Health Care Reform and Personal Privacy

GUEST: Janlori Goldman
AIR DATE: 04/03/10

I’m Richard Heffner, your host on The Open Mind. And it’s been only a few years since today’s guest first joined me here to discuss just how urgent it is that we Americans work exceedingly hard to reconcile our nation’s public health and personal privacy concerns.

I hadn’t thought much about the issue before then, certainly hadn’t talked much about it here on The Open Mind.

Yet the response I received at the time demonstrated full well that as far as many, many viewers were concerned, attorney Janlori Goldman was – and remains – very much on target in her work on the Faculty of the Mailman School of Public Health at Columbia University and as Senior Advisor to the Health Privacy Project which she created in 1997, devoted as it is and she is to ensuring that in America peoples’ privacy is always safeguarded in a healthcare environment.

Still, for all the talk of healthcare reform in America during the past months, there seems not to have been – or I for one just haven’t noted sufficiently – very much talk about or concern for this very issue of safeguarding individual’s privacy – yours and mine – in our healthcare system, reformed or not.

And I would ask my guest whether I’ve simply not paid enough attention…when, indeed, attention must be paid! Or has an abiding concern for privacy in health matters not played a sufficient role of late? Fair question Janlori?

GOLDMAN: Excellent question.

HEFFNER: And what’s the answer?

GOLDMAN: The answer is that privacy rippling below the surface and a lot has been done since President Obama took office and his new staff has come in. We’ve seen, in the stimulus package before we even started really talking about healthcare reform in a serious way, a number of improvements to the health privacy law that’s currently in effect.

A number of provisions that straighten, strengthen privacy laws, that increase penalties for violations, that put more money out for creating electronic record systems while at the same time coupling privacy and security with those systems. So that happened in the stimulus package back in the spring.

Now in healthcare reform, there’s less talk of privacy, more talk of coverage. But talking about anti-discrimination provisions to make sure that people aren’t hurt if their information is used against them, particularly in the genetics area.

So there, there’s a lot going on under the surface, but of course, you know, privacy is taking, to some extent, a backseat in the media because we’re all very concerned about expanding coverage.

HEFFNER: If it’s taking a backseat in the media, what happens when we’ve passed the bill or not passed the bill … when we’ve done something.

GOLDMAN: MmmHmm. Well, we … you know, we, we have done something. And the think the President is very committed to privacy. His new head of HHS was a big privacy advocate when she was the head of the Insurance Commission … Kathleen Sebelius. He’s got staff there who are very concerned as well so this is a committed group of people on the issue of health privacy.

Since he’s taken office, the Non-discrimination Act has passed related to genetics. That was a huge step that many Administrations …

HEFFNER: Explain it.

GOLDMAN: … had tried before. It basically says that employers cannot use your genetic testing information against you in making employment decisions. It’s a very simple law. It should have been in place a long time ago. The lack of a … an anti-discrimination law has probably kept people from getting genetic tests. Because people can be fired if …

HEFFNER: You … you had made the point, a similar point when you were last time …

GOLDMAN: MmmHmm.

HEFFNER: … that the lack of guarantees about privacy was keeping people from doing things they really should be doing …

GOLDMAN: Yeah. Yeah.

HEFFNER: … for their health.

GOLDMAN: Yeah. I think it’s one of the, the things about privacy that people don’t always realize. It’s not just about keeping secrets … and that I have things I want to hide.

If people are afraid that their information will be used against them, they don’t participate fully in their own healthcare. They keep something from their doctor or they avoid getting a test or they’ll pay out of pocket because they think then their insurer won’t know about it.

They might go to different doctors to try to keep different records. I mean the biggest risk, really, to people’s health is that they avoid care.

HEFFNER: Are you saying that penalties … are you saying this time … because last time when we talked about penalties your point was that they are not enforced.

GOLDMAN: MmmHmm.

HEFFNER: So what good does it do to …

GOLDMAN: It’s …

HEFFNER: … legislate penalties?

GOLDMAN: It’s an important point. I mean as, as the late Senator Kennedy said, “If you have a right without a remedy, it’s useless.” And so that’s a … it’s a critical point to remember.

The penalties have been increased and the, the new law, the expansion in the health privacy law says that HHS has got to be much more vigorous and much more aggressive in enforcing the health privacy law.

So they’ve given greater enforcement authority to the federal government, they’ve given the States Attorney Generals greater enforcement authority. So they can actually take action and not always rely on the federal government to step in. And so the hope is that we will start to see that these rules are more meaningful.

And, you know, the first time you have a major company, you know, have a penalty, and sometimes the penalties can be criminal penalties if there’s really kind of malicious or willful misuse of information … then I think it, it sends a message.

We haven’t seen that yet. But we know there are abuses. Every day you hear about them. You hear about information being misused. Or somebody was careless and information was shared. Or a well known person is treated at a hospital and everybody wants to hack into the records. I mean this is a very common and unfortunate problem. It makes people anxious. And the last thing you want … when people go to the doctor or go to get testing is be anxious about how the information is going to be used and who’s going to see it.

HEFFNER: You know I wasn’t cynical or disbelieving …

GOLDMAN: (Laughter)

HEFFNER: … when we did our last program …

GOLDMAN: MmmHmm.

HEFFNER: … but I sure as Hell asked you a lot of very, very pointed questions. And it wasn’t until I saw the program …

GOLDMAN: MmmHmm.

HEFFNER: … when it was on the air …

GOLDMAN: MmmHmm.

HEFFNER: … that I realized how important the things that you were saying were. And early this morning I went back to the transcript of our program … I still have some question …

GOLDMAN: MmmHmm.

HEFFNER: … about whether you have points, cases, incidents …

GOLDMAN: MmmHmm

HEFFNER: … that you can really point to in sufficient number to indicate that the threat is as great as you said then and as you obviously feel now.

GOLDMAN: I mean sadly there’s no lack of evidence that privacy is at risk. I wish I could say to you that this is just a value that I have and I think it’s important to build it into law.

But there’s quite a bit of empirical data. We not only have the stories that you read in the paper of, you know, people’s privacy being violated on an individual basis, but we know that because information is now held electronically, the magnitude of harm is so much greater.

HEFFNER: You say “held electronically” …

GOLDMAN: MmmHmm.

HEFFNER: Why does that make the magnitude of the problem greater?

GOLDMAN: Well, if I were interested in your medical records, for some reason, and I wanted to snoop around … let’s say you were somebody who was employed at a big company and they wanted to keep down their health care costs and they wanted to see who might be using a lot of healthcare.

You could open a file drawer and you’d look up, you know, Richard Heffner, and you’d look for your folder and you’d pull it out and you’d take a look.

That’s a lot of work. It’s a lot of work to look case by case. If the information is electronic and its in a database you could search by condition. You could say “Who has seen a doctor more than five times a month? Who has been diagnosed with cancer? Who might have HIV? Who’s had a genetic test that shows a pre-disposition for a certain condition and an expensive condition?”

And you could query that database and say, “Wow, these are my most expensive employees.”

HEFFNER: Were you …

GOLDMAN: This is what’s possible.

HEFFNER: Were you in favor of the electronic database being expanded and expanded still further and further which was one of the great contributions of the Obama Administration thus far?

GOLDMAN: It was. They’ve put in $19 billion dollars to create …

HEFFNER: I couldn’t …

GOLDMAN: … electronic records systems.

HEFFNER: … I couldn’t believe the figure when I saw it.

GOLDMAN: Well, I, I …

HEFFNER: That’s not in the future, that’s now.

GOLDMAN: That’s now. And that’s been something that’s been coming for a long time. And I will tell you as, as much of a civil libertarian as I am, while the risk to privacy is so much greater when you’re talking about electronic records … the, the capacity to improve your health and to give people greater care is so much greater if you have electronic records.

And so, to know that you could have tremendous benefit in the healthcare system, not just improving healthcare and giving people greater control of their information and stopping kind of, you know, duplicate tests. I mean how many times do you go to the doctor and they say “Ow, we lost that test.” Or, you know, “That didn’t come over from the doctor yet, you have to go do it again.” Or, you know, we don’t have access to those records”. This would eliminate that, essentially. So to know that the benefit is so great, we have a duty as a society to make sure that we protect the privacy of that information, that we build the system so that it doesn’t put people at greater risk. And, if there’s a mistake, if there’s an accident or someone is malicious, they should be punished.

So, we don’t want to stop progress just because there are risks. If we can address those risks, we should do it. And we can do it. So I do support creating electronic record systems. I think that the inefficiencies in the system and the harm that occurs because of that is really irresponsible.

HEFFNER: Because we haven’t yet seen them, have we? We haven’t had one … well, the Veterans Administration …

GOLDMAN: Right.

HEFFNER: And how many millions of records were …

GOLDMAN: Right.

HEFFNER: … accidentally …

GOLDMAN: Accidentally. Well, somebody was careless. And if you’re careless like that there should be punishment. I mean, honestly, this, this was … you know … lots and lots of people’s information. Now supposedly nothing horrible happened. You know the information was returned, nothing horrible happened. But we see … even with the good guys … even with, you know, health insurers and hospitals who think of themselves as acting in the patient’s best interest … careless things can happen.

Or somebody within the company can be too curious and they can hack into information or they want to sell the information. Medical information is quite valuable. And sometimes there’s financial data embedded in people’s medical records … their credit card numbers and so there’s … it’s considered quite valuable and you often see thefts within hospitals or medical centers.

HEFFNER: What’s the doctor’s attitude toward this?

GOLDMAN: Well, it depends on the doctor’s (laughter) age.

HEFFNER: What?

GOLDMAN: (Laughter)

HEFFNER: Say it again.

GOLDMAN: It depends on the doctor’s age.

HEFFNER: We young doctors are …

GOLDMAN: The young doctors are more embracing of the technology. They grew up with it, they like to use it, they see how handy it is. You know you can have a personal assistant … you know little computer right in your hand and you can check on Janlori Goldman’s medical information across the world.

This is a handy item. And you can update information, you can check on medication history. The older doctors are a little bit more resistant. They have to learn something new. It’s not that they don’t see the value in it.

And the second issue and why the Obama Administration has put $19 billion dollars into helping doctors, essentially, to create electronic medical records … it’s expensive.

You have to go from having those files drawers filled with paper records. And build something new. And it costs a lot of money.

HEFFNER: MmmHmm.

GOLDMAN: And so a lot of doctors have been resistant or are incapable … especially smaller practices …

HEFFNER: Has money been provided to help doctors in the expenses involved in going electronic?

GOLDMAN: Yeah … there’s, there’s money that goes to … that, that, that would be available for doctors and there’s tax credit. There are incentives that have been built into the stimulus bill to say, “If you do this, you will be rewarded, or we’ll make it a little bit less (laugh) harsh for you.”

So it’s not just about having the big medical centers. I mean I work at Columbia and all of the health information there is electronic … all of it.

So if I go see a doctor and I have a test done, my doctor gets the test electronically and can look at it. It doesn’t have to be walked around and it really makes an enormous difference in having the care kind of more coordinated and better handled.

HEFFNER: Janlori, a personal question then … how do you feel … you … well, not how do you feel …

GOLDMAN: (Laughter)

HEFFNER: … that’s too simple. Do you feel any anxiety knowing how focused your records, how available they are in one spot?

GOLDMAN: I do. I mean I know too much. And so, I’m, I’m not necessarily a fair bell-weather of the public although … because I know too much. I know how at risk my information is.

I will give you a, a little story. I did Grand Rounds at the Medical School a few years ago and I talked about privacy. Grand Rounds is where you basically speak to the doctors and they come in and they come in in their white coats and they’re very serious …

HEFFNER: Did you wear a white coat?

GOLDMAN: I did not. (Laughter)

HEFFNER: Why?

GOLDMAN: I’m not entitled to wear the white coat. And I asked them, “Have you ever, at Columbia, you know you’re at a premier medical institution … this is where you can get your care from all of your colleagues … have you ever avoided care at your institution because you didn’t want the information to be available to your colleagues? That you were worried about how the information might be used, did you ever go outside of the Columbia network, specifically to protect your confidentiality?” Just let me see a quick show of hands.

HEFFNER: Everybody?

GOLDMAN: Pretty much. Yeah. I mean “Did you ever?”, so there are moments when you say to yourself “I don’t really want to be wheeled on a gurney here in my own institution, or I don’t want to go see a psychiatrist in my own institution and maybe run into her in the hall. Or there maybe some other sensitive tests or procedures that you don’t want done. People are nervous.

HEFFNER: It’s funny how you can see both sides …

GOLDMAN: MmmHmm.

HEFFNER: … of this equation …

GOLDMAN: MmmHmm.

HEFFNER: And yet be such a warrior …

GOLDMAN: (Laugh)

HEFFNER: … on one side … be such a battler …

GOLDMAN: Yeah.

HEFFNER: You think you’ll come a’ cropper for that?

GOLDMAN: Well, you know, it’s … when I first started on this which might have been 20 years ago … I was more of a Luddite … remember the Luddites of the 19th century in England?

HEFFNER: You’re looking at one.

GOLDMAN: I’m looking at one! (Laughter) And people called me a Luddite because basically they thought that I wanted to smash the computer state. That I was against computers because they were inherently evil and that they … that their mere presence would essentially erode the very fabric of society.

And they weren’t terribly far off. But I have to say that since I was in my late twenties I have come to see that, in many ways, an electronic environment is in and of itself not evil, it’s who’s using it. It’s how the technology is used; it’s how we as a society protect ourselves and protect each other. What duty do we owe?

And so when I see, for instance, pharmaceutical companies or insurance companies saying, “Oh, that’s valuable data, we want to use that. We want to market to people or we want to use their information so that we can tell employers who not … you know, who, who are the greatest kind of high risk hires.”

That makes me angry and so I say, “You’re misusing the technology and you shouldn’t be allowed to do that. And in some ways the burden on individuals for protecting privacy has become so high. You know all those forms that you sign now, not just in healthcare, but you’re constantly being asked to sign forms agreeing to have your information used.

And I think that is a terribly unfair and unrealistic way to protect privacy.

HEFFNER: What do you mean?

GOLDMAN: Well, we’ve so …

HEFFNER: Well, you’d think … you know, my saying to you in the last program that we did, “When I get those forms I ‘don’t read them, I just put them aside.”

GOLDMAN: Right. If you’re not reading them …

HEFFNER: Yeah.

GOLDMAN: And I’m not reading them and my friends aren’t reading them, then what it tells us is we have to build privacy in to the fabric of our healthcare system and not put all the burden on individuals of saying “I’ll read this carefully; I’ll know all the risks; I’ll know where my information is going, I’ll make choices about how information is used.”

I’m trying to go to the doctor. I’m looking to have, you know, a test done; I’m about to have an operation, I am not in the best position to be making very detailed and thoughtful, you know, considerations about how my information might be used in the future.

So we have to build limits in to how information is used; who gets to see it and not put all that burden on people.

HEFFNER: You’re a lawyer, an experienced lawyer … what are the examples that you can offer of machinery of this kind …

GOLDMAN: MmmHmm.

HEFFNER: … being made available. And not being used for the very purposes that you’re concerned about. Not being mis-used in your terms.

GOLDMAN: MmmHmm. You mean what are some of the horror stories of …

HEFFNER: No. I mean just the opposite.

GOLDMAN: Ahh …

HEFFNER: I mean … what are the examples of the potential …

GOLDMAN: Oh …

HEFFNER: … for misuse …

GOLDMAN: Oh. Oh.

HEFFNER: … and regulation estopping it. Because I’m afraid of the effectiveness. Remember the last …

GOLDMAN: Yes.

HEFFNER: … time you were here …

GOLDMAN: Yes.

HEFFNER: … and we were talking about penalties …

GOLDMAN: MmmHmm.

HEFFNER: …and you said of course the penalties have not been applied.

GOLDMAN: Okay. So let me give you …

HEFFNER: So why are they going to be now?

GOLDMAN: … I’ll give an example of … and I’ll probably get in trouble for this …

HEFFNER: Okay.

GOLDMAN: … so that makes it interesting. Right.

HEFFNER: Go ahead.

GOLDMAN: (laughter) … at my own institution when former President Bill Clinton had heart surgery he, of course, was admitted under a pseudonym … somebody figured out the pseudonym … and everybody wanted to look at his medical records. I mean we are a curious species. We don’t want to stop curiosity, we just want to be protected against ourselves.

And so people go into the system … a number of people were able to look at his records … we know that, not because the information was necessarily sold or misused. But there are audit trails, that the technology allows. So you could … you couldn’t tell because someone had looked in the paper record … that would have been hard, if not impossible to tell … but you could tell because of the electronic system … basically recorded, somebody got in here who shouldn’t have been in here. And those people lost their jobs.

Now, did HHS come in at the time when, you know, when George Bush was President … did HHS come in and say, “There will be penalties applied here?”. They did not.

But the institution took action because they … one, they know it’s wrong and two, there’s the threat of penalties. We would hope that under a more vigorous system where there’s a requirement now that where there is abuse, penalties must be applied, there is no discretion anymore. And that was a huge advance in the law, in the new stimulus package. Basically saying, “If there’s willfulness use of information, HHS must penalize the institution.”

HEFFNER: Can’t you just hear the hew and cry …

GOLDMAN: (Laughter)

HEFFNER: … when a Democratic administration … when big government penalizes people for such simple acts?

GOLDMAN: No. I mean if I hear it, I turn the other ear because if you do the wrong thing, in our society, there’s some penalty, there’s some consequence. I mean every parent knows that. It’s not the worst penalty in the world. You’re not shut down, your business isn’t shut down, but what people understand in this country usually is a monetary penalty. People don’t want to be fined. We’re not talking about putting the heads of institutions in jail. But it is a deterrent and it does work and it does make people take privacy more seriously.

HEFFNER: How do you know this? How do you know it works?

GOLDMAN: How do I know it works?

HEFFNER: Yes. It hasn’t happened yet, has it?

GOLDMAN: It hasn’t …

HEFFNER: Well, it happened in the incidence of Bill Clinton, you said people were fired.

GOLDMAN: Well, but … I know a number of institutions have had breaches of medical privacy and they have either fired employees who acted wrongly or they have taken action.

What we haven’t seen is the Federal government taking a leadership role and enforcing the law. That has not happened yet. But the, the pieces are in place for it to happen. So you can have me back in a few years (laugh) and we can see how we’re doing.

HEFFNER: Once the hew and cry begins about big government.

GOLDMAN: Right. We’ll see how we’re doing.

HEFFNER: Right.

GOLDMAN: Well, there … but your point is an important one. The healthcare industry as a whole and there are, of course, exceptions to this, are resistant to regulation. It took ten to 15 years to get the first medical privacy regulation in place. I mean everybody agreed it was an important issue, we had documented data that people were afraid to seek care, that they were lying to their doctors because they were afraid of their privacy. We had documented cases of people being discriminated against, losing jobs, being, you know, ostracized by family and community … not getting insurance. We had plenty of evidence. We had hearing records … you know I have a big stack of them in my office. That wasn’t the problem.

The industry is absolutely resistant to being regulated. They don’t want to be regulated. And so that’s been a problem. We see this in the financial industry. Most industry does not welcome regulation.

HEFFNER: And you think there’s going to be a change of temper?

GOLDMAN: No. But I think you just have to do. You just have to do it. I mean I don’t always want to drive 55 miles an hour, but you just … you sometimes have to say, as a society, here are our values, here are our morals, here’s what we think is important and we are going to require that you live by these rules, in order for us to have as vibrant and fair a society as possible.

HEFFNER: And that the machinery won’t be misused.

GOLDMAN: Right. Now let’s be realistic. Okay.

HEFFNER: That’s what I’m asking you to be.

GOLDMAN: Yeah, let’s be realistic. It doesn’t matter what the law is. It doesn’t matter … I mean it does matter … but even if you have a strong law. Even if you have people of good will. Even if you put in every protection … there’s going to be a … there’s going to be a problem. There will be … you can’t 100% protect against bad things.

I wish we could. But something will happen. It could be an accident. Maybe there’ll be some problem and, and they’ll be a breach by accident. Maybe someone will be way more clever than the law and the security and they’ll break into a, a … you know, a system. That can happen.

HEFFNER: Well, isn’t that the largest concern? We read now about … and President Obama indicated that we have been in real danger …

GOLDMAN: MmmHmm.

HEFFNER: … many nations have and many huge corporations …

GOLDMAN: Yeah.

HEFFNER: … because of tampering with the electronic world.

GOLDMAN: It’s true. I mean we do live with risk. And so what I’m trying to do is to say “How do we, how do we try to address the kinds of risks we can? What’s the best thing that we can do? What’s the way we can give people as much confidence as possible?”

You walk down the street, you know, in New York (laugh) you live with some risk. But you try to do the best you can to protect people. And I think that’s what we’re trying to do. Is to not just throw our hands up and say, “It’s too big a problem. It’s impossible. The industry’s resisting it. We can’t … you know … what can we do? We’ll do the best we can do.

HEFFNER: You … you think there’ll be a great enough public health advantage stemming from the extension of electronics to health to make up for whatever mishaps …

GOLDMAN: Absolutely.

HEFFNER: …occur.

GOLDMAN: Absolutely. I mean anyone, anyone who has had either a chronic illness or an acute illness, or who has been a caregiver … I was a caregiver for an elderly relative of mine … I can tell you, having paper records is a disaster. It’s a disaster.

The information is lost. It sometimes is inaccurate. Different doctors don’t have access to the records that they need when they need them. It’s … people are in charge of carrying their medical histories with them wherever they go. It’s, it’s, it’s just not a good way to provide medical care. And when you’ve seen it up close and you see how hard it is and how it doesn’t work … my vision has been to say, “How can we allow for the progress and allow people to get better health care, but not put them at risk of having their privacy violated and put them at risk for discrimination?”

I think both things are possible. That’s what … I think that’s what we should be focused on … how do we make both things happen? It’s not a trade-off. You know, unfortunately, what you often hear from medical researchers or from people in the healthcare industry is “privacy gets in the way of progress”. That’s been a line we’ve heard for 20 years. Privacy gets in the way. And I think that that’s wrong. I think privacy is the enabler.

Privacy allows people to more fully participate in their own healthcare and to trust people, to trust public health, to trust doctors. If they know that they’re coming into a relationship with someone who’s going to protect their dignity, essentially.

HEFFNER: So you’re not just an advance person …

GOLDMAN: (Laughter)

HEFFNER: … for the end of privacy.

GOLDMAN: No. I hope not. I hope it doesn’t come across that way.

HEFFNER: Are we going to find great public health benefits coming from this?

GOLDMAN: I hope we will. I hope we will. I think that we know more than we’ve ever known, and I think to be able to collect information and to look at groups of people and to say “Who else has this particular kind of tumor? Who else, you know, is, is susceptible to developing asthma in certain neighborhoods?”

We can know more and we can develop better treatments. We can develop better ways of responding to illness and disease, even with all the concern that we’ve had lately about the flu. I mean just the seasonal flu and H1N1. We have to be able to respond quickly in the event that we have any kind of an epidemic.

HEFFNER: We haven’t done so well, have we?

GOLDMAN: We’ve done terribly. We’ve done terribly. And it’s certainly not the fault of electronic information systems. But that would be one thing, if we had kind of good … if we were well organized and we had our messages clear and we had enough supply … you know, if all the other pieces were in place … certainly electronic records would be helpful.

HEFFNER: Janlori Goldman, we’ve come to the end of our program with my feeling a heck of a lot better … thanks to what you say, but not thoroughly …

GOLDMAN: (Laughter)

HEFFNER: … completely convinced. But maybe by the time you come back next it will be. Thank you for coming … joining me again today.

GOLDMAN: Thanks for having me, it was fun.

HEFFNER: And thanks, too, to you in the audience. I hope you join us again next time. Meanwhile, as an old friend used to say, “Good night and good luck.”

N.B. Every effort has been made to ensure the accuracy of this transcript. It may not, however, be a verbatim copy of the program.