Public Health and the Law
The Privacy Protection Report and Epidemiological Research WILLIAM J. CURRAN, JD, LLM, SMHYG The Report of the Privacy Protection Commission has been awaited by epidemiological researchers, and by medical science researchers generally, with a certain sense of anxiety. Privacy protection is a popular subject in Congress. It is a "flag and motherhood issue" on which successful careers and personal appearances on CBS Ev,ening News and Good Morning, America have regularly been built. It is often sensational; it feeds upon rank paranoia as well as upon legitimate fears of disclosure of the embarrassing moments in nearly all of our lives. The report is long and complex. It requires careful, thoughtful examination, advisably by experienced legal counsel, to be fully understood. (It contains 654 pages, 16 chapters, and has no summary of recommendations.) I will try to point out some of the important recommendations for epidemiologists and other medical researchers who would utilize medical and other personal records in their research. The Commission recommends that all states enact laws allowing patients to examine their medical records, including hospital clinical records. No general exceptions are provided such as for psychiatric records and the medical care provider cannot withhold information thought harmful to the patient. In a rather confusing added recommendation, however, the Commission suggests that the patient be afforded access to the record, or that the medical care provider furnish the record to "another responsible person designated by the individual." This other person, the text explains, could then use his or her discretion as to whether to disclose all of the information in the record. Of particular importance is a recommendation that the patient be given the opportunity to correct the medical record or to amend it with further information. If the institution or the provider (a private practitioner) refuses to accept the "correction" or "amendment", the institution or provider must nevertheless include in the record a concise statement Professor Curran is Frances Glessner Lee Professor of Legal Medicine, Harvard University, School of Public Health, 677 Huntington Avenue, Boston, MA 02115 AJPH February 1978, Vol. 68, No. 2
of the reasons for the disagreement and in any subsequent disclosure of the "disputed information" include the "statement of disagreement" (which is apparently the correction or amendment which was refused) and may also include the provider's or practitioner's own statement of the reasons for not making the correction or amendment. Specifically in regard to use of medical records, the Commission would generally require that the consent of the individual patient be obtained before access to records is allowed. There is a specific exception, however, for researchers conducting "a biomedical or epidemiological research project." In order to allow access without patient permission, the facility or practitioner must be satisfied that the researcher and his project meet file separate conditions as follows: First, the discloser cannot violate any limitations under which the information was collected. Second, the disclosure in individually identifiable form must be "necessary" to the research. Third, the institution or practitioner must be satisfied that the "importance of the research" is such that it warrants the "risk to the individual" in the exposure of the information to the researcher. Fourth, the institution or practitioner must be satisfied that the researcher has established adequate safeguards to protect the disclosed information from unauthorized use including a program for "'removal or destruction of identifiers." Fifth, the institution or practitioner must retain the authority to consent in writing to any further use or redisclosure of the information in individually identifiable form. The researchers with whom I have discussed the above provisions indicate to me that they can function under them, as long as the institution or practitioner does not interpret them unreasonably. The text of the Commission Report indicates that the exception applies not only to record examination without later contact with the patients, but to followup studies where patients are contacted by the researchers for further information. It remains to be seen what the Congress and the states do with the recommendations of the Commission. The attachment of many of the recommendations to federal regulatory and funding programs is expected within the next year. 173
The Privacy Protection Report and Epidemiological Research WILLIAM J. CURRAN, JD, LLM, SMHYG The Report of the Privacy Protection Commission has been awaited by epidemiological researchers, and by medical science researchers generally, with a certain sense of anxiety. Privacy protection is a popular subject in Congress. It is a "flag and motherhood issue" on which successful careers and personal appearances on CBS Ev,ening News and Good Morning, America have regularly been built. It is often sensational; it feeds upon rank paranoia as well as upon legitimate fears of disclosure of the embarrassing moments in nearly all of our lives. The report is long and complex. It requires careful, thoughtful examination, advisably by experienced legal counsel, to be fully understood. (It contains 654 pages, 16 chapters, and has no summary of recommendations.) I will try to point out some of the important recommendations for epidemiologists and other medical researchers who would utilize medical and other personal records in their research. The Commission recommends that all states enact laws allowing patients to examine their medical records, including hospital clinical records. No general exceptions are provided such as for psychiatric records and the medical care provider cannot withhold information thought harmful to the patient. In a rather confusing added recommendation, however, the Commission suggests that the patient be afforded access to the record, or that the medical care provider furnish the record to "another responsible person designated by the individual." This other person, the text explains, could then use his or her discretion as to whether to disclose all of the information in the record. Of particular importance is a recommendation that the patient be given the opportunity to correct the medical record or to amend it with further information. If the institution or the provider (a private practitioner) refuses to accept the "correction" or "amendment", the institution or provider must nevertheless include in the record a concise statement Professor Curran is Frances Glessner Lee Professor of Legal Medicine, Harvard University, School of Public Health, 677 Huntington Avenue, Boston, MA 02115 AJPH February 1978, Vol. 68, No. 2
of the reasons for the disagreement and in any subsequent disclosure of the "disputed information" include the "statement of disagreement" (which is apparently the correction or amendment which was refused) and may also include the provider's or practitioner's own statement of the reasons for not making the correction or amendment. Specifically in regard to use of medical records, the Commission would generally require that the consent of the individual patient be obtained before access to records is allowed. There is a specific exception, however, for researchers conducting "a biomedical or epidemiological research project." In order to allow access without patient permission, the facility or practitioner must be satisfied that the researcher and his project meet file separate conditions as follows: First, the discloser cannot violate any limitations under which the information was collected. Second, the disclosure in individually identifiable form must be "necessary" to the research. Third, the institution or practitioner must be satisfied that the "importance of the research" is such that it warrants the "risk to the individual" in the exposure of the information to the researcher. Fourth, the institution or practitioner must be satisfied that the researcher has established adequate safeguards to protect the disclosed information from unauthorized use including a program for "'removal or destruction of identifiers." Fifth, the institution or practitioner must retain the authority to consent in writing to any further use or redisclosure of the information in individually identifiable form. The researchers with whom I have discussed the above provisions indicate to me that they can function under them, as long as the institution or practitioner does not interpret them unreasonably. The text of the Commission Report indicates that the exception applies not only to record examination without later contact with the patients, but to followup studies where patients are contacted by the researchers for further information. It remains to be seen what the Congress and the states do with the recommendations of the Commission. The attachment of many of the recommendations to federal regulatory and funding programs is expected within the next year. 173
