A tripartite threat to medical records privacy: technology, HIPAA'S privacy rule and the USA Patriot Act.

• Author: Wills, Nathan J.
• Position: Health Insurance Portability and Accountability Act of 1996

1. INTRODUCTION II. PRIVACY IS A FUNDAMENTAL RIGHT III. MEDICAL RECORDS PRIVACY IS OF THE UTMOST IMPORTANCE IV. HIPAA: THE GOVERNMENT'S RESPONSE TO THREATENED MEDICAL RECORDS PRIVACY V. PRIVACY RIGHTS ARE CIRCUMSCRIBED IN THE POST-9/11 WORLD VI. THE THREAT TO MEDICAL RECORDS PRIVACY VII. CRITICISM OF THE PRIVACY RULE A. Is the Privacy Rule Unconstitutional? 1. Fourth Amendment Claims 2. First Amendment Claims B. If not Unconstitutional, the Privacy Rule is Ineffective 1. The Privacy Rule is Behind the Times 2. Exceptions Swallow Additional Privacy Protections Protections 3. The Nebulous Nature of a "Covered Entity". 4. Federalism Concerns 5. Congress was Catering to Corporate Interests VII. ALL IS NOT LOST VIII. CONCLUSION I. INTRODUCTION

   "Privacy is not something that I'm merely entitled to, it's an absolute prerequisite." (1)--Marion Brando

   Virtually every member of American society has seen a physician and therefore has some type of medical history. A medical history contains some of the most intimate details of a person's life. (2) This information might not even be shared with intimate partners, family or friends, (3) perhaps because an individual is usually private, in denial of an illness, or wishes to guard loved ones from painful information. Whatever the reason, it is reasonable to conclude that most individuals wish to keep health information personal and private.

   The desire to keep medical information private has been recognized for centuries, as evidenced by the Hippocratic Oath (4) and the common law physician-patient privilege. (5) As healthcare changes, so too must societal conceptions of medical privacy. Today, medical privacy encompasses not only privileged communications, but also the power to control medical records and who may access them. Preserving this power can appropriately be termed protecting medical records privacy.

   Unfortunately, three issues threaten the long-recognized right to medical privacy. First, while the increased use of technology to store and transmit medical records makes accessing private health information easier for authorized medical personnel, it also increases the likelihood that the information may be seen and used by those with ill intentions. Second, the Privacy Rule promulgated under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") (6) actually sanctions the non-consensual disclosure of personal health information. (7) Third, privacy rights are eroding as a result of measures taken to increase national security in the wake of the September 11, 2001 terrorist attacks. The erosion of privacy rights is illustrated by the hastily passed USA PATRIOT Act, (8) which alters the interpretation of many privacy oriented statutes and effectively contracts individual privacy rights. (9) These three factors have converged to threaten an individual's right to medical records privacy.

   Proceeding from the proposition that privacy is a fundamental right, this essay notes the importance of maintaining medical records privacy in light of the increased use of technology. It describes the Privacy Rule promulgated under HIPAA, which was intended to strengthen medical records privacy, but notes the restriction of privacy rights following September 11, 2001 ("9/11"). In light of circumscribed privacy rights, the Privacy Rule becomes much more important in protecting medical records privacy. Unfortunately, the Rule falls short of this goal by potentially running afoul of the First and Fourth Amendments. It also fails to provide adequate medical records protection because it: (1) relies on an out of date technology model; (2) provides too many exceptions to its own consensual disclosure provisions; (3) lacks specificity in defining the entities it covers; (4) fails to resolve important federalism issues; and (5) caters to corporate interests. These problems can be corrected by bolstering computer security, changing the text of the Rule to anchor a patient's "reasonable expectation of privacy," and offering the judiciary an avenue to continue to expand privacy rights despite the nation's post-9/11 fears.

2. PRIVACY IS A FUNDAMENTAL RIGHT

   "[T]he makers of our Constitution conferred, as against the government, the right to be let alone--the most comprehensive of rights and the right most valued by civilized men." (10)--Justice Louis Brandeis

   While the Constitution does not explicitly grant the right to privacy, the United States Supreme Court has recognized this guarantee. (11) One of the earliest recognitions of the right to privacy came in the 1891 decision of Union Pacific Railway v. Botsford. (12) Finding that an injured woman could not be required to submit to a surgical examination to determine the extent of her injuries, the Supreme Court noted that "[n]o right is held more sacred, or is more carefully guarded ... than the right of every individual to the possession and control of his own person, free from all restraint or interference of others...." (13)

   The 1928 decision of Olmstead v. United States formally tied privacy rights to the Fourth Amendment protection against unreasonable searches and seizures. (14) Justice Brandeis noted in his dissent that the drafters of the Constitution, in an effort to allow for the pursuit of happiness and to protect the beliefs of Americans, "conferred, as against the government, the right to be let alone." (15) That right, he asserted, was promulgated in the text of the Fourth Amendment)6 Similarly, in the 1965 decision of Griswold v. Connecticut, Justice Douglas noted that the penumbral zones of privacy stem from the emanations of the Fourth Amendment "right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures." (17) In light of these decisions, privacy may appropriately be regarded as a fundamental right with a substantial historic pedigree.

   Unfortunately, the right to privacy is limited and poorly defined because it emanates from the penumbras of the Fourth Amendment, and is therefore easily subject to transgression. (18) The right faces further limitation from other social interests, such as the need for openness and transparency or other compelling State interests, which are often balanced against it. (19)

   Ferguson v. City of Charleston recently addressed the balance between medical privacy and State interests. (20) In response to the increased use of cocaine by expectant mothers, The Medical University of South Carolina ("MUSC") began screening urine samples of maternity patients suspected of drug use. (21) Under MUSC policy, if a patient tested positive for cocaine use during labor or a prenatal care visit, medical staff threatened to report the patient's drug use to law enforcement officials. (22) The patient could avoid criminal sanctions by enrolling in a substance abuse program. (23)

   The Supreme Court found for the Plaintiffs, stating that MUSC had violated the Fourth Amendment protection against unreasonable search and seizure. (24) In deciding the case the Court noted that MUSC was subject to the Fourth Amendment because it was a state hospital. (25) It also identified the well-settled principle of law that urine tests are considered searches under the Fourth Amendment. (26) Balancing the patients' Fourth Amendment privacy interests against the "special needs" of the hospital, the Court concluded that the tests were an unreasonable search in violation of the Fourth Amendment. (27) The Court also noted that a patient's "reasonable expectation of privacy" is that the results of diagnostic tests will not be shared with non-medical personnel without her consent. (28)

   While privacy rights prevailed in Ferguson, the balancing test employed illustrates that the extent of privacy rights may not be well-settled. Nevertheless, previous Supreme Court decisions indicate that privacy may appropriately be regarded as a fundamental right. (29) This treatment is justified; for without privacy an individual's medical records might be used to deny credit, employment, or insurance coverage. (30) Similarly, without privacy rights a person would be subject to being embarrassed by neighbors and stigmatized or humiliated by friends and relatives. (31) The right to privacy is therefore co-extensive with protecting individual dignity and fulfills an essential role of individual autonomy and a free society. (32) To protect individual dignity, preserve personal security and allow for the pursuit of happiness, privacy must encompass not only 'the right to be let alone,' but also the right to control the release of personal and private information. (33)

3. MEDICAL RECORDS PRIVACY IS OF THE UTMOST IMPORTANCE

   "All that may come to my knowledge in the exercise of my profession or outside of my profession or in daily commerce with men, which ought not to be spread abroad, I will keep secret and will never reveal." (34)--The Hippocratic Oath

   The right to privacy is of paramount importance in the medical records context because medical records contain highly sensitive information about what are potentially the most intimate details of an individual's life. (35) Medical records often contain demographic information such as age, sex, race, marital status, children, and occupation; financial information, such as employment status, income, and methods of payment; personal identifiers other than name, including social security number, addresses, and phone numbers; and information about why treatment is sought, such as being the victim of a violent crime, firearm injury, or the at-fault party in an auto accident. (36) They also contain information identifying whether an individual has a communicable or other disease, or a particular genetic propensity. (37) When aggregated, this information reveals a great deal about the intimate details of a person's life. (38) It also creates a profile of a person that may be used for discriminatory purposes such as denying credit...