Personal Privacy in an Information Society. Recommendations

07/12/1997

The Commission's inquiry into the creation, maintenance, use, and disclosure of medical records and medical-record information led it to six basic conclusions.

First, medical records now contain more information and are now available to more users than ever before.

Second, the control medical-care providers once exercised over information in medical records has been greatly diluted as a consequence of specialization within the medical profession, population mobility, third party demands for medical-record information, and the increasing incidence of malpractice suits.

Third, the comparative insulation of medical records from collateral uses, normal even a decade ago, cannot be entirely restored. Indeed, it appears that the importance of medical-record information to those outside of the medical-care relationship, and their demands for access to it, will continue to grow. Moreover, owing to the rising demand for access by third parties, coupled with the expense of limiting disclosure to that which is specifically requested by the non-medical user, there appears to be no natural limit to the potential uses of medical-record information for purposes quite different from those for which it was originally collected.

Fourth, as third parties press their demands for access to medicalrecord information, the concept of consent to its disclosure, freely given by the individual to whom the information pertains, has less and less meaning. When an individual must choose between signing an authorization form and foregoing employment or insurance or public assistance, one cannot realistically speak of his signing voluntarily. This is not to say that authorization procedures are useless; to the contrary, they are essential instruments of control over the content and subsequent use of what is disclosed. In many situations, however, they should no longer be construed as evidence of consent freely given.

Fifth, although the content of a medical record is becoming harder to control at the same time that the number and kind of decisions in which it figures is growing, it is still rare for an individual to be allowed to see, much less copy, a medical record pertaining to himself or to check the accuracy, timeliness, or completeness of the information it contains.

Sixth, there are steps that can and should be taken: (a) to improve the accuracy, timeliness, and completeness of the information in a medical record; (b) to enhance the individual patient's awareness of the content and uses of a medical record about himself; and (c) to control not only the amount and type of information that is disclosed to other types of users, but also the conditions under which such disclosures are made.

The recommendations presented below are the Commission's answer to a balanced delineation of these steps. As with the Commission's other recommendations, they have three objectives: (1) to minimize intrusiveness; (2) to maximize fairness; and (3) to create a legitimate, enforceable expectation of confidentiality. Unlike the Commission's other recommendations, however, the recommendations set forth below are expected to have their greatest influence outside the medical-care relationship. For example, the Commission's recommendations are not focused on the intrusiveness of the medical-care relationship per se, but rather on the intrusiveness that can result from others being able to take advantage of the unusual extent of divulgence and recording of observations that the medical-care relationship entails. Similarly, the Commission's recommendations for letting the patient see, copy, and correct or amend his records are not primarily aimed at the consequences of inaccuracies or other deficiences in the records when used by a medical-care provider working within the context of the medical-care relationship.

The Commission has been moved to recommend rights of access and correction for the patient in recognition of the harm that can befall him as a consequence of inaccurate, obsolete, or incomplete medical-record informa tion being available for use in the context of relationships he has with other kinds of record-keeping institutions. While the Commission is aware of the argument that giving a patient the right to review, discuss, audit, and obtain a copy of his medical record can have therapeutic value,48 it does not consider the decision-making uses of medical records within the confines of the medical-care relationship to be within its competence. In fact, only in the confidentiality area do the Commission's recommendations speak directly to the dynamics of the medical-care relationship, but again, only as those dynamics are affected by the lack of a legitimate, enforceable, expectation of confidentiality.