Medical Record Confidentiality Law,Scientific Research,and Data Collection in the Information Age

See discussion in Gostin L.O. , “Health Information Privacy,” Cornell Law Review, 80 (1995): At 480–81, n.138.

See id. at 452.

See Louis Harris and Associates, Health Care Information Privacy: A Survey of the Public and Leaders (Atlanta: Equifax, Inc., 1993): At 65.

Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (codified as amended in scattered sections of U.S.C. and I.R.C.) (1996).

See, for example, American Medical Association, Principles of Medical Ethics (Chicago: American Medical Association, 1957): At § 9; “Ethical Principles of Psychologists,” American Psychologist, 36 (1981): At 635–36; and American Hospital Association, Hospital Medical Records (Chicago: American Hospital Association, 1972): At 5.

For a useful discussion of the human dignity respect for person basis for the right to privacy, see Schoeman F. , ed., Philosophical Dimensions of Privacy: An Anthology (Cambridge: Cambridge University Press, 1984); and Turkington R.C. , Cases and Materials on Privacy (Houston: John Marshal Publishing, 1992): Ch. 1. Preserving the integrity of the professional-client relationship reflects the traditions of science, empiricism, utilitarianism, and of the health profession in providing treatment and care.

For a general analysis of the array of laws that touch confidentiality issues and health information, see Gostin , supra note 1; and Turkington R.C. , “Legal Protection for the Confidentiality of Health Care Information in Pennsylvania: Patient and Client Access; Testimonial Privileges; Damage Recovery for Unauthorized Extra-Legal Disclosure,” Villanova Law Review, 32 (1987): 259–400.

See generally, Advisory Panel on Privacy and Confidentiality of Hospital Records, American Hospital Association, Guidelines on Institutional Policies for Disclosure of Medical Record Information (Chicago: American Hospital Association, 1979); and Bruce J.A.C. , Privacy and Confidentiality of Health Care Information (Chicago: American Hospital Association, 1988). The terminology is in flux because of changes in the health care delivery system. See, for example, Gostin , supra note 1, at 452 n.4 (using the concept of “Health Data”).

The concepts of confidentiality and breach of confidentiality are the result of collaboration with Robert Wettstein, a psychiatrist. I am deeply indebted to him for his contributions to my understanding of ethico-legal issues in confidentiality law.

See Keeton W.P. , Prosser and Keeton the Law of Torts (St. Paul: West Publishing, 5th ed., 1984): At § 18, 117.

See, for example, Saur v. Probes, 476 N.W.2d 496 (Mich. Ct. App. 1991).

See, for example, Tarasoff v. Regents of the University of California, 551 P.2d 334 (Cal. 1976).

See generally, Mancolini R.M. , “Elder Abuse Policy: Consideration in Research and Legislation,” Behavioral Sciences and the Law, 13 (1995): At 352.

See Hyman A. Schillinger D. Lo B. , “Laws Mandating Reporting of Domestic Violence,” JAMA, 273 (1995): 1781–87.

See id.

See Stuart N.E. , “Child Abuse Reporting: A Challenge to Attorney-Client Confidentiality,” Georgetown Journal of Legal Ethics, 1 (1987): At 246.

See, for example, 23 Pa. Stat. Ann. §§ 6311-19 (West 1997) (requiring physicians, osteopaths, medical examiners, corners, dentists, registered nurses, and hospital personnel engaged in the admission examination, care or treatment of persons, as well as school teachers and administrators, school nurses, social workers, and day care workers, among others, to report serious physical or mental injury, sexual abuse, sexual exploitation, or serious physical neglect of a child under the age of eighteen). In Roman v. Appley, 558 F. Supp. 449 (E.D. Pa. 1983), the court dismissed all federal and state claims brought against a social worker who had erroneously reported child abuse, on the basis of the good faith defense under the reporting statute.

On state legislation, see, for example, R.I. Gen. Laws § 5-37.3 (1986); and Cal. Civ. Code § 56 (West 1987). See generally, Southwick A.F. , The Law of Hospital and Health Care Administration (Ann Arbor: Health Administration Press, 1988): At 511. On patient bills of rights that include confidentiality protection, see, for example, 28 Pa. Code § 103.22(b)(15) (1982).

National Association of Insurance Commissioners, NAIC Insurance Information and Privacy Protection Model Act (Kansas City: National Association of Insurance Commissioners, Model No. 670, 1992).

See id. at § 13(B).

See McCormick C.T. , McCormick on Evidence (St. Paul: West Publishing, 4th ed., 1992): At § 103. See, for example, Jones v. Prudential Life Insurance Co. , 388 A.2d 476 (D.C. 1978), where the court upheld a general release of health information to an insurance company and also treated the general release as a waiver of an evidentiary privilege for the information.

Paul Schwartz describes this as a form of “uninformed consent.” See Schwartz P. , “The Protection of Privacy in Health Care Reform,” Vanderbilt Law Review, 48 (1995): 295–346.

See also generally, Donaldson M.S. Lohr K.N. , eds., Institute of Medicine, Health Data in the Information Age: Use, Disclosure, and Privacy (Washington, D.C.: National Academy Press, 1994): At 50, 52, 151–52.

Whalen v. Roe, 429 U.S. 589 (1977).

United States v. Westinghouse Electric Corp. , 638 F.2d 570 (3d Cir. 1980).

See id. at 578–80.

In re “B,” Appeal of Dr. Loren Roth, 394 A.2d 419 (Pa. 1978).

Rasmussen v. South Florida Blood Service, Inc. , 500 So. 2d 533 (Fla. 1987).

See, for example, 500 So. 2d 533; 638 F.2d 570; and In re the June 1979 Allegheny County Investigation Grand Jury, 415 A.2d 7, 76 (Pa. 1980).

See Doe v. Borough of Barrington, 729 F. Supp. 376 (D.N.J. 1990); Carter v. Broadlawn Medical Center, 857 F.2d 448 (8th Cir. 1988); and Doe v. City of New York, 15 F.3d 264 (2d Cir. 1994). These courts found that disclosure of plaintiffs' HIV status violated their constitutional right to privacy.

See, for example, N.J. Stat. Ann. § 4A-22.15 (West 1997) (New Jersey's victim counselor privilege); and Wis. Stat. Ann. § 905.04 (West 1994) (Wisconsin's statutory privilege for physicians, registered nurses, chiropractors, psychologists, social workers, and marriage and family therapists). See generally, Stone S.N. Taylor R.K. , Testimonial Privileges (New York: Shepard's/McGraw-Hill, 2nd ed., 1993): At § 7.01.

See generally, Stone Taylor , supra note 31, at § 7.01; and Wigmore J.H. , Evidence in Trials at Common Law (Boston: Little, Brown, 1961): At § 81.

A few states have applied the balancing approach, even in respect to the psychotherapist-client privilege. See, for example, Me. Rev. Stat. Ann. tit. 32, § 7005 (West 1964); N.H. Rev. Stat. Ann. § 330-A-19 (West 1995); N.C. Gen. Stat. § 8-53.7 (1986); and Va. Code Ann. § 801-4000.2 (Michie 1992). For examples of an implied waiver attaching to the initiating litigation, see “Development in the Law—Privileged Communications,” Harvard Law Review, 98 (1985): At 1637.

See 42 Pa. Cons. Stat. Ann. § 5944 (West 1995) (the Pennsylvania Psychologist-Client Privilege Statute). See also Jaffee v. Redmond, 116 S. Ct. 1923 (1996) (recognizing similar federal privilege).

See, for example, Whyte v. Connecticut Mutual Life Insurance Co., 818 F.2d 1005 (1st Cir. 1987).

The health records of a person's HIV status are also granted limited privilege status in many states.

See, for instance, Commissioner of Social Services v. David R.S., 436 N.E.2d 451 (N.Y. 1982).

See 818 F.2d 1005.

See 436 N.E.2d 451.

West Virginia Board of Medicine v. Mayo Clinic, Civ. No. 3092-335 (D. Minn. 1993).

See Napp S. Vander Creet L. , Privileged Communications in the Mental Health Profession (New York: Norstrand/Rinehold, 1987).

Jaffee, 116 S. Ct. 1923.

See id.

See id. ( Stevens J. ).

See Freedom of Information Act, 5 U.S.C § 552 (1988).

See Privacy Act, 5 U.S.C. § 552a (West 1979 & Supp. 1990).

See Forsham v. Harris, 445 U.S. 169 (1980).

See 5 U.S.C. § 552, exempt. 3.

See 52 Fed. Reg. 21796 (1987 WL 148286).

See 5 U.S.C. § 552, exempt. 6.

See, for example, United States Department of Justice v. Reporters Committee for Freedom of Press , 489 U.S. 749 (1989); and Department of the Air Force v. Rose, 425 U.S. 352 (1976).

5 U.S.C. § 552a (West 1974 & Supp. 1990); and New Systems of Records, 62 Fed. Reg. 16596 (1997).

See Gostin , supra 1, at 501–03.

See Iowa Code Ann. § 22.1 (West 1995).

Head v. Colloton, 331 N.W.2d. 870 (Iowa 1983).

See Smith R.E. , Compilation of Federal and State Privacy Laws (Providence: Privacy Journal, 1992): At 20–24.

Mass. Gen. Laws ch. 66A, §§ 2(c), 2(f) (1996).

See Flaherty D.H. , Protecting Privacy in Surveillance Societies (Chapel Hill: University of North Carolina Press, 1989): At 305.

42 C.F.R. §§ 2.21, 2.32 (1996).

See, for example, Pennsylvania's AIDS Confidentiality Statute prohibiting subsequent disclosure: (b) Subsequent disclosure prohibited (no) person to whom confidential HIV-related information has been disclosed under this act may disclose that information to another person except as authorized by this act. 35 Pa. Cons. Stat. Ann. § 7607 (West 1995).

See Andrews L.B. Jaeger A.S. , “Confidentiality of Genetic Information in the Workplace,” American Journal of Law & Medicine, XVII (1991): At 75, n.26, for a summary of states that view breaches of confidentiality as grounds for professional discipline including loss of license.

See Hammonds v. Aetna Casualty & Surety Co. , 243 F. Supp. 793 (N.D. Ohio 1965).

See Estate of Behringer v. Medical Center at Princeton , 592 A.2d 1251 (N.J. Super. Ct. Law Div. 1991).

Warren C. Brandeis L. , “The Right to Privacy,” Harvard Law Review, 4 (1890): 193–220.

The four privacy torts are summarized in Section 652 of the Restatement (Second) of Torts: (1) 652B. Intrusion upon Seclusion (Privacy Intrusion Tort); (2) 652C. Appropriation of Name or Likeness; (3) 652D. Publicity Given to Private Life (Private Facts Tort); and (4) 652E. Publicity Placing Person in False Light.

See Bezanson R.P. , “The Right to Privacy Revisited: Privacy, News, and Social Change, 1890–1990,” California Law Review, 80 (1992): 1133–76; and Zimmerman D.L. , “Requiem for a Heavyweight: A Farewell to Warren and Brandeis' Privacy Tort,” Cornell Law Review, 68 (1983): 291–367. Both authors suggest that the breach of confidence tort be used in place of the private facts tort. See Doe v. Methodist Hospital, 639 N.E.2d 683 (Ind. Ct. App. 1994); and Multimedia WMAZ, Inc. v. Kubach, 443 S.E.2d 491 (Ga. Ct. App. 1994), where the private facts tort was the basis of a liability claim against a hospital and its employees and a television station for publishing a person's HIV status. See also, Miller v. Motorola, Inc., 560 N.E.2d 900 (Ill. 1990) (holding an employer liable for disclosing an employee's personal health information to coworkers).

For an elaboration of the distinction between highly intimate and highly personal, see Turkington R.C. , “Legacy of the Warren and Brandeis Article: The Emerging Constitutional Right to Informational Privacy,” Northern Illinois University Law Review, 10 (1990): At 506–07.

Department of Health and Human Services regulations for institutional review board approval of research require that: When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data, 45 C.F.R. Sec. 46.111(a)(7). The requirements of informed consent include, “A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.” 45 C.F.R. Sec. 46.116(a)(5). 45 C.F.R. § 46.111(a)(7) (1996); and 45 C.F.R. § 46.116(a)(5) (1996).

See Confidentiality of Alcohol and Drug Abuse Patient Records, 42 C.F.R. § 2.1 (1996). The regulations do not provide a blanket privilege for the records. However, the records may only be disclosed in court proceedings after a court hearing and after a finding of good cause. In determining good cause, the court is required to weigh the need to know against the injury to the physician-patient relationship and treatment service. Courts are also required to impose safeguards against unnecessary further disclosure.

Fed. R. Civ. P. 26(c).

Farnsworth v. Procter Gamble Co. , 758 F.2d 1545 (11th Cir. 1985).

See id. at 1547.

See id. at 1545.

Andrews v. Eli Lilly & Co., 97 F.R.D. 494 (N.D. Ill. 1983). Defendant Squibb was able to get information in the Registry from those women who had initiated lawsuits, because they had voluntarily raised the issue of their medical conditions in court.

Argonaut Insurance Co. v. Peralta , 358 So. 2d 232 (Fla. Dist. Ct. App. 1978).

See supra notes 25-26 and accompanying text.

See 42 C.F.R. ch. 1, § 2a.1 (1996).

See id.

See Assistant Secretary, U.S. Department of Health and Human Services, Interim Policy Statement (May 22, 1989).

21 U.S.C. §§ 301 et seq. (1994) (Food, Drug and Cosmetic Act).

Earley C.L. Strong L.C. , “Certificates of Confidentiality: A Valuable Tool for Protecting Genetic Data,” American Journal of Human Genetics, 57 (1995): 727–31.

See Alberts v. Devine, 479 N.E.2d 113 (Mass. 1985) (psychiatrist of priest to superior and bishop); MacDonald v. Clinger, 84 A.D.2d 482 (N.Y. App. Div. 1982) (psychiatrist to spouse); Schaffer v. Spicer, 215 N.W.2d 134 (S.D. 1974) (psychiatrist to spouse); Humphreys v. First Interstate Bank, 696 P.2d 527 (Or. 1985) (physician of natural mother to adopted daughter); and Home v. Patton, 287 So. 2d 824 (Ala. 1973) (physician to employer).

See Holder A.R. , “Research and Subpoenas: A Continuing Issue,” IRB: A Review of Human Subjects Research, 15, no. 1 (1993): 6–7.

See generally, Gilles S.M. , “Promises Betrayed: Breach of Confidence as a Remedy for Invasions of Privacy,” Buffalo Law Review, 43 (1995): 1–84.

45 C.F.R. § 46.116 (1997).

See 45 C.F.R. § 46.116(a)(5) (1996). The general requirements for informed consent include “A statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.”

One issue is whether the regulations apply when the data is acquired during clinic care. Some have argued that those under clinical care are not human subjects within the regulations. However, the better view is that data acquired in clinical settings is covered by the regulations, because the definition of research on human subjects includes any investigator conducting research who obtains identifiable private information on a subject. 45 C.F.R. § 46.102(f) (1997). For a useful analysis of these and other important issues under the regulations, see Clayton E.W. , “Informed Consent for Genetic Research on Stored Tissue Samples,” JAMA, 274 (1995): 1786–92.

45 C.F.R. § 46.101 (1997). Some commentators view this exemption to apply only where (1) the nonidentifiable data is in existence at the time the research commences, and (2) the identifiers must have been irretrievably removed from the data that is studied. See Clayton , supra note 87.

See 45 C.F.R. § 46.101(5)(f).

See Minn. Stat. Ann. § 144.335 (West 1996).

Veatch R.M. , “Consent, Confidentiality, and Research,” N. Engl. J. Med., 336 (1997): At 869.

See Donaldson Lohr , supra note 23, at 202, 205, rec. 4.3.

See Clayton , supra note 87. See also Capron A.M. , “Protection of Research Subjects: Do Special Rules Apply in Epidemiology?,” Journal of Clinical Epidemiology, 44, Supp. 1 (1991): 81S–89S.

See Veatch , supra note 91; and Wald N. , “Use of Personal Medical Records for Research Purposes,” British Medical Journal, 309 (1994): 1422–24.

Pub. L. No. 104-191, 110 Stat. 1936, § 264 (1996).

Id. at § 1173(b).

Id. at § 264.

A 1993 Harris survey indicated that 56 percent of the public who responded to the survey thought that federal legislation was needed. See Louis Harris and Associates, supra note 3, at 97. A majority of public officials also indicated their support for national legislation.

National Committee on Vital and Health Statistics, Health Privacy and Confidentiality Recommendations (visited July 24, 1997) <http://aspe.os.dhhs.gov/ncvhs/privrecs.htm>.

Shalala D.E. , U.S. Secretary of Health and Human Services, Address to the National Press Club, Washington, D.C. (July 31, 1997).

See Lowrance W.W. , Privacy and Health Research, A Report to the U.S. Secretary of Health and Human Services (Washington, D.C.: Department of Health and Human Services, May 1997): At 43, 53.

Numerous bills were proposed in the 104th and the 105th Congress. They included: Medical Records Confidentiality Act of 1996, S. 1360, 104th Cong. (1996) (proposed by Senator Robert Bennett (R-Utah); Medical Privacy in the Age of New Technologies Act of 1997, H.R. 1815, 105th Cong. (1997) (proposed by Representative Jim McDermott (D-Wash.); and Fair Health Information Practices Act of 1997, H.R. 52, 104th Cong. (1997) (proposed by Representative Gary Condit (D-Cal.). Senator Patrick Leahy (D-Vt.) has a proposal that was not introduced during the last term, but is well known. I cite sections from Leahy's most recent proposal, which is designated 105th Congress. These proposals are currently being reviewed and revised.

See Lowrance , supra note 101.

For laws that emphasize patient autonomy, see, for example, H.R. 1815, § 103(a)(1),(A)–(E) (prohibiting general releases, creating the right of a patient to segregate health information and to restrict use by employees, agents, and contractors of the custodian); and Leahy Bill, 105th Cong., § 3023(4)(f) (patients may segregate nonadministrative billing information and also decide that such information will not be maintained in computerized or digital systems). For the NAIC Model Act, see National Association of Insurance Commissioners, supra note 19.

See, for example, H.R. 52, §§ 111–12 (describing the consent form and requiring notice in terms of a statement of use but no restrictions on general consent). See also § 113(A), authorizing a health information trustee to a health benefit plan sponsor, health care provider, or health oversight agency for the purpose of payment without patient consent and providing for health care unless the subject “has not previously objected to the disclosure in writing.”

See H.R. 1815, § 209(a); and Leahy Bill, § 312(a). Another proposal would grant public health agencies unrestricted access to personally identifiable medical information. See S. 1360, § 208.

See Bill Leahy , §§ 201–03; H.R. 1815, §§ 101-03; S. 1360, §§ 101-03; and H.R. 52, §§ 101–03.

See H.R. 52, §§ 151–54; S. 1360, §§ 301-02, 311; H.R. 1815, §§ 301-02, 311; and Bill Leahy , §§ 111–13, 121–24.

U.S. Const. art. VI.

42 C.F.R. ch. 1, § 2.20 (1996).

American Hospital Association (visited Aug. 13, 1997) <http://www.aha.org>.

See, for example, S. 1360, tit. IV, § 401.

See H.R. 52, § 304(b).

Council Directive 95/46/EC, art. 24, 1995 O.J. (L281) 31–50.

H.R. 1815, § 201(h).

Bill Leahy , § 4(12).

H.R. 1815, § 3(14).

See Lowrance , supra note 101, at 34; and Clayton , supra note 87.

See Capron , supra note 93. Alexander Capron views informed consent for research as primarily having the role of preventing harm to the subject. But consent also has four additional functions: (1) promoting autonomy and self-determination; (2) improving research; (3) regularizing relationships; and (4) protecting privacy.

See H.R. 1815, § 103(a)(1)(E); and Bill Leahy , § 302(c)–(d).

See Bill Leahy , § 302(f).

See H.R. 1815, § 103(a)(1)(A)–(E); and Bill Leahy , § 302(f).

See H.R. 1815, § 111(b)(2)(C)–(D).

See H.R. 52, § 112 (1997).

See National Committee on Vital and Health Statistics, supra note 99.

See, for example, Katz J. , The Silent World of Doctor and Patient (New York: Free Press, 1984); and Faden R. Beauchamp T. , A History and Theory of Informed Consent (New York: Oxford University Press, 1986).

See, for example, United States v. R. Enterprises, Inc., 111 S. Ct. 722 (1991) (holding that there is a different standard of relevancy for subpoenas issued by a trial court and by a grand jury); In re Allegheny County, 415 A.2d 73 (constitutional right to privacy reached records subpoenaed by a grand jury investigating possible fraud in billing); Division of Medical Quality Board of Medical Quality Assurance v. Gherardini, 156 Cal. Rptr. 55, 93 Cal. App. 3d 669 (4th Cir. 1979) (holding that statutory privilege and constitutional right to privacy required a state medical quality assurance board to demonstrate that access to records was necessary to further a compelling state interest); and United States v. Miller, 425 U.S. 435 (1976) (holding that a subpoena of bank records was not a search of the bank customer under the Fourth Amendment).

See Bill Leahy , § 324. Oversight agencies are not required to procure a subpoena to show probable cause to access research records in the private sector.

See H.R. 1815 § 207.

See H.R. 52, § 2(6); and S. 1360, § 2(8).

Pub. L. No. 104-191, 110 Stat. 1936, § 248(a) (1996).

Compare 42 C.F.R. § 2.65 (1996).

See Bill Leahy , § 315.

See H.R. 1815, § 213.

See id.; and Bill Leahy , § 315.

See H.R. 52, §§ 116–17: Bill Leahy , §§ 311, 314, 322; and H.R. 1815, §§ 116–17.

See Bill Leahy , § 322; and H.R. 1815, § 210.

See H.R. 52, § 116.