Massachusetts Medical-record Dump Serves as Warning for All Americans

[FrankRep]

http://www.thenewamerican.com/images/stories/jbs_banners/obamacarebanner-tna.jpg (http://www.jbs.org/stopobamacare)



Those Bay Staters whose medical records may have been dumped are not the only Americans who ought to be concerned about this occurrence, since Massachusetts is operating under RomneyCare, the forerunner to ObamaCare, which impacts us all. By Michael Tennant


Massachusetts Medical-record Dump Serves as Warning for All Americans (http://www.thenewamerican.com/index.php/usnews/health-care/4306-massachusetts-medical-record-dump-serves-as-warning-for-all-americans)


Michael Tennant | The New American (http://www.thenewamerican.com/)
Sunday, 15 August 2010


“Four Massachusetts community hospitals are investigating how thousands of patient health records, some containing Social Security numbers and sensitive medical diagnoses, ended up in a pile at a public dump,” began an August 13 Boston Globe report (http://www.boston.com/news/health/articles/2010/08/13/mass_hospitals_investigate_exposure_of_records/).

“The unshredded records,” continued the report, “included pathology reports with patients’ names, addresses, and results of breast, bone, and skin cancer tests, as well as the results of lab work following miscarriages.”

The records were discovered by a Globe photographer when he stopped by the dump to toss his trash. “When he got out of his car, he said, he saw a huge pile of paper about 20 feet wide by 20 feet long,” according to the newspaper.

Upon further inspection he found that the papers were “health and insurance records from at least four hospitals and their pathology groups … mostly dated 2009,” said the Globe, which also notified the hospitals of the find. “It is unclear,” said the paper, “how many other hospitals’ records might have been discarded in the dump.”

The culprit in the dumping of sensitive medical records appears to be the former owner of a medical billing company employed by pathologists for decades, who admitted that he had sent the records to the dump after selling the company. The new owner’s lawyer said that the new owner had taken only records from 2010; the rest were, apparently, dumped by the previous owner.

Disposing of medical records containing personal identifying information without making them unreadable, generally by shredding or incineration, is a violation of both state and federal law.

“The hospitals said they also plan to formally notify the Massachusetts attorney general’s office; preliminary information has already been passed along,” according to the Globe. “Based on that, the attorney general’s office said in a statement it is reviewing ‘whether there has been a data breach.’”

In addition, said the newspaper, the hospitals “are developing plans to notify the thousands of patients whose records may have been left at the dump.” Hospital officials, wrote the Globe, “believe the records dumped went back two or three years” and involved thousands of patients — everyone who had pathology testing during that time.

Those Bay Staters whose medical records may have been dumped are not the only Americans who ought to be concerned about this occurrence. Massachusetts, after all, is already operating under RomneyCare, the forerunner to ObamaCare, which now impacts us all. If this sort of thing can happen in a state with such a healthcare system, what could happen when that system goes national?

Of even greater concern is the fact that the 2009 economic stimulus law mandates (http://www.thenewamerican.com/index.php/usnews/health-care/4090-federal-medical-snoopingand-how-to-stop-it) that all Americans’ medical records be stored electronically and then made available to all healthcare providers and the federal government, making such privacy breaches much more likely.

The Globe commented on the Massachusetts record dump:



The episode highlights in dramatic fashion how hard it can be for hospitals to safeguard patient information, given the large number of doctors, insurance companies, medical billing firms, and contractors who have access to personal data in the normal course of business....

“This is a perfect example of how complicated the security of confidential information is,” said Clark Fenn, vice president for quality improvement, risk management, and corporate compliance at Holyoke Medical Center. “There are many hands that touch things. All it takes is one slip in that process for information to be released.”


Now imagine how many hands will be able to touch each person’s medical records when they are stored in a centralized electronic database. All it takes is one careless mistake, such as sending data over an unsecure connection or in unencrypted form, or one person with a vendetta for someone’s electronic medical records to become public knowledge. Once electronic data has become public, it is nearly impossible to make it private again. The more centralized the data and the more widespread its use and availability, the more easily and frequently such data breaches can occur.

Massachusetts once warned all Americans that the British were coming to invade their privacy by, for example, quartering soldiers in their homes. Perhaps today it can serve as a warning of the dangers of putting Americans’ medical records into a Washington-mandated electronic database with the potential for banishing medical privacy once and for all.


SOURCE:
http://www.thenewamerican.com/index.php/usnews/health-care/4306-massachusetts-medical-record-dump-serves-as-warning-for-all-americans

[Greenbeard]

It's a little odd to use an example of an egregious privacy violation of paper health records to argue that electronic health records aren't secure enough. The fact is, there are and will be breaches of both at various times--that's the price we pay for writing down and storing information. But most states aren't building centralized technical architectures to store EHRs (I actually can't think of any states doing that, offhand), most are relying on some kind of federated or hybrid architecture (http://statehieresources.org/the-toolkit/technical-infrastructure/technical-infrastructure-overview/). Electronic records will generally be stored in some provider's system, segmented from other systems and only shared outside that system when authorized.

Privacy is a real concern, which is why every state is developing its own privacy and security standards as we speak. I can't agree that it's a good enough reason to ignore the positive attributes and huge advantages that electronic records have over paper records, though.

[FrankRep]

It's a little odd to use an example of an egregious privacy violation of paper health records to argue that electronic health records aren't secure enough.


Study finds electronic health records vulnerable (http://news.cnet.com/8301-10784_3-9779986-7.html)

Public leery of electronic health-record security (http://www.modernhealthcare.com/article/20080708/REG/626135643)

Health Plan May Expose Medical Records to Hackers, Experts Fear (http://www.foxnews.com/politics/2010/03/24/obamas-health-plan-expose-medical-records-hackers/)

[VBRonPaulFan]

Dude, no shit. Any data stored electronically is vulnerable.

[Greenbeard]

To repeat: "The fact is, there are and will be breaches of both at various times--that's the price we pay for writing down and storing information." Privacy and security work around EHRs has been going on for years now and really took off at the state (and, to some degree, federal) level last year when the HITECH Act--the law attempting to speed up EHR adoption--passed.

But there's no need for hysteria like:

But privacy advocates fear that the speed at which the government is moving to digitize records will increase the risk of medical identity theft, and they are concerned about what the government will do once it has access to Americans' medical history.

Having an electronic health record doesn't give "the government" access to your personal medical history. The woman at the end of that FoxNews article put it well:

"You cannot have paper files in an electronic world," she said. "But you also cannot have the Wild Wild West with patient medical data. You need a balance."

[FrankRep]

Having an electronic health record doesn't give "the government" access to your personal medical history.

Greenbeard, any more lies you would like to share with us today?



The Obama administration's stimulus bill requires that American's medical record be stored electronically and be made available to the federal government. by Michael Tennant

Federal Medical Snooping — and How to Stop It (http://www.thenewamerican.com/index.php/usnews/health-care/4090-federal-medical-snoopingand-how-to-stop-it)


Final Stimulus Bill Creates Government Database that Will Hold Every American’s Personal Medical Records
http://www.cnsnews.com/public/content/article.aspx?RsrcID=43463

Health Care Reform: Government To Have Access To Americans Medical Records
http://www.canadafreepress.com/index.php/article/21137

Georgia Court: Personal medical records are fair game for government snooping
http://blogs.ajc.com/bob-barr-blog/2010/07/23/court-rules-your-medical-records-are-not-private-papers-or-personal-property/

Health bill could allow government access to personal financial records
http://www.washingtonexaminer.com/politics/Health-bill-could-allow-government-access-to-personal-financial-records-8093377.html

U.S. Government Seeks Control of All Doctors, Patient Medical Records in Hidden Provisions of Stimulus Bill
http://www.naturalnews.com/News_000724_health_care_stimulus_bill_Big_Brother. html

[Greenbeard]

I assume you're being serious here so I'll walk through your links for you:


Final Stimulus Bill Creates Government Database that Will Hold Every American’s Personal Medical Records
http://www.cnsnews.com/public/conten...x?RsrcID=43463

The first thing you'll notice about this article is that nothing in the actual text of the article supports the headline. Some mysterious national database is purported to be called for in early versions of the legislation (note this article is old enough that it admits the final text isn't even available as of its writing), yet none of the actual text from versions of the bill quoted in the article say anything about a national database of EHRs.

And, in fact, the HITECH Act doesn't say anything about that. Read it (http://www.hipaasurvivalguide.com/hitech-act-text.php) for yourself.


Health Care Reform: Government To Have Access To Americans Medical Records
http://www.canadafreepress.com/index.php/article/21137

There's not much to say about this one, as there's very little substance to speak to. The crux of it seems to be this paragraph:


But let’s get back to Obama’s health care reform plan. One of the provisions within the bill is that all Americans medical information should be compiled and stored electronically. Supposedly, this data will strictly be meant to stay in-house, as my nurse ensured me it would be. However, if health care reform becomes law, if it desires, the government will have access to the medical records of every American citizen. Of course, those who support health care reform will say nothing will change regarding privacy laws. But the simple fact medical providers will have this data on their systems will make it that much easier for the government to further intrude in our private lives.

The bolded sentence is merely a statement. There's nothing offered to back it up, no section of the reform law (or HITECH) cited. And, in fact, it's false. The federal government can't peruse your medical record any time it pleases.



Georgia Court: Personal medical records are fair game for government snooping
http://blogs.ajc.com/bob-barr-blog/2...onal-property/

As I've hinted at multiple times now, these kinds of privacy matters are state issues. "The government" referred to here (i.e. the one executing a legal search warrant) would primarily be local or state authorities. I would assume you're not suggesting Georgia's state laws are some plot on the part of the federal government.


Health bill could allow government access to personal financial records
http://www.washingtonexaminer.com/po...s-8093377.html

Out of curiosity, did you just Google some collection of words and throw in links to any article that came up? This has nothing to do with health records, electronic or otherwise. Checking "financial responsibility and eligibility for health care services" is a fancy way of saying your doctor's office or other provider can check who your insurer is, what your health plan looks like, and what your cost-sharing responsibilities at the point of care (i.e. what you owe) are under it. That doesn't have anything to do with accessing your health record.

And, of course, there's the fact that the bill this language is lifted from, H.R. 3200, never became law. The actual health care reform bill that passed didn't include any language like that.


U.S. Government Seeks Control of All Doctors, Patient Medical Records in Hidden Provisions of Stimulus Bill
http://www.naturalnews.com/News_0007...g_Brother.html

It's becoming apparent to me that your primary method for determining what's in a given bill consists of believing what someone on the internet says is in the bill (with, of course, no citations). I've linked you to the actual text of the HITECH Act above. It's not very long and even a quick read through should show that none of the things your alarmist links are saying about it are true.

And after you find that you can't point to a section of the law that gives the government unfettered access to your medical record, I'll happily accept your apology for calling me a liar.

[Anti Federalist]

Electronic medical records will be centralized in a database that employers and government will have access to at any time for any reason.

It will be used to increasingly disqualify anybody for employment based on arbitrarily assigned medical conditions.

This is already happening to truckers, pilots and mariners.

[Anti Federalist]

And after you find that you can't point to a section of the law that gives the government unfettered access to your medical record, I'll happily accept your apology for calling me a liar.

See my post above.

When you are required to apply for professional licenses such as a CDL or pilot's license from the feds, you are also required to sign a form stating that you give them unfettered access to your medical records.

[Greenbeard]

Out of curiosity, can you point me to a source from the FAA on that? In browsing their Medical Certification page (http://www.faa.gov/licenses_certificates/medical_certification/), I see that pilots are required to get a physical and a medical certification from an "FAA-designated Aviation Medical Examiner." Who are you saying has unfettered access to your medical records? The FAA itself or your chosen medical examiner (since the latter is a doctor, I would assume that at least is a no-brainer)?

That aside, what's the broader point here? This is an activity for which medical certification is required as a part of licensing. That was true before HITECH passed and, as far as I can tell, has nothing whatsoever to do with electronic health records. Anything you're talking about here would apply to paper records. In other words, this has nothing to do with electronic health records or the recent legislation we're talking about. Are you drawing some broader implication from this example?

This strikes me as similar to pointing out that the VHA (a government agency) has access to participating veterans' health records since it provides health care to them. "Yes, but what does that have to do with anything...?"

[Anti Federalist]

Out of curiosity, can you point me to a source from the FAA on that? In browsing their Medical Certification page (http://www.faa.gov/licenses_certificates/medical_certification/), I see that pilots are required to get a physical and a medical certification from an "FAA-designated Aviation Medical Examiner." Who are you saying has unfettered access to your medical records? The FAA itself or your chosen medical examiner (since the latter is a doctor, I would assume that at least is a no-brainer)?

Refer to page 3 at the bottom:

http://www.uscg.mil/forms/cg/CG_719K.pdf

That releases all medical records by that doctor.

What it does not tell you is that "policy directives" have interpreted that to mean all medical records.

That's for USCG, They will have unfettered access. So will FAA for pilots and DOT for truckers.


That aside, what's the broader point here? This is an activity for which medical certification is required as a part of licensing. That was true before HITECH passed and, as far as I can tell, has nothing whatsoever to do with electronic health records. Anything you're talking about here would apply to paper records. In other words, this has nothing to do with electronic health records or the recent legislation we're talking about. Are you drawing some broader implication from this example?

This strikes me as similar to pointing out that the VHA (a government agency) has access to participating veterans' health records since it provides health care to them. "Yes, but what does that have to do with anything...?"

The broader point is that electronic records, centrally located with easy access, will be used in more and more efforts to limit or restrict employment, insurance, professional licenses and so on.