Rebecca Del Carmen

I. Introduction

The notion of privacy in the healthcare profession is beginning to mutate, as are the physical forms in which medical information is stored and distributed. Industry emphasis on managerial concepts such as shared-information and digitization ¹ , and on methods such as telemedicine and preventative medicine, has forced the medical profession to reevaluate the benefits of privacy in light of its costs. ² As Samuel W. Warburton, chief medical officer of NYLCare Health Plans Inc., a large New York managed-care company, says: "Hippocrates is 2,000 years old. Medicine isn’t one-on-one anymore. It’s a team effort." If the protection of medical information is no longer governed by a pared down one-to-one rule between doctor and patient, the question then remains: who has what entitlements to medical records, and how should we monitor their enforcement?

The supposed privacy of medical records and its recent downfall has received a great deal of attention in both legal and medical literature. Many commentators concede that the traditional one-to-one privacy of an individual’s medical information is beyond our reach – and, in some cases, detrimental to the public’s health and welfare. ³ Not surprisingly, the movement to "go online" has generated much of this recent concern. ⁴ Digitizing information is a presumed threat to its own security, and medical information is no exception. For that reason, the software company Healtheon (the touted gatekeepers to the paperless revolution in healthcare) faced numerous setbacks in trying to make their product both guarantee the level of security expected of medical records and still be user-friendly. ⁵ In fact, the digitization of the healthcare industry has been relatively slow because of security and privacy concerns. ⁶

Ultimately, however, the debate surrounding a paperless revolution extended beyond the threat of unauthorized hacking and into the staggering numbers of authorized users that digitization helps to facilitate. ⁷ Starting with the traditional notion that a patient shares her medical information with her doctor and none other, how did the current system develop whereby "[t]here are thousands of people who consider patient data their business."? ⁸

The arguments in support of a modified level of privacy protection for medical records generally justify two categories of authorized use. The first is authorized use of medical information within a managed-care organization. Large healthcare institutions like Health-Maintenance Organizations (HMOs) now share a patient’s medical information with a large "inner circle" of providers. Putting aside the mining of data to protect an organization’s bottom line, an HMO’s primary purpose is still to provide quality healthcare to its consumers; toward this goal, the sharing of information has become a valuable tool for preventative and disease management. ⁹ Health-care providers now spend around $ 2 billion a year on information networks that support approaches like disease management. These networks consist of computerized programs that, inter alia, help prod sick people into getting particular kinds of treatment. ¹⁰ For example:

Pharmaceutical companies data mine as well --- to protect their bottom-line, to target new customers and to develop new products. ¹² However offensive one may find these uses of personal data, many argue that they are, for the most part, here to stay. "[I]nformation is the life's blood of the modern healthcare system . . . . The public should get reasonable assurances that when their personal information is collected, the health-care system will treat it with respect, store it securely, and disclose it only for important health purposes." ¹³

Second, the need to police fraud and to manage costs has justified the use of medical records between entities, such as between an employer and a pharmaceutical company. A recent Third Circuit decision ¹⁴ supported this expansion of the "inner circle." SEPTA, a stateagency, decided to offer drug benefits to its employees, and chose to self-insure. Because of this choice, SEPTA had a hefty incentive to limit its employees’ use of medications. Therefore, SEPTA’s Chief Administrative Officer (CAO) requested and received reports from Rite-Aid (their sole provider) with the names of individuals filing prescriptions for more than one hundred dollars a month and the specific drugs that these employees received. Somewhere down the line, the CAO learned that one of his employees, John Doe, was receiving AIDS medication. John Doe subsequently learned of the leak, and felt that his CO-workers were treating him differently because of this information. A jury agreed with Doe and awarded him $125,000 for invasion of privacy and emotional distress. ¹⁵

The Third Circuit reversed the ruling. The court noted that SEPTA had a strong interest "in containing its costs and expenses by permitting this sort of research by authorized personnel." In addition, the court concluded that SEPTA’s financial interest outweighed "the minimal intrusion" upon Doe’s privacy. ¹⁶ Two points are significant here. First, an employer seems to have a valid interest in an employee’s medical information if the employer’s financial interest is at stake. Second, the Court instructs us that disclosure of Doe’s status as an AIDS patient is minimally intrusive. Absent Congressional action to change the fact that video rental records are currently afforded more federal protection than are medical ones ¹⁷ , patients such as Doe seem to have lost the battle.

To restate, the court asserted that SEPTA had a strong interest "in containing its costs and expenses by permitting this sort of research by authorized personnel." ¹⁸ John Doe did not authorize these personnel to examine his prescription records. SEPTA did. This line of reasoning suggests that John Doe’s interests are immaterial to authorization; SEPTA’s authorization is sufficient. Medical records, therefore, are no longer the patient’s property once in the hands of a Rite-Aid, or by extension, an HMO? Or were the records ever the property of the patient in the first place?

This Article attempts to disentangle the current system of data-use in the healthcare industry and to provide a more predictable and workable framework for tracking property entitlements to medical records. First, I will argue that the patient has the strongest proprietary interest in, and indeed, ownership claim to, her medical records; therefore, an entitlement to medical records should be given to the patient, protected by a property rule. Second, I will argue for carved-out exceptions to the property rule in situations where the public interest is significant enough that the patient should (and has had) no single entitlement to the information. Third, putting this construct into practice, I will explore how the application of a "trusted system" to data management in healthcare could both enforce property protection of a patient’s data and "fair use" of the data by authorized users in the industry.

II. Protecting a patient’s entitlement to medical records by a property rule

The first choice that society must make when it faces conflicting interests --- an HMO’s desire to scan medical information versus a patient’s to protect her records from strangers’ eyes --- is who should receive the entitlement. ¹⁹ It is clear that society, and particularly state legislators, have chosen to afford the entitlement to the patient. ²⁰ Beyond that initial entitlement, however, the rules governing protection become somewhat murky. Guido Calabresi and A. Douglas Melamed define such second order decisions as "the manner in which entitlements are protected and . . . whether an individual is allowed to sell or trade the entitlement." ²¹ They go on to consider three types of protection: a property rule, a liability rule, and an inalienable entitlement. Before considering why a property rule is best suited to the protection of medical records, I will first discuss why a liability rule or inalienability are improper.

Liability rules permit non-voluntary transactions between the entitlement holder and the party seeking to infringe upon the entitlement. "Whenever someone may destroy the initial entitlement if he is willing to pay an objectively determined value for it, an entitlement is protected by a liability rule." ²² Therefore, whenever an insurance company or an employer is willing to pay a collectively-determined reasonable price for transcripts of an individual’s psychiatric sessions, or proof of his HIV status, a liability rule would enforce the transaction. This window of opportunity for non-voluntary transactions would seriously undermine popular expectations of privacy relating to medical information, as well as the Supreme Court’s notion of the right to privacy as the right to "control of information concerning an individual’s person." ²³

Another option to protect medical records would be to make the individual’s entitlement inalienable, so that "its transfer is not permitted between a willing buyer and a willing seller." ²⁴ Calabresi and Melamed identify two situations which lend themselves to inalienability: when a transaction would create significant externalities, and when "external costs do not lend themselves to collective measurement which is acceptably objective and nonarbitrary .", i.e. moralisms. ²⁵ One could argue that the commodification of medical records could lead to moralisms, for a society which creates a monetary incentive to sell off one’s medical information is a step away from a society which permits the sale of organs. With medical information, however, the inability to transact would create significant externalities. Obviously, a sick individual cannot receive due care if he cannot transact with his doctor to receive such care in exchange for money and access to his medical information. Another example would be a pharmaceutical company that depends on data from heart patients ages fifty-five to seventy to help develop a new anti-clotting medication. Inalienability of such data would inflict severe externality costs on society.

The only option left in Calabresi and Melamed’s framework is the protection of the individual’s entitlement by a property rule. "Much of what is generally called private property . . . is protected by a property rule. No one can take the entitlement to private property from the holder unless the holder sells it willingly and at the price at which he subjectively values the property." ²⁶ Therefore, protection by a property rule would allow the patient to control any dissemination of his personal medical information. ²⁷ Though I will assert that there are limited situations where a patient should not have such control, a patient’s entitlement is generally best protected by a property rule.

One rejoinder to property protection of medical records is that such privacy allows individuals to manipulate access to personal information and therefore the world around them, thereby increasing transaction costs between bargaining parties and creating harmful information asymmetries. ²⁸ First, this Posnerian argument relies on a notion of privacy as motivated solely by reputational interests. "To the extent that the privacy preference is in fact derivative of a reputational interest, it often can be characterized as the utility derived from deception. In such a case, the cost of restricting disclosure will likely outweigh the gain." ²⁹ However, critics of Posner such as Richard S. Murphy argue that the motivation to keep one’s personal information private may extend well beyond reputational interest:

Murphy calls these psychic values "pure privacy" preferences. ³¹ He proposes an informational privacy model that would permit disclosure if and only if "the value of the information when disclosed exceeds the value of the pure privacy preference of the individual; and permitting disclosure will not distort or eliminate the information in future transactions." ³²

As for the first prong of the test, the psychic motivations that justify protection of one’s medical information by a property rule could certainly classify as "pure privacy preferences." Most simply, the right to "control of information concerning an individual’s person" could stem from a belief that information concerning your person is yours --- not from a desire to deceive society into believing that you are someone other than who you are. Likewise, John Doe’s desire to keep his HIV status private while working at SEPTA may have stemmed from a desire to avoid future disturbances, such as the disturbance which ultimately forced him to go to court.

Another justification for protecting medical records with a property rule whereby the patient controls dissemination is the second prong of Murphy’s test: whether permitting disclosure will or will not distort or eliminate the information in future transactions. Transactions between patient and doctor/HMO work best if a patient has confidence in the confidentiality of her visit. Wide disclosure rules for medical records could distort patient behavior in an extremely inefficient manner. "Fearing loss of employment and social discrimination, people will either lie to their physicians or avoid seeking care . . . . These same fears will also harm job market efficiency by causing individuals to remain in current positions rather than risk unemployment or a lack of medical coverage in a new job." ³⁴ Most of us do not have a clear sense of where our medical data is going and who is mining it. ³⁵ I imagine that if more Americans knew that their medical information was zipping through research, pharmaceutical and managed-care networks, then patient behavior in confidential settings would change --- just as John Doe’s behavior toward pharmaceutical treatment of his HIV may have changed if he had known that SETPA was monitoring his purchases.

A property rule would thus best protect a patient’s strong proprietary interest in her medical records, as well as protect her pure privacy preferences. There are obstacles, however, to implementing a strict property rule for this entitlement. First, as stated before, many commentators argue convincingly that such strict protection in today’s wired industry is no longer possible or preferable. ³⁶ If all individuals or certain classes of individuals are unwilling to sell medical data to industry researchers, then pharmaceutical firms, for example, which use huge amounts of patient data in research, will face the possibility of skewed study results. There may be then certain circumstances where society will not benefit from a property rule that restricts transactions to instances where the entitlement holder is willing to sell and the interested party is willing to buy at the holder’s price. The next section will explore the arguments for fair use of medical data by certain players in the industry, and how to reconcile a property rule with such exceptions.

FOOTNOTES