Category: Uncategorized

By Siranya Rhuvattana

After the mass shootings in Colorado and Connecticut, President Barack Obama has attempted to curb the gun violence by, among other ways, improving the Federal government’s background check system for the sale or transfer of firearms by licensed dealers, called the National Instant Criminal Background Check System (NICS). The Department of Health and Human Services (HHS) is accordingly considering amending the Health Insurance Portability and Accountability Act (HIPAA) privacy rule to allow covered entities to disclose the identities of those deemed dangerous. (link: Link: http://www.courthousenews.com/2013/04/26/57104.htm)

NICS Index

The NICS Index is a database administered by the Federal Bureau of Investigation (FBI) established to collect and keep certain identifying information about individuals who are subject to one or more of the Federal prohibitors and thus, are ineligible to purchase firearms. In general, the Federal Firearms Licensees are required to request a background check through the NICS before selling guns to a buyer. The mental health prohibitors include those who have been involuntarily committed to a mental institution; found incompetent to stand trial or not guilty by reason of insanity; or otherwise have been determined, through a formal adjudication process, to have a severe mental condition that results in the individuals presenting a danger to themselves or others or being incapable of managing their own affairs.

The demographic information about the individual maintained in the NICS database is restricted to only the names of ineligible individuals and certain other identifying information, such as their dates of birth, and codes for the submitting entity and the prohibited category that applies to the individual. The underlying diagnoses, treatment records, and other identifiable health information is not provided to or maintained by the NICS. However, State agencies are not required to report to the NICS the identities of individuals who are prohibited from purchasing firearms. The NICS Index, thus, could not encompass the information of all mental health prohibitors.

HIPAA implications

Where the record of an involuntary commitment or mental health adjudication

originated with a HIPAA covered entity, or the HIPAA covered entity is the State

repository for such records, the records are subject to HIPAA. Nonetheless, due to the variety of State laws, there may be other parties such as State agencies, boards, commissions, or other lawful authorities outside the court system that are involved and to what extent these parties that order involuntary commitments or conduct mental health adjudications are HIPAA covered entities. Also, there may be some designated repositories by State laws that needs to be determined as to whether they are subject to HIPAA, such as State health agencies, to collect and report to the NICS the identities of individuals subject to the mental health prohibitor. Although HIPAA allows the State agency to designate itself a hybrid entity by labeling its health care components as separate from other components and documenting that designation, there may be administrative or other challenges to the creation of a hybrid entity.

As a result of unclear extent of covered entities and their obligations, many States still are not reporting essential mental health prohibitor information to the NICS. Some States may face practical difficulties in passing a State law requiring NICS disclosures, but primary concern is about the HIPAA Privacy Rule’s restrictions on covered entities’ disclosures of protected health information which may prevent certain them from reporting to the NICS the identities of individuals who are subject to the mental health prohibitor. (link: http://thehealthcareblog.com/blog/2013/04/25/what-does-hipaa-have-to-do-with-gun-control-maybe-more-than-you-think/)

In addition, the provided names will then be cross-checked against a state database of people who have registered their weapons. Law enforcement officials would then have the option of removing weapons from that individual, and suspending or revoking any gun permits they hold. Harvey Rosenthal, an executive director for the state Association of Psychiatric Rehabilitation Services (link: http://www.timesunion.com/local/article/Gun-law-vs-mental-health-4234056.php#ixzz2SA8ehuHA) was of concern that a danger that the information might fall into the wrong hands, or prejudice police or other authorities who come in contact with someone over a non-gun-related issue.

Thus, the HHS’s advance notice of proposed rulemaking (link: https://s3.amazonaws.com/public-inspection.federalregister.gov/2013-09602.pdf) is seeking public comment on how HIPAA is preventing states from sharing such records, and how the law would be in place without discouraging individuals from reaching out for medical cares. Wide public recommendations would, expectantly, provide a balanced strike between the privacy interest and public security.

By: Albert Lin

As part of a reaction to the mass shootings in Aurora, Colorado and particularly Sandy Hook Elementary School, there has been strong push in recent weeks for stronger and stricter gun control laws to hopefully reduce the risk of future mass shootings. Much attention during debate over the proposed gun control legislation has rightfully been focused on their relation to the Second Amendment’s right to bear arms. One of the proposed alterations to the existing framework of gun control laws involves improving the background check system nationwide and enforcing a prohibition on selling guns to individuals found to be a danger to themselves, otherwise known as “mental health prohibitors.” One unintended potential consequence of the proposed reforms may clash with the current provisions of the Health Insurance Portability and Accountability Act (HIPAA), as well as other laws related to the privacy of personal health information (PHI).

HIPAA forbids “covered entities” such as medical clinics, hospitals, physician offices, and other health care organizations, from disclosing the identities of health care information of persons whose medical records they store. Additionally, numerous states have specific statutes providing civil and criminal protection against the disclosure of medical information. Some statutes restrict disclosure of medical data by certain entities, while others restrict the disclosure of particular types of medical data, including mental health information. While it is unclear what the exact mechanism of the proposed background checks is, it is clear that they will undoubtedly be in conflict with the relatively strict nondisclosure requirements under HIPAA.

Towards the end of April, the Department of Health and Human Services began soliciting public comments on improving the background check system and for potentially amending the privacy rule to allow covered entities to disclose the identities of those deemed dangerous. The DHHS has cautioned that they would not allow the disclosure of an individual’s treatment record or any related clinical or diagnostic information. In the issued statement, the DHHS also stated they would limit the information disclosed to only the demographic information (such as date of birth), and codes identifying the reporting entity and the relevant prohibitor. Depending on the relevant state laws, however, it is possible that Congress may have to amend HIPAA entirely to allow these increased background checks to move forward. As such, the clash of this prospective expansion to the background check system with HIPAA’s privacy rule must be resolved before the expansion of background checks may be implemented.

http://www.courthousenews.com/2013/04/26/57104.htm

http://www.allgov.com/news/controversies/would-gun-background-checks-clash-with-health-privacy-laws-130429?news=849885

http://www.gpo.gov/fdsys/pkg/FR-2013-04-23/html/2013-09602.htm

Anonymous

The use of drones on American soil came to the fore in March, when Sen. Rand Paul “talking filibuster[ed]”of the confirmation of John Brennan as Director of Central Intelligence. Mindful of the killing of al-Qaeda activist and U.S. citizen Anwar al-Awlaki by weaponized drone—after an Article II-only deliberative process—in Yemen, Sen. Paul insisted on a clear statement from the Obama Administration that it did not possess “the authority to use a weaponized drone to kill an American not engaged in combat on American soil.”

Sen. Paul’s particular focus on drones was curious: one would think that the chief concerns with executive killings of this sort would relate to the lack of Article III process and use of the substantive threshold of enemy combatant status, rather than whether the instrument was a drone or a SEAL teams. But the attention that Paul nonetheless drew to the potential use of drones in America raised a public debate about the proper usage and procedures for private and public drones alike. The debate particularly illuminated the scope of surveillance potentially enabled by a world of ubiquitous flying cameras, as well as its impact on what our reasonable privacy expectations are in the 21^st century.

Amidst increase awareness of the implications for privacy law raised by the drone future, several members of Congress have introduced legislation to regulate domestic drone use. The Center for Democracy and Technology has helpfully summarized bills targeting privacy issues raised by non-weaponized drones introduced by Reps. Ed Markey and Joe Barton, and Reps. Poe and Lofgren. Both bills would increase oversight of use of drones by law enforcement agencies and constrict the scope of private actors’ permissible use of drones. While both bills (and others) are still pending, they mark some of the first attempts by legislators considering drones’ potential to challenge bounds of privacy in the physical space just as the internet has challenged bounds of privacy in the communicative space.

For the Center for Democracy and Technology summary: https://www.cdt.org/blogs/gs-hans/0804drone-privacy-bills-attempt-protect-americans-governmental-commercial-surveillance

By Scott B.

Trying to make employees work more efficiently isn’t a new project – from Taylorism to 360-degree reviews, an entire industry has emerged to analyze and optimize workforce productivity. However, never before has the sheer amount of data, and immense processing power, been available in a way that allow companies to analyze employee performance in real-time, and without human intervention.

The New York Times reported last week about the growing trend of “employee informatics”, where companies are using employee data and the tools of big data to measure employee habits. “Today,” the Times reports, “every e-mail, instant message, phone call, line of written code and mouse-click leaves a digital signal. These patterns can now be inexpensively collected and mined for insights into how people work and communicate, potentially opening doors to more efficiency and innovation within companies.” These are the same types of tools that advertising companies use for behavioral ad targeting, but since the data available on employees is so much richer, the privacy risks are also greatly increased. Furthermore, the employee-employer relationship gives rise to a far greater risk of privacy harm.

IBM’s 1.3 billion dollar acquisition of Kenexa in August, 2012 appears to be a sign of things to come. According to Forbes.com, “Kenexa is a consulting, content, and technology company which plays in many different parts of the talent management market.” Through the purchase, IBM will be able to integrate its data processing power and know-how with the abundant data and HR industry connections that Kenexa has established. The Times article also reports that companies like Google, and organizations like the NYU Langone Medical Center, have utilized “constant measurement” to test employee traits.

How do the Fair Information Practices (FIPs) fare when corporations are tracking every move their employees make in the workplace? To prevent employee abuse, meaningful notice and consent should be important components of extensive workplace data collection and analysis. Employees should also be able to view and correct any data collected about them. It would also be beneficial to require that any measurement methodology used be disclosed to employees so that they can see why their work is being praised or criticized. Particularly when employee informatics leads to demotion or firing, reckless reliance on inaccurate employee analytics is deeply problematic. Furthermore, data security is a big concern, particularly when confidential employee data is shared with third parties such as IBM.
Employee creativity is also at risk when work is so closely monitored, and companies might find these monitoring strategies to be counterproductive when employees try to beat the system rather than produce their best work. Even the most mundane jobs include elements of creativity, such as process optimization. Will the chilling effect of constant workplace surveillance serve to chill employee creativity in the same way that public surveillance chills free speech and expression? While the workplace is not considered a particularly private environment, the extension of surveillance to the workplace represents another space where persistent surveillance is becoming the norm. As these surveillance programs become increasingly common, it would be useful for a government agency (presumably the Department of Labor) to oversee the regulation of these tools to ensure they are responsibly implemented.

By: Felipe Burgos

On April 9, 2013, the United States Court of Appeals for the Eleventh Circuit upheld the district court decision that the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) preempted a Florida law regarding the disclosure of patient records by nursing homes.

The nursing facilities were penalized by the Florida Agency for Health Care Administration (“AHCA”) for refusing to provide medical records to deceased residents’ spouse, guardian, surrogate, proxy, or attorney in fact, according with a 1987 state law allowing to provide that personal health information.

Florida’s nursing facilities filed the case against the AHCA in May 2012.

The plaintiffs argued if they followed the Florida law requiring them to provide medical records to these parties, they would violate HIPAA. Under HIPAA, nursing homes can only provide personal health information to officially designated “personal representatives”, which could include the executor, administrator or other person acting on behalf of an individual or his or her estate. Providers also may furnish medical records to deceased residents’ family members who helped pay for the resident’s care, but only if the records are pertinent to the requestor’s financial involvement.

The Court maintained the decision from the lower court that the Florida statute was too broad and it did not meet the stricter HIPAA definition of personal representative, but “authorizes sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead”.

According to the Court, HIPAA and the Florida law “could not be reconciled” because the Florida law was “an obstacle to the accomplishment and execution of the full purposes and objectives of HIPAA in keeping an individual’s protected health information strictly confidential.” The court emphasized that HIPAA ensures the privacy protection of deceased individuals’ health information by generally prohibiting its use and disclosure except in certain circumstances or with authorization. In contrast, the court explained, the Florida law allowed for “sweeping disclosures, making a deceased resident’s protected health information available to a spouse or other enumerated party upon request, without any need for authorization, for any conceivable reason, and without regard to the authority of the individual making the request to act in a deceased resident’s stead.”

Based on this argument, the court concluded HIPAA preempted the Florida law.

Because HIPAA preempts any contradictory state laws, the Florida legislature must revise the statute at issue or it will not be enforceable, Judge Susan H. Black said.

Link: http://www.govhealthit.com/news/appeals-court-affirms-hipaa-preemption

The FISA Amendments Act (FAA) enacted in 2008 and extended in 2012, has been the subject of much controversy as of late. The Act authorizes the Attorney General or the Director of National Intelligence to gather intelligence information on individuals who are “reasonably believed to be out of the United States.”[1] Of course, the Act places several restrictions on the government in order to prevent the warrantless seizure of information on U.S. citizens.  Beyond these restrictions that mainly prohibit intentional misuse of the Act in order to collect information from people in the United States or U.S. people abroad, the FAA also provides for judicial review of the targeting procedures that the government uses to gather information. However, one large concern of opponents of the Act is that the information gathered and the judicial review process are largely confidential.

The Federal Intelligence Surveillance Court (FISC) handles judicial review of the FAA cases. These courts writes full, binding opinions on the permissibility of certain targeting and surveillance practices of the federal government. Proponents of the Act support the privacy interests of those conducting foreign intelligence gathering to keep us safe– keeping this information confidential is essential to protecting their efforts to thwart potential foreign attacks. Many citizens, including several senators, however, were not keen on extending the life of the Act without increasing transparency on an otherwise opaque process.

One major concern over transparency is that while the government may not be intending to collect information on people in the United States or our citizens abroad, we have no idea how much inadvertent surveillance of American citizens the government has conducted. We also don’t know how FISCs are interpreting the statute and whether or not their interpretation is markedly different from the Congress’s intent. Organizations like the ACLU believe that the American people have a right to know how effective current procedures are in keeping American citizens and those in the US from mistakenly having their privacy interests infringed upon.[2]  At the same time, Congress has no way of knowing if they should look into changing the wording of the Act to ensure that the court interprets the statute as intended. Two proposed amendments to the FAA arose out of this concern.

In 2012 when the Senate voted on extending the deadline for the FAA, Senator Jeff Merkley (D-OR) introduced S. 3515[3] and “put the Senate to a vote on whether the administration should be forced to release the court opinions, supply unclassified summaries of them, or explain why they should be kept secret.”[4] Finding that “Secret law is inconsistent with democratic governance. In order for the rule of law to prevail, the requirements of the law must be publicly discoverable,” Merkley’s proposed Amendment would require that the Attorney General disclose each decision, order, or opinion of a FISC that includes significant interpretations of FISA. If declassification of the full text would compromise national security, then the AG should provide summaries of the opinions. If even that will compromise national security, the Amendment asks the AG to provide a report on where they are in the process of declassifying these materials.

Those who opposed this Amendment worried about the potential dangers of requiring the administrators to broadcast classified information to the world, putting all Americans at grave risk. Further, they believed the Amendment unrealistic to accomplish – these opinions contain facts about current surveillance techniques and targeted subjects that they cannot separate out. Finally, though Senator Merkley’s Amendment allows for summaries and updates that might avoid some of these national security issues, a major concern for the Senate and Congress was the timing. Indeed, the Senate discussed this proposed amendment on December 27, 2012, just 4 days before the President had to sign the bill.[5]

What do you think? Was this proposed amendment worth holding up a bill that helps monitor potential foreign threats? Should we be concerned about “secret legal opinions”? Is this just the price we pay for a safer America?

By: Ross Woessner

Great controversy surrounds the proposed Cyber Intelligence Sharing and Protection Act (“CISPA”), which passed the House and is currently in the Senate.  The bill provides for voluntary information sharing between private companies and the government in order to prevent or mitigate cyberattacks.  For example, if the government detects a cyberattack threatening Google or Twitter it could inform those companies of the threat; likewise, Google could notify the government if they detect suspicious activity on their networks.  Part of the bill’s rationale is the increasing number of cyberattacks on American companies emanating from China and Iran.

This has alarmed civil liberties groups because of the ease with which private communications companies can share users’ information with the government.  CISPA is written broadly enough that such companies could provide someone’s text messages, emails, or cloud-shared files.  The bill authorizes such disclosure “notwithstanding any other law,” which according to the Electronic Frontier Foundation, “essentially means CISPA would override the relevant provisions in all other laws,” and thus creates “a cybersecurity loophole in all existing privacy laws.”

But as Solove and Schwartz note on page 590, Internet “anonymity is quite fragile, and in some cases illusory.”  Indeed, Business insider has noted that CISPA merely legalizes already common cybersecurity practices.  The Electronic Privacy Information Center (“EPIC”), through a FOIA request, obtained documents that describe a well-established information sharing program between the Department of Defense, Department of Homeland Security and private companies, including immunity provisions for private companies.  This is particularly worrisome because the Obama administration has publicly threatened to veto CISPA “while privately granting immunity to [private companies] as they collaborate with government agencies to evade wiretapping laws.”  Thus, CISPA’s practical impact would be minimal because the practices it authorizes are already widely used.

http://www.pcmag.com/article2/0,2817,2417993,00.asp (“What is CISPA, and Why Should You Care?”)

http://www.businessinsider.com/cispa-legalizes-common-secret-practices-2013-4

By: Elena D. Lobo

The past two weeks have brought about events that are surely making many government officials and privacy scholars think about our current policies in a new light. In some ways, what occurred in Boston reawakened fears that we felt in the aftermath of the 9/11 attacks in 2001. Additionally, in the same week, mysterious ricin-laden envelopes were sent to the White House. Homeland security is now forced to make decisions with respect to many of the issues we examine in a class like Information Privacy. The Boston bombing turned into a manhunt that upended what was set to be a beautiful, patriotic Monday; and suspects have been apprehended in the mailings incident. The main difference between these events and those that occurred in 2001, however, is that the perpetrators of these incidents (as far as we know, and as far as the news media/government has told us) were American citizens.

The aftermath of the 2001 attacks resulted in an overhaul of our privacy regulations. The Patriot Act was passed with very little opposition. Many were generally ok with it because the people we were being protected against, the terrorists, were “out there;” they were the “other.” Well, it appears that now terrorists can be “one of us.” Once again, privacy laws are being questioned, and similar discussions are taking place about how much privacy we are willing to give up in the name of anti-terrorism and public safety. The information privacy regulations once saved for foreign terrorism suspects are now threateningly able to be used at home. Does the fact that we have more and more American citizens participating in terrorist activities mean our privacy policies will have to expand to include more and more surveillance of Americans?

What is becoming apparent is that the once nebulous idea of “terrorism” that we have generally been so quick to blame for various atrocities we fall victim to as Americans is starting to bump up against a thinning border between “us” and “them.” And our government has to respond. In fact, all governments do. Scott Helfstein argues in an article in Foreign Affairs that security surveillance needs to become more globally cooperative. Of course, this sounds ludicrous. Why would we share our intelligence with say, post-Arab Spring countries, for example? We may be able to help each other….but would it endanger us much more than it would help? That is the fear, but is there a way to get the benefit without compromising our own national security? http://www.foreignaffairs.com/articles/139337/scott-helfstein/intelligence-lessons-from-the-boston-attacks

As far as we know, the channels are already open for increased surveillance. In fact it is nearly impossible to know how much nonconsensual surveillance is already being conducted. We know that the CIA and the FBI can request access to emails sent 180 days prior without a warrant or judicial review of any kind. We know that FISA allows surveillance of international communications made by Americans. We know that the Department of Homeland Security trolls our Facebook and twitter accounts for buzz words that may lead to further monitoring. And now we know that the IRS can access our emails without a warrant, in the name of policing tax law criminals. (http://www.washingtonpost.com/blogs/post-politics/wp/2013/04/23/ma-senate-candidates-feud-over-homeland-security/).

Our laws are not adapting quickly enough to our changing environment. It’s a dilemma that can only be fixed by making more laws, and faster. But with that comes the fear of carelessness, and in an area like homeland security, that is something we just can’t afford. Is it crazy to think the next step may be a computer that can draft and adapt laws for us? After all, it would be faster…