Privacy safeguards

For the past few months, the Wall Street Journal has run a great series on the use of electronic personal information by commercial entities. The series is titled "What They Know." While the emphasis of this series has mostly been on the tracking of web browsing behavior, the latest article in this series discusses the "scraping" of personal data from a patient support network called PatientsLikeMe.

This is a troubling development.

Like the electronic commerce IT revolution before it, the anticipated healthcare IT revolution depends upon the proper security (and associated trust) of private data. I have covered Privacy in healthcare before (see this, for example) and my summary conclusion remains that this topic will receive a disproportionate amount of attention in the coming months.

I don't agree with alarmists like Deb Peel who advocate against use of any patient data (and consequently put a number of patients at risk). The right answer is to put well understood safeguards in place and use de-identified data in a manner that promotes innovation in outcomes based treatment. This is an opportunity for companies to innovate in this space.

What products/innovations do you think we need?

How to deal with Deb Peel

For those of you following the battle over Privacy rights in Healthcare, today's post by Lygeia Ricciardi on The Healthcare Blog is a must read.

Ms. Ricciardi suggests that factual responses to fear mongering often don't work because our response to fear is often stronger than our response to reason. She writes that one way  to counter alarmists like Deb Peel is to offer your own alternate scary scenarios:

If it’s fear you’re after, we hardly lack material:

- How about being given a drug you are dangerously allergic to?

- How about receiving a radical misdiagnosis—and the treatment to match?

- How about enduring prolonged, unnecessary pain?

- What abut the cures not found, or contagions not contained?

But, the post continues, a better way is to also use holistic, moving stories. Look for this battle to heat up in the coming months as more companies monetize de-identified data. Alarmists must not be allowed to derail progress.

De-Identified Patient Data and The Right to Privacy

"It's personal. It's private. And it's no one's business but yours.......Privacy is as apple-pie as the Constitution."

And so began one of the most important essays on Privacy in recent times. The essay was authored by Phil Zimmerman, the author of PGP--a public source encryption program that broadened access to secure electronic communication. And yet, scholars will tell you that, despite Mr. Zimmerman's "American as apple pie" comparison above, the US Constitution does not include an express right to privacy [1]. The Bill of Rights does, however, acknowledge the need for privacy and the US Supreme Court has firmly implied such a right through numerous rulings over the past century.

Healthcare records were not always afforded the same level of privacy as today. The road to HIPAA--today's governing legislation on healthcare records--was long and paved with some spectacular cases of misuse of personal health information. In recent times, HIPAA has strengthened privacy protections and emphasized enforcement. The penalties are steeper and the access terms are stricter than before.

The challenge with HIPAA, as with any other legislation, is to balance individual interests with those of society. For example, an individual has a self interest in protecting his or her health records from prying eyes. Yet, aggregate health information is extremely valuable to analyze trends, predict disease migration patterns, link treatment to outcomes, etc. The personal privacy protections from HIPAA make it difficult to get these societal benefits. The industry's approach at de-identified data appears to be a good compromise, but privacy advocates such as Deb Peel of Patient Privacy Rights have strongly clashed with industry advocates like Matthew Holt, the author of The Healthcare Blog on this subject.

For a recent example of how privacy alarmists can derail efforts to improve healthcare see this article. The issue described here was the selling of de-identified patient data by a free, hosted EMR system called PracticeFusion. The sale of de-identified data enables PracticeFusion to provide a free service to 30,000+ small physicians, but, the company's practices has privacy advocates up in arms.

Some of you may recall Facebook's Mark Zuckerberg claiming privacy was dead. Zuckerberg, of course, was referring to personal privacy in the context of what you do or share online and he was probably not thinking as much about personal health records. Are these two related? Will changing outlook on personal privacy affect how we view health information?


[1] a fact noted by Mr. Zimmerman later in his aforementioned essay.