Privacy Protections Must Accompany New Models of Health Care
The bumpy rollout of healthcare.gov has been front-page news for the past several weeks, but the topic of health reform extends well beyond current efforts to get everyone insured. Efforts to transform health care so that it delivers greater value for patients at more rational costs are proceeding apace. For example, Walgreens is piloting a new model of care – called Well Experience – where the pharmacist’s work area is relocated from behind the counter out into public areas of the pharmacy. This enables the pharmacist to interact more regularly with members of the public – to answer questions and provide advice to patients.
New models of care that enable greater interaction with patients provide opportunities to improve care delivery at reduced costs. But new models cannot be deployed in a way that jeopardizes the privacy and confidentiality of a patient’s health information. Based on a HIPAA complaint filed with the Department of Health & Human Services’ (HHS) Office for Civil Rights by Change to Win, a coalition of labor unions, it seems that Walgreens has not taken sufficient care to protect patient privacy in this new model.
Pharmacists handle a lot of sensitive patient information, including processing electronic and paper prescriptions, calling physicians to confirm prescriptions, calling health plans to check on insurance coverage, and counseling patients, both face-to-face and on the phone. In traditional pharmacy models, the pharmacist is behind a counter, creating a natural barrier between the public and much of the sensitive patient information pharmacists handle. Moving the pharmacist out from behind the counter eliminates this barrier and creates additional challenges to protecting confidential patient information that is an inherent part of pharmacy care.
It appears from the complaint that Walgreens has not adequately addressed these additional challenges. Change to Win based its complaint on observing the implementation of the new Well Experience Model over June, July and August of 2013 in 50 pharmacies in Illinois, Indiana and Florida. Among the privacy concerns they observed were the following:
- Doctor’s prescriptions and prescription drug leaflets with patient name and drug information left unsecured and unattended at pharmacist work stations;
- Completed health test authorization forms, including patient medical history or test results, left unsecured and unattended;
- Medication therapy management call lists, showing multiple patient names, phone numbers, and prescribed drugs, left unsecure and unattended;
- Computer screens with patient information clearly visible left unattended; and
- Conversations with patients overheard, initiated by the pharmacist by telephone (so the patient may not have known the pharmacist was not behind the counter).
As noted in the Change to Win complaint, these privacy concerns are not “incidental disclosures” but foreseeable consequences of moving pharmacists from behind the counter to an area where their work is “open, visible, and audible to the public.”
This information prompted Senator Edward Markey (D-MA) to send a letter to Walgreen’s asking them to respond to questions regarding the Well Experience model and its privacy and security safeguards, and we hope their response will be shared with the public.
As health care continues to evolve, new models of care may introduce new privacy risks, and health care entities must address these risks. They must address them with respect to the adoption of new policies and safeguards, as well as assuring these policies and safeguards are implemented to ensure new models don’t impose new risks to patient privacy and confidentiality.