March 26th, 2011 by DavidHarlow in Health Policy, News
No Comments »
Walgreens is being sued by customers who are not happy that their prescription information – even though it has been de-identified – is being sold by Walgreens to data-mining companies.
The data privacy and security concerns surrounding the transfer of de-identified data are significant. To “de-identify” what is otherwise protected health information under HIPAA, some outfits will simply strip data of 18 types of identifiers listed in federal regulations. However, the relevant regulation (45 CFR 164.514(b)(2)(ii)) also provides that this only works if “the covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information.” Thus, the problem with this approach is that, these days, nobody can disclaim knowledge of the fact that information de-identified by removing this cookbook list of 18 identifiers may be re-identified by cross-matching data with other publicly-available data sources. There are a number of reported instances of this sort of thing happening. The bottom line is that our collective technical prowess has outstripped the regulatory safe harbor.
Is this the basis of the lawsuit brought against Walgreens? An objection to trafficking in health information that should remain private? No. The plaintiff group of customers is suing to share in the profits realized by Walgreens from trading in the de-identified data. Read more »
*This blog post was originally published at HealthBlawg :: David Harlow's Health Care Law Blog*
June 22nd, 2009 by DrRob in Better Health Network
No Comments »
I have heard a lot of talk about ownership of medical information. Bloggers like e-Patient Dave, and Robin are strong advocates for patient ownership of their information. To be truthful, I get nervous when I hear people saying they own something I have in my possession (and I’ve blogged about this). The charts in my office are mine, right? How can I create something and have it not be mine?
I carried this unease with me into the exam room recently. Thinking about the ownership of medical information, I opened a patient chart. The vital signs were already in, and I started in on the HPI (the patient’s story as to why they are there). I do this by asking questions: When did it start? How long did it last? What did it feel like? What did you take? Did you have other symptoms with this? How bad was it? Have you ever had this before?
Hmmm…. Whose information is this?
Then I went on to the review of systems. We have the patients circle symptoms on a laminated sheet and I discuss what they circled.
“You have some chest pain?”
“Well, it was a sharp pain that happened when I coughed. Is that bad? Could it be my heart?”
We then go into a discussion about chest pain and what to look for.
I put down the information the patient has given me and think a little more. The patient’s information?
Then I get frustrated. The past medical history hasn’t been updated recently, she’s been in the hospital and most of the information about this is not in the chart. The medication list is not accurate. The information about her family, lifestyle, and habits are incomplete and I don’t know when they were last updated. I sigh, then try to fill in the gaps as best as I can by asking her questions without betraying my lack of confidence in our record.
We have a meeting of our IT team after this, and I am thinking about this encounter. We are about to roll out a patient portal where patients will be able to log onto our website securely and fill out patient demographics, request refills, and get appointments.
“What information in the record would the patient be best to be in charge of?” I ask. By being “in charge” I mean that the patients would have actual control of this information and we would read it. I tell them about my experience and frustrations and we make the following list:
- Marital Status
- # Children
- Job/School info
- Home DM monitoring, weight, BP
- Address, phone, e-mail address
- Family history
Then I ask, “What information in the record could the patient contribute directly to?” By this I mean that they would see the information as it is in there and be able to suggest changes or additions, but would not be able to actually change themselves. Here’s what we came up with:
- Smoking, alcohol
- Medication List
- History of visits to other medical providers, consultant names, etc.
- Review of systems prior to visit
- Surgical history
We want to be able to assemble this information so that it is in a format that is readable to us and fits our needs, but the patient would have the ability to take this data information and perhaps download it to organize as they wish.
“So what information should they have access to?” I ask, referring to information they can see, download, and organize as they wish, but not add or subtract to. Here is that list:
- Upcoming tests needed (Colonoscopy, etc)
- Immunizations
- Lab results
- Visit schedule – past and present
- Previous vital signs
- Recommended schedule based on their diseases
- Problem list?
Finally, we discuss what is our own information that the patient only has access to if they request it. This is information that either will give them too much information (our thought process and remote concerns) or even things that we don’t want them to see (suspicions about truthfulness or worse). Here is this list:
- Perhaps the problem list – if it contains things like anxiety, suspected abuse, or private things the patient has told us.
- The HPI often has information that is potentially sensitive. People have to feel free to tell us things, and having that information be back in the face of the patient on the Internet (albeit a secure site) goes a bit too far. Who knows if a family member can access it? What about teens? It’s just too complicated.
- Part of the assessment and plan is often conjecture and reminders to ourselves to pay attention to things in the future. If a person has weight loss, we may keep cancer in the back of our minds. If a person is asking repeatedly for narcotics, we may write down suspicions that bear watching in the future. We have to have a place where we can put things down and know they are for our own eyes only.
The last list is the shortest. Yet the current state of things is that the entire chart falls into the last category. This not only leaves the patient in the dark, it makes it so we have to do a whole lot of unnecessary work that the patient would do much better at (and without costing us a dime).
I think this is the sweet spot. This is the way the medical record should be in the future. It should be a shared venture – not just between PCP and patient, but also including other providers. For care to truly move forward we have to dream about what it could be. Our office now has this as the vision for where we want to head. I know my patients will be thrilled, and I am pretty sure I’ll have a lot less frustration in the exam room.
*This blog post was originally published at Musings of a Distractible Mind*
