Your Medical Records: New CT Laws Take Away Patient Control & Privacy

If you value your privacy and want to keep control over your medical records, tell your legislators to restore the original RAISED SENATE BILL 368 (Feb. 12) that gave Connecticut residents almost complete control over their electronic medical records.

What made Bill 368 so beneficial to residents was the “Opt-in” consent policy in The Health Information Technology Exchange of CT, HITE-CT, that allowed patients to choose what information would be shared, to whom it would be sent and for what purposes it would be used (except emergencies). Unfortunately, the original bill has been modified to no longer give patients this type of control.

Instead, the HITE-CT currently has an “Opt-out” consent policy that allows medical providers, hospitals and government agencies, such as the state Department of Public Health, to exchange patient information for many purposes without patient consent.

Their current “Opt-out” consent policy requires patients to formally refuse to allow “disclosure” of their records to other providers. However, patients may not be able to stop Public Health, business people and others involved in treatment, payment and operations from accessing their records without their consent.  If you allow “disclosure” to providers, it may mean that any provider in the country who is part of the exchange can see your records, until an audit possibly catches an improper access. Additionally, the HITE-CT only needs to notify you if the breach was “significant” enough. This protects the businesses of the HITE-CT from undue litigation, but how does it protect the patient?

Furthermore, those hospitalized do not have the ability to stop any provider in the country who subscribes to the same electronic medical record system from accessing their records without their specific permission. Nor does the new bill require the implementation of available technology to give patients the ability to limit the information in the exchanges. Please note that doctors do not have to honor your request to leave information out of the exchanges.

HOUSE BILL 5038 is perhaps the biggest back door threat to patient privacy ever conceived. HB 5038 will force the insurance companies to transmit our medical information into the All-Payer Claims Database (APCD). It will create a centralized medical claims database by using your Social Security number to collect every diagnosis from all your hospital and doctor visits, including tests, drugs taken, costs and provider names and dates.

Legislators may be reassured that federal regulations for the de-identification and release of data will be followed, but the details do not guarantee privacy, particularly as the state will also be taking the enrollment and eligibility data on patients. It is also not clear whether any state agencies will see the data before or after it is de-identified.

Even without a hacker or a virus getting your medical and identity data, under the new law, you could be identified through databases as varied as those of hospital fundraisers (that gather patient names and dates via the admission process) to those of the Department of Public Health, which already receives identifiable medical data without our consent, as per such laws as HB 6652, PA 11-61, Sec. 143 (b) and HB 6678, PA 09-232, Sec. 74-77.

How hard do you think it would be to recognize you or your children, even without “identifiers,” if you have an unusual illness or injury? The database will include all your treatments for cancer, abortion, sexually transmitted infections, number and dates of childbirth and probably mental health diagnoses.

Our state wants control over the health care system so much that it may fine insurers up to $1,000 a day for noncompliance, pay $1 million to $2 million a year for the APCD, and will force your claims data into it, risking your privacy, probably without being liable for the inevitable breaches.

Over the past few months, I have spoken with individual legislators, attended HITE-CT Committee meetings and given testimony to the Public Health Committee. I spoke not just as a resident, but as a doctor familiar with the value and importance of patient privacy. At this point, I believe only pressure from the public will bring about the reinstatement of patients’ rights in Connecticut.

Please contact your legislators and ask for them to vote for the original (2/12) RAISED S.B. 368 and vote against H.B. 5038.

Comments

comments