TESTIMONY OF DENISE M. NAGEL, MD ON S.B. 1360 - THE MEDICAL RECORDS CONFIDENTIALITY ACT OF 1995 BEFORE THE LABOR AND HUMAN RESOURCES COMMITTEE OF THE U.S. SENATE ON TUESDAY, NOVEMBER 14, 1995 AT 9:30 ROOM 430 DIRKSON SENATE OFFICE BUILDING My name is Denise Nagel. I am a physician. I first trained at Duke University in pediatrics and then in psychiatry at the Massachusetts General Hospital in Boston. I have been in clinical practice since finishing my residency fifteen years ago. Until my involvement in the issue of medical confidentiality, I have not been a political advocate or a lobbyist. I have received no reimbursement for the work I have done. I have no industry ties. In this testimony I speak as the President of the Coalition For Patient Rights of New England, whose sole mission is to work to restore confidentiality to the doctor-patient relationship. I also speak as the chair of the Medical Confidentiality Project of the national CPR organization. In addition, I speak as the mother of two young children. But more than anything I am a doctor here to warn you, to implore you, to study the provisions of Senate Bill 1360 very carefully. I have, and I am convinced it is not at all an act primarily concerned with the confidentiality of medical records. It is just the opposite. It will actually facilitate the transfer of medical information and data. It talks about informed consent....and then authorizes the creation of databases without patient knowledge or consent. It talks about individual rights.....and then allows police broad authority to search databases directly instead of obtaining a specific record from the patient's doctor. It talks about civil and criminal sanctions.... and then pre-empts all common law and most existing state statutes. It talks about ensuring personal privacy with respect to medical records.... and then sets a ceiling rather than a floor on medical confidentiality. We need federal legislation that sets a minimum standard for medical record confidentiality rather than a maximum standard. In spite of the good intentions of the sponsoring senators,----and I believe that the intentions are very good---Senate Bill 1360 has been written to advance the interests of certain segments of the computer, telecommunications, data processing and health-care industries. With this bill they would be able to careen full speed ahead to develop data networks that will give innumerable people access to our medical records legally and without our knowledge. Advocates of S.B. 1360 say this is going on anyway and that is why we need this bill. The industry itself will tell you that this bill is much too strict, and will break its back. We must not buy into this view that the loss of medical confidentiality is a done deal, or the industry pretense that it is against this bill. If we think just any legislation - or a law like this - will do, we will codify some of the most egregious breaches of ethics, morals and the Hippocratic oath that this country has ever seen. The fact is, of course we need federal legislation for the protection of medical confidentiality in the computer age. But we must use the capacities of computers to bend technology to our idea of privacy, dignity, and individual rights. If we want medical privacy in the computer age, we can have medical privacy in the computer age. Medical and security experts in this country and around the world are poised to help us achieve it. I believe the Senate and the American people want patient-centered legislation that guarantees their privacy. How many of us would confide in our doctor - let alone a mental-health professional - if we knew that our record would be available on-line to so many? The situation is bad enough already. One man told me he was disqualified from buying life insurance because he once told his internist in passing, that he was `down' and worried about a hostile takeover of his company. This man was not diagnosed with clinical depression, he was not put on medication or even referred to a psychiatrist. But there it was, a note from his internist saying that he was depressed in his file, a red flag for all to see and use for purposes of discrimination and exclusion. I could talk for hours about all the examples I have heard. There's the man who was laid off because his employer knew he needed a kidney transplant or the woman with pms who couldn't purchase insurance and the woman with a history of manic-depression who was not able to get a job. If you ask, I will go on. Dr. Harold Eist, President-elect of the American Psychiatric Association writes in a letter to Senator Kassebaum ``No one, no matter how desperate they are, will come forward, reveal their disorders and the hidden torments and suffering they have endured if they cannot be assured absolute privacy''. ... It was certainly not the intention of the framers of this bill that it would impede the expeditious delivery of humane medical services. In its present form it will do this. Right now in Great Britain, a medical-information security policy is under consideration that is based on the principle of informed consent. It restricts electronic access to the treating clinicians only and it requires anyone else to go to the doctor - not the database - to get the information. We only need look to Maryland to see the very different way our country is heading. Maryland has already passed a bill mandating the reporting of clinical data to the state, including easily identifiable information like birthdate by day, month and year and the zip code of the patient. People in the know expect that soon Maryland will require doctors to report on every patient encounter, even those paid for by the patient. There is nothing in S.B. 1360 that would interfere with this compulsory data reporting. In fact, while the bill prevents states from writing more stringent privacy laws in most cases, there is nothing in it that would preclude them from demanding more disclosure of medical information under the public health exception. What will S.B.1360 do?: I am quite concerned that under this legislation, patients will not only be uninformed about some of the uses to which their medical information will be put, but will be deliberately misled about it. Most patients will be asked for their consent to the disclosure of their medical information to their insurers and others for payment or treatment under section 202(a). The consent form under 202(a)(8) will imply that the information is solely for purposes of treatment and payment. But then the bill permits the insurer or other trustee receiving the information to pass it on without consent to the whole host of organizations covered in the exceptions. Sections 204, 205, 206, 207, 208,209, 210, 211 and 212 specify situations in which trustees (including doctors and health information services) can divulge patient-identified information without prior patient consent. Thus, Senate Bill 1360 not only permits some types of such extremely objectionable disclosures to third parties without notification or consent, but its procedures will mislead patients in this respect. The patient not only will be unaware of this further dispersion of his personally-identified information, but will be cruelly tricked by the initial assurance that the disclosure will be solely for treatment and payment. We need good medical privacy law. Good medical privacy law would limit the amount of sensitive personal information that insurers can demand. This bill does not do that. We need to craft prohibitions on access to strictly limit insider access of the medical record to only those directly involved in the patient's care. Period. This is what they are setting out to do in Great Britain, and Americans deserve no less. And we need to protect consumers and providers from losing out on services if they decline to participate in data networks. In all of these crucial ways, this bill does nothing to increase consumer choice and control. I urge you to see this bill as a wake-up call. We need good federal legislation in this area. S.B. 1360 represents the interests and needs of those who are in the business of maintaining and trading medical records electronically, and those who are willing to surrender the right to privacy for some hoped-for greater good. A bill written from the patient's need for privacy and the patient and doctor's concern for confidentiality would be a very different bill indeed. As I go back to my practice I will meet with people with severe problems. They may feel suicidal. They may have developed a dependency on drugs or alcohol. They may be unable to cope with a family trauma. They may suffer sexual dysfunction. They all will want to be assured their meetings with me are confidential. They will want to know if any records will be accessible by a party beyond the office. They will want to know what information their insurance companies and employers have a right to. These are fair questions. In every other country I have researched, medical records remain in complete control of doctors and their patients. They should stay that way here. We should heed a warning from Dr. Ross Anderson in Great Britain: ``America's problems have actually been helpful to us,'' he wrote, ``British doctors are horrified when I show them US press articles advising readers to be careful about disclosing sensitive information in a medical context.... My own expectation is that if the Bennett Bill is enacted as it stands, then your problems will get rapidly worse. With the fear of lawsuits removed, medical networks will proliferate; records will be ever more briskly traded; the incidence of abuse will soar; and the profession of medicine will become something different in America from what it is in the rest of the developed world. The USA badly needs a medical records confidentiality act, but this is not the one. I would urge you to oppose it as strongly as you can.'' Hippocrates wrote, ``Whatever in connection with my professional practice, I see or hear in the life of men which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret.'' This has been the basis of the doctor-patient relationship since 350 B.C.