Management of Medical Information

Privacy and Confidentiality

HCP-Patient Relationship and Full Disclosure of Information

As Johnna Fisher stresses in her introduction to the readings for this week, privacy and confidentiality are unquestionably at the heart of cultivating a trusting HCP-patient relationship. Even for someone who is not particularly private or shy, disclosing information or exposing one’s body for examination can, for many, be a very difficult and stressful moment. Knowing that one’s physician is committed to privacy and confidentiality makes it much more comfortable for a patient to disclose the full range of information that the HCP needs to make an accurate diagnosis and recommendation.

As mentioned in the previous lessons, modern medicine is moving from the old paternalistic tradition to one that respects patient’s autonomy. We now see the HCP as someone with professional skills and judgment but also a duty to make full disclosure to the patient. A medical professional on this model may not lie or withhold information from a competent patient. As the last lesson mentions, this is essential for a patient making an informed decision about the risks and benefits of proposed treatments.

Truth Telling and Temporary Soft Paternalism

“Telling the Truth to Patients: A Clinical Exploration” by David C. Thomasma

David C. Thomasma presents a case for a temporary or soft paternalism. He argues that on deontological, utilitarian, and virtuous grounds, the prima facie duty must indeed be a default of telling the truth. Nevertheless, when the receiver of the truth is not in a state to “act rationally and autonomously,” then others must act to “protect us from harm” — at least until we are able to regain an ability to cope with the truth.

He suggests that truth is actually only a secondary value, and the primary value in any relationship is…

1. Survival of the community

2. Well-being of the individual

As such, veracity can be suspended temporarily in favour of other values

Thomasma explores several different types of situations that occur in medicine and that suggest certain times and considerations that justifiably place truth in suspension. These cases are as heart-wrenching as they are perplexing, and the study of biomedical ethics must work through them very carefully to balance prima facie duties. Thomasma emphasizes…

• Context

• Secondary nature of value of truth

• Truth is essential at some point to reach a cure

• Withholding truth is only a temporary solution

Unless there are significant considerations against telling the truth, the default should be in favour of truth.

Management of Health Data

How Should Health Data be Used?

Now, let us turn to the last reading of this lesson on the discussion on the managing of health data. Widespread use of electronic patient record systems enables opportunities to improve healthcare through data sharing, secondary use, and big data analytics. Multiple healthcare professionals, payers, researchers, and commercial enterprises can access data, they can do so at reduced costs by eliminating duplication of services and conducting research on effective care.

However, widespread use of electronic patient records systems also creates more opportunities for privacy violations, data breaches, and inappropriate uses.

Two court cases about selling prescription data, the Sorrell case in the U.S. and the Source case in the U.K., raise questions of what constitutes “privacy” and “public interest” and how to balance them. Bonnie Kaplan uses these two cases to present an ethical analysis of data privacy, commodifying data for sale and ownership, combining public and private data, data for research, transparency, and consent.

Kaplan Electronic Data and De-identification

Sensitive Information (Context-Dependent)

Health information is given special protection internationally, though specific ways of achieving it differ. Lifestyle choices, reproductive abilities, and stigmatizing conditions are considered highly sensitive.

But what is included in these categories differs with cultural background, from place to place, and from time to time. What is considered very private, embarrassing, stigmatizing, or grounds for discrimination varies among individuals and groups. Countries, likewise, vary in what personal information is treated as needing restricted collection, use, and disclosure. They also balance privacy and other considerations differently; thus, privacy protection is more lax in some places than in others.

Ways Data Could Be Used

• Provider or patient information is valuable

  • Providers could identify populations for treatment

  • Researchers could conduct studies involving healthcare and public health practices

  • Government agencies could identify and influence health trends

Clearly, provider or patient information is valuable. Hospitals could purchase data about competitors, providers could identify populations for treatment, researchers could conduct studies involving healthcare and public health practices, and government agencies could identify and influence health trends. If such sales were restricted, some fear, the data would not be collected or maintained at all, which could compromise research and new drug development.

De-Identification

Can de-identification protect privacy?

• Assumption 1: We can always identify the kinds of data that lead to privacy risks

• Assumption 2: We can always prevent harms

Both assumptions are not warranted. There is a further consideration. Privacy harms can be done to individuals who are not identified. Consider the situation where individuals object to uses of their personal data in certain ways — if their data were used in ways against their will, their rights are violated.

Harm to their privacy is done regardless of being identified or not. It is worth noting that neither HIPAA (U.S. Health Insurance Portability and Accountability Act) nor the EU Data Protection Directive applies after data are deidentified, meaning that neither HIPPA nor EU Data Protection Directive protects health data after de-identification.

Public Interest

Lastly, even though public interest should be considered, it is not always clearly understood, even though HIPAA permits secondary uses of data for…

• Research

• Public health

• Law enforcement

• Judicial proceedings

• Other “public interest and benefit activities,” without individual authorization

  • “Public interest: is not clearly defined

Kaplan Sorrell and Source Court Cases

The 2011 U.S. Supreme Court case Sorrell v. IMS Health Inc. et al. was decided on free speech grounds. Although the legalities involve unique features of U.S. constitutional law, a similar case in the U.K. in 2000, R v. Department of Health, Ex Parte Source Informatics Ltd., points to the international nature of the ethical issues. Both cases were ruled in favor of the selling of the data. That case was decided on the grounds that selling anonymized (de-identified) data did not violate pharmacists’ duty of confidentiality.

Confidentiality and Consent

Let us now turn to the important factors in our discussion. First, the HCP has a duty of confidentiality. Physicians and nurses have duties both to their individual patients and to the health of their communities; it is also important to maintain trust between HCP and patient.

We have talked about consent in the previous lesson. Here, we need a discussion of patient’s consent for their information being used. Consent and transparency go together; without transparency, consent is meaningless. The principles of data protection — transparency, legitimacy, and proportionality — embodied in the EU Data Protection Directive specify that the person from whom data are obtained should be informed of what will be done with this information and to whom it will be disclosed. This allows the individual to consent or object and to withdraw or correct the data.

Kaplan Big Data Sale

Another important factor to consider, which may be surprising to you, is the costs of data storing.

Secondary use and big data analytics are affected by:

• Costs of collecting

• Storing

• Organizing data

• Costs of meeting regulatory agreements

To reduce costs:

• Health data processing is outsourced from countries with stronger privacy protections to countries with weaker ones

  • This is despite its sensitive nature and consequent privacy risks

• U.S. marketing organizations oppose opt-in consenting on the grounds that it would increase the cost of doing business.

  • Though transborder data flow is regulated by international agreements (such as the EU Data Protection Directive), presumably, health data could be sold worldwide, to anyone, for any purpose.

Lastly, let us take a look at the ownership, commodification, and de-contextualization of health information. The right to sell data is muddied by lack of clarity over the legalities of data ownership.

Law in and outside the United States does not address health data ownership clearly; it is not clear who the owner should be, or whether ownership is better than current or alternative approaches.

It also is not clear where those who sell data analytics services obtain the data, or how they might use them.

If health data is seen as property:

• Presumably, whoever owns the data can sell them

• Some advocate clearly defined property rights in medical information, giving patients the right to monetize their access and control rights as a way for individuals to control and benefit from what happens to data about them.

• Commodifies the self

• Sullies ideas of personhood and dignity

To sum up, how should health data be used? Kaplan does not give us a clear answer, nor could anyone provide a ready answer. However, the article provides us a survey of the important factors and theories to consider.

Wrap-Up

In this lesson, we have talked about:

• Issues in the management of medical information

• HCPs’ duty of…

  • Confidentiality

  • Disclosing information to patients

• Moral complexity of truth telling

• Concern over privacy and right violation of mining and secondary use of health information

• Special nature of health information

• Patients’ rights

• Benefits and harms involved