http://www.bazelon.org/LinkClick.aspx?f ... &tabid=320 Testimony Presented to
National Committee on Vital and Health Statistics
Concerning Privacy of Mental Health Information
By
Chris Koyanagi, Policy Director
Bazelon Center for Mental Health Law
Washington, D.C.
June 15, 2010
Good morning,
My name is Chris Koyanagi and I am currently the Policy Director at the Bazelon Center for Mental Health Law in Washington, D.C. The Bazelon Center is a legal advocacy organization dedicated to protecting and advancing the rights of adults and children who have mental disabilities. The Center envisions an America where people who have mental illnesses or developmental or intellectual disabilities exercise their own life choices and have access to the resources that enable them to participate fully in their communities.
I am very pleased to be invited here to today to share the Bazelon Center’s views on how electronic health records can protect patient privacy. The Committee is to be commended for all of its work to date concerning health information technology policy as well as for its willingness to consider a range of views on these issues.
*******************************************************************************************************************************************
1.)
Introduction :
Lack of communication among providers treating people with serious mental illnesses is a serious problem, especially given the high co-morbidity of other serious and chronic illnesses (diabetes, cardiovascular disease and cancer). However, in light of the stigma and discriminatory practices still attached to mental illnesses, fully open sharing of mental health information may not be the way to optimize communication or appropriate treatment of mental disorders. In fact, it may simply raise a consumer’s fear of disclosure and lead to withholding of information or failure to seek treatment.
Control of personal health care information, and particularly information relating to potentially sensitive areas like mental health, HIV/AIDS status or genetic information, should belong to the health care consumer. Consumers may have individual views of what information is particularly sensitive, and an array of personal beliefs and experiences inform these views. We are therefore extremely concerned that consumers have access and control over their own health records. This is entirely consistent with person-centered service planning, which is now taking hold in mental health and health care in general. We believe public policy should ensure that fear of a breach of their record’s privacy not deter consumers from seeking the treatment that they need and that consumers are able to make informed choices about how their personal information is shared to improve their health outcomes.
*******************************************************************************************************************************************
2.)
We also believe that the advent of electronic systems provides a golden opportunity to allow consumers to have specific control of aspects of their health records and, as a result, have the confidence to seek treatment. The exchange of health information through the use of electronic health information technology has great potential to improve health care, particularly for people who have co-morbid conditions that require coordination between several treating providers.
Consumer Concerns and Consequences
Consent is only meaningful if consumers are fully informed about what information is collected, under what circumstances it will be shared, why information sharing is beneficial and how their information can be protected. I would like to urge the committee to consider a more fine-grained approach rather than an all-or-nothing approach that simply sequesters all mental health information.
There is obviously an imperative for ensuring that electronic systems allow all treating providers to have access to the range of information they need to provide effective treatment. However, research shows that concern about discrimination resulting from disclosure affects whether individuals seek treatment for a mental health condition at all and whether they fully disclose information about themselves. These fears are not groundless. For example, some individuals who have disclosed their mental illnesses have lost jobs, had loans foreclosed and, importantly, found that health care providers dismiss their physical symptoms as manifestations of their mental illness.
Since studies have shown that people with serious mental illnesses are more likely than others to have serious health problems—diabetes and cardiovascular disease, for example—it is all the more important that consumers agree to share critical information, an outcome that should properly occur only when the consumer is able to make informed decisions about how their information is to be shared. These issues must be addressed through system reforms, including changes in provider practices and opportunities for consumer education. IT systems can assist in this process with pop-ups and similar devices.
For individuals who are inclined to withhold potentially significant information, the answer does not lie in a forced-disclosure policy, which is liable to drive some people away from seeking health care at all. The desired result—patient consent for information-sharing—is much more likely if providers clearly and effectively explain why it is important to share information and what safeguards are in place to protect unauthorized disclosures. Patient consent is also more likely when systems are capable of ensuring privacy by limiting access to an individual’s health information to those who truly need to know.
We recognize that even with a good process for obtaining informed consent, a small number of consumers (including those with mental illnesses and others) may remain adamant about withholding information. Unless an individual has been found incompetent for the purposes of making decisions about health care, the decision rightly remains with the individual, even if the provider does not believe this is in the person’s best interest. An individual’s unwillingness to share important information is properly an issue to be addressed clinically over time, and is not a
*******************************************************************************************************************************************
3.)
justification for undermining the consumer’s sense of personal control through enforced disclosure.
Information to be Shared
Consumers should be able to choose what information to share and with whom. They should not be led to believe that the only options for consent are to either share all or share nothing.
Under HIPAA privacy rules, information can be shared for purposes of health care operations (including billing, utilization review and other managed care techniques) and all information can be shared with treating providers, with the one exception of psychotherapy notes. Psychotherapists, nonetheless, must provide progress notes for an individual’s health record that includes information about symptoms, history, test results, diagnoses, medications and other treatment and services.
With electronic systems replacing paper systems, it becomes quite feasible to create additional privacy protections for sensitive information, such as mental health information. Electronic systems should be built so as to make it possible to limit disclosures of health information to third parties based on the individual’s expressed wishes for excluding or masking sensitive information. As a default, information could be categorized and access limited on a need-to-know basis. This will reassure consumers, who will (or can be helped to) appreciate the need for certain individuals or entities to receive certain types of information from their record.
For example, components of mental health records could be separated into a few, broad categories, such as information on medications and diagnosis, treatment and progress notes, names or types of providers who have been seen (or any other information that indicates that the person is receiving mental health care), and psychotherapy notes. Consumers could then be given some control on whether information in each category is shared, and with whom.
Electronic systems can quite readily be built to accommodate different levels of sharing for this limited number of categories of mental health information, and then automatically share that information with a certain group of individuals/entities once the consumer consents. Audiences for the information would include, among others, primary care providers, other treating providers, pharmacists, health plans/insurance companies and emergency personnel. For each category of information, consumers should be able to pick which audience should have access to particular information.
The pay-off for such an approach would be significant improvement in consumer confidence in the health care system. Although, in fact, nearly all consumers will readily consent to the sharing of information where the need is obvious (such as medication data being shared with other prescribers and pharmacists), they will feel, and be, in control. This is important for all health care consumers, but particularly for people with significant mental health problems
To make systems run more efficiently and to reduce costs, the system could be set up so that for situations where consent is required, the individual has only the option to opt out or assertively opt in, leaving the default in the system as consent has been given.
*******************************************************************************************************************************************
4.)
For example, information about diagnosis and medication could automatically be shared with other prescribers and pharmacists, or diagnosis and progress notes could be shared with health plans unless an individual chooses to specifically opt out. One area where the Bazelon Center would be open to sharing without consent is in emergency situations when there is an immediate danger to self or others. In this situation, there could be no opt-out option, although consumers should be informed what information is shared.
The general approach described above is quite reasonable. There are already some places where the sharing of certain health care information can be limited by the consumer:
? Consumers in New York are allowed through a consent directive to agree to a general release of information but also have the option to mask certain information that is only available through a specific release. This is how New York deals with HIV-related information. No confidential data are released under a “general release” but disclosure is permitted with a specific release.
? In Canada patients can mask data by content or providers. Individual provinces allow individuals to mask specific data elements in addition to categories of data. (I understand that in IT terms, this is considered allowing highly granular consent options.)
? In Australia, European countries and the UK, systems allow for segmenting a unified record.
I have not studied these systems and so cannot give you details, but clearly these concepts are being considered, and at least in part implemented, in some places. In preparation for this testimony, I also contacted some IT vendors who provide services to community mental health agencies. They assure me that electronic systems can feasibly help with this sort of fine-grained security setup. A system using similar concepts, but focused on homeless people, is already up and running and provides three layers of information that can either be shared or withheld from various audiences.
We would also want to see other privacy rules, particularly HIPAA and state laws on mental health privacy, honored through the electronic systems used in those states. (Almost all states have specific statutes related to some aspect of mental health privacy.)
Informed Consent
The Bazelon Center believes that consumers should be active participants in their care. We support self-direction, choice of provider, person-centered planning and advance planning for crisis care. We also believe that an all-or-nothing consent approach is meaningless and does not represent “informed” consent. We also believe that electronic systems should be constructed so as to facilitate periodic re-authorization by the consumer.
When HIT systems rely on consent, consumers need to appreciate the necessity of sharing certain information. Ensuring that consumers understand the need for and benefits of sharing information is the responsibility of the mental health provider who is creating the record. Software can help here as well, with pop-up menus for elements that require special consent. Mental health providers should, as part of therapy and treatment, educate and help consumers to
*******************************************************************************************************************************************
5.)
fully appreciate the value of sharing the most relevant information with other providers. The Bazelon Center promotes the use of psychiatric advance directives for individuals with serious mental illnesses and a discussion of information sharing and informed-consent would fit within the development of such directives. Even when consumers do not wish to have a formal directive, crisis planning by the consumer and provider is critical, which again can lead to informed consent regarding information to be shared.
The Bazelon Center also strongly believes that consumers with mental illnesses should be able to access all of their health and mental health information. Access to this information is not only fundamental to a person’s sense of autonomy, it is also critical to health care improvement efforts that focus on involving patients in their own care and in their learning to self-manage aspects of their health. Also, for consent to be fully informed, the consumer must have confidence that the information is accurate and complete and thus may want to know exactly what is being shared. Information technology makes it far easier to share health information with the consumer, and to do so promptly and without undue cost to the provider.
Although HIPAA assures such access for nearly all information, it does not grant consumers access to psychotherapy notes. This is not something that this Committee can resolve, but no electronic system should include psychotherapy notes if these are not to be shared. Such notes can (and according to psychotherapists generally are) kept separate.
It will also remain important for consumers to have the ability to challenge and correct their information, as is now authorized by HIPAA and for there to be very prompt notification if their health information privacy is breached.
Conclusion
Electronic Health Records offer consumers the means to control not only which treatment provider or entity has access to their personal health care information but also what information may explicitly be permitted or excluded under consent agreements. This individualized approach is in keeping with the values of self-determination and represents the most effective way to address an individual’s privacy concerns. Electronic systems have the potential to make it easier to share information while also keeping private information that the consumer wishes to protect from disclosure. While electronic records hold great potential for improving patient care and giving consumers more information about their own health and health care, consumer confidence in electronic systems in general is not high. Highly publicized leaks of electronic information systems make it all the more important to have the requisite safeguards in health record systems and to give consumers confidence that they have control of any sensitive information in their record. Sadly, the stigma and discrimination that exist around mental health means that mental health records (and information on other sensitive issues) cannot be treated exactly like other health care information.
