In Electronic Health Information, Who Decides Which Info is "Sensitive"?

I participate in a committee that establishes policies for our state's health information exchange (HIE). The HIE is the electronic infrastructure that permits hospitals, physician groups, labs, imaging companies, pharmacies, and others to share information about patients. The idea behind the sharing is to make it easier for your primary care doctor to share your health data (ideally, with your permission) with your cardiologist and your dermatologist. The potential benefits to this sharing include:

• quicker exchange of information than with faxing or mailing
• less likely for papers to get misfiled or lost (eg, think Hurricane Katrina)
• better tracking of who accessed what information
• less duplication of tests ("I know you had a CAT scan at the other hospital last week but I can't wait for the results to be sent to me so I'm getting another one.")
• improved coordination of care
• fewer medical errors due to more information available
• decreased liability due to sharing of important information with other providers

The potential risks include:

• decreased privacy due to potential for data breach, identity theft
• loss of data due to technical problems (viruses, hardware failure, etc)
• failure to secure data due to inadequate authentication, authorization, encryption, etc
• more errors in health record due to automated data collection processes
• increased liability due to sharing of sensitive information with other providers

I wanted to talk briefly about this notion of "sensitive health information." Our committee has spent many hours discussing what this might mean and how to define it. One view is that all health information should be treated as "sensitive," while another is that only certain categories of health information, such as mental illness, substance abuse, HIV status, domestic violence, abortion history, and genetic data, should be treated with additional safeguards against inadvertent access or disclosure. This latter viewpoint promotes the stigma about mental illness that we have been trying to erase.  It wasn't so long ago that epilepsy and cancer might have been on this list. My viewpoint is that patients should be the one to decide which elements of their health information should be treated with extra precautions and which should be considered routine.

This was ultimately agreed upon by the other committee members, but it still didn't help us much because the technology for patients to review their health information and mark which bits should be tagged as sensitive is not yet built into nearly any of the electronic health record products or the HIE systems. There is no standard for doing so nor is there even any agreement about how or whether it should be done. Groups like healthdatarights.org and speakflower.org have promoted these ideals, but we are not much closer to achieving them.

Anyway, I discussed this topic in my Shrink Rap News blog post this week over on Clinical Psychiatry News. Read more about it over there. If you are a psychiatrist, log in or register on CPN and join the discussion (my mistake -- other professionals and also consumers are allowed to register over there).

Tell Me.... an Ethical Dilemma

Sam is young man is applying for a summer program, a real resume builder.  Among other things, the application asks if he has been treated for a psychiatric disorder.  In fact, he's seen a therapist and he's felt anxious at times.  His internist gave him some Lexapro samples and he feels better.  The symptoms of his problems have been limited to his own subjective distress.  His anxiety is not something that has disabled him, in fact he has not missed a day of school in 3 years -- and then for the flu-- he sees his therapist on the weekends, and no one would know he's been uncomfortable unless he told them.  He's never been in a hospital, he's ultra-reliable, and he has great grades and extracurriculars.  Any way you look at it, Sam is an energetic guy on the road to success.

What should he write on the form?  It's a yes/no check box, no questions or place to clarify, so if he says yes, well, that could mean he has some subjective anxiety, or it could mean he has attention deficit problems, or it could mean he has been hospitalized 6 times after becoming violent, or has a severe mental illness.  He's worried that his anxiety will throw him into a subset of applicants that the committee would rather not deal with: why choose someone for a project who has a mental illness if another equally qualified applicant is available without this issue to address?

Sam's mother say he should check "yes."  He has been in treatment and he has a diagnosis and he takes a medicine.  He has a psychiatric disorder and he needs to be honest. 

Sam's father says that the question defies the spirit of what the committee wants to know.  They want to know, Dad presumes,  if there will be issues or problems or things they might need to accommodate, and there is no reason to believe that Sam's problem will interfere with his ability to negotiate life in a competitive or stressful environment.  Sam, he contends, does not belong in the same category as someone who has attempted suicide, been hospitalized, missed work, or behaved in a disruptive or dysfunctional manner. If anything, Sam's anxiety drives him to focus and achieve and to be very conscientious.  He's not ill, his father says, he's just more anxious on a spectrum of normal anxiety.

I want to know why forms get to ask such questions and put people in the awkward situation of having to answer something that is none of anyone's business versus being dishonest.  It seems that if someone wants to know this, it might be asked in terms of "Do you have any health issues that might require any special accommodation?"  Is there a limit to what random forms can ask and whether you're behaving unethically if you choose not to answer their questions or answer it less then completely?  Sam tried leaving the question blank, but the computer wouldn't let him submit the form without checking all the boxes first.  Can they ask if you have deviant sexual fantasies?  If you've ever committed a crime (regardless of whether you've been charged or convicted)?  If you say provocative things on your blog?