P1

Notes

1. United Nations, Universal Declaration of Human Rights, Article 12. Available at: http://www.un.org/en/documents/udhr/index.shtml.
2. The EU Directives mentioned above similarly treat medical violations of privacy as particularly egregious cases.
3. These and more survey results can be found at: http://www.epic.org/privacy/survey/.
4. While much of this discussion refers to broad federal approaches to privacy, it is essential to recognize that privacy protections in the United States have been far more localized and sector-specific. Indeed, the states, not the federal government, have generally led the way in protecting privacy.
5. The US National Information Infrastructure Task Force defines the term as: “Information privacy is an individual's claim to control the terms under which personal information—information identifiable to an individual—is acquired, disclosed, and used.” (Formerly available at http://www.disastercenter.com/Html/PrivacWG.htm; http://www.datenschutz-berlin.de/gesetze/
   internat/een.htm)
6. A copy of the report was formerly available at: http://www.healthprivacy.org/usr_doc/33807.pdf.
7. http://epic.org/privacy/ppsc1977report/.

8. Formerly available at: http://www.connectingforhealth.org/.

9. Formerly available at: http://www.accenture.com/xd/xd.asp?it= enweb&xd=_dyn\dynamicpressrelease_857.xml.

10. Formerly available at: http://energycommerce.house.gov/107/hearings/
    05082001Hearing209/Westin309.htm.

11. The illicit use of data is not particular to the networked environment. What has changed is the scope of potential violations: As the network expands and as the amount of data increases, so does the possibility of confidentiality violations. In addition, a networked environment facilitates the illicit acquisition (e.g., through theft) and dissemination of data. This is in large part due to digitalization of information, which is easier to store, and to steal without its original owner even noticing.

12. Formerly available at: http://judiciary.senate.gov/testimony.cfm?id= 1437&wit_id=4161.

13. Goldman (1998, 10).

14. Health Privacy Working Group (1999, 10).

15. Formerly available at: http://www.theregister.co.uk/2005/04/21/ icam_surveillance_report/.

16. Formerly available at: http://judiciary.senate.gov/testimony.cfm?id=
    1437&wit_id=2875.

17. Formerly available at: http://judiciary.senate.gov/testimony.cfm?id= 1437&wit_id=4161.

18. Formerly available at: http://judiciary.senate.gov/testimony.cfm?id= 1437&wit_id=4162.

19. Formerly available at: http://judiciary.senate.gov/member_statement.cfm?id= 1437&wit_id=2629.

20. Formerly available at: http://www.adn.com/news/alaska/story/6399520
    p-6278454c.html.

21. For a listing of recent security breaches and data violations, see http://www.privacyrights.org/ar/
    ChronDataBreaches.htm.

22. See for instance Paul Clayton (Chair): For the Record: Protecting Electronic Information; National Academy Press, 1997.

23. Health Privacy Working Group (1999, 10).

24. See http://www.privacyrights.org/ar/fairinfo.htm for a full discussion.

25. Reproduced from “The Law of Privacy in a Nutshell,” Robert Ellis Smith, Privacy Journal, 1993, pp. 50-51.

26. E.g., in the form of the Fair Credit Reporting Act, the Right to Financial Privacy Act, the Electronic Communications Privacy Act, and the Video Privacy Protection Act.

27. Reproduced from http://www.privacyrights.org/
    ar/fairinfo.htm.

28. Para 9 of the OECD Privacy Guidelines states: “The purposes for which personal data are collected should be specified not later than at the time of data collection and the subsequent use limited to the fulfillment of those purposes or such others as are not incompatible with those purposes and as are specified on each occasion of change of purpose.” See http://www.oecd.org/document/
    18/0,2340,en_2649_34255_1815186_1_1_1_1,00.html.

29. For more information, see http://www.privcom.gc.ca.

30. Any provisions for informed consent need to be drafted in such a way that ensures the sharing of information is not unduly cumbersome on data users. It is probably unrealistic to assume that patients can or should give their assent to each and every use of their medical data.

31. At the same time, outreach and awareness-building must be conducted with consideration for the potentially harmful effects on a public that is overly-concerned about privacy violations. See, for instance, the following article, which highlights concerns that patients might avoid care due to recent privacy fears (formerly available at): http://www.ihealthbeat.org/ index.cfm?Action=dspItem&itemID=110098.

32. Valid concerns have been raised that such a centralization may create additional security vulnerabilities.

33. It is important to recognize that the flexibility of opt-out provisions is limited by what is technologically feasible. Any steps or provisions taken to protect confidentiality need to consider what is possible with existing technology. At the same time, technical limitations should never be used to justify breaches of confidentiality or privacy.

34. It is also worth noting that some observers have suggested that penalties for abuses should be strengthened in order to act as a deterrent against future abuses.

35. The full and updated text of the Privacy Rule is available at: http://www.hhs.gov/ocr/hipaa/finalreg.html. The Security Rule is available at: http://www.hhs.gov/ocr/privacy/hipaa/administrative/securityrule/.

36. It can be accessed at: http://ihcrp.georgetown.edu/privacy/pdfs/statereport1.pdf. The 2003 version of the report updated an earlier version -The State of Health Privacy: An Uneven Terrain (A Comprehensive Survey of State Health Privacy Statutes). Pritts (1999). In addition, the Health Privacy Project’s web site offered a state-by-state listing of laws (formerly available at): http://www.healthprivacy.org/info-url_nocat2304/info-url_nocat.htm.

37. For a discussion, see Goldman (2001) and Pritts (2002).

38. Colorado and Minnesota, for example, have recognized torts on the basis of “unreasonable disclosure of public facts.” Others, including New York and Nebraska, have explicitly denied this right.

39. A discussion of these sub-networks, often called “regional health information organizations” or RHIOs, was formerly available at: http://ccbh.ehealthinitiative.org/
    communities/community.aspx?Section=102&Category=148&Document=590 and http://www.healthcareitnews.com/NewsArticleView.aspx?ContentID=1751&ContentTypeID=3&IssueID=12.  In addition, sub-network organizations operate as health information data exchange organizations (whether regionally or affinity-based) that operate as a part of the National Health Information Network (NHIN), a nationwide environment for the electronic exchange of health information made up of a “network of networks.”

40. For a full analysis of the benefits of an information sharing environment, see Achieving Electronic Connectivity in Healthcare: A Preliminary Roadmap from the Nation’s Public and Private Healthcare Leaders. Available at: http://www.markle.org/publications/842-achieving-electronic-connectivity-health-care-summary-financial-incentives-recommen.

41. Their report is available at: http://www.markle.org/publications/863-linking-health-care-information-proposed-methods-improving-care-and-protecting-priv.

Markle Connecting for Health thanks Stefaan Verhulst, Chief of Research, Markle Foundation, for drafting this paper.