Shalala Calls for New Health Privacy Laws

WASHINGTON — Federal laws protect the privacy of credit cards, driving records and even video rentals, but there are no safeguards for personal health records, Secretary of Health and Human Services Donna Shalala warned Thursday.

“Our most cherished and personal information,” family secrets about heart disease and cancer, sexual habits and depression all flow freely through computers open to virtually anyone, she said.

“We must act now with national legislation, national education and a national conversation,” Shalala said in a speech to the National Press Club. “The computer revolution means that our deepest and darkest secrets no longer exist in one place and can no longer be protected by simply locking up the office doors each night.”

The secretary will deliver a report to Congress next month on health-privacy issues, and she wants to stimulate a debate leading to federal legislation to assure privacy safeguards for medical records.

The dangers for individuals will worsen, she said, because a “whole new world of genetic tests has the potential to help either prevent disease or reveal our families’ most personal secrets.” Tests can reveal a predisposition to Alzheimer’s disease, cancer and other ailments; disclosure could threaten a person’s chance for a job, a promotion or insurance, she said.

The rapid changes in health care have wiped out privacy, Shalala said. A generation ago, “our health care privacy was protected by our family doctor--who kept handwritten records about us sealed away in a big file cabinet. We trusted our physicians to keep their file cabinets locked and their mouths shut,” she said.

Now doctors participate in health maintenance organizations and other managed-care systems, with records stored in computers, open to inspection by many people.

She mentioned a Boston HMO where every clinical worker could tap into the computer and call up the notes from psychotherapy sessions.

At another HMO, a medical student sold the names of patients with particular conditions to a drug company.

“When we give a physician or health insurance company precious information about our mood or motherhood, money or medication, what happens to it?” she asked.

Rather than computer hackers breaking into systems to steal information, most of the violators of medical privacy are people working within the health care system, Shalala said.

Some hospitals and HMOs are putting tighter restrictions on who has access to patient records, she noted. But a federal law, offering the same protection now given to credit card and video rental records, should cover health information, according to Shalala.

In the age of computerization, the lack of a federal statute effectively opens all records, regardless of state laws that may protect the confidentiality of such information, Shalala said. For instance, anyone with access to an HMO or insurer’s database could go to a computer in a state without restrictive laws to obtain medical records. She also suggested that the improper use of health records should be made a criminal offense under federal law.

California civil law has some restrictions on a corporation’s access to its workers’ medical records. However, there are big loopholes in the law. Companies that self-insure, a category that covers most employers with more than 500 workers, are covered by federal law and are exempt from state confidentiality laws. In addition, hospitals and other health care facilities may distribute records unless a patient has specifically forbidden their release in writing.

Shalala noted that health records are invaluable for use in medical research to measure the efficacy of tests, surgeries and treatments. The government also needs records to help with the detection of waste, fraud and abuse in such federal programs as Medicaid.

Thus, medical records need to be available for these uses without threatening the privacy of individuals, she said. The debate is whether “records will be used to heal you or reveal you.”