Patient records managers fight for confidentiality
April 1, 1999 3 minutes read
Patient records managers fight for confidentiality
As a quality professional, you know that information is as critical to good health care measurements as oxygen is to healthy brain function. But 38,000 health information management and medical records pros, united through the Chicago-based American Health Information Association (AHIMA), make a strong case for controlled access to patient data.
Put in the wrong hands, for example, personal information can trigger unwanted adult diaper ads delivered to a middle-aged executive who signs up for an incontinence management program, or job loss for a 30-something HIV patient.
"Our concern is that patients generally don’t know how information is being used when it goes to a health insurance company or to an employer. And where will it go after that? And at what point will it be shredded?" asks Kathleen A. Frawley, JD, MS, RRA, vice president of legislative and public policy services for AHIMA.
Legal protections around the privacy of patient information are fragmented and inconsistent because each state crafts its own. AHIMA advocates for federal legislation. (For a bird’s-eye view of the complex traffic in patient records, see chart, "Flow of Patient Health Information Inside and Outside the Healthcare Industry," p. 45.)
Will information flow affect jobs, insurance?
According to AHIMA’s recent position paper, "Confidentiality of Medical Records," computer records are as safe, and as vulnerable, as paper. The group does not recommend restrictions that would jeopardize public health surveillance, clinical studies, or quality measures.
In states like Minnesota, where the privacy laws are the tightest in the country, employer purchasers of health care benefits have to rely on consumer-based measures for provider performance data. But that’s not all bad, argues Frawley, who warns, "So much medical information is flowing into personnel records, that people are concerned about its effect on their future insurance coverage and their eligibility for promotions.
"A lot of information is flowing out without patient consent. It’s coming out of this rubric of outcomes measurement or case management or disease management. We are concerned about how many of those measures can be accomplished without a direct link to individual patient identities," she says.
That sensibility is not lost on Ted von Glahn, consultant for the Foundation for Accountability (FACCT) of Portland, OR. The foundation is a leading advocate and designer of consumer-based health care quality measures. "No individual identification information would ever be disseminated outside of FACCT in performance reporting," he says.
However, he adds that FACCT does use individual names and addresses to contact individuals for certain outcomes data.
"For example, sometimes we ask patients before a medical appointment whether we may send them a questionnaire, and if they will return it to us for measurement purposes," von Glahn explains. "For other studies, we use individual records and set a point at which no individual patient data go out the door."
A federal law may be just around the corner, however. Frawley explains that the Health Insurance Portability and Accountability Act of 1996 mandates Congress to pass a law on privacy of patient data by August 1999. AHIMA recommends that the law address the following concerns:
1. What function is to be served by a piece of data?
2. How much individual information is required to fulfill the function?
3. Can the objective be accomplished with aggregate data stripped of names, addresses, dates of birth, or other facts that link data to individuals?
4. When functions require data linked to individuals, are the appropriate patient authorizations in place?
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content