Editor’s note: This commentary is by Stuart Graves, of South Burlington, who is a retired physician.
[E]rin Mansfield’s July 3 article about VITL wanting to “Give Doctors Easier Access to Medical Records” evokes in me that special kind of nausea one feels when somebody chooses to re-open an old argument that one has gone round and round a hundred times.
This is not a new proposal on VITL’s part. It has essentially been VITL’s preferred, if not always achieved, means of handling privacy since its inception in 2005.
The bottom line is poor design of the multifarious electronic medical records which makes it cumbersome for practitioners to maintain routine patient privacy. The solution to that should not be seriously degrading patient privacy; it should be better design. There are two main points supporting this conclusion.
First: In the “old” days prior to electronic medical records when you visited a doctor’s office or entered a hospital each place simply created and kept their own medical records about you. Most often you would be asked if it was OK if your records from previous doctors or other hospitals were obtained. If you said yes, you signed a “release of information” form that was sent off to the other hospitals and doctors. This was simple to do; nobody complained about it; it was just done. Notice that you, the patient, chose to send your “old records” to one other particular doctor, doctors, or hospital as opposed to allowing every other doctor, hospital and their staff in the state the ability to access your records.
Are we to believe that a medical information system cannot be designed that keeps track of who we want to see our records, who we do not, and which behaves accordingly?
Today a nice young man wheels a computer on a cart into your hospital room and asks, “Is it OK with you to share your records with other doctors taking care of you?” If you answers yes (as I do) the above happens: every health care provider, every health care institution, and their staff who are members of VITL now have the ability to access your records. This is the “opt in” mechanism. You have just opted into the network of access to records that VITL provides. To be clear, this is the ability of personnel to access any medical record, but if security actually matters, it seems such a naïve approach: “Now everybody be good.” Clearly this is a little different from what used to happen, different from what the nice young man asked, different from what you thought was going to happen, and, obviously, is not up to the informed consent standards of the Office of the National Coordinator for Health Information Technology, but there’s the rub: who can or wants to spend half an hour explaining what is really going on to somebody suffering in a hospital bed.
Hence the “opt out” idea. By this mechanism on automatically gives permission for the above to happen by becoming a patient of a particular physician or hospital. In order for it not to happen one has to actively “opt out” – no doubt after another half hour of explanation – but at least things are moving in the meantime.
But just a minute, please. Are not computers, if they are good at anything, good at keeping lists? Are we to believe that a medical information system cannot be designed that keeps track of who we want to see our records, who we do not, and which behaves accordingly? And maybe even does this elementary task without a half hour’s worth of mind-numbing, eye-glazing techno speak?
Second: The idea of “HIPAA on steroids” induces another mild wave of nausea. The Health Insurance Portability and Accountability Act did not come into being until 1996. Obviously privacy was an important consideration long before that, and had been dealt with by many laws. The privacy provisions of HIPAA are actually weak compared to the pre-existing law. A main impetus of HIPAA was standardizing the way large organizations (e.g. health care clearing houses, insurers, hospitals, etc.) dealt with “protected health information” so as to facilitate their business transactions. To that end health care organizations are allowed by HIPAA to disclose PHI (protected health information) “to facilitate treatment, payment, or health care operations without a patient’s express written authorization.” This privacy portion of the law is meant to establish a nationwide “floor” below which one cannot sink in privacy matters. Most states including Vermont have statutes that protect privacy far better than HIPPA does – much along the lines of the “old days” scenario above in which a person must give their express permission before health information can be shared. Additionally, the federal government in the special case of substance abuse treatment has strict privacy laws.
Despite these two rocks of state and federal privacy laws VITL has persisted in its wishful thinking about the “opt out” mechanism, and so has continued to founder on those rocks despite much legal advice on maneuvering around them. In all fairness to VITL, it is not the organization that designs the electronic medical records, but it is the one that has to cope with the many different medical record systems created by vendors pandering to the economic needs of large health care organizations. Facilitating individual privacy needs is not high on their list. So VITL is stuck with trying to find some way to make the whole thing work, and thus, again, the “opt out” idea.
But why should VITL, an essentially public entity, go along to get along at the expense of citizens’ privacy? Why does it not represent the interests of the state in privacy, and in conjunction with the state establish rules of system design the vendors must follow to do business in Vermont?
