Legal Issues Concerning Electronic Health Information: Title and subTitle BreakPrivacy, Quality, and Liability

Computer technology is transforming the ways in which health information is acquired, used, disclosed, and stored in the modern health care system. Fundamental changes in the organization, delivery, and financing of national health care services through managed care and integrated delivery plans require sophisticated health information systems that facilitate information sharing.^{1 - 2} Increasingly, individual patient medical records are stored in electronic databases by government and private medical providers. Automated technologies may someday enable patient medical records to be recorded longitudinally from birth to death and accessed widely in a national health care information infrastructure.³ E-mail correspondence is increasingly a viable communication link between patients and physicians.⁴

Public, online networks including MEDLINE, the Internet, and the World Wide Web allow health consumers and physicians to quickly and relatively inexpensively access a wealth of medical information, reports, articles, and research about conditions,⁵ treatments,⁶ and providers.⁷ Expanding communications technology has transformed the practice of telemedicine from its origins of transmitting clinical advice over the telegraph.^{8 - 9}

Many advantages exist to the systemic collection and use of electronic health data. Better data allow consumers to make more informed decisions about health plans, providers, diagnoses, products, and treatments. Clinical care is improved through faster and more accurate diagnoses,¹⁰ increased checks on medical procedures,¹¹ prevention of adverse drug events,¹² instantaneous research of medical conditions, and the dissemination of expert medical information to areas traditionally underserved. Medical research on the causes of disease and injuries and health services research concerning the quality and cost-effectiveness of health care services are improved through increased access to (and more accurate) information. Public health surveillance of morbidity and mortality across populations is facilitated.^{13 - 14} Electronic security tools including personal access codes, encryption programs,¹⁵ and audit trails¹⁶ can more efficiently monitor health care fraud and abuse³ and protect data from unauthorized use and disclosures.

Along with these benefits, however, come significant legal challenges. The computerization of health data challenges traditional legal protections of patients and providers concerning the use and disclosure of health information in 3 key areas: (1) privacy of individually identifiable health information, (2) quality and reliability of information, and (3) tort-based liability. In this article we examine these 3 areas precisely because of a definable relationship we observe among them. We assert that protecting health information privacy (by providing individuals some control concerning their health data without severely restricting warranted use of the data) directly improves the quality and reliability of health data (by encouraging individuals to fully use health services and allowing communal uses of the data for societal goods), which diminishes tort-based liabilities (by reducing the opportunities for medical malpractice or invasions of individual privacy, improving the quality and reliability of health research data, and ultimately improving the quality of clinical care and medical products in the marketplace).

To illustrate this hypothesis, we discuss select applications of computer-based technologies in the medical setting, including e-mail and telemedicine, in the context of a brief review of existing and proposed health information privacy laws at the federal and state levels. We further analyze the interconnectivity of individual privacy with the quality and reliability of health data as well as the legal and regulatory structures designed to protect individual consumers and practitioners in the health care marketplace. We conclude with several recommendations for legal reform, focusing on protecting the privacy and quality of health data.

Principal among the legal challenges presented by the computerization of health data information is how to protect individual privacy interests in personally identifiable health information. Health data about individuals are among the most sensitive types of personal information.¹⁷ Protecting the confidentiality of personally identifiable health data is critical. Insufficient protections can lead to unauthorized use and disclosures of data,¹⁸ subjecting individuals to possible embarrassment, social stigma, and discrimination.¹⁹ Modern computer applications in the health care system threaten individual privacy despite offering significant benefits to patients and practitioners. Computerized databases of personally identifiable information may be accessed, changed, viewed, copied, used, disclosed, or deleted more easily and by more people (authorized and unauthorized) than paper-based records. With little more than basic information about a person, detailed medical profiles of individuals can be quickly assembled by private or commercial actors^{20 - 21} through online networks, Internet chat boards, and retrieval services.²² Additional issues of privacy and technology are illustrated below in 2 prominent examples: e-mail as a means of patient-physician communication and the practice of telemedicine.

E-mail correspondence among patients and physicians, both solicited and unsolicited,²³ has increased dramatically in recent years.²⁴ E-mail can be an effective communication tool²⁵ that (1) circulates information efficiently, (2) enables thoughtful exchanges of medical information, (3) allows authorized receivers to save messages electronically or in paper form, and (4) can be linked to educational Web sites and other media.^{26 - 27}

Yet, e-mail use also poses privacy and security concerns. Unsecured e-mail can be intercepted by others in route. Anyone with access to a physician's e-mail account can access, alter, and respond to e-mail with the illusion of authority. Technical complications may prevent the transmittal of important e-mail information. These and other considerations have led organizations like the American Medical Informatics Association to develop guidelines for the use of patient-physician e-mail that reflect privacy values including (1) obtaining patient informed consent before using e-mail for direct correspondence, (2) explaining and using security mechanisms, (3) prohibiting the forwarding of patient e-mail without express authorization, (4) informing patients about those having access to their messages and whether their messages will become part of their medical records, (5) responding to messages responsibly, and (6) avoiding references to third parties.²⁴

Physician-patient e-mail is one electronic tool used in telemedicine. Telemedicine uses communications technology to deliver health care information and services between medical providers and patients separated by geographic boundaries.²⁸ Telemedicine improves clinical care to traditionally underserved populations (such as patients in rural areas), broadens access to specialty care and advanced technology, and facilitates clinical encounters and educational activities between physicians and patients.²⁹ It also increases opportunities for invasions of privacy by dispersing health data through interceptable telecommunications, thus magnifying the risks of breaching patient-physician confidentiality.²⁸ As with e-mail transmissions, similar recommendations for privacy and security protections through cryptography or message authentication have been proposed concerning telemedical practices.³⁰

Adequate legal protection of personally identifiable health data is necessary to facilitate the transmission of electronic data through e-mail, telemedicine, and other applications. Existing legal safeguards in the United States, however, are inadequate. Privacy protection is fragmented and inconsistent with major gaps in coverage.¹⁷ There is no comprehensive, national legislative, or regulatory standard concerning how privacy interests in identifiable health information are protected, secured, or verified. Rather, a patchwork of federal and state laws and judicial theories prescribe narrow privacy protections for selected types of individual health information or information held by certain entities.

Informational privacy is protected by the Constitution and federal legislation, although such protections are limited.^{31 - 32} Constitutional protections of health information privacy are restricted to governmental activities, and thus do not extend to the private sector where vast health information is exchanged.³³ Even where applicable, constitutional safeguards are nominal. Courts allow states wide latitude in protecting the public health³⁴ and view government purposes of clinical care, quality assurance, cost-containment, or research underlying data collection, use, or disclosure as substantial, if not compelling. As long as the government is attentive to privacy and security concerns, it is likely to prevail under the deferential constitutional approach adopted by the judiciary.³⁵

Federal statutes and regulations provide limited contextual protection of health information privacy. The Privacy Act of 1974,³⁶ which regulates the transmission of government-held health data,³ and the Freedom of Information Act,³⁷ which excludes certain medical files from its disclosure requirements,³ only protect federal government records, not private-sector health data. Federal agencies retain substantial administrative discretion to disclose data without individual consent. Courts can require disclosures in the interests of justice. The Americans With Disabilities Act requires employers to maintain separate files for health questionnaires and medical examinations of applicants and employees.³⁸ Provisions of the Public Health Service Act require federally assisted facilities to protect drug and alcohol treatment records³⁹ and allow for the execution of certificates of confidentiality to protect research data.^{3 ,40} Medicare Conditions of Participation require participating hospitals to ensure the confidentiality of patient records.⁴¹ Regulations concerning human subject research⁴² address record confidentiality to a limited degree.³

State safeguards of health information privacy are often incomplete or inadequate.¹³ While some states (eg, Maine, Montana, Washington, California, Maryland, Rhode Island) have passed or are considering comprehensive health information statutes, most state privacy statutes are restricted to government-held data. These piecemeal statutes may (1) be silent about the degree of privacy protection afforded or allow access to so many groups as to provide no meaningful protections; (2) fail to address secondary uses of information (ie, disclosure of data by others for purposes beyond those used to justify the original collection); (3) grant data holders broad and unreviewable discretion to disclose data; (4) fail to protect health data from public disclosure through subpoena or court order; and (5) have weak or nonexistent penalties for unauthorized disclosures, even by government health officials.

In contrast, some states enact "super-confidentiality" statutes for certain diseases (eg, human immunodeficiency virus and/or acquired immunodeficiency syndrome or mental illness) or certain kinds of health data (eg, genetic test results).^{43 - 44} Making exceptions of certain conditions to the exclusion of others without clear physiological, epidemiological, psychological, or social differences is unjust and administratively problematic. Health data cannot always be neatly separated in an electronic health record as these statutes suggest. Furthermore, such laws may significantly impede justifiable transfers of data across state lines.

Comprehensive federal health information legislation (or administrative regulations) pursuant to the Health Insurance Portability and Accountability Act⁴⁵ (HIPAA) may soon provide greater legal protections. Although this law required Congress to enact comprehensive legislation to protect electronic health data by August 21, 1999, Congress has failed to do so. As a result, regulations developed by the Department of Health and Human Services will take effect on February 21, 2000 (assuming HIPAA is not amended).⁴⁶ (Given the 6-month delay before regulations of the Department of Health and Human Services take effect, Congress essentially has until February 2000 to legislatively respond to HIPAA's prior mandate).

The Department of Health and Human Services has previously sent Congress recommendations for legislation to protect health information,⁴⁷ which set forth the following 5 key principles: (1) boundaries: health care information should be disclosed for health purposes only, with limited exceptions; (2) security: health information should not be distributed without patient authorization absent a clear basis and those who receive such information must safeguard it; (3) consumer control: persons are entitled to access and amend their health records and to be informed of the purposes for which it is used or disclosed; (4) accountability: those who improperly handle health information should be criminally punished and subject to civil recourse; and (5) public responsibility: individual privacy interests must not override national priorities of public health, medical research, preventing health care fraud, and law enforcement in general.⁴⁶

Congress has recently debated 3 HIPAA health information privacy bills,^{48 - 50} as well as a banking privacy bill that includes health information privacy provisions relating to insurance companies.⁵¹ The latter legislation would automatically be repealed upon enactment of a HIPAA bill.⁵² Each of the HIPAA bills follows a predictable pattern that seeks to protect personally identifiable health-related information (ie, protected health information) by guaranteeing individual rights of access, copying, amendment, and knowledge of disclosures. Broad prohibitions on uses and disclosures are set forth only to be diluted by disclosure exceptions for which individual consent may not be required. These include disclosures (1) to a patient's next of kin, (2) to health oversight agencies, (3) for public health purposes, (4) to identify a deceased individual, (5) in cases of medical emergencies, (6) for health research, (7) pursuant to a civil or criminal subpoena, and (8) to facilitate electronic payment transactions. They also include the controversial allowance for disclosures to law enforcement agencies. At least 1 bill allows such disclosures provided ". . . the law enforcement official complies with the Fourth Amendment to the Constitution."⁵³ The Fourth Amendment upholds privacy to a degree by protecting individuals from unreasonable searches by government, absent probable cause. The other bills merely spell out the constitutional requirements, conditioning such disclosures on the showing of a subpoena, warrant, or court order, or the existence of a separate federal or state law authorizing the disclosure.^{54 - 55}

Federal preemption of state and local law is another highly controversial aspect of potential Congressional action.⁵⁶ Broad federal preemption would override all existing and future state privacy laws. Floor preemption would provide a basic level of national uniformity without preempting all state privacy laws.⁵⁷ Only state laws that provide less protection than federal privacy standards would be preempted. State laws that are more protective would survive.

The quality and reliability of personal medical information are related to protecting the privacy of personally identifiable data in 3 ways. First, fair information practices, including the right to access and amend medical records, may lead to better quality data by allowing individuals and encouraging data holders to amend erroneous information.³⁵ Second, privacy assurances between physicians and patients enhances the trusting relationship between patients and physicians, thus contributing to the free exchange of health information. Patients who lack trust in their providers may fail to disclose their medical conditions, provide false information to protect their confidentiality, or simply avoid care altogether.⁵⁸ Such distortions lower the quality and reliability of national health data. Finally, national standards for data protection may encourage greater sharing of data. When physicians and others rely on accepted principles governing disclosures of health information, responsible circulation of health data should follow.

Quality and reliability issues also arise from the proliferation of consumer-oriented medical information available through technological media sources.⁵⁹ Government, academic institutions, medical product/drug manufacturers and retailers, health insurers, private practitioners, and consumers post medical information on user-friendly Web pages that are accessed by millions of Americans.⁶⁰ The quality of such medical information, particularly for answering clinical questions,⁶¹ is highly suspect.⁶² Health data, especially commercial data, are not adequately monitored for quality.⁶³ Neither the Federal Trade Commission, which regulates false or deceptive commercial information,^{64 - 65} nor the Federal Food and Drug Administration, which regulates medical information about drugs and medical products,⁶⁶ can aggressively monitor the quality of all commercial health data over the Internet. Government attempts to stifle nondefamatory information over the Internet may violate free speech protections,⁶⁷ although regulations protecting consumer health and safety may be upheld. Without adequate government oversight, effective self-regulation of the quality of medical information is needed.⁶⁸

Privacy and quality issues concerning the computerization of health data pervade tort-based liability. Unwarranted disclosures of personal medical information by physicians or their agents have traditionally resulted in tortious or contractual claims of invasion of privacy,⁶⁹ breach of confidentiality,⁷⁰ or implied statutory violations under state law.^{71 - 72} Disclosures of information through computer media like e-mail or across the Internet would result in potential liability, although assessing responsibility can be problematic. Tracing electronic disclosures to a responsible party is difficult without adequate security trails, especially once the private information is published on the Web or other mass media.

While few cases have discussed the duty of physicians to use medical information available on the Internet or through online services like MEDLINE,^{73 - 74} it is conceivable that a physician may be liable for failing to enhance his/her knowledge or skills by accessing easily obtained medical information or using software that provides clinical reminders.^{75 - 76} Assuming the procedural issue of jurisdiction over a telemedical procedure can be determined,⁷⁷ is a physician liable for malpractice for transmitting or receiving an inaccurate telemedical opinion? Several substantive issues arise: (1) when has a physician-patient relationship arisen in a telemedicine encounter?⁷⁸ Telemedicine practitioners may be viewed similarly to on-call specialists where the patient-physician relationship is often implied⁷⁹ and liability attaches if the specialist is negligent⁸⁰ ; (2) how should errors of omission (failure by the treating physician to use telemedicine when needed) and errors of commission (failure to use the technology properly) be resolved? and (3) who is responsible for the reliability of the technology itself?

Health-related computer technology requires a weighing of competing interests toward devising effective policies to protect the public. Technological improvements genuinely threaten the privacy of personally identifiable health data. As a result, the quality and reliability of personal health information, as well as medical information generally, are suspect. Traditional tort-based theories of liability, as applied to uses of computer technology, may leave health consumers and practitioners improperly protected. Conversely, innovative computerized systems and databases have greatly contributed to improvements in health care, public health, and medical science. The privacy, quality, and reliability of medical information can actually be enhanced through such systems. Physician negligence can be averted through computerized oversight systems.

We understand these competing interests and suggest that medical practitioners and consumers increasingly use computer technologies only if sufficient legal protections are met. Given the connection between protecting individual privacy, improving the quality and reliability of health data, and diminishing tort-based liability, legal reform must fundamentally focus on protecting individual privacy. We recommend that Congress fulfill its prior mandate pursuant to HIPAA and pass comprehensive federal legislation to protect the privacy interests of patients in their medical information. Recent legislative proposals on Capitol Hill fall short on needed protections.

Effective legislation must (1) recognize the unique status of identifiable health information. Identifiable health data must be uniformly viewed as highly sensitive information, not merely as a commercial or research commodity. Health information that cannot be identified with an individual (also known as nonidentifiable data) does not invoke strong privacy interests (at least among individuals) and should not be subject to individual privacy protections; (2) provide privacy safeguards based on fair information practices. Fundamental privacy protections must allow individuals the right to review and amend their health data. Secretive data systems should be prohibited. Individual data may be collected and used only for important health purposes; (3) empower patients with information and rights to consent. Patients are entitled to know about and consent to the collection and use of identifiable information, the time length that information will be stored, when it will be expunged, and the degree to which others may have access. Data should be acquired, used, disclosed, and stored consistent with the information provided to, and the consent of, patients without thwarting legitimate, communal uses of such data. Effective criminal and civil actions should follow breaches of privacy; (4) limit the disclosure of health data. Pursuant to the least-intrusive disclosure principle, health data must be disclosed in a form that is narrow in content, least identifiable, minimally sensitive, and to the fewest number of persons as reasonably necessary to achieve the stated purpose; (5) incorporate industrywide security protections. Technical and organizational policies and procedures (eg, encryption, user authentication, access controls, audit trails, and recovery of leaked data) must be improved, employed, and shared throughout the industry¹ ; (6) establish a data protection and security board. Though politically difficult, the creation of a federal data protection and security board, similar to European models, may complement the national privacy and security framework. The board could set and monitor privacy and security standards consistent with health care practice and research¹⁷ ; and (7) provide a minimal level of national privacy protections. A minimal level of basic coverage for all identifiable health information, regardless of its form, location, user, or holder, should be created without preempting more substantial protections for certain health data.

Protecting health data beyond this standard floor may regretfully lead to new waves of inconsistent privacy protections and contribute to health data exceptionalism. However, the impetus for a national health information privacy law is the existing legal statutory and judicial framework that leaves some data virtually unprotected to the detriment of individual privacy interests. This dilemma can only be corrected through national legislation. Additional federal or state privacy protections are justified to address health information issues that may be truly unique to certain populations or areas.

Thus, while we discourage differing standards of privacy protections for similar health data, we support a national floor of health data protections that covers all health data and can be supplemented where warranted. Provided that consumers trust that the privacy of their health data is maintained through legal protections, we suggest that the quality and reliability of health data will be advanced. Statutorily defined civil remedies for inappropriate disclosures of confidential information will significantly clarify existing causes of action for breach of privacy based in tort. Furthermore, better health care information may potentially limit malpractice liability through better clinical care resulting from improved medical research, enhanced channels of communication, and greater information sharing.