by Jennifer S. Bard
For the symposium, I was asked to grapple with how health law teaching has been disrupted by technological innovation. On these occasions, my thoughts immediately go to the rapidly evolving expectations of privacy in the face of the ever growing breaches of cyber security in healthcare settings, the widespread access to communications technology, and the rapidly evolving technologies to establish identity and extract significant amounts of medical information from the genetic material left behind on a coffee cup. Jessica Davis, Malicious Code on Mission Health Store Website Undetected for 3 Years, Xtelligent Healthcare Media (Oct. 17, 2019), https://healthitsecurity.com/news/malicious-code-on-mission-health-store-website-undetected-for-3-years; Eriq Gardner, The Marvel Chairman, a Hate-Mail Feud and Claims of Stolen DNA, The Hollywood Reporter (Aug. 11, 2016), https://www.hollywoodreporter.com/thr-esq/isaac-perlmutter-story-marvel-chairmans-918237. Privacy laws of the past, including the original formulation of HIPAA, assumed that records were physical objects that could be kept secure behind locked doors. Today’s electronic records, which can be transmitted in the millions with no removal of a physical object, cannot be regulated in the same way. Even as HIPAA and other health information cyber security laws evolve, technology evolves faster, leaving us to face the larger questions of what we mean by a right to “privacy” for health information and what are realistic expectations of those who create and retain this information. Summary of the HIPAA Security Rule, U.S. Dep’t of Health and Human Serv., https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html (last visited Oct. 19, 2019); Elizabeth Snell, How the FTC Act, HIPPA Privacy Rule Impact Healthcare Orgs, Xtelligent Healthcare Media (Feb. 19, 2018), https://healthitsecurity.com/news/how-the-ftc-act-hipaa-privacy-rule-impact-healthcare-orgs.
Health law has always faced the challenge of evolving technology. But what is striking about the current disruptions is how fast they happened and how accessible they are. For example, scientists have been able to get some information from genetic material ever since DNA’s discovery. Today, the information extracted from a DNA sample is extensive and ever growing. Even more disruptive is the ability to change genes. The difference between 2001 and today is the difference between having the map and being able to change the map. The Earth’s Moon, https://www.google.com/search?q=national+geographic+map+of+the+moon&source=lnms&tbm=isch&sa=X&ved=0ahUKEwj1lP3SqM7iAhWSm- AKHXr7DyEQ_AUIESgC&biw=1024&bih=598#imgrc=yXLnss_3sPNQxM; Christopher Mahon, Our Coming DNA Nightmare, as Outlined by A Dystopian Graphic Novel, Fast Company (May 18, 2019), https://www.fastcompany.com/90349961/our-coming-dna-nightmare-as-outlined-by-a-dystopian-graphic-novel.
Much of the case law regarding genetic material is out of date or unhelpful. The leading common law tort case involves a doctor’s duty to warn his patient that his cancer could have been genetically transmitted to his children. Mark A Rothstein & Herbert F. Boehl, Health Care Provider Liability for Failure to Warn a Patient’s Genetically At-Risk Relatives, Univ. of Lousiville Inst. for Bioethics 2 (2018), https://am.aals.org/wp-content/uploads/sites/4/2018/12/AM19TortsHealthPresentation.pdf. But in recognizing a doctor’s obligation to share information of value to people other than the patient itself, the Court explicitly rejected the creation of any direct duty between a doctor and third parties of heritable conditions, which differs from the ethical obligation of medical conditions. Anne-Marie Laberge & Wylie Burke, Duty to Warn At-Risk Family Members of Genetic Disease, AMA J. of Ethics (2009), https://journalofethics.ama-assn.org/article/duty-warn-risk-family-members-genetic-disease/2009-09. Today, just twenty years later, the duty to warn has left the confines of the doctor-patient relationship, or even research study, and includes a wide swath of academic and commercial entities who have never seen the individual whose genetic material they are analyzing (Mark Rothstein, Stacey Tovino, Susan Wolf, Jordan Paradise and Charlisse Caga-anan are experts on the issue). Mark Rothstein, Genetic Privacy and Confidentiality: Why They Are So Hard to Protect, 26 J. L. Med. & Ethics 178, 198-204 (1998); Stacey Tovino, Incidental Findings: A Common Law Approach, Drake Univ. L. Sch. (2008), https://www.ncbi.nlm.nih.gov/pubmed/18972265; Susan M. Wolf, Jordan Paradise & Charlisse Caga-anan, The Law of Incidental Findings in Human Subjects Research, 36 J. Law Med. & Ethics 361, 361-241 (2008), https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2581517/pdf/nihms-73012.pdf. Even worse, we can transmit information from genetic analysis across the globe in the blink of an eye. In the late 1970s the growing ubiquity of photocopying machines was a significant factor in the unauthorized spreading of private health information. But this is dwarfed by today’s reality in the USA, which is that every health care professional and the vast majority of human beings bring with them communications technology that 30 years ago would have been beyond science fiction. Laura Silver, Smartphone Ownership Is Growing Rapidly Around the World, but Not Always Equally, Pew Res. Ctr. (Feb. 5, 2019), https://www.pewresearch.org/global/2019/02/05/smartphone-ownership-is-growing-rapidly-around-the-world-but-not-always-equally/; Katelyn G. Bennett & Christian J. Vercler, When Is Posting about Patients on Social Media Unethical Medutainment, AMA J. of Ethics (Apr. 2018), https://journalofethics.ama-assn.org/article/when-posting-about-patients-social-media-unethical-medutainment/2018-04.
In sum, the days when the only way to access medical records was to break into a filing cabinet disappeared with the Watergate hearings. Owen Edwards, The World’s Most Famous Filing Cabinet, Smithsonian Mag. (Oct. 2012), https://www.smithsonianmag.com/history/the-worlds-most-famous-filing-cabinet-36568830/.
What does this mean for privacy? These issues were raised in a day of exceptionally high quality presentations at the 2019 Petrie-Flom Center Annual Conference, Consuming Genetics: Ethical and Legal Considerations of New Technologies. Videotape: 2019 Petrie-Flom Center Annual Conference: Consuming Genetics: Ethical and Legal Considerations of New Technologies, The Petrie-Flom Ctr. for Health L. Pol’y, Biotech., and Bioethics at Harv. L. Sch. (May 17, 2019), https://petrieflom.law.harvard.edu/events/details/2019-petrie-flom-center-annual-conference.
As Professor Seema Mohapatra has so brilliantly explained, in some fields, such as the anonymity of any human tissue sample, very much including that of Gamete Donors, is not just difficult to preserve, it is actually a myth. Alex Pearlman, Gamete Donor Anonymity is a Myth: Q&A with Seema Mohapatra, Bill of Health (May 23, 2019), http://blog.petrieflom.law.harvard.edu/2019/05/23/gamete-donor-anonymity-is-a-myth-a-qa-with-seema-mohapatra/.
Faced with these disruptive technologies, the expectations of those with information to protect have changed. Stacey Pereira et al, Do Privacy and Security Regulations Need a Status Update? Perspectives from an Intergenerational Survey, Plos (2019), https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5604938/. Genetic testing has become trivialized and ubiquitous. Katie Spector Bagdady’s wonderful, ongoing empirical research is already filling in the gaps about expectations and raising important questions about meeting them. Father’s Day 2018 DNA Testing Kit Deals: A comprehensive Guide, Genomelink (Jun. 11, 2018), https://medium.com/genome-link/fathers-day-2018-dna-testing-kit-deals-a-comprehensive-guide-b8129bd42619; Kayte Spector-Bagdady Author Details, SCOPUS, https://www.scopus.com/authid/detail.uri?authorId=36601367700 (last visited Oct. 20, 2019).
So why bother with laws that close the barn door long after the horse has been sold and shipped out-of-state?
Because there is still considerable harm that can come from disclosure of information such as diagnosis, prognosis, and even treatment plans and it is still possible to protect this information from inadvertent or unnecessary disclosure.
Laws set up to protect against health-related and genetic discrimination are far from comprehensive and even as written contain many loopholes. Amy L. McGuire & Mary A. Majumder, Two Cheers for GINA?, 1 Genome Med. 1, 6 (2009), https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2651591/; Sarah Zhang, The Loopholes in the Law Prohibiting Genetic Discrimination, The Atlantic (Mar. 13, 2017), https://www.theatlantic.com/health/archive/2017/03/genetic-discrimination-law-gina/519216/. There are significant professional and personal risks for individuals in the disclosure of their health information.
People with serious or chronic illnesses are faced with difficult decisions regarding disclosure. Responding to the genuine hurt of some of her closest friends who did not learn that she had Leukemia until the last days, Nora Ephron responded that she wanted to maintain her normal personal and professional life as long as she could—and if the diagnosis became known, her career as a director would be over because no one would insure her. Kyle Smith, Nora Ephron’s Dying Secret, N.Y. Post (Sep. 23, 2015), https://nypost.com/2015/09/23/why-nora-ephron-kept-her-fatal-illness-a-secret-until-the-end/; Richard Cohen, My Friendship with Nora Ephron, Wash. Post (July 2, 2012), https://www.washingtonpost.com/opinions/my-friendship-with-nora-ephron/2012/07/02/gJQAfCLGJW_story.html.
Another area of concern involves mental health. While, Brittany Spears herself is directly involved in the “Free Brittany campaign” and has made her medical treatment common knowledge without losing ticket and music buyers, this is not everyone’s experience. Michael Hein, Britney Spears Flaunts New Bike in Health Infused Photos Following Treatment, Popculture (June 3, 2019), https://popculture.com/celebrity/2019/06/03/britney-spears-new-bike-health-photos-following-treatment/.
We can see the harm caused by the fear of disclosure of health information in the high rates of mental illness and a very troubling rate of lawyers, nurses and doctors who die by suicide despite intense and sincere efforts to provide resources and fight stigma. ABA Mental Health Resources for L. Students, https://abaforlawstudents.com/events/initiatives-and-awards/mental-health-resources/ (last visited Oct. 20, 2019); Shannon Firth, Nurses Suicides: Talk To A Colleague, MedPage Today (May 29, 2019), https://www.kpbs.org/news/2019/may/29/nurse-suicides-talk-colleague/; Sara Reader, The Physician Reluctance to Seek Mental Health Treatment, MedPage Today (June 25, 2019), https://www.kevinmd.com/blog/2018/06/the-physician-reluctance-to-seek-mental-health-treatment.html; Suicide Prevention Resource Ctr., https://www.sprc.org/organizations/%20national-federal (last visited Oct. 20, 2019) ABA Nat’l Resources, https://www.americanbar.org/groups/lawyer_assistance/resources/links_of_interest/ (last visited Oct. 20, 2019). [Please reach out to the National Suicide Prevention Lifeline if these words resonate with you. 1.800.273.8255]. Nat’l Suicide Prevention Lifeline, https://suicidepreventionlifeline.org (last visited Oct. 20, 2019).
Today’s privacy laws are in place to limit and catalog disclosure, but they make no pretense of preventing disclosure. Summary of the HIPAA Privacy Rule, U.S. Dep’t of Health & Hum. Serv., https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html (last visited Oct. 20, 2019). They provide an ability to impose penalties on those who breach rather than provide an ability to guarantee privacy. Top 15 Celebrity HIPAA Fails, ReminderCall (Jan. 13, 2017), https://www.remindercall.com/celebrity-hipaa-fails/.
In sum, the availability of genetic information and universal access to the internet has disrupted the framework of medical privacy laws and even significantly changed people’s expectations of privacy; it has not made privacy law obsolete. As the ACLU argued in opposing the federal government’s ability to access the records of all patients prescribed certain prescription substances, “this kind of medical information is among the most sensitive data about us.” Nathan F. Wessler, The Government Needs to Get a Warrant if it Wants Access to Our Private Health Information, ACLU (May 29, 2019), https://www.aclu.org/blog/privacy-technology/medical-and-genetic-privacy/government-needs-get-warrant-if-it-wants-access. That’s why, for as long as there has been a medical profession, health care providers have been bound by a duty of confidentiality toward their patients’ medical information.” For a complete analysis of the issues, see Jennifer Olivas in the Duke Law Journal. Jennifer D. Oliva, Prescription Drug Policing: The Right to Protected Health Information Privacy Pre- and Post-Carpenter, 69 Duke L. J. (forthcoming 2020), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3225000.
So, in response to those who wonder if technology has made legal protection of health information privacy obsolete, the answer is “no.” As long as disclosure of identifiable health information is a likely risk of people having health information, and that disclosure can cause individuals what they perceive to be significant harm, there is a role and need for legal protection, even if it takes the form of remedies for those whose information has been disclosed.
Bio: Jennifer S. Bard, J.D., M.P.H., Ph.D, is a professor of law at the University of Cincinnati College of Law and has an appointment as a professor in the Department of Internal Medicine at the University of Cincinnati College of Medicine. She is currently a visiting professor of law at University of Florida Levin College of Law.
Handle: @ProfBardLaw