7OYS: Patient Privacy in a Digital Age

The idea of doctor-patient privacy has been around for about as long as medicine itself. It’s included in the Hippocratic Oath and taught in virtually every medical school in the world. It comes up frequently in movies, crime shows and medical dramas. And yet despite its prevalence in mainstream culture, some experts say the idea of doctor-patient privacy has become almost a myth in the modern healthcare system.

"Everyone understands about the Hippocratic Oath and believes their doctor is keeping their information private and that's pretty easy to do in a paper world. It's not so easy to do with electronic records,” said Dr. Deborah Peel, an Austin-area psychiatrist and leader of the non-profit group called Patient Privacy Rights .

Peel and other privacy advocates warn everything from prescription records to your DNA can be bought and sold under the right circumstances. The information is purchased daily by pharmaceutical and insurance companies who hope to use the data to market new drugs or research medical trends.

Doctors and hospitals that use electronic records have to store the information somewhere and there’s a good chance that data is sent back to the company managing the system. While doctors don’t necessarily get paid for it, that company can and frequently does.

Exact numbers on how much is made are not available, but it’s estimated to be in the billions of dollars. The controlling companies can sell your data to insurers, pharmaceutical conglomerates, and even employers who may be looking for any reason to cut staff, said Dr. Peel.

Of course, there are rules in place to keep your data safe, but they’re not as strong as some people would like. The Health Insurance Portability and Accountability Act, better known as HIPAA, was designed to prevent private information from getting into foreign hands, but Congress changed the rules in 2002. They stripped away HIPAA’s need for doctors to get a patient’s written consent before sharing their health information. The idea was to allow other physicians and nurses a way to quickly weigh in on a patient’s illness in the name of treatment.

It worked, which is partly why the Obama administration included $45 billion in economic stimulus funds to digitize all of America’s medical records. But there were side effects. Aside from drug companies and insurers, now anyone in the hospital’s or doctor’s network can access your electronic data. It’s a point one California hospital learned the hard way when they were fined $250,000 after Octomom Nadya Suleman’s records were leaked earlier this year .

In the Austin area, few doctors know the importance of patient privacy more than UT’s team physician Dr. Mark Chassay. He treats some of the country’s biggest sports stars and says when it comes to your health, the benefits of honestly answering your doctor’s questions outweigh the risk to privacy.

"It's very important to fill out. we've had some people who have balked to it, especially if it's your first time in the doctor's office and you want to get to know the doctor and you may not feel comfortable with that but usually it's important that the doctor asks you at some point early on so they'll have some idea of what kind of risk you may be in," said Dr. Chassay.

In Austin, Brackenridge Hospital uses Cerner Corporation’s electronic record system. While it is true people in their network can access medical files, a detailed record is kept showing who logged on and when, said Patricia Perry Williams, head of information security at Brackenridge. She tells 7 On Your Side that people have been fired for looking where they shouldn’t.

In any case, Dr. Peel says now when you go to the hospital or doctor’s office, you really should bring your own contract, available in the group's online privacy toolkit .

"Now to protect yourself you really have to take the doctor your own consent form, tell them what your rights are, tell them you don't expect them to disclose anything without your express consent,” said Dr. Peel.