Health Care Data Protection

Issue

How do we protect medical records and patient confidentiality without jeopardizing access to critical research, public health and consumer information needs?

Policy

In 1996, the federal Health Insurance Portability and Accountability Act established strict health care privacy laws for all 50 states. Minnesota law already exceeds the federal standards in certain ways. Minnesota law requires that when information is released in electronic format, all patient identifiers be encrypted to ensure patient confidentiality. Since 1997, health care providers that want to release medical record information for research without asking the patient’s permission first, must do the following: first, notify, in writing, all patients seeking medical care that medical records may be released for research and that the patient may object; second, obtain the patient’s authorization for the release of records for research, which does not expire, but may be revoked; and third, upon request, inform patients whose records were released and tell them how they can contact the investigators. Also, under state law, health plan companies are prohibited from selling patient data.

Recently, proposals have been offered that limit access to de-identified medical and prescriber information by health researchers, payers and providers. It is critical that patient confidentiality be maintained and appropriate safeguards be in place to prevent the ability to directly identify a patient. However, overly restrictive proposals may jeopardize the quality of patient care, the choices patients have in the market and the effectiveness of our health care system.

Health care information and databases are useful tools for purchasers, health plans and providers in improving health, evaluating quality and outcomes, and containing costs. Records-based research is vital to provide appropriate, quality, cost-effective health care.

• Support Minnesota’s current “opt-out” policy for medical records for research. Access to this data is critical for medical research innovation to continue in the state. Advancements in medical record security ensure that safeguards are in place to protect inappropriate breaches of confidentiality.

• Protect medical records and patient confidentiality without jeopardizing access to critical research, public health, effective coordination of care and consumer information needs.

Business Impact

Employers are seeking to engage consumers in making sound economic and responsible choices about their health care. Essential to connecting consumers to the choices they make in health care is providing access to the information that will allow them to make responsible and informed choices. This cannot happen if information about performance outcomes, cost-effectiveness and the quality of care is not available.

This information is used to study patterns of the course of diseases and for comparing outcomes of various treatments. Results from these studies are vital to fostering continued quality improvements in health care for future generations. More and more, information is used to measure performance outcomes of doctors, clinics and hospitals to provide consumers with information about best practices and quality of care.

The use of an “opt-in” approach requires patients to provide consent each time a medical record is used for research. Optional patient participation makes statewide assessments and other research data statistically unsound. Without sufficient numbers of people participating in these studies, most of the research will become statistically invalid. A study by the Rochester Mayo Clinic also found statistically significant differences in who consents to providing information, with respect to age and disease category. This severely limits research capabilities for populations most in need. Access to medical information is necessary to protect the health of all Minnesotans and provide them with information necessary to make informed health care choices.