Re: Consent and Access to Medical Records

[Robert Gellman <rgellman@cais.cais.com>]

The consent issue is worth some attention, but it is pretty complicated 
and there are no easy solutions.  If life insurance companies are 
permitted to assess risk on the basis of medical status, then it is 
difficult to object to letting them have access to medical information 
with the consent of the patient.

The House bill is a bit more express on authorizations.  Section 112
attempts to address the issue by requiring the Secretary to prepare model
statments of uses and disclosures for different types of consent forms. 
The idea -- not fully clear from the language of the bill -- is that the
Secretary would prepare model notices for life insurance and other
purposes.  Consumers would hopefully learn to use/ask for the Secretary's
consent form in order to make sure that the consent is properly limited. 
This would be an alternative to consent forms developed by insurance
companies solely for their own benefit.  There may be something about this
in the Committee report as well.  I haven't checked. 

Both House and Senate bills make restrictions in consent forms binding so
there is enforceable protection against expanded use of information
disclosed with consent.  The House approach was intended to address the
problem of the self-serving consent form.  Unless you directly restrict
the ability of an individual to consent to the disclosure of his/her
records, this may be as far as you can go.  And I don't think that you can
restrict rights to consent.  It is too paternalistic and it won't work. 

The employer issue is also complicated.  The issue is not just disclosure 
but use, and the ADA prevents many types of misuse.  I just don't have 
the ADA expertise to explain this further.  But I think that the ADA 
solution is pretty good as it stands.  If you want to prevent 
discriminatory uses, then the ADA is the right place to go.  You can't 
prevent discrimination simply by controlling access.  Any scheme will 
have too many loopholes, and you can't stop people from getting their own 
records and sharing them as they please.

I think that you have raised a reasonable issue, but it is too early to
start pushing solutions until you have figured out how the ADA works and
whether its protections are adequate.  The "undue coercion" standard you
propose is not terrible, but it is too vague.  You have to remember that
there are plenty of circumstances in which the person seeking records can
make a case for having them.  Life insurance is the best example.  You 
will need some real life consent horror stories to make the case on this 
point.  

The House bill approach is a reasonable one, but it leaves a lot to the 
individual.  It is certainly possible that the Secretary's model notices 
will be ignored by everyone.  Ultimately, the real problem here is that 
there are limits to what can be accomplished in restricting a patient's 
ability to consent.

Note that the Senate bill has a time restriction on the seeking of 
consent.  Look at section 203.  This is an idea that originated in an 
earlier version of the House bill last year.  We dropped it as simply 
impractical.  I love the idea, but I just don't think that is is workable 
in the real world.

This issue is worth some more thought.  There may be some sharper ideas 
out there that are workable and that improve things.  I have already made 
peace with the notion that we can only accomplish so much on the consent 
front.  For treatment and payment, I actually think that relying on 
consent is counterproductive.  In other areas, the tradeoffs are very 
difficult.  

Bob

+ + + + + + + + + + + + + + + + + + + + + + + + +
+   Robert Gellman          rgellman@cais.com   +
+   Privacy and Information Policy Consultant   +
+   431 Fifth Street S.E.                       +    
+   Washington, DC 20003                        + 
+   202-543-7923 (phone)   202-547-8287 (fax)   +
+ + + + + + + + + + + + + + + + + + + + + + + + +