line of PHI breaches. In late October, the Philadelphia Inquirer reported that a computer flash drive belonging to Keystone Mercy Health Plan and AmeriHealth Mercy Health Plan (MPH) was lost at a community health fair. The flash drive contained the medical record information of over 280,000 Pennsylvanian Medicaid recipients.

Donna Burtanger, Vice President of Communications at MHP, stated that company representatives were trying to use the health plan members’ PHI to personalize service at community health fairs. Burtanger offered the example of when a health plan member visits a church sponsored health fair, the insurance company representative can access the member’s medical record to schedule an appropriate screening test such as a mammogram.

As one article pointed out, MHP assumes that the patients under the plan would want company employees to have and access the patient’s full medical record or bring that sensitive health information into a less secure location such as a community health fair. This situation highlighted the vast discrepancy between how an insurance company and its members would view the risk-benefit calculation of permitting non-essential access of their sensitive medical information.

If a health insurance company such as MHP does not know when its members would not want their information shared, accessed, or transported, it likely would also face a disconnect when attempting to determine potential harm arising from a breach of its members’ PHI and whether that level of harm would require disclosure of the breach.

OCR should consider whether placing a level of discretion in the hands of health care entities given the knowledge of this difference will build the public’s trust of using electronic health information.

--Katherine Drabiak-Syed

Will Stronger Privacy Protections Result in Better Health Data? The Health Privacy Project Recommendations

The Health Privacy Project of the Center for Democracy & Technology (CDT) recently released a paper arguing for changes in how the HIPAA Privacy Rule protects "de-identified" health information. The recommendations grow from a one-day, CDT workshop held in September 2008. The Health Privacy Project makes the following eight recommendations:

1. Re-examine the Privacy Rule de-identification provisions (in particular, the safe harbor method for de-identification);
2. Strengthen accountability by requiring data use agreements;
3. Expand data anonymization options under the Privacy Rule;
4. Provide incentives to use less than fully identifiable data for certain purposes;
5. Provide support through “Centers of Excellence” in de-identification;
6. Require or encourage the use of limited access datasets and other technical solutions;
7. Require education and training of staff de-identifying data; and
8. Consider increasing public transparency regarding uses of de-identified data.

The Project argues that the HHS needs to re-examine the Privacy Rule "to ensure that the de-identification standard remains robust as re-identification becomes easier."

For readers struggling with the "Babel" of data privacy vocabulary (for example, what's the difference between "anonymous" and "anonymized"?), these recommendations may open the door to additional confusion, especially if #3 (above) means that additional categories of protected data are created. The Privacy Rule currently offers two categories data which are exempt from regulation: "de-identified" (presumed to be beyond the risk of re-identification and therefore not regulated) and not fully identifiable, "limited data sets" (incomplete data which includes some identifiers, for example: birth dates). While the Rule's current categories may seem simple, The Health Privacy Project notes that a "one-size-fits-all de-identification approach" does not, one the one hand, meet the diverse data needs of researchers and health providers, nor does it, on the other hand, provide sufficient protections in era of evolving data technologies.

Reference:

The Health Privacy Project, Center for Democracy & Technology. Encouraging the use of, and rethinking protections for de-identified (and “anonymized”) health data. Center for Democracy & Technology, June 2009. http://www.cdt.org/healthprivacy/20090625_deidentify.pdf

Related:

Knoppers BM, Saginur M. The Babel of genetic data terminology. Nat Biotechnol. 2005 Aug;23(8):925-7. PubMed PMID: 16082354.

Sharyl J. Nass, Laura A. Levit, and Lawrence O. Gostin, Editors; Committee on Health Research and the Privacy of Health Information: The HIPAA Privacy Rule; Institute of Medicine. Beyond the HIPAA Privacy Rule: Enhancing Privacy, Improving Health Through Research. Washington, D.C.: Institute of Medicine, The National Academies Press, 2009. http://www.nap.edu/catalog.php?record_id=12458

Other Stories in the News

Your Genes Aren’t Covered for That: One Year Later, Gaps in Genetic Discrimination Legislation Reveal the Challenges Ahead. Susannah Baruch, Science Progress. June 29, 2009.

FDA’s Current Ability to Regulate Genetic Testing Is Problematic, FDLI-AAAS Colloquium Attendees Say. Food and Drug Law Institute (FDLI) and the American Association for the Advancement of Science (AAAS) [Press Release]. June 22, 2009. http://www.fdli.org/press/pressrelease/062209.pdf

New Comparative Effectiveness Bill Enhances Dx, Genomics Focus. Matt Jones, GenomeWeb. June 18, 2009.

The GINA Law: Consumer Protection in a New Era of Genetic Testing Research Report. N. Lee Rucker, M.S.P.H., AARP Public Policy Institute, May 2009. http://www.aarp.org/research/health/prevention/fs156_gina.html

-- J.O.

New Technologies and Old Laws: Square Pegs in Round Holes

I sit in a lot of meetings where I people discuss how new health information and technology will fit into existing policy and law. Many of these discussions go over my head, as they are bogged down in minutiae of law and policy far beyond my ken. I have often assumed that these discussions are important, perhaps even necessary, as our system of law is built on precedent, reaching back into the past to inform the future.

And then I read something like this.

New President Barack Obama will have to give up his Blackberry. The entire White House Staff can’t Instant Message. Eight years ago, President Bush sent a message to 42 friends and relatives right before assuming office explaining that he had to give up email. I know what I will say to them if they ever try to come for my iPhone; it’s not fit for print and involves my cold, dead fingers.

Why? It has to do with something called the Presidential Records Act. It turns out that all of the documents that come into contact with a President and Presidency need to be preserved and one day made public. Don’t get me wrong, I understand the importance of such a law, and I am all in favor of it. But even that law recognized that there had to be exceptions. Presidents, and their staff, do need to keep some things private. Conversations aren’t all recorded; neither are telephone calls.

Personally, I hate to talk on the phone. So, given the chance, I will use email, text messaging, or even Instant Messaging to talk to friends and colleagues. For me, and many others, it’s faster, it’s easier, and it’s preferable. I can tell you that I would be much less productive professionally, and much less happy personally, if you told me I had to stop.

Here’s the problem. The Presidential Records Act was written in 1978. No Blackberries. No Instant Messaging. No email. It is simply ridiculous that President Obama can’t have a Blackberry and David Axelrod can’t Instant Message because of a law written thirty years ago. We shouldn’t have to figure out how to make these new technologies fit into law that couldn’t predict them. We need new law.

Which brings us back to health technology. Those old laws and old policies – they too were often written in a time when the issues and difficulties we face today were simply incomprehensible.

It may be just as unreasonable to think that we can use them to inform what we should do today. Sometimes, precedent isn’t enough.

We shouldn’t have to figure out how to make these new technologies fit into policies that couldn’t predict them. We need new policies.

Aaron E. Carroll