September 26, 2011 – A proposed new rule from the Department of Health and Human Services would make it impossible for American’s to keep their medical records private. The rule would have the government build a centralized database of medical records. Not only would such a database make an inviting target for hackers and scam artists, but it also raises a variety of troubling questions about why the government needs this data in the first place.

Tweet

According to the rule notification published in the Federal Register, HHS wants all insurance companies to share medical records of every one of their clients with the government. The reason they give for this is that the government needs to be able to review treatment and claim information in order to make sure that consumers are not paying too much for insurance. As a part of this oversight, the database could be used by insurers when writing new policies to make sure that the information furnished by customers was accurate and complete. In other words, if you have a preexisting condition, the insurer is going to know about it right away.

Unfortunately, the federal government’s track record is abysmal when it comes to data security. For instance, the VA breached the data security of more than 26 million veterans when a laptop computer was stolen. In fact, there have been, and continue to be a wide variety of government data breaches at both the federal and state levels. There is absolutely no reason to believe that any government agency is currently prepared to protect medical record any better than they have protected other data. And there are a lot of reasons to believe that the creation of a centralized database of medical records will lead to an inevitable mass breach of data.

If that doesn’t make you uncomfortable, then consider the following four things.

First, medical identity theft is on the rise. Medical identity theft occurs when someone assumes another person’s identity in order to get medical treatment using the victim’s insurance. Any data breach of this proposed government database could easily lead to this. Hackers are likely to collect and sell breached data over the internet. And unlike some of the remedies available to consumers when their credit data is breached, there is no current mechanism available to consumers to protect their medical identities. For instance, you can freeze your credit file but you can’t freeze your medical file.

As with other forms of identity theft, medical id theft can be financially devastating to victims.

Second, just consider the consequences of having medical records openly posted on the internet. A data breach could very well involve this scenario.

In such a breach, highly personal information would be revealed, and the consequences could be horrible for those affected. Consider the person who has a debilitating disease but is trying to keep that information quiet for fear of discrimination. Or perhaps they simply have been working up a plan about how to tell their family or friends about a medical condition which is now posted for the entire world to see.

Third, a breach of medical information could actually lead to new opportunities for criminal activity such as blackmail and extortion. Consider the person who is married but who sought treatment for a sexually transmitted disease. While you might not feel too sorry for someone who finds themselves in this position, do you really want the government to put together a database that could be used in this way?

And finally, there is no assurance that a database of this type in the hands of the government wouldn’t be used for other purposes. The federal government is already trying to get people to stop smoking and lose weight but to date, the government hasn’t been able to pinpoint those that fall into these categories. That will change if the government has access to medical records.

The government could actually use this data to impose penalties on those it considers to be obese. It could target families of children that are overweight to potentially have them removed from their parents. It that sounds far fetched, there are already court cases in other countries and in the United States that involve this very issue.

The proposed rule completely obliterates patient privacy and changes the doctor patient relationship. No longer will any of us be able to have a conversation with our doctor and have the assurance that the information we discuss will remain private.

You can comment on the rule proposal by going to www.regulations.gov and searching for the term “CMS–9975–P” without the quotation marks. All comments must be submitted by September 28^th. 

Note: When posting a comment, please sign-in first if you want a response. If you are not registered, click here. Registration is easy and free.

Follow me on Twitter: