Proposed new Consumer Privacy Bill of Rights: Is It Too Late For Healthcare?

From the White House:

http://www.whitehouse.gov/the-press-office/2012/02/23/fact-sheet-plan-protect-privacy-internet-age-adopting-consumer-privacy-b

The White House
Office of the Press Secretary
For Immediate Release
February 23, 2012

Plan to Protect Privacy in the Internet Age by Adopting a Consumer Privacy Bill of Rights

CONSUMER PRIVACY BILL OF RIGHTS

The Consumer Privacy Bill of Rights applies to personal data, which means any data, including aggregations of data, that is linkable to a specific individual. Personal data may include data that is linked to a specific computer or other device. The Administration supports Federal legislation that adopts the principles of the Consumer Privacy Bill of Rights. Even without legislation, the Administration will convene multi-stakeholder processes that use these rights as a template for codes of conduct that are enforceable by the Federal Trade Commission. These elements—the Consumer Privacy Bill of Rights, codes of conduct, and strong enforcement—will increase interoperability between the U.S. consumer data privacy framework and those of our international partners.

1. INDIVIDUAL CONTROL: Consumers have a right to exercise control over what personal data companies collect from them and how they use it. Companies should provide consumers appropriate control over the personal data that consumers share with others and over how companies collect, use, or disclose personal data. Companies should enable these choices by providing consumers with easily used and accessible mechanisms that reflect the scale, scope, and sensitivity of the personal data that they collect, use, or disclose, as well as the sensitivity of the uses they make of personal data. Companies should offer consumers clear and simple choices, presented at times and in ways that enable consumers to make meaningful decisions about personal data collection, use, and disclosure. Companies should offer consumers means to withdraw or limit consent that are as accessible and easily used as the methods for granting consent in the first place.
2. TRANSPARENCY: Consumers have a right to easily understandable and accessible information about privacy and security practices. At times and in places that are most useful to enabling consumers to gain a meaningful understanding of privacy risks and the ability to exercise Individual Control, companies should provide clear descriptions of what personal data they collect, why they need the data, how they will use it, when they will delete the data or de-identify it from consumers, and whether and for what purposes they may share personal data with third parties.
3. RESPECT FOR CONTEXT: Consumers have a right to expect that companies will collect, use, and disclose personal data in ways that are consistent with the context in which consumers provide the data. Companies should limit their use and disclosure of personal data to those purposes that are consistent with both the relationship that they have with consumers and the context in which consumers originally disclosed the data, unless required by law to do otherwise. If companies will use or disclose personal data for other purposes, they should provide heightened Transparency and Individual Control by disclosing these other purposes in a manner that is prominent and easily actionable by consumers at the time of data collection. If, subsequent to collection, companies decide to use or disclose personal data for purposes that are inconsistent with the context in which the data was disclosed, they must provide heightened measures of Transparency and Individual Choice. Finally, the age and familiarity with technology of consumers who engage with a company are important elements of context. Companies should fulfill the obligations under this principle in ways that are appropriate for the age and sophistication of consumers. In particular, the principles in the Consumer Privacy Bill of Rights may require greater protections for personal data obtained from children and teenagers than for adults.
4. SECURITY: Consumers have a right to secure and responsible handling of personal data. Companies should assess the privacy and security risks associated with their personal data practices and maintain reasonable safeguards to control risks such as loss; unauthorized access, use, destruction, or modification; and improper disclosure.
5. ACCESS AND ACCURACY: Consumers have a right to access and correct personal data in usable formats, in a manner that is appropriate to the sensitivity of the data and the risk of adverse consequences to consumers if the data is inaccurate. Companies should use reasonable measures to ensure they maintain accurate personal data. Companies also should provide consumers with reasonable access to personal data that they collect or maintain about them, as well as the appropriate means and opportunity to correct inaccurate data or request its deletion or use limitation. Companies that handle personal data should construe this principle in a manner consistent with freedom of expression and freedom of the press. In determining what measures they may use to maintain accuracy and to provide access, correction, deletion, or suppression capabilities to consumers, companies may also consider the scale, scope, and sensitivity of the personal data that they collect or maintain and the likelihood that its use may expose consumers to financial, physical, or other material harm.
6. FOCUSED COLLECTION: Consumers have a right to reasonable limits on the personal data that companies collect and retain. Companies should collect only as much personal data as they need to accomplish purposes specified under the Respect for Context principle. Companies should securely dispose of or de-identify personal data once they no longer need it, unless they are under a legal obligation to do otherwise.
7. ACCOUNTABILITY: Consumers have a right to have personal data handled by companies with appropriate measures in place to assure they adhere to the Consumer Privacy Bill of Rights. Companies should be accountable to enforcement authorities and consumers for adhering to these principles. Companies also should hold employees responsible for adhering to these principles. To achieve this end, companies should train their employees as appropriate to handle personal data consistently with these principles and regularly evaluate their performance in this regard. Where appropriate, companies should conduct full audits. Companies that disclose personal data to third parties should at a minimum ensure that the recipients are under enforceable contractual obligations to adhere to these principles, unless they are required by law to do otherwise.

For an example of some of the major problems with healthcare data, see my Oct. 2009 post "Health IT Vendors Trafficking in Patient Data?"

I like the proposals.

The question is, regarding electronic health data: are these Federal proposals too little, too late?

Complex systems such as massive computer networks (with myriad stakeholders seeking to 'game' the system, skirt the boundaries of the law, and make handsome profits) can become uncontrollable.

-- SS

It's Remarkable That EHRs Can't Do What Med Students Are Taught in PGY3-4 ... And Remarkable That Academics Don't Push This Information to the Public

The following article's full text from the journal Applied Clinical Informatics (ACI) is not freely available, but the abstract says all that needs to be said:

Clinical Summarization Capabilities of Commercially-available and Internally-developed Electronic Health Records (Vol. 3: Issue 1 2012)

A. Laxmisan (1), A. B. McCoy (2), A. Wright (3), D. F. Sittig (2)

(1) Houston VA Health Services Research and Development Center of Excellence, Michael E. DeBakey Veterans Affairs Medical Center and Section of Health Services Research, Department of Medicine, Baylor College of Medicine, Houston, TX; (2) School of Biomedical Informatics, The University of Texas Health Science Center at Houston (UTHealth), Houston, TX; (3) Brigham and Women’s Hospital, Harvard Medical School, Boston, MA

Summary

Objective: Clinical summarization, the process by which relevant patient information is electronically summarized and presented at the point of care, is of increasing importance given the increasing volume of clinical data in electronic health record systems (EHRs). There is a paucity of research on electronic clinical summarization, including the capabilities of currently available EHR systems.

Methods: We compared different aspects of general clinical summary screens used in twelve different EHR systems using a previously described conceptual model: AORTIS (Aggregation, Organization, Reduction, Interpretation and Synthesis).

Results: We found a wide variation in the EHRs’ summarization capabilities: all systems were capable of simple aggregation and organization of limited clinical content, but only one demonstrated an ability to synthesize information from the data. Conclusion: Improvement of the clinical summary screen functionality for currently available EHRs is necessary. Further research should identify strategies and methods for creating easy to use, well-designed clinical summary screens that aggregate, organize and reduce all pertinent patient information as well as provide clinical interpretations and synthesis as required.

Put more directly, EHRs were poor at presenting relevant clinical information in summary form at the point of care.

(They're even worse after care is finished; see my Feb. 2011 post "Electronic Medical Records: Two Weeks, Two Reams" on the piles of 'legible gibberish' put out as official medical records of entire hospital admissions.)

The implications are that these systems cause physicians to waste time, weed through inordinate amounts of data in seeking what's important to help patients - and prevent errors. Thus, they are highly likely to increase clinician cognitive burdens and quite possibly reduce the quality of care.

But don't just take my word for that.

The 2009 National Research Council report made similar observations about EHRs in research overseen by two of HIT's preeminent pioneers, Drs. Octo Barnett and William Stead. See "Current Approaches to Healthcare Information Technology are Insufficient" and the accompanying full NRC report here that states:

"Current efforts aimed at the nationwide deployment of health care information technology (IT) will not be sufficient to achieve medical leaders' vision of health care in the 21st century and may even set back the cause ... The report describes difficulties with data sharing and integration, deployment of new IT capabilities, and large-scale data management. Most importantly, current health care IT systems offer little cognitive support; clinicians spend a great deal of time sifting through large amounts of raw data (such as lab and other test results) and integrating it with their medical knowledge to form a whole picture of the patient. Many care providers told the committee that data entered into their IT systems was used mainly to comply with regulations or to defend against lawsuits, rather than to improve care. As a result, valuable time and energy is spent managing data as opposed to understanding the patient."

I find several aspects of the new ACI study and its findings remarkable:

First:

Clinical summarization is an essential skill for patient pickups (e.g., taking over the care of a hospitalized patient or performing a consult on them), patient handoffs (such as when put in care of a covering physician), and other related informational reasons.

It is a skill taught (at least when I attended medical school) in the third and fourth years, also known as PGY3 and PGY4 (postgraduate years 3 and 4).

I was tested on my ability to perform this task adequately, and the quality of my clinical summaries were also evaluated during internship and residency training as one of many criteria for successful completion.

The author's results, therefore, indicate that EHR designers and implementers cannot, or will not, incorporate the skills of clinical summarization required of PGY3-4 medical students and interns into their products, even after several decades of product manufacturing.

I find this astonishing.

Second:

While I applaud the authors of the new ACI study for performing such work, which in the current environment of hyper-enthusiastic cybernetic technophilia in medicine might cause negative industry pushback, I find another aspect of their work astonishing (perhaps 'disappointing' is a better term):

They only published their findings in ACI.

ACI is an excellent new journal, but as it is a relatively specialized journal in a specialized domain, its content will reach probably on the order of thousands of people in a substantive way.

This very blog has surpassed one million "hits", we estimate; my Drexel University site on HIT difficulties (including its predecessors) has probably surpassed the quarter million mark.

My point is that, at a time when the Institute of Medicine, NIST and others have advised further study of health IT to decide if HIT is safe and efficacious (because they don't really know) in order to decide if FDA or other governmental regulation is needed, research findings such as that of Archana Laxmisan, M.D, Dean Sittig PhD, and Adam Wright PhD, deserve far wider dissemination than in a highly specialized, relatively new informatics journal.

Let me further go on to say that physicians, by the nature of their MD degree, and non-physician informaticists such as Sittig and Wright, should feel ethically compelled to actively diffuse this type of finding about an experimental, suboptimal and potentially dangerous medical device (as per FDA CDRH's designation as such) more widely.

They should not leave it to bloggers such as myself to do that work for them.

This is not to single out these authors, this journal or this article; the phenomenon is common. Health IT research findings of potential great import sit in scientific journals that rarely if ever get seen by the lay citizenry, despite the importance to their being informed about the technology's actual and potential downsides.

How about the New York Times or Wall Street Journal? Even YouTube? These observations are not at all to impugn publication in ACI in any way, whose editor in chief I deeply respect for publishing articles that could be viewed as "negative" about HIT. Wider diffusion in non-academic print media and/or "New Media", however, would get messages such as in the clinical summarization deficiency study out in a way that would have far more social impact - and help protect patients.

In other words, the authors of informatics studies need to actively "get out more."

After all, the industry and government spare no effort in positive publicity, even making unabashed marketing claims not backed by the scientific literature, such as in the Feb. 24, 2012 HHS press release at this link:

“We know that broader adoption of electronic health records can save our health care system money, save time for doctors and hospitals, and save lives,” said [HHS] Secretary Sebelius."

Unlike the relationships between, say, hydrochlorothiazide diuretics and reductions in blood pressure, or sterile techniques in surgery lessening infection, I don't think that in 2012 we "know" that at all (link).

-- SS

Feb. 26, 2012 addendum:

Regarding my final point about the HHS statement, a reader who wishes to remain unnamed, familiar with efforts outside the US, offers the following interesting observations:

"This [HHS statement from Sebelius] is political spin to try to keep some momentum in a project that is obviously failing. What is more they KNOW it is failing and can read the IOM report and the negative US and UK reports on EHR's.

The White House is clearly desperate to calm voter and healthcare professional opinion and this is another naked attempt to project the inevitable crisis to beyond the end of this year...well at least early November.

I know that this is true because Sebelius' language is exactly the same as that used by the UK Dept. of Health just before NPfIT completely folded...

Also, implementation rates of HIT projects must also be carefully scrutinized as they reflect the percentage of hospitals where something, usually anything has been switched on rather than the proportion where a full EHR, PACS, CPOE etc. has been achieved. A good question to ask is how many units are now paperless?"

-- SS

HIMSS Annual Meeting in Las Vegas - Fitting for People Who Gamble With People's Lives to Make a Buck?

The setting for the Feb. 2012 annual meeting of HIMSS (the Health Information Management Systems Society, the gargantuan health IT trade group), ongoing as of this writing, is the Venetian Sands Expo Center in Las Vegas, NV.

Judging by the pictures posted at the HisTALK blog here of the event, now ongoing, it seems to be one big, happy party:

Rolling the dice at HIMSS 2012, Las Vegas.

This is ironically apopos for an organization whose leaders beg for special accommodation for a technology they know their industry has not learned how to "do right" after decades of profiteering (at patient's expense), thus gambling with live, unconsenting people as the poker chips:

Barry Chaiken, former HIMSS Chairman of the Board, July 2010 interview: "We’re still learning, in healthcare, about that user interface. We’re still learning about how to put the applications together in a clinical workflow that’s going to be valuable to the patients and to the people who are providing care. Let’s be patient. Let’s give them a chance to figure out the right way to do this. Let’s give the application providers an opportunity to make this better." [While the systems remain in use on live, unconsenting patients - ed.]

It is difficult to imagine such a statement coming from the aviation, nuclear energy or other lives-at-risk industries.

HIMSS 2012 really seems to be a fun party. Even Elvis was in attendance:

Elvis, a fitting icon for an industry trade show on health IT? Journalist Tony Scherman wrote that by early 1977, "Elvis Presley had become a grotesque caricature of his sleek, energetic former self. Hugely overweight, his mind dulled by the pharmacopoeia he daily ingested, he was barely able to pull himself through his abbreviated concerts."

Sounds like what the commercial health IT sector has done to the good intentions and well-thought out applications created by the health IT pioneers.

I note that prostitution is legal in Las Vegas as well. This allows making money from objectification of human beings, although at least the latter give consent to the exploitation of their bodies.

Final thought:

What was missing from HIMSS was the ED EHR Slot Machine of Risk. (From my March 2011 post "On an EMR Forensic Evaluation by Professor Jon Patrick from Down Under: More Thoughts.")

The ED EHR Slot Machine. Click to enlarge. You've hit the ED EHR mis-processing jackpot! Perhaps today is a good day to die...

-- SS

BLOGSCAN - Television Advertising Revenue and the Anechoic Effect

We have often discussed the anechoic effect, how cases involving or discussions of the topics we address on Health Care Renewal, the concentration and abuse of power in health care, fail to produce any responses, or echoes.  Two recent blog posts discussed one way in whicht the anechoic effect might be generated.

A post by Dr Steven Greer on CurrentMedicine.TV, enlarged upon by Alison Bass on the Alison Bass blog, discussed a segment on 60 Minutes yesterday that dealt with the evidence that anti-depressant drugs may not be efficacious for mild to moderate depression.  Since this evidence is about four years old, the question is why it has only made it to the main-stream media now?  Both Dr Greer and Ms Bass think it may be because the patents on most of the newer, mainly selective serotonin reuptake inhibitor (SSRI) type anti-depressants have run out.  Therefore, their manufacturers may no longer be interested in using the clout they derive from paying millions for television advertising to keep programs critical of these drugs off the air.  The implication is that large health care organizations may often use threats to withdraw advertising to forestall criticisms of their products or their agendas in the media, hence increasing the anechoic effect.

ADDENDUM (27 February, 2012) See also comments on the 1BoringOldMan blog. 

Is ONC Stonewalling on the issue of HIT Certification, Safety and Liability?

At my Feb. 16, 2012 post "Hospitals and Doctors Use Health IT at Their Own Risk - Even if Certified" I wrote that an ONC-ATCB (Authorized Testing and Certification Body) replied to my email inquiry about health IT certification, safety and liability indemnification by stating that:

What was suggested in the email below (freedom from liability for users of the system, etc.) would be out of scope for ONC-ATCB testing based on the given criteria.

[That is, the criteria used in testing here - ed.]

What I did not include in that post was the fact that some months ago, I had emailed ONC directly with the same questions, and then called them on the phone with those questions at about the same time as I inquired of the ATCB.

ONC itself never responded.

There are several possibilities:

• They don't know the answer.
• They don't want to respond.
• They don't care to respond.

Dismissing possibility #1, these civil servants appear to be stonewalling on the issue.

It would be nice to hear ONC itself admit the term "certification" is a gossamer guarantee of health IT safety, efficacy and indemnification of purchasers, implementers and users from potential EHR-related liability.

I am not holding my breath.

-- SS

Addendum:

An ONC representative did get back to me on Feb. 27, but I told them my question had already been answered by ONC ATCB's.