A disturbing new trend is emerging when Americans find out that bio-data is being used for purposes they never agreed to: Lawsuits are being filed against state agencies and state universities when residents find out that sensitive health information is used in ways they never expected or gave permission for.
Two examples: 1) the Texas agency that oversees the Newborn Bloodspot program was sued for using spots without consent. 2) the Arizona Havasupai Indian tribe sued ASU for using biosamples for research without consent.
Why should states pay attention and implement electronic consent tools with REAL choices instead of gross opt-outs or opt-ins?
Because technology tools that offer meaningful choices will satisfy ALL residents and facilitate research by empowering researchers to find people who are willing to participate in studies. States will be held to standards of consent that have long been enshrined in medical and research ethics, in standards of practice, and in state and federal laws which ARE NOT preempted by HIPAA or ARRA.
Vibrant, dynamic (i.e. changeable) consent tools should include these minimum functionalities: the right to opt-in, the right to opt-in and segment sensitive information, the right to opt-in and agree to be contacted for research and public health uses of PHI (unless required by law), the right to opt-in and give broad directives for PHI to be used for emergencies or for research (including public health, population health, quality improvement, comparative effectiveness, clinical trials, etc , etc), the right to prevent disclosure of PHI for payment and HCO if the patient pays out-of-pocket (a HITECH requirement), and audit trails x 3 years for all uses and disclosures (another HITECH requirement).
What will happen when Americans realize it is not only state or federal agencies that use their PHI for purposes they never agreed to?
Take a guess. Blanket, advance consents will not pass muster when dynamic, effective electronic consent tools exist that offer meaningful choices. In fact the use of blanket consents or coerced, opt-out consents will be seen as unfair and deceptive trade practices.
Technology can make consents far easier, dynamnic, and include defaults and robust drop-down info explaining the consequences and risks of all choices. Independent consent tools by keeping track of all disclosures can then FULFILL the HIPAA requirement to enable patient amendments to PHI and EHRs to be sent to all data holders.
States will see increasing pressures from residents to enable their privacy rights and expectations to be enforced using new privacy-enhancing technologies, not eliminated by technology tricks.
The Coalition for Patient Privacy applauds ONC for its willingness to hold a Privacy Summit in collaboration with the health privacy community this Spring offering content about patients' privacy rights and showcasing effective, existing, proven privacy-enhancing technologies for consent, segmentation, and audit trails.
Deborah C. Peel, MD is the Founder and Chair of Patient Privacy Rights. This blog post originally appeared as a comment on the story States Lead the Way on Health IT.
