IT Everything: Health IT Blog—A contrarian's view of data rights

Here's a thought. When it comes to privacy and security, all patient information is equal.

This isn't a new idea, of course.

I have a copy of the Oath of Hippocrates on my wall. It says, “Whatever … I may see or hear … which ought not be spoken abroad I will not divulge, as reckoning that all such should be kept secret.”

In the U.S., however, that's all Greek to the feds and many states. They have created legal gradations of health information sensitivity. Patient information about mental health, drug and alcohol abuse treatment and HIV/AIDs, for example, is earmarked for special treatment, particularly when it comes to health information exchange.

Typically, U.S. laws specifically require patient consent before “sensitive” information can be shared, even between doctors and hospitals, whereas, under the 2002 HHS-revised HIPAA privacy rule, patient consent is no longer required for most data sharing of other health data types.

So, it was refreshing to visit with Dr. David Levin last week at a health IT leadership forum here in Chicago hosted by Microsoft.

“I'm a little bit of a contrarian,” said Levin, a board certified family practitioner and full-fledged geek doc. He is the chief medical information officer at the Cleveland Clinic.

“Once you get into the clinical information side, I've been skeptical of differentiating things as even more sensitive,” he said. “We need to treat all of this clinical information as extremely private and confidential.”

“This is the thing that keeps me awake at night” about the direction of information technology, Levin said. “I'm a family doctor. I believe at the foundation of all of healthcare is trust. If we violate trust, then there is no way we're gong to have a successful healthcare system.”

When the patient enters the exam room and the door is closed, “It's a sacred time in a sacred space,” Levin said. “What I worry about as we create these systems of data and as we move into new areas, with social networks and social data, we may end up with the Facebook problem.”

As a Facebook user, I know that creepy feeling well, and it's not just the immediate annoyances—legions of popup adds linked to words or interests I've recently expressed on my page—but what future uses, or harms, might come of the data mining of information or communications I've engaged in there.

This problem is only going to get worse.

Soon, the largely unregulated torrent of patient-generated health data gushing from the open hydrants of millions of high-powered and exquisitely interoperable mobile devices will exceed even the prodigious and rising tide of data flows (many only lightly regulated) from providers' data sources, such as electronic health records systems, lab systems, PAC/RIS systems and inpatient monitors.

Levin said the tipping point, when the volume of patient-created data outstrips provider-created data, may be only three to five years, but certainly not 10 years, off.

And while the total volume of data about a patient will be greatly enriched by mobile and home health systems, “a great thing,” Levin said, the coming wave presents a host of challenges.

Simply capturing and storing all these new data flows is one part of the problem.

Another, tougher one will be, “You've got to turn that into intelligible data. How do we take that data to make it truly actionable?

“We want our clinicians to be able to see it and act on it in one frame,” he said. “I want to highlight the things that really require your attention and then close the loop back with patients. We want to see clinical decision support that has a patient face. A patient enters data and it bounces against some well-designed decision support. It bounces back to me and I say, 'Take an extra water pill.'”

A third challenge will be to protect the privacy of the patients as these data flows slosh together.

One approach is to re-empower patients, restoring to them the right of consent for the sharing of all their data, regardless of the source or level of sensitivity.

“Philosophically, that's appealing, but I don't know how practical that will be,” Levin said. “It's a mistake, and we make the mistake all the time, to think of patients as monolithic.

“We're going to have patients and groups of patients that are more and or less facile with the information,” he said. But there also will be circumstances—such as emergency room visits by traumatized patients, or patients without computer or medical literacy—in which “a patient making an informed choice is really hard to believe.”

“Whatever organizations we design in the future we have to take that into consideration,” Levin said.

Follow Joseph Conn on Twitter: @MHJConn