Privacy concerns

BMJ 2004; 329 doi: (Published 26 August 2004) Cite this as: BMJ 2004;329:519
  1. George Dunea, attending physician
  1. Cook County Hospital, Chicago, USA

    If you should become infected with gonococcus, Treponema pallidum, hepatitis B, or HIV, you may not wish this information published in the local newsletter, disseminated to your friends, or discussed in a loud voice by enthusiastic medical students before an interested audience in a crowded elevator. You may not want your medical records sent to every insurance company in the country. You would accordingly be pleased to hear that a comprehensive federal law—the 1996 Health Insurance Portability and Accountability Act (HIPAA)—contains provisions designed to protect the privacy of patients' medical information.

    Unfortunately this law is now having distressing consequences. These seem to arise largely from uncertainties in understanding its complicated provisions, misinterpretations, and anxiety about breaking the law and incurring heavy penalties.

    We read that some months ago a man jumped out a window because a hospital assumed that it was not allowed to inform the family that he had been treated for depression. People calling hospitals often cannot obtain information about the condition or even the location of their relatives. Police officers and firefighters are wary of notifying relatives after a road crash. Medical records departments have repeatedly refused to release vital patient information to inquiring doctors. And several doctors have been reluctant to release the results of tests on the phone and have insisted that patients come to the office to get them. In the clinic, patients have waited interminably or were never seen because the clerks were told not to make up a list of scheduled appointments. Chaplains and ministers have given up visiting patients in hospital because they often cannot find where they are.

    This has also had an impact on research. Even simple studies, such as examining specimens collected for routine urinalysis, would require either signed consent forms from 1500 patients, or not using the clinical data at all and thus making the project useless. Data collection for disease registries has run into difficulties, and there has also been an impact on fundraising for charitable organisations.

    None of this was intended in the original legislation. But things do not always turn out as planned.

    View Abstract