Despite HIPAA, the Privacy of Our Health Records Is Largely a Myth
Posted Oct 08 2009 10:02pm
Most of us, perhaps too glibly, assume that our medical records, both in hardcopy and electronic formats, remain a bastion of privacy and can be securely anonymized and and thus protected from prying eyes. Mr. HIStalkcomments wisely on this topic in a recent blog post:
I think that [HIT vendors selling hospital clients' ‘de-identified’ clinical data] conveniently [hide] behind the concept of “anonymization” as an absolute; a simple technique of magically rendering highly sensitive personal data untraceable. Sounds good to a lay person, right? It even sounds technically reasonable as long as you’re thinking of someone having only one data element (just your birth date) instead of multiples (your birth date and ZIP code) and one database (a prescription file) instead of multiples containing joinable fields (prescriptions plus driver’s license records plus a grocery store loyalty card database). It’s like security in general: rarely absolute, secure only if there’s not enough incentive for someone to go to the trouble to crack the code.
I stated rather bluntly in a previous note (see: On the Privacy of Health Information: The Horse Is Already Out of the Barn ) that the privacy of medical records is largely a myth and that we should get accustomed to the idea. I specifically cited an article in the Washington Post describing how pharmacy benefit managers (PBMs) sell data about individuals to health insurance companies in order for them to assess financial risk of insurance applicants (see: Prescription Data Used To Assess Consumers ). The lede to this this article stated the problem succinctly: "Health and life insurance companies have access to a powerful new tool for evaluating whether to cover individual consumers: a health "credit report" drawn from databases containing prescription drug records on more than 200 million Americans." In other words, health insurance companies can acquire from the PBMs a report of your health status based on the type and doses of the drugs that are prescribed for you by your physician. The PBMs assert that the disclosure of such information is legal because the consumers authorize the release of such information to health insurance companies.
I am not saying that we should let down out guard or even think about abandoning HIPAA. There are too many people feeding at the HIPAA trough -- to do so would postpone our economic recovery for at least another year. I just want to reinforce Mr. HIStalk's major point, which is that no privacy or anonymization system is absolute. If someone with a computer, a few dollars, and some computer savvy wants to learn all of the details about your health status, there is little that can be done to protect your data. The situation is not going to get better in the future as "protected" health information is replicated to an increasing number of applications and databases including personal health records (PHRs), for which I am a strong advocate. Let's face facts. When the pharmaceutical companies pull out their checkbooks, nothing or no one is protected. Even the AMA, supposedly chartered to protect its physician members, is susceptible to the lure of cold, hard cash (see: AMA Discloses Masterfile Physician Data to Pharmaceutical Companies ).