HIPAA Blog

[ Monday, February 20, 2006 ]

Slicing Through the Gordian Knot. OK, I've ranted and raved about how Privacy/Security and Healthcare excellence are opposing forces where healthcare information is concerned. If you want perfect privacy and security of your healthcare information, tell no one, not even your doctor. Prevent any dissemination of the information, and your privacy will be protected. Of course, your health will suffer, but that's the price of perfect privacy. On the other hand, if you want the best healthcare possible, make sure your medical information is spread out to everyone possible. If all medical professionals, researchers, etc. had access to your medical information, no symptom or possible infirmity would go unnoticed and undiagnosed. Of course, people could use that information against you, and obviously you'd have no privacy regarding your medical issues. That would probably be OK for someone with exhibitionistic tendencies, but for most people, there are at least some potential medical issues that they'd rather not have everyone know.

One of the things about medical information, though, is that the vast majority of it is not the type of stuff people are all that concerned about keeping private. For example, my secretary Alice is on vacation this week, and I was supposed to have a temp at her desk. Well, he called in sick. That's right, he freely volunteered medical information to Nicola in office services, who relayed the information to me. Actually, all she told me was that he was sick, but he probably told her more than that. I read in yesterday's newspaper that the batting coach for the Texas Rangers, Rudy Jaramillo, has prostate cancer. Occasionally you'll see someone out in public with an arm in a sling or hobbling along on crutches. And I'm just not all that bothered with the breach of medical information privacy that occurs when I tell you that there's a stomach flu bug working its way through the Drummond household (not me yet, knock wood). Those are all disclosures of medical information, and a breach of the privacy of the information.

Other disclosures of health information are more sinister. Unlike Bob Dole, most men using Viagra don't want that information publicized. If Vince Young has a degenerative knee condition, or if his peripheral vision on the right side is weak, he probably doesn't want anyone to know about it. Theoretically, a bank or insurance company could use adverse health information about a loan applicant or potential insured to turn them down.

However, a look at the news about HIPAA breaches and the improper disclosure of protected health information has not been a story of medical information being broadcast to the detriment of individual patients; rather, it has been about other information being broadcast and used by bad actors in a manner that harms the individuals: it has been the use of social security numbers to perpetrate identity theft.

Theoretically, disclosure of medical information could be bad. But the real trouble in privacy breaches does not involve the medical information, it involves financial information. And specifically, it involves disclosure of the patient's social security number.

Why is disclosure of a social security number such a bad thing? Because the social security number is the de facto identifier in America these days. Banks, credit card companies, employers, the government, all kinds of people want a way to ensure the identity of the person who they think they are dealing with. How can a bank find out whether Jeff Drummond is a good person to lend money to, someone who might repay? They can find out information about Jeff Drummond, but it might also be information about Jeff Drummond. And they definitely aren't the same person.

As an effective ID number, the social security number has become the primary means of identification for financial transactions. If a bad actor wants to pretend to be not who they are so as to steal via credit card or other method, it is much easier if they pretend to be someone else than if they pretend to be an entirely made-up person. So, if a bad actor knows a person's name and social security number, the bad actor can go a long way toward pretending to be that person, and thereby steal from a third party who thinks they're dealing with the person, not the bad actor (collateral damage is done to the person, when the third party tries to collect). So, the need to confirm identity for business, commercial, and governmental dealings has led to the social security number being the key form of identification, and that has led to the possible misuse of social security numbers to steal through the form of fraud known as identity theft.

Much of the concern about the national patient identifier is the concern that we don't want a "national ID card." But, in fact if not in law, we have one in the social security number. And I, for one, don't really understand all the fuss and concern about having national ID cards. So what? The government could do a bunch of terrible things to you if there were national ID cards, but it seems they could do a bunch of bad things to you without having national ID cards. But even giving credence to those "black helicopter"types of concerns, your social security number effectively serves as your national ID anyway, at least as far as your financial life is concerned. So what if there was also a national identifier just for your healthcare information? Would that cause any greater concern than the fact that there is currently a de facto national identifier for all of your information, financial and healthcare (not to mention educational, etc.)?

Again, the concern about your social security number getting into the wrong hands is primarily a financial one. Nobody is committing identity theft so they can actually "be" the victim, are they? If so, I'm going to steal Kobe Bryant's identity. No, people steal identities so they can perpetrate financial fraud and steal by deception. And social security numbers are valuable in that they allow someone to do so.

And again, the big examples of HIPAA breaches we've seen, or at least the actual or anticipated damages, all relate to the disclosure of social security numbers.

But what if we could remove social security numbers from PHI? What if the HIPAA breaches included patient medical information but not patient financial information; would they be as serious? I think not. Sure, some people would probably like to see the medical information of just about any individual -- an office snoop, a family member, your boss, the company you are trying to get a life insurance policy from, etc. (but think about it, many of those people get to see that information via intentional disclosure by the individual). And there are some people, such as celebrities, whose medical information would be valuable to the tabloid press, regardless of whether it's a serious or embarrasing condition. But by and large, an inadvertent or accidental disclosure of the medical information on a lot of people just wouldn't be as big a cause of concern as the inadvertent or accidental disclosure of social security numbers on those people.

The holy grail of computer crime is getting social security numbers. The problem with interoperability is that it dramatically raises the stakes by increasing the amount of treasure in the vault by connecting a bunch of small vaults into one great big one. But what if the "treasure" in the vault is devalued? The gold (social security numbers) is replaced with lead (patient identifier numbers)? Sure, the lead is worth something, but not much, or not to most people; if someone wanted information on a single individual, they could break into the small vault and get it, and interoperability doesn't increase or decrease that risk. But there's gold in the vault, interoperability increases the risks; if there's lead in there, the risk really isn't increased by interoperability.

So, that's my point. We need to balance the need for privacy with the need for disclosure to drive effective health care. And we could really help efficiency in the transfer and availability of information by connection healthcare data bases. But in doing so, we need to protect as much as we can the information in those interconnected data bases. And one way to do so would be to remove the biggest troublemaking nugget of information, the social security number. And the best way to do that is to replace it with another universal identifier, unconnected to the social security number.

I know some of the arguments, such as the "big brother" or "black helicopter" concerns, and while I don't want to entirely denigrate them, I fail to see how having a de jure patient ID number is any worse than having a de facto everything ID number. Also, everyone knows their social security number; this would require them to have yet another number to remember. While this is definitely a drawback, it shouldn't be insurmountable. Not that many years ago, working folks needed to know 2 phone numbers for themselves (stay-at-homes, students, and other non-workers only needed to know 1), and usually only 7 digits; now, people know their home, office, cell, other people's cell and home and office, and usually 10 digits. If people can remember that many phone numbers, they can remember a "second social security number".

I'm not saying that patient identifiers are going to happen; hysterics may win the day. Just that they should.

Jeff [10:41 AM]

Comments:

Great essay! I plan to steal from it shamelessly :)

# posted by

Art : 11:25 AM