IRS faces class action lawsuit over theft of 60 million medical records

Try this with paper records.  This is spectacular (as in, spectacularly alarming) if true:

IRS faces class action lawsuit over theft of 60 million medical records

The Internal Revenue Services is now facing a class action lawsuit over allegations that it improperly accessed and stole the health records of some 10 million Americans, including medical records of all California state judges.

According to a report by Courthousenews.com, an unnamed HIPAA-covered entity in California is suing the IRS, alleging that some 60 million medical records from 10 million patients were stolen by 15 IRS agents. The personal health information seized on March 11, 2011, included psychological counseling, gynecological counseling, sexual/drug treatment and other medical treatment data.

"This is an action involving the corruption and abuse of power by several Internal Revenue Service agents," the complaint reads. "No search warrant authorized the seizure of these records; no subpoena authorized the seizure of these records; none of the 10,000,000 Americans were under any kind of known criminal or civil investigation and their medical records had no relevance whatsoever to the IRS search. IT personnel at the scene, a HIPPA facility warning on the building and the IT portion of the searched premises, and the company executives each warned the IRS agents of these privileged records," it continued.   According to the case, the IRS agents had a search warrant for financial data pertaining to a former employee of the John Doe company, however, "it did not authorize any seizure of any healthcare or medical record of any persons, least of all third parties completely unrelated to the matter," the complaint read.

The class action lawsuit against the IRS seeks $25,000 in compensatory damages "per violation per individual" in addition to punitive damages for constitutional violations.  Thus, compensatory damages could start at a minimum of $250 billion.

According to the linked Courthousenews.com piece, the class is represented by attorney Robert E. Barnes of Malibu, California.   The Complaint is reported to state that the IRS' data theft was so enormous it affects "roughly one out of every twenty-five adult American citizens."

If a government agency decides to steal medical records, I'd rather the records be on paper than electronic. I think it's inarguable that it is a lot harder for 15 people to haul 60,000,000 paper charts away than a few hard disks.

Mass theft of records must be factored into the risk/benefit ratio of electronic health records.  See other posts on this topic at the label index terms below.

Addendum:  the Complaint is here (PDF).

-- SS

Minimizing Legal Liability or Upholding the Mission? - the Markingson Case Redux

There are new, and troubling developments in the long running case of Dan Markingson, the psychiatric patient and research subject who committed suicide while enrolled in a trial of anti-psychotic drugs at the University of Minnesota nearly 10 years ago.

Summary of the Case

A good quick summary of this case just appeared in the Center for Law and Bioscience blob out of the Stanford Law School. 

Dan Markingson – a vulnerable, psychotic young man – was forced to choose between enrolling in a Pharma-funded drug study or being involuntarily committed (in other words, locked up).  A UMN [University of Minnesota]  doctor enrolled him in the study despite having just determined that Dan 'lack[ed] the capacity to make decisions regarding [his] treatment,' rendering it highly unlikely that Dan could have given valid informed consent to participate.  As Dan's mother, Mary Weiss, observed his mental condition deteriorating, she repeatedly tried to have Dan removed from the trial – at one point asking  'Do we have to wait until he kills himself or someone else before anyone does anything?'  But the UMN co-investigators in the drug study refused to terminate his participation.  Shortly after Ms. Weiss made her desperate plea, Dan Markingson killed himself by cutting his own throat.

Our most recent (2011) post on the case was here.  In it we also noted that there was reason to think:
-  The design of the controlled trial was flawed.
-  Financial conflicts of interests may have influenced the trial investigators' actions, particularly their questionable enrollment of Mr Markingson in the trial and their retention of him in it despite his apparent clinical deterioration.
Despite that, when bioethicists and the University of Minnesota called for a new investigation of the trial and what happened to Mr Markingson, the university rebuffed them.

Worse, as detailed in a 2012 post in the Center for Law and Bioscience blog, not only did university officials rebuff this call, but the university general counsel, who had been operating at the heart of this case, appeared to threaten the leading bioethicist dissident, Dr Carl Elliott:

 After Carl Elliott, the University of Minnesota bioethicist, refused to drop the matter, Rotenberg asked the university’s Academic Freedom and Tenure Committee to take up the question of '[w]hat is the faculty[’s] collective role in addressing factually incorrect attacks on particular university faculty research activities?' – a question that appeared both to accuse Elliott of 'factually incorrect attacks' and to call for some unspecified action to 'address' them.  Other faculty, including the president of the Minnesota chapter of the American Association of University Professors, viewed this as an attempt to intimidate Elliott into silence.  If so, it backfired.  The story ended up in the press, putting the Markingson case back in the public eye and once again making the University of Minnesota look really bad.

New Evidence Unearthed

In 2013, Dr Elliott made public what may be important new evidence in the case.  As summarized by the Minneapolis Star-Tribune,

The professor, Carl Elliott, says he has obtained consent documents for two separate schizophrenic patients that appear to be exact copies — not just in the subjects’ apparent replies, but in the positions of the lettering on the pages.

Elliott said it is improbable that separate patients would provide identical responses to the questionnaire, which includes open-ended questions about the risks and requirements of clinical research. And that, he said, raises questions about whether the university was really examining patients to determine their ability to consent to research.

 One crucial question about the case is how a patient who was actively psychotic - out of touch with reality - could give true informed consent to participation in a drug trial.  These new documents suggest major irregularities in the process used in the trial to assure that patients did give informed consent. 

Furthermore, as reported by the Minnesota Daily, other documents that Dr Elliott found suggested problems with records that related to whether study investigators would have had legal authority to access Mr Markingson's medical records, also suggesting major problems with trial administration. 

These documents, unknown until recently, suggest new concerns with how the study in which Mr Markingson was enrolled, and during which he died, was run.  Yet, the University of Minnesota's official response to them, once again orchestrated by university counsel Mark Rotenberg, attacked the legitimacy of the documents (and indirectly, attacked Prof Elliott again), as reported by the Star-Tribune,

the university’s general counsel, Mark Rotenberg, challenged the authenticity of the documents and disagreed that study recruiters failed to obtain proper and independent consent from mentally ill patients.

'I am challenging these allegations directly,' he said. 'We have no reason to believe the consent forms were prepared inappropriately.'


As Matt Lamkin wrote in the Stanford Law and Bioscience blog,  the University's responses all through this case have been focused  not on the welfare of patients, maintaining the trust of research participants, or the integrity of clinical trials, but on the legal defense of  the University and its leaders

Despite all this (and much more), the University has never acknowledged any errors or taken any disciplinary action related to the Markingson case and has repeatedly rejected calls for an independent investigation.  That’s probably because from the start the University has handled this case as a litigation matter.  Rather than trying to determine whether there were problems with the way its personnel treated Markingson, the University has focused on minimizing its potential liability.  Accordingly, the University appears to run every inquiry related to the case through the office of its General Counsel, Mr. Rotenberg.  When Carl Elliott (my mentor as a grad student at UMN) wrote a damning article about the case in Mother Jones, the University’s response came from Rotenberg.  When UMN bioethicists called on the University’s Board of Regents to launch an independent investigation, the Regents deferred to Rotenberg.  Not surprisingly, he declined.

When you turn to your lawyer, you’re going to get a particular kind of response.  The GC isn’t in a position to take an objective look at the circumstances.  He’s an advocate.  His role is not to make sure the client has conducted itself ethically, but to minimize the client’s risk.  Asking your lawyer to respond to allegations of wrongdoing is like asking your PR flacks to do so.  Their job is to make their clients look good, not to make sure they’ve acted properly.
Note that this still begs the question of who the client is.  Is it the university, or the university's leaders?

Furthermore, as Mr Lamkin pointed out, the general counsel would appear to have a conflict of interest.  It may be he has an interest in defending his own actions, as well as those of his client(s), whether they are the university, its leaders, or both. 

In addition to Mr. Rotenberg’s role as the University’s top defender and advocate, there is another reason he cannot impartially consider requests for an investigation: the General Counsel’s Office is an important player in some of the disturbing events at issue.  As noted above, Rotenberg himself has been accused of attempting to intimidate and silence the bioethicist who has most doggedly sought an investigation.  The University’s lawyers are also responsible for the disgraceful silencing of Markingson’s mother, Mary Weiss.  After avoiding liability by arguing the University was immune from suit, these lawyers then threatened to force Weiss – whose son had died in a University doctor’s 'care – to pay the University’s legal costs of some $57,000.  The University used that threat as leverage to get Weiss to forgo an appeal of the trial court’s decision.

So as the University continues to refuse any new consideration of this this seemingly never-ending case, Dr Elliott has posted an online petition calling for an outside investigation.   We will see how Mr Rotenberg reacts to this.

Summary


A very troubling aspect of this case is that it has shown that the university leadership has seemed to care, at best, more about fending off litigation than upholding the university's mission.  The mission of the university is supposed to be discovering and disseminating the truth in a spirit of free inquiry.  Added to the mission of medical schools and university teaching hospitals is taking good care of patients, and putting the patients' interests ahead of all other concerns.  Yet, in this case, university leaders have not seemed to care whether in their haste to push back legal liability they were stepping on their faculty's academic freedom and free speech, the integrity of the medical research done at the university, and most importantly the rights of their patients and research subjects.  Furthermore, it is not clear whether they mainly feared the impact of litigation on the university, or how litigation might actually end up holding them accountable.

As Dr Judy Stone wrote in her Scientific American blog,

  it appears that UMN believes, as do many other institutions, that protecting itself from scandal and its consequences comes first and foremost and that, like the big banks, that it is too big to be punished.

Again, note that UMN cannot itself believe or protect.  People acting ostensibly on its behalf may have been protecting themselves from scandal, and believing that the size and status of their institution gave them, the leaders, impunity.

The case of Mr Dan Markingson is a continuing reminder that to reform health care, health care organizations need to be lead by people who put the health care mission first and are willing to be accountable for that mission.   I hope that eventually there is an honest investigation of this case, and a commitment to reform based on its conclusions.

See additional thoughts from Dr Howard Brody on the Hooked: Ethics, Medicine and Pharma blog, on the 1BoringOldMan blog, on the Periodic Table blog, and last but certainly not least, many comments by Dr Carl Elliott on the Fear and Loathing in Bioethics blog. 

JAMA: "Improving the Electronic Health Record—Are Clinicians Getting What They Wished For?" - No, But Utopia Arrives Soon

At a new JAMA piece "Improving the Electronic Health Record—Are Clinicians Getting What They Wished For?", former Columbia U. and now NIH medical informaticist James J. Cimino, MD points out issues with the documentation that results from health IT systems.

A preview of the first page of this short Viewpoint piece is available free at this link.  It includes the observation that:

... There is no question that computerization has made patients’ records more available and legible. With respect to completeness, however, there are now complaints that the record is too complete: electronic notes are deemed by many clinicians as being full of extraneous details and obscuring important aspects of a patient’s condition

Dr. Cimino goes on to state that:

Empirical observational studies of clinicians have shown ways to improve EHR functionality ... Similar research on clinical documentation processes is needed to advance this crucial EHR component.

These are excellent observations.

The issue I have with the piece is - and I am finding this true of many articles critical of today's health IT - the ending, which I'm finding to often be PR.  Or, perhaps it would be more accurate to call the endings of late a "salvage operation-style" attempt to save face for the informatics community, who let this domain be overrun by the corporate IT sector and terrible products that violate many of the precepts of design of good health IT learned during five decades of research.

Cimino concludes an otherwise constructive piece with this statement:

... Rather than complain about the challenges [a euphemism if ever I saw one - ed.] they have introduced, clinicians should recognize that current EHRs are illuminating the opportunities for the next generation of systems that will support clinicians as active partners across the spectrum of health care settings and tasks. The resulting improvements in documentation will, in turn, support patients, administrators, and researchers as we move towards a true learning health system.

I note this assertion is at complete odds with the dictum I was taught from my earliest medical mentors, and that no amount of wishful thinking will banish:

"Critical thinking always, or your patient's dead." (Cardiothoracic surgery pioneer Victor P. Satinsly, M.D., Hahnemann Medical College, Philadelphia, early 1970s.)

Translating the statement into plainer English, it seems to me that Cimino is saying this:

"Doctors, shut up, stop complaining about the chaos and patient/professional risk today's bad health IT is causing, take the medicine your betters have prescribed for you, and don't be uncompromising patient advocates as patients are secondary in this quest to reach IT-based Healthcare Utopia - which we will reach come version 2.0."

(This comes, ironically, at a time when physicians are starting to get a voice, e.g., Twitter's #EHRbacklash.)

It appears articles with even a faint tinge of anti-health IT sentiment - in addition to the traditional methods, results, limitations etc. sections - have an "appeasement" section as well.  Perhaps this it what it takes to get past peer review and/or industry ire.

In my view, this salvage mentality sprinkled with euphemisms and Utopian rhetoric spoils an otherwise constructive piece.  This type of language and utopian predictions about HIT have also appeared in other major medical publications by informatics and healthcare leaders (including top governmental office holders), as for example here.

Now, I know Jim Cimino and he is a good scientist.  However, I truly wish the non-scientific, "wait for version 2.0", utopian P.R. would stop.  As a member of the Medical Informatics profession myself, it's actually become embarrassing.

-- SS

But don't worry, your EHR information is secure

My last reminder of this issue was almost a half-year ago, but I think a repeat is in order.

More bugs squashed:

Microsoft fixes critical Windows, IE flaws for Patch Tuesday

Microsoft has released four critical security updates for Windows and Internet Explorer, along with a bevy of other products, in order to protect against at least 19 vulnerabilities identified in its software.

On deck this month, there are four "critical" vulnerabilities that affect Windows, Internet Explorer, Office, and Windows Server, including one for Silverlight that affects both Windows and Mac machines.

The most severe Internet Explorer flaw affected all versions of Windows XP (Service Pack 3) and above, including Vista, Windows 7, and Windows 8 — including tablets running Windows RT — running Internet Explorer 6 and above. The flaw could have allowed a hacker to access the vulnerable system with the same user rights.

... The other vulnerabilities rated as "important" could allow data and information disclosure, or an elevation of privileges on affected machines. These affect SharePoint, OneNote, Outlook for Mac, and kernel-mode drivers in Windows-based machines.

I note that Windows XP is now more than a decade old, but Windows RT is brand-spanking new.

In a Nov. 2012 post somewhat vexatiously entitled "Why It's Crazy to Want Your Most Confidential Information Put into An Electronic Medical Records System" about Windows 8 flaws, I had indicated how common Microsoft products were in hospital IT.

I stand by that vexatious title.

But don't worry, your confidential medical information is secure, and your safety against malfunctioning IT that loses your critical medical information after hackers invade is assured, in our current rushed national health IT rollout.

What is the answer?  Until this technology has significantly been secured and debugged, this old triad applies:

  • If you want your information secure, don't put it on a computer.
  • If you must put it on a computer but still want some degree of security, don't put the computer on a network.
  • If you must put the computer on a network, especially a network connected to the Internet, your information is no longer secure. 
It's premature in my view to be building and operationalizing national health records networks.  Unless, that is, patient information privacy, security and confidentiality are secondary considerations.

(In my view, they are seen by the national IT builders and promoters as secondary considerations, but the builders and promoters will never admit it, perhaps even to themselves.)
    -- SS

    The Dangers of Big Corporate Health Care: Deceptive Marketing of Cancer Treatments

    A series of articles over the last few months, culminating in an investigative report by Reuters, provided the newest example of what can go wrong when corporations provide direct care to vulnerable patients.  In this case, the vulnerable patients had cancer, and the corporation that provided them care was the Cancer Treatment Centers of America (CTCA).  I will try to go through the case chronologically.

    As Rueters reported, CTCA "was founded in 1988 by Richard J. Stephenson, who has been chairman ever since."

    The Founder's Checkered Past

    A Misdemeanor

    As Reuters noted,

    A graduate of Northwestern University Law School, Stephenson started out as an investment banker. In 1966 he became a trustee of Americans Building Constitutionally, an organization that helped wealthy individuals set up not-for-profit corporations and personal trusts to avoid paying federal income and inheritance taxes.

    In 1969, a California state court found the group's top official and six others guilty of grand theft or conspiring to commit grand theft. Stephenson had pleaded no contest to false advertising, a misdemeanor, and testified for the state, according to media reports at the time.

    Allegations of Use of Unproven Cancer Treatments

    Stephenson seemingly stayed out of trouble until 1975, but

    Stephenson ventured into healthcare in 1975, when he and partners bought Zion-Benton Hospital in Zion, Illinois, renaming it American International Hospital. By the late 1980s, American International was facing financial problems and its 'reputation had been severely damaged' by local press reports about its use of unproven cancer treatments, according to a 2004 court opinion on a successful petition by a former CTCA president seeking an increased valuation for his share of the company.

    CTCA: No More Unsubstantiated Claims

    Apparently around the time American International Hospital starting having major troubles, Stephenson branched out,

    In 1988, Stephenson founded CTCA. He was motivated, said CEO Bonner, by the difficulty he had identifying and obtaining the best therapies for his mother after she developed bladder cancer. She died in 1982.

    By 1996, CTCA got into trouble too,

     
    Cancer Treatment Centers of America got in trouble with regulators in 1996, when the Federal Trade Commission accused it of, among other things, presenting survival claims it couldn't support. The company entered into a consent decree with the FTC and, without admitting any of the allegations, agreed not to make unsubstantiated outcomes claims.

    "Unscientific Therapies"

    As far as I can tell, all was then quiet until 2012.  Late that year, a Forbes columnist wrote,
     Alongside standard, science-based cancer therapies, CTCA also offers an array of questionable, unscientific therapies, which it proudly labels as part of its 'integrative cancer treatment.'  CTCA advertises many such treatments, including:
    * Acupuncture
    * Acupressure
    * Chiropractic
    * Naturopathy
    * Homeopathy
    * Mind-Body medicine (including Reiki and Qi Gong)

    None of the treatments in this list has any scientific support showing that they provide a benefit to cancer patients.  Some of them carry a real risk of harm, as I’ve written about previously.

    He further charged,

    CTCA makes multiple unsupported, unscientific claims for its alternative treatments, such as:
    These are just a few examples. These claims, and CTCA’s marketing of the therapies involved, present a huge ethical problem.

    Manipulated Survival Statistics

    Then, in March 2012, the Reuters investigative reporters charged that CTCA manipulated its survival statistics to make its results look better.

    CTCA reports on its website that the percentage of its patients who are alive after six months, a year, 18 months and longer regularly tops national figures. For instance, 60 percent of its non-small-cell lung cancer patients are alive at six months, CTCA says, compared to 38 percent nationally. And 64 percent of its prostate cancer patients are alive at three years, versus 38 percent nationally.

    Such claims are misleading, according to nine experts in cancer and medical statistics whom Reuters asked to review CTCA's survival numbers and its statistical methodology.

    The experts were unanimous that CTCA's patients are different from the patients the company compares them to, in a way that skews their survival data. It has relatively few elderly patients, even though cancer is a disease of the aged. It has almost none who are uninsured or covered by Medicaid - patients who tend to die sooner if they develop cancer and who are comparatively numerous in national statistics.

    Carolyn Holmes, a former CTCA oncology information specialist in Tulsa, Oklahoma, said she and others routinely tried to turn away people who 'were the wrong demographic' because they were less likely to have an insurance policy that CTCA preferred. Holmes said she would try to 'let those people down easy.'

    Equally significant, CTCA includes in its outcomes data only those patients 'who received treatment at CTCA for the duration of their illness' - patients who have the ability to travel to CTCA locations from the get-go, without seeking local treatment first. That means excluding, for example, those who have exhausted treatment options closer to home and arrive at a CTCA facility with advanced disease.

    Accepting only selected patients and calculating survival outcomes from only some of them 'is a huge bias and gives an enormous advantage to CTCA,' said biostatistician Donald Berry of MD Anderson Cancer Center in Houston.

    Furthermore,




    CTCA also appears to exclude the vast majority of its patients when it calculates survival data. In survival results from 2004 to 2008 posted on its website, CTCA reported 61 patients with advanced prostate cancer, 97 with advanced breast cancer, 434 with advanced lung cancer, and 165 with advanced colon or rectal cancer. These are the four most common solid tumors. In the same period, CTCA treated thousands of patients at its Zion facility alone, according to filings with state regulators.

    'We agree that some of our sample sizes' are small 'and have always stated this as a limitation of our study,' said Xiong, the consultant to CTCA.

    'I'd have some concerns about why and wonder if some cherry-picking was going on,' said Spectrum Health's Campbell.

    Moreover, while the standard reporting period for cancer survival is five years after diagnosis, CTCA on its website doesn't go that far; for the four most common tumors, it reports survival up to four years at most. And as Reuters found, the company's advantage often diminishes as the five-year mark approaches
     
    The Founder's Checkered Present

    By the way, also in the last few months, watchdog groups have asked for an investigation of CTCA's founder for possible deceptive actions that might have violated US election laws.  In December, 2012, the Washington Post reported

    In the weeks before the election, more than $12 million in donations was funneled through two Tennessee corporations to the FreedomWorks super PAC after negotiations with [CTCA Founder Richard J] Stephenson over a preelection gift of the same size, according to three current and former employees with knowledge of the arrangement.
    Then,

     Two watchdog groups last week asked the Federal Election Commission and the Justice Department to investigate the donations from the two Tennessee companies. The groups, Democracy 21 and the Campaign Legal Center, say the arrangement could violate federal laws that prohibit attempting to hide the true source of a political contribution by giving it under another name.


    Summary

    In summary, there are now charges in the media that Cancer Treatment Centers of America manipulated its survival data to makes its advertised results appear better, while it also advertises unproven complementary and alternative medicine treatments  as effective.  In the past the company had signed a consent decree not to make (presumably any more) unsubstantiated claims.  Meanwhile, the company's founder, who has a past history of a no contest plea to false advertising, and who had previously run a hospital system also charged with making unsupported survival claims, has been accused of hiding political donations.

    Thus this organization, run by someone who has his own history of deception, has been found to make exaggerated and/or unsubstantiated advertising claims of several types and at different times.  These claims could attract vulnerable patients who perhaps could get better care elsewhere, possibly leading to excess morbidity and even early mortality. 

    So Cancer Treatment Centers of America seems to be the latest reason to worry about the laissez faire US system which allows lightly regulated for-profit corporations to provide direct "care" to our most vulnerable patients.   We have recently discussed how a for-profit hospital chain may have been over treating some patients and under treating others, possibly risking patients' health to increase revenues (look here);  how for-profit hospice corporations by enrolling patients who do not actually have terminal illness for palliative care only  could be denying potentially curative treatment to curable patients (look here); and how for-profit mental health clinics and drug treatment centers could be providing shoddy, and potentially dangerous care to boost revenues (look here and here).

    We will see if the newest part of the pattern of news reports about CTCA and its founder, coupled with reports about other for-profit health care corporations that provide direct care to vulnerable patients provoke any official action.  However, the pattern is substantial enough so that it should make all health care professionals and all patients  reconsider whether ever to trust a for-profit hospital system, hospital, clinic or other site providing direct health care to patients.

    On a policy level, as I have said before,....   In my humble opinion, before the health care bubble bursts, we need to challenge the notion that direct health care should ever be provided, or that medicine ought to be practiced by for-profit corporations. Before market fundamentalism became so prominent, many states prohibited the corporate practice of medicine, and the American Medical Association forbade the commercialization of medicine.

     It is time to heed that wisdom. I submit that we will not be able to have good quality, accessible health care at an affordable price until we restore physicians as independent, ethical health care professionals, and until we restore small, independent, community responsible, non-profit hospitals as the locus for inpatient care.