Privacy and Electronic Health Records

President Obama wants a national electronic health records system up and running in the United States by 2014. There is a lot of skepticism about whether or not it can be set up that quickly, but the point is creating one of these systems is the ultimate goal.

This national health information network will be a large database of medical records that can be accessed from many locations. Professor Thomas Lauer, the Chair of Decision and Information Systems at Oakland University, provides a simple example of how the system would work. “You take a vacation in Aspen and get in a skiing accident, the doctor in Aspen can look at your records [from your hometown] to make the most accurate diagnosis for you.”

Creating this centralized network would obviously make the system far more efficient if it is implemented effectively, but what if it isn’t? Having all of that health information in one location raises some serious privacy issues. “If you have so much data in one location the risk of loss is far greater than if data is dispersed. With paper records the most someone could get is a few records, if someone gets into this system they own the whole thing,” professor Lauer says. It could be like Fort Knox in the movie Goldfinger.

Aside from someone hacking into the system, there are simpler, everyday privacy questions. We will need to determine what 3^rd parties get access to the information, and how much information these 3^rd parties are allowed to see. Should employers be able to see the information? What about health insurance companies? These are issues professor Lauer is particularly concerned about. “A lot of privacy issues have to do with power asymmetry, you are weak, others are strong,” he says. If a person wants a credit card or insurance, he has to give up certain private information, and “if you’re not comfortable giving out that information, the powerful can demand it.” The individual really doesn’t have an option. If they need the service, they need to give up the information.

After determining which people should be able to access which information, there is the potential problem of onward transfer. “I collect your information and you feel confident in me, but I have to give it to someone else, and so on. You may trust my ability, but these other people I gave the information to you can’t be so sure about,” professor Lauer explains. Credit bureaus used to engage in this type of behavior. They would collect secret databases on people, and then sell them.

This also happened in the medical area, with an organization called the Medical Information Bureau, which is similar to the credit reporting agencies. They would collect data, wouldn’t let individuals see their data, and wouldn’t tell them what was in the data. If something in the data was inaccurate, too bad, nothing could be done about it. This information was sold to the MIB’s member insurance companies. Nowadays, patients are able to look at their report once a year, but most people still don’t know this organization exists. This type of onward transfer is a major issue, and with a national database, it could conceivably become much easier.

Finally, there is the issue of what professor Lauer calls “function creep.” The goal of the health information network is to help doctors make a more accurate diagnosis. However, at some point down the line, this can change to “wouldn’t it be great to study the relationship between physical disease and mental disease.” So it’s important to know who controls the data, and whether or not people should have a say in what their private information is used for.

Some people may say, ‘what’s the big deal, I don’t really care what they do with my information.’ Professor Lauer sees this as a side effect of the culture that we live in. “A lot of privacy has to do with personal dignity, and this is a value in society we should protect,” he says. “I think society is seriously compromised in many areas, so not much thought is given to areas like dignity. I believe that’s a problem.”

Whether people care or not, professor Lauer says the most important thing is that people know about these issues. “I really think it's important to raise awareness on the subject of privacy in general, and health information privacy more specifically. In my view, informed dialog that represents a public viewpoint is critical to enacting good policy.”