Hostname: page-component-cd9895bd7-dk4vv Total loading time: 0 Render date: 2024-12-26T07:52:46.081Z Has data issue: false hasContentIssue false
  • English
  • Français

Medical Record Confidentiality Law, Scientific Research, and Data Collection in the Information Age

Published online by Cambridge University Press:  01 January 2021

Richard C. Turkington
Get access Rights & Permissions [Opens in a new window]

Extract

A powerful movement is afoot to create a national computerized system of health records. Advocates claim it could save the health delivery system billions of dollars and improve the quality of health services. According to Lawrence Gostin, a leading commentator on privacy and health records, this new infrastructure is “already under way and [has] an aura of inevitability.” When it is in place, almost any information that is viewed as relevant to a decision in the health care delivery system would be available to a large and yet undetermined number of individuals. The transformation of the collection and communication of health information from texts housed by health care providers and facilities to data electronically transmitted through networks of linked computers has significant implications for confidentiality and for data collection in scientific research. The best evidence clearly indicates that most people in the United States consider confidentiality for health information important and worry that the increased computerization of health records will result in inappropriate disclosure.

Type
Article
Information
Journal of Law, Medicine & Ethics , Volume 25 , Issue 2-3 , Summer Fall 1997 , pp. 113 - 129
Copyright
Copyright © American Society of Law, Medicine and Ethics 1997

Access options

Get access to the full version of this content by using one of the access options below. (Log in options will check for institutional or personal access. Content may require purchase if you do not have access.)

References

See discussion in Gostin, L.O., “Health Information Privacy,” Cornell Law Review, 80 (1995): At 480–81, n.138.Google Scholar
See id. at 452.Google Scholar
See Louis Harris and Associates, Health Care Information Privacy: A Survey of the Public and Leaders (Atlanta: Equifax, Inc., 1993): At 65.Google Scholar
Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of U.S.C. and I.R.C.) (1996).Google Scholar
See, for example, American Medical Association, Principles of Medical Ethics (Chicago: American Medical Association, 1957): At § 9; “Ethical Principles of Psychologists,” American Psychologist, 36 (1981): At 635–36; and American Hospital Association, Hospital Medical Records (Chicago: American Hospital Association, 1972): At 5.Google Scholar
For a useful discussion of the human dignity respect for person basis for the right to privacy, see Schoeman, F., ed., Philosophical Dimensions of Privacy: An Anthology (Cambridge: Cambridge University Press, 1984); and Turkington, R.C. et al., Cases and Materials on Privacy (Houston: John Marshal Publishing, 1992): Ch. 1. Preserving the integrity of the professional-client relationship reflects the traditions of science, empiricism, utilitarianism, and of the health profession in providing treatment and care.Google Scholar
For a general analysis of the array of laws that touch confidentiality issues and health information, see Gostin, , supra note 1; and Turkington, R.C., “Legal Protection for the Confidentiality of Health Care Information in Pennsylvania: Patient and Client Access; Testimonial Privileges; Damage Recovery for Unauthorized Extra-Legal Disclosure,” Villanova Law Review, 32 (1987): 259–400.Google Scholar
See generally, Advisory Panel on Privacy and Confidentiality of Hospital Records, American Hospital Association, Guidelines on Institutional Policies for Disclosure of Medical Record Information (Chicago: American Hospital Association, 1979); and Bruce, J.A.C., Privacy and Confidentiality of Health Care Information (Chicago: American Hospital Association, 1988). The terminology is in flux because of changes in the health care delivery system. See, for example, Gostin, , supra note 1, at 452 n.4 (using the concept of “Health Data”).Google Scholar
The concepts of confidentiality and breach of confidentiality are the result of collaboration with Robert Wettstein, a psychiatrist. I am deeply indebted to him for his contributions to my understanding of ethico-legal issues in confidentiality law.Google Scholar
See Keeton, W.P. et al., Prosser and Keeton the Law of Torts (St. Paul: West Publishing, 5th ed., 1984): At § 18, 117.Google Scholar
See, for example, Saur v. Probes, 476 N.W.2d 496 (Mich. Ct. App. 1991).Google Scholar
See, for example, Tarasoff v. Regents of the University of California, 551 P.2d 334 (Cal. 1976).Google Scholar
See generally, Mancolini, R.M., “Elder Abuse Policy: Consideration in Research and Legislation,” Behavioral Sciences and the Law, 13 (1995): At 352.Google Scholar
See Hyman, A., Schillinger, D. and Lo, B., “Laws Mandating Reporting of Domestic Violence,” JAMA, 273 (1995): 1781–87.CrossRefGoogle Scholar
See id.Google Scholar
See Stuart, N.E., “Child Abuse Reporting: A Challenge to Attorney-Client Confidentiality,” Georgetown Journal of Legal Ethics, 1 (1987): At 246.Google Scholar
See, for example, 23 Pa. Stat. Ann. §§ 6311-19 (West 1997) (requiring physicians, osteopaths, medical examiners, corners, dentists, registered nurses, and hospital personnel engaged in the admission examination, care or treatment of persons, as well as school teachers and administrators, school nurses, social workers, and day care workers, among others, to report serious physical or mental injury, sexual abuse, sexual exploitation, or serious physical neglect of a child under the age of eighteen). In Roman v. Appley, 558 F. Supp. 449 (E.D. Pa. 1983), the court dismissed all federal and state claims brought against a social worker who had erroneously reported child abuse, on the basis of the good faith defense under the reporting statute.Google Scholar
National Association of Insurance Commissioners, NAIC Insurance Information and Privacy Protection Model Act (Kansas City: National Association of Insurance Commissioners, Model No. 670, 1992).Google Scholar
See id. at § 13(B).Google Scholar
See McCormick, C.T., McCormick on Evidence (St. Paul: West Publishing, 4th ed., 1992): At § 103. See, for example, Jones v. Prudential Life Insurance Co., 388 A.2d 476 (D.C. 1978), where the court upheld a general release of health information to an insurance company and also treated the general release as a waiver of an evidentiary privilege for the information.Google Scholar
Paul Schwartz describes this as a form of “uninformed consent.” See Schwartz, P., “The Protection of Privacy in Health Care Reform,” Vanderbilt Law Review, 48 (1995): 295–346.Google Scholar
Whalen v. Roe, 429 U.S. 589 (1977).Google Scholar
United States v. Westinghouse Electric Corp., 638 F.2d 570 (3d Cir. 1980).Google Scholar
See id. at 578–80.Google Scholar
In re “B,” Appeal of Dr. Loren Roth, 394 A.2d 419 (Pa. 1978).Google Scholar
Rasmussen v. South Florida Blood Service, Inc., 500 So. 2d 533 (Fla. 1987).Google Scholar
See, for example, 500 So. 2d 533; 638 F.2d 570; and In re the June 1979 Allegheny County Investigation Grand Jury, 415 A.2d 7, 76 (Pa. 1980).Google Scholar
See Doe v. Borough of Barrington, 729 F. Supp. 376 (D.N.J. 1990); Carter v. Broadlawn Medical Center, 857 F.2d 448 (8th Cir. 1988); and Doe v. City of New York, 15 F.3d 264 (2d Cir. 1994). These courts found that disclosure of plaintiffs’ HIV status violated their constitutional right to privacy.Google Scholar
See, for example, N.J. Stat. Ann. § 4A-22.15 (West 1997) (New Jersey's victim counselor privilege); and Wis. Stat. Ann. § 905.04 (West 1994) (Wisconsin's statutory privilege for physicians, registered nurses, chiropractors, psychologists, social workers, and marriage and family therapists). See generally, Stone, S.N. and Taylor, R.K., Testimonial Privileges (New York: Shepard's/McGraw-Hill, 2nd ed., 1993): At § 7.01.Google Scholar
See generally, Stone, and Taylor, , supra note 31, at § 7.01; and Wigmore, J.H., Evidence in Trials at Common Law (Boston: Little, Brown, 1961): At § 81.Google Scholar
A few states have applied the balancing approach, even in respect to the psychotherapist-client privilege. See, for example, Me. Rev. Stat. Ann. tit. 32, § 7005 (West 1964); N.H. Rev. Stat. Ann. § 330-A-19 (West 1995); N.C. Gen. Stat. § 8-53.7 (1986); and Va. Code Ann. § 801-4000.2 (Michie 1992). For examples of an implied waiver attaching to the initiating litigation, see “Development in the Law—Privileged Communications,” Harvard Law Review, 98 (1985): At 1637.Google Scholar
See 42 Pa. Cons. Stat. Ann. § 5944 (West 1995) (the Pennsylvania Psychologist-Client Privilege Statute). See also Jaffee v. Redmond, 116 S. Ct. 1923 (1996) (recognizing similar federal privilege).Google Scholar
See, for example, Whyte v. Connecticut Mutual Life Insurance Co., 818 F.2d 1005 (1st Cir. 1987).Google Scholar
The health records of a person's HIV status are also granted limited privilege status in many states.Google Scholar
See, for instance, Commissioner of Social Services v. David R.S., 436 N.E.2d 451 (N.Y. 1982).Google Scholar
See 818 F.2d 1005.Google Scholar
See 436 N.E.2d 451.Google Scholar
West Virginia Board of Medicine v. Mayo Clinic, Civ. No. 3092-335 (D. Minn. 1993).Google Scholar
See Napp, S. and Vander Creet, L., Privileged Communications in the Mental Health Profession (New York: Norstrand/Rinehold, 1987).Google Scholar
Jaffee, 116 S. Ct. 1923.Google Scholar
See id.Google Scholar
See id. (Stevens, J.).Google Scholar
See Freedom of Information Act, 5 U.S.C § 552 (1988).Google Scholar
See Privacy Act, 5 U.S.C. § 552a (West 1979 & Supp. 1990).Google Scholar
See Forsham v. Harris, 445 U.S. 169 (1980).Google Scholar
See 5 U.S.C. § 552, exempt. 3.Google Scholar
See 52 Fed. Reg. 21796 (1987 WL 148286).Google Scholar
See 5 U.S.C. § 552, exempt. 6.Google Scholar
See, for example, United States Department of Justice v. Reporters Committee for Freedom of Press, 489 U.S. 749 (1989); and Department of the Air Force v. Rose, 425 U.S. 352 (1976).Google Scholar
5 U.S.C. § 552a (West 1974 & Supp. 1990); and New Systems of Records, 62 Fed. Reg. 16596 (1997).Google Scholar
See Gostin, , supra 1, at 501–03.Google Scholar
See Iowa Code Ann. § 22.1 (West 1995).Google Scholar
Head v. Colloton, 331 N.W.2d. 870 (Iowa 1983).Google Scholar
See Smith, R.E., Compilation of Federal and State Privacy Laws (Providence: Privacy Journal, 1992): At 20–24.Google Scholar
Mass. Gen. Laws ch. 66A, §§ 2(c), 2(f) (1996).Google Scholar
See Flaherty, D.H., Protecting Privacy in Surveillance Societies (Chapel Hill: University of North Carolina Press, 1989): At 305.Google Scholar
42 C.F.R. §§ 2.21, 2.32 (1996).Google Scholar
See Andrews, L.B. and Jaeger, A.S., “Confidentiality of Genetic Information in the Workplace,” American Journal of Law & Medicine, XVII (1991): At 75, n.26, for a summary of states that view breaches of confidentiality as grounds for professional discipline including loss of license.Google Scholar
See Hammonds v. Aetna Casualty & Surety Co., 243 F. Supp. 793 (N.D. Ohio 1965).Google Scholar
See Estate of Behringer v. Medical Center at Princeton, 592 A.2d 1251 (N.J. Super. Ct. Law Div. 1991).Google Scholar
Warren, C. and Brandeis, L., “The Right to Privacy,” Harvard Law Review, 4 (1890): 193–220.Google Scholar
The four privacy torts are summarized in Section 652 of the Restatement (Second) of Torts: (1) 652B. Intrusion upon Seclusion (Privacy Intrusion Tort); (2) 652C. Appropriation of Name or Likeness; (3) 652D. Publicity Given to Private Life (Private Facts Tort); and (4) 652E. Publicity Placing Person in False Light.Google Scholar
See Bezanson, R.P., “The Right to Privacy Revisited: Privacy, News, and Social Change, 1890–1990,” California Law Review, 80 (1992): 1133–76; and Zimmerman, D.L., “Requiem for a Heavyweight: A Farewell to Warren and Brandeis’ Privacy Tort,” Cornell Law Review, 68 (1983): 291–367. Both authors suggest that the breach of confidence tort be used in place of the private facts tort. See Doe v. Methodist Hospital, 639 N.E.2d 683 (Ind. Ct. App. 1994); and Multimedia WMAZ, Inc. v. Kubach, 443 S.E.2d 491 (Ga. Ct. App. 1994), where the private facts tort was the basis of a liability claim against a hospital and its employees and a television station for publishing a person's HIV status. See also, Miller v. Motorola, Inc., 560 N.E.2d 900 (Ill. 1990) (holding an employer liable for disclosing an employee's personal health information to coworkers).Google Scholar
For an elaboration of the distinction between highly intimate and highly personal, see Turkington, R.C., “Legacy of the Warren and Brandeis Article: The Emerging Constitutional Right to Informational Privacy,” Northern Illinois University Law Review, 10 (1990): At 506–07.Google Scholar
See Confidentiality of Alcohol and Drug Abuse Patient Records, 42 C.F.R. § 2.1 (1996). The regulations do not provide a blanket privilege for the records. However, the records may only be disclosed in court proceedings after a court hearing and after a finding of good cause. In determining good cause, the court is required to weigh the need to know against the injury to the physician-patient relationship and treatment service. Courts are also required to impose safeguards against unnecessary further disclosure.Google Scholar
Fed. R. Civ. P. 26(c).Google Scholar
Farnsworth v. Procter Gamble Co., 758 F.2d 1545 (11th Cir. 1985).Google Scholar
See id. at 1547.Google Scholar
See id. at 1545.Google Scholar
Andrews v. Eli Lilly & Co., 97 F.R.D. 494 (N.D. Ill. 1983). Defendant Squibb was able to get information in the Registry from those women who had initiated lawsuits, because they had voluntarily raised the issue of their medical conditions in court.Google Scholar
Argonaut Insurance Co. v. Peralta, 358 So. 2d 232 (Fla. Dist. Ct. App. 1978).Google Scholar
See supra notes 25-26 and accompanying text.Google Scholar
See 42 C.F.R. ch. 1, § 2a.1 (1996).Google Scholar
See id.Google Scholar
See Assistant Secretary, U.S. Department of Health and Human Services, Interim Policy Statement (May 22, 1989).Google Scholar
21 U.S.C. §§ 301 et seq. (1994) (Food, Drug and Cosmetic Act).Google Scholar
Earley, C.L. and Strong, L.C., “Certificates of Confidentiality: A Valuable Tool for Protecting Genetic Data,” American Journal of Human Genetics, 57 (1995): 727–31.Google Scholar
See Alberts v. Devine, 479 N.E.2d 113 (Mass. 1985) (psychiatrist of priest to superior and bishop); MacDonald v. Clinger, 84 A.D.2d 482 (N.Y. App. Div. 1982) (psychiatrist to spouse); Schaffer v. Spicer, 215 N.W.2d 134 (S.D. 1974) (psychiatrist to spouse); Humphreys v. First Interstate Bank, 696 P.2d 527 (Or. 1985) (physician of natural mother to adopted daughter); and Home v. Patton, 287 So. 2d 824 (Ala. 1973) (physician to employer).Google Scholar
See Holder, A.R., “Research and Subpoenas: A Continuing Issue,” IRB: A Review of Human Subjects Research, 15, no. 1 (1993): 6–7.Google Scholar
See generally, Gilles, S.M., “Promises Betrayed: Breach of Confidence as a Remedy for Invasions of Privacy,” Buffalo Law Review, 43 (1995): 1–84.Google Scholar
45 C.F.R. § 46.116 (1997).Google Scholar
See 45 C.F.R. § 46.116(a)(5) (1996). The general requirements for informed consent include “A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.”Google Scholar
One issue is whether the regulations apply when the data is acquired during clinic care. Some have argued that those under clinical care are not human subjects within the regulations. However, the better view is that data acquired in clinical settings is covered by the regulations, because the definition of research on human subjects includes any investigator conducting research who obtains identifiable private information on a subject. 45 C.F.R. § 46.102(f) (1997). For a useful analysis of these and other important issues under the regulations, see Clayton, E.W. et al., “Informed Consent for Genetic Research on Stored Tissue Samples,” JAMA, 274 (1995): 1786–92.Google Scholar
45 C.F.R. § 46.101 (1997). Some commentators view this exemption to apply only where (1) the nonidentifiable data is in existence at the time the research commences, and (2) the identifiers must have been irretrievably removed from the data that is studied. See Clayton, et al., supra note 87.Google Scholar
See 45 C.F.R. § 46.101(5)(f).Google Scholar
See Minn. Stat. Ann. § 144.335 (West 1996).Google Scholar
Veatch, R.M., “Consent, Confidentiality, and Research,” N. Engl. J. Med., 336 (1997): At 869.Google Scholar
See Donaldson, and Lohr, , supra note 23, at 202, 205, rec. 4.3.Google Scholar
See Clayton, et al., supra note 87. See also Capron, A.M., “Protection of Research Subjects: Do Special Rules Apply in Epidemiology?,” Journal of Clinical Epidemiology, 44, Supp. 1 (1991): 81S–89S.Google Scholar
See Veatch, , supra note 91; and Wald, N. et al., “Use of Personal Medical Records for Research Purposes,” British Medical Journal, 309 (1994): 1422–24.Google Scholar
Pub. L. No. 104-191, 110 Stat. 1936, § 264 (1996).Google Scholar
Id. at § 1173(b).Google Scholar
Id. at § 264.Google Scholar
A 1993 Harris survey indicated that 56 percent of the public who responded to the survey thought that federal legislation was needed. See Louis Harris and Associates, supra note 3, at 97. A majority of public officials also indicated their support for national legislation.Google Scholar
National Committee on Vital and Health Statistics, Health Privacy and Confidentiality Recommendations (visited July 24, 1997) <http://aspe.os.dhhs.gov/ncvhs/privrecs.htm>..>Google Scholar
Shalala, D.E., U.S. Secretary of Health and Human Services, Address to the National Press Club, Washington, D.C. (July 31, 1997).Google Scholar
See Lowrance, W.W., Privacy and Health Research, A Report to the U.S. Secretary of Health and Human Services (Washington, D.C.: Department of Health and Human Services, May 1997): At 43, 53.Google Scholar
Numerous bills were proposed in the 104th and the 105th Congress. They included: Medical Records Confidentiality Act of 1996, S. 1360, 104th Cong. (1996) (proposed by Senator Robert Bennett (R-Utah); Medical Privacy in the Age of New Technologies Act of 1997, H.R. 1815, 105th Cong. (1997) (proposed by Representative Jim McDermott (D-Wash.); and Fair Health Information Practices Act of 1997, H.R. 52, 104th Cong. (1997) (proposed by Representative Gary Condit (D-Cal.). Senator Patrick Leahy (D-Vt.) has a proposal that was not introduced during the last term, but is well known. I cite sections from Leahy's most recent proposal, which is designated 105th Congress. These proposals are currently being reviewed and revised.Google Scholar
See Lowrance, , supra note 101.Google Scholar
See, for example, H.R. 52, §§ 111–12 (describing the consent form and requiring notice in terms of a statement of use but no restrictions on general consent). See also § 113(A), authorizing a health information trustee to a health benefit plan sponsor, health care provider, or health oversight agency for the purpose of payment without patient consent and providing for health care unless the subject “has not previously objected to the disclosure in writing.”Google Scholar
See H.R. 1815, § 209(a); and Leahy Bill, § 312(a). Another proposal would grant public health agencies unrestricted access to personally identifiable medical information. See S. 1360, § 208.Google Scholar
See Bill, Leahy, §§ 201–03; H.R. 1815, §§ 101-03; S. 1360, §§ 101-03; and H.R. 52, §§ 101–03.Google Scholar
See H.R. 52, §§ 151–54; S. 1360, §§ 301-02, 311; H.R. 1815, §§ 301-02, 311; and Bill, Leahy, §§ 111–13, 121–24.Google Scholar
U.S. Const. art. VI.Google Scholar
42 C.F.R. ch. 1, § 2.20 (1996).Google Scholar
American Hospital Association (visited Aug. 13, 1997) <http://www.aha.org>..>Google Scholar
See, for example, S. 1360, tit. IV, § 401.Google Scholar
See H.R. 52, § 304(b).Google Scholar
Council Directive 95/46/EC, art. 24, 1995 O.J. (L281) 31–50.Google Scholar
H.R. 1815, § 201(h).Google Scholar
Bill, Leahy, § 4(12).Google Scholar
H.R. 1815, § 3(14).Google Scholar
See Lowrance, , supra note 101, at 34; and Clayton, et al., supra note 87.Google Scholar
See Capron, , supra note 93. Alexander Capron views informed consent for research as primarily having the role of preventing harm to the subject. But consent also has four additional functions: (1) promoting autonomy and self-determination; (2) improving research; (3) regularizing relationships; and (4) protecting privacy.Google Scholar
See H.R. 1815, § 103(a)(1)(E); and Bill, Leahy, § 302(c)–(d).Google Scholar
See Bill, Leahy, § 302(f).Google Scholar
See H.R. 1815, § 103(a)(1)(A)–(E); and Bill, Leahy, § 302(f).Google Scholar
See H.R. 1815, § 111(b)(2)(C)–(D).Google Scholar
See H.R. 52, § 112 (1997).Google Scholar
See National Committee on Vital and Health Statistics, supra note 99.Google Scholar
See, for example, Katz, J., The Silent World of Doctor and Patient (New York: Free Press, 1984); and Faden, R. and Beauchamp, T., A History and Theory of Informed Consent (New York: Oxford University Press, 1986).Google Scholar
See, for example, United States v. R. Enterprises, Inc., 111 S. Ct. 722 (1991) (holding that there is a different standard of relevancy for subpoenas issued by a trial court and by a grand jury); In re Allegheny County, 415 A.2d 73 (constitutional right to privacy reached records subpoenaed by a grand jury investigating possible fraud in billing); Division of Medical Quality Board of Medical Quality Assurance v. Gherardini, 156 Cal. Rptr. 55, 93 Cal. App. 3d 669 (4th Cir. 1979) (holding that statutory privilege and constitutional right to privacy required a state medical quality assurance board to demonstrate that access to records was necessary to further a compelling state interest); and United States v. Miller, 425 U.S. 435 (1976) (holding that a subpoena of bank records was not a search of the bank customer under the Fourth Amendment).Google Scholar
See Bill, Leahy, § 324. Oversight agencies are not required to procure a subpoena to show probable cause to access research records in the private sector.Google Scholar
See H.R. 1815 § 207.Google Scholar
See H.R. 52, § 2(6); and S. 1360, § 2(8).Google Scholar
Pub. L. No. 104-191, 110 Stat. 1936, § 248(a) (1996).Google Scholar
Compare 42 C.F.R. § 2.65 (1996).Google Scholar
See Bill, Leahy, § 315.Google Scholar
See H.R. 1815, § 213.Google Scholar
See id.; and Bill, Leahy, § 315.Google Scholar
See H.R. 52, §§ 116–17: Bill, Leahy, §§ 311, 314, 322; and H.R. 1815, §§ 116–17.Google Scholar
See Bill, Leahy, § 322; and H.R. 1815, § 210.Google Scholar
See H.R. 52, § 116.Google Scholar