Testimony Regarding the Implementation of Electronic Health Records and Health Information Technology in New York State

My name is Corinne Carey and I am Senior Public Policy Counsel to the New York Civil Liberties Union (“NYCLU”). I would like to thank the Committees on Technology and Health for holding this hearing and for allowing the NYCLU today to provide testimony relating to the implementation of health information exchanges in New York State.

The NYCLU, the state affiliate of the American Civil Liberties Union, is a not-for-profit, nonpartisan organization with eight offices and nearly 50,000 members statewide. The NYCLU’s mission is to defend and promote the fundamental principles, rights and constitutional values embodied in the Bill of Rights of the U.S. Constitution and the Constitution of the State of New York. The right to privacy is central to these values, and privacy is a major concern as the state begins to operationalize health information exchanges. Without adequate privacy protections, this promising program is at risk.

We recognize that sharing health information among health care providers is likely to confer real benefits on patients, such as improved care through greater coordination of health care services; the reduction of duplicate testing, which speeds care and lowers cost; and the potential to reduce medical errors, misdiagnoses, and conflicting medications. However, easily shareable electronic records can create threats to patient privacy, including making patients’ most personal and confidential information susceptible to inadvertent disclosure and misuse. If patients do not trust that the network will protect their sensitive medical information, they will not use it, and there may be significant public backlash, as we’ve seen with periodic uproar over the level of privacy protection guaranteed by Facebook.

We have voiced these serious concerns about the implementation of health information exchange by participating in New York State Department of Health work groups and submitting public comments through New York’s eHealth Collaborative.

Our three major concerns are: (1) patient consent is not required for entering individual medical information into the network; (2) the state has adopted an all-or-nothing approach to sharing health information; and (3) the state has not engaged in sufficient public education about health information exchange. I will address each of these in turn.

First, current state policies allow health care providers to upload a patient’s medical information to shareable electronic networks without first obtaining the patient’s consent. The policies require patient consent only when a provider wants to download health information about that patient from the network. In emergency situations, state policy allows providers to “break the glass” and access a patient’s medical records without the patient’s knowledge or consent. Patients should be given a choice about whether they want their medical information to be linked to a network that allows for easy sharing before it happens, not simply when a provider wants to access that information. We have recommended, and continue to recommend, that patient consent be sought at the front end before individual patient information is entered into an electronic health information network, as well as at the back end when a provider wants to access that information.

Even simple identifying information can be sensitive. Access to patient names or addresses may pose a threat to patients at risk of domestic violence, minors and other vulnerable groups. Patient consent should be required before identifying information is included in the system or patients should be allowed to require protections for such information. Consider, for example, a woman with children who has fled an abusive partner. That partner is a health care provider or a service provider to a health care information network with access to electronic medical records. If the woman seeks medical care for herself and her children, her address will be entered into an electronic network where it could be easily accessed by her partner.

Second, the state has adopted an all-or-nothing system for sharing patient information. There is no way to limit a provider’s access only to information that is medically necessary for a patient’s current treatment. In New York State, giving a provider permission to download a patient’s medical information means that the provider sees the patient’s entire medical record dating back as far as electronic health records exist. Consent bestows access to sensitive information such as substance abuse treatment, mental health conditions, abortion and other reproductive health care. In the past, New York State recognized that this sensitive information requires special legal protections, but this has been swept away by the current policy’s one-size-fits-all consent requirement. This forces patients to choose between sharing relevant information with a new provider and having control over sensitive health information. Patients should be able to shield such information altogether or decide to share it only with selected providers. If not, those patients who most need help may refuse to participate in the network—or avoid treatment altogether—for fear of discrimination, breach of confidentiality or mistreatment.

Consider, for example, a patient who was sexually assaulted in her 20s and briefly took antidepressants to cope with the trauma. She has put this behind her, but is afraid to consent to participate in her doctor’s health information exchange because she doesn’t want all of her doctors, present and future, to know about the rape and depression she suffered. Because New York’s all-or-nothing system will not allow her to restrict access to this sensitive and irrelevant information to specific providers—her podiatrist, for example, wouldn’t need to know if she was sexually assaulted—this patient must choose to forego the benefits of health information exchange.

The state’s all-or-nothing system also poses a dilemma for adolescents. In New York State, minors can privately consent to specific types of health care, including reproductive health and certain mental health treatment. Parents and providers may not obtain information about such treatment without the minor’s permission. Currently, the health exchange system simply excludes the medical records of all minors between the ages of 10 and 18, which protects minors’ privacy rights but deprives them of the potential benefits of the health information exchange. Consider the case of a 15-year-old seeking treatment for gonorrhea. He wants all of his doctors to be informed about this treatment, but does not want his parents to find out about it. The current all-or-nothing system cannot segregate information about minor-consented treatment and allow access by health care providers who have received consent from the minor, while blocking parents from obtaining that information when they access the child’s other medical records. And since excluding only those minors who have exercised their right to consent would identify them, this path has forced New York State to exclude all minors between the ages of 10 and 18. A system built to accommodate more nuanced levels of consent and information segregation would allow minors to fully benefit from participation in health information exchanges while maintaining control over their sensitive health information.

Finally, to date there has been an astonishing lack of communication with the public about the development of health information networks. Patients have a right to be informed about how their medical information is shared electronically. Since patients cannot prevent their basic information from being linked to the system, they should understand better what is at stake, both in terms of risks and benefits. Here, as throughout the health care system, the state has based its policy on patients’ informed consent. Consent cannot be informed if patients only learn about the program when they arrive in their doctor’s office. New York State must conduct public outreach and education about health information exchange that goes well beyond a simple promotional campaign to encourage everyone to sign up.

In the absence of the measures we suggest here, New York puts at risk a program that may offer great benefits.

The NYCLU is grateful to the City Council for holding this hearing and its interest concerning this extremely important issue. We look forward to future dialogue with the New York State Department of Health as the state health information network is expanded and policies and procedures continue to be developed.