Like other top hospitals in LA, UCLA Medical Center has heavy
physical security to keep the papparazi and other riff-raff away from
its celebrity patients. But a flock of security guards in the parking
lot can’t stop an inside job. The LA Times
reported over the weekend that the hospital fired 13 employees and
disciplined six doctors for taking unauthorized looks at Britney
Spears’ online medical records during her recent stay in the
psychiatric unit. The rest of us aren’t Britney (a relief to Kevin
Federline, no doubt), but we should be worried.
Electronic
medical records, like those at UCLA, are proliferating. Done right,
they are expected to cut costs and ease access for docs in different
locales, including emergency rooms. But the technology, and now profit
motives, are getting ahead of patient privacy and protection.
Google
wants to keep your complete medical records. So do Microsoft and
Yahoo. But if at least 25 people can violate UCLA’s system for nothing
but gossip value, what would your complete-from-birth medical records
be worth to an insurer, a mortgage lender or a potential employer who
wants to know everything about your health history? It wouldn’t take a
hacker to find out, if a system technician is having trouble paying his
mortgage.
Unlike a doctor or a hospital, Google wouldn’t be
subject to the federal patient privacy law known as HIPAA, so all we
have to depend on are its promises (which so far are not nearly
comprehensive enough).
Pharmaceutical companies also want to use
your electronic pharmacy records to keep their products in your
medicine cabinet–and advertise new ones related to your specific
health conditions.
A for-profit company, Adheris, offers the
"service" of reminding you to take your (brand-name) medication, but
makes its money from the drug companies that mine its data. (FTCR is
trying to stop their entry
into California). Under a proposed law, your pharmacist wouldn’t even
have to ask your permission before sending your data to Adheris. The
company’s promise to shield your specific identity is far from enough
to make its for-profit "service" worthwhile.
While the
tabloids may be after Britney, the rest of us are fair game to drug
companies, insurance companies and financial companies in the world of
online health records. The benefits of universal electronic records
shouldn’t be embraced without a full set of consumer protections to
match.
