Your Medical Records: Public Property?

Whenever we go to the doctor, we naturally assume that the doctor and their staff are going to safeguard our medical records, personal data, and financial information from exposure or theft. Granted, sometimes people cannot be counted on for that, but the general sanctity of our personal information at the doctor's is something that we expect- and that the medical establishment is in our corner on this one. However, like most assumptions depending on the Good Faith of Those in Government, it is false.

The first thing you need to know: you do not technically own your medical records. The copyright law on medical records is murky at best- your doctor actually owns your medical records and holds them in trust, but legally, they belong to him or her, as they did the work to fill them. Conversely, there are arguments that you own the paper they are printed on, but your doctor actually owns the content, which is where the real value lies. Murkier still, if these records are being kept electronically, the software firm that designed the database actually owns your records, with end-user licensing, proprietary software and Digital Millennium Copyright Act issues coming into play. There has been no strong precedent or finality in sorting through these issues.

Recently, the Institute of Medicine convened a workshop on what has been termed the "learning healthcare system," and how it promises to revolutionize clinical, lab research, and pharmaceutical data reporting in order to ensure greater outcomes for patients. Sounds great, I will admit, as most things do in theory. The question is, are you willing to allow a government agency or private firm harvest your full data, remove personally identifiable information, and make it part of a public database? This is exactly what dozens of agencies, research labs, hospitals and private firms are salivating over. You are the sum total of your data, and now that data would be public.

Consider the following scenario.

You go to the doctor, for that raspy throat and burning sensation that has plagued you on and off for the past few months. The medical transcriptionist enters your intake form into a database using your national patient identification number, assigned randomly by the overseeing agency. As your symptoms and personal information are entered, they are tacked onto the end of your patient file, sitting somewhere on a massive server, able to be instantly recalled anywhere, anytime, by anyone with proper access. Triplicate forms are replaced by three computing sites in California, North Carolina and Minnesota. After taking down your symptoms, they enter that data for a cross-reference against the region, your age group, your medical history and your gender, seeking patterns and explanations.

"Hmmm, interesting," the doctor taps his stylus on the screen. "Based on the aggregate data for your age and health cohort, we've had a 70% improvement rate on the reduction of coughing fits with this treatment program."

"I don't have many coughing fits," you say. "It's more of a sensation, a burning."

"It is probably just a different manifestation of the same symptoms," he replies coolly. "I'm prescribing a three week drug regimen for long-term relief, but short-term relief can be had by this spray. Please pick up the sheet from the front desk on your way out. Make another appointment in two weeks if you haven't improved."

As you drive home, you pop the first pill of your three-week treatment, choking it past a protesting throat. The spray, a peculiar-tasting concoction, is actually starting to work, to your and you are certainly pleased that it is reliable. Pulling into your house, you see a strange car in the driveway. Oh yes- the home appraiser is due today to give their final assessment. You have been optimistic, as home values have finally been rising after the collapse of the market years ago. As you enter, your husband looks sick to his stomach, and the appraiser seems to be actively trying to console him.

"Honey, this gentleman has some bad news." He looks at you with a mixture of anger, disbelief, and despair.

"I'm sorry, ma'am, but we simply had to take these other factors into account," he sputters. "While your property itself is highly valued, we cannot ignore the medical data for this neighborhood," Your stomach drops and twists up, all at once. "There are remarkably high respiratory disease rates in this county. It's all right here, if you want to review it- two standard deviations above the mean rate nationwide. Best as we can tell, it is due to coal-fired power plants a few hundred miles away. This is public information, after all, and our supervisors insist that we access these databases in our assessments. I'm sorry."

He hands you a bound report. There it is, in black and white: your county has been flagged as needing immediate attention to ambient air quality, with high levels of many types of pollutants, illustrated by colors wafting over multiple states, right over your home. Another page shows a map with your county glowing red, at the tail end of a trail of bright colors leading hundreds of miles southwest. 'Respiratory Illness Rates,' it reads. You take another spray, mind empty, heart racing, future plans fleeing before the pained truth in your hands.

Meanwhile, in a computing center in San Diego, or Durham, or St. Paul, an IT sub-contractor has just gone to get a smoke. He does not log off his workstation. An office supply courier enters the office. Updated files are compiling by the second on-screen, awaiting de-identification to add to the database. Opportunity knocks. Your record pops up just as he plugs in a flash drive, and begins entering commands.

Scary picture, yes? It is entirely possible with the technology in place. But the real questions is, when you weight out the pros and cons- Is it worth it?

You might not believe it after the above story, but there are demonstrable positives to this plan. For instance, with a national database, there can be instant follow-up on successful (and unsuccessful) treatments on any number of illnesses, from the flu to heart disease to cancer. Medical research could be conducted in real-time, effectively, with results updated to the minute. It could provide a sort of early-warning system for regional disease outbreaks, as alerts could be sent to area hospitals upon spikes of certain symptoms in a given population. A consolidation of medical records serves only to increase access, with the hope of giving you, the patient, better medical care.

There are a lot of "could's" in the paragraph above, because this is all strictly theoretical, and no one knows in practice how wieldy or useful this proposed database could be. For instance- doctors nationwide, and potentially worldwide, would have to perfectly align reporting, terminology, and symptomatic description conventions to fit the needs of this database, removing all subjectivity and likely removing a layer of the analysis of you, the patient. In forming an analysis, a doctor would rely on you as the sum total of your data, and may not have that supplemental relationship of knowing you personally, your attitudes and lifestyle, that could add color to a diagnosis. Deeply entrenched attitudes on what constitutes research and data would have to be reformed- as one speaker put it, "every patient walking through the doors is a research subject." All these things could cripple any potential system simply by making it useless for practical application. But the security issue stands out as paramount. Do you honestly want to sign over your medical records into a massive database, knowing what you know about the government's esteem for your personal data? For all the promises that are made, and all the complex and wonderful systems they propose, they are still designed and operated by flawed people. There is a limit to the security that can be put in place.

It is no surprise that some of the biggest HMOs, pharmaceutical companies and government agencies are all worked up about it. They have a lot to gain from this. Do you? There is really no guarantee that this system is going to produce measurable positive outcomes for the patient. Until such time as I can see what this will do for me, I will keep that medical history private, locked up tight, where it should be. Only the person in the white coat standing next to me should have access at that time. I am not your research subject. Until such time that I can have absolute faith in the inviolability of these records, consider them off-limits- that is my prerogative as a patient, and yours.