Hostile HIPAA

Adding to my new experiences as a patient, I have now run into heretofore unforeseen side of the HIPAA monster. As a patient, it should be protecting me, right? Of course not! Legislated in part to protect privacy, HIPAA is one of the most misunderstood and abused laws by healthcare personnel, particularly clerical staff at the front lines of the patient-physician records interface who may not have much of a healthcare (or all that much educational) background to boot. 

In my case, I called wanting a report from a minor surgery a few weeks after I had it done. I had already called the surgeon’s office and they said that while they did have a copy via their electronic medical record (EMR), the actual operative report was the hospital’s property and they couldn’t give me a copy; they just had viewing privileges, I was told. In the past, I’ve received every copy of everything I’ve ever wanted. This “ownership” business was nonsense–after all, this was my surgeon and the paper copy was in my chart. As long as I was there and asked for it, a simple copy had always been made for me to walk out with said report in hand. To be clear, I’m talking about post-HIPAA, not some wistful recollection of the way things were back in the “good old days.” Said surgeon recently moved into a brand spanking new office, has a ton of new staff, and I just thought that this was just a miscommunication–escalating to a supervisor or the like should resolve the problem.

Obviously it didn’t, but the fun was just about to begin. My instructions–reasonable, I might add–were to contact the hospital’s medical records department since they “owned” the information, and they could help me further. It was speaking to the medical records (“MR” below, because I like the double-entendre) office that thing became unglued. Below is a faithful transcript of our conversation, edited only for general length and idle banter:

Me: [explain my needs] So what procedure do you have for me to get a copy of the report?
MR: You need to come by–in person only with a picture ID–fill out some paperwork and pay a processing fee that starts at $42.50 for first 10 pages.
Me: $42-what?! The report is just one page, I think–maybe 2 at most. I mean, it’s on the screen–just hit ‘Print’
Me: Doesn’t matter if it’s 1 page or 10; it’s the same price.
MR: But wait, my family doctor’s been FAXed records from here–did you charge his office too?
MR: No, we don’t charge physicians because the request is for continuation of care. If we give a copy to you it’s not for continuation of care, it’s for your personal use.
Me: But the same work is being done, you just aren’t charging the doctor but are charging the patient? So it’s not a cost recovery, you’re penalizing the patient.

MR: We give it to the doctor electronically [not true, only applies to affiliated doctors in same med center]. We charge you or an insurance company because we have to physically process the record [what, press "Print" from the screen interface?!?] If it the report is for a doctor, they can access it electronically.
Me: But the doctor is in [my home city, 35 miles away], he’s always gotten records by fax.
MR: Well, we just went live with our new system in October.
Me: But if your system wasn’t live, you’re still saying you would charge me and not him.
MR: That’s correct, but slightly less than $42.50.

Me: OK, but I’m saying my doctor I know has no login credentials to your hospital, no privileges, nothing. So how can he get a copy?
MR: I’m guessing he’ll have to apply for access, but–well–I don’t know–I’m not the one that handles that, but in the meantime if he can’t get to it online, someone will have to pull the records, process it [again, this is just a quick computer search that takes 5-10 seconds], and send him the records–
Me: –which is my point: you’ll have to send him the records manually, but you aren’t going to charge him for the same work you’re going to charge me–
MR:  –That’s right! [Proudly, as though she's won an argument b/c I'm agreeing, which was most disturbing]
Me:  –someone is going to have to physically process this–
MR: Yes sir! [again, defiantly]
Me:   –and send it to my physician without charging him.
MR: Yes, because it’s for continuation of care [emphasis theirs, spoken slowly] and that’s something very different.
Me: [previously explained about my having been in Mexico, do have a "continuation of care" issue for my own recordkeeping] I already told you, I need the records for a physician in Mexico.
MR: If you can provide us with the name and address, we can release the records to him and mail them.
Me: To Mexico?!?!
MR: Yes sir, we can mail them.

Me: You have no idea what mail is like in Mexico; it will take a month at least if at all. I doubt you’ll pay the $30 for FedEx for that one page. Besides, are you sure all these fees are consistent with HIPAA and state regulations concerning access, etc?
MR: Yes sir, I can even provide you with a fee schedule.
Me: Can you fax that to me?
MR: Of course, let me get your fax number.

And with that deliciously ironic ending, the “labor” and “pulling records” was equal to the fax of that one page which they were all too willing to perform for free so their fees could be proudly shared. The 10 minute phone converation could have pulled at least 5 records and faxed as many copies. This is robbery, plain and simple.

HIPAA was crafted for portability (change in jobs, location, etc. doesn’t make one “start over” in terms of coverage) and security/privacy above all. It is, in spirit, supposed to be protective of the insured at the unfortunate and unfunded responsibiity of the healthcare provider caught in between trying to both comply and do right by the patient. I sympathize with this, but to selectively push costs back on the patient and not a physician–or more to the point, another business entity capable of absorbing said costs as the price of doing business–is predatory and in stark contrast to the spirit of the law. Moreover, HIPAA left way too much open to vague enforcement with language like “reasonable fee.”  It’s no wonder that individual state agencies and other entities are pushing the envelope with what’s “allowable” at the patient’s (ie, the person most exploitable and vulnerable) expense.

In the end, I got my report–not by paying $42.50 to the hospital, but at my next surgeon’s visit, I simply asked him if I could get a copy.  Without hesitation, he said “Sure!” and directed his nurse to go up front and make a copy for me on my way out.  Done. Piece of cake. HIPAA be damned.

Medical Blogs: Social Contract?

In the October 2008 issue of the American College of Emergency Physicians’ (ACEP) Journal, an op-ed was posted entitled “Medical Blogs: Communication Vehicle or Social Contract?” (if the link takes you to a sign-up page, close the window and click it again–there’s a strange cookie that’s set that will bypass the registration screen) As I read it, the first thing that struck me was the comically dated language and information. The death knell of this article’s significance was already ringing in the first paragraph (all emphases below are mine):

According to the Internet phenomenon Wikipedia, blogs (short for Web-logs) are Web sites, usually maintained by an individual, with regular entries of commentaries, descriptions of events, or other materials such as graphics and video. They can serve as online interactive diaries where bloggers pour out ideas, feelings, and opinions, and invite readers to respond with comments of their own that are often equally fascinating and spontaneous.

Technorati, a blog searching service, reports there were 112 million blogs in 2007.

Wikipedia is relegated to a “phenomenon?!” Someone needs to tell these folks at ACEP that they don’t need to qualify what a blog is with enumerated reference; it’s not 2005, and wasting a paragraph on the obvious made me want to stop reading altogether.

Moving on, any person in the blogosphere worth their salt knows the once mighty Technorati has long since lost almost all of its relevance. Nobody uses it for anything useful, its continued existence being somewhat of an anachronism. However, the ACEP authors cite 2007 data from it in July of 2008!!(as referenced in the footnote) WTF?! They aren’t even trying to appear as though they care at this point.

The painfully protracted exposition continues:

[Other blogs] serve largely as public journals, providing authors’ insights and anecdotes without the peer review or editorial vetting that occurs in more traditional journal venues. However, the personal nature of many blogs lends them an intimacy and an immediacy that is often missing from mainstream outlets. Arthur Caplan, a prominent ethicist, compared blogs to an extended form of chatter and conversation.

I noticed here already a condescending tone that would get more and more pervasive throughout the article, that the notion of a peer-reviewed journal is the pinnacle of scholarship and a blog being gossip and nonsense. Wrong and wrong–it’s a comparison of apples and oranges. No one would argue that “big” journals get their gravitas from their editorial boards, but even peer reviewed journals suffer from bias, politics, and other non-scientific factors, and published studies often come under fire after publication for being extensions of corporate/non-scholarly interests. On the flip side, many blogs can honestly stand against some of the giants of the print world in terms of their solid content–far from idle prattle–the “peer review” being the entire world of reading scholars, all free to leave commentary, positive or negative, in an open forum.

It is this point in particular where the “good old boy” stripe of physician is most chafed. There’s a strong sense of “you kids get off my lawn!” as a new medium threatens to tear away the fabric of order and control as seen through the eyes of these authors. The very notion that a patient or layperson has a potential standing of equivalence to published physicians is the fundamental reason behind why this article is being published in 2008 without embarrassment: the ACEP still doesn’t “get it.”

Most of the above is petty quibbling compared to what I’m going to quote here, though:

Dr. Rita Charon, a physician and a leading authority in narrative medicine [whatever the hell that means], believes patients own their stories, and she takes the strong position that physician-writers must have patients approve narratives written about them before publication. Two other writers and experts in literature and medicine – Dr. Jack Coulehan, internist and poet, and Ann Hawkins, Ph.D. – invoke the argument of relational ethics. What will happen if particular patients discover that they were featured in an article, story, or blog? Will they find such attention beneficial, perhaps therapeutic? Or will embarrassment or betrayal boil their blood?

“Patients own their own stories?” Well, yes, in a fundamental ethical way, no one would argue that it would be wrong to publicly share that which is private between doctor and patient. In today’s world, HIPAA guarantees*cough* that their information is kept confidential, and every medical blogger I know goes well out of their way to mask any indentifying features of a story so that any semblance to the original would either be complete coincidence or not specific enough to be unique (“a woman came to the ER last night” would apply to potentially half the emergency patient population, for example, even if it were found to be true). However, the authors aren’t even bringing up confidentiality or legal concerns; they are ridiculously invoking the idea that in a doctor-patient encounter, the patient is the “owner” of the encounter’s narrative.

RUBBISH!

There isn’t ONE story, but TWO stories, at least: one from the point of view of the patient, and one from the POV of the physician. The ACEP doesn’t seem to be concerned with nurses, techs, etc. but the reality is that everyone in, say, a trauma bay (this is the ACEP after all, and ER environments are hardly ever private one-on-one encounters), could feasibly walk away from that encounter and have something to write about and each would be unique representing a distinct POV. You can’t equate or assign ultimate ownership of the experience of any one person, the different jobs being performed, etc. It is the height of arrogance to say that any one person actually “owns” the unique narrative of another. It’s sickening, in fact.

You have to hand it to bioethicists, though. I love that they exist, and like the ACLU, you’re happy they’re there for the “big stuff” that require their unique talents, but like this they’re often involved in issues more for the intellectuo-ethical masturbation debate than for yielding something tangibly better for the patient.

There’s a lot more as the article continues about what kind of “tone” the physician-blogger should strive for, and other paternalistic drivel from authors who have already demonstrated their incompetence on the subject matter. It’s insulting enough as a physician reading this to be told they “should aspire to a voice that is respectful and professional,” much less by these authors who can’t even utilize the very tools they are professing to teach.

Ultimately, however, the relevant question is raised, “What kind of ethical code should be used to protect patients’ confidentiality?” Had this not been the article of two online amateurs, the last section could have served as a wonderful teaching tool. Instead, it turned into yet another demonstration of hubris demonstrating, “Look how I’ve offered a solution to this problem!”

The solution for a “code of ethics” had already been actively addressed, voluntarily, in the medical blogging world, without the need of paternalistic mandates from out-of-touch organization chairpersons. The Heathcare Blogger Code of Ethics (HBCE, also knowns as “Medblogger Code”) was created by communal referendum with each blog’s participation vetted beforehand. Nowhere in the HBCE will you find paternalistic directives like “Wait one week before posting [clinical encounter] material to your blog.” We (and I say ‘we’ because I’m an active member in this community) assume that bloggers who care enough to announce due diligence with the HBCE badge don’t need to be micromanaged about their own posting habits, timing, or frankly judgment on any subject.

In fairness, I’d love to see what these two ACEP bioethicists would make of the HBCE and even the sibling patient-focused community, the Patient Blogger Code of Ethics (on the same site above). Perhaps that can be the subject of a future article, once the authors get this whole “blogging” thing down.