4 Mar 2009

Trust me…it’s bleeding.

So says a new report from Dartmouth College telling us that in the US “data hemorrhages” are coming from all over the health sector including hospitals, physicians, laboratories, as well as outsourced service providers.

For example, the researchers found a 1,718-page document from a medical testing laboratory containing patient Social Security numbers, insurance information, and treatment codes for thousands of patients exposed on a P2P network, as well as two spreadsheet databases from a hospital system detailing highly sensitive personal information on over 20,000 patients, including codes revealing their diagnoses.

Among the many troubling issues raised in this report, what strikes us is that a source of the problem is not necessarily a scheming employee intent on medical identity fraud but rather inadvertent disclosures on internet-based file sharing networks.  Stories like these are just one more reason for patients to be worried about the privacy of their personal health information.  And with the new funds flowing in support of electronic health records development here in Canada, there needs to be some sober second thought on how the health care sector proceeds to maintain patient trust.

The Canadian Medical Association reported on this question at a health conference in January 2009.  They said they have public opinion survey results over the last ten years that consistently show 11% of respondents holding back information from their physicians because of concerns about their privacy.  The Alberta Medical Association expressed similar concerns in its comments in Committee around Bill 52 (status) in that province: “If patients don’t believe we can protect their privacy and that we may be forced to share the information that they confide in us, they will stop telling us everything we need to know to make the right diagnosis and provide the right care.“

The rush toward electronic health records may well cause more people to feel concern and anxiety about the privacy of their health information so it will be important to keep these views in mind over the coming years.

Research we co-funded through EKOS in 2007 found that 45% of respondents worried that their information could be accessed for malicious or mischievous reasons, 37% were worried that privacy and security procedures would not be followed by those with access to their records, and 55% wanted the ability to mask or hide sensitive information in their file from some users who would be authorized to have access to their health records.

We believe that a patient’s ability to exert some control over who gets to see this most sensitive, personal information seems crucial to preserving patient trust in the health care system.  The last thing we need is more patients withholding information from their health providers because they don’t trust their privacy will be protected and because they continue to hear about privacy breaches involving medical information.

What’s needed is respect for patient wishes, patient control of their personal health information, strong legislation to protect patient privacy as well as transparency and accountability to patients.  And it goes without saying that organizations need to protect against the privacy breaches, such as exposure on P2P networks, that undermine patient trust in the whole system.

(Thanks to SC Magazine for reporting on this research at Dartmouth College.)

3 Responses

Eric Howe Says:

There’s also the issue of off-shored data entry and records management. I remember a story from a couple years ago about a subcontractor in India that wasn’t getting paid; this subcontractor was working (eventually) for a medical records management company in the US. When the subcontractor stopped getting paid they had to threaten to dump all the records onto the open net to force the US company to pay.

I tend to think that all data about a person is their property. If a company or government institution is handling said data then they should manage it at least as well as a bank manages a safe deposit box.

mike waddingham Says:

I can see two sides to this issue.

First, I agree that we own our own health data and should be informed on how/where it is stored. Protecting data ‘at rest’ is very important. And, clearly, any data breaches need to be properly reported as well.

However, health care is primarily about improving health and saving lives. For example, there is a lot of discussion around strong authentication to protect health records. A physician faced with an overly cumbersome authentication system is not going to be as effective as one who has ready and fast access to information. In acute care situations, excessive information security could literally cost lives.

So, I think that the issue is situational and complex, and working through the issues to find a balance between appropriate access and privacy protection is not an easy task…

Marie Says:

I don’t trust the medical system with my information *at all*. This means I go to the doctor as infrequently as possible, and minimize the information I give any medical staff.

I think adult patients should have the right to see all their medical records, and to delete any details they wish from those records. Patients should also get to choose who will view their records. Not likely to happen, is it? No, adult patients are assumed to be incompetent, so ‘professionals’ make decisions about how our information is stored. Instead of controlling our own records, the opposite is happening – we’ve got endless news stories about people’s medical records ending up in the wrong hands.

There’s probably nothing I can do about it; the medical profession doesn’t give a damn how I feel about this situation. But what I can do to keep my information private is to stay away from the doctor. I do that as much as possible.

Leave a Reply

If you wish to leave a reply, you will be asked to provide your name and e-mail address. Your e-mail address is required for the purposes of limiting spam and contacting you should we have questions about your comment.

To learn more about why this information is collected and how it will be used, please read our Blog Comment Policy.