UCSD gives consent for sharing medical records without patient approval

I got an interesting letter from UCSD three days ago. It told me that I had consented to share my electronic medical records.

The trouble is--I had NOT given my consent. I never signed a consent form. I never clicked a box on the Internet agreeing to share my records.

And the letter from UCSD did NOT arrive in my home mailbox or even in my email. It was purely by chance that I found it on MyUCSDChart—NOT among the MyChart emails. If it had been among the MyChart emails, I would have received an alert about it in my regular email.

UCSD was definitely NOT trying to make sure that I found out about my “consent”.

Today, each time I have clicked on the link about sharing electronic medical records on MyUCSDChart, I found myself unceremoniously thrown back to the sign-in page. Automatically signed out. They really don't like it when I click on the link!

UCSD seems to be remarkably fond of both signing me in and signing me out--without my involvement--whenever it feels like it.

I found this page on the UCSD site about sharing electronic records. It seems that I am now part of two databases: The San Diego Beacon Health Information Exchange, and something called Care Everywhere.

It's not that I want to keep my records secret. In fact, I think sharing electronic records is basically a good idea. It's just that I've had problems with health providers hiding my own test results from me, so I'm sensitive about doctors violating the law regarding medical records.

Apparently the VA is also part of this system, but the VA has a more transparent consent process.

I've heard of falsified medical records, but this is the first time I heard of a falsified consent for release of medical records.



I found some interesting stuff about UCSD's informed consent process for patients in research projects:

iDASH Integrating Data for Analysis, Anonymization and SHaring

Informed Consent

Paper Consent versus Electronic Consent

Traditionally, paper-based consent has been the medium through which researchers and physicians conducted the informed consent process. The paper-based process consists of giving a hard copy consent form to a patient for him or her to review. Then a care provider answers any questions from the patient and in some cases assists the patient in reviewing the paper consent forms. The issues surrounding this procedure are that the paper-based consent form tends to be long and monotonous, and the retrieval of paper forms are often time consuming.

The new electronic consent forms use tablets or computers as the medium for communicating information and seeking consent from the patient...The iDASH team is also currently working on two systems, iCONS and iCONCUR, which are intended for such open source use in the future.

iDASH electronic informed consent management system

iCONS is a system currently being tested in a clinical trials environment at Moores Cancer Center Biorepository. The system supports informed consent electronically by enhancing the consent process for patients and researchers by acting as a consent broker and by adding multimedia aspects to the process. This consent process is opt-in, meaning no patient information is shared with researchers until the patient specifies what specific information he or she would like to share with researchers. The iCONS system creates a permission ontology to model the consent choices of the patient to assist in the process of releasing data and specimens to researchers for their consented uses.

iCONCUR is a pilot study within the University of California - San Diego Health System. This system transforms the sharing of electronic records from the opt-out system that is currently in place, meaning a patient’s record is automatically entered into the system unless the patient specifically requests to have their records taken out, to an opt-in system. The tool presents the patient with a taxonomy of his or her medical record allowing the patient to dictate what parts of the medical record to share and with whom it may be shared with.

HOSPITAL FAXED MEDICAL RECORDS TO PATIENT'S WORKPLACE

Tufts Medical Center sued for faxing patient records without consent
July 15, 2011
By Karen Cheung-Larivee
FierceHealthcare

Tufts Medical Center in Boston faces a lawsuit after a patient said the hospital faxed her medical records to her workplace without her consent, causing her embarrassment, reports The Boston Globe yesterday.

"I feel like I might have walked in (the office) naked," said patient Kimberly White.

White requested Tufts to send a form for a disability claim, but instead the hospital allegedly sent four pages of medical records about her hysterectomy to a shared fax machine at her workplace.

White filed a complaint in Plymouth County Superior Court. The hospital denies any wrongdoing, according to the article.

Tufts spokeswoman Julie Jette said, "In this matter, we complied with a patient's request to share information. We firmly believe we responded to the patient's request appropriately."

"I can't go back there," White said. "I am so embarrassed. ... I couldn't live with knowing what these people knew about me."

Earlier this year, another Boston hospital, Massachusetts General Hospital, faced accusations that an employee lost records of 192 patients on the subway. The hospital in February settled the federal case for $1 million, according to the article.

UCLA HIPAA VIOLATIONS

UCLA Health System pays $865G to settle HIPAA violation charges
July 8, 2011
FierceHealthIT
By Ken Terry

UCLA Health System has agreed to pay a fine of $865,000 and to develop a correction action plan to settle potential HIPAA privacy violations involving improper disclosures of medical records at its three hospitals, the federal Office of Civil Rights (OCR) reports.

OCR launched the investigation in 2009, following complaints by two unnamed celebrities that their medical records had been compromised. The government probe revealed that from 2005 to 2008, "unauthorized employees repeatedly looked at the electronic protected health information of numerous other UCLAHS patients," according to an OCR press release.

The Los Angeles Times reports that violations allegedly occurred at all three UCLAHS hospitals: Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center, and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, which are regarded as a single unit.

The hospital had disclosed in April 2008 that it had discovered that several employees had snooped into the patient records of dozens of celebrities, including Britney Spears, Tom Cruise and Maria Shriver.

When the alleged violations came to light in 2008, the California legislature passed a law that imposed escalating fines on hospitals for patient privacy breaches. The state fined UCLAHS $95,000 in 2009, reportedly in connection with the medical records of the late Michael Jackson.

The UCLAHS settlement with OCR is much smaller than previous HIPAA settlements, including those involving CVS Caremark ($2.25 million) and Rite Aid ($1 million).

As part of its settlement, UCLAHS agreed to institute new security and privacy policies, improve employee training, take action against employees who violate privacy rules, and designate an independent monitor to oversee compliance.

In a statement, UCLAHS said, "The UCLA Health System considers patient confidentiality a critical part of our mission of patient care, teaching and research. Over the past three years, we have worked diligently to strengthen our staff training, implement enhanced data security systems and increase our auditing capabilities."


MEDICAL ETHICS--RESEARCH ON MEDICAL RECORDS WITHOUT INFORMED CONSENT

J Law Med Ethics. 2008 Fall;36(3):560-6. doi: 10.1111/j.1748-720X.2008.304.x.
Research on medical records without informed consent.
Miller FG.

Observational research involving access to personally identifiable data in medical records has often been conducted without informed consent, owing to practical barriers to soliciting consent and concerns about selection bias. Nevertheless, medical records research without informed consent appears to conflict with basic ethical norms relating to clinical research and personal privacy. This article analyzes the scope of these norms and provides an ethical justification for research using personally identifiable medical information without consent.

PMID: 18840249 [PubMed - indexed for MEDLINE]

Kaiser sued for its common practice of releasing incorrect records

The medical records system at Kaiser is rather odd. It seems they often give the wrong records, or no records at all. I've received altered records from Kaiser, and a bizarre set of X-rays with many duplicates that Kaiser prepared in an apparent effort to hide the fact that most of my X-rays were missing from the set. Also, they gave Stutz, Artiano Shinoff & Holtz 20 years of my records illegally. It turned out that the woman at Kaiser who authorized the release was Facebook friends with Dan Shinoff's wife!

Man Claims Kaiser Screw-up Cost Him
By BARBARA WALLACE
Courthouse News Service
December 27, 2012

CLEVELAND (CN) - The Ohio National Guard rejected a man's application for Officer Candidate School because a Kaiser employee entered "intermittent explosive disorder" into a computer system, though he never had been diagnosed with that, the man claims in court.

Simon Montgomery sued Kaiser Foundation Health Plan of Ohio, Ohio Permanente Medical Group, and Constance Baker-Alden, who allegedly made the computer mistake, in Cuyahoga County Court. The National Guard is not a party to the complaint.

Montgomery claims he was diagnosed with "exercise-induced syncope" after he fainted after working out on a treadmill in February 2010. After this, his doctor had told him "that he was medically cleared for all activities and that the isolated incident should not be a cause for concern," according to the complaint.

Montgomery applied for Officer Candidate School in January 2010. To do so, he signed waivers allowing the National Guard to review his medical records.

The Guard rejected him, in a letter that said "his application for enlistment had been denied because of a permanent medical disqualification for Intermittent Explosive Disorder and exercise-induced syncope," the complaint states.

Montgomery says he appealed to the Guard, in a letter stating that the fainting episode happened just once and that the diagnosis of intermittent explosive disorder was incorrect.

He claims that Baker-Alden, "as an employee of Kaiser and/or Permanente," wrote a letter to him, which he immediately forwarded to the Guard.

"This letter explained that Baker-Alden had incorrectly entered the diagnosis of Intermittent Explosive Disorder on plaintiff's medical records," the complaint states.

The Guard rejected his appeal, "because his medical records were contradictory," Montgomery says.

As a result, he says, he applied to the Naval Reserves as an enlisted man, for monthly pay of $366 less than he would have earned as an officer in the National Guard.

He seeks punitive damages for more than $25,000 for negligence.

He is represented by Ann-Marie Ahern, with McCarthy, Lebit, Crystal & Liffman.

UCLA hospitals to pay $865,500 for breaches of celebrities' privacy

UCLA hospitals to pay $865,500 for breaches of celebrities' privacy
July 08, 2011
By Molly Hennessy-Fiske
Los Angeles Times

UCLA Health System has agreed to pay $865,500 as part of a settlement with federal regulators announced Thursday after two celebrity patients alleged that hospital employees broke the law and reviewed their medical records without authorization.

Federal and hospital officials declined to identify the celebrities involved. The complaints cover 2005 to 2009, a time during which hospital employees were repeatedly caught and fired for peeping at the medical records of dozens of celebrities, including Britney Spears, Farrah Fawcett and then-California First Lady Maria Shriver.

Violations allegedly occurred at all three UCLA Health System hospitals — Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, according to UCLA spokeswoman Dale Tate.

The security breaches were first reported in The Times in 2008.

The violations led state legislators to pass a law imposing escalating fines on hospitals for patient privacy lapses.

After the law took effect on Jan. 1, 2009, state regulators fined Ronald Reagan UCLA Medical Center $95,000 in connection with privacy breaches that year that sources said involved the medical records of Michael Jackson, who was taken to the hospital after his death in June 2009.

The same month, the U.S. Department of Health and Human Services' Office for Civil Rights began investigating alleged violations of the federal Health Insurance Portability and Accountability Act at the hospitals, according to the settlement agreement.

Investigators found that UCLA employees examined private electronic records "repeatedly and without a permissible reason" in 2005 and 2008, including an employee in the nursing director's office, according to the agreement reached Wednesday.

The employee was not named in the agreement, and the hospital spokeswoman declined to identify who it was. But the timing and description of the alleged violations cited in the agreement suggest that it may have been Lawanda Jackson, an administrative specialist at Ronald Reagan UCLA Medical Center who was fired in 2007 after she was caught accessing Farrah Fawcett's medical records and allegedly selling information to the National Enquirer.

Jackson later pleaded guilty to a felony charge of violating federal medical privacy laws for commercial purposes but died of cancer before she could be sentenced. Fawcett died of cancer in 2009.

Federal investigators faulted the hospital system for failing to remedy the problems, discipline or retrain staff.

"Employees must clearly understand that casual review for personal interest of patients' protected health information is unacceptable and against the law," Georgina Verdugo, director of the Office for Civil Rights, said in a statement Thursday, adding that healthcare facilities "will be held accountable for employees who access protected health information to satisfy their own personal curiosity."

As a condition of the settlement, UCLA Health System was required to submit a plan to federal regulators detailing how officials would prevent future breaches. They agreed to retrain staff on privacy protections, formulate privacy policies, appoint a monitor to oversee improvements and report to regulators for the next three years.

UCLA Health System released a statement Thursday noting that, "Over the past three years, we have worked diligently to strengthen our staff training, implement enhanced data security systems and increase our auditing capabilities."

"Our patients' health, privacy and well-being are of paramount importance to us," said Dr. David T. Feinberg, chief executive of the UCLA Hospital System. "We appreciate the involvement and recommendations made by OCR in this matter and will fully comply with the plan of correction it has formulated. We remain vigilant and proactive to ensure that our patients' rights continue to be protected at all times."

UCLA Radiology Department--Who's in charge of losing my X-rays?

I'm trying to figure out how--or why--ALL my digital X-rays got "lost" at UCLA.

[Update October 20, 2012: It seems that UCLA wants to protect Kaiser from having to answer questions about this problem at Kaiser Permanente's new Garfield Specialty Center in San Diego. My UCLA primary care doctor explained it to me, saying, "You need to forget about Kaiser." She was worried that I might "have a case against Kaiser."]

It appears that I have these people to thank for my X-rays being unavailable:

UCLA RADIOLOGY DEPARTMENT

Dieter R. Enzmann, M.D.
"Leo G. Rigler" Chair and Professor (What's up with that Cheshire Cat smile? He looks like he might have swallowed my X-rays.)

Brenda Izzi, R.N., M.B.A.
Chief Administrative Officer and head of Radiology Image Library
(310) 481-7516 (310) 794-8056
BIzzi@mednet.ucla.edu
(From the look on her face, I think she knows where those X-rays are.)







Brenda Jones, Director of Radiology Image Library


UCLA MEDICAL RECORDS DEPARTMENT

The head of the Medical Records Department won't even let employees give out his or her name. Perhaps the Los Angeles Times article at the bottom of this post explains the desire for anonymity.

Katherine Mair, special project manager (Her existence might be just a rumor, but I suspect she's simply too important to deal with missing X-rays.)

Erik Lozano--contractor (He had his door closed, and later was in a meeting.)

Pazzette McCray, contractor, manager 310 825 9381 (She ignored all my messages.)

Erika, contractor (She was the only one who would talk to me, but I don't think she was authorized to say much. I'm sure that's difficult for her. As far as I know, she's the only one earning her pay.)

See more information HERE.


UPDATE October 5, 2012

I got the following email this morning, but I'll believe that Ms. Izzi is sincere when I have the digital images in my possession. Erika Lee told me that the images can be burned to a CD within a day. That means they could also be sent in an email within a day. Anyone want to bet that I don't get all the digital images today? (Note to UCLA: it doesn't count if you print out an image, then scan it. You remove a huge amount of detail when you do that.)

Dear Ms. Larkins,
I am happy to look into any imaging provided by Radiology and ensure you can obtain copies of those studies. I have asked my Director of the Image Library to research your concern.
I will let you know what we uncover.
Sincerely,
Brenda
Brenda M. Izzi, RN, MBA
Chief Administrative Officer
UCLA Radiology


I SENT MS. IZZI THIS EMAIL IN RESPONSE:

Dear Ms. Izzi:

It is ridiculous for your department to claim that X-rays might have gotten misplaced inside Dr. Raz's office. The Chair of the Radiology Department, Dr. Enzmann, states "the Department of Radiological Sciences is completely digital." The digital images are available on your computers, and it's simply false to say that they aren't there.

Also, please don't print out a few images, then scan them, and then call them the original digital images. You remove a huge amount of detail when you do that. By law you must provide all the videos and all the original still images. Your department has been in violation of the law for almost two weeks.

It is also shameful for your department to claim that my September 18, 2012 Request for Images was not received. I have a FAX transmission report with a photocopy of the Request to prove that you received my Request on Sept. 18.

I assume you are talking about Brenda Jones when you refer to your Director. Surely she has been researching this matter for the past three days, since Erika Lee sent a FAX on October 2, 2012 asking that my request be prioritized? Isn't Brenda Jones the person who told her subordinates to tell me that no images were available? I suggest you look into this matter yourself, Ms. Izzi.

Sincerely,
Maura Larkins


THE PLOT THICKENS ON FRIDAY AFTERNOON, OCT. 5, 2012

Apparently Brenda Izzi and Katherine Mair and the mysterious head of Medical Records decided that the best response to the situation was to make up a bizarre story in which they would claim that images don't exist, and if they did, they wouldn't be able to release them.

So why would UCLA, a public entity, pay all these people in Medical Records and the Radiology Image Library to do nothing? Well, they don't exactly do nothing. They actually work very hard. It can't be easy to conduct phone calls like the following one.

THE CONFERENCE CALL

On Oct. 5, 2012 at 4:50 p.m. I became part of a conference call with Ms. P. M. and the elusive Mr. E. L. of UCLA’s Medical Records office.

When I had called the office on October 2, 2012, a receptionist had gone to ask E. L. to talk to me, but then she came back and told me that his door was closed.

P. M. had ignored my messages for several days, but when I called earlier today, she had picked up the phone and talked to me.

Only P. M. spoke in the beginning of our conference call, and I began to wonder if E. L. was actually on the line. "Are you there, E.?" I asked. Then I heard his voice for the first time.

From all this I concluded that E. L. must actually be P. M.'s superior, rather than her subordinate, as I had assumed when told that P. M. was the "manager." I figure the higher-ups tell their subordinates what to say, but they don't like to actually talk to patients themselves.

In fact, I suspect that there may have been others on the line during the call who never said anything. I think B. J. was probably on the line, since she called me back just minutes after the following call. I also think that the people who were calling the shots did not speak to me at all. I think E. L., P. M. and B. J. are all following orders.

Here's my transcript of the call:

P. M.: ...I called the physician [Dr. Raz] and was told that they don't make videos in that office.

[Maura Larkins comment: I knew this statement was false. I saw the videos myself on the computer monitor as they were being taken.]

P. M.: The X-rays are the physician's product to release. We're not experts and we're not able to release it. He's a private physician.

[Maura Larkins comment: I knew that all these claims were false, too. It says on the UCLA website that the Radiology Image Library releases images on CD for free, and that it does so within 5 days of the request--because this is what is required by California law. All X-rays at UCLA are digitized, and the Radiology Image Library has access to all X-rays. In further proof, Dr. Raz's office had given me the phone number of the Radiology Image Library and told me to call that number to get copies of my images.

Also, UCLA doctors are public employees, hired by the Regents of the University of California, NOT private doctors.]

Maura: No one in your department knows California law regarding medical records?

McCray: We can not provide patient information. Erika (Lee) was being kind in trying to help you out.

Maura: (repeating the unanswered question) No one in your department knows what California law is regarding medical records?

P. M.: We know the law.

Maura: Why are you disobeying the law?

P. M.: Miss Larkins, we do not release information from a private physician.

Maura: I didn't get everything you said written down in my notes here. P. M., you said you spoke to Dr. Raz?

P. M.: E. L. called Dr. Raz's office. The number he called was 310 794 0206.

Maura: E. L., did you speak to Dr. Raz? Did he say they don't make videos in his office?

E. L.: His office said that they don't make videos.

Maura: Who was it who said that?

E. L.: I don't have her name written down. A woman said they don't make videos. If they do make videos, we don't have access.

[Maura Larkins comment: I can't believe that anyone in Dr. Raz's office would claim that they don't make videos. But it does appear that for some reason Dr. Raz's office didn't want the videos released, and Medical Records came up with this cover story. Why wouldn't a doctor want a video of abdominal X-rays released? This is all very bizarre.]

Maura: E. L., are you a contractor?

E. L.: Yes.

Maura: P. M., are you a contractor?

McCray: Yes.


MAYBE I SHOULD ASK THE NATIONAL ENQUIRER TO GET MY RECORDS FROM UCLA; THEY SEEM TO HAVE BETTER LUCK

UCLA hospitals to pay $865,500 for breaches of celebrities' privacy
July 08, 2011
By Molly Hennessy-Fiske
Los Angeles Times

UCLA Health System has agreed to pay $865,500 as part of a settlement with federal regulators announced Thursday after two celebrity patients alleged that hospital employees broke the law and reviewed their medical records without authorization.

...Violations allegedly occurred at all three UCLA Health System hospitals — Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, according to UCLA spokeswoman Dale Tate...The same month, the U.S. Department of Health and Human Services' Office for Civil Rights began investigating alleged violations of the federal Health Insurance Portability and Accountability Act at the hospitals, according to the settlement agreement.

Investigators found that UCLA employees examined private electronic records "repeatedly and without a permissible reason" in 2005 and 2008, including an employee in the nursing director's office, according to the agreement reached Wednesday.

..."Our patients' health, privacy and well-being are of paramount importance to us," said Dr. David T. Feinberg, chief executive of the UCLA Hospital System. "...We remain vigilant and proactive to ensure that our patients' rights continue to be protected at all times."

La Verne teacher claims Kaiser Permanente nurse violated her privacy

Teacher claims Kaiser nurse violated her privacy
allnurses.com
Jun 9, '09

When stories about hospital privacy breaches turn into lawsuits, there's usually a celebrity name attached.

Britney Spears, Farrah Fawcett and Nadya Suleman have all claimed medical staffs snooped through their confidential records.

But celebrities aren't the only ones alleging violation of their privacy. A second- grade teacher in La Verne says she is the latest victim of a medical confidentiality breach.

Louise Steele, 56, claims a Kaiser Permanente nurse pried into her medical file and reported the findings to her employer, Bonita Unified School District, according to a lawsuit filed May 29 in Los Angeles Superior Court.

Steele accuses Kaiser Permanente and nurse Lisa Martinez of conspiracy, negligence, invasion of privacy and emotional distress, according to the complaint.

Martinez, who had a child in Steele's class at Roynon Elementary School, did not return calls Tuesday....

In January, Lisa Martinez accused Steele of making a derogatory comment to her son. Her son was removed from Steele's Roynon Elementary class.

Shortly after, Martinez was filling in at the San Dimas office of Steele's physician when Steele came in for an appointment.

Martinez accessed Steele's medical records and reported the content, which included mental- and emotional- health information about Steele, to her ex-husband. Alex Martinez then submitted a letter dated May 18 to the school district stating Steele "is not fit to continue being an elementary school teacher" and asked the district to investigate. Soon after, Steele received an anonymous letter saying Martinez pried into Steele's medical file.