AAPS Privacy Information

Association of American Physicians and Surgeons             Back to NCPA Debate Home Page

WARNING: Health Web Sites May be Hazardous to Your Privacy Consumer health care sites on the Internet provide a wide range of clinical and diagnostic information, products and services, and a way to communicate with other patients. Some of the information is good, some not so good -- to the point of fraud. But all share one serious problem -- They cannot guarantee your privacy! Once you identify yourself in any way on a Web site, your information is no longer anonymous. Most Web sites track all of your online activity through profiling -- information that is very valuable to advertisers. ----- Both Congress and the White House have expressed well-founded concerns about the privacy of medical records. However, proposed legislation, as well as the standards on "the privacy of individually identifiable health information" recently promulgated by the Department of Health and Human Services as mandated by the Health Insurance Portability and Accountability Act, would have an effect opposite to the stated intention of protecting patient confidentiality. Both the proposed regulations and various legislative proposals establish procedures permitting and facilitating the disclosure of information for which disclosure is now either prohibited or practically impossible. ----- The Department is correct in saying that patients wish to have their medical records protected, but is then incorrect to cast the privacy efforts of state legislatures as needing an overriding federal standard. Some state laws such as those in Minnesota have effectively mandated patient consent -- the most effective approach to patient privacy -- which this regulation specifically forbids. ----- In the wake of HHS efforts to thwart public input, The Association of American Physicians and Surgeons (AAPS) is asking Congress to postpone tomorrow's deadline for public comments on controversial medical privacy regulations. The government is about to change the rules about who has access to everyone's medical records. These new rules will make it easier for a wide variety of individuals, government agencies and groups to get the private medical records of every person in the US and track all patient files on a central government database. ----- "Our medical records necessarily include the private, intimate details of not just the individual patient, but the entire family. We take the trust that our patients place in our hands very seriously and we assiduously safeguard their privacy. I am concerned that these proposed "privacy" regulations would suddenly create a new class of persons with the right to access the information contained in these records without the patient's knowledge or consent." ----- Since Congress could not agree on privacy legislation, Secretary Shalala and HHS have issued their own set of proposed privacy regulations... AAPS has concluded that the proposed rule would be more appropriately entitled "The End of Privacy" rule. This rule will undermine the privacy that patients cherish in numerous ways... ----- It is unconstitutional to have an administrative agency as creator and definer of rights. The scope of authority of HHS should be narrowly interpreted to set federal standards for the protection of electronically transmitted medical information, not to seize control of all such information and dictate that it may be used for any purpose authorized by HHS. ----- The statute provides that the Secretary shall define the rights of individuals who are the subject of protected health information. This delegation of authority, however, can only apply within the context of the statute, the purpose of which is to "improve...the efficiency and effectiveness of the health care system, by encouraging the development of a health information system through the establishment of standards and requirements for the electronic transmission of certain health information." The statute does not delegate to the Secretary the authority to make radical changes in the very concept of confidentiality, to abrogate the right of individuals to control access to their health information, to dictate the scope of the Fourth Amendment to the U.S. Constitution, or to seize control of all health information so that it may be used for any purpose approved by the federal government and its agents. ----- Protecting medical privacy is a noble goal, however, the federal government is not constitutionally authorized to mandate a uniform standard of privacy protections for every citizen in the nation. Rather, the question of who should have access to a person's medical records should be determined by private contracts between that person and their health care provider. ----- "Trusting President Clinton to protect our medical privacy is a bit like asking the Pied Piper to baby-sit our children. "Congress had better take a very close look at the details of the President's privacy regulations when they come out, as this Administration's record on privacy is lousy..." ----- Computer technology is undoubtedly useful in many aspects of medical care. When patients and physicians benefit from such technology, it has been voluntarily purchased by them. Mandatory standards and compulsory usage are likely to be of benefit only to vendors such as the AMA, insurers attempting to improve their underwriting, marketing agents, government oversight agencies, and agencies that intend to control and redistribute resources. ----- The Act would create a new federal right to collect, maintain, and harvest highly personal medical information about patients nationwide... Congress should first establish meaningful protection in the privacy of patients' medical records, and only afterwards consider whether it is necessary to create incentives for the corporate development of medical record data bases... ----- Our specific concerns about the Health Information Privacy Protection Act include: The creation of a new entity called a "health information trustee," which subsumes physicians and other "health care providers," placing them in the same category as "health plans," "health oversight agency," and "public health authority." -----