Kansas City Star, September 8, 2005
Schooled on television cops-and-court dramas, most people think that what they tell their doctor is private, privileged information that cannot be accessed by a third party, even the police.
But as a case dealing with subpoenaed medical records from Kansas abortion clinics shows, it's not that simple.
Medical records often aren’t as confidential as people would like to believe, say privacy advocates and law professors who study medical privacy. And they say marketers, insurance companies and others use medical records far more often than law enforcement officers.
"People have a mistaken notion that there's a doctor-patient code of confidentiality, and that nobody can ever find out what you tell them," said Beth Givens, director of the San Diego-based Privacy Rights Clearinghouse. "They're wrong."
Even though there are laws in place to keep medical information private, loopholes allow third parties to access the data, sometimes in individual files and sometimes in large blocks of information involving many patients.
Insurance companies and prospective employers can access files with the permission of the patient, who may have unknowingly signed a release. Health-care providers can trade and sell data, sometimes without the patient’s permission, so long as identifying information such as names and Social Security numbers are stricken from the files.
Law enforcement officials can get access to the files, if they're relevant to an investigation and the information can't be found elsewhere. It's up to police, prosecutors and judges to determine what's relevant.
Kansas Attorney General Phill Kline is seeking the medical records of 90 women and girls who received abortions at two Kansas clinics, Women’s Health Care Services in Wichita and Comprehensive Health of Planned Parenthood in Overland Park. Kline says the records are needed to prosecute suspected cases of illegal late-term abortions and child rape. At Kline's request, a Shawnee County district judge issued subpoenas for the records last year.
The clinics asked the Kansas Supreme Court to block the subpoenas. Oral arguments are set for 1:30 p.m. today in Topeka.
Kline said the records would be kept confidential and that authorities commonly use medical information in investigations. But that's little solace for the clinics.
For privacy experts, it's a classic showdown of two competing social interests: medical privacy and law enforcement. It's a tough balancing act, according to Lee Albert, a University at Buffalo law professor who studies medical privacy.
"Medical information can be very helpful in investigations," he said. "But there’s often the question of whether an investigation goes too far in violating a person’s right to privacy."
However, commercial businesses exploit medical information more often than law officers. Insurance companies want to know the medical background of customers. Marketers want to know consumer health habits. Pharmaceutical companies want to know which drugs to advertise to which markets.
"You’ve got people on the outside (of the health-care industry) dying to get ahold of this information for commercial purposes," said Nicolas Terry, a law professor at St. Louis University who studies health-care law. "That information about our health, the medications we take, the devices we need...has incredible value."
The legal concept of doctor-patient privilege typically extends to conversations, physical exams, lab tests and medical records. Ethics prohibit doctors from disseminating this information without a patient's approval.
"It's an ancient, ancient promise," said Martha Montello, a professor of medical history and philosophy at the University of Kansas School of Medicine. "Patients go in to a hospital assuming that what happens will be private."
There are exceptions: Laws require physicians to report gunshot wounds and evidence of abuse. Health statutes require the reporting of certain infectious diseases and the number of abortions provided.
And even though identifying information, such as names and Social Security numbers, is blacked out, medical records are routinely sold to insurance companies and marketers who want information about health-care consumers.
In April 2003, the Health Insurance Portability and Accountability Act, or HIPAA, went into effect, controlling the release of health information. Hospitals and doctors were prohibited from disclosing the names and details of patients to the media or the public.
But HIPAA allows a variety of groups to have access to medical records if the patient allows it. The waivers are often buried under a mountain of legal fine print, and many people sign the waivers without knowing what they mean.
"Right now, the model is: If I consent to it, you can do anything," Terry said.
The key for health-care consumers is to read the fine print, Givens said.
"People think the P in HIPAA is 'privacy,' " she said. "It’s not. HIPAA does very little to safeguard patient privacy."
Law enforcement has long looked to medical records for evidence. Dennis Rader, Wichita's BTK killer, was caught in part because authorities matched the then-unknown killer's DNA to a sample of his daughter's DNA, held by a physician.
Kline said his investigation isn't any different than others, except that it happens to involve the issue of abortion. He argues that the personal information of those whose records he seeks will be guarded by authorities.
He has accused the clinics of hypocrisy because both clinics included on their Web sites waivers allowing the use of patient information for fund-raising purposes. Both clinics deny that patients are ever contacted for fund raising.
Officials with the Wichita clinic say the waiver was put online by mistake. Overland Park clinic spokeswoman Laura Norris said the facility is legally required to list the disclosure even if the clinic does not use records for fund raising.
It's up to judges to determine when to grant subpoenas for medical records, based on the need and the damage to the patient's privacy.
"The test of whether a privacy right has been violated is whether the state has a compelling interest, and whether its means are the least intrusive possible," said Nancy Levit, a University of Missouri-Kansas City law professor who teaches privacy law.
Often, authorities will accept redacted medical records, where information deemed irrelevant or especially personal has been removed or blacked out. The clinics offered to submit redacted files if Kline explained in more detail what crimes he was investigating.
Government subpoenas for abortion records have been quashed in the past by federal judges, but this summer a judge in Indiana allowed a state investigation to go forward, dismissing claims that access to records violated patient privacy.