FTC re­port sees in­di­vid­ual con­sent as key in pri­vacy cases

Re­port ad­dresses con­cerns over on­line health info

Modern Healthcare - - Front Page - Joseph Conn

As the Fed­eral Trade Com­mis­sion as­serts a greater role in U.S. pri­vacy pol­icy and en­force­ment, it is di­verg­ing from the path forged by HHS, par­tic­u­larly on the ques­tion of whether in­di­vid­ual con­sent should be a thresh­old for the gath­er­ing, shar­ing and stor­age of sen­si­tive in­for­ma­tion such as health records.

The FTC re­leased a re­port last week on on­line con­sumer pri­vacy is­sues. The 122-page doc­u­ment de­scribed as a pre­lim­i­nary staff re­port was clearly a warn­ing shot at col­lec­tors and bro­kers of data gleaned from con­sumers’ on­line ac­tiv­i­ties. “We are not call­ing for leg­is­la­tion yet, but it’s clear that this re­port is also a rec­om­men­da­tion for law­mak­ers,” FTC Chair­man Jon Lei­bowitz said in a phone call with re­porters.

The re­port fo­cused on a wide spec­trum of per­sonal in­for­ma­tion, such as the data stored in ev­ery­one’s Web browser, but it also ad­dressed prob­lems aris­ing from the grow­ing vol­ume of health­care in­for­ma­tion cre­ated or stored out­side the reg­u­la­tory fence of the chief fed­eral pri­vacy law, the Health In­surance Porta­bil­ity and Ac­count­abil­ity Act of 1996 (Nov. 22, p. 26).

“Re­ten­tion of such data, and its use to build con­sumer pro­files, raises im­por­tant pri­vacy con­cerns,” ac­cord­ing to the re­port. “For in­stance, the re­ten­tion of lo­ca­tion in­for­ma­tion about a con­sumer’s vis­its to a doc­tor’s of­fice or hos­pi­tal over time could re­veal some­thing about that con­sumer’s health that would oth­er­wise be pri­vate.”

The FTC staff, ac­cord­ing to the re­port, con­cluded that “cer­tain types of sen­si­tive in­for­ma­tion war­rant spe­cial pro­tec­tion, such as in­for­ma­tion about chil­dren, fi­nan­cial and med­i­cal in­for­ma­tion, and pre­cise ge­olo­ca­tion,” and that “com­pa­nies should seek af­fir­ma­tive ex­press con­sent” be­fore col­lect­ing, us­ing and shar­ing it.

In con­trast, in a 2002 HHS-writ­ten re­vi­sion of the HIPAA pri­vacy rule, a re­quire­ment for pa­tient con­sent for the dis­clo­sure of med­i­cal in­for­ma­tion was re­placed with a pro­vi­sion grant­ing “reg­u­la­tory per­mis­sion” for health­care providers and other “cov­ered en­ti­ties” to dis­close med­i­cal records for treat­ment, pay­ment and many other health­care op­er­a­tions with­out pa­tient con­sent.

In defin­ing pri­vacy, the FTC ref­er­enced for­mer Supreme Court Jus­tice Louis Bran­deis, co-author in 1890 of “The right to pri­vacy,” a sem­i­nal Har­vard Law Re­view ar­ti­cle that equated the con­sti­tu­tion­ally pro­tected right to life with “the right to be let alone.” The ar­ti­cle went on to ex­plain that the right to pri­vacy is ex­tin­guished by that per­son’s con­sent.

In 2008, the Of­fice of the Na­tional Co­or­di­na­tor for Health In­for­ma­tion Technology at HHS re­leased its Na­tion­wide Pri­vacy and Se­cu­rity Frame­work for Elec­tronic Ex­change of In­di­vid­u­ally Iden­ti­fi­able Health In­for­ma­tion, in which it de­fined pri­vacy not as a right but “an in­di­vid­ual’s in­ter­est in pro­tect­ing his or her in­di­vid­u­ally iden­ti­fi­able health in­for­ma­tion.” The ONC did not re­spond to re­quests for com­ment on the FTC re­port.

Cal­i­for­nia Pri­vacy and Se­cu­rity Ad­vi­sory Board ad­vo­cate Pam Dixon, founder of the not-for-profit World Pri­vacy Fo­rum, said she par­tic­i­pated in sev­eral roundtable dis­cus­sions the FTC held to ob­tain pub­lic com­ment be­fore draft­ing its re­port.

“I think the heart and soul of this re­port is the one sen­tence that in­dus­try self-reg­u­la­tion has not worked,” Dixon said, and she also praised the FTC for a “bold ap­proach” that in­cludes data col­lec­tors such as Google and third-party data bro­kers such as Acx­iom in its pro­posed pri­vacy guide­lines. “The bot­tom line is this: The trend is to­ward the con­sumer hav­ing the right to opt in when there are sen­si­tive is­sues in­volved,” Dixon said.

The FTC, in seek­ing to bring Bran­deis for­ward more than a cen­tury, rec­og­nized that “the ap­pli­ca­tion of this con­cept in mod­ern times is by no means straight­for­ward.”

Lei­bowitz: The re­port is a “rec­om­men­da­tion for law­mak­ers.”

Dixon: “In­dus­try self-reg­u­la­tion has not worked.”

Newspapers in English

Newspapers from USA

© PressReader. All rights reserved.