Direct contracts, data sharing and employee risk selection: new stakes for patient privacy in tomorrow's health insurance markets.

I. INTRODUCTION In the decades since the United States Supreme Court's consideration of informational privacy in Whalen v. Roe, a couple of worthy candidates to fulfill Justice Brennan's premonition of "future developments" have emerged. One is the nature of information technology itself. Today, sensitive health care data are generated, stored, transferred, and deployed toward countless uses with astonishing facility. An inexorable shift toward computerized medical records and fully automated storage and transfer of patient information is well underway.2 Consider the Whalen Court's concern in 1977: the threat posed to patient privacy by a centralized reporting system that collected prescription forms for controlled substances.3 The forms were filled out in triplicate by the treating physician and forwarded to the New York State Department of Health where they were "sorted, coded, and logged and then . . . recorded on magnetic tapes for processing by a computer."4 In 1998, New York State enacted a law converting the state-issued triplicate prescription form into a new single form that pharmacies will forward to the Department of Health for all future monitoring of Schedule II controlled substances and benzodiazepines.5 The entire process is electronic and instantaneous.6 The other ground shift since Whalen is linked to metamorphoses in the organization of the health care system. Led by employer intolerance with double-digit premium hikes in the late 1980s,7 managed care spread rapidly beyond its early strongholds in California and pockets of the Midwest.8 Managed care organizations (MCOs), with their ability to bring market incentives to bear directly on the doctorpatient encounter, were positioned to provide care at a lower cost and thus could respond to employer calls for cost containment with lower premium bids.9 Competition among various delivery configurations has spawned a variety of new organizational forms and caused considerable market flux.10 More than 73% of all privately insured workers and their families, approximately 40% of Medicaid beneficiaries, and approximately 15% of the Medicare population are now in some form of managed care.11 New financing and delivery arrangements rely heavily on data from the patient encounter to calculate expected costs, track expenditures, reimburse providers, monitor health care utilization and improve quality of care.12 For physicians, multilateral responsibilities have replaced an ancient tradition of bilateral commitment. Exchange and use of health care data threaten patient interests in privacy and confidentiality as never before.13 This Article describes a particular type of organizational arrangement and examines a set of concerns this arrangement raises regarding use of health care data in the workplace. Direct contracts between employer-purchasers of health insurance and provider-sponsored organizations (PSOs) differ from more conventional managed care models by not mediating relations between purchaser and provider through a health plan or insurer. Part II describes the history and use of such contracts, highlighting several recent developments that focus greater attention on them as potentially attractive delivery options. Part III argues that the tighter nexus between purchasers and providers in direct contracting arrangements accentuates troubling incentives to transfer and use sensitive health care data in ways that may conflict with the best interests of employees. Part IV analyzes legal protections, both current and proposed, for dealing with misuse of health information by employers. After identifying a number of shortcomings in these laws, Part V briefly outlines one policy option, the "health information trustee," for safeguarding the privacy interests of patients receiving their health care through direct contracts. II. DIRECT CONTRACTING ARRANGEMENTS: WHENCE AND WHITHER? A. DIRECT CONTRACTING DEFINED The term direct contracting refers to an arrangement for the provision of health care services conducted between a PSO14 and an entity not licensed to insure, typically a self-insured employer or business purchasing consortium securing services for employee groups. …