Coalition for Patient’s Privacy comments on EHRs

Now is the time to restore Americans’ rights to control personal health information. Electronic health systems and data exchanges should work the way patients expect them to and empower each person to selectively share information only with those they trust.

The centerpiece of the bipartisan Coalition for Patient Privacy’s extensive comments on the proposed rulemaking, Modifications to the HIPAA Privacy, Security, and Enforcement Rules Under the HITECH Act, is the recommendation that HHS restore the right of consent that was eliminated from HIPAA in 2002.

Consumer protections mandated BY HITECH, federal and state law, and medical ethics cannot be fulfilled unless policy and technology empower patients to selectively share sensitive health information only with those they trust. The Coalition’s recommendations ensure that health IT systems and data exchanges align with Secretary Sebelius’ statement that the Administration’s policy is to “make sure no one has access to your personal information unless you want them to”.

Ensuring Americans’ control over health information is critical for quality health care and the success of health information technology (HIT). The Coalition applauds the efforts of the Department of Health and Human Services (HHS) to revise HIPAA. However, the Coalition also urges HHS to require use of robust electronic consent and segmentation tools to assure compliance with the consumer privacy and security protections in HITECH and existing rights in state and federal law and medical ethics.

View the Coalition’s comments here:

Coalition members signing the comments include: the American Association of People with Disabilities, the American Civil Liberties Union, Consumer Action, the Cyber Privacy Project, the Doctor Patient Medical Association, the Fund for Genetic Equity, the Gun Owners of America, the Multiracial Activist, Patient Privacy Rights, Private Citizen, Inc., and the U.S. Bill of Rights Foundation. In addition, Representative Nancy Barto (R-AZ), Chairman, Health & Human Services Committee, and Prof. Chip Pitts, Stanford Law School & Oxford University and President, Bill of Rights Defense Committee also signed.

The Coalition recommends that HHS require the use of the consent and segmentation technologies showcased June 29th at the Consumer Choices Technology Hearing for all HIT systems, HIE, and the Nationwide Health Information Network (NHIN). “Innovative, low-cost, effective privacy-enhancing technologies available now can empower patients to have maximal control over PHI,” said Deborah Peel, MD, Founder of Patient Privacy Rights and leader of the bipartisan Coalition for Patient Privacy. “These privacy-enhancing technologies should be used now, not ten years from now. HHS must ensure that today’s industry-centric health IT systems and data exchanges are replaced with truly patient-centric systems.”

Electronic consents that enable segmentation empower consumers to:

* consent before protected health information (PHI) can be sold

* disclose ONLY the “minimum necessary” information from electronic health records (EHRs) for a particular purpose or use

* prevent information from being disclosed to a health plan if the treatment cost was paid out-of-pocket

* segment sensitive PHI as required by state law (prevent disclosure of sensitive information in EHRs)

* give consent to disclose addiction treatment records as required by 42 CFR

Part 2

* enable veterans to consent before disclosing information as required by USC 7332, Title 38, Veteran’s Benefits, Subchapter III-Protection of Patient Rights

* consent before “psychotherapy notes” are disclosed

Consent and segmentation technologies are the key to gaining public trust, which is the foundation of our health care system. Furthermore, if HHS does not require strong privacy policies and the enforcement now, the US investment of billions in Health IT and data exchange will be wasted. Patient privacy can only be assured with trustworthy systems and data exchanges based on consent and segmentation systems. Only meaningful enforcement of security and privacy will ensure that we reap the benefits of HIT while preventing most harms.