Home : Privacy & Technology : Medical Privacy

Medical information is arguably the most personal and private sources of data about us. Yet privacy protections in this area are far from adequate.

The relentless commercialization of information has also led to the breakdown of some longstanding traditions, such as doctor-patient confidentiality. Citizens share some of their most intimate and embarrassing secrets with their doctors on the oldfashioned assumption that their conversations are confidential. Yet those details are routinely shared with insurance companies, researchers, marketers, and employers.

Current Federal Legislation on E-Medical Records
On February 17, 2009, President Obama signed the American Recovery and Reinvestment Act of 2009 (ARRA), which encourages the adoption of electronic medical records by doctors and hospitals. But, in poll after poll Americans, both doctors and patients, worry that their personally identifiable medical data will not be protected.

Old medical records privacy laws (the Health Insurance Portability and Accountability Act, or HIPAA) failed miserably at protecting patient privacy. The new law includes significant new protections that should go a long way toward protecting the privacy of American patients. However, much will depend on the regulations that are enacted to implement the new law.

Here is the ACLU summary of the new medical records privacy provisions law.

> Coalition Letter to Congress Urging Privacy Protections with Health IT (1/14/2009)
> ACLU Press Release: ACLU Applauds Privacy Safeguards In Stimulus Package For Health IT (1/16/2009)
> ACLU Letter to House in Support of the Privacy Protections Included in the Health Information Technology for Economic and Clinical Health Act (1/21/2009)
> ACLU Press Release: Privacy Needed For Health IT Implementation (1/27/2009)

The ACLU's Views on Atlanta Man's Quarantine Case
The CDC invoked its authority under federal law last week to hold an unnamed Atlanta man in isolation in New York City and later an Atlanta hospital. The patient was reportedly contacted by CDC while traveling in Europe and informed that unrelated medical tests had indicated that he had a dangerous, drug-resistant form of tuberculosis.
> Statement of Barry Steinhardt
> FAQs on New Medical Privacy Laws
> Q&A on Emergency Health Powers

Privacy Needed For Health IT Implementation (01/27/2009)
WASHINGTON – Today, just an hour before the Senate Finance Committee meets to consider the economic stimulus package, the Senate Judiciary Committee holds a hearing titled “Health IT: Protecting Americans’ Privacy in the Digital Age.” Health IT systems were included in the House of Representatives version of the stimulus and are likely to be a part of the Senate version. The American Civil Liberties Union applauds the Judiciary Committee for bringing this crucial topic up for discussion and calls on the Senate to adopt the privacy protections included in the House version of the package.

ACLU Applauds Privacy Safeguards In Stimulus Package For Health IT (01/16/2009)
WASHINGTON – The American Civil Liberties Union was pleased to see privacy protections as a part of the funding being provided for health IT implementation in the economic stimulus package introduced in the House of Representatives this afternoon. Following the incoming administration’s call for a transition to electronic health records and IT systems, Congress has earmarked $20 billion of the overall package to be used for beginning this transfer and adoption. The ACLU has reservations that without sufficient protections against the abuse of individual medical records, notably prohibiting the sale of private medical records, implementation should not move forward.

ACLU Recommends Privacy Protections for Successful Health IT Implementation (01/15/2009)
WASHINGTON – As the Senate Committee on Health, Education, Labor and Pensions meets today for a hearing on implementing health IT systems, the American Civil Liberties Union cautions that failure to include privacy safeguards would keep the American public from adopting and participating in these systems. The full committee hearing, titled “Investing in Health IT: A Stimulus for a Healthier America,” seeks to examine the possibility that funds for implementing health IT systems be included in the economic stimulus package being proposed by the incoming administration and the new Congress.

Privacy is Key to Achieving Successful Health IT Integration (01/14/2009)
Today, the American Civil Liberties Union and other organizations belonging to the Coalition for Patient Privacy are holding a press conference calling on Congress to add much-needed privacy protections to any funding given to implement health IT systems in the proposed economic stimulus package.

ACLU Reacts to Extortion of Private Medical Records (11/07/2008)
WASHINGTON – In response to today’s news that the FBI is investigating an extortion letter threatening the release of millions of private medical records, the ACLU reiterates its demand for the protection of individual privacy for all electronic medical records. Express Scripts, a medical benefits management company, said it has been investigating the threat since October, when the extortion letter was received containing the names, dates of birth and social security numbers of approximately 75 clients. Express Scripts then notified the FBI, and has since ruled out the possibility of an internal breach.

Pandemic Preparedness: The Need for a Public Health — Not a Law Enforcement/National Security — Approach (01/14/2008)

Bigger Monster, Weaker Chains: The Growth of an American Surveillance Society (01/15/2003)

The Maryland Lesson: Conducting Effective HIV Surveillance with Unique Identifiers (12/04/1997)
Since June 1, 1994, the State of Maryland has utilized a Unique Identifier system to conduct HIV surveillance. As part of the ongoing public discussion about how to best expand HIV surveillance across the country to understand the changing epidemic, it is useful to evaluate Maryland's experience to determine whether Unique Identifiers form a viable surveillance option.

HIV Surveillance and Name Reporting: A Public Health Case for Protecting Civil Liberties (10/04/1997)
Recently, there have been renewed calls for HIV surveillance, and specifically for reporting the names of all those who test positive for HIV to public health authorities. Proponents of HIV surveillance and name reporting frequently suggest that there is a conflict between the privacy rights of individuals who have or may have HIV and the public health needs of the country, and that individual civil liberties must take a back seat in order to effectively battle the spread of HIV and AIDS.

ACLU Letter to the House Energy and Commerce Committee Commenting on Discussion Draft of Health Information Technology Legislation (06/13/2008)

ACLU Complaint in Folley v. United Surgical Partners, et al., (06/10/2005)

ACLU Brief in Weber v. Lockyer (12/08/2004)

ACLU Brief in Terri Schiavo Case (05/20/2004)

Florida Court Decision in Terri Schiavo Case (05/20/2004)

ACLU Letter to House in Support of the Privacy Protections Included in the Health Information Technology for Economic and Clinical Health Act (01/21/2009)
On behalf of the ACLU’s more than half a million members and activists, and 54 affiliates nationwide, we write in support of the privacy provisions included in the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. These privacy provisions must be enacted without passage of weakening amendments to realize President Obama’s vision of implementing a nationwide, interoperable electronic medical record system. Without the privacy provisions proposed in the HITECH Act, Americans will fear justifiably that their most private, personally identifiable information concerning their medical histories and conditions will be available to prying eyes.

Coalition Letter to Congress Urging Privacy Protections with Health IT (01/14/2009)

ACLU Comments on National Institutes of Health Data Sharing (11/30/2006)

The ACLU's Chris Calabrese's Testimony Before the NCVHS (02/18/2004)

ACLU Letter to the House Judiciary Committee Expressing Concerns about HR 3214, the Advancing Justice through DNA Technology Act of 2003 (10/08/2003)

ACLU Letter to FTC Re: Eli Lilly (07/05/2001)
Timothy MurisChairmanFederal Trade Commission600 Pennsylvania AvenueWashington DC 20580

The Medical Privacy Regulation's Impact on Women's Health (04/01/2001)
Ensuring Medical Privacy

Medical Privacy and Electronic Records (07/22/2008)
Legislation aimed at pushing doctors and reluctant health care providers toward a conversion from paper to electronic health records stored in searchable web-based databases is moving through Congress. A key House panel is voting tomorrow on its proposal.

FAQ On Access to Patient Information by Friends and Family (07/15/2003)
Frequently Asked Questions about Access to Patient Information by Family, Friends, and Others under the HIPAA Privacy Rule

FAQ on Government Access to Medical Records (05/30/2003)
Answers to Frequently Asked Questions about Government Access to Personal Medical Information (under the USA Patriot Act and the HIPAA regulations)

Model State Emergency Health Powers Act (01/01/2002)
Model State Emergency Health Powers Act