Medical-Record Privacy May Suffer In Post-Terrorism Backlash

At first, almost no one noticed the latest threat to the privacy of medical records. The country itself had been attacked the previous month, and the privacy challenge was put into a section about access to business records in the U.S.A. Patriot Act of 2001 (HR 3163), which was signed by President Bush on October 25, 2001.

Section 215 stipulates that the director (or an agent) of the Federal Bureau of Investigation (FBI) can apply to a judge for an order requiring the production of “any tangible things” needed “to protect against international terrorism or clandestine intelligence activities. . . .”

During the debate on the Senate floor, Sen. Russell Feingold (D-Wis.), the sole dissenting vote on the legislation, called the section “a truly breathtaking expansion of police power.” He said, “[I]n an ex parte application to a secret court, with no showing even that the information is relevant to the investigation, the government can lawfully compel a doctor or hospital to release medical records or a library to release circulation records.”

The American Library Association (ALA), working with other specialized library associations, lobbied unsuccessfully for an amendment to the section that would provide greater protection for such records. The ALA is analyzing the possible effects of the law and has posted information on its Web site to help its members respond if records are requested.

APA President-elect Paul Appelbaum, M.D., said, “Certainly we can explore with other interested groups ways the legislation could be modified. Perhaps its reach could be limited through the use of an executive order or regulations. As written, the law appears to allow the FBI access to medical records without even meeting the test of probable cause. It circumvents protections and procedures based on the 4th Amendment that have developed over hundreds of years.”

APA is working to modify another legislative initiative that could affect the privacy of medical records. The Centers for Disease Control and Prevention (CDC) requested the Center for Law and the Public’s Health at Johns Hopkins and Georgetown universities to draft model state legislation that would expand the powers of public health authorities to respond to emergency health threats, such as bioterrorism.

As currently written, the model act states that a governor may suspend legal procedures for conducting state business and also suspend orders, rules, and regulations affecting state agencies if compliance would hinder efforts to respond to the public health emergency.

Jay Cutler, J.D., APA’s director of the Division of Government Relations, said, “We are supporting language that would protect psychiatrists’ medical records and psychotherapy notes in the event state privacy laws are suspended during a public health emergency. Any release of information about a patient must be based on the clinical judgment of a psychiatrist that there is a real and present danger to the public health.”

Joy Pritts, senior counsel of the Health Privacy Project (HPP) at Georgetown University, said that HPP has additional concerns about the model act. The act would appear to allow the existence of any epidemic, such as HIV or hepatitis, to trigger the emergency powers vested in state authorities. She and HPP staff are also worried about lack of protections for the health information that would be collected by authorities during any emergency.

A committee drafting the act is reviewing comments. A final version is expected by the end of the year.

The Web site for the Health Privacy Project is www.healthprivacy.org. The Web site for the American Library Association is www.ala.org. The Model State Emergency Health Powers Act is posted at www.publichealthlaw.net. ▪