I'm Mary Ann Kobasek McGee, Executive Editor at Information Security Media Group. Today, I'm speaking with Patient Privacy Advocate, Twyla Bres, a registered nurse and President of Citizens' Council for Health Freedom. Twyla will be discussing some of the biggest concerns that she has about the privacy and security of patient information, especially in light of collaborations between various large healthcare organizations and major cloud services providers such as Google, Amazon, and Microsoft that involve the use of analytics of patient data in the stated quest to improve healthcare and patient outcomes. So Twyla, when it comes to the revelations in recent months that healthcare entities such as Ascension Health, Mayo Clinic, CERNIR, which is a provider of Health IT, and some other healthcare-related entities have signed deals with cloud service providers such as Google, Amazon, and Microsoft for collaborations involving the analysis of patient data.
What are you most concerned about from a security and privacy standpoint? Well, I would say that our greatest concern is that these entities are planning to data mine this private, individually identifiable data for their own purposes. I'm concerned that no consent is required under HIPAA, and I think that for the public, their awareness of how HIPAA does not protect them can be heightened or maybe unveiled for the first time with the news that Google and Ascension Health are sharing these medical records of more than 50 million people in 21 states. And from my perspective, I understand that all of this sharing is legal under HIPAA, but the American public doesn't understand that and they believe their information is private and that's not the case, as has been shown with the fact that both Google and Ascension Health say that they are filing the law, and indeed they are.
They are filing HIPAA, which is a data sharing law, not a privacy law. So now, Twyla, your organization recently sent a letter to the Department of Health and Human Services Office for Civil Rights requesting that the agency assess making changes to the HIPAA privacy rule. What sorts of changes are you seeking and why? Well, HIPAA, by itself, the law from 1996, does not actually require the US Department of Health and Human Services to get rid of privacy and consent requirements.
It's not required. Twyla was a decision back in 1998, 1999, and 2000 when they were writing the final rule, and the Secretary of HHS said that although we have all had an age-old right to privacy that things were going to change under this rule and that data would be available for publicly useful purposes, and thus, it is the Department itself that made the decision to get rid of consent requirements over the use of patient data. That means that the US Department of Health and Human Services could unilaterally change the rule to bring back patient privacy and consent rights and give patients control over their most personal data so that other people can't use it for their own purposes and share it willy-nilly around the country and even around the world. So when it comes to patient consent requirements, what sorts of changes would you like to see involving the release and sharing of patient health data, what sorts of consent would you like to see required?
Well, first of all, we would just like written, informed, voluntary patient consent, and the reason that I emphasize those three words is because some folks would say, okay, consent, but we'll just tell them if they say yes, we'll just mark it on the record and patients have no idea what they've just consented to, but if you have to write it down, you have to tell patients what it is that they're consenting to. And then voluntary, I say the word voluntary because today in states that require some consent for sharing, and that's very few states, but they often use what we call coercive consent forms where it says consent to treat, in other words, consent to be treated by the hospital, for instance, at the top and then at the bottom is a single signature line. But in the middle is all of this consent to data sharing, and for most patients, either they don't believe that they can cross those things out or they think crossing them out would mean that their doctor and the staff would get angry with them and they are in need of care, and so they don't want to rile anybody up. So patients are vulnerable, and lots of them just sign on the dotted line giving away all their rights to say no to the various uses of data that are listed in between the consent for treatment and the signature.
So Twiloh, what about the use of patients' de-identified health data by third parties for research, data analysis, and other work related to, quote, improving health care and medical discovery? What are your main privacy and security concerns around that, and why? The concerns with the use of de-identified data is there's really no such thing as unidentifiable data. Once you have stripped off several different items, that does not mean that it cannot be matched up with another database or another two databases, and the full identity of the patient becomes available.
And so that's one thing just the fact that de-identified shouldn't cause anybody to feel comfortable about privacy because it does not protect privacy, de-identification does not protect privacy. But the other thing is there's all sorts of things, analysis, predictive analytics, research that are for things or will do things that the patients would actually oppose. For instance, using the patient's data to control the physician, to track the physician, to penalize the physician financially, to limit the ability of the physician to give the care that he thinks is necessary for this patient. The use of data to standardize practice for very unique individualized patients who are unique and individualized in so many ways.
That is one of the great dangers that we are experiencing today in the use of data without the patient's consent. Now, Twilight, there's also proposals by federal regulators for the healthcare sector to enhance the ability of patients accessing and sharing their health data using application programming interfaces. These personal health record apps or platforms are not necessarily covered under HIPAA, and it's not clear how much regulatory authority the Federal Trade Commission would have over these apps. So, what are your concerns about the use of APIs to facilitate the access and sharing of patients' health data?
One of the biggest concerns right now is just how this is being talked about in the news, as though if we put apps in APIs under HIPAA that that would solve a privacy problem. But HIPAA itself is a data sharing rule, and according to the federal government, 2.2 million entities could have access to the data if it's given to them by the doctors or hospitals or health plans, the laboratories, the data clearinghouses, all of those folks. And so, all without the patient's consent, so putting apps, et cetera, under HIPAA does nothing for privacy except continue to deceive the American public that they have privacy because of HIPAA. So, I think that we need to go the right direction back to patient consent for regular sharing that's happening right now, and we should go to consent for apps and APIs, and there should be, as I said, written and informed voluntary consent, and it should not be so fine-lined and small in font that nobody will read it.
But at the end of the day, it is up to the American people to decide where and how they want to share their information, and if they want to share it using apps, you know, they should be able to do so. The problem right now, again, is that they all think that they're protected by HIPAA when they're, nothing of the sort is happening today. They're all very unprotected by HIPAA. Twila, what else is on the top of your list of privacy and security concerns involving health information in 2020, and why?
Well, one of the concerns is the proposed interoperability rule that is getting a lot of attention now in the White House and at HHS, and this is about those apps. I think what's essentially happening here is a food fight between big tech and big health, and if I were to look into the future, I think that big tech, Google, Amazon, Microsoft, foresee a time when they will have a national medical record system of all the American people, and they will create an electronic health record that will be in doctor's offices, and they will use Alexa-like virtual assistants that take the entire conversation of the patient of the doctor from the privacy of the exam room to the shareability of the server. And I think that that is not being looked at seriously enough in the discussions taking place. And as a matter of fact, I don't think that the patients are even really part of it.
I mean, they can mention privacy all they want, but I don't think anybody is looking to protect the privacy of the patient. It's just a matter of who's going to get access to all of the data to use for their purposes to drive this new market of patient data forward in whatever way big tech or big health wanted to happen. And Twila, if that were to happen, what sorts of threats do you think there would be towards privacy and security in terms of cyber attacks or breaches by insiders, or what sorts of potential threats are there that this might pose? Well, the same threats that are today, it's just that they would also be in big tech.
And so big tech, big government and big health, all having all of our data and being able to use it all the way that they want to and becoming targets for hackers. Now, there are people who have a real, real need for privacy and all sorts of people who may not be in their camp on a political sensor and may not have their best interest in mind, are going to have access to all of that data. And my concern is that what we're building here, if you put together everything on the apps, everything in Facebook and Twitter and Apple watches and Fitbits with everything in the electronic health record, what we're building here is Dossier, is complete Dossier is of the American public at a time when they are vulnerable and cannot keep from saying what they need to say in order to get the treatment that they need to have. And so we're coming to a time where I believe people who have a real need for privacy and know they have a real need for privacy, they will try to find places that aren't on the grid.
And we should not have to be in this country in that situation where the patients don't own their private lives, they don't own their private data, everybody else owns it for their own purposes because of HIPAA, because Congress hasn't protected them, because HHS and other proponents see the value of data and want to control the doctors. So I think this is a scary time for patients except that they don't know that they should be scared because they're still thinking HIPAA protects them, they have no idea what's really being built here. Thanks, Twyla. I've been speaking to Twyla Bres of CCHF.
I'm Mary Ann Kobasek-Bighi of Information Security Media Group. Thanks for listening.