Fake Banner
    Who Owns Your Medical Records?
    By Randall Mayes | August 1st 2012 06:42 PM | 27 comments | Print | E-mail | Track Comments
    About Randall

    Randall Mayes is a policy analyst specializing in biotechnology. His areas of expertise include technology based economic development and public...

    View Randall's Profile

    For most of our lives; physicians, hospitals, and insurance companies have used paper medical records. They controlled the flow of data, but allowed patients and others access to their records.

    Over the past few years our medical records have gradually moved to the cloud. This is a consequence of the Obama Administration addressing the massive budget deficit and reviving an antiquated healthcare system. Obama’s National Commission on Fiscal Responsibility and Reform identified defense, interest on the national debt, and healthcare costs as its major targets to address the huge budget deficit. To address the healthcare component, Obama unleashed a controversial health plan and also wants to overhaul the current infrastructure for medical information. The President also signed The American Recovery and Investment Act (2009) which allocates roughly $20 billion of the $787 billion in stimulus funds towards equipment and technical support enabling the transition to digitized medical records.

    Digitized or electronic medical records (EMRs) will provide a seamless way to manage the health data from pharmacies, doctors, hospitals, and insurance providers. With a unique medical identification number, each patient’s personal statistics, demographics, lifestyle, and medical history including lab tests, immunizations, allergies, medications, and health insurance information are accessible in a centralized format, wherever needed.

    EMRs will, in theory, provide more reliable and higher quality healthcare and reduce medical costs. Sharing medical data will hopefully eliminate hundreds of thousands of medical errors annually and provide better management of medical data in clinical treatment and medical research accelerating medical discoveries. According to a RAND Corporation study (2005), savings from EMRs could reach $77 billion per year. With the ability to eliminate mass volumes of paper and storage costs, administrative tasks, red tape, and the duplication of procedures; the savings are passed on to patients. 

    Obama has set a goal of having a nationwide system in place by 2014. In order to help with the financial burden of the transition from paper records, Obama is using a carrot and stick approach with the stimulus money to ensure a smooth transition. For doctors and hospitals to receive stimulus money for their computer equipment, they must meet government standards for recording patient’s data and for sending prescriptions and exchanging patient data between clinicians electronically. Starting in 2015, doctors and hospitals using Medicare are subject to financial penalties for not meeting these standards.

    According to property law specialist Mark Hall of Wake Forest University Law School, although the law does not consider medical information property, it gives EMRs that distinction. So, who actually owns your electronic medical records? Currently, the answer to this question is somewhat vague even to experts in the field. Policymakers are, however, attempting to answer this question. The perspectives from experts and activists on who should own EMRs are related to their positions on policy issues related to EMRs.

    For those whose concern is with privacy protection, patients should have control of who sees their medical data. A medical records network will require safeguards for unauthorized access similar to online banking. In addition, there are issues with authorized access. For physicians it is not always practical to obtain consent while providing medical care, for example, in emergency room situations or if the patient is unconscious. Also, after medical professionals perform services, in order to verify claims it is necessary that insurance and billing personnel, both government and private, have access to medical records. Even with different levels of access to EMRs, Deborah Peel of Patient Privacy Rights points out that currently self-insured employers can access employees’ entire health records.

    Although the primary use of medical records is to treat patients, the medical community also uses EMRs for mining data in clinical care research. If medical data is anonymous, patients can no longer claim ownership. The Health Insurance Portability and Accountability Act (2003) allows anonymously sharing patient medical data with related healthcare businesses. This includes organizations that possess medical information selling it anonymously to resellers. Marc Rodwin, a Professor of Law at Suffolk University, discloses in JAMA that IMS Health, the largest reseller, made $2 billion in 2006. For Rodwin who has pragmatic concerns related to the benefits of mining data, EMRs should become public property. He argues that with private ownership the interests are with the data sellers, not the public and that private companies are reluctant to let competitors use their clinical data.

    Kevin Schulman of Duke University’s Medical and Fuqua Business Schools, and Mark Hall argue in JAMA that for developing EMRs, the current situation is the worst of two worlds. Current laws, which are at the state level, favor protecting the patient and the clinician’s economic interest limiting access to health records. As a result, the low commercial value to patients and the restricted access create barriers to forming integrated electronic records. Schulman and Hall advocate letting markets determine the best use of the EMRS which is more efficient than allowing courts or regulatory agencies to decide.

    The U.S. Constitution’s Fifth Amendment prohibits the state from taking property without compensating owners. Given that EMRs are property with economic value, how can policy makers create an infrastructure that is financially self-sustaining and no longer requires government/taxpayer support?

    Heritage Foundation’s Edmund Haislmaier suggests, The best way to induce patients and providers to share the individual data they create is to help them unlock the value of that data and share in the benefits derived from letting others use it. The idea is to create market mechanisms for rewarding those who control access to medical data and place those rights in a stream of commerce for the highest and best use. By commercializing the medical records through bundling rights to patients and clinicians, they could receive the profits in return for release in to the network.”

    Hall and Schulman observe that for developing our property laws, lawmakers use our fundamental rights and society’s economic goals. In response to the policy issues associated with EMRs, Representative Paul Ryan of Wisconsin and Representative Dennis Moore of Kansas introduced legislation in the House and Senator Sam Brownback of Kansas in the Senate known as the Independent Health Record Trust Act (2007).

    Under this proposal, consumers own and have control of their health records. Similar to the current banking infrastructure, the proposed trust requires obtaining a patient’s consent before releasing health information to hospitals, doctors with exceptions for emergencies where patients authorize limited amounts of information. With patient control, electronic medical records will potentially become more secure than paper records. The proposed trust is also financially self-sustaining. It can generate revenue through the sale of non-identifiable health data for research by charging account fees to those who use them. Unfortunately, the bipartisan bills did not receive enough votes to pass.

    Consequently, although EMRs are government mandated, a number of policy issues remain unresolved. PACeR, the Partnership to Advance Clinical Electronic Research, a pilot program in New York State has developed a business model based on the failed legislation. The non-profit partnership between medical centers, patients, and pharmaceutical companies developed a medical data network and hopes to discover how researchers can mine the data and manage patients in the most efficient manner and remain financially self-sustaining.

    Comments

    Gerhard Adam
    Digitized or electronic medical records (EMRs) will provide a seamless way to manage the health data from pharmacies, doctors, hospitals, and insurance providers.
    How is that supposed to happen?  Who will be determined to be the central authority for maintaining the integrity of the data?
    With a unique medical identification number, each patient’s personal statistics, demographics, lifestyle, and medical history including lab tests, immunizations, allergies, medications, and health insurance information are accessible in a centralized format, wherever needed.
    Again ... who is the "owning" entity with respect to the electronic data base and who will be responsible for managing the interconnected network to make all this real?
    Sharing medical data will hopefully eliminate hundreds of thousands of medical errors annually and provide better management of medical data in clinical treatment and medical research accelerating medical discoveries.
    I don't want to rain on anyone's parade here, but how is this supposed to happen?  "Sharing" is such an easy word to use when you're marketing a computerized solution, but it's amazingly difficult to pin down when we're talking about responsibilities.
    randallmayes
    The government set up the infrastructure, but individual institutions maintain the integrity (same as with paper records) and restrict who can see what. Each state and institution is protective of its data until some policy issues are sorted out. This is because the system is draining money, but needs to become financially sustainable. These are good questions, but unfortunately politics is involved.
    Randall Mayes
    Gerhard Adam
    Has this actually be spelled out someplace, because it sounds like a governmental fantasy right now.  If individual institutions maintain the integrity of data, then there is no infrastructure except as it applies to transmitting information.  In short, that is simply the internet.

    NOTE:  Paper records have one significant difference in that they can be identified legally as originals.  The same cannot be said of electronic records, and consequently there is a completely different standard required for maintaining data integrity.

    I can appreciate that there are politics involved, but it sounds primarily like its only politics, because this problem cannot be solved by any current technology under these circumstances.
    randallmayes
    What exactly does integrity have to do with ownership? Let's be positive and invest our energy in making this work. You never know, someday we may have online banking. Seriously, what ever the banking system did, medical institutions can follow.
    Randall Mayes
    Gerhard Adam
    Data integrity is the basis by which there is an entity that is responsible for data content.  It is also responsible for security, ensuring that copies are up to date, ensures the integrity of the updating process, and provides backup/recovery mechanisms.  In the event of conflicting copies of data, it is the final arbiter of which is correct.

    Without that there is nothing. 

    Medical institutions cannot duplicate even the subset of what banking did, because unlike medicine there are no individual-practice bankers.  Just to be clear, banks don't share data, at least not in the sense that medicine requires. 

    I would love to be positive about something that has a chance of working, but this isn't it.  This is a disaster waiting to happen and the complexity surrounding the management of such data and the computing systems complexities that go with it, are not "just around the corner".  I will willingly bet that within the next two decades they won't be any closer to having such a system working than they are today [and such fantasies have already been under discussion for the past two decades in various forms].

    I don't have a problem taking such problems seriously, but I won't do it simply to engage more political fantasies.
    randallmayes
    There are two components, patient care which has been operational for years. The second is data mining, which has not only scientific hurdles but financial challenges. I have attended dozens of meetings and conferences related to EMRs and no one has ever brought this integrity issue up as an issue. Why don't you give us a specific example in medicine where this is relevant and discuss it. Until then, it will remain a philosophical bloviation.
    Randall Mayes
    Gerhard Adam
    There's nothing philosophical about it.  If the point is simply to send e-mail attachments, then there's no difficulty.  Data mining is a complete fantasy.

    Let's just consider a local doctor's office.  What data base is going to be required to ensure consistency of data access?  If data is copied to another location, how is currency [i.e. how up to date it is] going to be maintained?  Let's just assume that the data from a doctor's office has to be sent up to a hospital for treatment.  Now we have data residing in two locations.  Who is responsible for the data?  It can't be the doctor's office if information can be changed at the hospital.  So is the hospital now the owner of the data?  How is it going to be managed to ensure that the doctor's office is also up to date?

    Who purges the data when it is no longer current at the site it resides at?  It requires a level of systems interaction that is unprecedented anywhere in the world. 

    Again, if more than one copy of data exists, who ensures which one is the current one [especially if they aren't identical records]? 

    Even something as relatively simple as pharmacies can't keep drug prescriptions straight if a patient were to go to different physical locations of the same company.  How is this to be handled when multiple companies may be involved?  If a communication link is down, does that simply prevent treatment?

    It's a great computer fantasy, but that's all it is. 

    Bear in mind, that even if the issue were as simple as allowing researchers to engage in data mining without patient care being involved, how is access authorization going to be determined?  You made the comparison to banks, yet most banks require weeks of security clearance simply to allow someone outside the organization to have access, and then access to privileged [i.e. high security information] is severely restricted.  This would require essentially open access to be of any value.

    It has no chance of ever working.
    I have attended dozens of meetings and conferences related to EMRs and no one has ever brought this integrity issue up as an issue.
    Data integrity is so fundamental that it raises grave concerns if no one has ever brought this issue up.  It strongly suggests that no technical people were actually involved in the discussions.  This isn't something I've just made up, nor is it philosophical.  It is the backdrop against which all computer systems have to operate.  If it hasn't been discussed, then it isn't real.

    In short, my question is ... at these conferences, how many data base administrators, systems programmers, application programmers, and network analysts were involved?  I can already answer part of that question, because if it involves the thousands of doctors in private practice, the answer is zero.

    As I said, it involves an IT project of unprecedented scale and yet a significant portion of the necessary participants don't even have IT staff.
    randallmayes
    I can only speak for Duke University and what the informatics people tell me, It sounds like you want to talk about a different topic than the blog. Duke has been involved with clinical data since the 1940s and definitely has worked with data base people since they were created. Currently, companies like Quintiles and Verizon are at the meetings. The Center for Disease Control people are attendes and have the most sensitive data. They contradict everything you say. But what do they know?
    Randall Mayes
    Gerhard Adam
    Duke has been involved with clinical data since the 1940s and definitely has worked with data base people since they were created.
    Good, except that there weren't any computer systems then.
    Currently, companies like Quintiles and Verizon are at the meetings. The Center for Disease Control people are attendes and have the most sensitive data.
    ... and what expertise do these people bring to constructing such systems?
    I can only speak for Duke University and what the informatics people tell me, It sounds like you want to talk about a different topic than the blog.
    Good, perhaps you can point to a link or some paper that illustrates how this modern miracle of computing is to occur?  Given what you described in the article, I would challenge any one of them to explain how this is to be done [unless, of course 90% of it is hype].
    Gerhard Adam
    I'm not sure what you mean by "patient care" having been operational for years.  Certainly in one on one exchanges between doctors, information can be exchanged, but it has always been a one-off type of arrangement and is hardly as comprehensive as you've outlined above.

    At it's most optimistic interpretation, it is little more than faxing a copy of the records to another facility.  It is hardly anything resembling a digital medical record with all the interfaces being described.

    ... and as for the government establishing the infrastructure?  The government can't even maintain such data communication among its own agencies.  Just as one example, the IRS has been struggling for over a decade to consolidate it's own data bases and provide a comprehensive system for dealing with taxes [that was only phase 1 having been implemented this past year].  The hard part comes later.
    randallmayes
    The Veterans Administration was the pilot program probably because it was so bad and wasteful. It has operated for years. You should read about the topic and at least get to the informed opinion level. You are making many uniformed comments and are not adding anything to the conversation .
    Randall Mayes
    Gerhard Adam
    Ah yes ... the organization that managed to compromise the data of 26.5 million veterans because they couldn't manage something as simple as "data integrity" on a laptop.

    http://www.msnbc.msn.com/id/12916803/ns/technology_and_science-security/t/all-veterans-risk-id-theft-after-data-heist/#.UBoHJ6Phcsw

    You may think my comments are uninformed, but you haven't provided any information that it can be done and the organizations you claim are doing it ... aren't.

    Bear in mind that the VA is only ONE organization.  It has to merge information with no one and doesn't have to allow outside access.  In short, it is clear that the architects of this "project" don't know anything about computer systems.
    Shinseki acknowledged the two departments for 10 years have been discussing and taking interim steps toward an integrated Electronic Health Record (iEHR) system. He described as “ground breaking” the fact that he and Panetta agree now on what the system will be and are moving toward it.
    http://www.jdnews.com/articles/house-106595-dod-years.html
    Yeah ... where did I hear something like that before?

    The whole approach may have had more credibility if an organization like IBM were involved, but without them, there isn't a prayer of success.  As I said ... believe what you like.  I've said my piece, but this will never happen.  If anything, within the next few years it will be grossly watered down, and it will result in a large number of incompatible systems that will be costly but operate no different than they do today.  In the end, none of the stated objectives will be met.   Oh ... one other thing.  It will easily cost ten times more than the most pessimistic estimates available.

    http://www.it-cortex.com/Stat_Failure_Rate.htm
    http://calleam.com/WTPF/?page_id=1445
    Gerhard Adam
    Hmmm .. this is also interesting.  You're right.  I'm glad I read about it.  So it appears that there is no running system, and it isn't even projected to be complete for another couple of years.
    In a report that the Department of Defense (DOD) recently submitted to Congress, the DOD said that it and the Department of Veterans Affairs (VA) had made "significant progress" on their project to create an integrated electronic health record (iEHR).

    This assessment echoes a recent announcement by Roger Baker, CIO of the DOD, that the first version of the iEHR would be ready in two years, instead of the four years earlier allotted for development.

    The Congressional report stated that the two departments had agreed on a wide range of topics, including common data standards, data center consolidation, common clinical applications, a common presentation layer, and a governance structure for the iEHR. The Defense Department's Information Systems Agency will run the data centers, and its Manpower Data Center will handle identity management, the report said.
    Informationweek, May 2012.
    http://www.informationweek.com/news/healthcare/EMR/240000449
    So, it appears that DoD will be the "owner" and responsible for the data [i.e. fully centralized system] and another data center will be responsible for maintaining security or identity protections.

    As I said ... such a system doesn't currently exist, and isn't even scheduled to be completed with phase 1 for a few years.  So, what is the basis of the claim that it has "operated for years"?  So it appears that is a misstatement?
    http://www.jdnews.com/articles/house-106595-dod-years.html

    http://www.informationweek.com/news/healthcare/EMR/240002650?cid=SBX_iwk_related_commentary_Electronic_Medical_Records_healthcare&itc=SBX_iwk_related_commentary_Electronic_Medical_Records_healthcare
    However the tools healthcare providers currently use don't have the ability to store, manage, and distribute comprehensive, timely, and relevant information to the degree needed for PHM, the report concludes.

    EHRs, for example, often don't contain the data about the care that patients have received outside an organization, and they aren't designed for interoperability. Likewise, many EHRs don't generate the real-time alerts for preventive and chronic care, and don't generate quality and population reporting.


    http://www.informationweek.com/news/healthcare/clinical-systems/240004578?cid=SBX_iwk_related_commentary_Electronic_Medical_Records_healthcare&itc=SBX_iwk_related_commentary_Electronic_Medical_Records_healthcare
    randallmayes
    There are numerous seperate systems for mining data. There is one system for health records which has numerous levels of access. Institutions are not sharing the data for mining because it has become a commodity due to property laws. How does your last post relate to my article?
    Randall Mayes
    Gerhard Adam
    Confidential data will never have open access.  Property laws have nothing to do with it.  The question isn't how many systems are involved, the question is the confidentiality of the data.  That renders all other points moot.
    There is one system for health records which has numerous levels of access.
    What do you mean "one system"?  You indicated that there is no centralized system for health care records.  If there is a centralized system, then all users must coordinate with that centralized system, but that begs the question of where the data originates from.  Is it expected that doctors will submit patient records to such a central site [which won't happen]?

    Is every medical facility expected to have a connection/account with such a centralized agency?  If it is proposed to be centralized in that fashion, that would be hugely expensive and wasteful and ultimately not work very well.

    That's why I'm asking these questions, because it sounds like salesmanship instead of science or technology. 

    My last post supports my point in that despite your claims, there is no functioning system, there isn't even one scheduled to be quasi-functional for several years, and it says nothing about integration to the private sector which hasn't even been addressed.

    randallmayes
    There is one health records system otherwise the whole concept is meaningless. Each institutions system has to be integrated, the free market model. Duke is discussing partnering with Verizion for a portable device. Verizon knows a little bit about databases. Duke and Quintiles may partner for data mining. Each institution can choose their platform. As an alternative you could have a centralized government dictated technology, the socialist model. Iceland has had a government run medical database for over a century. Pharmacy has spent hundreds of millions of dollars in Iceland mining data.
    Randall Mayes
    Gerhard Adam

    OK, I get it.  You think this thing is going to be great, and I'm saying that it won't work.  In the absence of a working prototype, any projection about success is premature at best.

    You keep mentioning Verizon, Duke, and Quintiles and yet none of these organizations has any history of actually implementing anything on such a scale.  Verizon is only agreeing to provide the data exchange bandwidth, which doesn't actually involve anything new in the technology.  The entire architecture will still be TCP/IP driven so, they aren't having to do anything special.

    Their certification process is equally uninvolved, since certification is a passive process [i.e. getting to judge others].  Since they don't actually have to comply and design how such compliance is achieved, they offer a checklist to tell everyone else what they have to do.  These are not the keys to success in such a project.
    http://newscenter.verizon.com/press-releases/verizon/2012/verizon-provides-tips-to-help.html
    Verizon knows a little bit about databases.
    Such as?  What database does Verizon support? 
    Duke and Quintiles may partner for data mining.
    Again ... irrelevant.  The question is what tools will be used and under whose control do these organizations think they are going to be given access to anyone's data? 

    Let me be clear just in case there's some misunderstanding.  Connecting up computer systems can be done by a sixth grader.  Doing it so that the data is protected, proper authorizations are maintained, and data integrity is preserved is a bit more complex.  So far, those aspects seem to have been ignored.
    Iceland has had a government run medical database for over a century.
    ????
    MikeCrow
    What I have seen, is the Dr's associated to the Hospital System I use, have access to my records. They in turn use the same system to  input the data from my Dr's visits. So a single copy of the data is all in one place for that hospital, and a group of Dr's that I use. If that hospital make agreements with the other hospital systems in the area, the data can be shared. And yes, while the internet will be used, it will be over a vpn or as encrypted data.

    There are also a number of companies, who will provide a location to store copies of your records, where you have control over access. It to would be easy to support encrypted access, and almost all of the standard web servers support https. Some of these companies also allow you to store your data on an encrypted usb flash drive. While getting the data, can be a pain, all Dr's have access forms, but if you have a huge stack of paper records, I would expect it to not be free.

    While I don't have all of my records, I do have copies of x-rays, cat scans, and my mri's (and yes I have pictures of my brain, so I can prove I have one).
    Never is a long time.
    Gerhard Adam
    Mike

    I'm not disputing that a small group can share information.  Similarly, we already know about large amounts of data that are typically shared in large organizations for a variety of purposes. 

    That's not the problem.

    All of these arel traditionally controlled by a specific organization from which everyone else cooperates.  This may involve having an account, etc.  Again ... not a problem.

    However, what is being proposed assumes a kind of open access where by all records are supposedly "owned" and managed locally and yet allow a kind of universal access to anyone engaged in data mining. 

    The problem isn't in creating and supporting large databases.  The problem is in trying to create this "love fest" of data and access that has never been realized in the "real world".  The amount of data is simply too large for tight centralized control and distributed access/control is impossible to make work within the definitions of what is desired.
    randallmayes
    Mi Cro is discussing patient health records and you are discussing data mining. Your comment has nothing to do with the previous comment or the article.
    Randall Mayes
    Stellare
    The chances of abuse is too big. It is already scary how much sensitive data is available to too many people.
    Medical data is perhaps the most sensitive data there is. There are too many ways that this data can 'come astray' and end in the wrong hands of ill will. Seen it already in my country. In the US you have on top of it the economic interest of insurance companies.

    I would fight to keep it analog! :-)
    Bente Lilja Bye is the author of Lilja - A bouquet of stories about the Earth
    randallmayes
    Are you saying that the Pentagon's or CIAs files are less sensitive than what's in Hank's stool sample?
    Randall Mayes
    Hank
    Hey, I told you about my bowel movements IN CONFIDENCE!
    Want more no-nonsense, independent science? Buy Science Left Behind
    Gerhard Adam
    I'm not sure if you're being deliberately obtuse, or if you think that being flip about it answers questions.

    That's about the silliest and ill-informed comparison I've seen.
    Stellare
    I take it from your comment that you have lived a protected life. ;-)
    I am very happy for you - but for many people, more than those who are involved in the wars you are fighting, medical information astray can destroy their lives. Particularly in the US.

    The systems we create are vulnerable to the human factor. At all times. We will always have to negotiate the benefits vs potential damage.

    It is naive, at best, to think that sensitive information about our health not will be used against the individuals. Even Hank's...
    Bente Lilja Bye is the author of Lilja - A bouquet of stories about the Earth
    randallmayes
    I undertand your concerns and your subsequent opinion. People have had paper records compromised. Online banking has its obvious issues. Obama has already put this in place and it is the law in the U.S. So, the field has moved on to other problems that stand in the way. In the U.S., we have over 40,000 automobile related deaths annually. Americans in general want to keep cars and some even want to increase speed limits. In risk assessment, you weigh risks and benefits. In both cases, Luddites are losing.
    Randall Mayes
    I think this whole story along with the comments are very thought provoking. I can see positive things from both sides.