At a recent meeting in Washington, D.C., Microsoft chairman Bill Gates called on Congress to pass a comprehensive privacy law this year, allowing consumers to control how their medical information is used. He also stressed that a new privacy law should balance consumers’ rights with government’s need to protect against terrorism.

Gates also implied that some privacy protections have gone too far and have become annoying to consumers. According to Network World, “He talked about the Health Insurance Portability and Accountability Act (HIPAA), passed by Congress in 1996, which puts strict controls on the release of information. HIPAA too often asks patients to sign documents allowing the release of their medical records, he said. HIPAA is evidence ‘we don't always get it right the first time,’ Gates said. ‘All I know is I keep signing those forms.’”

It’s great to see an influential leader like Bill Gates calling for a federal privacy law that allows individuals to control the flow of their health information. But he appears to be misinformed about the HIPAA rule. As Theo Francis pointed out in the Wall Street Journal article “Taking Control: Setting the Records Straight,” the rule actually permits over 600,000 doctors, insurers, and others to access electronic medical records—without consent—for purposes related to treatment, payment, or health-care operations.

Francis wrote, “Over the past three years, millions of Americans visiting doctors’ offices, pharmacies and hospitals have been handed forms and brochures discussing privacy rules under…HIPAA. Many assume signing somehow protects their privacy. It doesn't. In fact, the disclosure notice essentially details the many ways a doctor can use and disclose medical information—often without a patient’s consent or knowledge.” (Emphasis added.)

Meanwhile, Harris Interactive notes that many people are concerned about potential privacy abuses with electronic medical records (EMRs). Citing a 2006 national survey, Harris Interactive reports that 62 percent of respondents think that the use of EMRs makes it more difficult to ensure privacy. The largest group—42 percent—said privacy risks outweigh expected benefits; 29 percent disagreed, while another 29 percent were not sure.

There is no consensus regarding the public’s support for moving to electronic records (from paper records):

• One out of five Americans (21 percent) says he/she would want the right not to have any of his/her medical records entered into a new electronic record system;
• 12 percent said they would want to be able to designate which parts of their medical records were entered or not entered into an electronic record system;
• 27 percent said they would want to be notified of the change to electronic medical records and have the effect (of the handling of their personal medical information) explained to them; and
• 22 percent said they did not want to be notified of the change to electronic medical records since they didn’t think it would affect their relationship with their doctors and how their doctors handled their information. (17 percent were not sure; 1 percent “other”).

So what can Congress do to ensure that individuals really control their medical records? Congress should pass a law which states clearly that (1) personal health information cannot be disclosed (in any form) without express, written, and informed consent; and (2) those who prefer efficiency to privacy are free to waive their rights. Thus people who want to choose what information is shared electronically would be free to do so, while those who find the consent process annoying could avoid it.

Given that Bill Gates strongly supports individual control over the flow of personal medical information, perhaps he will help pave the way to a true federal health-privacy law.

Sources:

• “Gates Calls for New Privacy Law,” Network World, March 7, 2007: www.networkworld.com/news/2007/030807-gates-calls-for-new-privacy.html
• “The Benefits of Electronic Medical Records Sound Good, But Privacy Could Become a Difficult Issue,” Harris Interactive press release, February 8, 2007: http://biz.yahoo.com/prnews/070208/nyth192.html?.v=10
• “Taking Control: Setting the Records Straight,” by Theo Francis, Wall Street Journal, October 21, 2006: http://online.wsj.com/public/us (subscription required)