Listen and followApple PodcastsSpotifyYouTubeMore apps · Browse all episodes
Join us in this episode as we discuss the limitations of HIPAA and U.S. law in protecting health information privacy with our guest, Brian R. Jackson. As a pathologist, Brian provides a unique perspective on the challenges of modernizing health privacy law and the potential benefits it can bring, including better public health data aggregation and improved public health outcomes. We’ll delve into the three glaring deficiencies of HIPAA, the de-identification loophole, and the limitations of distinguishing between different types of subsequent data uses. Tune in for an insightful discussion on the need for stronger data privacy protections in the health care industry.
Brian R. Jackson is a pathologist.
He shares his story and discusses his KevinMD article, “Why HIPAA isn’t enough to protect your health data.”
The Podcast by KevinMD is brought to you by the Nuance Dragon Ambient eXperience.
With a growing physician shortage, increasing burnout, and declining patient satisfaction, a dramatic change is needed to make health care more efficient and effective and bring back the joy of practicing medicine. AI-driven ambient clinical intelligence promises to help by revolutionizing patient and provider experiences with clinical documentation that writes itself.
The Nuance Dragon Ambient eXperience, or DAX for short, is a voice-enabled, ambient clinical intelligence solution that automatically captures patient encounters securely and accurately at the point of care. Physicians who use DAX have reported a 50 percent decrease in documentation time and a 70 percent reduction in feelings of burnout, and 83 percent of patients say their physician is more personable and conversational.
Rediscover the joy of medicine with clinical documentation that writes itself, all within the EHR.
VISIT SPONSOR → https://nuance.com/daxinaction
SUBSCRIBE TO THE PODCAST → https://kevinmd.com/podcast
RECOMMENDED BY KEVINMD → https://kevinmd.com/recommended
GET CME FOR THIS EPISODE → https://earnc.me/oje6sl
Powered by CMEfy.
Transcript
Kevin Pho: Hi, and welcome to the show. Subscribe at KevinMD.com/podcast and get CME for this episode by clicking on the CME link in the show notes. Today we welcome Brian Jackson. He’s a pathologist. His KevinMD article is titled “Why HIPAA isn’t enough to protect your health data.” Brian, welcome to the show.
Brian R. Jackson: Hey, thank you. Pleased to be here.
Kevin Pho: We’ll get into the article in a little bit. First off, briefly share your story and journey to where you are today.
Brian R. Jackson: Like a lot of doctors, I grew up around health care. My dad was a pharmacist, and so I grew up around the hospital in Salt Lake City. Then I was really interested in computers back in the ’80s, and so I ended up working in high school, and then during college, in the informatics department at Intermountain Healthcare, where they had a homegrown electronic health record system. That was a lot of fun, and that’s what made me want to go to medical school. It wasn’t so much about seeing individual patients but just this realization that health care is the most exciting industry in the world, with some of the smartest and most interesting people, and I wanted to be part of that. So that’s what got me into medical school.
I ended up doing a residency in pathology, then worked in health care IT for a couple of years, did a master’s in informatics, and then I landed at ARUP Laboratories in Salt Lake City, where I’ve been for the past two decades. What’s interesting about ARUP is that it’s quite a large medical laboratory business that does testing for hospitals all over the U.S. It has about 5,000 people employed there, but it’s also entirely part of the University of Utah. So it’s this hybrid business and academic environment, and I was able to sort of do IT, do operations, and do a bunch of business-facing functions, and be sort of half an academic, writing papers and going to conferences, and then half in a business role in this medical setting. So it was really just a fun place; I couldn’t imagine a better place to build a career over the last couple of decades.
More recently, I’ve taken more or less a sabbatical this year. I stepped away from my full-time academic role and started working on a book proposal and some things on basically the topics we’ll be talking about today. So I’m here in London with my family, awaiting the king’s coronation at the end of this week, drinking all of that in and just having a great time.
Real physician voices, twice a week
Free, and one click to unsubscribe.
Kevin Pho: Excellent. Now, with your expertise in both medicine and health informatics, why has that marriage between medicine and health IT been so rocky and difficult?
Brian R. Jackson: Oh, it could be a long answer. It was the IT thing that got me into medicine rather than the other way around, but it was because of what you said: There seemed to be just such huge opportunities to do things so much better. Medicine is an information profession. I mean, what doctors do is mostly about information, more than it is about physical actions and things like that. Historically, medical records, being on paper, were very limited in what you could do with them.
I think the informatics community made some mistakes back in the ’90s and 2000s. With the push to get everyone onto electronic health record systems as fast as possible, it happened in ways that basically put everyone on commercial platforms that were, and I’m just going to express an opinion, I don’t think were necessarily the best-designed commercial platforms. So that industry consolidated much faster than it really should have, and it drove out some of the independent efforts, like Intermountain, Vanderbilt, Harvard, Beth Israel Deaconess, and some others that I should be naming that I’m forgetting. It sort of drove them out because of the way it all consolidated and the way the regulation came about. So that didn’t really do us any favors, but hopefully we’re making some progress.
Kevin Pho: All right, so we’re going to talk about one aspect of informatics and that intersection of informatics and medicine, which is, of course, patient privacy and HIPAA. Your KevinMD article is titled “Why HIPAA isn’t enough to protect your health data.” Now tell us, how did this article come together?
Brian R. Jackson: I’ve had this interest for a long time in the connection between medicine and corporations. Again, a lot of this was just from working in business-facing roles and learning about business theory and taking classes and things. A couple of years ago, some articles came out in the press about Google approaching health systems to acquire medical records. One of the first ones was a project that hit the press from UCSF, and then later some bigger data acquisitions involving the University of Chicago, and the biggest one was Project Nightingale with the Ascension health system. This was from Wall Street Journal articles. So that got me really thinking about the deal making between health care systems and a company like Google, and the ethics of this.
Now, it turns out that the UCSF contract became public because it was acquired by a reporter through the California Public Records Act. So I read through that, and it looked to my eyes like a pretty ethical contract. Google was committing to use this patient data in ways that seemed to be responsible. They were promising to destroy the data at the end of the project, to not re-identify it, to not share it with any third parties, et cetera, et cetera. So there were no big red flags in terms of the wording of the contract. The concern was the privacy of it. Why wasn’t that public? Why didn’t UCSF, in particular? Now, I don’t blame Google.
OK, so here’s the irony here: Companies like Google, their whole business model is built on exploiting our private data. I think people know that. So they really don’t have any respect for private data, because their business model is antithetical to that, and yet they are incredibly protective of their own corporate privacy. I just find that a little bit ironic. Because of that, Google does not make these deals public. But why didn’t UCSF make it public? Presumably because Google told them not to and put pressure on them, twisted their arm. But was that really ethical?
And then with Project Nightingale and the Ascension health system, why didn’t Ascension executives insist that that be public? Because presumably they were well intentioned. Presumably they were doing this deal so that Google could develop useful software that Ascension could then use. So if the intentions were good, if there was nothing to hide, why were they hiding it?
So that got me thinking, and I got a group of like-minded folks together from the American Medical Informatics Association, whom I’d met through the ethics work group in that organization, and we started talking about whether we could do a research project around this. Originally I wanted to go to health system executives and ask for all of their data-sharing contracts so that we could analyze their contract language, and we quickly discovered that no one was going to share their contracts. So instead, we have been doing structured interviews with health system executives to ask about their policies and practices and perspectives and motivations and things like that, and hopefully we’ll get something submitted for publication in the coming months.
But out of that came a lot of internal conversations about HIPAA, because one of our main findings was that to many health system leaders and hospital CEOs, HIPAA gets equated with privacy, or I should say privacy gets equated with HIPAA. “If we’re complying with HIPAA,” which everyone does, and health systems are very good at this, “if we’re complying with HIPAA, then we’ve checked the box, and we’re doing everything we need to do to be responsible about privacy.” That’s the attitude, and it’s a problem, because HIPAA is an incredibly archaic law in internet terms. So that was the motivation behind writing this up.
Kevin Pho: And we’re seeing a lot of these corporate entities get involved in the health care space. You mentioned Google, and I want to ask you about Amazon, right? Amazon has their own clinics, and they’re buying primary care clinics, and they’re moving into that primary care space. So tell us, what exactly is the privacy risk to patients who engage in services that are intersecting with these corporate entities like Amazon and Google? What is their data privacy risk?
Brian R. Jackson: There are several ways you can slice this. From a medical ethics standpoint, there’s certainly the principle of autonomy: that all of us should have the right to control our own data, just the way we have the right to control our own bodies. So whether you want to frame that as a risk or not, I think there’s sort of a fundamental expectation out there that a lot of people have.
But if you want to talk about actual risks, let me try an example here. This was a recent news story that came out. It was reported in STAT News, but I think in some other sources as well, that most hospitals in the United States have Google, Meta/Facebook, and other tech companies’ tracking software built into their websites. The deal here, the trade-off, basically, is that the software is free to the hospital and to the marketing departments who build the websites, and the software gives you basically free web statistics on your users. So it’s useful stuff, and so everyone has incorporated it into their websites. Well, at the back end, what these trackers do is siphon off user data and send it to Meta/Facebook and Google and whoever it is providing the software, which they then build into their databases for search purposes.
OK, so is there a risk to the fact that 99 percent of hospitals have this on their public websites? Now, hospital execs interviewed for the news articles basically said, “Well, there’s no risk here, because we don’t put PHI on our website.” OK, and there are no trackers on the patient portals. But here’s a scenario for you. Let’s suppose you are a woman in Texas who just found out that you’re pregnant, and you start searching hospital websites to see which hospitals have abortion services. The fact that you are searching the public website for the word “abortion” is now part of Google’s and Facebook’s databases. Now, is that going to be discoverable by an aggressive attorney general in the state of Texas? Under some scenarios, it possibly could be.
OK, a second, related scenario: Maybe you’re not searching for abortion; maybe you’re looking for a substance abuse treatment program, again offered by a hospital. So now that information is in Google’s databases, and maybe some other tech companies’ databases. And now suppose that there’s a spin-off of Google selling algorithms to HR departments to screen employees, basically for candidate screening, to see who’s going to be a good employee. That algorithm may now have access to all kinds of personal data on you, including the fact that you were just looking for a substance abuse treatment program at a hospital, and maybe you had an abortion, and maybe you’re seeing a psychiatrist. So you can sort of see where these scenarios go. The more that these companies know about you, the more risk there is that it could be used in all kinds of subtle ways. And with the rise of AI making decisions about employee screening, about health insurance rates, about life insurance rates, about all kinds of aspects of your life, it does become a real risk.
Kevin Pho: Now, to your knowledge, today, have any of those scenarios come to fruition? Have there been any cases or stories of something close to what you just said coming through?
Brian R. Jackson: So I am not aware of any of those specific scenarios coming through. On the algorithm front, if you just want to look at algorithmic bias kinds of stuff, there has been a lot of good reporting, particularly by ProPublica and particularly in the criminal justice space, about how algorithms used by judges to assign sentences can be biased in lots of bad ways. So I’m connecting some dots here, but basically you combine the rise of AI, and the ways in which algorithms are coming into our daily life, with the fact that these algorithms are going to increasingly have access to big data sets that include all kinds of private information, to say that maybe this isn’t such a great thing.
Kevin Pho: So let’s talk about Amazon. I know Amazon’s gotten into that primary care space. They have this product where someone, a practitioner, can prescribe medication without really even talking to you; you could fill out a questionnaire. Are these companies bound by any privacy laws? Are you essentially just giving up your private medical data without something close to HIPAA on these corporate entities’ part?
Brian R. Jackson: OK, so I think you’re getting into the HIPAA-covered entity part. This is one of the major limitations of HIPAA law as originally written. Back in the ’90s, in the pre-electronic health record era, HIPAA was written specifically to apply to hospitals, clinics, health care workers, insurance companies, and basically clearinghouses between those two. So basically, if you had traditional access to health records back in the ’90s, then HIPAA was written for you. The boundaries have really gotten blurred.
So with Amazon, if Amazon is running a clinic, then that clinic is obviously bound by HIPAA. If Amazon is doing other IT-related services that are sort of organizationally separated from the part of Amazon that’s running a clinic, then that part of Amazon probably isn’t subject to HIPAA.
An example here that again has been in the news recently is BetterHelp. It’s not Amazon, but I think we’ve all heard ads for BetterHelp on podcasts or in other places. They’ve advertised quite aggressively, and their pitch is that they’ll match you up with a therapist online, which in principle is a good thing. I mean, there’s a lot of need for mental health care in the U.S. and a lot of unmet need, and if they can fill some of that by matching people up to therapists, that should be a good thing.
So BetterHelp was discovered to be selling a lot of their data to Facebook by the same kind of mechanisms we were talking about a few minutes ago. Even though BetterHelp was caught doing that, they have not been hit with a HIPAA-related fine, and that’s presumably because they’re probably not a HIPAA-covered entity, even though they’re in the mental health space. The reason they’re not subject to HIPAA is that they’re not actually the organization delivering those services. They’re like Uber, contracting with private therapists, and the private therapists keep their own records, and they’re subject to HIPAA, but BetterHelp as a company is not. So I think it’s a loophole.
But anyway, the end of that story was that they did get hit with a multimillion-dollar fine, but it was from the FTC, for basically false advertising, because they were claiming in ads to be responsible with privacy and then turning around and not doing it. So yeah, it’s a good example of how in the modern internet era, not everyone involved in health care is actually even subject to HIPAA.
Kevin Pho: So what’s the path forward here? Because we’re seeing all these tech companies moving into the health care space, hoping to disrupt it. Should patients simply be wary of any tech-related health care solution? Should they accept the trade-off to their privacy? What do you envision to be the path forward?
Brian R. Jackson: I think people have sort of accepted loss of privacy because, let’s face it, the current system doesn’t give patients any real control. Even HIPAA: What are those forms, those HIPAA disclosures that you sign when you go into the hospital? You don’t have any real control over whether you sign that or not, because they won’t treat you if you don’t sign it. So patients have basically zero control today, and I think at that level, as citizens, we shouldn’t accept that as being OK.
In terms of how things can be changed, clearly federal medical data privacy law needs to be overhauled. It’s way overdue. I know there are folks working on it in Congress. I don’t know that there’s anything close to actually making it onto the floor for discussion, but a number of things really need to be rethought. There are some principles from the Europeans’ GDPR legislation that might be useful here.
But some of the key things that really ought to be done differently with HIPAA are, first of all, it should apply to everyone, not just health care companies. It should be based mainly on misuse of health data rather than disclosure of health data, because HIPAA is all about disclosure, but it doesn’t penalize people downstream for what they actually do with it.
And then the de-identification loophole is an enormous loophole. We’ve got this huge data broker industry in the United States, companies like IQVIA and now Truveta, but those aren’t the only examples, sharing and selling health data and getting away with it because they strip out names and birth dates and the other identifiers. But all of that data can be re-identified with fairly straightforward technology. So the de-identification loophole really needs to go as well. So anyway, basically my point is we need a complete overhaul of federal law.
But I do think there’s an additional layer here, which is that health care organizations, particularly hospitals, have a moral and ethical responsibility to their communities. They don’t always act like it, let’s be honest, but they do have that responsibility in their community, and the boards of directors should hold them accountable for that. Hospitals have a lot of purchasing power and a lot of influence if they choose to exert that power in terms of contracts with suppliers, and I think hospitals could do a lot to hold IT companies and other kinds of external companies that they contract with accountable for these kinds of things.
Kevin Pho: And my final question, Brian: Tell us some of your take-home messages that you want to leave with the KevinMD audience.
Brian R. Jackson: The big take-home message that I’d like to leave people with is that the rise of corporations in health care, we’ve all seen it, we’ve all experienced it, it’s real, and it’s not going to go away. We need to develop better ways to hold corporations accountable to the same ethical principles that physicians are basically indoctrinated with during our training. Those ways exist in theory; they’re just not in practice today. So hospitals and professional organizations need to be talking about medical ethics, but not just ethics in the individual sense; ethics in terms of the behavior of large health care corporations, and finding creative ways to create more transparency and more accountability.
Again, this is obviously my area of personal interest, and I’d just like to plug that I’m working on a book proposal. The working title is Hippocratic Capitalism. Pretty soon we should have the HippocraticCapitalism.com website up and running, where we’ll put more ideas and information on this topic.
Kevin Pho: All right, thank you so much for sharing your time and insight, and thanks again for being on the show.
Brian R. Jackson: All right, thank you very much. I appreciate the opportunity.
Listen and followApple PodcastsSpotifyYouTubeMore apps · Browse all episodes
