S. HKG. 106-49

MEDICAL RECORDS PRIVACY

HEARING Jl

OF THE

COMMITTEE ON HEALTH, EDUCATION,

LABOR, AND PENSIONS

UNITED STATES SENATE

ONE HUNDRED SLXTH CONGRESS

FIRST SESSION

ON

VERMONT FIELD HEARING ON FEDERAL LEGISLATION RELATING TO

MEDICAL INFORMATION CONFIDENTIALITY

MARCH 15, 1999 (BERLIN, VT.)

Printed for the use of the Committee on Health, Education, Labor, and Pensions

U.S. GOVERNMENT PRINTING OFFICE

57-145 CC WASHINGTON ! 1999

For sale by ihe U.S. Government Printing Office

Superintendent of Documents. Congressional Sales Office, Washington. DC 20402

ISBN 0-16-058580-5
COMMITTEE ON HEALTH, EDUCATION, LABOR, AND PENSIONS

JAMES M. JEFFORDS, Vermont, Chairman

JUDD GREGG, New Hampshire

BILL FRIST, Tennessee

MIKE DeWINE, Ohio

MICHAEL B. ENZI, Wyoming

TIM HUTCHINSON, Arkansas

SUSAN M. COLLINS, Maine

SAM BROWNBACK, Kansas

CHUCK HAGEL, Nebraska

JEFF SESSIONS, Alabama

EDWARD M. KENNEDY, Massachusetts

CHRISTOPHER J. DODD, Connecticut

TOM HARKIN, Iowa

BARBARA A. MIKULSKI, Maryland

JEFF BINGAMAN, New Mexico

PAUL D. WELLSTONE, Minnesota

PATTY MURRAY, Washington

JACK REED, Rhode Island

MARK E. POWDEN, Staff Director

SUSAN K. HATTAN, Deputy Staff Director

J. MICHAEL MYERS, Minority Staff Director and Chief Counsel

(n)

*

'A$

A»

v

LC Control Number

99 490493
KF2k

Copy'

CONTENTS

STATEMENTS

MONDAY, MARCH 15, 1999

Page

Jeffords, Hon. James M., Chairman, Committee on Health, Education, Labor,

and Pensions, opening statement 1

Koch, Hon. Thomas, Chairman, Ways and Means Committee, Vermont State

House of Representatives, Barre Town, VT; Meg O'Donnell, director of

quality assurance and consumer protection, Vermont Division of Health

Care Administration, Montpelier, VT; Tim Palmer, executive director, Vermont Cares, Burlington, VT; and Susan Aranoff, attorney, Vermont Protection and Advocacy, Montpelier, VT 3

Prepared statement ofMs. O'Donnell 7

Leahy, Hon. Patrick J., a U.S. Senator from the State of Vermont 12

Prepared statement 14

Tofferi, Leigh, director of government and public relations, Blue Cross and

Blue Shield of Vermont, Montpelier, VT; Anne Cramer, Vermont Association of Hospitals and Health Systems, Burlington, VT; and Madeleine

Mongan, counsel and director of government relations, Vermont Medical

Society, Montpelier, VT 22

Prepared statements of:

Ms. Cramer 26

Ms. Mongan 29

Gettinger, Dr. Andrew, Dartmouth-Hitchcock Medical Center, Lebanon, NH ... 37

Prepared statement 39

Lussier, Mary, and Anne Ladue, Vermont Occupational Health Nurses Association; Dr. Douglas Weir, program manager, Occupational Health Services,

IBM, Essex Junction, VT; Dr. Norman S. Ward, associate professor of

family practice, University of Vermont College of Medicine, Burlington,

VT 43

Prepared statement of Dr. Weir 46

Warnke, Andrea, American Civil Liberties Union of Vermont, Montpelier,

VT; Laura Ziegler; Phyllis Tarbell, Dorset Nursing Association, Dorset,

VT; and Vicki Giella, Area Agency on Aging for Northeastern Vermont 55

Prepared statements of:

Ms. Warnke 56

Ms. Tarbell 59

(III)

MEDICAL RECORDS PRIVACY

MONDAY, MARCH 15, 1999

U.S. SENATE,

COMMITTEE ON HEALTH, EDUCATION, LABOR, AND PENSIONS,

Berlin, VT.

The committee met, pursuant to notice, at 9:19 a.m., in Conference Room 3, Central Vermont Medical Center, Berlin, Vermont,

Senator James M. Jeffords (chairman of the committee) presiding.

Present: Senator Jeffords.

OPENING STATEMENT OF SENATOR JEFFORDS

The CHAIRMAN. Good morning. May I have have your attention

please. As you know, I am Senator Jim Jeffords. I am chairman of

the Health, Education, Labor, and Pension Committee, called the

HELP Committee, and right now it is the busiest legislative committee in the Senate. And we are here today to hold a hearing,

which I try to do in Vermont as often as I can, especially if the sub1'ects are of great importance to individuals, to businesses, and to

lospitals.

Senator Leahy should be joining us before too long. Senator

Leahy and I have been in the Congress about 24 years together

now and have learned to work together very well. He is on the Judiciary Committee, which also has an interest in the legislation

which we are talking about today.

This is the committee's sixth hearing on the topic of medical

records privacy. And until recently we gave very little thought to

issues of medical privacy. We visited our family doctor with full

confidence in the sanctity of the physician-patient relationship.

Today, however, technology has radically altered the delivery of

health care and the use of health care information. The National

Research Council, as part of their study of the confidentiality of

medical records, has shown that numerous individuals in more

than 17 different organizations have access to any one set of medical records.

Many recent technology changes contribute to better and more

efficient health care. Telemedicine will make it possible for patients

here at Central Vermont Hospital to benefit from the expertise of

physicians at nationally known academic medical centers like

Fletcher Allen, Dartmouth-Hitchcock.

Quality care requires more than the free flow of information between providers, payers, and other users of health information. It

requires trust between a patient and a caregiver. For our health

care system to be effective as well as efficient, patients must feel

comfortable sharing sensitive information with health profes-

(1)
sionals. Technology has provided the tools to allow the ease of access to health care information. Now legislation is needed to ensure

the confidentiality of personal health information.

The current loose web of State privacy laws is inadequate and insufficient. We need a uniform national standard for medical records

confidentiality, with the exception of State laws relating to public

health issues in those areas having a history of discrimination,

such as mental health. The Health Insurance Portability and Accountability Act of 1996, known as the Kassebaum-Kennedy Act,

established several mandates relating to medical records privacy.

One provision set August, 1999, this August, as the deadline by

which Congress must act to ensure the confidentiality of electronically submitted data. If for some reason Congress fails to act, then

HIPAA includes a default provision directing the Secretary of

Health and Human Services to promulgate regulations.

This issue is much too complex and important to be handled by

the regulatory process. Senator Leahy and I prefer to ensure the

appropriate safeguards for medical data through the deliberative

and conscientious approach of the legislative process. This hearing

is intended to be an overview of the unique perspectives of consumers, providers, regulators, insurers, employers, and researchers. I

look forward to all the valuable testimony today that we have before us so that we can move forward to meet that August deadline.

I would like to announce that following the three panels of witnesses, we will have an open mike session for questions and comments. There is a sign-up sheet for use of the microphone in the

back of the room. Since we have a limited amount of time, signup will be on a first-come-first-served basis, and we will listen to

as many people as we possibly can.

We will be hearing from several distinguished witnesses this

morning. On the first panel, I am happy to introduce Thomas Koch,

who has been elected to his fourth term as the Republican member

of the Vermont House representing Barre Town. Is Mr. Koch here?

Oh, yes, I see you now. Hi. How are you?

An attorney, Tom Koch also has served since 1984 as Barre

Town moderator. If you want to come up, Tom, and take a seat.

He was a member of the Barre Town Charter Committee. Tom has

been active in a wide variety of community service roles, having

served with the Army in Vietnam, with the Barre Lions Club, and

as a scoutmaster. It is a great pleasure to have you with us this

morning, and thank you for appearing.

The next is Ms. Meg O'Donnell, director of quality assurance and

consumer protection for the Vermont Division of Health Care Administration. In that capacity she holds responsibility for implementing Rule 10, Vermont's new regulatory oversight program for

managed care plans. In the course of her career she has frequently

spoken on health care policy topics such as consumer protections

and the confidentiality of medical records. Ms. O'Donnell, we are

pleased to have the benefit of your experience.

The next witness, whom I am pleased to introduce is Susan L.

Aranoff, a staff attorney at Vermont Protection and Advocacy, Inc.,

in Montpelier, where she provides legal services to people with disabilities and also is engaged in policy research, development, and

advocacy before the legislature and other agencies. In addition, Ms.
Aranoff is co-chair of the Vermont Coalition for Disability Rights,

Legislative Committee.

In the past she served clerkships in the office of Governor Kunin

and the office of Vermont's Attorney General.

Ms. Aranoff, we thank you for being with us today.

Also testifying today is Mr. Tim Palmer, executive director of

Vermont Cares in Burlington. Vermont Cares is a statewide organization committed to providing resources, education, and services for

people with HIV and AIDS.

Air. Palmer, thank you for being here. Good to see you again.

Tom, would you please proceed.

STATEMENTS OF HON. THOMAS KOCH, CHAIRMAN, WAYS AND

MEANS COMMITTEE, VERMONT STATE HOUSE OF REPRESENTATIVES, BARRE TOWN, VT; MEG OTJONNELL, DIRECTOR OF QUALITY ASSURANCE AND CONSUMER PROTECTION, VERMONT DIVISION OF HEALTH CARE ADMINISTRATION, MONTPELIER, VT; TIM PALMER, EXECUTIVE DIRECTOR, VERMONT CARES, BURLINGTON, VT; AND SUSAN

ARANOFF, ATTORNEY, VERMONT PROTECTION AND ADVOCACY, MONTPELIER, VT

Mr. KOCH. Thank you, Mr. Chairman. I thank you for the opportunity to share some thoughts with you on the subject of medical

records confidentiality. This is not a high profile issue, and few

people seem concerned with it until the relatively rare event occurs

which brings it home personally. The fact is, however, that everyone has some form of medical record, and everyone is interested in

maintaining some degree of control over the dissemination of his or

her own records. So I thank you for your interest in this matter

and the important work that you are doing on it.

This issue, like so many that Congress on the one hand and

State legislatures on the other deal with, presents a difficult question of Federal-State relationships. I believe I speak for 179 other

members of the Vermont General Assembly when I tell you that we

are jealous of our legislative prerogatives and that we believe we

are in a better position than the Congress to tailor programs and

regulations in a manner which best serve and protect Vermont's

citizens. On the other hand, we certainly recognize the constitutional role of Congress to regulate commerce among the States, and

that is an area that has become vast more complex in recent years.

The proper balance point is not easily located, and I do not presume to find it for you today. I will, however, attempt to share

what we are doing in Vermont and to express some concerns, and

I hope this will be helpful to you as you work on the subject in

Washington.

To the extent that Federal law will preempt State law, it would

be useful for you to know what it is that you are preempting, and

I wish I could tell you. Vermont's medical records confidentiality

laws are not a coherent whole. Rather, they have grown up piecemeal over many years, and rather than being comprehensive, they

could best be described as hit and miss. We do have statutes and

court rules relative to provider-patient privilege, but there is some

question of the extent to which records, as opposed to direct communication, are privileged. The privilege has been substantially
narrowed by a number of court decisions over the years. Requirements regarding the length of time that records must be maintained, except hospital records, do not exist. And Vermont's laws

certainly do not contemplate the ease with which information can

be transferred in the age of the Internet.

So the need for a new medical records confidentiality law in Vermont has been clear for a number of years. Nevertheless, the bill

has foundered on the rock of complexity during the past two biennial sessions, and we are just now beginning the process again.

Last week, the House Health and Welfare Committee, on which I

serve, voted out its version of the bill, H. 63, and that bill is now

in the House Judiciary Committee. Eventually, I expect the corresponding committees in the Vermont Senate to consider the bill

as well. For that reason, I cannot tell precisely what the final version will contain.

What I can tell you is a lot of work has gone into this bill with

more to come. We have listened to many, many Vermonters trying

to design a law that will serve their particular needs. We have attempted to design a bill that is both comprehensive and workable.

How any other State may view the needs of their people and what

other states have done in this regard, I do not know. We have not,

however, heard any concerns in our committee expressed to us that

what another State has done might adversely impact Vermonters.

For that reason, I do not perceive any need for Congress to roll

back, by way of preemption, any protections that Vermont or any

other State has adopted.

There are those who may argue that some businesses, such as

insurance companies who deal with medical records across State

boundaries, and reviewing some of the other statements that will

be made here today, physicians, for example, who treat people

across State boundaries, will find it difficult to comply with a myriad of regulations imposed by 50 different states. I would suggest

that it will not be any more difficult than it is for insurers to comply with existing insurance regulations in the several states. They

have developed State specific endorsements, procedures and protocols in the conduct of their business, and they will no doubt do so

as they deal with modern medical records confidentiality laws. In

short, this is a matter in which Congress may be tempted to impose uniformity, but I would hope the temptation would be resisted.

What it does raise is I believe a legitimate concern are the truly

Federal questions about transfer of information across State lines,

particularly to a person in a State which may not have acted adequately to maintain the confidentiality of records in its jurisdiction.

Vermont's proposed bill, for example, makes it clear that a person

who or which obtains health care information for a lawful purpose

is a custodian of that information, and subsequent disclosure of

that information is subject to the provisions of the proposed act.

When the recipient is in another State, it is unclear how Vermont

can enforce the protections it purports to give to its citizens. In this

case, the Federal power can be helpful, either by enacting minimum standards where inadequate rules exist, or by giving effect in

Federal law to the law of the jurisdiction in which the medical in-
formation originated if that state's protections are greater than

those of the State to which the information is sent.

The Federal-State question is sometimes reduced to the shorthand whether the Federal law should be a floor or a ceiling. My

own conclusion is that there is no pressing need for uniformity,

that the States should be allowed to respond to the need of the citizens as the 50 State legislatures deem best, and that if a State provides greater protections to its citizens than are provided under

whatever law the Congress eventually enacts, the additional protection ought to be•ought to remain in effect, thus, providing a

Federal floor but leaving the states to establish the ceiling.

I thank you for this opportunity and for your consideration.

The CHAIRMAN. Thank you very much. I think we will go down

through the statements and then I will have questions.

The CHAIRMAN. MS. O'Donnell.

Ms. O'DONNELL. Thank you. Good morning, Mr. Chairman, and

thank you for this opportunity to address your committee on the

confidentiality of medical information.

My name is Meg O'Donnell, and I am currently the director of

quality assurance and consumer protection for the division of

health care administration which is part of the Vermont Department of Banking, Insurance, Securities and Health Care Administration. In this and my previous position as general counsel to the

Health Care Authority, I have been interested and involved for a

number of years in the issue of ensuring the confidential handling

of individually identifiable health care information.

First, I want to say that we are very proud that Vermont's two

senators have been so involved in this issue and addressing this

critical issue on the national level. We are pleased that the work

continues and very pleased that we have this opportunity to address you at today's hearing.

Vermont is not unique in its current approach to medical records

confidentiality. As Representative Koch I think amply illustrated,

we have a hodgepodge of laws that provide some protections, but

certainly not the comprehensive protections that Vermonters can

and should expect in the area of their medical records.

The division has for some time now recognized a need for broad

legislation that will comprehensively govern how medical information is collected, used and maintained. Our involvement in this

issue is based in part on the division's own need for clinical data

to carry out some of our legally mandated activities. For example,

the division contracts with the Vermont Program for Quality in

Health Care to develop Vermont specific practice guidelines which

requires an understanding of how health care has been delivered,

and that depends on medical records. Another example is the division's oversight of managed care plans. By law, we are required to

audit such plans at least once every 3 years. Those audits must include a review of a selected number of medical records in order to

ensure that plan practices comply with our regulations.

Vermonters must have confidence that the Division of Health

Care Administration and other public entities engaged in similar

work are handling their records with the respect, security and confidentiality they expect. While I believe that most health care providers, facilities and insurers in Vermont are already setting and
6

abiding by high standards in handling their medical information,

the public's confidence can only be increased by setting a benchmark standard that all people and organizations who have access

to medical records must legally comply with.

To that end, the division has supported the efforts of the Vermont legislature over the past 4 years to pass a comprehensive law

setting basic standards for how confidential medical records are

used.

But even if Vermont succeeds in passing one of the bills presently before it, a State-by-State approach to medical records confidentiality will not solve all of the issues. Health care is no longer

a matter that fits neatly within State borders. Again, Vermont is

an excellent example of this. 40 percent of the patients seen at

Dartmouth-Hitchcock Medical Center actually live in Vermont.

Similarly, many Vermonters have sought or will at some time seek

care even further afield at centers of excellence located in Boston,

in New York, in Cleveland, in any number of other states. The reality of the health delivery system today is that it is a multistate

system. So no matter what one State, like Vermont, accomplishes

in protecting its residents' medical records, those protections will

not stretch as far as those medical records are likely to travel.

Thus, while we continue to support Vermont legislation in this

area, we strongly support action on the part of the Congress on this

critical issue. Only Federal legislation can ensure that all confidential medical records receive the same basic protections no matter

where in the United States they are located, used or transmitted.

Any such legislation must strike a balance between privacy

rights of individuals and the legitimate use of individually identifiable information in delivering and paying for health care services

in research and in overseeing the quality of today's health care system. Essential ingredients of such legislation include, and I will

just list them very briefly, patients' rights. We believe that individuals should have primary control over disclosure of their health

care information. Standards for releasing identifiable health care

information. Standards for maintaining identifiable health care information. And as importantly, if not more importantly, effective

sanctions.

Let me reiterate a concept that the division considers essential

to any proposed legislation, and I apologize, I have not had a

chance to read S. 578 so I cannot speak in any detail about that.

The CHAIRMAN. I understand, Ms. O'Donnell.

Ms. O'DONNELL. In the desire to protect individuals' medical

records from unnecessary release or use, we must ensure that legitimate uses can continue without undue burden. From a regulator's perspective, for example, this includes the ability to review

medical records as necessary to carry out my legal responsibilities.

A good law will allow this use, but will also establish strong sanctions for any misuse or abuse that could result.

We look forward to the opportunity to review and comment in

more detail on S. 578, and I thank you again.

[The prepared statement of Ms. O'Donnell follows:]
PREPARED STATEMENT OF MEG H. O'DONNELL

Thank you for this opportunity to address the Committee on the confidentiality

of medical information.

My name is Meg O'Donnell, and I am currently the Director of Quality Assurance

and Consumer Protection for the Division of Health Care Administration, part of the

Vermont Department of Banking, Insurance, Securities and Health Care Administration. I was formerly the General Counsel to the Health Care Authority, which

became the Division of Health Care Administration in 1996 as the state consolidated its regulatory oversight of health delivery systems and insurance companies

in Vermont In both positions, I have been interested and involved for a number of

years in the issue of ensuring the confidential handling of individually-identifiable

health care information.

First, I want to say how proud I am that Vermont's two senators have been at

the forefront of addressing this critical issue on the national level. I am pleased that

this work continues to be a focus of their offices and this Committee, as evidenced

by today's hearing.

Vermont is not unique in its current approach to medical records confidentiality.

While many, if not most, consumers believe that their medical records are uniformly

subject to tight legal restrictions on how they can be used, Vermont in fact has a

medley of laws that address only bits and pieces of the issues. For example, we have

a Hospital Bill of Rights that protects medical records of inpatients, and our managed care oversight program has regulatory provisions that govern how managed

care organizations handle their patients' confidential records. But these and similar

provisions do not provide the comprehensive protections Vermonters can, and

should, expect.

The Division has for some time now recognized a need for broad legislation that

will comprehensively govern how medical information is collected, used and maintained. Our involvement in this issue is based on the Division's own need for clinical

data to carry out some of its legally mandated activities. For example, the Division

contracts with the Vermont Program for Quality in Health Care to develop Vermont

specific practice guidelines, which requires an understanding of how care has been

delivered in the past•and that depends on medical records. Another example is the

Division's oversight of managed care plans. By law, we are required to audit such

plans at least once every three years. Those audits must include a review of a selected number of medical records in order to ensure that plan practices comply with

our regulations.

Vermonters must have confidence that the Division of Health Care Administration and other public entities engaged in similar work are ha. 'Mng their records

with the respect, security and confidentiality they expect. While i believe that most

health care providers, facilities and insurers in Vermont already set and abide by

high standards in handling medical information the public's confidence can only be

increased by setting a benchmark standard that all people and organizations who

have access to medical records must legally comply with.

To that end, the Division has supported the efforts of the Vermont legislature over

the past four years to pass a comprehensive law setting basic standards, for how

confidential medical records are used.

But even if Vermont succeeds in passing one of the bills presently pending before

it, a state-by-state approach to medical records confidentiality will not solve all of

the issues. Health care is no longer a matter that fits neatly within state borders.

Vermont is an excellent example of this, forty percent of the patients seen at the

Dartmouth-Hitchcock Medical Center, which is located across the border in New

Hampshire, actually live in Vermont. Similarly, many Vermonters have sought or

will at some time seek care even further afield, at centers of excellence located in

Boston, in New York-, in Cleveland, in any number of other states. The reality of

the health delivery system today is that it is a multistate system. So no matter

what one state, like Vermont, accomplishes in protecting its residents' medical

records, those protections will not stretch as far as those medical records are likely

to travel.

Thus, while we continue to support Vermont legislation in this area, we strongly

support action on the part of the Congress on this critical issue. Only federal legislation can ensure that all confidential medical records receive the same basic protections no matter where in the United States they are located, used or transmitted.

Any such legislation must strike a balance between the privacy rights of individuals and the legitimate use of identifiable information in delivering and paying for

health care services and oversee in the quality of today's health care system. Essential ingredients of such legislation include:
8

• Patients' rights. Individuals should have primary control over disclosure of their

health care information. Those rights should include the right to consent to disclosures before they are made, except in certain defined circumstances specifically authorized by law, the right of patients to see their own health care records and to

receive copies of them without being charged excessively high fees, and the right

to correct health-care records that contain wrong information.

• Standards for releasing identifiable health care information. Those standards

should clarify and codify the circumstances under which health care providers and

facilities may release health care information without the individual's consent, and

establish a general prohibition against disclosing or re-disclosing identifiable health

care information without a consent or specific legal authority.

• Standards for maintaining identifiable health care information. The law should

establish basic standards for maintaining the securit;' and confidentiality of health

care records, whether by a health care facility, provider or insurer.

• Effective sanctions. Legislation must include effective enforcement tools.

Let me reiterate a concept that the Division considers essential to any proposed

legislation. In the desire to protect individuals' medical records from unnecessary release or use, we must ensure that legitimate uses can continue without undue burden. From a regulator's perspective, for example, this includes the ability to review

medical records as necessary to carry out my legal responsibilities. A good law will

allow this use, but will also establish strong sanctions for any misuse or abuse that

could result.

We look forward to the opportunity to review and comment in more detail on any

proposed legislation that the Committee will be considering.

Thank you.

The CHAIRMAN. Thank you very much. It is very helpful.

Mr. Palmer.

Mr. PALMER. Thank you, Senator. Thank you for this opportunity

to address this important issue. I would like to indicate for the

record that the airlines ate my testimony. My testimony is in a

suitcase in Philadelphia. [Laughter.]

The CHAIRMAN. That may be helpful there. [Laughter.]

Ms. ARANOFF. Air passenger's Bill of Rights theory?

Mr. PALMER. Air passenger's Bill of Rights. I will be submitting

my written remarks shortly, but first of all, I wanted to address

the fundamental issue of why I am testifying; that is, that for the

past 2 weeks we have tried to identify someone living with HIV in

the State of Vermont who will be willing to testify on this subject.

Given the public nature of this hearing, all of the people that we

work with on a regular basis have declined this opportunity. That

is how important confidentiality is to people living with HrV.

So I am put in the position of reporting that on a regular basis

people living with HIV are faced with making health care decisions

based on what the record is ultimately going to show; who is going

to get that record. That is a barrier to health care. And I believe

that your legislation moves in the right direction in providing, as

Representative Koch has indicated, a Federal floor. And I would

encourage you•in support of Representative Koch's position, I

would encourage Federal legislation to be the floor and to permit

states to build over, above and beyond that floor.

I think it is important to recognize that people live with life

threatening and chronic illness and with those illnesses also including a great deal of judgment about their lives and their own personal judgments, it is important that•that their health care be

something that is above and beyond the probing of outside experts.

It is important to recognize that that barrier to care has prevented and adds an additional burden for someone who may be the

victim of a sexual assault from accessing the kinds of care that are

in that survivor's best interest because of fear that at some future
9

point an employer accessing those records can find out that that individual sought testing around HIV and was treated. Not because

of any action taken by that individual but because it was in their

best interests to protect their health and safety. That is just one

example of how important it is to maintain the confidentiality of

records, particularly when it comes to employment situations.

It is important to establish in the law that employers need to

make decisions on employment as people living with HIV go back

to work, as your•as another bill that you have advanced addresses. As they go back to work, it is important that employers make

decisions based on the individual's qualifications and ability, not on

their medical past. And I encourage that that kind of issue be addressed in your legislation. And I thank you for the opportunity to

address you today.

The CHAIRMAN. Thank you. Ms. Aranoff.

Ms. ARANOFF. Good morning, Senator. I also would like to thank

you and acknowledge the hard work that you have done over the

years to bring this issue of medical records and the need for confidentiality to the attention of Congress, and the work that you did

last year to introduce a bill, and I understand you recently reintroduced a new bill, that has, I think, really moved this issue forward.

And I know that you have galvanized a lot of this attention that

you have received at the Statehouse here in Montpelier as well. So

I want to thank you for all your work on that issue.

Before I begin my testimony, on behalf of Vermont Protection Advocacy I want to share with you a story that was my first introduction to this issue of medical records confidentiality. And we were

asked to try to find a person whose life has been affected either by

not being able to get access to their own medical record or by a

breach of confidentiality of their own medical record. And in 1992

when I was an attorney in private practice, by just a fluke of nature the Vermont Lawyer Referral Service sent my office a case

that involved a woman, she is now deceased. And this is all a matter of public record, and I think if she were here, she would either

be sitting here today or saying, yeah, go ahead and tell my story

because it was a really compelling story and it illustrates the need

for this exact legislation.

This woman was a Vermonter, and she had one of those childhoods that we read about. But you actually meet someone who has

experienced sexual abuse by relatives, placement in foster care,

sexual abuse by foster parents, ending up at Brattleboro Retreat

for many drug overdoses, alcohol issues by the time she was 19,

and then being released from Brattleboro Retreat to an interim,

like halfway facility called Spruce Mountain Inn here in this area,

receiving some treatment at Spruce Mountain Inn and then being

discharged presumably into the community which she ended up

homeless•at the point when I met her she was 22, and she was

living next door to her mother in a duplex in Plattsburgh, New

York. She was taking care of her mother who had lung cancer and

was in the very end stages of a long and painful illness.

And in the course of taking care of her mother she was doing

routine things like cleaning the house, vacuuming and stuff like

that. She was vacuuming under her mother's bed 1 day and saw

a stack of papers and went to move them and realized that they
10

were her treatment records from both the Brattleboro Retreat and

Spruce Mountain Inn. And she panicked because at facilities•at

mental health facilities a lot of times what goes into a treatment

record are the person's own handwritten statements. This was

around the time when David Letterman came out with his top ten

lists. So she had a lot of top ten lists that were assignments. The

top ten things I am most ashamed of, the top ten things I have

never told anyone, the top ten reasons I am mad at my mother.

Her mother was dying of lung cancer caused by cigarette smoking,

and this woman was really pissed that her mother smoked her

whole life and was going to be dead by the time she was 25. And

that was like her top ten reason for being mad at her mother.

In the top ten things that she had never told anyone and was

most ashamed of was a lot of this history of family sexual abuse

and other kinds of abuse that she had never told her mother. And

so there she is cleaning and there she discovers that all of this very

sensitive, very•well, I will leave it at sensitive information that

she had provided to treatment providers that she had trusted had

been released to her mother.

Her mother died within 6 months of that, and during that time

they tried to deal with some of these issues, but it kind of complicated her grieving process with her mother. She came to my office wanting to know, could she sue over this. What•did she have

any recourse? In the course of doing this litigation, we ran into

issues like definition of medical records. None of this information

that she provided•none of this information that was released, the

stuff that really caused her harm, was written by a provider. It

was not a provider's treatment notes, it was her own statements,

and it was not necessarily about a medical condition. So the definitions that we have in the bill that is under consideration in Vermont and in DC. would not necessarily capture this information

that was created in the course of receiving treatment and stored

and maintained by a treatment provider and released by the treatment provider, would not necessarily be within the definition of

medical information.

Perhaps, you know, significant to an attorney, but I think to others as well, is the definition of harm and the fact that when there

is a release of this type, there is very little recourse right now. We

need like significant penalties for negligent releases as well as intentional releases. But because she was a person living on disability, and because she did not have lost wages, and because it is hard

to quantify the injury to a mother-daughter relationship, you know,

the 6 months•the last 6 months of that person's life, she did not

have really good damages, you know, from like a litigator point of

view. And so•and there was no other penalty to kind of capture

that case.

So anyway, that was a lesson of that litigation. The need for remedies, the need for definitions, the need for•the other thing we

learned about both of those facilities was they had no policies or

procedures in place for how they treat the journals, and diaries and

assignments, writing assignments that they give their patients.

They did not have policies as to whether or not they considered

that medical information, whether or not they released that. The

patient kept it in a file, anything like that. And how long they
11

would keep it for, and what they would do•who they would send

it to when they could not find anyone. In this case she was homeless, they did not have a known address. They sent it to her mother.

A lot of people would think what is the big deal, but when it happens to someone, it can be a really big deal. Her mother had no

knowledge. So since I have used up most of my time telling that

story, I will hit the high points of my testimony.

The CHAIRMAN. Could you speak a little louder? Imagine you are

talking to the back of the room instead of to me. I understand that

is hard. There are a number of people here who would like to hear

from all of you.

Ms. ARANOFF. Our agency is federally funded to assist people

just like the person I described, people with diagnoses, labels, history of mental illness who are receiving residential care. We keep

statistics on the number of•on the issues that come up and the

cases that we handle as well as on the issues in the cases that we

do not handle but that we provide information, referrals and services to.

In 1997, 1998 and to date in 1999 we have had a total of 28 clients with•these are clients, not information referrals, these are

people we have actually opened up cases for who have had issues

around their medical records. Fifteen of those have been breaches

of confidentiality and 13 of those have been access•access issues.

And the access issue is probably the overarching issue for our clients. Very often they are denied access entirely. Sometimes their

access is restricted.

And I brought with me a copy of this letter that is dated February 24th, 1999, so this is recent. This is what happens today

when someone asks for their treatment notes. It is from Counseling

Service of Addison County, and the response to a person's request

for their record is to say, first, we need to meet with you to go over

the record together before you can copy anything to take. And I will

be glad to schedule a meeting with you, but in anticipation of this

meeting, please let me know the reason for your wanting these

records.

Now these kinds of hurdles might get placed in the way of people

with other kinds of conditions other than mental illness, but they

are constantly placed in the way of people who want their mental

health treatment records. Sometimes it is an outright denial for

that category, and the bill that was first introduced in the Vermont

legislature would have sanctioned a denial of records access for

people with mental illness. Access issues are key.

Along with the outright denials of records, there are other kinds

of obstacles, and one of those is financial. Brattleboro Retreat

charges $1 a page for copying. We have a client whose record from

a 30-day stay is estimated to cost more than $1,500 just to get a

copy of a record, and that is not an expense that insurance will reimburse. The State Hospital, which is supposed to under Vermont

law charge only 4 cents a page, routinely charges 50 cents a page.

When you are there for 30 days, you know, 60 days, that kind of

cost can become quite prohibitive. We think that everyone should

be entitled to one free copy of their record, and that if their record
12

is needed for a benefits case or something like that, that it should

be free as well.

In addition to access issues, the other complaint•the other situation that affects our clients most is confidentiality. One of the

most common things•it shocks me all the time that I can call up

on the phone and talk to insurers and treatment providers about

someone's mental health treatment and I am not even asked if I

have a release, let alone asked to potentially fax the release. This

happens to me in my office I would say easily five times a week.

And I think that those kinds of things happen.

I have a written statement that has addressed these issues in

more detail and, again, I thank you for your time and attention to

this issue.

The CHAIRMAN. Thank you for an excellent statement. Let me

welcome Senator Leahy. We have worked together for about 24

years now in Congress and the Senate, and it is a pleasure, let me

tell you, to work with Pat. We are on an issue here, for instance,

where we have, at least he argues, a joint jurisdiction. [Laughter.]

But, anyway, that is not up to me to decide.

Senator LEAHY. We certainly have a joint interest.

The CHAIRMAN. We certainly have a joint interest, which is the

important thing. We have looked at his work, and it has been very

helpful to us in our work. Pat, pleased to have you here.

Senator LEAHY. Thank you.

The CHAIRMAN. DO you have an opening statement?

Senator LEAHY. I would be happy to wait for the panel if you

would like, Jim. Whatever you want. You are the chairman.

The CHAIRMAN. I think I will give you a chance perhaps after we

question the panel.

Senator LEAHY. OK. Have you finished the panel?

The CHAIRMAN. We have finished. Why don't you talk right now.

HON. PATRICK J. LEAHY, A UNITED STATES SENATOR FROM

THE STATE OF VERMONT

Senator LEAHY. I will. Thank you.

The CHAIRMAN. I may have some questions.

Senator LEAHY. I do want to say how happy I am to be here. I

mean, Jim and I have been partners on some of these things longer

than most people have lived in Vermont, I guess, been married or

something. [Laughter.] And so it is good to be here with good

friends and fellow Vermonters. And when one of them is the chairman of the U.S. Senate Health, Labor, Pensions Committee, that

helps even more.

Mr. Chairman, you and I introduced separate legislation, as you

mentioned, last week to protect the privacy of medical records. We

did this because we have a deadline. We have to have medical privacy legislation by August 21st of this year, and if we do not do

it, then the Secretary of Health and Human Services does it. And

I think this is far too important an issue to just go administratively. Jim, you and I support the same values, and I know in the

end we are going to work together to pass a strong bill that is

going to protect American families.

This is a time we have to worry about privacy. We see some

states selling license photos. I must say I am very pleased that
13

Vermont declined to do that. Our leading chip and computer companies have built in a secret identifier so every time you use your

computer they can find out where you went and nobody is told that

that is in there.

In February, Jim, you and I held a hearing on home health care

in Vermont. One person testifying brought the information of new

regulations by Medicare and Medicaid called OASIS, and this requires home health agencies to gather very sensitive, personally

identifiable information on all of their patients. The thing that

struck me is they said on all of their patients, whether their claims

are being paid by a government program or privately. I am very

concerned about State and Federal governments compiling this

kind of a personal database of sensitive personal health information, and I will be writing to Secretary Shalala to ask about this.

It seems to be greatly overreaching to say we want this information

on everybody whether we are paying for it or not.

It seems that both Big Brother and Big Business are trying to

get at our most sensitive personal information, and I think that

what it comes down to, if you have a medical record, you have a

medical privacy problem.

Most of us think of our medical records being held in a manila

file folder under the health care provider. When I walk in here I

always stop by, there is a bill that is framed over here, it was a

bill from when I was born at the Heaton Hospital. I hasten to add,

Jim, the bill was paid [Laughter.] It is not a past due account, but

I see Dr. Mclntyre's picture on the wall, the man who delivered me.

The fact is, it is not that way anymore.

When I was chairman of the Technology and Law Subcommittee

of the Judiciary Committee I went into the privacy of medical

records and new technologies. We found out good news and bad

news. The good news is that we could do so much more for rural

areas because of technology. The bad news is the information that

is in there. One woman who testified told about going to a doctor

for severe depression, and she was actually contemplating suicide.

Got the proper medical care, obviously did not commit suicide, was

helped with her depression. She was an immigrant. It is not the

sort of thing she wanted to discuss in her family. To her shock her

medical records were printed in the newspaper. Somebody took

them. No laws were violated. And I asked her at the hearing, if you

had known your records were going to become public, would you

have sought medical help that you obviously needed? And she said,

no, I would not have. And she might not have been alive. Instead,

she is now a member of the House of Representatives and•U.S.

House of Representatives and extremely well respected in there.

So we have to worry that if confidentiality is compromised it is

going to deter people from seeking medical treatment or else stifle

technological or scientific development. We should not fear the new

technology. We should remember the technology is our servant and

do not let it become our master.

In 1996 alone the health care industry spent an estimated 10 to

$15 billion on information technology. Insurance companies want to

know about your genetic makeup and health status so they can anticipate what diseases you will get later in life or whether they will
14

insure you to begin with. Pharmaceutical companies want to know

what diseases you have so they can market their products to you.

But the question comes down who conl ols that information, us

or them? And if you are concerned about where it goes, that may

reduce the willingness of patients to confide in physicians or other

practitioners. Now I think the computerization if done right can ensure more privacy to individuals in the current system if we have

strong medical privacy legislation, but if we do not, you have a

great potential for embarrassment.

A few weeks ago The Wall Street Journal wrote about a company

that is seeking the mother load in health data mining. The company wants to get medical data on millions of Americans to sell to

any buyer, and currently there is no laws preventing that. That

can be your information, any one of you, as part of that data gold

mine.

Last year an article in the Washington Post described the story

of a woman whose prescription purchases were tracked electronically by a pharmacy benefits management company two states

away hired by her employer. Now when she used her card she got

a discount. She thought that was great. What she did not know,

all the sensitive information was being compiled, and her doctor

was told that she would soon be enrolled by the company in a depression program and she would be watched for continued use of

antidepression medication. She had been getting something for

sleep and yet the company two states away who would interpret

her medical records that she did not even know they had anyway,

they decided that she was•better be watched out for because of

her depression. This is wrong.

University of Illinois study found 35 percent of all Fortune 500

companies regularly review health information before making hiring decisions. And the health care providers are told they are constantly pressured to give out the most sensitive information to

these companies or they will lose their own jobs. In genetic testing

at the National Institutes of Health, 32 percent of the people who

were offered in tests for breast cancer declined to take the free test.

Why? Because they were afraid of who the information would be

given to. Just stop and think about it. A test that could save lives,

and they declined it because they are afraid of what might happen.

So, you know, the only•we can not let privacy slide the point.

The only way for a person to ensure confidentiality is to avoid seeking medical care. We have got 159 days to correct this, and let me

say I applaud you, Jim, for•you and your committee for being

such strong leaders in this. I think we will put together a bill. I

think we will have a bipartisan bill. I think we will have a strong

bill. I think if we do not, health care and privacy will both suffer

in this country. So thank you, Mr. Chairman.

[The prepared statement of Senator Leahy follows:]

PREPARED STATEMENT OF SENATOR PATRICK LEAHY

I am especially pleased to be here today with my good friends and fellow Vermonters, one of whom happens to be the Chairman of the U.S. Senate Health, Education, Labor, and Pensions Committee (HELP).

Mr. Chairman, you and I introduced separate legislation last week to protect the

privacy of medical records. We support the same values and I believe, in the end,

we will work together for passage of a strong bill to protect American families.
15

At a time when some states are selling driving license photos and information•

which I am very pleased that Vermont has decided not to do•when our leading

computer chip and software companies have built secret identifiers into their products to trace our every move in cyberspace without our consent, it is time for Congress to wake up to the privacy rights and expectations of all Americans before it

is too late.

In February, Mr. Chairman, you and I held a hearing on home health care in Vermont. One person testifying brought up the issue of new regulations by Medicare,

called OASIS, requiring home health agencies to gather very sensitive personally

identifiable information on all of their patients.

I repeat•on all patients•whether their claims are being paid by a government

program or privately. I am very concerned about State and Federal Governments

compiling a database of sensitive personal health information. I have been in contact with the Administration about this issue and will soon be sending a letter to

Secretary Shalala to get to the bottom of it.

It seems that both Big Brother and Big Business are vying to get at our most

sensitive personal information.

The trouble is this: If you have a medical record, you have a medical privacy problem.

Increased computerization of medical records and other health information is fueling both the supply and demand for our personal information. We should not fear

new technology, but unless we are vigilant, it will overwhelm our privacy rights before we even know what has happened. Technology is our servant; we should not

let it become our master.

The debate boils down to a fundamental question: Who controls our personal information, and how freely can others gain access, buy and use it? We must not let

privacy slide to the point that the only way for a person to ensure confidentiality

is to avoid seeking medical treatment.

We have 159 days to enact a strong Federal medical privacy law. With the clock

ticking toward the deadline set by Congress of August 21, 1999, let us act sooner

rather than later. Mr. Chairman, I look forward to working with you on this very

important issue.

The CHAIRMAN. Thank you. That is an excellent statement, Pat,

and will be very helpful to us. We will be marking up our bill sometime in the not-too-distant future. I know we will be working with

you as you have some excellent ideas in your bill. Ours•Senator

Dodd and I put my bill in, so we have a bipartisan bill to start

with. We are pleased to have you stay as long as you can.

Senator LEAHY. I would like to stay for a while if I might.

The CHAIRMAN. Tom.

Senator LEAHY. I know a number of the witnesses here. I look

forward to hearing them.

The CHAIRMAN. On the issue of preemption, are you concerned

that establishing a Federal ceiling would constrain State legislatures from enacting their own legislation?

Mr. KOCH. Yes. What would the point be if we have a federally

uniform rule and State legislatures are preempted? It is a very

complex subject matter, and that is why the bill has failed in the

past two bienniums. It is the fifth year we are working on it, and

what happens is that everybody has an interest in it and you end

up with a real Christmas tree. And everybody has a special interest

that, you know, they all come in and they want something added

to it, and it gets very complex.

Federal uniformity I think is an easy answer, but I am not persuaded that it is the right one. I think states can often deal with

their particular situations. But at the same time, we have a serious

situation, and both you and Senator Leahy have outlined that very

well, that needs attention at the Federal level. And I certainly hope

that you do get a bill through here before August.
16

The CHAIRMAN. The legislation that I have introduced would give

18 months after enactment for states to establish stricter confidentiality rules. Would that be OK, or is it a problem for you?

Mr. KOCH. I do not think it will be a problem for Vermont because I think we are going to get this through if not by the time

we adjourn this year, then by the time we adjourn next year. I

mean, what happened here as far as I am concerned is I saw the

bill fail in the last 2 years, I was not there the previous 2 years,

and I said, what this bill needs is a shepherd, and so we are starting it in the House.

I do believe that the House Judiciary Committee is going to be

working on it rather quickly. I think we will get it through the

House this year, probably in the next few weeks, although the next

few weeks on our agenda is extremely busy. Then it will go over

to the Senate which is already working on it. Helen Riehle's committee, Senate Health and Welfare, has been looking at it, and so

they are prepared for it. I am also told that it is the simplest version that has been around in the last 5 years because they did try

to strip out some of the Christmas tree ornaments.

One of the things that we took out was the right to deny•in the

health and welfare version we took out the right to deny mental

health information to an individual because that individual may be

injured in the doctor's opinion. And we heard from a lot of mental

health advocates who said we have a right to see our own information. We do not need to be super protected from people who think

that we cannot handle it. And our committee agreed with that, and

we took that out of the bill.

So it is a fairly stripped down version that we have, but we think

it provides good protection for the people of Vermont.

The CHAIRMAN. Meg, does that provision in our bill, do you

think, give you enough time to react?

Ms. O'DONNELL. I would agree with Representative Koch. Because Vermont has been looking at this issue so intensively for so

many years, we are in a better position than some other states

might be to react within that 18-month window, and that is, as I

understand it, 18 months after the Congress would adopt this. So

that is an even longer period. And I think for us that that would

be ample time to accomplish something on the State level.

The CHAIRMAN. Mr. Palmer.

Mr. PALMER. I think that that does represent adequate time

given all of the work that the legislature has done already, and I

would reiterate my strong support for committing the states to do

that because we in Vermont are very aware of the kind of confidentiality issues we have given the size of the State, and the number

of people who live here and the closeness of all of us, that confidentiality around these issues is really important. And what is needed

in Vermont may not be needed in California or Montana, but it is

needed here. I think we are the best at being able to carve out the

kinds of protections that we need locally.

The CHAIRMAN. MS. Aranoff.

Ms. ARANOFF. I think I would defer to the legislators and regulators who would have to be meeting that 18-month deadline. If

they feel comfortable, then I am sure that is accurate. I do know
17

that they have been working industriously for at least 6 years on

this issue. So I am sure they could do that.

The CHAIRMAN. I guess this is more for Meg, but I think all of

you can comment. What sanctions do you think are appropriate for

those who violate patient confidentiality, and who should be responsible for enforcing those sanctions?

Ms. O'DONNELL. I am chuckling a little bit because I have seen

all range of sanctions in the various bills before the Vermont legislature. The original version that was introduced in January of 1995

included I think the full range that I understand is in your bill

which includes civil remedies, a civil action and criminal sanctions.

And those were windowed down over time I think over a concern

as to how much was needed to enforce.

I think the core of the sanctions has to be a civil right of action;

that an individual who feels that he or she has been harmed by the

use or misuse of their information have an opportunity to go into

court and to fight it out there and get some remedy if, in fact, there

has been misuse or abuse.

I think that it is also appropriate to look at maybe some kind of

a higher remedy, whether it is a civil one enforced through the

state's attorneys, or the Attorney General's Office, or perhaps even

criminal sanctions, that are keyed in to more of the motivation behind misuse or abuse. Typically a lot of the model legislation we

have looked at will include heightened sanctions in terms of heightened fines or even the penalty of imprisonment for multiple misuse, for misuse that is motivated by trying to get money or to harm

somebody. And I do think that that is appropriate, and that is

harder to put into a personal civil action.

So I would say that a broad range of sanctions is probably the

most appropriate. I think we have to be cautious as to how you peg

the crime or the civil remedy to what has happened because what

you do not want to do is set up a system where a health care provider, for example an institution like Central Vermont Medical

Center, is put under an obligation to do a broad range of things

with their medical records to ensure confidentiality, finds itself in

a position of having one employee who maybe mistakenly does

something and then they find themselves on the hook for a large

penalty or a large fine. I think you do have to be cautious that

there is going to be probably some involuntary or some unknowing

violations of this law, especially in the first couple of years as people are getting used to new ways of doing business.

The CHAIRMAN. Tom.

Mr. KOCH. I generally agree with what Meg had to say, and particularly her last comments about not coming down too hard on

people who unintentionally make errors. We all make errors, and

they are likely to continue. We do need requirements that organizations that maintain records develop procedures so people are aware

of what is required. And I read in one of the other statements that

I believe you will be hearing later this morning a suggestion that

we have not had before our committee, but I think I will offer to

the House Judiciary Committee when I appear before them on this

bill and would suggest for your consideration, making it clear that

a person who intentionally or maybe substantially violates someone's confidentiality in handling records, that that is legitimate
18

grounds for immediate dismissal. And I think if you make it clear

that somebody's employment is at risk, you will get compliance.

And it will also eliminate some litigation after a dismissal is imposed because, you know, if you do not say it, you will find a lawyer who will say it was wrong to fire that person for that reason.

The CHAIRMAN. Mr. Palmer.

Mr. PALMER. On that issue in particular, running a small organization that does have control over confidential information, we

have confidentiality policies that protect those records. And if an

individual staff person violates those policies, they are subject to

immediate termination. I think that works in small settings, but

when we are dealing with multistate corporations as Senator

Leahy talked about and large employers, I think it is important to

maintain the right of individuals whose confidentiality has been

violated to civil action. And I think it is also important given the

size of some of the employers and health care record organizations

to also have criminal penalties involved because it would be easy

for a client of Vermont Cares to take Vermont Cares to court because it is a much more even playing field. We do not have attorneys on staff waiting to handle any kind of complaint, but large

corporations and large manufacturers and employers would have

that kind of protection. And I think it is important to protect the

individual's right. So criminal penalties I think are also important.

The CHAIRMAN. MS. Aranoff.

Ms. ARANOFF. I would just like to add that I think it is very important that nominal damages, in other words, damages just for a

violation, be allowed and attorney's fees be allowed for the simple

fact that this particular area of harm is very difficult to prove. You

know, even in some of the more egregious violations, the medical

information that is sold to pharmaceutical companies for marketing, if you receive something in the mail saying, hey, there is a new

treatment for X, Y and Z, which is something that you have, you

receive that because your information was wrongly released, it is

going to be hard to say how you were harmed by receiving notice

of new treatment for your condition. Where is your damage? But

I think that prosecuting civilly violations of these kinds of laws is

a consumer protection function, and there has got to be some inducement for attorneys to take these cases when the damages are

going to be either impossible to quantify or not very high.

So I think attorney's fees are very important, and nominal damages would be very important.

The CHAIRMAN. Pat.

Senator LEAHY. Ms. Aranoff, if you got the brochure that says

you can get 40 percent off on this generic, you have been buying

this other, and we will argue that there is a benefit. Conversely,

if it is promotion for a company and your employers look at this

and say, well, they may be genetically disposed to breast cancer,

prostate cancer, whatever else, so we are not going to promote it,

or you are seeking insurance and similar•life insurance, similar

things are given, though there would be no question in your mind

what the damage was, I would assume?

Ms. ARANOFF. Yes. If you can establish you missed out on a promotion when you were hired initially, you would have a good case

for damages.
19

Senator LEAHY. And in sensitive health information, and it could

be mental health; it could be reproductive health information; Mr.

Palmer, it could be information you handle at Cares, the bill that

I have put in specifically allows patients to restrict what kind of

information can be released from their records. Is that something

that you think makes sense?

Mr. PALMER. I think it is absolutely essential for individuals to

have control over what pieces and parts of their medical records

are made available. I think the system has to be structured in a

way that by saying that I do not want my HIV status disclosed, by

saying that I do not want it disclosed, that I am not disclosing it

in that form itself. So I think that the•that how the program is

structured, how your control over your medical records is structured has to be in a way that protects your confidentiality right

from the very beginning.

Senator LEAHY. It is not directly related, but I think of the number of times in our military, for example, when somebody did not

seek help for alcoholism, partially because they are afraid they

would not get their promotion. I saw cases similar to this in law

enforcement when I worked in law enforcement, and it bothers me.

Tom, I was glad to hear your comment about needing a guardian

angel or shepherd on this, and I think it is absolutely important.

I mean, everybody•if you ask 12 people walking out of here, do

you think you ought to have some privacy in your medical records,

of course they will all say yes. It is a long way from there to a bill

that is workable, enforceable and makes sense. And one of the debates we will have in the Congress will be on the question of preemption and how much a Federal law might preempt State law. It

is something that when you come from a small State like ours you

are, I think, particularly sensitive to.

How do you feel about a law which•a Federal law that sets a

basic floor but allows a State at any time, either before or after,

to set a tougher law on disclosure if they feel it is necessary to•

if the legislature of that State feels it is necessary to protect the

people of that state?

Mr. KOCH. I was the first member of the panel to speak, and I

spoke before you got here, and essentially that is the concept that

I did endorse, that we have a Federal floor and that states be allowed to extend greater protections. In answer to Senator Jeffords'

specific question, I responded essentially that I think 18 months is

probably sufficient time for us to act on this bill. But things change

over time, and the situation may come up that Vermont wants to

extend some protections to 5 years from now, and if the Congress

does not act, then Vermont would be powerless to act. So my statement was directed essentially to the issue of Federal preemption,

and I would prefer that we set a minimum Federal standard and

allow the states to extend greater protections to their citizens

if

Senator LEAHY. YOU will not be surprised if I tell you I agree

with you completely on that one, and that is written out well in the

bill. I wish I had heard the earlier part of it. I was shoveling out

of Middlesex a little bit earlier this morning, although this•when

I watched the news this morning, Jim, they are saying light snow,

accumulations of no more than two to four inches. In Washington
20

when they are expecting two to four inches they break into the

news every 2 minutes with trailers. [Laughter.] They have got people out, they film the first snowflake coming down to get the appropriate level of panic on the people. [Laughter.]

Thank you very much.

The CHAIRMAN. On the other hand, Mr. Palmer, just to get to the

reason that we need to have transfer of information a little bit into

the equation here. For instance, suppose you have HIV and you do

not want that disclosed, but non-disclosure could mean getting

some pharmaceutical treatments, drug treatments, which might

be•create an adverse drug reaction. How do we handle that problem?

Mr. PALMER. Well, I think that one of the realities we have

learned through the course of the epidemic is that individuals living with life-threatening diseases have themselves a responsibility

to take care of their health care. And if we were to just rely on the

system, we are not going to protect ourselves. So I would err in

favor of letting the individual have responsibility for keeping themselves informed, not using information about them to inform them.

I think that the ownership of the information needs to be the patient, not a system. If I have a condition that I am aware of, I am

responsible for tracking the treatment that should be available to

me. I do not want big pharmaceutical companies, I do not want big

medical providers, I do not want my employer to provide me information about the best course of treatment for me.

The CHAIRMAN. That is a partial answer. What I am thinking of

is this: suppose you are taking certain medications for HIV and

that is not disclosed, at the same time, another physician is treating you for something else without knowing about the HIV drug.

A certain drug combination could cause an adverse, maybe fatal reaction; how do you protect against that?

Mr. PALMER. Well, I think that there are a number of safeguards.

Again, in working with your primary care physician, it is your responsibility along with the physician to•to identify your entire

course of treatment and what medications you are in fact taking.

I do not•again, I would err on the side of the individual patient

and physician to have that responsibility to track what interactions

might or might not occur, not to have some electronic system controlled by somebody else knowing more about me than I know

about myself advising me what kind of course of action I should be

taking.

The CHAIRMAN. Ms. Aranoff, what single issue involving confidentiality is of most concern to the mental health community?

There are many of them.

Ms. ARANOFF. There are so many of them. The issue that comes

to our attention most in the office is the issue of disclosures to family members and people that the person is associated with without

any kind of release and often against the person's will. In fact, it

is the policy of many of the community mental health centers and

it is the policy of the State Department of Mental Health to include

family members on people's treatment teams, what they call treatment teams, and to•and they have a memo out that says•and

this does not violate confidentiality laws.
21

And I worked with a client who was being discharged from the

State Hospital into the community, and the community based provider would not take her•would not provide the services to her,

services that the state's obligated to provide, unless she would

allow her family members in on the conversation and in on her

treatment and to have access to her treatment. And that kind of

coercion to violate confidentiality and that kind of routine disclosure to family members, without the bill that is before Senator

Koch's (sic) committee, Vermont statutes specifically allow health

care information about people who have been committed to be released to family members. And very often it is the patient's position

that it is the family members that are either responsible for their

conditions or responsible for them having been in the State Hospital to begin with, and they are the exact people that they do not

want in on their information. So I would say that that is the issue

that we receive the most complaints about.

The CHAIRMAN. Thank you. I just want to make a comment on

the other side of the question which we have to be aware of, and

that is the importance of the ability to trade information in outcomes research to determine how we can better treat patients. We

have to weigh that balance, and it is not easy to do.

But also as Senator Leahy, I think, pointed out earlier, with

modern technology, information transfer can be done very selectively. You can get the core information you need in order to improve treatments and to determine how well treatments work, in

very sophisticated ways, by passing data that are not relevant.

One of the things we are considering at the Federal level in the

large amount of information transfer occurring now. This fall, we

are probably going to be linking up with Europe concerning all

sorts of treatments being used around the world now, and the outcomes of various treatments moreover to encumber the free flow of

useful information between hospitals across State lines could actually have adverse effects on the health of our Nation's citizens. So

it is not an easy issue, and you all know that.

I assume, Tom, you are aware of that. Let me ask you this about

the transfer between New Hampshire and Vermont for instance.

How are you handling that?

Mr. KOCH. I believe that•well, that is one of the problems that

I would hope that the•you would take reins on. It is•once the information goes across the State lines, we do not have true jurisdiction, and it is difficult. We have enforcement problems, although

we probably have a minimum context jurisdiction in a civil action.

And I do not know what New Hampshire is doing, frankly. I really

cannot give you a good answer.

The CHAIRMAN. OK. I would draw from that that there is a role

for the Federal Government to play

Mr. KOCH. Absolutely. Absolutely.

The CHAIRMAN. •in some sort of uniformity and in some system

to maximize the beneficial utility of information.

Mr. KOCH. Or as I suggested, giving effect to the originating

State's law which might have a definitional problem.

The CHAIRMAN. Senator Leahy.

Senator LEAHY. NO, I have nothing further. Thank you.

The CHAIRMAN. YOU are the next panel.
22

Senator LEAHY. And I have already spoken. [Laughter.]

The CHAIRMAN. All right. Thank you very much. Very helpful. I

would like to reserve the right to ask you further questions in writing if you do not mind, because this is an extremely important

issue for all of us. And my number-one concern is Vermont. So I

do not want to do anything at the Federal level which will inappropriately interfere with your work, and I want especially to keep in

close touch with you, Tom, as you progress. That's also true of the

other members of the panel. Thank you very much. Very valuable

testimony.

Our next panel is Leigh J. Tofferi, director of government and

public relations at Blue Cross & Blue Shield of Vermont. Leigh, if

you will come forward. He currently develops public policy and also

has primary responsibility for liaison with State and Federal legislative bodies, governmental agencies, news organizations, and the

public. Wow.

Prior to joining Blue Cross/Blue Shield, Mr. Tofferi served four

terms in the Vermont House of Representatives. Thank you for

being here.

I would also like to introduce Ms. Anne Cramer who is a partner

in the Burlington law firm of Miller, Eggleston & Cramer, Ltd. In

her private practice she represents hospitals, nursing homes, physician groups, and various private groups in Vermont. Today she is

representing the Vermont Association of Hospitals and Health Systems. Among her professional accomplishments, Ms. Cramer was

one of the four original drafters of proposed comprehensive legislation addressing the collection, use, and disclosure of confidential

health care information introduced in the Vermont legislature in

1995.

A welcome to you, and we are fortunate to have you here today.

Appreciate it.

I am next pleased to introduce Madeleine Mongan, who is here

today representing the physicians, residents, and student members

of the Vermont Medical Society. Welcome, to you.

Please proceed.

STATEMENTS OF LEIGH TOFFERI, DIRECTOR OF GOVERNMENT AND PUBLIC RELATIONS, BLUE CROSS AND BLUE

SHIELD OF VERMONT, MONTPELD3R, VT; ANNE CRAMER,

VERMONT ASSOCIATION OF HOSPITALS AND HEALTH SYSTEMS, BURLINGTON, VT; AND MADELEINE MONGAN, COUNSEL AND DIRECTOR OF GOVERNMENT RELATIONS, VERMONT MEDICAL SOCHCTY, MONTPELIER VT

Mr. TOFFERI. Thank you, Mr. Chairman. I am testifying today as

a representative of the state's largest private health insurer

The CHAIRMAN. Excuse me. I want to ask you all to speak up because we have an overflowing crowd here which is kind of•so aim

at them and speak to me. [Laughter.]

Mr. TOFFERI. I am representing the state's largest private health

insurer and the only health insurer domiciled here in the State of

Vermont. Blue Cross & Blue Shield of Vermont provides health

care benefits to approximately 190,000 Vermonters in every category of health insurance: The individual market, small and large

group, Medicare supplemental benefits, the state's safety net pro-
gram and for Medicaid recipients through a contract with the

State. I thank you, Mr. Chairman, for the opportunity to express

our views about this important issue.

Blue Cross & Blue Shield of Vermont considers the confidentiality of the subscribers' medical records to be of prime importance.

The plan has a strict policy in place to protect subscriber privacy

but which also allows an efficient process to administer health benefits and pay medical claims.

Currently our plan certificates of coverage include a provision

clearly stating the plan's right to obtain the information necessary

to administer benefits and resolve grievances. By accepting this

contract, the subscriber agrees to allow the plan to obtain the necessary information to process claims and perform functions such as

utilization review. In return, the plan agrees to pay for claims

under the terms of the contract.

This agreement provides the plan with sufficient authority to

gather the information necessary to perform the functions we all

expect of a health care plan. The plan recognizes its responsibility

to protect this information and employs tight controls on information it obtains.

The release provision in the certificate of coverage includes our

subcontractors as entities that may receive medical information.

However, the plan protects the use of that information through provisions in its own contracts with those subcontractors requiring

them to comply with its protections for medical information.

We also have a strict employee confidentiality policy in effect.

This policy covers internal communications of health care information, external communication in response to customer service inquiries and external communications of statistical health care information. This policy also covers retention and disposal of records

and any other instances governing the use of medial information.

All employees are briefed on the confidentiality standards of the

plan and sign a statement acknowledging that they understand the

plans confidentiality policy.

We will only release medical information to the patient or person

specifically authorized by the patient and then only with a release

from the attending physician or medical provider. The plan may

provide a spouse or family member with benefit information but

will not release medical information without written authorization.

Although our current standards have worked well, we support

the concept of a clear and concise approach to medical confidentiality. We have worked with the Vermont legislature as it has considered these issues over the past few years, and we also look forward

to working with you.

In that regard, we have adopted three principles to guide us

when discussing this topic. First, legislation in this area should

balance the protection of consumers' personally identifiable health

information with the needs of the health care industry to deliver

the best possible service. Second, each person or entity in the

health care chain must be required to fully participate and assist

in ensuring the protection of individually identifiable information.

Third, legislation for access, use and disclosure of this information

must be clearly defined to avoid misapplication, misuse of the law.
24

We have also identified some key issues that could adversely impact our ability to function if not appropriately addressed. Authorizations for disclosure and use of protected health information for

health plan functions should not be required. For health plans this

might include payment, credentialing, fraud detection, disease

management, utilization review, etc. If, however, authorizations for

health plan functions are required, a single authorization at the

time of enrollment for these purposes for the life of the relationship

between the insured and the insurer should be the rule. Preferably,

the law would provide by statutory authorization or deemed authorization to be granted at the time of enrollment.

Special protections should not be created for sensitive categories

of health information, for example disease-specific information. Any

legislation should protect all types of individually identifiable

health information equally including genetic information.

Individuals should be allowed to review and copy their protected

health information from entities that collect, transmit or process

this information, but health plans should be allowed to require a

provider release before issuing records through an insured member.

Any new confidentiality law should recognize and appreciate that

health care is local. Any enforcement structure established by any

Federal confidentiality law should, wherever possible, link national

and State, local resources.

Finally, any penalties should clearly define the behavior that

constitutes a violation. Further, they should be consistent with the

threshold/intent standards and penalties established in current

law. The penalty structure should allow for the opportunity to take

corrective action and should establish intermediate sanctions. Enforcement should not include private right of action or punitive debarment from Federal programs.

We look forward to working with you on this important issue,

and thank you for giving me the opportunity to express our views.

The CHAIRMAN. Thank you very much.

Ms. Cramer.

Ms. CRAMER. Thank you, Mr. Chairman. I am here today and

testifying on behalf of the Vermont Association of Hospitals and

Health Systems. We have 16 member hospitals in the State of Vermont, 14 are acute care institutions; in addition, the Brattleboro

Retreat and the Veterans Administration Center.

This is an issue that has been very important to us. We have

been long looking to have a void filled. As a slight digression, when

I moved to this State in 1985, my law partner, Marty Miller, said,

ah, some people would like us to give a seminar on medical records.

Why don't you do it. It will be a good way for you to get to know

the State. So I started doing some research and found out that I

was really going to be making a lot up, that the medical records

law on the books did not cover nearly any of the scenarios that had

been painted to me as being important questions to the clients that

we were working with both in hospitals and patient offices.

We thank you on behalf of the association for this opportunity to

testify and work with both of you. We are grateful that this is a

priority, and we have•also want to just make sure that there is

not any misunderstandings I think as to our efforts at the State

level as well as our really strong desire that there be uniform pre-
25

emptive Federal legislation that defines the scope of patient rights

as well as the obligations of all of us who either generate, store,

transmit or use confidential health information.

Since 1993 there has been a pretty extensive effort at the State

level to draft legislation. The Hospital Association, as it was known

then, was very much in the middle of it trying to make sure that

we fill this void, that we define what information is actually covered; that there is standards for what is an appropriate authorization; we define circumstances where it is appropriate to have information disclosed without an authorization; that we establish firmly

the rights of the individual to copy their records, to access their

records, to correct or seek to comment on them.

Additionally, as we have moved into the electronic age, the security standards are something that we are all looking to have uniform so that we make sure we are designing these expensive information systems in the right manner. And, indeed, we also believe

there should be serious penalties for wrongful disclosures.

We have worked at the State level and we still continue to work

with Representative Koch, and we hope that, indeed, a bill can be

passed at that level. This is a difficult issue, and as much as we

are hopeful that between now and August you can accomplish your

work, we feel that this is a race to at least get the void filled. We

would, however, prefer to have Federal legislation, and we would

like it to be preemptive, both as a floor and a ceiling.

The hospitals and doctors today work in an interstate environment. They seek tertiary care out of State. Lab results, lab testing

goes out of State. We are back and forth across State lines constantly for the care management of patients. As much as we would

like to keep this as an intimate Vermont relationship, it is not. And

our biggest concern is that if you put the type of tough penalties

in place that should be in a law of this caliber, that if we have

states with varying standards, all for good reason and all, I think,

trying to do the best things for their own population, that we are

going to be in a situation where we cannot comply, that we will be

violating the law. We will be in a catch 22 where we violate a New

Hampshire law but it complied with perhaps Federal and Vermont.

So from this standpoint I think this is an area that I know there

is a lot of•there is a lot of hard work that you do not want to deny

at the State level. On the other hand, health records mean a great

deal in a lot of different aspects of society and our ability to continue to deliver and improve the quality of health care that we deliver, that this really is something that needs Federal preemption.

The other area that I would like to just address briefly today is

we do not believe there should be special rules for special diseases.

We are very sympathetic with the AIDS community, but as we

have gone on and talked with our patients, there needs to be one

standard. And there is no question that all of us need to improve

our culture of confidentiality, so whether or not it is a pregnancy

or an HIV, there is a very strong standard that this is personal information and it needs to be protected and respected.

We also are weary and really do not support any type of effort

of a patient block from one provider to another. Although for some

areas you may not think that the mental health notes may be relevant to a primary care physician, there is a lot of different steps
26

in health care delivery, a lot of different scenarios we cannot always anticipate. And to have some artificial blocks put in place

both makes it very difficult to manage the record and it also creates potential where we are not going to be able to give the care

that is appropriate.

So I thank you, and I look forward to working with you.

[The prepared statement of Ms. Cramer follows:]

PREPARED STATEMENT OF ANNE CRAMER

Mr. Chairman, I am Anne Cramer, a lawyer with the law firm of Miller, Eggleston & Cramer which serves as legal counsel to the Vermont Association of Hospitals and Health Systems ("VAHHS"). VAHHS has sixteen member hospitals which

include fourteen acute care facilities, the Brattleboro Retreat and the Veterans Administration Center in White River Junction.

On behalf of VAHHS, I thank you for this opportunity to testify on the extreme

importance of enacting strong, uniform and preemptive federal legislation defining

the scope of patient rights and the obligations of all who generate, store, transmit

or use confidential health information. Health care delivery at our member hospitals

necessitates the involvement of interstate providers and payers and requires that

health information be regularly transmitted across state lines for such purposes as

obtaining tertiary care, lab testing, care management, quality assurance review and

long term care services. Federal confidentiality legislation must set a national

standard, which is both "the floor and the ceiling", for protecting patient privacy

while ensuring that information is available for patient treatment.

Currently, neither federal nor Vermont law addresses the confidentiality of health

care information in an appropriately comprehensive manner. In particular, Vermont's present law, 12 V.S.A. Sec. 1612, consists of a simplistic statement of the

patient's privilege against unconsented disclosures of health information which is

virtually impossible to apply to the hundreds of scenarios where access to health

information is sought for a multitude of purposes beyond the delivery and financing

of health care services.

To address longstanding concerns relating to the privacy and management of

health information, in late 1993, VAHHS participated in an effort initiated by an

organization then known as the Vermont Health Information Consortium

("VHIC")•a private nonprofit organization funded by a grant from the John A.

Hartford Foundation•to explore the development of a statewide health information

system. As part of that process, VHIC conceived a set of fundamental health information privacy principles to serve as a basis for the development of legislation for

introduction and adoption by the Vermont General Assembly. I was one of four individuals who worked to draft comprehensive health information legislation for Vermont on the basis of these fundamental principles. The first bill was introduced in

the Vermont legislature in January of 1995 and sought to accomplish the following

objectives:

1. Define the scope of health related information entitled to confidentiality;

2. Provide a standard for an appropriate written patient authorization for disclosures;

3. Establish the circumstances under which health information could be disclosed

without a patient's authorization;

4. Establish the rights of an individual to obtain copies of his or her own medical

records or seek to correct or comment upon them;

5. Establish standards for how health information should be maintained, secured

and retained by health care facilities and providers;

6. Establish damages and/or penalties for violations of this legislation.

This proposed Health Information legislation has received extensive review, revision and debate in every year of each of three biennial sessions of the Vermont legislature since 1995. Today two comprehensive bills are under current consideration.

VAHHS and its member hospitals have been very supportive of state legislation

to fill the existing statutory void and patchwork of court precedent. As health care

professionals and institutions are required to better manage the cost of delivering

health care, electronic information systems have increasingly been utilized to collect,

sort and transmit pertinent health information. While these information systems

offer greater opportunities for delivering a higher quality of health care, they create

new problems for potential misuse and breaches of security. Clear standards for the

operation and security of such systems is imperative.
27

It is our preference that federal, rather than state, legislation be enacted so that

all patients are protected uniformly across state lines since Vermont's health care

delivery system delivers care to residents of other states and is extensively integrated with providers and third party payers in other states. Federal legislation

must be designed with the following tenets:

1. It must preempt state law so providers can rely on uniform standards and are

not faced with trying to comply with potentially inconsistent or conflicting requirements. In this regard, federal confidentiality legislation must be the "floor and ceiling" of standards with no more than an occasional specific exception, perhaps for

public health reporting.

2. The requirements must consider the realities of our multifaceted health care

delivery systems and not serve to prevent the appropriate flow of health information

between individuals treating a patient. The notion of a patient "block" preventing

certain providers from accessing and using health information during treatment is

untenable. Health information must be fully available for diagnosis and treatment

services. Special disclosure rules for special diseases also has the potential of prohibiting the appropriate flow of information to health care providers when it might be

most needed. It is imperative that there be a single standard of confidential.

" this oppoi

ticipating in a more detailed discussion with the Committee focused on the goal of

We thank you for this opportunity to set forth our views and look forward to parpassing federal legislation which protects patient confidentiality and promotes the

efficient delivery of high quality health care through a uniform national standard.

The CHAIRMAN. We look forward to working with you.

Ms. Mongan, please proceed.

Ms. MONGAN. Thank you. Good morning. Senator Jeffords, Senator Leahy, my name is Madeleine Mongan. I am counsel and director of government relations for the Vermont Medical Society,

and I thank you for the opportunity to speak to you on behalf of

the approximately 1400 physicians, medical students and•physicians residents and medical students who are members of the medical society. And thank you for coming to Vermont and holding this

hearing and for making this a priority issue for both of you both

introducing legislation.

My remarks are going to be based on a formal position that was

adopted by the Vermont Medical Society Council in October of

1995. We have been working on this issue for a long time, and we

are excited to see it, we hope, making progress on both the State

and the Federal level.

Because the physician-patient relationship is based on trust, the

medical society believes that the confidentiality of communications

within this relationship is essential to high quality medical care.

Privacy of medical records is ingredient to this ability to trust your

physician or your other health care provider. And in order for physicians to provide the best and most appropriate medical care, patients must feel that they can disclose to their physicians personal

facts and information that they would not want others to know.

Without assurance of confidentiality, patients may not provide the

information that their doctor needs to properly diagnose and treat

the patient.

Now the second factor leading to the importance of this issue at

this time is, as you know, the evolution of electronic medical data.

This has intensified concerns, although I agree with other speakers

that have said this may create the ability to provide greater confidentiality rights. It has intensified concerns, particularly with the

linking of various databases.

The Medical Society believes that Vermont's patients will benefit

from the adoption of Federal legislation and State legislation that

protects the confidentiality of medical records. We have some cri-
28

teria for this legislation. It should clarify patient and provider understanding of their rights and responsibilities. As Anne said, when

we first began looking at this issue, it is•in Vermont the laws are

a mish-mash or a hodgepodge.

We are looking•also consistent with Ms. Cramer's statement, we

are looking for a law that will create consistent nationwide standards for confidentiality of medical records that will apply in all

health care settings. We are hoping that confidentiality will be able

to be protected with minimal increases in bureaucracy for physicians who are burdened at this time by paperwork and bureaucracy, and we are also hoping that confidentiality legislation will be

sufficiently flexible to adjust to future changes, both in medical

care delivery and in record keeping processes and electronic data.

The legislation should include a fair time frame for implementation

and should be premised on the assumption that a law governing information practices cannot guarantee confidentiality. Protection

must•real protection has to result from creating, as others have

said, a culture of confidentiality and educating record keepers, providers and others who deal with this information on the•both the

clinical and the ethical importance of privacy.

Now I will speak briefly on the preemption issue. We, as I said,

are looking for a consistent national confidentiality standards, and

we think health care is not confined within a set of State boundaries. Vermonters travel to our border states regularly. They travel

to other states to get specialized medical care. And we have physicians who are practicing•southeastern Vermont is one example

where I know of some physicians who have offices in three states,

in Massachusetts, in New York and in Vermont. And they may be

seeing patients from any of these states in any of these offices on

any 1 day based on the schedules of the patients and the physicians.

We think that if there are different confidentiality requirements

imposed by different states, potentially they could be inconsistent

and this could create a tremendous burden for physicians in other

health care facilities. Medical records need to move with patients

to ensure quality health care and should be subject to the same

and I would say a high level of protection regardless of whether the

patient is in Montpelier getting treated for a sore throat or is in

Pittsburgh receiving a heart transplant.

Others have mentioned telemedicine which is another cross State

lines issue which is important for rural health care in Vermont.

And final point on this is the various number of Federal and

State programs that physicians participate in with potentially inconsistent standards. To the extent that the standards can be the

same for all programs, that would be I think helpful to both patients and to physicians.

Now I would like to digress from my written statement for a

minute to offer a few comments on S. 578 which I received Saturday.

The CHAIRMAN. Yes. Please do.

Ms. MONGAN. OK. We are very supportive in general of the legislation. We are very happy to see it introduced. In Title 1, Subtitle

A, and this goes along with my statement, we are very supportive

of the provisions governing patients access to their records. We also
support an exception to that access in situations where there is

danger to health, life, and this is from the bill, the language in the

bill, the exception in the bill, if there is danger to health, life, physician's safety or if substantial mental harm would result. I trunk

it is important to have that exception. We have a similar exception

in Vermont law and other states which allows physicians to inform

victims•identified victims if there is a risk of harm•a threat of

a risk of harm to that identified victim. So I think this is a similar

kind of exception that we need that will be used very rarely but

needs to be there as a safety valve. And I know that is important

to physicians in Vermont.

We also support the ability of patients to amend their records.

We have a concern about the 30, 45 and 60-day time lines, and

that concern is that there should be a good cause exception for

those rare cases when these time lines could not be met.

And as far as the notice of confidentiality practices, this imposes

some bureaucracy for physicians, but it does say that the Federal

government is going to create a model notice which would be helpful and that physicians can either choose to put it on the wall or

to hand it out or provide it to patients which gives them an option.

So we are generally supportive of that.

In Subtitle B we support the safeguards but have a very small

concern•the safeguards require the person keeping the record to

maintain the accuracy of the record, and that might not be possible

in all cases. There could be some inaccurate information that gets

into the record from•maybe the patients do not provide the history

quite correctly. And so we are concerned about that becoming a

mandate in view of the penalties.

On the disclosure tracking provision, we understand that the details of this will be promulgated by rule, but our concern is that

the tracking be very simple and straightforward, particularly for

disclosures, okay, among physicians. I will be able to submit the

rest of these comments to you.

[The prepared statement of Ms. Mongan follows:]

PREPARED STATEMENT OF MADELEINE MONGAN, ESQ.

Senator Jeffords, Senator Leahy and members of the committee, my name is Madeleine Mongan, I am Counsel and Director of Government Relations for the Vermont

Medical Society. On behalf of the approximately 1,400 physician, resident and medical student members of the Vermont Medical Society, I appreciate the chance to

comment on the issue of medical records confidentiality and thank the committee

for holding this hearing in Vermont and devoting the time to discuss this important

issue. My remarks are based on the Vermont Medical Society's Position on Access

to Confidential Health Care Information which was formally adopted by the VMS

Council on October 28, 1995.

Because the physician-patient relationship is based on trust, the Vermont Medical

Society believes that the confidentiality of communications within this relationship

is essential to high-quality medical care. In order for physicians to provide the best

and most appropriate medical care, patients must feel that they can disclose to their

physicians personal facts and information that they would not want others to know.

Without assurance of confidentiality, patients may not provide the information necessary for proper diagnosis and treatment to their physicians.

The evolution of electronic medical data has intensified concerns about access to

patients' confidential medical information. Concerns regarding the transmission and

aggregation of electronic data are amplified by the practice of linking information

across data bases.

The VMS believes that Vermont's patients will benefit from the adoption of federal legislation that protects the confidentiality of medical records if the legislation:

• clarifies patient and provider understanding of their rights and responsibilities;
30

• creates consistent nationwide standards for confidentiality of medical records

that apply in all health care settings;

• enhances confidentiality with minimal bureaucracy;

• is sufficiently flexible to adjust to future changes in the medical care delivery

system and in consent and record keeping processes;

• establishes a fair time-frame for implementation of any significant changes in

current access laws; and

• is premised on the assumption that a law governing information practices cannot guarantee confidentiality: such protection will result from educating record

keepers on the clinical and ethical importance of privacy.

Consistent National Confidentiality Standards

Health care is not confined within any one set of state boundaries. Vermonters

travel regularly to health care professionals practicing in our border states•New

Hampshire, New York and Massachusetts•to receive health care. They travel even

farther to receive specialized services. Likewise, many physicians practicing in Vermont treat patients in other states; some have offices in two or, in the case of southeastern Vermont, even three states. In view of the mobility of health care delivery,

the imposition of different confidentiality requirements, potentially inconsistent, created by different states, on physicians and health care facilities could create a legal

and bureaucratic nightmare. Medical records need to move with patients to ensure

quality health care, and should be subject to the same level of protection regardless

of whether the patient is being treated in Montpelier, Vermont for a sore throat or

receiving a heart transplant in Pittsburgh, Pennsylvania.

An increasing number of physicians in Vermont are participating in telemedicine

initiatives, that make it possible for them to consult and treat patients in remote

and often rural locations, both inside and outside of Vermont. Additionally, regardless of where they provide care, Vermont physicians participate in a number of federally operated or funded programs that each have their own rules and standards.

Because of the increasing complexity of the health care system, a clear set of consistent confidentiality rules that apply across state lines, across all federal and state

programs and across facilities is of critical importance to physicians, and the future

of the health care system. Confidentiality rules should not impede the efficient delivery of health care.

Purpose of the Medical Record

The primary purpose of the medical record is to provide a reliable tool for clinical

diagnosis and treatment of patients. Medical records must be accurate and complete

in order for patients to receive high quality medical care. While patient privacy is

of vital importance to high quality medical care, this need for confidentiality must

be balanced with the need to ensure that the medical record is accurate and complete. In that regard, the VMS cannot support including a provision in the law that

would allow patients to limit or block the transfer, among health care professionals,

of information that is necessary to provide medical treatment. Such blocks on the

transfer of records could lead to duplication of tests or treatment. More important,

because patients are not necessarily aware of the consequences of limiting access,

limiting information could result in harm to patients through adverse drug interactions or unforeseen complications.

Provider to Provider Record Transfers

It is a physician's duty ethically and legally to provide medical information on a

patient to another provider when the information is reasonably necessary to provide

Health care services to that patient. A physician's failure to provide a record to a

subsequent physician or hospital constitutes unprofessional conduct which could result in loss of license. While such transfers do not require the explicit consent of

a patient, implied consent is presumed to exist when a patient seeks the services

of another physician or hospital. When consent is not clearly implied physicians customarily seek written permission from the patient.

The VMS can support a patient's right to ask their provider to refuse to disclose

certain parts of their record to another provider only if:

• such a block on the record can be structured to insure that the receiving physician is aware of the block and can freely elect not to treat the patient;

• the licensing board acknowledges that such a block is an exception to the implied consent regarding transfers to subsequent physicians; and,

• the physician is protected from medical malpractice suits arising out of a block

on the record.

Sensitive Information

Patients must be treated as whole individuals. Sensitive information about all aspects of the patient's history and treatment that is necessary for treatment must

be available to physicians. Legislation should ensure that the confidentiality of all
31

health information is protected. Creating a different level of protection for certain

health care conditions implies that all information is not subject to equal protection.

Information concerning sensitive conditions such as HIV or mental health can be

necessary for treatment purposes and should be maintained as part of a patient's

medical record. Segregating sensitive information that is necessary for treatment

could impede quality treatment. Likewise, a separate release form should not be required for certain types of information. A provision that limits release to information necessary to accomplish the purpose of the disclosure is sufficient to ensure

that extraneous information is not released.

Paperwork Burden

Physicians are already overburdened by paperwork. Any confidentiality bill

should be designed to reduce rather than increase bureaucracy. While the VMS supports the patient's right to know when a record transfer has occurred, it does not

support creating a bureaucratic tracking system, particularly for small rural providers. Physicians should be able to document disclosures, particularly to other providers, in the patient's chart, and should not be required to maintain separate and detailed documentation of disclosure. This is an area in which legislation must be

flexible enough to await the time when the technology is in place to track records

movement without undue red tape.

Patient Access

Patients should have access to a copy of their medical records to assist them to

understand their health status. Any limitations on the patient's ability to obtain the

actual record should be narrow and in the patient's best interest. If it is determined

that access to the record will endanger the patient or others, the patient must have

recourse such as:

• receiving a summary of the record;

• obtaining a second physician's opinion;

• appealing the decision.

The statute must be clear that the patient may obtain all of the record regardless

of whether the content was:

• authored by their own physician or other staff;

• from the hospital;

• from a previous physician; or

• inclusive of comments made by a third party•for example a family member.

This change in access practices must be carefully implemented with an effective

date which gives providers sufficient time to conform to new procedures. The law

should be clear that records collected prior to the effective date are grandfathered

allowing providers the option of summarizing records prepared previous to the effective date.

Access to a patient's record includes access by a parent or guardian to a minor's

record; however, minors must have the right to block parental access to their

records if the records contain information on treatment or procedures to which minors have the legal right to consent.

Record Ownership

While a medical record is about a patient and the patient must have open access

to that information, the owner of the record must be the person who is primarily

responsible for:

• ensuring that the record is accurate and current;

• deciding what recording methods are used written, taped, video recording, or

computer retrievable;

• implementing security measures;

• establishing consent and disclosure protocols;

• preserving the record;

• ensuring that the record is maintained in a manner which enhances appropriate

medical care.

The VMS advocates for legislation which is centered around the patient-physician

relationship.

Amending The Record

After reviewing medical information, a patient may disagree with the physician's

conclusions or may have a factual correction to make. In either case, the patient

should have the right to add a notation. The record owner may also disagree with

the conclusions of a consulting physician or may find that a statement made as. fact

was later found incorrect. Neither the record owner or the patient may erase or

cross out the original record, but both may make notations. Notations should be reasonably brief.

Access to the Record Without Authorization
32

There are a number of instances under existing law by which a medical record

should be made available to someone other than the patient or the owner without

consent assuming the disclosure follows reasonable confidentiality protocols:

• in a peer review process;

• in a medical emergency to a provider or family member if the patient is incapacitated;

• to meet infectious disease or cancer registry reporting requirements;

• when a state agency is fulfilling its obligations to investigate insurance or workers, compensation claims.

Access by Researchers

At a minimum, legislative change is needed to assure that researcher's access to

confidential information used for research purposes is controlled by an Institutional

Review Board which shall consider whether the confidential records can be traced

back to the patient; the degree to which the research process or outcome could have

an adverse affect on the participant; and federal laws limiting access to mental

health and substance abuse records.

Release Under Court Order

The law should make clear that a physician shall not transfer a medical record

after receipt of a subpoena until either:

• the patient signs a consent form; or

• a court order is issued.

In that event, a physician shall release relevant records to the appropriate parties

in a timely fashion. However, a physician must retain the right to appeal a court

order on the basis that release of a complete copy of the medical record would be

injurious to the patient.

Consent Forms

The law should establish minimum requirements for the content of consent forms

including the following:

• the need for and proposed use of such information;

• a statement indicating specifically the type and extent of information to be released;

• a statement that such information will not be given, sold, transferred; or in any

way relayed to any other person or entity not specified in the consent form or notice

without first obtaining the individuals additional written consent on a form stating

the need for the proposed new use of such information or of the need for its transfer

to another person or entity;

• the duration of the consent; and

• the patient's-signature attesting to understanding the implications of the consent.

Security

The record owner is responsible for keeping the records secure from inappropriate

access and must follow appropriate protocols including stringent security measures

applicable to all staff whether the records are kept on paper, tape, video or computer. Patients should have the right to know what form of record keeping is employed by their provider and the security measures followed to maintain privacy.

Where confidential health care information is in computer-retrievable form such

information shall be subject to the following minimum measures:

• security clearance available only to authorized individuals;

• identified individual responsible to maintain security procedures; and

• prohibition on contractual limitations of liability for breaches of confidentiality.

Penalties

Civil and criminal penalties should be sufficientlv large to deter intentional and

knowing violations of this Act. Stiff penalties should also apply to anyone who obtains an individuals confidential health care information through the commission of

a crime. However, we are concerned about awarding liquidated damages for negligent conduct.

Thank you again for the opportunity to speak on behalf of the physicians of Vermont. The VMS would be happy to review and comment on privacy legislation that

comes before the committee. The physicians of Vermont are grateful that this committee has made the privacy of medical records a priority issue.

The CHAIRMAN. Yes. We want to very much. The people who control my life tell me we are running out of time here. [Laughter.]

Ms. MONGAN. Thank you for the opportunity.

Senator LEAHY. YOU have to understand that United States senators are merely constitutional impediments to their staff. [Laughter.] They run everything. [Laughter.]
33

Senator LEAHY. It is true.

Ms. MONGAN. Thank you.

The CHAIRMAN. YOU can say that, Pat. I would not dare. [Laughter.]

Senator LEAHY. It is going to cost me, I know. [Laughter.]

The CHAIRMAN. Well, at this point a little off that subject though,

Pat and I realize that we have a certain responsibility to Vermont.

Senior as we are, Pat is the shadow chairman of the Judiciary

Committee, and I am, of course, chairman of the Health, Education, Labor, and Pensions Committee. It gives us an opportunity

to get together and to bring staffs up here to listen to Vermont and

their problems. It is a great advantage that we share, and we are

pledged to doing it as often as we can to make sure that people get

the maximum out of our capacities here.

Senator LEAHY. Like the one we had at the Statehouse back here

a couple weeks ago, two, 3 weeks ago about Medicaid. We try.

The CHAIRMAN. This is more in your territory. Why don't you

Senator LEAHY. If I could, Jim, only because I am going to have

to slip out for my flight.

The CHAIRMAN. Yes.

Senator LEAHY. Mr. Tofferi, you spoke about individuals having

a right to see, and copy and supplement health records and information. I know we talked about doctors and hospital records. What

about records on health information that is held by health insurers

like your own, should an individual have a right to seek, copy and

supplement those records?

Mr. TOFFERI. We do not have a problem with them seeing and

copying what we have. We would have an issue with them being

able to supplement it. One of the issues the health plan has is different than a medical provider themselves is we do not have the

entire medical record for that patient in our possession, and we

cannot make decisions that a medical professional could make in

certain cases who knows the entire medical record. So our preference is that we be allowed to let them see the record and copy

it, but we would also like to have the right•retain the right to require a release from the attending physician or medical professional that we can, in fact, release that information to the patient.

Senator LEAHY. I am wondering if you say you do not have it all,

would not that encourage you to ask them to supplement it? You

can make the judgment on what weight you want to give to a supplement, but suppose they said, well, now you have got this information about the cancer I had, but you do not have this further

information that I have got to have five different checkups all saying I am in total remission, etc., etc. I mean, you might say, okay,

fine, we will look at that, but we do not necessarily put a great deal

of weight on it because it is such a short period of time or whatever, but would that not be something that might be helpful to

you?

Mr. TOFFERI. We only want the minimum amount of information

necessary to perform the function. We are not looking to gather additional information. We do not want to be encumbered with storing it, retaining it and all of those kinds of things. Our interest is

making sure that we have the minimum but necessary amount of

information to actually determine whether it is a covered benefit
34

and we should pay it or not. If the patient is interested in knowing

what we have, we would be happy to give the patient that information with a release from a provider.

Senator LEAHY. YOU are somewhat unique in the fact you are

both an employer and I assume an insurer of some of the same people who work for you. Do you have a firewall to make sure that

your employees•or your employers, the supervisors and all, cannot

look at an employee's health record unless they are the ones that

are supervising the health care plan?

Mr. TOFFERI. Yes, we do. We have a very strict policy in that regard. In fact, we have a separate designated individual in our customer service area who our employees talk to if they have questions about their own benefits. And we are very attentive and very

strict about that.

Senator LEAHY. IS that basic industry practice or is that unique

to you? It makes a great deal of sense to me; that is why I ask the

question.

Mr. TOFFERI. I am only familiar with our own policies, but I

would be very surprised if other insurers handled it differently.

Senator LEAHY. YOU know, we ask these questions and it is easy

to bring up the horror stories as I did in my opening statement

where it is gone awry where somebody's health records have gone

out. The flip of that is we have the best health care system, I believe, in the country. And, Ms. Cramer and Ms. Mongan•am I pronouncing this correctly, Mongan?

Ms. MONGAN. That is correct, Mongan.

Senator LEAHY. When you talk about the patchwork, I am concerned about that. I mean, I know you cross from place to place.

You have different laws. My wife who is here is a registered nurse,

she is registered both in•she holds licenses both in Vermont and

Virginia. You go back and forth on these various things. I look over

to Mary Hitchcock or•people move around. Senator Jeffords and

I obviously•we have health care here in Vermont, but if something

happens when we are in Washington, we have health care there.

If we have a Federal floor, is not it possible to put a Federal floor

that evens out almost all of the patchwork but still allows the ability of a State who feels there is an overwhelming compelling purpose to have something stronger or does that create the very problems that you want to avoid?

Ms. CRAMER. I think we are at a time period where as you all

know, I am sure, health care is very, very regulated. And we have

a variety of type of people who work in a hospital, whether it be

the physician, whether it be a technician. So we are constantly

training people. And what our goal is so that compliance is as precise as it can be in the environment we work is to have simple, uniform laws. And the difficulty is we do get a lot of turnover. Right

now we have shortages in staff. You bring people in for a month,

you bring people in for 2 months. We have care that is crossing

lines, and it is difficult to always check.

Certainly if Vermont has key priorities, our hospital is routed

here, we will know that. Madeleine mentioned the notion of telemedicine. We are all embracing that a little bit more. It brings resources to the State and distributes those resources of those specialists we have here. Sometimes I look at it that we are on this
35

brink of paralysis sometimes in health care because every direction, we are trying to figure out how five rules sort together. And

I am concerned that confidentiality can raise yet another area. And

we believe that the penalty should be strong, and so we do not

want to have to look at making sure that we have got five states

coordinated when our physicians are traveling between New York,

and Vermont and Massachusetts.

Senator LEAHY. SO your answer to my question is no?

Ms. CRAMER. Correct. [Laughter.]

This is an unusual opportunity.

Senator LEAHY. Hey, that is all right.

Ms. MONGAN. And I could follow up on that no answer with

Senator LEAHY. I assume though one thing that may help you is

we get better software, better computerization and everything else,

but your answer would still be no?

Ms. MONGAN. Yes. And I think it is because in these laws, all

of these laws that I have seen at both the Federal and the State

level have•there are many small details in them. There are differing time lines, different lengths of time to keep records, different

standards for releasing records, the components of what has to be

in a release authorizing release of records. I think there is a lot of

potential in the details for standards to be different and then for

penalties to be imposed. So we are nervous about that, particularly

in the light of•I did not get to the penalty section, but in the light

of liquidated damages for violation for some these small violations.

So we are a little nervous about that.

Senator LEAHY. We will obviously look at all of these. There are

a number of competing bills now, competing and complimenting depending how one looks at it. And as I mentioned earlier on, we

have that August date. We either do it or it is going to be imposed

somehow administratively, and I really would prefer the Congress

do it.

I have to leave. We are having some problems in Washington

today. They fear snow more than•they fear the threat of snow

more than the reality of it, so I have to leave.

Jim, I want to thank you for having this hearing. Obviously you

are going to be one that everybody is going to be looking to in the

Senate on the issue. It is an extraordinarily important issue. And

this underscores something that Senator Jeffords said earlier, we

have an advantage in Vermont. We are 600,000 people. We have

got the same two senators as California, what do they have now,

35 million, people, and they do not have the opportunity to have

hearings like this. You also•in what you are saying though is not

just for Vermont. I mean, you become part of the hearing record

for the U.S. Senate, and it is in your answers and your statements

will be part of that record. And I think we are fortunate that Vermonters take so much time and pay so much attention. I think the

rest of the country benefits by it.

Jim, I thank you very much.

The CHAIRMAN. Thanks for dropping by.

Senator LEAHY. Take care.
36

The CHAIRMAN. Leigh, the Vermont Blue Cross/Blue Shield plan

includes a provision explaining its confidentiality practices. I read

it. Do you think a patient really understands what it says?

Mr. TOFFERI. I think our members assume that we have a very

workable, very tight policy in place. I think they have confidence

in our intent in this area. In addition to that, if any member has

a particular question, our customer service people are available to

go into greater detail. Also, providers who have questions, we have

a provider relations staff who can also give them more detailed information on this area. As well as our employer groups. We have

a group relations staff who can also provide group administrators

with more information on this.

So members may not have detailed information or a detailed understanding, but I think they assume that we have the appropriate

standards in effect.

The CHAIRMAN. MS. Cramer, in your testimony you State that

Federal legislation should subject all medical records to the same

standards and not provide special disclosures for specific diseases

or conditions. How do you suggest we address the concern that

mental health records should be at a higher level?

Ms. CRAMER. I think a lot of what we are struggling with are

breakdowns in the culture of confidentiality, and I think that there

is a lot more that can be done to look at how a medical•mental

health record in particular is structured. There have been a lot of

informal practices, the description of the notes be included and

then not being protected. And so that I think this is an area that

is slightly different than the average medical record, but I also

think that there are too many primary care providers that need to

use this information so that there is not a way to simply have the

State Hospital have a set of rules that are stricter and then have

individual physicians suddenly exposed to the higher rules. I think

we can do a better job in looking at the record, what should be in

the record and reconstructing it.

The CHAIRMAN. Thank you. I was the boss of your present boss.

Just let him know that I think he does a wonderful job in selecting

his fellow attorneys. [Laughter.]

Ms. Mongan, what single issue regarding patient confidentiality

is most important to the members of the Vermont Medical Society?

Ms. MONGAN. I think I get a number of calls about just the simple administrative issues from physicians, how long do I have to

keep records, how long do I have to keep them after somebody dies

and just kind of the•questions about patient's access to records. So

I do not know if that is the most important issue, but that is certainly something that physicians would like to have clarified so

that there is a clear legal answer, which in Vermont law we do not

have answers to a lot of those questions right now. So I think that

that is very important.

That is kind of the administrative issue. I think the philosophical

point is it is very important to the Medical Society that we protect

the confidentiality of patient's records so that that physician-patient relationship can do what it is supposed to do, so that the trust

is there between the doctor and the patient that leads to high quality health care.
37

The CHAIRMAN. Well, thank you, all three of you, for very, very

helpful testimony. As I told the other panel, we reserve the right

to come back to you with questions. I am sure you will cooperate

in providing answers. Deeply appreciate it. Very, very helpful testimony.

Mr. TOFFERI. Thank you.

Ms. MONGAN. Thank you, Senator.

The CHAIRMAN. Our final panelist is Dr. Andrew Gettinger representing Dartmouth-Hitchcock Medical Center in Lebanon, New

Hampshire. Dartmouth-Hitchcock is the teaching hospital serving

the Dartmouth Medical School, and over 40 percent of its patients

are here from Vermont. Thank you for testifying today.

Dr. GETTINGER. Thank you very much.

The CHAIRMAN. Please proceed with your statement.

STATEMENT OF DR. ANDREW GETTINGER, DARTMOUTHHITCHCOCK MEDICAL CENTER, LEBANON, NH

Dr. GETTINGER. I have submitted written testimony for the

record. Rather than reading the written testimony, I would like to

give you a sense of who I am as a physician, who we are as an entity in trying to provide health care across State lines.

There has been a lot of discussion already this morning about

preemption. Preemption is a complicated issue. We live in two communities where we have fierce protection for individual rights, community rights. It is town meeting season, and we do not give those

up without very, very good reason. I think this may be one of those

circumstances where there may be good reason.

I provide care to patients who co-exist across State lines. We

have defined our medical record as an electronic medical record.

Patients receive care concurrently in two states. We cannot distinguish between that care as abiding by rules of one jurisdiction versus another. I was very sensitive to the example of the physician

who has offices in three states and patients from all three and the

problems that that would entail in regards to preemption.

We believe there is also another aspect to preemption that we

would like you to think about; that is that part of our confusion

about confidentiality comes from the myriad of different rules and

experiences that people try and learn over the course of their lives.

I grew up in New York. I moved to Vermont. I then moved to

Connecticut. I moved back to Vermont. I now am a New Hampshire

resident, and I do not know what the rules are in each of those entities around the confidentiality of medical information. I am also

a teacher, so in preparation for this I went to three sources. I went

to my freshman seminar, 12 of the brightest young minds in the

United States from 12 different states. They all had different ideas

about their personal health information. They did not know. I went

to two other sources equally as qualified. I went to the Lime Country General Store on a Saturday morning, [Laughter] and I went

to the barber shop in West Lebanon, both locations with people of

great intellect. And the diversity of opinion about health care and

the confidentiality of medical information was astounding.

Federal preemption also gives us an opportunity to have a level

playing field to educate ourselves, to educate our population, our

public, and providers need that same level of education. I was very
38

sensitive to the testimony about having to recruit nurses, respiratory therapists from even outside the United States in order to

try and provide health care. We do the same thing.

I am also sensitive to the question you asked about what are

the•what are potentially mechanisms that we can put in place to

help protect health information. I think there are a variety of

mechanisms. I have suggested a couple of them in my written testimony, but I would like to emphasize two of them. The first is that

the patient, together with the clinician, physician, author of health

information, could in an electronic system identify that information

as of higher sensitivity. That would be a joint decision. A flag could

then be pushed in the electronic system and that access to that information may result in, first, a warning that this is of a higher

level of confidentiality; second, an E-mail back to the author of the

information; and third, a request to document why the other clinician needs access to that information.

We have done something similar to that by providing to every

employee at Dartmouth-Hitchcock Medical Center access to their

own personal health records audit trail, and each clinician who has

clinical privileges can as part of their routine day look at who has

access to their electronic information and where their paper chart

has gone. You know, we have this folksy image of a manila envelope with undecipherable physician encryptions that is absolutely

protected from any prying eye, no one including the doctor can reinterpret it. There is no key to re-encyphering this. That has

changed. I mean, you heard about $1,500 at some small percent•

number of cents per page for health care records that do not fit in

a manila envelope anymore. They are mountains.

I have practiced for most of my professional career as an

intensivist, that is a physician in the ICUs. In 1 day we can generate more paper than is necessary to provide information. The

electronic information systems that we develop I believe can synthesize information out of there, can make that available to other

clinicians who need that information when they treat patients.

We believe that patients have strong rights. They are not protected today. You are left to the goodwill of institutions who collect

personally identifiable health information to guard that health information. We believe that the computer systems are better than

paper systems. We believe that patients can control access to computerized information if we enact guidelines which can serve as a

model. We would like to suggest that our affiliate information system is one such model. Physicians, other clinicians regardless of

their affiliation with us or not are given access to all the information that we have in the Dartmouth-Hitchcock system about an individual patient, but they are given that information only when the

patient consents.

There is an example of that consent form where we try and educate our patients. And the patients always have a right to retract

that consent. We believe that is an example of a system that can

be endorsed and used more broadly. It enables physicians in the

Northeast Kingdom to receive information back about the care that

their patients receive at Hitchcock today. Likewise, at Fletcher

Allen, similar systems could be in place so that New York physi-
cians and other clinicians can have access to that same information.

I would say that the patchwork of medical information is the disparity between our record keeping systems in all these areas, and

I would like you to think about the potential for setting up some

uniform standards and an identifier that would enable us in the

appropriate settings with appropriate safeguards to aggregate that

information in the patient's best interests.

In a short period of time I have covered a variety of different topics.

[The prepared statement of Dr. Gettinger follows:]

PREPARED STATEMENT OF ANDREW GETTINGER, M.D.

Thank you, Mr. Chairman, for the opportunity to testify on this topic of the privacy and confidentiality of personal health information. I am pleased to join my colleagues from Fletcher-Allen Health System, Vermont Blue Cross/Blue Shield, and

both the Vermont Medical Society and the Vermont Association of Hospitals and

Healthcare Systems. My name is Andrew Gettinger. I am a practicing anesthesiologist, an intensivist (a physician who specializes in critical care medicine) and an

active clinical researcher. Additionally, I serve as the Medical Director for Information Systems. In this testimony, I represent the Dartmouth-Hitchcock Medical Center (DHMQ and the Dartmouth Medical School, which together comprise one of the

126 academic health centers in the United States. The Dartmouth-Hitchcock system

provides a full spectrum of care from community-based practices to sophisticated

tertiary care. We are the second largest provider of health care to Vermonters, and

the largest provider of health care in New Hampshire. For over fifteen years we

have worked to develop computerized medical records that assist our clinicians in

caring for patients. We are fully committed to addressing the current concerns that

accompany the implementation of computers for patient care and research in medicine. That commitment is demonstrated by our adoption of an institutional policy

on privacy and confidentiality, fully endorsed by our senior leadership and Boards

of Trustees, which outlines strict standards for access to clinical information and

mandates serious consequences, including termination, for employees found in violation.

Many in the community have been slow to relinquish the notion of the community-based family doctor whose illegible handwritten notations served as the basis

for documenting and recording personal health information. The doctor's manila patient binders were "protected by this handwritten, illegible scrawl and by the fact

that they were located in the doctor's office and not shared with other providers.

These patient notes were typically meant for the author as a means to refresh his

or her recollection about the patient's personal medical details. Today an individual's health care is provided by a continuum of clinicians for which the timely and

accurate conveyance of information is essential. Well-thought-out and well-designed

computer systems can facilitate care, not only for the clinician in an academic medical center but also for the clinician in rural settings where patients may be physically distant from referral centers and community physicians isolated from specialist colleagues. We have developed one such system. Our Affiliate Information System (AIS) provides referring physicians access to the same electronic personal

health information as clinicians located at DHMC, but it is the individual patient

who controls this access by our requirement of patient consent The overwhelming

majority of our patients grant this consent, understanding that it is in their selfinterest to do so.

We believe that there is a clear need for federal legislation to establish the framework for defining and protecting personal health information. The question of federal pre-emption of state law is an important one, especially to our organization. We

provide medical care to Vermonters both in Vermont and in New Hampshire. Potentially conflicting state confidentiality statutes could result in circumstances that

would be difficult for physicians and health-care providers to comply with or, worse,

impede the flow of critical patient care information. We worry, too, about the development of 50 different standards of health-care confidentiality rather than a single,

well-understood structure. It should be as easy for patients to understand the rules

regarding personal health information as it is for drivers to navigate our interstate

highway system. According to data from the 1990 U.S. census, 34 percent of us reside in states different from the state in which we were born. We have become a
40

mobile society. Safeguards for privacy and confidentiality need to be structured in

a single way, so that patients hear a consistent message and physicians and providers understand clearly their responsibilities. We must be able to educate the population about what privacy standards are and be confident that they understand,

whether they are born in Vermont and later move to Washington or grow up in New

York and move to New England. Furthermore, health care organizations like DHMC

that provide care to residents of two, three or even more states need to have compatible rules to assure consistent protection of confidentiality.

We are in support of legislation to assure privacy and confidentiality of health information. All health care information should be considered sensitive, confidential,

and protected so that patients can feel comfortable sharing personal details related

to their health. We believe that the answer lies not in segregating data, but in developing mechanisms for protecting the data while allowing access by those who require it to provide the care a patient wants and needs.

We acknowledge that while computer technology can present challenges to the

confidentiality of personal health information it can also be implemented in a way

that provides security and protection that can not be matched by traditional paper

medical records. Two possible safeguards: biometric authentication (that is, having

the computer recognize authorized clinicians by their fingerprints, facial identities,

or retinal scans) and encryption (that is, scrambling data into bits and pieces that

are undecipherable if the key or code is not available) are reaching the stage of development where they are feasible to use.

While it may be premature to rely upon the universal implementation of biometric

authentication and encryption for all clinical records, other strategies that are available today can be implemented now. For example, a security structure that allows

a variety of access levels based on employee class could be utilized. Clinicians who

provide direct care might have the ability to enter, edit and retrieve general patient

information. Recognizing that some information, such as HIV status, is considered

more sensitive than other information, designated categories of sensitive information might require a higher security level for access. The person requesting access

to sensitive data could be required to declare a valid clinical reason for needing to

do so. Similarly, other categories of users might only be able to view but not enter

or edit information. They too could be required to state the purpose of access to

more sensitive information. Both the access and the reasons selected would be reported and monitored by the institution. Certainly, the importance of administrative

review and the need to hold all users accountable for their access to information is

essential.

Similarly, the physician author of clinical documentation that is particularly sensitive for an individual patient can employ the same approach. Together the patient

and physician could choose to put a "restricted" flag on a note that would trigger

the same kinds of actions mentioned above. The viewer would need to state a reason

for requiring access to the note. A message might then be sent back to the author

of the note that that it was accessed, by whom, when, and for what reason. The

development of such security mechanisms would be facilitated by some national

guidelines along these lines, emphasizing security of information, with clear user accountability, rather than segregating data in a way that might have a detrimental

impact on patient care.

Individuals and groups concerned about privacy issues have raised great concern

in the debate about a national medical identifier. These concerns have been heightened by recent examples of computer hardware and software that have built-in identifiers that exist unbeknownst to the user. Little attention has been paid to the positive outcomes that can result from careful implementation of such a system. Today,

personal health information exists in a staggering array of disparate sources that

prevent integration and comprehensive medical documentation, all of which would

be in the interest of the individual patient. With monitoring, we believe the benefits

of a national medical identifier outweigh the potential risks of misuse.

Traditional concepts of research such as randomized controlled clinical trials, case

control studies, and patient surveys are overseen by a network of institutional review boards (IRB's). An IRB traditionally functions within an organization with a

view to protecting privacy and assuring ethical and sound methods. There is a tension in when trying to maintain the balance between research in the public interest

and the individual's right to privacy. Additionally, the distinction between research,

which requires IRB oversight, and quality improvement and assurance efforts which

do not, is becoming increasingly blurred. We believe that these confidentiality and

privacy issues should be addressed by institutions, not through the IRB, but rather

through a structure which connects senior leadership, the medical staff, and operational managers so that policy and enforcement can be well-grounded in the daily
41

operations of the institution. We believe that it is important that these issues be

included as the federal legislative process continues.

I am a practicing physician and I care deeply about my patients and their rights.

It is important for them, and it is important for me, that they have confidence in

the privacy of our interactions and the confidentiality of their health care information. I would like to see federal legislation to assure this protection, while at the

same time assuring that complete information is available when needed to those

who provide care, and support the provision of care. There is a great opportunity

for Congress to legislate such safeguards for privacy and confidentiality that can enhance patient care. We hope that well-publicized but relatively infrequent breaches

of confidentiality will not stand in the way of legislation aimed at this greater good.

On behalf of our patients in Vermont and New Hampshire, and the physicians and

institutions that I represent, we enthusiastically hope and expect that you will complete this legislation in the very near future. We wish you well, and thank you.

The CHAIRMAN. I asked you to come up separately because I am

extremely interested in this area. What is going on within the profession or otherwise to figure out how best to address some of these

matters?

Dr. GETTINGER. There is a profession, the American Medical

Informatics Association, AMIA. I know one of the public speakers

is going to represent that. The AMIA has put forward some suggestions. In this month's journal there is actually a coalition, a review

article that talks about 10 or 12 principles that might be established. They cite the work in the various bills that have been under

consideration, as well as the AMA efforts in this area, as well as

Dr. Coop's efforts in these areas as well as the professional societies.

I believe that that kind of information can serve as a very good

framework, and I will make that paper available to your staff.

The CHAIRMAN. I would appreciate that, because I am concerned

that we have AHCPR, which is one agency that gathers information; and we have the FDA, which is also under our jurisdiction

and has a great deal of information. I just imagine a big black box

into which all of this information is dumped, and I do not know

whether anything comes out that is usable. How do we try to pull

this information together? We have additional information flowing

in from Europe and Asia.

Dr. GETTINGER. Vermont should take some pride in this. Jack

Wennberg, who was one of the leaders in this field, was Commissioner of Medicaid and started his pioneering in variations of

health care, how health care that patients receive in Barre are different from that that patients receive in Ludlow. He has continued

that work by using the Medicare claims database and has done

some very significant work in that area demonstrating differences

in health care, the kind of societal differences or regional differences that is not because that we do not all try to do the best

we can. We have just not had access to the kind of information that

is coming out. What is the best way to take care of Condition A,

B or C. I think AHCPR's work is essential in how to get answers

to those problems, but in those circumstances you can use the

deidentified information. The information does not have to have the

patient's name, a medical identifier or any other attributes that

really identifies the patients. So I think one can get the public

health benefits from quality improvement work with very, very

careful application of and rules around patient identifiers and who

controls those keys.
The CHAIRMAN. Well, thank you. I am very actively interested

and concerned that we are going to end up missing an opportunity

to utilize this information much more to our advantage than we

currently do.

Dr. GETTINGER. The other point I would like to make just very

quickly is that there is consideration of using the IRBs or the CPA

chess's, the institutional review boards that regulate research as a

venue where confidentiality can be strengthened. I would suggest

that this issue is bigger than•by at least an order of magnitude

than the IRBs because there needs to be

The CHAIRMAN. Explain IRBs for the

Dr. GETTINGER. IRB is the institutional review boards. They tend

to be set up around the 126 academic medical centers in the United

States. There are some supplemental ones. The FDA has its own

IRB. Actually has, I believe, a number of them. And those are the

committees that control what researchers can do in their research.

They do not today have a clear directive or focus on confidentiality

issues per se but are one of the groups that have access to clinical

information when it is done under the guise of research.

And so IRBs•my point about IRBs is that they are very important organizations. We need to have them, but I believe this issue

goes beyond the IRBs because we have somewhere by an order of

magnitude more health care organizations and individual providers, all of whom have information which needs to be protected, by

an appropriate framework and standards.

The CHAIRMAN. Well, thank you very much. I will be back in

touch with you, because I am very interested in the area you are

discussing and how we can maximize our use, at the same time

maintaining confidentiality, which is absolutely essential.

Dr. GETTINGER. Thank you for allowing me to testify.

The CHAIRMAN. Thank you.

First on our final panel is Mary Lussier and Ms. Anne Ladue.

They are representing the Vermont Occupational Health Nurses

Association. The next witness is Dr. Douglas Weir, who has worked

since 1983 in IBM Corporation's Occupational Health Services in

Essex Junction, Vermont. His medical career includes service at

the Veterans Administration Medical Center, Cleveland, Ohio, as

well as a residency in internal medicine at the Medical Center Hospital of Vermont. Dr. Weir, nice to have you here. And, finally, I

present Dr. Norman S. Ward, who is an associate professor of family practice at the University of Vermont College of Medicine. He

is also medical director of Vermont Managed Care.

As a member of the National Health Science Corps early in his

medical career, Dr. Ward served in a number of health manpower

shortage areas around the country including communities in Mississippi, Georgia, New Hampshire, Maine, and New York State.

Since 1995 he has been affiliated with Fletcher Allen Health Care

in Burlington. Welcome. Good to have you all here.

And, Ms. Lussier, please proceed.
43

STATEMENTS OF MARY LUSSIER AND ANNE LADUE, VERMONT

OCCUPATIONAL HEALTH NURSES ASSOCIATION; DR DOUGLAS WEIR, PROGRAM MANAGER, OCCUPATIONAL HEALTH

SERVICES, D3M, ESSEX JUNCTION, VT; DR NORMAN S. WARD,

ASSOCIATE PROFESSOR OF FAMDLY PRACTICE, UNIVERSITY

OF VERMONT COLLEGE OF MEDICINE, BURLINGTON, VT

Ms. LUSSIER. Anne will be reading the statement and I will be

answering questions.

Ms. LADUE. Senator Jeffords, my name is Anne Ladue. I am a

member of the Vermont chapter of the American Association of Occupational Health Nurses. I am here today to comment on behalf

of occupational health nurses and workers across Vermont and the

country. AAOHN is the professional association for more than

13,000 occupational health nurses. We provide on the job health

care.

AAOHN and I would like to thank you for advancing this very

important debate concerning privacy of health information. Enactment of comprehensive Federal legislation is critical. In this age of

computers, people are becoming increasingly concerned about their

personal health information being used in unintended and potential discriminatory ways.

Today I want to make four points. First, Federal confidentiality

legislation should apply to all personally identifiable health information regardless of why the information was generated or where

it is collected or stored. Inappropriate disclosure and misuse of

health information collected at the work site poses just as serious

a threat to the privacy interest of our Nation's workers as does

abuse in their treatment, payment, plan administration or research

records. Accordingly, effective Federal medical records privacy legislation should cover occupational health records.

Second, human resource managers, line supervisors and others

involved in hiring, promotion or work assignment decisions should

not have unfettered access to work site medical records. Rather,

employers should rely upon the judgment of the health care professionals they retain to generate or maintain occupational health

data for determination of an employee's fitness for work. Effective

Federal privacy legislation should build barriers designed to prevent management misuse of workers' health records without jeopardizing a company's ability to operate safely and efficiently.

Third, informed authorization for release of medical records

should be the cornerstone of any privacy legislation. To be meaningful, the requirements for authorization should apply equally to

all types of medical records including those generated or maintained at the work site. That said, a comprehensive Federal privacy

bill should include safeguards against coerced authorization for

work site records disclosure.

Finally, strong and enforceable civil and criminal penalties for

wrongful disclosure or use of protected health information are essential. Moreover, those penalties should apply not only to actual

abuses of protected health information but also to inappropriate attempts to access such data. A comprehensive law also should protect individuals who report breaches of the privacy protection from

retaliation.
Federal privacy legislation that embraces these four principles

should address the privacy concerns that occupational health professionals are forced to grapple with all too often. To illustrate, I

would like to relate an incident reported to AAOHN by one of its

members. This nurse was threatened with loss of her job when she

objected to making employee medical files available to the plant

human resources manager so that he could tabulate the frequency

and purpose of employee clinic visits for performance appraisal

purposes. We need a privacy law that curtails such practices.

The Medical Information Privacy and Security Act includes specific safeguards limiting inappropriate access to employee health

information at the work site. The AAOHN is supportive of this

level of protection and would like any bill that moves forward to

create a similar balance between an employer's legitimate need for

employee health information and the employee's right to privacy.

The Vermont chapter and the national office of the AAOHN encourage you and Senator Leahy to work toward the enactment of

a bipartisan Federal medical records that is truly comprehensive,

recognizing that such a bill must deal effectively with the privacy

issue raised by occupational medical records.

We look forward to working with you to achieve this objective.

Thank you.

The CHAIRMAN. Dr. Weir.

Dr. WEIR. Thank you, Mr. Chairman, and thank you for the opportunity to present IBM's views on the medical records confidentiality legislation. I would like to begin by condemning your interest and leadership and that of Senator Leahy as well on this issue,

and we hope to continue to work with you and your staffs as you

develop legislation. We also hope that this Congress will enact such

legislation in time for the August 1999 deadline set by the Health

Insurance Portability and Accountability Act.

We offer two perspectives on this very important issue: First, as

the world's largest information technology company and, second, as

an employer with over 150,000 employees in the United States,

over 7,000 of which are right here in Vermont.

First I would like to address the role of technology in ensuring

privacy and security of our medical records. As a technology company, we see every day the role that information technology plays

in improving the delivery of health care, and we believe that such

technology can also be used to protect and secure personally identifiable information.

I can imagine a health care system being able to access patient

charts and X-rays, attach a physician progress note to an existing

electronic chart via voice recognition software, send that file across

town or across country to another doctor or hospital. Patients can

sit at home and arrange an appointment on line, ask a nurse practitioner about a sick child through an Internet chat session or order

prescription refills on the computer. Some of this is available right

now.

At the same time, technology offers many forms of security that

can appropriately manage access to protected health information,

tools such as biometricks and digital signatures that can verify the

identity of an individual in a manner that is more fool proof than
45

a set of questions that ironically enough ask for additional personal

information.

Such tools as encryption and other technologies can also enhance

the security of health information. To allow our customers to take

advantage of the capabilities of the Internet and other technologies,

we must create a trusted environment where personal health information is protected. And while we have advocated that in most situations industry self-regulation can address consumer concerns

about privacy, for medical records we support Federal legislation to

address this important and sensitive category of information. We

believe technology can help to implement the goals of this legislation.

Employers regularly play three important and distinct roles relevant to the medical privacy debate. As providers of health benefits

and payers of health claims. Self-insured firms like IBM actively

design, manage and fund health benefits for their employees; providers of emergency care when necessary and, also, as stewards of

a healthy and safe workplace to promote the well-being of their employees.

The employers' role is an active and central one resulting in

many positive programs that companies like IBM voluntarily undertake, including various wellness offerings and also disease prevention programs.

It follows then that the employers' benefit plans generate and

use much of the health information that flows through the health

care system today. In turn, we have a keen interest in the privacy

debate.

IBM's own practice aims to maintain a very high standard to ensure confidentiality of information entrusted to it. Our privacy

principles relative to employee personnel information are collect,

use and retain only personal information that is required for business or legal purposes; provide employees with a means of ensuring

that their personal information in IBM personnel records is correct;

limit the internal availability of personal information about others

to those with a business need to know; and release personal information outside of IBM only with employee approval, except to verify employment or to satisfy legitimate purposes such as investigatory or legal needs.

These principles apply to all personal information but have particular meaning for medical information which, we believe, deserves the greatest degree of protection. Inside IBM access to confidential medical records is limited to the IBM medical staff and it

cannot be accessed by management.

To be of benefit, privacy legislation should not tie the hands of

employers so severely that they lose the flexibility to perform these

necessary functions. Employers need to have access to sufficient information to manage their work force effectively, manage worker's

compensation, comply with the ADA and the FMLA and perform

necessary research and analysis that requires medical information.

But, clearly, employees need to have assurances that the privacy

of their medical records will be protected by their employers.

I will conclude with several points I feel should be addressed in

the legislation that Congress enacts on medical records privacy.

Legislation should establish a strong Federal framework including
46

Ereemption. We cannot encourage development of a sophisticated

ealth care delivery system without uniform national standards for

information management.

Privacy and security are closely related, but security standards

for health information have already been enacted by Congress in

1996. Final implementing regulations from HHS are expected this

year. Federal privacy legislation should not re-legislate these information security standards and therefore create uncertainty, delay

implementation and undermine the rule making process.

Federal legislation that sets out uniform standards and responsibilities in this area should strive to create a flexible environment

that recognizes the need for a balance of interests. It should also

encourage organizations to develop innovative approaches in order

to meet their compliance obligations. This flexibility should help

spur innovation while at the same time minimizing costs.

Uses of medical information provided by employees to help us as

employers make judgments related to ADA, FMLA and other leave

of absence programs as a legitimate use and should be accommodated in the legislation.

And while there is certainly a role for strong technology to protect the security of health care information, the legislation should

be written in technology neutral terms. This is to allow the flexible

use of current technologies while at the same time not discouraging

the development of newer alternative technologies in the future.

And, finally, privacy legislation should address all types of medical

records regardless of the medium in which they are stored.

Once again, I would like to thank you for the opportunity to

share IBM's view on Federal medical records confidentiality legislation. And as we have an opportunity to study the legislation recently introduced, we will be very pleased to provide any further

comments and answer any questions.

[The prepared statement of Dr. Weir follows:]

PREPARED STATEMENT OF DOUGLAS WEIR, M.D.

Thank you for the opportunity to present IBM's views on medical records confidentiality legislation. My name is Dr. Douglas Weir, and I am a physician who

trained in internal medicine at the Medical Center Hospital in Burlington. For the

past 15 years I have worked at the IBM facility in Essex Junction where I am currently the Program Manager of IBM Occupational Health Services.

We offer two perspectives on this very important issue: First, as the world's largest information technology company, and second, as an employer with over 150,000

employees in the United States, including over 7,000 in Vermont.

Technology and Medical Records Confidentiality

IBM's Global Healthcare Industry division is a leader in providing new solutions

for improving health care systems, patient responsiveness, and communications

within far flung health care operations. We work with our customers•hospitals,

providers, insurers, and others•to address their evolving needs and assist them in

integrating new technologies into their healthcare systems. I have attached material

in the Appendix to this statement that provides more detail on our experience in

this industry.

As a technology company, we see every day the role that information technology

plays in improving the delivery of healthcare•and we believe that such technology

can also be used to protect the privacy and security of personally identifiable information.

As a practicing physician, I can personally imagine a healthcare organization

being able to access patient charts and X-rays, attach a physician progress note to

an existing electronic chart via voice recognition software, and send that file across

town or across country to another doctor or hospital. Patients could sit at home and

view the doctor's schedule to arrange an appointment, or ask a nurse practitioner
47

about a sick child through an Internet chat session. Even using a computer link to

determine eligibility and to electronically handle a co-pay while the patient is seeing

the doctor. Consumers could even use the Internet or other computer network to

buy exercise equipment, or create a diet and exercise plan monitored by an online

physician. Some of these are happening even now!

At the same time, technology offers many forms of security controls that can appropriately manage access to protected health information•controls that were not

possible or cost-effective in a paper-based environment Some technology•like biometrics•can authenticate or verify the identity of an individual in a manner that

is more foolproof than a set of questions that (ironically) ask for additional personal

information. Technology also enables the "de-identification" of information, so that

it no longer identifies a specific individual. What that means, in the context of federal privacy legislation, is that it can create information that does not constitute

"protected health information" in a manner that is viable for large volumes of

healthcare records•something that was not feasible with paper. Encryption and

digital signatures are additional components of the technology security portfolio that

can be used to enhance the security of health information.

The tools and capabilities I've mentioned here will only get better and more sophisticated in the future, given the fast pace of technological advances. In other

words, technology can help to implement the goals of this legislation.

Yet this legislation is not directed at these technology solutions, because they are

largely addressed under the security standards of the 1996 Health Insurance Portability and Accountability Act's Administrative Simplification provisions, which are

now being implemented by Health and Human Services. Federal medical records

confidentiality legislation is directed, instead, at the policies by which organizations

will establish who has access to protected information and what the right of individuals are with respect to the uses of the information.

We know as a healthcare information systems company that the only way our customers will be able to take advantage of the capabilities of the Internet and other

technologies is if we can create a trusted environment where personal health information is protected. It is to this end that we support the need for and the intent

of the legislation, to address this important and sensitive category of information.

An Employer's Perspective

We an know that most Americans and their families receive health care coverage

through their employer•whether that's a private company or a government. IBM

believes that employers play a very constructive role in today's U.S. health care system and have helped bring about many of the most innovative developments in

health care delivery.

Employers regularly play three distinct roles relevant to the medical privacy debate:

• Providers of health benefits and payers of health claims. Self-insured firms like

IBM actively design, manage, and fund health benefits for their employees.

• Providers of emergency care when necessary, and

• Stewards of a healthy and safe workplace to promote the well-being of their employees. Employers are responsible for ensuring that a healthy and safe workplace

exists at their facilities, and they underpin the nation's worker compensation system.

Employers' role is an active and central one, resulting in many positive programs

that companies like IBM voluntarily undertake, such as health prevention and

wellness programs.

It follows, then, that employers' benefit plans generate and use much of the

health information that flows through the health care system today. In turn, we

have a keen interest in the privacy debate.

To be of benefit, privacy legislation should not tie the hands of employers so severely that they lose the flexibility to perform these necessary functions. Employers

need to have access to sufficient information to manage their workforce effectively

and perform necessary research and analysis that requires medical information. But

clearly, employees need to have assurances that the privacy of their medical records

will be protected by their employers.

IBM Privacy Policies and Practices

As an information technology company, IBM has maintained a very high?standard

with respect to ensuring the confidentiality of information entrusted to it. The company's interest dates back to the 1960s when our privacy policies were formalized

due to our desire to respect our individual employees and a general public apprehension about the effects of computers on privacy.

In the 1970s, we conducted a comprehensive review of specific internal guidelines

and began management training programs to support compliance with these guidelines.
48

In the 1980s, we revisited these privacy principles to test their viability given

technological and social changes that had occurred and to think through the new

challenges presented by these changes.

These are our privacy principles relative to employee personnel information.

• Collect, use and retain only personal information that is required for business

or legal reasons.

• Provide employees with a means of ensuring that their personal information in

IBM personnel records is correct.

• Limit the internal availability of personal information about others to those

with a business need to know.

• Release personal information outside IBM only with employee approval, except

to verify employment or to satisfy legitimate purposes, such as investigatory or legal

needs.

In the 1990s, and with the explosive growth of the Internet and other networked

technologies, we updated our privacy policies by adopting a global online policy for

our websites•take a look at our website, at ibm.com. And with the taking effect

in October 1998 of the European Union Data Protection Directive, we are again ensuring that our policies meet the requirements of this law.

But we have never lost sight of the fundamental principles, which underlie our

employee privacy policies.

These principles apply to all personal information but have particular meaning for

medical information which, we believe, deserves the greatest degree of protection.

Inside IBM, access to confidential medical records is limited to IBM medical staff

and department personnel under their immediate supervision. They will disclose information from those records to others within IBM, but only:

• to benefits plan administrators who may review information needed for determining eligibility for benefits

• to others with a need-to-know to evaluate medical recommendations, medical restrictions and accommodations as they relate to the work environment and ability

to perform the job

• to legal counsel when medical status or information is at issue or required.

All employees may obtain copies of their records from the IBM medical department. Further, with few exceptions (where required by law or legal process, or

where necessary to protect the vital interests of the patient) we require our medical

staffs to obtain prior approval of the employee before either disclosing or seeking

confidential medical information.

Because we believe that empowered employees with knowledge of their rights is

our best assurance that these rules will be followed, we publish our principles and

guidelines and periodically remind the 2000+ IBM managers in the U.S. of their responsibilities.

In addition to the information which is contained in our own internally generated

medical records, we recognize the need to protect employee medical information associated with our benefits programs. IBM provides a wide array of benefits to our

employees, many of which involve treatment for medical conditions•our company

provides coverage for over half-million employees, dependents, and retirees. Consistent with our emphasis on employee privacy, we have placed restrictions on our benefits contract administrators on how this information can be used and even what

information they will pass on to us. For example, our plan administrators receive

only aggregate data derived from the medical records available to the carriers which

does not permit linkage of any individual employee with a particular medical condition.

We have imposed these restrictions because we believed it was important to strike

the right balance between the needs of the business and the need to protect an employee s privacy. The fact that we have been able to continue to provide our employees a broad array of medical benefits at reasonable costs while operating with these

self-imposed restrictions is evidence, we believe, that maintaining high standards of

confidentiality need not compromise efficiency.

Federal Legislation Issues

IBM has for years supported federal medical record confidentiality legislation.

Personally identifiable medical information is sensitive and deserving of a federal

framework for the protection of its privacy and security. We commend Senator Jeffords' and Leahy's interest and leadership on this issue, and hope to continue to

work with you and your staffs. We also hope that the new Congress will enact such

legislation, in time for the August 1999 deadline set by the Health Insurance Portability and Accountability Act.

Such legislation should include the fundamental "fair information" principles recognized in the privacy debate: notice, access/supplementation, security, and enforcement.
49

Such legislation should also reflect the following:

Strong preemption. Legislation should establish a strong federal framework•

we cannot encourage development of a sophisticated health care delivery system

without national standards for information management.

Health Information Security. Privacy and security are closely related, but as

noted previously, security standards for health information have already been enacted by Congress in 1996. Final implementing regulations from HHS are expected

this year. Federal privacy legislation should not "re-legislate" these information security standards and therefore create uncertainty, delay implementation and undermine the rulemaking process.

Flexibility. Federal legislation that sets out uniform standards and responsibilities in this area should strive to create a flexible environment, that recognizes the

need for balance of interests. It should also encourage organizations to develop innovative approaches in order to meet their compliance obligations. This flexibility

should help spur innovation and minimize costs.

Employer's Appropriate Use. We also have a concern over judgments employers must make regarding an employee's ability to perform a job or continue to be

eligible for paid or unpaid leave according to company policy. Uses of medical information provided by employees to help us make such judgments is a legitimate use,

and should be accommodated in legislation (e.g., there should be no blanket prohibition of the use of information for purposes unrelated to treatment or payment). In

fact, proper compliance with laws such as the Americans with Disabilities Act and

the Family and Medical Leave Act require that employers make use of personally

identifiable medical information in a manner unrelated to treatment or payment

Technology Neutrality. While there is certainly a role for strong technology to

protect the security of health information, legislation should be written in technology-neutral terms. This is to allow the flexible use of current technologies while,

at the same time not discouraging the development of newer alternative technologies in the future. Finally, privacy legislation should address all types of medical records, regardless of the medium.

Once again, thank you for the opportunity to share IBM's views on federal medical records confidentiality legislation. As we have an opportunity to study the legislation recently introduced, we will be very pleased to provide further input or answer questions.

APPENDIX

D3M & HEALTH CARE INFORMATION TECHNOLOGY

IBM Global Healthcare Industry

As the industry's leading provider of e-business solutions, IBM offers a suite of

comprehensive, end-to-end technology solutions to the Healthcare Industry. In the

current healthcare marketplace, networking technology now points the way to new

methods of improving care systems, patient responsiveness, streamlining cost of operations and improving communications within increasingly far-flung healthcare organizations. IBM's network-enabled commerce, information sharing, management

and information technology consulting combined with innovative research offer tangible benefits to healthcare organizations and their constituents.

As healthcare organizations continue to broaden their operations, often including

healthcare providers, payers, pharmaceutical and other suppliers in the mix, the

need for integrated, secure, scalable networks is leading healthcare organizations towards some form of Internet-based communications.

IBM offers complete solutions suitable for all network configurations: Intranets or

internal networks based on local area networks and some form of e-mail and other

applications, often built on the Lotus Notes platform; Internet-based programs

(intranets) offering communications and information through websites secured

through firewalls and IBM network servers designed for this use; and Extranets

which connect Intranets of many organizations' through secure Internet channels.

"End-to-end" network computing solutions•from the initial consulting project to

implementation and managed operations•address the full spectrum of healthcare

organizations' evolving requirements and the need to migrate healthcare systems to

new technologies. IBM's 24 development laboratories worldwide work with customers on new technologies such as genomics research to design pharmaceuticals,

or continuous speech technology that enables physicians to dictate reports into their

computers while reading X-rays or doing a variety of tasks including referrals and

other administrative functions.

e-business is the foundation of IBM's network computing offerings providing a

flexible, modular approach from a basic foundation level to highly secure, advanced
50

applications. For those customers who want to create content and establish thenpresence on the Web, IBM offers solutions including Lotus Notes and DominoTM,

HTML authoring and HTML templates, TCP/IP and related networking services,

web content hosting, e-commerce functions, business recovery services, security, consulting services, and systems management. Our web site development and content

hosting services, provide healthcare organizations with a simple-tooperate, engaging set of networked applications offering quality healthcare information and services, personalized to each individual user.

Our Health Data Network provides the framework and solutions whereby payers,

providers, government and others share information. The architecture is open and

can scale up to support the needs of a growing networked organization. Health Data

Network applications enable healthcare organizations to consolidate and access information, automate business processes, minimize redundant data re-entry and extend the useful lives of legacy systems.

Other IBM competitive-advantage healthcare business solutions include data mining to identify marketing trends or ferret out fraudulent claims, etc.; call center

technology to handle customer service operations more efficiently at lower costs; mobile computing for enhanced communications with doctors, home healthcare workers, and other healthcare professionals; financial and human resources information

systems; year 2000 consulting and software; systems integration and much more.

Professional Service offerings focus on meeting customer requirements which have

rapidly increased in scope along with the need to create competitive advantage in

a consumer-driven healthcare market environment. Healthcare organizations are

looking for sophisticated assessments of Information Systems, HIPAA security readiness, business process evaluation and analysis, reengineering expertise, systems integration, advice on best-of-breed application selection, customization and implementation, ongoing support for such activities, end-user training, and managed operations such as desktop support, data centers, transaction processing, network and

other operational business process.

Recognized as the industry's leading provider of electronic business solutions, IBM

offers a suite of comprehensive, "end-to-end" technology solutions. IBM's networkenabled e-commerce, information sharing, management and information technology

consulting combined with innovative research offer tangible benefits to healthcare

organizations and their constituents in improved customer service, enhanced patient

care and decreased operating costs.

The CHAIRMAN. Thank you. Dr. Ward.

Dr. WARD. My name is Norman Ward. I am a practicing family

physician at Fletcher Allen Health Care in Burlington, Vermont,

and hold a full time faculty appointment in the College of Medicine

at the University of Vermont. I serve as the medical director of

Vermont Managed Care which is an 800-physician network that

contracts with insurers to provide health care on fully capitated

basis to 24,000 Vermonters. I also serve on the committee at

Fletcher Allen that is charged with implementing our new electronic medical information system. I would like to thank the committee for this opportunity to provide input into this important debate on behalf of the largest provider of health care services in Vermont. I would also like to extend special thanks to yourself and

Senator Leahy for your national leadership and dedication to putting into place legislation concerning medical record confidentiality

and patient privacy. These are issues that physicians have always

been profoundly concerned with.

I must say at the outset that this issue requires me to wear several hats. Wearing these hats at the same time could get my head

rather crowded with what seem to be incompatible points of view.

As a patient, I want assurances that my medical information will

not fall into unscrupulous hands that might harm or embarrass

myself, or my family or threaten my employment or health insurance coverage. As a physician, I can do the best quality medical job

for my patients with complete, uncensored, up to date medical information that is available to me at the time of the need to make
51

decisions with my patients. As a medical director, I have been initiated into the complex world of how medical care is paid for. Trying

to obtain enough information in a timely enough fashion to approve

or disapprove medical services that are or are not benefits within

the scope of a patient's insurance contract can be a frustrating experience. As a member of Fletcher Allen's electronic medical information implementation committee, I struggle with the potential

wonderful benefits to medical care quality through the use of electronic storage and retrieval of information, balanced by the legitimate concerns of patients for their privacy. As a taxpayer who contributes money to our government, the largest purchaser of health

insurance in the country, I am concerned about the high costs of

implementing whole new paradigms of information storage and

transfer by the health care system.

The medical record is the single most important tool for providing quality health care in 1999. The amazing technologies that can

be brought to bear to benefit patients are indeed wonderful, but the

medical record is the physician's guide as to when such studies are

indicated and appropriate. Since in our current medical system no

one practitioner can provide all the care that a patient needs, it is

critical that the health care team has ready access to the information that provides the context and background for the next clinical

decision. This implies a system with appropriate security safeguards, but one that is highly accessible to the treatment team. We

teach our medical students that the key to diagnosis is a thorough

and accurate history. Often that history becomes clearer over time

such that one small new piece of data makes the whole picture suddenly become clear. The inability to compile information in one usable location significantly handicaps this effort. At the very least,

information within an integrated system of care should exist in

such a format.

Probably one of the most important aspects of health care today

is the use of multiple medications. A patient may see several consultants with different areas of expertise, each of whom may prescribed a medication. Admissions to hospitals for serious complications of medication interactions represent a significant problem. In

my own practice, I review the medications that a person is taking

on every visit. I instruct the patient to bring every pill bottle in a

brown paper bag each time I see them. It is unusual for me not

to discover at least one or two discrepancies in what the patient is

actually doing with their medications compared to what I believe

they are doing. For example, they may be taking both a generic

and a brand name preparation of the same drug believing that they

are different medications. Our current development of Fletcher Allen's electronic medical information system has placed a high priority on making a shared medication list part of that system to avoid

errors and adverse interactions.

Under the proposed legislation, it is conceivable that a patient

may choose to restrict access to such a medication list. Let us say,

for example, that a patient is on a certain anti-seizure medication.

They have blocked their medication list because they are fearful

that their employment situation could be threatened if it were

known that they had a seizure disorder. They present to the emergency room with an antibiotic known to interact with that medicine
52

is inadvertently prescribed for a simple infection. The patient may

neglect to inform the emergency room doctor of the fact that they

are on this medication, not realizing the potential for serious drug

interactions. Toxic levels of the seizure medication can result. Now

the patient may return to the emergency room confused and unable

to communicate. The emergency room staff could, I suppose, invoke

the emergency access clause in the legislation to discover the explanation for the symptoms. A preventable complication has occurred.

Where will the liability reside for this untoward event?

Let me speak next about some of the cost implications for the

proposed legislation. There is an enormous cost to the reordering

of tests that may already have been performed when a patient goes

to a new doctor in their own area or more commonly when they are

out of town. Patients often cannot remember the names of tests,

the specific reasons that they were done or the exact results. Simplified systems of accessing this information locally within a provider network or potentially even nationally in a responsible, secured fashion are important. If State specific statutes create multiple rules for providers to follow, there will be significant confusion. Fletcher Allen receives some 40 percent of its patients from

New York State. Meeting differing confidentiality statutes for Vermont and New York will prove to be an operational nightmare.

Health care providers are dependent on software vendors to provide the information systems that they use for patient information.

These systems cost millions of dollars to purchase and install. Installations can take many months. It would be highly desirable if

there were a national standard for the functionality that these systems need to meet to satisfy privacy requirements. It is conceivable

that a health care system operating in a State with more restrictive statutes concerning health information access than a national

norm would find it very difficult to locate a vendor to meet those

specific State needs. In addition, the investments that health care

providers have already made in their current information systems

may be significantly increased by new regulations if those systems

are not compatible with the demands of the new legislation. These

costs will need to be passed on to those paying for medical care.

Strategic decisions made today concerning information technology

capability have implications for years into the future. This speaks

to the need for sufficiently long implementation time line for health

care organizations to attain compliance with any new proposal.

This legislation makes allowance for a patient to sequester parts

of the medical record for transfer. For some people, genetic information will be the important category to prohibit access to. For

someone else, it may be a curative cancer operation performed

years before. For another, a notation concerning cosmetic surgery.

This is not to discredit people's individual sensitivities, but rather

to illustrate that the entire record is to be held in a sacred trust.

The logistics of editing a record to the patient's satisfaction prior

to transfer will be daunting.

The legislation also makes reference to eight separate circumstances where personally identifiable health information can be

released without patient consent. Except for release for emergency

medical treatment, the other seven categories do not involve direct

patient care. Are we to assume that safeguards for confidentiality
53

within entities such as research, public health, law enforcement

and credit card payment systems are more secure than the physicians and nurses providing direct patient care?

In the final analysis, I believe the impetus for this legislation

stems partly from heightened concern about patient record confidentiality due to computer related developments. Electronic

records can be much more usable as clinical tools than paper

records by putting the needed information immediately in the

hands of the clinician where the patient is being seen. The ability

to document who exactly has opened a computer file and accessed

the record can make enforcement of rules prohibiting inappropriate

viewing of the record easier. Fletcher Allen has a universal confidentiality statement that all employees must sign stating their

understanding that their jobs are at stake for breach of patient privacy.

In closing, I was struck with a sense of irony about the timeliness of the appearance of an article in the Burlington Free Press,

you may have seen it, on Saturday in relation to today's meeting.

A short article accompanied a picture of Queen Elizabeth documenting the discovery of her medical records in a ditch in Scotland.

[Laughter.] Confidentiality is, after all, about people and their imperfections. We are clearly all in this boat together, even the

Queen.

I am optimistic that we can, indeed, have a better State of affairs

concerning patient privacy in this country. Once again, I wish to

thank you for the opportunity to address the committee.

The CHAIRMAN. Thank you. Thank you all. That creates more

questions than perhaps I want to deal with, but it is extremely important that we get the best, especially in the area of utilization

of technology, in order to sift out some of these problems and get

some uniformity.

Do you believe that the bill has sufficient safeguards to allow for

uniformity in utilizing technology while insuring both security and

the free flow of information? That is a necessity.

Any comments? [Laughter.]

Dr. WARD. Well, if there were a ceiling or if there were at least

a floor for what kind of standards, there would need to be a ceiling

for the software standards that a vendor would have to meet. Our

country is an entrepreneurial society. Those entrepreneurial software manufacturers, for instance, that could exceed the

functionality that the national standard puts into place would be

at a market advantage, I think. But I think the ceiling should be

the important point.

The CHAIRMAN. Dr. Weir.

Dr. WEIR. I agree with what Dr. Ward is saying. I think the most

important thing is to have the legislation make clear the importance of confidentiality as a philosophical point. I talked before

about not•making it technology neutral because technology

changes but the central importance of confidentiality of medical

records, and I think that is of all medical records whether they are

mental health care, whether they are infectious disease, whatever,

is what is important, and it should be unchanging.

The CHAIRMAN. Dr. Gettinger.
54

Dr. GETTINGER. I believe there is an opportunity with Federal

legislation to carefully construct a means to have clinicians, health

care providers aggregate data from different sources. Today our

problem is that we have bits and pieces of care. Some of your

care•some of the documentation of your care lives here in Vermont. Some of the documentation of your care lives in the greater

DC. area, and yet any physician who provides care to you either

in Vermont or in DC. would like to have all of that information.

Standards allowing the aggregation is•are important, and one of

the keystones of that standard is a national medical identifier. The

problem with a national medical identifier is that everybody is

afraid of Big Brother and Big Government. So it is how do you put

in place sufficient safeguards and sufficient penalties that will give

that kind of number the kind of protection that will make you and

me sleep well at night for our own medical information. And I do

not think that is a technology specific issue. It is one which will

continue on forward.

The CHAIRMAN. It is troubling. A national identifier and availability of all their medical records upsets people. On the other

hand, without some sort of system, the maximum protection a patient can have is not available if that information is not locatable

and usable.

Dr. WEIR. If I may add something. I think that the concern that

a national identifier automatically makes available this myriad of

information is incorrect because there are ways to protect that information while it is all clustered under a national identifier.

The CHAIRMAN. MS. Lussier, will you give me an example of the

types of problems the occupational nurses have encountered in

treating patients?

Ms. LUSSIER. Some of the problems are that we have collected

personal information, medical information along with information

that has to do with their occupational job, so we may be asked

about some of that which has nothing to do with their job. What

we need to do is be able to have the ability just to release information that is needed to say how fit they are to work and that the

employer will trust the health care professional that they have the

ability to do that. And realize that line managers and supervisors

do not have a knowledge to go, and when they go into medical

records, to make the right decision what that says and the person's

ability to work.

Personally, I have not come in contact with that, but other

nurses have come in contact with trying to be forced to release information by the threat of their job, and that we should be able to

release only information that is needed. That the employee can

sign an authorization saying that they are only to release certain

information and that they do not release any other information.

The CHAIRMAN. SO you would like to see perhaps some State or

Federal laws that would clearly identify or at least set a process

for when you can say no to making your medical records available

and rely upon the law?

Ms. LUSSIER. Right. And we are protected from having to disclose

information; that the health care provider is protected from not

being coerced into having to release that information on the threats

of their job.
55

The CHAIRMAN. MS. Ladue.

Ms. LADUE. I agree with Mary, and many of us nurses work for

organizations that are multistate, so it would certainly be to our

benefit to have one Federal law to protect so you would not have

to know•basically so we would not have to know 50 different laws.

The CHAIRMAN. Well, I want to thank you all for very helpful testimony, although I don't know if it will help us sleep tonight.

[Laughter.] But it is making me much more aware of the problems

that we have to face. We are still working on the legislation. We

would like to be back in touch with you.

Also, I remind everyone here, I told people I would reserve time

for questions. So as much as I would like to proceed, I have a

promise and I will keep my promise. Thank you for your very excellent testimony.

We have chairs to handle the number of people who have signed

up for two-minute statements. We will do it by two panels. The

first panel is Andrea Warnke, Vermont ACLU. Laura Ziegler, Phyllis Tarbell, and Vicki Giella. Come up.

We need to breathe for a couple of minutes while the reporter

changes the machine and paper.

Because I cannot really connect names with faces, I will proceed

from left to right here. Please introduce yourself. Go ahead with

your statement.

STATEMENTS OF ANDREA WARNKE, AMERICAN CIVIL LIBERTIES UNION OF VERMONT, MONTPELIER, VT; LAURA ZIEGLER; PHYLLIS TARBELL, DORSET NURSING ASSOCIATION,

DORSET, VT; AND VICKI GHELLA, AREA AGENCY ON AGING

FOR NORTHEASTERN VERMONT

Ms. WARNKE. Thanks for the opportunity to speak and for your

work on these issues. My name is Andrea Warnke. I am the associate director of the American Civil Liberties Union of Vermont. In

the interest of leaving time, I am going to abbreviate my comments, but I have a fuller written testimony prepared.

The ACLU obviously is very interested in having a national policy which protects medical records privacy enacted, certainly before

the August deadline. The major points of concern to us are that access to patients' medical records should never be given to anyone

other than their immediate health care provider without the patients' permission. Use of patient identifiable information should

not be permitted unless the patient has granted explicit permission

to do so, and the use of unique patient identification numbers,

Medicaid or Medicare numbers, or Social Security numbers should

be prohibited. Failure to grant such permission should not result

in the loss of access to medical care.

Information that you tell your doctor should have the same legal

protections as information you tell your lawyer, and law enforcement access to medical records must be limited. Medical records

should not become part of a centralized law enforcement database.

There must be protective legal standards for access to such records.

Law enforcement officers should be able to obtain medical records

only after persuading a judge that specific records were necessary

for investigating a crime.
56

State laws which offer greater medical record privacy protection

to help their patients must be protected and not preempted. We believe that a Federal standard should set the minimum, not the ceiling.

And, in addition, ACLU is concerned that the use of health care

information be restricted even if most personally identifiable information has been removed. And ACLU also believes that after the

fact notice should be given in the rare instances where health information has been disclosed to third parties, such as law enforcement agencies, without notice to or consent by the patient. Such a

provision should also allow patients to pursue appropriate legal

remedies.

Thanks for your time.

[The prepared statement of Ms. Warnke follows:]

PREPARED STATEMENT OF ANDREA WARNKE, ASSOCIATE DIRECTOR, AMERICAN CIVIL

LIBERTIES UNION OF VERMONT

The American Civil Liberties Union of Vermont applauds the efforts of our Vermont senators in working to put in place ironclad safeguards to ensure the fundamental privacy rights which all Vermonters expect and deserve with regard to the

confidentiality of their medical records.

Privacy protections of medical records have not kept pace with the rapid sweep

of technology, although the corresponding industries related to medical data collection have leapt forward with very little oversight and with certainly no comprehensive and consistent national policy protecting the use of such data.

The ACLU believes that we need to immediately enact a national policy protecting

medical records privacy which is based on the following principles:

• Access to patients' medical records should never be given to anyone

other than their immediate health care provider without the patients' permission. Informed consent should be required before a patient's records are disclosed to third parties except under carefully outlined circumstances. Basic privacy

rights can not be violated in the interest of public health and research, which can

be conducted without such privacy violations.

• Use of any patient-identifiable information should not be permitted unless the patient has granted explicit permission to do so, and the use of

"unique patient identification numbers," Medicaid or Medicare numbers, or

Social Security numbers should be prohibited. Failure to grant such permission should not result in the loss of access to medical care. Home health

care agencies are now being ordered to be in compliance with federal reporting requirements under OASIS (Outcome and Assessment and Information Set) before the

end of April. Under OASIS, home health care agencies are being required to electronically submit•for all clients served•patient-specific information including patient name, Medicaid or Medicare number. Social Security numbers, and diagnosis

and treatment information. The home health care agencies have been told that failure to provide this information (i.e., if a patient refused permission) would result

in prohibiting the patient from receiving treatment. We need a national policy that

would prohibit such massive violations of privacy and the punitive withholding of

medical care for those who resist.

• Information that you tell your doctor should have the same legal protections as information you tell your lawyer, and law enforcement access

to medical records must be limited. Medical records must not become part of

a centralized law enforcement database without protective legal standards for access. Law enforcement officers should be able to obtain medical records only after

persuading a judge that specific records were necessary for investigating a crimes.

• State laws which offer greater medical record privacy protection to

health care patients must be protected, not preempted. Any portion of state

laws which provide for a higher standard of privacy protection should take precedence over the national standard, which should set the minimum standard, not the

ceiling.

Based on the foregoing statement of principles, ACLU supports the Leahy-Kennedy-Markey bill known as the Medical Information Privacy and Security Act We

would not support other proposed bills until they include, at a minimum, these basic

principles.
57

In addition, ACLU urges that the Medical Information Privacy and Security Act

be strengthened by providing for restrictions on the use of health research information even if most personally identifiable information has been removed. ACLU also

believes that after-the-fact notice should be provided in the rare instances when

health information has been disclosed to third parties such as law enforcement

agencies without notice to or consent by the patient. Such a provision should also

allow patients to pursue appropriate legal remedies.

We thank you for the opportunity to present our testimony on this critically imgortant issue, and look forward to hearing a response from Senator Jeffords and

enator Leahy on the concerns which we have outlined above.

The CHAIRMAN. Thank you.

Ms. ZlEGLER. I have a stack of paperwork which is unnecessary

to say a lot

The CHAIRMAN. Sure.

Ms. ZlEGLER. The two points I would focus on. I have something

which was commissioned by the National Institute of Mental

Health from the Mental Health Project in 1978. Part of their model

statute included the right to have your records expunged with a

court action or sealed. It was at the discretion of the court, but one

reason I think it is so important•I should say my background. I

was assistant to the director of a mental disability law clinic that

served as a protection advocacy office. I also more or less coordinated an advocacy organization that was for and by people who

had been locked up in mental institutions. I have a lot of experience with highly confidential information.

In the course of doing discovery I went through massive quantities of this kind of data, and the overwhelming thing that struck

me was how pejorative and how often inaccurate this stuff was and

the incredible impact it could have on someone's life, whether

through disclosure, shared with providers or with the person's

knowledge that this stuff was on paper. It is kind of like having

stuff tattooed on you. Twenty years later what was said about you,

which was simply hearsay or which is blatant falsehood and fabrication, somehow has the force of absolute truth because it is in

a chart, and the right to put an amendment saying that is not true.

Well, I have seen people in court saying that is not true when the

chart is cited as what has been going on, and nobody believes

them. I am talking about people who have psychiatric labels or histories. So I would strongly recommend that you add this to the repertoire because I think without it, the remedy is extremely inadequate.

I also think that the preemption is not a good idea in terms of

you will probably come up with the lowest common denominator for

legal rights. I think there is a real need for states to come up with

more especially because some states may have model things that

are good and innovative, and no one will be able to try them. The

State of Michigan granted absolute right of access to records a couple of years ago. They would not have been able to do that if there

was Federal statute.

The third thing is that I think that one of the issues that I came

across which I do not hear raised, except today it was raised not

as let us do something about it but just as part of the landscape,

is the illegibility of records. You have no access to something you

cannot read. And a staggering amount of what I went through in

that discovery took ages just to try and decipher. One of the things

that occurred to me is what would happen if it was between health
58

care providers and how incredibly dangerous. Let us say it was an

allergic reaction to a drug or the amount prescribed. There should

be something in the statute that requires notations to be in print

rather than in cursive. I do not think that would be an unfair burden on anyone. To have signatures have print underneath and to

have anything prior to that if it was enacted that you have a right

to an explanation and a translation. People have talked about doctors' handwriting and they make a joke out of it, but it is no joke.

If you want to see your own records and you cannot read them, and

that has certainly happened to me, you never saw them.

I think I have taken up more than 2 minutes.

The CHAIRMAN. All right. We will certainly take your document.

Ms. TARBELL. I am Phyllis Tarbell. I am a nurse. I work for the

Dorset Nursing Association. We are the smallest home health agency in Vermont, and I am also representing the Vermont Assembly

of Home Health Agencies which is composed of the 13 not for profit

Medicare certified agencies in the State. We serve between 15 and

20,000 Vermonters each year.

We are very concerned about the new OASIS regulations. Home

health agencies are presently mandated to collect and transmit to

the State of Vermont and thence to the Health Care Financing Administration OASIS data on every home health patient no matter

what the pay source. OASIS records are very personal and sensitive patient identifiable medical information, far more personal

than U.S. Census records which are sealed by law for decades. For

instance, the OASIS includes all medical diagnoses; all current

medications; mental clarity and behavior such as confusion, disorientation, verbal or physical aggression; high risk factors such as

obesity, smoking, alcohol or drug dependency; patient's prognosis

and even bowel and bladder habits are included along with each

patient's name, Social Security Number, their Medicare and Medicaid numbers and their financial status. And all Medicare certified

home health agencies in the Nation are required by the new OASIS

regs to encode this very private information to transmit it electronically to their State and subsequently to HCFA starting April

26th, 1999, and to electronically update those records every 2

months thereafter at least.

Every patient's right to privacy is being invaded by including

those patient's names and identifiers in the documents. And I believe tnat the Federal government should not have a warehouse of

these identifiable, confidential medical records and that they have

no right to receive and maintain those records without the patient's

informed consent. And when patients become aware that the State

and Federal government will be keeping the electronic files of their

identifiable records, I think they will have some strong opposition.

When patients refuse to allow the home health agency to transmit their OASIS information, HCFA has decided the agencies must

stop providing care to those patients. Agencies will be forced either

to abandon patients who refuse to allow transmission of their personal information to HCFA or the agency can risk financial ruin by

losing Medicare certification and, therefore, all Medicare revenue.

All Vermont not for profit home health agencies have a mission

to serve all in need of home care based on their medical needs, not

on their ability to pay or their pay source. We cannot and we will
59

not abandon our patients if they exercise their right to refuse to

provide their OASIS information to HCFA. Agencies that continue

to provide care will be violating Medicare conditions of participation and could lose their Medicare certification. It is just unbelievable to me that in these United States patients can be coerced to

provide this information or have their coverage denied or their care

terminated.

There is a simple solution to this problem. Eliminate the patient

names and the identifiers in the encoded and transmitted OASIS

records. Agency assigned and protected unique patient numbers already included on each OASIS record would enable investigation of

potential patient specific problems by State or Federal officials on

a need-to-know basis.

These goals can be accomplished•the goals of OASIS were to authorize•let us see, to require that the home health agency submit

information that the Secretary of Health and Human Services considers necessary to develop a reliable case mix system to establish

a prospective payment system and to achieve a broad based measurable improvement in quality of care through Federal programs

and they can•those goals can be met without including patients'

names in that information.

What if anything can we do about this before April 26th? If home

health agencies are the only advocates of patients who are not always able to advocate for themselves in every case, we can be

viewed as self-serving, i.e., trying to get out of doing OASIS. That

is not the problem that I have. Agencies have been cautioned not

to present this information to patients in ways that might influence

them to refuse permission. In good conscience I could not encourage

a patient to consent to this unnecessary invasion of their privacy.

Could you?

My colleagues and I will be writing to the Secretary and to

HCFA to ask them to eliminate patient names and identifiers from

the OASIS before we give HCFA a Pandora's box of patient medical

records on April 26th.

Perhaps Congress could persuade them more quickly and effectively than we can possibly hope to. Thank you very much.

The CHAIRMAN. Thank you very much.

Ms. TARBELL. There is a copy of my OASIS document.

[The prepared statement of Ms. Tarbell follows:]

PREPARED STATEMENT OF PHYLLIS TARBELL, RN, BSNA,

Dear Senators and Public, are you aware of the invasion of each individual's right

to privacy and the loss of patient confidentiality created by the new home health

OASIS requirement under current law. Home health agencies are presently mandated to collect and transmit to the State of VT and thence to the Health Care Financing Administration (HCFA) which oversees Medicare and Medicaid,OASIS data

on every home health patient, no matter what the pay source,(except minors and

prenatal and postpartum mothers).

OASIS records are very personal and sensitive patient identifiable medical information (see enclosed copy of the questions), far more personal than detailed US

Census records which are sealed by law for decades. For instance, the OASIS includes all medical diagnoses, all current medications, mental clarity and behavior,

such as confusion, disorientation, verbal or physical aggression, delusional or paranoid behavior. The patient's prognosis, life expectancy, high risk factors such as obesity, smoking, alcohol or drug dependency, even bowel and bladder habits, are all

included, along with each patients name, Soc. Sec. number, Medicare, Medicaid

numbers and the patient's financial status. All Medicare certified home health agen-
60

cies in the nation are required by the new OASIS regulations to encode this very

private information and transmit it electronically to their state and subsequently to

HCFA, starting April 26, 1999 and to electronically update those records at least

every 2 months thereafter.

Every patient's right to privacy is invaded by including patient names and other

identifiers in the OASIS document The federal government should not have a warehouse of patient identifiable, confidential medical files on every home health patient

covered by Medicare, Medicaid, private insurance or even private pay. HCFA has

no right to receive and maintain personally identifiable OASIS files on patients, particularly those not even covered by Medicare or Medicaid, unless patients give their

informed consent for transfer of that information. When patients become aware that

the state and federal governments will be maintaining electronic files of their personally identifiable, private and confidential medical records, I think there will be

very strong opposition.

If patients refuse to allow the home health agency to transmit their OASIS information, then HCFA has decided that agencies must stop providing care to those patients. Agencies will be forced either to abandon patients who refuse to allow transmission of their personal information to HCFA, or risk financial ruin by losing

Medicare certification and all Medicare revenue.

All Vermont not for profit home health agencies have a Mission to serve all in

need of home care, based on their medical needs not on ability to pay or pay source.

We cannot and will not abandon our patients if they exercise their right to refuse

to provide their OASIS information to HCFA. Agencies that continue to provide care

to those patients Will be violating Medicare Conditions of Participation and could

lose their Medicare certification. It is unbelievable that in these United States patients can be coerced to provide this information, or have:

1. Medicare/Medicaid coverage denied

2. Medically necessary care terminated even if they are not covered by MC/MA

or choose to pay privately.

There is a simple solution to this problem; eliminate patient names and other

identifiers from all encoded and transmitted OASIS records. Agency assigned and

protected unique patient numbers already included on each OASIS patient record

would enable investigation of potential patient specific problems by state or federal

officials on a need to Know basis. The Federal Register 1/25/99, states (quote): "Summary: "Section 4602(e) The Balanced Budget Act authorized the Secretary (of the

Dept of Health and Human Service) to require that home health agencies submit

any information the Secretary considers necessary to develop a reliable case mix

system, ... to establish a prospective payment system (PPS) for home health agencies and to achieve a broad based measurable improvement in quality care furnished

through Federal programs." Did Congress really mean "any information the Secretary considers necessary"? That is far to much freedom to decide what might

or might not be necessary to achieve any goal.

These goals can be accomplished without patient names and other personal identifiers encoded and submitted in the OASIS records. There is no justification or need

to include patient identification routinely for anyone except direct medical care providers to see. Medicare surveyors that regularly inspect home health agencies have

always had access to every home health agency patient's medical record during surveys and when problems or complaints arise. But never before have identifiable patient medical records been copied, removed from the agency, and constantly updated

and maintained by the state and federal governments for government staff to access

and retrieve.

The nursing home industry has already been forced to provide similar personal,

private medical information (MDS) on every Medicare or Medicaid patient they

serve. Home health is now to send information (OASIS) on every patient regardless

of payment source (except minors and prenatal and postpartum mothers). There is,

I understand, a progressive plan for more and more health care providers, including

hospitals, to send HCFA their patient information, until eventually the federal government will have personally identifiable medical files on each and every one of us.

It is none of their business and it is wrong.

What, if anything, can we do about it before April 26, 1999? If home health agencies are the onlv advocates of patients who are not always able to advocate for themselves, we will be viewed as self serving, ie "trying to get out of doing OASIS". Agencies have been cautioned not to present this information to patients in ways that

might influence them to refuse permission. In good conscience I could not encourage

a patient to consent to this unnecessary invasion of their privacy. Could you?

I and my colleagues will be writing to ask the Secretary and HCFA to ask them

to eliminate patient names and identifiers from OASIS, before we give HCFA a Pandora's box of patient medical records on April 26.
61

But perhaps Congress could persuade them more quickly and effectively than we

can possibly hope to.

Thank you.
COMPREHENSIVE START OF CARE ASSESSMENT

DEMOGRAPMC/GENERM. HFORMATUN

MMB^JMygSi

47700S

6 40* IMj**• pm *• 4 dgto (4 SS «

(MO*M) StMt Of C*rt tWt.

AIM a a y t t T MM «• f|n

ONAlMtMMfeMW

« «* * » * »

Oa-fMwMM

0MM72) ft F>**rj M#*fi r«»g ftiy tartan •>

O 2-FT 03-SIPICT O 4-OT

O T - TnwMwd M> an n^Wiir* I•MM

MM* MtfJMM] MOMI Agency too to MHMI

i(M«lMU<fta«tH«VfeMI«'CMf« I (Gol-MMM)

O I

O 2

o to pM »•«* MI M MM* )

• MMM O] BD4-H

|M01tt) C««IM Paymcnf SoMrcn lor Horn* CMW:

no

ni

02

D)

D4

a *

a «

D 7

a e

a 9

a io

an

DUK

rm M«M tt o. im * v • XX)

OHMT gnvKMrf (*Q , CMAMPUS. VA. ok )

»» tOWy <* Pw p*ft*r**»rn*T

trnr isara ram
63

COMPREHENSIVE START OF CARE ASSESSMENT

jAfrg used for Rewnptton of Car* FogggdM tjggggl Stay)

rt*O!70| ft••** «J ff» tado-aso, hydfrrd hiili nwlw pana it dart•pad

Ol

OS

O) - tkrmqtvrn*

04 - Olw(H>K«y) __

«nsJbuHdiAr>7(•»*» «• *•• wr4

DMA

x^ OKWNI) te» odfc•tan•itJMrt gyre m a•flJfcafJH

• TiaaHiaiatRoa•

raadk^ or laalraait napman {• g wi,aorrn. tanner*.

O 0-

O 1 -

Mo I K MB. 90 to MOOT J

(HOlMf |M »» pabarf» Medatal DwgnottS and (CD

1 u> CJlogcrW (*nr dg*» rr»Jr ad, toe dads ofltonal)

fir BMMBtfBMi WUttM^^^iMttHtM iBatMnl

Htfwwn (no atrpc^ or V-i.odfia)

Changed Medkal R•wen ft•j| CD

( I

I »

< I

I )

i Prtor lo Mtoterf or Tnnttnanl R*qknM Oaajaja. or

knoattcaai HftBMH 1< Dam: VVa&patMrt raporatnoed aaj

(*r*y **• n» gc et titano* ti wwfc^ at fecdhwnl wywwdnai n»

14 days, nftcsl* arm condajona. Nhcft m*rf poor IP iv Wpa>•I etaO S

II C

a 7

a HA

Md"Jf "eppropad* MMMef

1 tell paanlfHl mpanwaaonlUdJdjajJ

Nona of he above

«tlt7MMI24«t Duonowx and Seventy todex Ud aodi mad** d

cdwgnry (»*e* i*ja-. rrqured fee dgts aadjaaaal no stcgKJl ••» V-codas) and me f

aaajajajaadj tw mod severe BJdjaj aaaaaajdjdaj lor ear* dkaonoaa* >

0 • Otfulwm, notreaUnert aajaajaj] dj fcaj fcm

1 S^n^Aorrai wal caadradad *MTI ctfvanf VMrape

2 - Symptom oontnaled vti ddJiady, «*r* imj defy h#icbonanp.. pakfl n

3 Bddj•jl fnortf ajaadjajad> poneni rvteda frequent adjustment r

4 • Symptown poorty corajoted Iddjaj ft idwipMrduiu

CO

( >

( )

I I

( >

( I

• •j•ledowrn M ajjd^ r

Seventy Rd»»o

OO O t 02 03 04

OO Ot 02 O 3 O 4

©• Ol 02 Ol 04

OO Ol 02 OJ O 4

OO Ol 02 OS O 4

O 0 Ot 02 03 O 4

l«ya-r»«wefSanor*M

O

r

on*ron*n

B6A*&«1 (1«B0)
64

COMPREHENSIVE START OF CARE ASSESSMENT

(MM«Md tor RxstMnpbon & Cm Foiling InpMKrt Suy)

o i

a 2

Dl

a <

•>(TPNsfcl*|

|MmMtan *MHB«*fc. BHtaMHmr. »f*M«eny. or •

l*« Mp^ctancy it 6 II«J*II w 1» an

•ADVANCE URECTOES:

• MlMi PRMBMK

O Copyp

tH»*r. PaDer*! w*^Fi

n provMad to Paaant I

r cMca) mwd Of?

(MUM) WSHRJSK FACTORS

D I -

O 2 •

a 3 - Afcc#*4 dependency

O 4 - OtuQdtfwndBncy

• 5 i Monaafmeabova

OUK- Untowaen

»>HEALTH SCREEMNQ

O Pvaerd racearaa pnvM>

O PdMrt referred to appropriate P*•«NM> >MH acreeneiaa

Qudcem* <ndn*dual nefc tactm A tftaonout delate actual h*M-^l

• Pap- 0 year after MM acbwtjr btgn. Q 1 -3 yaara Mi 2 •MlIt

> age 00 par MO after 2 normal MM

• fctawMwoyapHf 0 year >age 90

« Oejtal / Racial 0 year > age SO

• knmttfuaBona far erAfts tw anal anraafy. latoaua ojiOyr*. |

JnaHatoML MenJowxQyi

-CiareotG

LIVING ARRANGEMENTS

o i

••mad by paflar«c«a*VHgnatcant other)

O 7 - ftw% fwombef» MMM

O 3 • aVafalMJ WWW 1 wiad ••

O 4 - Board and cant or uurtu) hang laoety

05 • OtHr<apaca>T

I-MJ19) 1

am««o ^dependent motMay (Mark alt thai MM

O 0 - Nona

O i - SU*» traude home **ech M> UMO by Vw patter*

(• g . to 9H to loaaMno. atoapaaj eaftng area*)

• 2 - 3U*x rade home aWl ara gaaC

(a Q. to flat to laundry faciiu)

O 3 • Stan taadng horn etude houae a

Q4 - Harrow or otOwjctod doarwayi

s&p ream iaea~
65

COMPREHENSIVE START OF CARE ASSESSMENT

(Also mod far Resumption of Cam ro*owtnp jMghg Stay)

i SllKjtMfl HUM<]{ found V Ov pUM<r» C

pUarkaaOWappry.)

Mructed ta fat prcvenbon IIKBWM

Ralamrdto

(ccnikJw .d^iTlo PT OT. USW «MTutriS#

VA8VT, VOL. HC>

D 1 -

D 2

O 3 -

O 4 -

O 5 • VVO> pMd KMp (oowjr t

06 W» other tun M

• ABUSf /MEGLfCI fU«rt ,• a

a 1 - None

Dl-M

home car* ancnqr «*T) OS- EMdcncvofnegtacf. i

(twiMi awHfcl^••WO*»*wHWCw »Q*aty»

(Maritalthai apptyj

a i

OUK

Person raktnj in Dw hom* (EXCIUDMG pa«l hr*>)

PaMhMp

Nan* of the abovt (If Mow or u«*- above. i^litaM«MHAss*

Unknown 11Usauaow*. skip Is StM«rr Mwl Aiirstmiirj

[M0J4Oi Primary C-anrgrw twang |*a| ajawwj>la*f r*f prrwfclng or •g*M, rh» paaenTs can-,

(other INK hom* car* agency it«/r,

O 0 • No on* parson IW Wo ana person, sfck* ** Sensory ewBwl tew m•nH

O 1 - Spew

O 2 - Daughter or S«n

O 3 • Otwfi

O 4 - F**nd<

O 5 - Pad he*>

OUK • Unknown (H Uataom. slop ha Sensory Statin torti

prowSng Iht mod fraquam essotanc* efc

<M*3F«l How OOan 4on rw (Mbarf (i

O I

O 2

O 3

O 4

O 5

O 6

OUK

Several bmes dunnrj day and raght

Several ttmaa during day

OK* defy

Tr**» or more tanas par we*t

On* lo two tone* par week

Law* o«*n than Maafj

a rcm fw primary earagnir?

(M*]») fn>»«fhfnjrj C•njrv** feUitii.t (Mart N that fjM

O I - AD1 awrJ^n* (r j t.*)»r«? *r-.-^j 1<**v*, [*•**<***.**«. »*!nj1wr^rx)}

- lAtX awnfanr* (« p,. mads, meafc, teuse«e*p»nQ. tauntfn, iei»phone, thoppmo, Ananc*%)

- EfWonmtnal support (housmg. tent* maoaenancc)

PsychosocM support (saenfuahon. nimpareonehp. recreabon)

Advocate* or facaaar.es p*benTs partapebon n approprvrle mcdKal car*

1 ftajMBwi agent, power of attorney, or consarvaloi of Unarc*

• Heath car* tganl. conservator or parson, or **wjkwj pawn al aWomay

O 2

O 3

D 4

D S

• 6

O 7

OUK

TwVD^ *Wkwenjor**naOASl&-At (l-Vrff
COMPREHENSIVE START OF CARE ASSESSMENT

(Abo read for Rwiapto of Caw Fofcwwiwg tapaCem Story)

SENSORY STATUS

a c*nct»R/L a

O 0 • Norm* v»«n W*<*qm*+f i matf aHuaflcm;

Ol- P«*»*» *•»•#•* CMMI IM «M<acaltan lafx* a

kgn M arm* tenojn,

O 2

•EARS ftUttt am that apply i O Hun^ «H'i OTlm** OVoragp DO*** (*p«

OO - MB gj•It) *wp•TWO* AM» •httt•••MMOjtoJ o

OI- VW< mrwnaj ctrkAjty sjbfc to hoar and wvterstand «

rapOVJltoft, totfnj Itoto. Of tUfftof VOK: e

0 2- MM modbuto «fia*ty I•MI MVI widanUndvig wnpfc. *

O 3 - HH wnt <flk>t|r M**ITW and undrfitandng «n(Mj |MB|| and short

trnmrnmrntmrn, •amomi iw.

O 4 - it-^«»«i-»<-i-*«»->n-«•»*n»•

•>PWAi. »*Mt *• ttw< MMMj OOntm OM••• OGwPnHM tmWkmmjmi•g

OOVwr {•fwc*y)- D Damn pntam OMol•m

(HHttt SfMMc* ng Oral |WMM Eipmmn of language ** P***** *m Unauagt).

0 0 • Ejyiw 11 cowpffai «*-rv W*ngs and ne*<** dtearty. I mnpfc>i*|f. and mtrnf m *f jJuationa nth no eUtmMt mpwrnt^

01 - MrttoaJ dMnAy to «*jraBHg dm and imA (may UU cam fcaae. 1 '

W»Ot) fr» ••B1 ftotoj Mtortoratg pMl o•tonr> •Mfcj of ww>w«

O 0 - Plowl has m p*ci « p«an dots not rtcrtv* «*Jh actrv*• or fa•<

O 1 - UMflftMhandaJy

O 2 - Daty. bu ml cOTt»j<l|

OS - AlartMfm

(MMM) a**.-t*b*# P*tn to tm •»•! ffpartanuna, own IWnoi aaafj nanorf ••1 to• «fc aad al»ac*i (he paftinfi

•faptfav. pnyaacaj of onoftoitol anargy. conconaralnA. poroonal retstonaA^Mv oai^bona. ar •Baajy or Mm to poikam ptiywc^

O 0 - H*

CM • Ya»

»HEMATOf»OtETtC ASSCSSMEWT (Mark afl tHat apply )

•SMHASSESSMfiNT (Mark **at apply.)

O Hi O Rajr* O Scatng 11 Poor Tisgor a OffMf 0pac*r)

O DWM pjgkMWi QWaMMiB

Urn-aaanat^an^^opon-alp•d loC UaMtlnaiWo SESKM (t44* "
67

COMPREHENSIVE START OF CARE ASSESSMENT

(Also used for Retunpbon of Care fdtomng tnpjttenl SUy)

(MW4I) Ooea B« (Max* f-"I- J SUn i•nor *• Open MCMMfT Th*

0 0 - H»|«"OL>*"-

O 1 • *m

*• won IMMW or open wc

ndwki "OSTGUES '

O 0

O 1

|*M im Cutr*** in(fT«v*TUkmi(fid.SUgt (Caor on* rnpona* tar *•* abgc )

j> Stag* 1 Nw*tanchat*r *

t>) Stag* 2 Parta** s «tan *»s rwr*<«ig tpdnrm and/a dcrmr> The ti

down to UJ M( (nt^i und«V9 '«K» Thv •*» pi****** camcaiy *

luiihrfiiMf r«md

d) Stag* 4 Fi*«rtlr« UJ! k-t-, -«, rltnvM

or Hf>partaB *«*•**(c g. tendon, jm*

tn MMto •»* (tow k »>•• « l*a»* on* preaj

of ncfww or aWPwBi Acs^rg r^udhng D

O 1 -No

O 2 Y«

|NMM| SUge o» mtwl Pio.

O I • SBgal

O 7 • Stag* 2

O 3 - Sag* 3

O 4 - Stag* 4

ONA -

(OtoM-rvaM*} Sum V*rr

(U4444J y*«-*of MoUP

O 1 • 'i*TO

O 7 - EMVP*^* granuta»on

O 3 - Notheaftng

ON*.

O 0 No | « No, go la MM] |

O 1 - Yes

(M&470, CuarernN

O 0 Zero

O 1 - On*

O 2 • Two

O 3- Ttaa*

O 4 - f cw or mae

OI-YM

pirn

canaatar ucfi opanmg, as a separate wound)

O 0 - .-«-••:

O 1 - On*

O : - Tata

O 3 . TW*t

O 4 . four «r <•*. .-

• In pdtart rune at Ira* on* Surgical

b* Otaaanr*d dwt ta In*p•M of

O 0 • No

O t Yes

Wound that Cannot

(MM 74) Don thr. pake/* H**« at Man c t SUlH Uk*» tnaf

1••Hf|a drwswng"*

0 0 No

01 YH

0 l

02

O 3 - Hot

ONA- No

-SfQ- atauarpaFdtaaj 0*30-8< (Tu>»)
68

COMPREHENSIVE START OF CARE ASSESSMENT

MMHOW STATUS f*Urt *• ttut ***, ) (f *TT

O *Af*p«**WT»r

tftCSPVUTOfff ASSESSMENT (fcUrt *J

n coup* *******(

O I

O 3 • WKwranacMtttonfep

c*w ADO) or *4ti agfcrtm

O 4 • Alntjiinjditgn^i

OO - M

Of - v«

OHA ftatjj 1 prqph»Ucfc. I

OUK .

O 0

O 1 - DwqtwragN

O ? - Outngt«<tor«

("MM] Urvury ktartiMMt «i Urinary CaBitfe* ft•Mi

O 0 • MD kNMMW * o

MHM I ••»». «Up I© G

O I - PMkKolml

O? • Pabvri fegjum a mwy OHVMIM ft * , *tf«mri MM

•^OASTKOBnCSTMAL ASSESSMENT pUrt at M ««*y )

O 0

O I

O 2

O 1

O 4

O •>

(MMMt Ovtawy tar |MI

oaaomrlor tO»d Wwwtm fial

lo art np«fcart tacMy oay o/bl

OonliaipriMhMW

hrrO*mtl^^ gOAS1S-4t (.(WO) "
69

COMPREHENSIVE START OF CARE ASSESSMENT

(AtaamtdfctlteowipttonotCjre Following InplUKSttyi

H•W•MM•WM1M1•IIIXOI«H»H

0 rnquHrtorBMrahcjaaOHM oa«l«*M' O

O 0

O 1

O 2

O)

O 4

ONA

O 3

• 4

a s

o «

TTnugKi of sunfe

Now of 9w trfeow iocBi^^ cbflsnMd o

O 2 - Oa*T. bu» net con*rtr

O 3 - AJcrftw fcr.

OHA-

#MC1t) B«bnton Demon,-*.*** iC LMI« One*? • Waefc (Reported m Obw>id|: (M«t *•

O J - VartkJl darvjptnft. |i*\). n^

O 4 - rrrr*cXm&i

a S

O C - tXnawwl, hMfciJilirj. or ptvanc*d b*h»vt«

Q 7 • Hone of BH Mbnt MMM <J^nons«r«HxJ

{MO* Jfl) Fvvc^Mficy of ocft*n*tf PWJMMM p

Ot -

O 1 -

O 2 -

O 3 -

O 4 - Sr-nr**

O S - AttoMld

•am kto»p«b

O 0 - Ho

O I - T«

9 F^I^JMMWC NMTlJfifl '••T^C 11 Jf hc*n* ptWMV* tFf i ^jvUfaO CM^/VaTlnt rtus-f ?

t»WUSCUU»KCLETJU. WT(Ml. J*W «PP<TJ

Q WKBIII OQKitBrtROMiipec^l

ON4M«tHd

8

nagBaBiwaCTi tw|~
70

COMPREHENSIVE START OF CARE ASSESSMENT

M*3B5MM*jrt|gMjgMMJ

UFE SYSTEM PROFLE: Fa •»-p*»-cam..

«Mti»M.»».>CT«.m,i•l i .,

-W»ltltUMj*«« .^>.i^.•a- . IlirMlWtonmtojJl A»»M..iW,«H<ili,i.,l.lU^.^;

_f""'l To**"* AoB,«>o«l.mlta»»,»*i•tei-,<«•

Ed> CUXVJ

O 0 2. lUiltylkMtaNhHtiHUli O 03. lentfelogHtoaMtaBteuM,,

O o 4 - " • O UK.

wp«>»*d br MtfM (wwn. tffe to ort to M »

ITTflSWr
71

COMPREHENSIVE START OF CARE ASSESSMENT

(Also wtd far Resumption of Can F&kmktQ faggjfafa Stay)

•••fa•!•• fa^fatWI>faWfa<fa#^W»^<MW*«WWi<l.*«»»^«<l¥>»iri^W^.«^<^fcfa>«lifWfaBM>ll

MlpMUMM

fr-oj QiBtrf

O O 0

O O I

O 0 2- fajfaj to twite tJMi•Ito fata WfaJI •*» ffal rfafaj tfa »*"**» p•*

O OS- ttoarbt* to fcanafcr aef «nd »^f|MrtebM> wugWiFpwat«*»>>»ri«*«wJby iwoBta

O O 4 • Baefeol. UMU* to H•faj but b Alt to On and Ifafal **•* bad

O OS- BadtaM. aaajja, to barrator •I d ypajjaj to ton Mi pfarfai MI

«WJTM| faj<Mfatoj«a4WMpjj>MK <MM»fajg|3t«MX anoaai Hto»||M>t « •«»i*M.«Mhli

Us CtfWf

O OO- AMt to rratopandardy aw* en wr and ajaajaj fadfaaj, and dwt> fatoj •1 or wthout Bafap (1 .« . I

ajaartM* drric*)

O OI- Raoj^ara* »a» ol a drrtea to g. eana. nad^ to wa»i drw or raguaa* humans

•tjfaa

O 0 7- Mi»te«rtla*ftifWK»u*W(i nildi : 1 o« aacaW panwai at al»

O O 3 - CtartX. •j^faiil>fafa>tMfc«*%faWtojg|taf>a>ja»J>j^

O O 4 - CfaMrtodlwnartetoaa4»A«l*arKjauaafe&toafaMaal

O OS- Badfcsi unaM* to ambUata or fa up « a chat

O UK - Unknown

fJM7W* faadJaajwCaawg; Abr*y to toad Mff •

Bte Cue**

o 0 e

OOI- Aftte to toad «Hf ***p*nden«y but n

M maalaiUai.G

M

(c) • kaad. pumad m ground meal dtoL

O O J - faJlfa to toad aaf and m6 fa aaintort or pfaWfaMj fagtadjajaj » aaaajaa,

O O 3 • Abto to Ufcg 1 nMurt* oraly and racom -myannwaal nufavnh ffrr»j/> a <\

O O 4 - |tojfaj to MM n nuMarts only and • tod Hflfafa taouah a aj

O OS- Ifcwjbtetotaagetndtnantaoratyar falafafaffaj

(l»7»| PfadJrJfaj and fafajdjaj Ugtrl btoata to, |

fjtoj CMOati

O O 0 - W At* to

« preparation n Vta past (I a . pnor to tm hom* cam atnuon)

O O 1 • |faj

0 0 2

(M07») Transportation: PhyacaJ aajgnmtM atdry m aajdj

EBB ZitOtt

OOO Al*to aidapcndardjvdnw angular or

OOI- AtaatoiUaai«C«ardra4iandrtntfib«

Unabto to ndc •> a tar. tad, but. or wan, and regies tojaaaadjdjaji or a

(WO/44) Laundry: rfafaj to do •fafjfaj - to carry toajajbj to and to• aTJafadJ wraJpii. to ta» waaner and dryar.towaah aaa* tarns try hand

BflBJ £tfH"J

O O 0 - M **** to «J^xndan»y taka cam of al towrdry taaba QB

lb) nuinati.n^diiit, ail T n-aTy ditr fln fafaajfa »irt»iiw farraTa I QJ ha nrt imnrr) paTu -iilMnrrrt-|r'~~' "

(1 a pnor to ta, tan* car* adrMsaron,

O OI- AM* la da only rkda laandry. tut* as nanorhand wash 01 aght annhai toads Ou* to physical cogndm* or mantd antabonv near

avAtmc* •** l**»*r IJttf-Ory v* h as. urr*r«) 1*^* n**. d u.«v*T

O O 7 • UpJtt* to do any touwdry do* to ajraajcaj tardabon ar naada eajdjaaj aaajanaaaai and asaatanc* fan to daaajfal aj fjajdaj fafal

O UK Unknown

^^^^^ 10
72

COMPREHENSIVE START OF CARE ASSESSMENT

O O I

O O J

O O 3

O O 4

• Wl'II.

H) Wfci»M^»«i•rui j» ii |iai nag

(b> Ptiy^jtf, oogn»Ml*. •rtn**a>«M»hipalta«tfEMMMtMtaMMMrtiiMM

«.p-ni..pn.tei»ini[. i

Wfcim•««»t|t>« i »ii[-«.M<1^»iiM-m..n ) i m

*"~ '" ft" *l'll III U*^J !•!! WOTl HMII*lllwi^BIH imnWWllPUlM |<IM|

Y-TI m'fBini aiiani |i««laiiin0iiiHHii pmwii

lavtoi nnipum u%»|i»i>i>i>i.Mf

em cion -

O OS- (DAbotopuntaiomannnd

O O I

O O 3

O UK

OMM>!»•<»mi mi.u

•rOWtUlamlU^laiiaHgtoMnan

an

•i"ia»innnn,i(l

M•I >iatj>ou• T«I

O O 0

O O I

O O 2

O O 3

O O 4

O O 3

O O NA

O UK

MIMUMnali

H*lowiqwMfrA|MI*rhM^.tagiii .t.«»W.W.kt.W«,j,

«*»! 11.1 •t*i«i«kto(aij««l|il

iKil•MH» i I

MEDICATIONS

atimi

HOT* 1HsrakntoaM»r.

&M Cuxas

O O 0 - At**

O O I «HUHindal>H<t>iai«l

MMM

lb) g>«i aar nnMaK SB

(c) kwwdmfcwi

O O 2 - Ustfjfetob**iMla*a

O O NA Hoar*

O

dMt*WH)MWI||"'Ml*.nM*«MH

mii»ri«riii|«>AHjblen.a0*ilalili wJHi

O t • IW>U.Mca>IMaMinl

M ta***J*Mpua MJUKUJ •••••«• ft) •

O 2 - Uj^ajtoMMt »••»•»•! unto* •liM*».iiail by*

O NA - IN •*!!«• in•liiiijtfiiiiii Iinl

UK •

age tf tttta

bqpQ ••VflMWiMfMI*!

O • any an* rapanw •ftjMtf •am iMBi •
73

COMPREHENSIVE START OF CARE ASSESSMENT"

(Also uted fof Rtmnpdon <rf COT rufcwriMg fc^Mtttnl SUy)

O O 0 - At*tPWVpwil•*»tfl» HtU»l»fl Milt <ln<l»dMU»«

o 01- MM•rtjMMMi iM*t^aw g •1»w» t

MIHMMM

o o HA • m wfcaM*1^1pwM

O UK

w«m FI» nil 1 i««ri > «M*iMI«

M3TC: THt rrtprt to *XKj. iw* o

O fl - li•Ml «MMMMMI to *wnm* m,«%W| jUJMiB

O I • «•

MMMMM. ASSESSMENT INFORMATION DOCUMENTED ON OUTCOMES PLANNER VISIT H

Signakm of NunWDonpistt

Sigaiture of DaU Enlry On*:.
74

The CHAIRMAN. Vicki.

Ms. GIELLA. My name is Vicki Giella of the Area Agency on

Aging in Northeastern Vermont. I am speaking from the perspective of a very small local rural agency, and I would just like to

speak on behalf of balance in the area of individual need for privacy and agency needs to collaborate.

We work very much within an environment of confidentiality and

releases. We never share information without release from clients;

however, more and more as the health care environment changes

we are working within coalitions and within consortiums of health

care providers. So whatever•however the laws are changed, it is

important that these local providers, and this is even within an

area where there is not very much managed care, still in order to

effectively work with patients, we are going to need to be able to

share patient information. And so whatever kinds of ways in which

the rules are changed and privacy is enhanced, we still•we do not

want those rules to create a situation in which we will not be able

to care effectively for very•in many cases very frail people and

have their health care harmed by those regulations. I am saying

this completely within the context of confidentiality and releases,

personal releases.

The CHAIRMAN. Thank you, all four of you. I appreciate that information, and we will make that part of the record. We will be

back in touch with all of you I am sure, as we proceed along.

Thank you again.

Our final panel is Patrick Biggam of Vermont Labor Council;

Brian Travis, M.D., medical director of Central Vermont PHO;

Julie McGowan, UVM and AMIA.

Patrick first.

STATEMENTS OF PATRICK BIGGAM, ESQ., VERMONT LABOR

COUNCIL, MONTPELIER, VT; BRIAN TRAVIS, M.D., MEDICAL

DIRECTOR, CENTRAL VERMONT PHO, BERLIN, VT; AND

JULIE MCGOWAN, UNIVERSITY OF VERMONT, AMIA, BURLINGTON, VT

Mr. BIGGAM. Thank you very much, Senator. My name is Patrick

Biggam, and I am an attorney in Montpelier here on behalf of the

Vermont Labor Council, AFL/CIO. I am a practicing attorney for 20

years in Montpelier, and our firm probably does more Worker's

Compensation claims than any other firm in the State. In addition,

I am past president of the Vermont Trial Lawyers Association.

The Vermont Labor Council's position is that protection of medical records is obviously a very good thing, and they are interested

in the same rights and protections for the members as they are for

the people and the public at large. The problem that we see happening, however, is Worker's Compensation carriers seek to be excluded from this bill. They have done so on the State levels, and

they are doing so on the national level as well.

Now this exclusion is not a small exclusion. There are over 113

million employees covered by the Worker's Compensation system in

this country. It is a $70 billion industry. In Vermont alone there

are in excess of 25,000 first reports of injury. We represent granite

workers obviously being in Central Vermont, but the bulk of our
75

clients are either secretaries, nurses aides, people in white collar

positions as well as blue collar jobs. We have a lot of carpal tunnel

injuries that we see. We have a lot of back injuries that we see that

are related to all walks of life.

What happens when a person is injured in Vermont under the

Worker's Comp system is they must sign a medical release for all

of their medical records to the Worker's Compensation carrier. I

have two releases that I have brought with me from two cases that

we currently have. The first release is from Chubb Insurance Company, and it required our client to authorize every doctor, dentist,

medical practitioner, pharmacist, hospital, insurance company, consumer reporting agency and employer to provide them with any information which is with respect to their diagnosis, treatment or

prognosis of their medical condition and any nonmedical information about me which is relevant and requested. Now that is one

type of release that is mandated by Chubb in order for a worker

to collect Worker's Comp insurance.

The second release that a client was required to sign is even better. This one says, dear doctor, we have received notice of an industrial claim. Please send us all of your medical records. Since this

is a Worker's Comp claim, no medical authorization is required.

Now this was from Safeguard. What is happening in Worker's

Comp

The CHAIRMAN. Is that accurate?

Mr. BIGGAM. Well, in Vermont that is not accurate. The problem

in Vermont is that there is a Form 7 release. Very few insurance

companies provide the Form 7 to the worker. Of the 25,000 claims

that are filed in Vermont, less than 1,500 have an attorney who

gives any advice to the people about what their requirements are.

And so as a result, they get away with a lot of these letters and

releases.

The other thing is what are they doing with this information. We

have talked about Big Brother and the collection of databases. I am

informed that the American Insurance Services Group, which is an

insurance company database, has in excess of 57 million claims in

the national database, which I am sure include my clients and the

records that I have been required to give to those insurance companies. They do it on the allegation of prevention of fraud. On the

other hand, how many people want their medical records in a national database of this sort?

So basically I would argue and simply in a presentation is we

support the bill. We would not like to see any exclusion for Worker's Compensation because what you are trying to protect on one

hand is going to be let out the back door on the other if Worker's

Comp is excluded. Thank you.

The CHAIRMAN. Thank you.

Dr. TRAVIS. My name is Brian Travis. I am the medical director

at the Central Vermont PHO. I am also the director of the department of laboratory, medicine and pathology both at Central Vermont Hospital and Gifford Memorial Hospital in Randolph. As a

specialist in surgical pathology, I serve around 25,000 people in the

Central Vermont area and render 40 or 50 diagnoses•individual

diagnoses a day at a subspecialty level on these patients which influence their life profoundly including whether or not they are
76

going to have major surgery, whether they have to undergo dangerous chemotherapy or radiation therapy.

I am sitting there like in my office, which is right upstairs, every

day making these huge decisions, and I need to have information

right at my hands to important X-rays, to previous diagnoses of

cancer or not, to the fact of whether they might have HIV or any

other thing that might help me to make this decision that influences their life profoundly. A mistake made there can lead to absolute tragic consequences.

And subspecialists like myself need to have as much information

as we need. I do not care what their name is, but we need to have

as much information as we need at the point that we make that

decision if you want us to continue to support the infrastructure of

the best medical system in the world.

Along with this kind of access needs to go•needs to be accompanied by protection which is the whole thrust of your legislation.

The audit system alluded to by Dr. Gettinger and later by Dr.

Ward is something that every hospital that I know of in Vermont

is capable of implementing if they have the right mandate. Every

time a medical record is accessed by a provider, there can be a log

of who it was and when they did it. And if we were mandated, we

could go through these logs in a systematic quality manner to look

at the accesses that were not appropriate and take appropriate action.

A guideline for appropriate action also needs to be promulgated.

It is left up to the individual institution what is appropriate action

at this point. The reason I know this is because I am a computer

programmer also in the modern computer languages and am familiar with the systems that we have here, and at Gifford and in other

places.

The last vignette that I have for you is that it is a Federal mandate through the JCAH, or joint commission, to put the patient's

name on all requisitions for lab tests or anything else. That needs

to be done away with so that maybe we could use a number or

something so that six or eight people do not see the name as this

request is entered into the system.

The CHAIRMAN. Thank you. Very helpful.

Yes. Julie, please proceed.

Ms. MCGOWAN. My name is Julie McGowan, and I am a medical

informatics researcher at the University of Vermont. I am also a

member of the Public Policy Committee of the Medical Informatics

Association, a national association of almost 4,000 physicians, researchers, health information professionals and others interested in

the use of information technology to support health care delivery.

My comments reflect my own and as a member of this organization.

I would like to begin by thanking Senator Jeffords for introducing S. 578 and both senators for taking a leadership role in examining one of the most critical issues facing health care today. I

would also like to thank the staff of the U.S. Senate committee for

their willingness to listen to our concerns and formulate a balanced

approach to the need for patient confidentiality and the need for information dissemination in support of health care delivery and research.
77

Information professionals are commonly perceived as placing the

need for easy transmission of health care information ahead of the

privacy rights of patients. Nothing could be farther from the truth.

We support strong uniform Federal confidentiality standards to ensure that each individual can feel secure that his or her health information is protected. We also feel that all health information

should receive the same protections regardless of format, whether

that format is a paper record or an electronic medical record.

In the area of research, academic health centers such as the one

at the University of Vermont have established thorough IRBs to review proposed research and ensure that patient's rights are protected. This is especially critical in prospective research in which

patients are recruited to participate in various studies. However,

sometimes it is more effective to use data from large aggregate

databases or data elements from individual records from which all

identifying information has been removed.

In these instances it is•it frequently becomes problematic to

seek individual patient permission to use information in a medical

record which is 10 or 20 years old. Although the information is old

and/or aggregated, it is still critical to ensure the patient's privacy.

Again, the IRB should review such study designs with the concept

of patient confidentiality protection as paramount.

In today's, health care environment high quality and low cost are

top priorities. Institutional quality assurance initiatives also need

access to patient records and aggregate databases. Often these do

not fall under the umbrella of research or IRBs. However, it is essential that all policies and procedures regarding the use of protected health information be consistent with Federal policy for the

protection of human subjects.

Senator Jeffords' bill has gone a long way in addressing these

issues. It presents a balanced approach between the rights of patients regarding personal health information and the needs of

health care providers and researchers to use such information to

deliver care to the individual and to promote health for all citizens.

Thank you, Senator Jeffords.

The CHAIRMAN. Well, thank you all very much. The time has

come to an end, unfortunately. In many respects, we have heard

wonderful testimony today. I deeply appreciate everyone who has

assisted us. I also, of course, want to thank the Central Vermont

Medical Center, especially its CEO, Daria Mason, who gave us fantastic help, I appreciate it; my reporter who is still rapping away

and doing very well; and all of you for coming and helping us with

this very, very important issue. The outpouring of people we have

had today, as well as the testimony from our witnesses, demonstrates that this is obviously a matter of deep and high concern

to Vermonters.

I am sure I speak for Senator Leahy when I say that he and I

will make sure that Vermont's interests are as well protected as

possible. Thank you all. With that we will close the hearing.

The record will be open for 2 weeks if anyone desires to correspond with us.

[Whereupon, at 12:16 p.m., the committee was adjourned.]

O