The HealthITBlog

The ARRA stimulus bill provides incentives for medical providers to use Electronic Medical Records for storing patient healthcare information. (To read more about Meaningful Use and certified Electronic Medical records, beyond the scope of this posting, please refer to CCHIT). The overarching goal is to allow medical records to be exchanged between health-care providers. A simple example: An employee changes jobs and receives new health insurance, which requires him to use a different healthcare provider. How does he transfer his medical records to that new health-care provider.  Or a soldier is treated in a military hospital, then transferred to the VA and finally to a public/private hospital. How does his/her electronic medical record transfer between the three distinct institutions.

In transferring electronic patient data between institutions:

• How does American law protect the privacy and security of patient health-care data?
• Why are Americans hesitant to share medical information electronically?

On Monday January 25^th, 2010 a study by the Ponemon institute revealed that Americans distrust the Federal Government or private enterprise to electronically store their health-care data.

Of the 868 Americans surveyed about their views on digitizing and storing health records, only 27% said they would trust a federal agency to store or access the data–the same percentage as those who would trust a technology firm like Google Microsoft or General Electric

Let’s examine how US Federal law protects electronic medical records

• HIPAA – Health Insurance Portability and Accountability Act – is rather dated (1996) in terms of protecting electronic medical records. HIPAA does not take into account the electronic exchange of electronic health data.

Health Insurers and Providers who are covered entities must comply with your right to:

• Ask to see and get a copy of your health records
• Have corrections added to your health information
• Receive a notice that tells you how your health information may be used and shared
• Decide if you want to give your permission before your health information can be used or shared for certain purposes, such as for marketing
• Get a report on when and why your health information was shared for certain purposes

Nothing implied about electronic medical records, nor exchange of electronic data and most importantly authenticating the individual who is requesting access to the records. In an electronic medical record system, how can I be certain that Joe Smith is who he claims to be when he logs into the system. Is user-name password sufficient security?

• In light of the ARRA stimulus bill, the US Department of Health and Human Services (HHS) revised the privacy rule in December 2008. (11 page PDF here). In summary:

Access: Individuals must be provided timely access to their medical data

Disputation/Correction: Individuals must be able to dispute and correct information in their health record, from a simple typo, corruption of digital information in transit  between entities and even medical identity theft.

Openness/Transparency: Individuals must have access to their record and know what is in there and how it is disclosed.

Individual choice: Individuals must be able to choose how data is shared. For example which doctor is allowed to view their record delegating access to another person in case the individual/patient is incapacitated and cannot access their record.

Collection/Use: Individuals have the right to know how their medical data is distributed/used; that data is only used for their care and not distributed beyond the patient’s consent.

Data quality/integrity: Data is secure and not compromised

Accountability/Auditing: An audit trail and legal accountability exists to know who was authenticated and authorized to access an individual’s data.

The word “trust” appears 13 times in the 11 page document, the phrase “trust in electronic exchange of information” appears six times. Clearly the HHS is attempting to gain the public trust in an electronic exchange of health data.

• The Federal Trade Commission proposed a breach notification rule (50 page PDF) “requiring vendors of personal health records and related entities to notify individuals when the security of their individually identifiable health information is breached.”

So, given the above laws, why does the Ponemon study find Americans so distrustful to store their electronic health data. The study revealed:  Users rated health records as far more sensitive than other information they typically share with Web companies. On a scale from one to seven, medical data received an average rating of 6.64, while credit card information received only a 4.27 and online search records just a 1.86.

I posit that:

• Internet searches can be reasonably anonymous.  I can search for information from a public computer such as the library or a firewall can transform my computer’s identity (IP address).
• If my credit card information is compromised I am protected by the credit card company; so much so that credit card companies have sophisticated software that track errant spending patterns and forewarn me. Am I in an obscure overseas country attempting to purchase a $3000 airline ticket?
• Americans, historically, have a distrust in their government. The Bill of Rights dating back to 1791 protects the individual (for example unreasonable searches).  So why should the government be trusted with personal health information?

The problem is health information potentially reveals personal and important details about an individual: their weight, medications, illnesses, addictions, allergies,  perhaps even sexual preferences. (Interestingly under the US law, patients do not have access to their  psychotherapy notes. See HIPAA rule “You do not have the right to access a provider’s psychotherapy notes.” )

The real problem I believe is what options does a an individual have if their electronic medical record has been compromised? Witness two recent incidents in California where electronic patient information was stolen: UCSF – (600 patients) and Kaiser (15000 patients).

Is the FTC breach rule sufficient?

I think the rule is sufficient, but the ubiquity, and ease of electronic data duplication, makes it difficult to gain the trust of users. If my medical records are stolen, what comfort is the rule? The answer individuals require from electronic medical record vendors is “we will encrypt your data, at rest and in transit.” At rest means data in a database is encrypted; in transit means, that the data as it is transmitted across computer networks. Today, encryption in transit is easily achieved with SSL. Encryption at rest is rare because it is practically difficult to implement. If I encrypt “Joe Smith” as “aS@Pn!”, then how do I search for his record, as I cannot search for “Smith”? How does another, say reporting application, access and present the encrypted data? How do I index a database (group all the “Smith”s together) if the data is encrypted? How can a receiving party in another institution (sharing electronic medical records) decrypt the data? As the UCSF and Kaiser incidents note, unencrypted data was stored on detachable disks and subsequently stolen.

Electronic medical record vendors and the US government have a long way to go to gain public trust.

(This posting is an assignment from my UC Davis Informatics class on telemedicine)