UCSD gives consent for sharing medical records without patient approval

I got an interesting letter from UCSD three days ago. It told me that I had consented to share my electronic medical records.

The trouble is--I had NOT given my consent. I never signed a consent form. I never clicked a box on the Internet agreeing to share my records.

And the letter from UCSD did NOT arrive in my home mailbox or even in my email. It was purely by chance that I found it on MyUCSDChart—NOT among the MyChart emails. If it had been among the MyChart emails, I would have received an alert about it in my regular email.

UCSD was definitely NOT trying to make sure that I found out about my “consent”.

Today, each time I have clicked on the link about sharing electronic medical records on MyUCSDChart, I found myself unceremoniously thrown back to the sign-in page. Automatically signed out. They really don't like it when I click on the link!

UCSD seems to be remarkably fond of both signing me in and signing me out--without my involvement--whenever it feels like it.

I found this page on the UCSD site about sharing electronic records. It seems that I am now part of two databases: The San Diego Beacon Health Information Exchange, and something called Care Everywhere.

It's not that I want to keep my records secret. In fact, I think sharing electronic records is basically a good idea. It's just that I've had problems with health providers hiding my own test results from me, so I'm sensitive about doctors violating the law regarding medical records.

Apparently the VA is also part of this system, but the VA has a more transparent consent process.

I've heard of falsified medical records, but this is the first time I heard of a falsified consent for release of medical records.



I found some interesting stuff about UCSD's informed consent process for patients in research projects:

iDASH Integrating Data for Analysis, Anonymization and SHaring

Informed Consent

Paper Consent versus Electronic Consent

Traditionally, paper-based consent has been the medium through which researchers and physicians conducted the informed consent process. The paper-based process consists of giving a hard copy consent form to a patient for him or her to review. Then a care provider answers any questions from the patient and in some cases assists the patient in reviewing the paper consent forms. The issues surrounding this procedure are that the paper-based consent form tends to be long and monotonous, and the retrieval of paper forms are often time consuming.

The new electronic consent forms use tablets or computers as the medium for communicating information and seeking consent from the patient...The iDASH team is also currently working on two systems, iCONS and iCONCUR, which are intended for such open source use in the future.

iDASH electronic informed consent management system

iCONS is a system currently being tested in a clinical trials environment at Moores Cancer Center Biorepository. The system supports informed consent electronically by enhancing the consent process for patients and researchers by acting as a consent broker and by adding multimedia aspects to the process. This consent process is opt-in, meaning no patient information is shared with researchers until the patient specifies what specific information he or she would like to share with researchers. The iCONS system creates a permission ontology to model the consent choices of the patient to assist in the process of releasing data and specimens to researchers for their consented uses.

iCONCUR is a pilot study within the University of California - San Diego Health System. This system transforms the sharing of electronic records from the opt-out system that is currently in place, meaning a patient’s record is automatically entered into the system unless the patient specifically requests to have their records taken out, to an opt-in system. The tool presents the patient with a taxonomy of his or her medical record allowing the patient to dictate what parts of the medical record to share and with whom it may be shared with.

HOSPITAL FAXED MEDICAL RECORDS TO PATIENT'S WORKPLACE

Tufts Medical Center sued for faxing patient records without consent
July 15, 2011
By Karen Cheung-Larivee
FierceHealthcare

Tufts Medical Center in Boston faces a lawsuit after a patient said the hospital faxed her medical records to her workplace without her consent, causing her embarrassment, reports The Boston Globe yesterday.

"I feel like I might have walked in (the office) naked," said patient Kimberly White.

White requested Tufts to send a form for a disability claim, but instead the hospital allegedly sent four pages of medical records about her hysterectomy to a shared fax machine at her workplace.

White filed a complaint in Plymouth County Superior Court. The hospital denies any wrongdoing, according to the article.

Tufts spokeswoman Julie Jette said, "In this matter, we complied with a patient's request to share information. We firmly believe we responded to the patient's request appropriately."

"I can't go back there," White said. "I am so embarrassed. ... I couldn't live with knowing what these people knew about me."

Earlier this year, another Boston hospital, Massachusetts General Hospital, faced accusations that an employee lost records of 192 patients on the subway. The hospital in February settled the federal case for $1 million, according to the article.

UCLA HIPAA VIOLATIONS

UCLA Health System pays $865G to settle HIPAA violation charges
July 8, 2011
FierceHealthIT
By Ken Terry

UCLA Health System has agreed to pay a fine of $865,000 and to develop a correction action plan to settle potential HIPAA privacy violations involving improper disclosures of medical records at its three hospitals, the federal Office of Civil Rights (OCR) reports.

OCR launched the investigation in 2009, following complaints by two unnamed celebrities that their medical records had been compromised. The government probe revealed that from 2005 to 2008, "unauthorized employees repeatedly looked at the electronic protected health information of numerous other UCLAHS patients," according to an OCR press release.

The Los Angeles Times reports that violations allegedly occurred at all three UCLAHS hospitals: Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center, and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, which are regarded as a single unit.

The hospital had disclosed in April 2008 that it had discovered that several employees had snooped into the patient records of dozens of celebrities, including Britney Spears, Tom Cruise and Maria Shriver.

When the alleged violations came to light in 2008, the California legislature passed a law that imposed escalating fines on hospitals for patient privacy breaches. The state fined UCLAHS $95,000 in 2009, reportedly in connection with the medical records of the late Michael Jackson.

The UCLAHS settlement with OCR is much smaller than previous HIPAA settlements, including those involving CVS Caremark ($2.25 million) and Rite Aid ($1 million).

As part of its settlement, UCLAHS agreed to institute new security and privacy policies, improve employee training, take action against employees who violate privacy rules, and designate an independent monitor to oversee compliance.

In a statement, UCLAHS said, "The UCLA Health System considers patient confidentiality a critical part of our mission of patient care, teaching and research. Over the past three years, we have worked diligently to strengthen our staff training, implement enhanced data security systems and increase our auditing capabilities."


MEDICAL ETHICS--RESEARCH ON MEDICAL RECORDS WITHOUT INFORMED CONSENT

J Law Med Ethics. 2008 Fall;36(3):560-6. doi: 10.1111/j.1748-720X.2008.304.x.
Research on medical records without informed consent.
Miller FG.

Observational research involving access to personally identifiable data in medical records has often been conducted without informed consent, owing to practical barriers to soliciting consent and concerns about selection bias. Nevertheless, medical records research without informed consent appears to conflict with basic ethical norms relating to clinical research and personal privacy. This article analyzes the scope of these norms and provides an ethical justification for research using personally identifiable medical information without consent.

PMID: 18840249 [PubMed - indexed for MEDLINE]