Is your health information up for sale?

The noise about HIPAA in the US and clamor for strict privacy laws in other parts of the world, is driven by the fact that healthcare information is being traded for big bucks. A series of national public opinion polls conducted by Louis Harris & Associates in US documents a rising level of public concern about privacy, growing from 64 percent in 1978 to 82 percent in 1995. Americans’ concern about the privacy of their health information is part of a broader anxiety about their lack of privacy in an array of areas.

HIPAA Privacy Regulations

HIPAA (Health Insurance Portability and Accountability Act) mainly addresses three areas, standardization of transactions and code stets used in claims processing, privacy and security of protected health information (PHI).
Under the provisions of privacy component of the regulations, a covered entity may use or disclose PHI only in the following ways:
· It may use or disclose PHI for its own treatment, payment or healthcare operations purposes.
· It may use or disclose PHI to another covered entity for that entity's treatment purposes.
· Disclosure between two covered entities for limited use for operations, such as quality assurance or peer review. Such disclosures may take place insofar as the covered entity receiving the disclosure has a treatment relationship with an individual and PHI may only be disclosed regarding treatment that occurred while the relationship existed.


Buyers of Healthcare information

The purchasers of healthcare data have been pharma companies, insurance companies, employers and strangely bankers. Pharmaceutical companies were in the hot set when consumers groups agitated against the direct marketing efforts of pharma companies, which send specific treatment intervention options to specific disease groups. Direct marketing to patients with the advent of direct to consumer marketing approach became a nuisance to privacy advocates. Other issues revolved use of use of patient information by insurers in underwriting applicants. Banks used health information in “due diligence” to ascertain if the borrower had any health reasons that would prevent his repayment capabilities.

The Indian Scenario

To date the Indian healthcare sector has relatively free from this concern, as most of the medical records in the country are still physical records, safely stored away in medical records room. However this is all set to change with the advent of companies focused on aggregating health care data on Indian population. Recently, several business groups in Indian metros were approached by a company that promised to maintain electronic health records of employees at a nominal fee in addition to other healthcare services that they would provide. For many human resources managers not sensitized to concerns around privacy of health information, this sounded like a good service offering. To me however, in a country like India, with lax privacy laws, letting a third party collate patient information is scary. You might soon be bombarded by requests from various pharmaceutical companies with mailing campaigns that would be focused on solutions for your heart or kidney disorder. Others would want you to be part of clinical trial for Drug A or B. How would the Indian patient/consumer respond? Are consumer groups aware of this emerging scenario? What are the grievance redressal mechanisms in place from a legal or regulatory standpoint?

As the healthcare sector in India moves towards an electronic medical records era, this is one of the questions healthcare managers/policy makers and the patient community have to address keeping in view the global trends in privacy of healthcare information.