The Washington gang must have passed some sort of privacy law recently, judging by the number of "privacy notices" I’ve received from my health insurer, broker, and banker.
I haven’t paid much attention to them, for a couple of reasons: I don’t need these people to tell me what my rights are, and my broker and banker are among the principal violators of my privacy. It’s ludicrous to think they would protect it.
However, today I got a "Notice Of Privacy Practices" from my drug store! I found this so remarkable that I actually took time to read the almost five-page document. The pharmacy, it appears, keeps information about me, referred to as PHI (protected health information). The Notice describes how "we may use and disclose PHI about you to carry out treatment, payment or health care operations and for other specified purposes." The Notice also states that the pharmacy will not "use or disclose PHI about you without your written authorization, except as described in this Notice. We reserve the right to change — the Notice." Gee, my privacy is secured by rivets made of Jell-O! The use of the word "protected" in Protected Health Information evidently means protected from me.
The Notice then proceeds to list my rights: "You have the right to request additional restrictions on our use or disclosure of PHI about you by sending a written request to (us)." Aha! My privacy assured! Oops — here’s the next sentence: "We are not required to agree to those restrictions." Oh, well.
I also have the right to "access and copy PHI about you contained in a designated record set for as long as the Pharmacy maintains the PHI. — We may deny your request to inspect and copy in certain limited circumstances." Ah, but if my request is denied, I can request a review!!! I suspect THAT request could be denied, also.
But if the information in my PHI is incorrect, I "may request an amendment. To request an amendment, you must send a written request to (us). In addition, you must include a reason that supports your request. In certain cases, we may deny your request for amendment." But I have the "right" to file a statement of disagreement if my request is denied. I’m breathing easier!
The pharmacy may make disclosures of my PHI to "friends or family members involved in your care." I have the "right to receive an accounting of the disclosures we have made of PHI about you for most purposes other than treatment, payment, or health care operations." This right to an accounting is "subject to certain other exceptions, restrictions, and limitations." Why am I not surprised?
Of course, I can get tired of this whole run-around, and simply insist that the pharmacy stop disclosing information about me. I have that right: it says so right in the Notice: "You may revoke a consent in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing PHI about you, except to the extent that we have already taken action in reliance on the consent. We may refuse to continue to treat a customer that revokes his or her consent." That means finding another drug store, and guess what? — another Notice! And I cringe at that word "treat." I don’t want to be "treated" by the drug store!
Well, what, exactly, is the pharmacy going to do with this PHI of mine? According to the Notice, it is "likely" that it will be provided to insurance companies, business associates (of the pharmacy, such as billing agencies, but they will be "required" to safeguard the PHI!!) to family members, other relatives, close friends, or any person I identify, to the FDA, regarding adverse effects, to Worker’s Compensation, to public health or legal authorities concerned with preventing disease, to law enforcement, pursuant to a valid subpoena, to health oversight activity agencies, to courts, again pursuant to subpoena, or "administrative order," to researchers (who will guarantee my privacy, however!), to coroners, medical examiners, and funeral directors, to organ banks, fundraisers (!), correctional institutions, the military, "authorized federal officials for intelligence, counterintelligence, and other national security activities," to authorized federal officials so that may provide "protection to the President," his cronies, and foreign heads-of-state, and to a social service agency regarding abuse, neglect, or domestic violence.
In other words, my "protected" health information can be made available to hundreds of nameless persons, for reasons so vague as to be hard to challenge, and interpreted by others, not me. The whole absurd business is given an aura of propriety, if not actual legality, by describing it in a wordy "notice." That makes it OK, of course! I shudder to think what would happen if my health information weren’t protected.
That which the government would destroy it first legislates to "protect!"
Dr. Hein [send him mail] is a semi-retired ophthalmologist in St. Louis, and the author of All Work & No Pay.
