Blog

April 23rd, 2015

College Rape Case Shows A Key Limit To Medical Privacy Law

By: Ryusuke Tanaka

http://www.npr.org/blogs/health/2015/03/09/391876192/college-rape-case-shows-a-key-limit-to-medical-privacy-law

A student allegedly raped by other students got medical therapy at her university’s clinic. After the student sued the university, the university accessed, without notice or consent, to the student’s medical record and sent them to its attorney in preparing for its defense against the student. The university’s access invokes privacy concerns and uncertainty in the scope of the laws.

What laws govern this issue? The Health Insurance Portability and Accountability Act (HIPAA) and Health Information Technology for Economic and Clinical Health (HITECH) Act have a relatively strong regulation for the protection of individual’s health information possessed by health care provider. Yet, HIPAA regulations apply only to “health plans, health care clearinghouses and health care providers” that transmit health information electronically in connection with certain health insurance related transactions[1]. If the university in this case processes and transmits, for example, health care claims submitted to a health plan, then it becomes possible to regard the university as “health care provider” or as “hybrid entities” that employs health care provider.

Whereas, the Family Education Rights and Privacy Act (FERPA) prohibits educational institutions from disclosing “education records” without the authorization of student (or parent). In general, “education records” are defined as records which contain information directly related to a student and maintained by an educational institution[2]. FERPA permits schools to disclose, without consent, educational record to the court for its defense if a parent or student initiates legal action[3]. The university in this case, when sued by the student, could plausibly rely on this provision to disclose her medical information to its attorney or the court.

According to the United States Department of Health and Human Services, regarding educational records where FERPA applies, schools should comply with FERPA, and in that case, they are not necessarily bound by HIPPA.[4]

The point that should be emphasized in this case is that the information accessed and disclosed was the therapy record of a rape victim. With high probability, it contains sensitive information that a reasonable person would not wish to be disclosed. In addition, a victim like the student in this case would have visited a school therapist not to complaint about incident but to sincerely receive medical care. Given the situation where the school counselors owed confidential responsibility and fiduciary duty under the professional ethics code, it is possible to say that a reasonable student would reasonably expect that information given to a school counselor should be protected as a medical record and not regarded as an educational record.

This case seems to urge the court to clarify the exact scope of HIPAA and FERPA.

[1] 45 C.F.R. §160.102

[2] 20 U.S.C. §1232g(a)(4)(A)

[3] 34 C.F.R. §99.31(a)(9)(iii)(B)

[4] http://www.hhs.gov/ocr/privacy/hipaa/faq/ferpa_and_hipaa/513.html

April 23rd, 2015

Reflections on D.C. Administration’s Proposed Exemption of Police Body Camera Footage Disclosure

By Wei-Po Wang

Recently, the District of Columbia Mayor Muriel Bowser is looking to enact legislation to exempt footages from the Metropolitan Police Department (MPD)’s expanding body camera program from public records requests based on the Freedom of Information Act (FOIA) or its state counterpart. (“D.C. wants to keep police body camera footage hidden from public eye.” http://www.washingtontimes.com/news/2015/apr/14/dc-wants-police-body-camera-footage-exempt-from-pu/?page=all). The significance of the D.C. proposal, different from similar proposal or enactment by other states, is that instead of trying to hit a balance between the public interest in holding the police enforcement procedures accountable and the privacy concern associated with making these footages public, it goes all out and requests a blank check exemption of footages by police body cameras from the disclosure regime of FOIA.

Should the proposed statute come into reality, it would fall within the exemption under § 552(b)(3), where disclosure could be avoided if specifically exempted by statute. However, one must pay special attention to the qualifiers of subsection (b)(3), where the statute must “(A) requires that the matters be withheld from the public in such a manner as to leave no discretion on the issue, or (B) establishes particular criteria for withholding or refers to particular types of matters to be withheld.” Given the proposed enactment affords a blanket exemption for all footage data recorded by any police body camera, neither requirement (A) nor (B) seems to be of particular issue, since blanket exemption leaves no room for discretionary decision by the executive branch, and the criteria (i.e., all footages without any qualifier) is indeed particular in kind.

However, in view of the heightened public concern and awareness of law enforcement accountability arising out of the recent series of police brutality starting from the Ferguson incident through the most recent death of Freddie Gray, it has become apparent that more police accountability to be afforded through adoption of new technologies such as body cameras is now an ever important public interest issue. This leads to doubt that Mayor Bowser’s proposed legislation could have made more genuine efforts to strike a subtle balance between accountability and privacy.

In light of this line of development, it may be worth exploring how the new technology of police body camera and the footage data created by it would fit into the current FOIA exemption regime, especially under § 552(b)(7), which exempts from disclosure records or information compiled for law enforcement purposes, as long as they meet certain enumerated categories.

If it is a case where the public disclosure of the footages may interfere with enforcement proceedings, subsection (b)(7)(A) warrants such exemption. Subsection (b)(7)(B) affords exemption if the disclosure would deprive a person of a right to a fair trial or an impartial adjudication. This particular exemption may have implication in a situation where the images in a certain footage would in effect temper the perception of a potential jury pool on a foreseeable prosecution of the enforcing police officer’s conduct. The traditional personal privacy concern is also squarely addressed by subsection (b)(7)(C), for example in a case where the video footage caught certain private activities of bystander citizens who have no relevancy for public scrutiny. Prevention of endangering life or physical safety of any individual is also addressed by subsection (b)(7)(F).

Apart from the categorical exemption for interference with enforcement proceedings, § 552(b)(7) also highlights two specific exemptions associated with some most contested consideration in the course of law enforcement by police force. There is always the fear that such video footages would have the effect of revealing customary law enforcement techniques adopted by the police forces, which would inform future perpetrators on how to circumvent these enforcement efforts. This level of concern is safeguarded by subsection (b)(7)(E). Similarly, video recordings may a lot of times reveal the various confidential sources of information fostering the effective law enforcement, and disclosing these confidential source would have paramount adverse effect on future enforcement, investigation and prosecution efforts. Fortunately, this is also covered by subsection (b)(7)(D).

Based on the above analysis, it seems fair to declare that any privacy or law enforcement associated concerns along came with the development of body camera technologies has already largely been addressed by existing FOIA exemption regime. As a result, it may be more advisable for the D.C. administration to consider forgoing the blank check approach on body camera footage exemption, and instead taking up a more balanced, enumerative approach more akin to that of the FOIA.

April 23rd, 2015

Fitness apps may pose legal problems for doctors

By: Emma Trotter

The February 2015 Associated Press article “Challenges for Doctors Using Fitness Trackers & Apps,” which can be found at http://www.theepochtimes.com/n3/1257858-challenges-for-doctors-using-fitness-trackers-apps/, raises several issues that relate to topics covered during this week’s class on health privacy. The article reads as a list of potential trouble spots for doctors and declines to offer many solutions.

First, the article points out that, because HIPAA was written to only narrowly apply to entities that issue, accept, or otherwise deal in health insurance, the law’s privacy protections do not extend to the many new apps and devices that help users keep track of their health and fitness. As mentioned in class, this information might come as a shock to users, who tend to assume that HIPAA is much broader than it really is. This could lead to users over-sharing, thinking their information is protected because they are collecting and providing it in a health context, in the meaning of Helen Nissenbaum. If an app were to sell that normatively sensitive health information to third parties, it could theoretically be used, in secret, to deny a less in-shape person a job or offer that person insurance at a higher rate.

The article also mentions that certain apps have one purpose but could be used for others. For example, if a person wearing a step counter that tracks location goes and meets up with another person wearing that same brand of step counter, the device manufacturer probably has the ability to determine that those two people are together. While this may not seem like a privacy harm in and of itself, we have learned over the course of the semester from several theorists, including Neil Richards, that surveillance can curtail intellectual freedom and exploration.

Additionally, the article points out some reliability problems with certain types of data. For example, smart pillboxes that purport to track when patients take medication really only show when patients pick up the boxes. For now, doctors are still relying on patients to accurately self-report. That information could be supplemented by FICO’s new Medical Adherence Score, which we learned about from Parker-Pope’s NYT article, but since that score relies on information such as home ownership and job stability, not actual health data, it is fundamentally inference-based and reflects statistical averages better than the actual behavior of any individual patient.

Another reliability issue the article brings up stems from the fact that many of the apps and devices aren’t regulated by the FDA. The article suggests that this means some of the claims made by these businesses might not deserve doctors’ trust; for example, Fitbit sleep tracking might be oversensitive to movement and show a user as getting far less sleep than she really is. This concern could be mitigated somewhat by the FTC’s ability to use its section 5 jurisdiction to hold these companies accountable for deceptive or unfair business practices based on extremely overstated claims, which we studied earlier in the semester. But, as the article also points out, this limited recourse would only address data reliability and wouldn’t prevent the apps from selling data to third parties and violating contextual integrity if their posted privacy policies allow them to do so.

Yet another reliability issue raised by the article is that, for now, the data collected by these apps and devices skews toward younger people more likely to use or wear them. Since younger people are statistically healthier than older people, this could introduce bias into the data collected.

Finally, the article touches on the issue of liability. Imagine that a fitness tracking app shows something worrisome – a spike in blood pressure, for instance – and a doctor fails to notice it. Is that doctor liable, under traditional tort theories of medical malpractice, for an injury that then befalls the patient? The article suggests developing technological systems to scan the data and automatically flag potential trouble spots – but that doesn’t completely eliminate the issue. What if the technology fails, or the doctor still fails to act? This issue is of course compounded by the possibility that the data may be unreliable, as discussed above.

April 21, 2015

By: Rachel Wisotsky

Which Federal Agency Should Regulate Health Apps?

Sources:

• http://www.modernhealthcare.com/article/20140205/blog/302059996
• http://content.healthaffairs.org/content/33/2/222.full.pdf+html
• http://content.healthaffairs.org/content/33/2/216.full
• http://www.bloomberg.com/news/articles/2015-03-30/fda-taking-a-very-light-touch-on-regulating-the-apple-watch
• http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm369431.htm
• http://blogs.fda.gov/fdavoice/index.php/2015/02/smart-ways-to-manage-health-need-smart-regulation/

Mobile health applications are subject to the regulatory authority of several federal agencies. Due to the rapidly evolving nature of the industry, and the limits of each agency’s regulatory authority, it remains unclear which agency will offer the most comprehensive oversight over privacy and security risks. Three agencies that play a role in the regulation of health apps are The Department of Health and Human Services (HHS), The Food and Drug Administration (FDA), and The Federal Trade Commission (FTC).

The HHS

The HHS, which monitors HIPAA violations, will have a crucial role in regulating health apps used by health care providers. However, the HIPAA privacy rule only applies to “covered entities”, which does not include consumers who use private health apps outside of a healthcare setting. The HHS lacks experience with the privacy or security risks of consumer-facing commercial technologies.

The FDA

The FDA’s authority to regulate apps is limited to apps that qualify as a medical devices. The FDA announced it will focus its oversight on apps that are used an accessory to a regulated medical device- for example, to diagnose, treat, or prevent a disease; and to apps that transform a mobile platform into a medical device- for example, an app that turns a Smartphone into an ECG to detect heart conditions.

Further, the FDA’s regulatory authority only focuses on security protections. The FDA indicated it will only use its authority to regulate health apps that pose a risk of harm to consumers if there is a malfunction or failure. The FDA also indicated that it will not enforce regulatory requirements for low-risk apps, such as those that track heart rates, sleep patterns, or steps.

The FDA does not focus on privacy safeguards or oversee company policies about the collection, use, or disclosure of potentially sensitive health information.

The FTC

The FTC can use its authority to regulate unfair and deceptive practices to enforce security and privacy protections. Regarding privacy, patients using apps must largely rely upon company policies regarding uses of data that are offered unilaterally- in other words, accept the terms or don’t use the app. These policies may be especially unfair in the case of medical apps, since patients often do not have a choice whether to use them. The FTC also has expertise in penalizing companies for unfair design, unfair default settings, and unfair data security practices. The FTC has already successfully brought enforcement proceedings against private health apps for misconduct including: making scientifically dubious claims to treat medical conditions including melanoma and acne, and causing consumers to unwittingly share personal health information with other people.