SecurityArchitecture.comConspiracy theories alive and well on government’s role in health IT
In an otherwise unremarkable meeting of the Health IT Standards Committee on March 24, Dr. David Blumenthal, HHS’ National Coordinator for health IT, made public statements addressing and formally denying rumors that the Office of the National Coordinator’s (ONC) plans to use the National Information Exchange Model (NIEM) was really intended to enable government monitoring and control of electronic health information.When Blumenthal’s comments were first reported, it seemed like they were driven largely by fundamental misunderstandings of what NIEM is (and isn’t), but given the wide circulation of these suspicions about underlying motives for health IT standards adoption, among the press, industry blogs, and advocacy groups, perhaps a few clarifications are in order.
The primary concerns seem to fall into two main areas, separate but related to each other. First, because ONC leads government efforts in electronic health records adoption and health information exchange, government agencies are certainly among the participants seeking to get greater access to health record data. This seems to have led to a presumption that one of the purposes of widespread government-sponsored health information exchange is to make medical data on individuals available to government agencies, and it’s not just CMS we’re talking about, but intelligence-gathering agencies like the Justice Department, National Security Agency, and CIA. Given the federal government’s plan to implement monitoring and intrusion detection and prevention for all network traffic to and from government agencies through the Department of Homeland Security’s Einstein program, it’s not that hard to understand how some would make the leap to assume that the intelligence community will be looking at your health data. Second, the stated intention by ONC to document and publish health data exchange standards through the NIEM — an initiative originally started to facilitate information sharing in support of anti-terrorism activities by the Justice Department, DHS, and others — seems to have led to an assumption that if health data exchange standards are managed through NIEM, this will somehow enable information formatted using the standards to be secretly captured by or routed to intelligence gathering agencies.
There’s no getting around the fact that once large quantities of health data is stored in electronic format and made available for access among organizations that have a legitimate need to use it, is will be easier for personal health information to end up in more places than it is now, with paper-based storage or stovepiped electronic medical record databases. Privacy advocates such as the Patient Privacy Rights Foundation have pressed ONC to adopt standards, rules, and procedures that would mandate individual consent before health record data is shared with entities beyond the organization that maintains the record itself, and while not openly challenging Blumenthal’s assertion that data exchanges using ONC standards and services will not be shared with government agencies, would prefer a legally binding requirement rather than a promise. This makes sense on its face, but seems to imply that there is something new about the potential for disclosure-without-consent of health data to law enforcement or intelligence agencies, when such disclosures are explicitly allowed under the provisions of the Health Insurance Portability and Accountability Act (HIPAA, specifically 45 CFR §164.512(f) for law enforcement and §164.512(k)(2) for national security and intelligence activities). Such access under the current law requires appropriate and authorized use, so the only thing that would change under widespread adoption of electronic records is the ease of accessing the records online, rather than requesting them directly from the providers or other stewards holding the data now. These sorts of consent exceptions, including the core HIPAA purposes of treatment, payment, or administrative operations, exist for both paper and electronic health records.
The second of these objections is the one that’s really hard to fathom. NIEM is a collaborative initiative that produces domain-specific information exchange standards, and makes the schemas and corresponding documentation available to anyone who wants to use them. The “M” in “NIEM” is for model. It is not a system; it is not a record-keeping database; it does not store or transmit or process any records or messages formatted according to its standards; and no one who uses NIEM standards to format their own data for exchange sends that data to NIEM. NIEM standards are distributed as files in .csv, Excel, Access, XML, and other formats, not as executable programs. Suggesting that NIEM is a “Trojan horse” that will surreptitiously send data to government agencies without their knowledge demonstrates nothing so much as a basic misunderstanding of what NIEM does (or perhaps what a data standard is).
None of the preceding discussion is intended to diminish the valid concerns over individual privacy protections and control of personal health information. There is a general (and perhaps justified) lack of trust between patients and provides, insurance companies, and state and federal health agencies, particularly as to whether any of these entities will take the necessary measures to protect personal health information shared among them. ONC has not been able to resolve this lack of trust or mitigate the concerns underlying it, not least because current standards, processes, and services proposed for use by entities exchanging health information do not provide any mechanisms to ensure that use and disclosure of health data is always authorized and appropriate. Instead, legal agreements and frameworks have been put in place under which exchange participants agree in writing to access data for for permitted purposes, but in the absence of enforcement mechanisms, such agreements will do little to dispel the distrust many individuals feel about the organizations holding their health data.
1 Comments on “Conspiracy theories alive and well on government’s role in health IT”
I came here from a search for “electronic medical records conspiracy” following a conversation with a friend who is all fired up about this. It’s something I have felt very positive about and the friend in question is into all sorts of other such things so I was looking for something to pass on to her–not that you can convert those who accept most anything on faith alone. The friend is quite “alternative” and anti-science. Anyway, having read this I do feel better informed, but I am still in the dark as to just what people specifically fear even if the government/agencies did get into their medical records? What medical details would anyone be looking for?
Any links or perspective?