Your Great Granddaddy Had Syphilis And Now Everyone Knows It
The Department of Health and Human Services (HHS) wants to remove health information privacy protections from people who have been dead for 50 years. HHS issued a proposed rule to update health privacy regulations, and most of their modifications were quite positive from a privacy perspective. However, this idea is as weird and terrible as the logo for the scrapped Total Information Awareness Office.
Currently, the law requires that the health information of the dead be protected in the same manner as that of the living. Generally speaking, health care organizations can use patient data for treatment, payment and operations purposes without the consent of the patient, but must get the consent of the patient for most other purposes, like marketing or research. When the patient is deceased, health care companies must seek consent from the dead person’s personal representative, like the executor of the estate.
In the proposed rule, HHS states that the plan stems from the difficulty of locating personal representatives to obtain authorizations to use the health data of the deceased. Specifically, HHS refers to the frustrations of historians, biographers and archivists. (At last, the true might of the archivists’ lobby is revealed to us all.) HHS reasons that waiting until 50 years after death would protect the privacy of the deceased and their relatives.
CDT disagrees. We believe this proposed modification would be significantly more detrimental to patient privacy than it may seem. There are just too many unknowns to make this modification for the sake of posterity.
A significant number of patients presently withhold information about their health from doctors to keep insurance companies and employers from using the information against them. This is a big problem for the health care system, since good health care relies on accurate information about patients. According to HHS, the health care system depends on patient trust in the privacy of health data – especially as we transition to greater use of electronic health records.
So it's risky to assume that patients will be comfortable knowing information about embarrassing conditions, which may affect their legacies and sense of dignity, will be made available for unforeseeable purposes after death – when they cannot defend themselves. Releasing the health data of the dead could also affect the privacy of the living. Exposing a family history of certain disorders could jeopardize a person's job prospects or insurability, even a couple generations removed – especially as science gets better at predicting an individual's health based on family history.
The modification would likely change the data retention practices of health care companies. Today companies can delete a person's health data at some point, but the HHS proposal would likely inspire retention of that data until 50 years after death, or longer, in order to sell it (probably in bulk). And no one knows what the data security and privacy risks would be as a result of such extended retention periods.
Some – perhaps most – patients won’t care what happens to their health information when they’re dead. Many others will, however. It is not uncommon for modern estates to make plans for digital content, like social networking and email accounts. If people are concerned about what happens to their Facebook messages after they die, won’t they be even more concerned about their sensitive health records?
The unknown consequences and potential loss of trust in the privacy of the healthcare system outweigh the benefits of removing the privacy protection of health data 50 years after death. Achieving contact with decedents’ representatives may become increasingly easy to do in our interconnected digital world. Anyway, living patients are presently free to authorize disclosure of their health records after death. Health care providers and researchers should explore incentives to encourage patients to do so.
At very least, HHS should rigorously study the possible impact of the modification. In the meantime, CDT urges HHS to preserve the freedom of patients to choose whether to maintain their heath privacy after death.
Cover image by permission of Morgan Worth