GENETIC INFORMATION IN ELECTRONIC HEALTH RECORDS AND NETWORKS Mark A. Rothstein, J.D. Herbert F. Boehl Chair of Law and Medicine Director, Institute of Bioethics, Health Policy and Law University of Louisville School of Medicine © 2009

FOCUS OF THIS TALK I.Changes in the quantity and quality of genetic information in health records. II.Characteristics of the emerging Nationwide Health Information Network. III.Uses and disclosures of health information beyond health care settings.

I.GENETIC INFORMATION TRADITIONALLY CONTAINED IN PAPER HEALTH RECORDS Family health history (3 generations if possible) Medical geneticMendelian disorders in informationaffected families (e.g., test results, counseling records, diagnostic, treatment)

GENETIC INFORMATION INCREASINGLY FOUND IN ELECTRONIC HEALTH RECORDS Complex disorders E.g., cancer, heart disease Genomic information genetic tests GWAS Pharmacogenomics Drug selection and dosing Toxicogenomics Risk assessment and medical monitoring

VALUE OF ELECTRONIC HEALTH RECORDS TO CLINICAL GENETICS 1.There are only about 1,500 active board-certified clinical geneticists and 2,000 board- certified genetic counselors. 2.Most primary care physicians lack the training or expertise in genetics.

3.EHRs can help standardize and organize pedigree and other data collection. 4.EHRs can provide essential clinical decision support.

II.NATIONWIDE HEALTH INFORMATION NETWORK Network of networks Interoperable Longitudinal Comprehensive

ADVANTAGES OF THE NHIN 1.Enhance coordination of care 2.Avoid duplication of services 3.Improve effectiveness of care 4.Improve efficiency of care 5.Facilitate outcomes and other research

DISADVANTAGE OF THE NHIN (FOR PRIVACY) It eliminates the chaos of disaggregated, unconnected, fragmented, and largely paper-based health records.

KEY PRIVACY ISSUES TO BE RESOLVED Should patients be allowed to control access to their records? Should patients be allowed to control the content of their records?

No: It will make record management more difficult and it will undermine the integrity and completeness of the records.

Yes: 1. Unless individuals can control the content of their records, they will opt-out of the NHIN. 2.Much sensitive health information is not needed for current health care needs. 3.If patients fear a loss of privacy, they might refuse to seek care for these conditions, thereby endangering themselves and possibly the public.

Should any special protections be put in place for certain classes of sensitive medical information, such as mental health, substance abuse, STDs, genetic test results, etc.?

NCVHS (Feb. 2008): “The design of the NHIN should permit patients to elect to sequester sensitive health information in one or more predefined categories.”

Some examples of categories for consideration: Domestic violence information Genetic information Mental health information Reproductive health information Substance abuse information

AMERICAN RECOVERY AND REVINVESTMENT ACT (2009) (i)Technologies that protect the privacy of health information and promote security in a qualified electronic health record, including for the segmentation... Title XIII. Health Information Technology for Economic and Clinical Health Act (HITECH Act) Section – HIT Policy Committee – Areas for Consideration

... and protection from disclosure of specific and sensitive individually identifiable health information with the goal of minimizing the reluctance of patients to seek care (or disclose information about a condition) because of privacy concerns, in accordance with applicable law, and for the use and disclosure of limited data sets of such information.” ARRA § 3002(b)(2)(i).

OTHER QUESTIONS TO RESOLVE RELATED TO SEQUESTERED HEALTH INFORMATION CLINICAL DECISION SUPPORT (Should it scan sequestered information?) EMERGENCY ACCESS (How would a “break the glass” feature work?) NOTATIONS TO PHYSICIANS (Should they identify the category?)

HIPAA PRIVACY RULE 1.Only designed to protect health information in the payment chain. 2.No federal enforcement or private remedies. 3.Without comprehensive health privacy legislation, the NHIN will diminish current (indirect) privacy protections.

SOME NON-COVERED HEALTH-CARE PROVIDERS Athletic trainers Blood banks “Concierge” physicians Cosmetic medicine Employer health clinics Health and fitness clubs Home testing laboratories Nutritional counselors Reproductive health services Urgent care facilities

III.DISCLOSURES BEYOND HEALTH CARE SETTINGS

Each year in the U.S. there are about 25 million authorizations for the compelled disclosure of health records in various contexts, such as the following: Employment entrance examinations (10.2 M) Individual life insurance applications (6.8 M) Individual health insurance applications Individual long-term care insurance applications Individual disability insurance applications

Individual and group disability insurance claims Automobile insurance personal injury claims Social Security Disability Insurance applications Workers’ compensation claims Veterans’ disability claims Personal injury lawsuits

For the vast majority of these authorizations, there are no limits placed on the scope of the information disclosed. Even where there are limits, in a paper-based health records system there is no practical way to limit the scope of the disclosure. So, custodians of the records send everything.

Today, “everything” means all the records from a single provider or entity. With the NHIN, tomorrow’s “everything” means everything from everybody.

Contextual access criteria technology could limit the scope of these compelled disclosures. NCVHS recommended in 2006 that HHS begin development of these tools. So far, there has been no progress.

CONCLUSION The combination of more genetic information with EHRs and EHR networks presents a great challenge for health privacy.