Privacy advocates concerned about CIA investment in e-health firm
Privacy advocates in the United States and Canada have serious concerns about the privacy of electronic health records accessed through master patient index software developed by Initiate Systems, which recently received funding from In-Q-Tel, the venture capital arm of the Central Intelligence Agency.
Canadian privacy advocates have called for a federal and provincial investigation into the relationship among the CIA, In-Q-Tel and Initiate.
The Veterans Health Administration uses Initiate's Identity Hub to eliminate duplicate records and improve matching of records in its master person index (MPI), which has 12 million entries. The software is also used to help match patient records in a three-state regional health information organization that the Markle Foundation's Connecting for Health supports.
The company's software is widely used in Canada, particularly in the provinces of Alberta, Newfoundland and Labrador, and Ontario. Canada Health Infoway, a federally funded nonprofit corporation that leads e-health efforts in the country, signed an agreement to use Initiate MPI software throughout Canada in May 2004, almost two years before In-Q-Tel made its investment in Initiate this March.
Initiate discloses its relationship with In-Q-Tel on its Web site and Modern HealthCare reported the CIA link to Initiate last month.
MPIs use a patient identifier based on demographic information such as name, date of birth and address with medical records stored in disparate places, such as multiple doctor offices or clinics used by an individual with matches performed by sophisticated algorithms. E-health experts, including Connecting for Health, have pitched MPIs as a way to alleviate privacy concerns raised by the use of a national patient identifier.
But Twila Brase, president of Citizens' Council on Health Care, a health care policy organization, views MPI software as an invasion of privacy because "it allows disparate pieces of data to be gathered on an individual as part of a countrywide data sharing system."
Brase finds the CIA investment disturbing and thinks it could lead to the agency obtaining private medical records under the guise of national security.
Health and Human Services Secretary Mike Leavitt has repeatedly stated that the public will only accept widespread use of electronic health records if privacy is paramount, and a CIA investment in widely used MPI software will not help that effort. Putting the words "CIA and medical record privacy in the same sentence does not fit, Brase said.
Philippa Lawson, executive director of the Canadian Internet Policy and Public Interest Clinic said a CIA investment in a company whose software is widely used throughout the Canadian health care system raises a red flag and called for federal and provincial privacy commissioners to investigate Initiate's deals in Canada.
Lawson said CIA backing of Initiate is "disconcerting as it raises the possibility of inappropriate information gathering and privacy abuses."
Darrell Evans, executive director of the British Columbia Freedom of Information and Privacy Association, said he is concerned that Initiate software use in the Canadian health care system would allow the CIA to use the Patriot Act to get access to Canadians' sensitive health care information.
Scott Schumacher, senior vice president and chief scientist for Initiate Systems, said concerns about the CIA link are more problems of perception than reality. He said Initiate's software does not contain any clinical information and In-Q-Tel made its investment to tap into the company's data matching capabilities in areas other than health care.
He added that a Canadian subcontractor conducts maintenance of the company's software in Canada and he would resist Patriot Act subpoenas that target its installation in Canada. "I will not break the law," Schumacher said. He added Initiate would cooperate with any Canadian investigation.
A Canada Health Infoway spokesman said Infoway was not concerned with the CIA investment in Initiate because a client registry does not hold any personal health information on an individual.
Don Tighe, an In-Q-Tel spokesman, said concerns about the investment in Initiate are a misperception and that the CIA-backed firm looks for the best in information management tools. The Initiate software cannot be used to access medical data, he said.