Medical privacy? You don't have any." So said Michael Breen, M.D., medical correspondent for the CBS affiliate in Chicago, in a recent report.
His outburst was sparked by a class-action lawsuit filed in Florida on behalf of patients with depression who had received a free sample of Prozac in the mail without asking for it. A local Walgreen's sent the originating plaintiff the drug; a letter signed by the woman's physician and two other doctors accompanied the sample. The letter apparently had been written by a sales representative for Eli Lilly & Co., the manufacturer of Prozac. (Lilly had just settled with the Federal Trade Commission over charges of another breach of patient privacy involving marketing of Prozac.) A company spokesman said-in the understatement of the year-that "while Lilly supports informing people about new treatment options and encouraging them to discuss these options with their doctor, what occurred in Florida appears to go beyond this."No kidding.
Incidents such as this-and much worse-led Congress to include strengthening of privacy protections in the Health Insurance Portability and Accountability Act of 1996. But Congress never got around to passing legislation spelling out those protections. And so, in its last days, the Clinton administration produced an extensive and complex set of regulations, as it was required to do if Congress failed to act.
No one who is familiar with the Clinton effort would call it perfect-or anything close to that. Some of the restrictions it called for easily could have interfered with the provision of emergency care, physician and nurse consultations, referrals to other providers, the filling of prescriptions, and other day-to-day healthcare activities. Thus it was not surprising that almost the entire healthcare field, from physicians and hospitals to drug manufacturers, complained bitterly about the Clinton rules. The new HHS secretary, Tommy Thompson, heard the cries and promised to "tweak" the proposal.
It was quite a tweak. By the time the Bush administration's version was released in March, the philosophy behind the rules had changed. Instead of providers being required to obtain written consent from patients before performing a wide variety of healthcare activities, all they have to do under the new proposal is notify patients of their privacy rights and the provider's policies and practices regarding use of patient data. Patients are then asked to "acknowledge" that they have been so informed. Whether they even vaguely understand what they have been told is not addressed.
And then their most personal and sensitive information-concerning their mental health, HIV status or state of sexual function-can be shared with all kinds of people and organizations, including being used for marketing by hospitals and drug manufacturers. This, of course, would not be called "marketing" but rather "recommending treatment."
Even with all this new latitude, hospitals are asking for more, including weakening of the already flimsy consent requirements, expansion of the amount of personal patient data they can collect without permission and whom they can share it with, and widening of their ability to use private patient information for fund raising.
Not surprisingly, privacy advocates, congressional Democrats and several newspapers have condemned the new regulations. Former HHS Secretary Donna Shalala, who had overseen the writing of the Clinton rules, wrote a critical editorial in the New York Times. The Health Privacy Project of Georgetown University called the elimination of required prior consent a "devastating blow to patient privacy."
Is there no middle ground here? Isn't there a way to craft regulations that preserve a patient's right to be informed and to give consent prior to treatment without unduly burdening providers? Have we turned healthcare into such a commodity that we accept the buying and selling of the contents of personal medical records? We must find a way to establish reasonable limits on what vendors, employers, insurers, researchers and the press can learn about our health status without making their work impossible. It shouldn't be open season on privacy.
This isn't just an academic debate on ethics. All Illinois hospitals are now required to screen newborns for a broad range of genetic conditions; what happens to the future of children found to have problems when and if that information gets to their parents' employers or insurers? How about Burlington Northern and Santa Fe Railway Co.'s attempt to test 36 of its employees for a specific genetic marker without their knowledge or consent in an attempt to negate their claims of work-related disability? (Burlington entered a legal settlement to resolve the matter.)
In the age of Enron, trust in our leaders and corporate ethics have become central concerns for an increasingly skittish public. And nowhere in this society is trust more critical than in healthcare, where the stakes are so high and the possibilities for misbehavior so plentiful. As Florida Attorney General Bob Butterworth said in issuing subpoenas in the Florida case, "Of all people, patients should be able to trust their physician and pharmacist to have only the patient's health in mind when prescribing and recommending medication."
It will be up to the providers and suppliers to prove that the honor system they wanted-and got-will work. It will be up to Congress and the Bush administration to exercise vigorous oversight. And if abuses continue and patients and the public rebel, I guess we'll all see each other in court.