UCSD gives consent for sharing medical records without patient approval

I got an interesting letter from UCSD three days ago. It told me that I had consented to share my electronic medical records.

The trouble is--I had NOT given my consent. I never signed a consent form. I never clicked a box on the Internet agreeing to share my records.

And the letter from UCSD did NOT arrive in my home mailbox or even in my email. It was purely by chance that I found it on MyUCSDChart—NOT among the MyChart emails. If it had been among the MyChart emails, I would have received an alert about it in my regular email.

UCSD was definitely NOT trying to make sure that I found out about my “consent”.

Today, each time I have clicked on the link about sharing electronic medical records on MyUCSDChart, I found myself unceremoniously thrown back to the sign-in page. Automatically signed out. They really don't like it when I click on the link!

UCSD seems to be remarkably fond of both signing me in and signing me out--without my involvement--whenever it feels like it.

I found this page on the UCSD site about sharing electronic records. It seems that I am now part of two databases: The San Diego Beacon Health Information Exchange, and something called Care Everywhere.

It's not that I want to keep my records secret. In fact, I think sharing electronic records is basically a good idea. It's just that I've had problems with health providers hiding my own test results from me, so I'm sensitive about doctors violating the law regarding medical records.

Apparently the VA is also part of this system, but the VA has a more transparent consent process.

I've heard of falsified medical records, but this is the first time I heard of a falsified consent for release of medical records.



I found some interesting stuff about UCSD's informed consent process for patients in research projects:

iDASH Integrating Data for Analysis, Anonymization and SHaring

Informed Consent

Paper Consent versus Electronic Consent

Traditionally, paper-based consent has been the medium through which researchers and physicians conducted the informed consent process. The paper-based process consists of giving a hard copy consent form to a patient for him or her to review. Then a care provider answers any questions from the patient and in some cases assists the patient in reviewing the paper consent forms. The issues surrounding this procedure are that the paper-based consent form tends to be long and monotonous, and the retrieval of paper forms are often time consuming.

The new electronic consent forms use tablets or computers as the medium for communicating information and seeking consent from the patient...The iDASH team is also currently working on two systems, iCONS and iCONCUR, which are intended for such open source use in the future.

iDASH electronic informed consent management system

iCONS is a system currently being tested in a clinical trials environment at Moores Cancer Center Biorepository. The system supports informed consent electronically by enhancing the consent process for patients and researchers by acting as a consent broker and by adding multimedia aspects to the process. This consent process is opt-in, meaning no patient information is shared with researchers until the patient specifies what specific information he or she would like to share with researchers. The iCONS system creates a permission ontology to model the consent choices of the patient to assist in the process of releasing data and specimens to researchers for their consented uses.

iCONCUR is a pilot study within the University of California - San Diego Health System. This system transforms the sharing of electronic records from the opt-out system that is currently in place, meaning a patient’s record is automatically entered into the system unless the patient specifically requests to have their records taken out, to an opt-in system. The tool presents the patient with a taxonomy of his or her medical record allowing the patient to dictate what parts of the medical record to share and with whom it may be shared with.

HOSPITAL FAXED MEDICAL RECORDS TO PATIENT'S WORKPLACE

Tufts Medical Center sued for faxing patient records without consent
July 15, 2011
By Karen Cheung-Larivee
FierceHealthcare

Tufts Medical Center in Boston faces a lawsuit after a patient said the hospital faxed her medical records to her workplace without her consent, causing her embarrassment, reports The Boston Globe yesterday.

"I feel like I might have walked in (the office) naked," said patient Kimberly White.

White requested Tufts to send a form for a disability claim, but instead the hospital allegedly sent four pages of medical records about her hysterectomy to a shared fax machine at her workplace.

White filed a complaint in Plymouth County Superior Court. The hospital denies any wrongdoing, according to the article.

Tufts spokeswoman Julie Jette said, "In this matter, we complied with a patient's request to share information. We firmly believe we responded to the patient's request appropriately."

"I can't go back there," White said. "I am so embarrassed. ... I couldn't live with knowing what these people knew about me."

Earlier this year, another Boston hospital, Massachusetts General Hospital, faced accusations that an employee lost records of 192 patients on the subway. The hospital in February settled the federal case for $1 million, according to the article.

UCLA HIPAA VIOLATIONS

UCLA Health System pays $865G to settle HIPAA violation charges
July 8, 2011
FierceHealthIT
By Ken Terry

UCLA Health System has agreed to pay a fine of $865,000 and to develop a correction action plan to settle potential HIPAA privacy violations involving improper disclosures of medical records at its three hospitals, the federal Office of Civil Rights (OCR) reports.

OCR launched the investigation in 2009, following complaints by two unnamed celebrities that their medical records had been compromised. The government probe revealed that from 2005 to 2008, "unauthorized employees repeatedly looked at the electronic protected health information of numerous other UCLAHS patients," according to an OCR press release.

The Los Angeles Times reports that violations allegedly occurred at all three UCLAHS hospitals: Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center, and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, which are regarded as a single unit.

The hospital had disclosed in April 2008 that it had discovered that several employees had snooped into the patient records of dozens of celebrities, including Britney Spears, Tom Cruise and Maria Shriver.

When the alleged violations came to light in 2008, the California legislature passed a law that imposed escalating fines on hospitals for patient privacy breaches. The state fined UCLAHS $95,000 in 2009, reportedly in connection with the medical records of the late Michael Jackson.

The UCLAHS settlement with OCR is much smaller than previous HIPAA settlements, including those involving CVS Caremark ($2.25 million) and Rite Aid ($1 million).

As part of its settlement, UCLAHS agreed to institute new security and privacy policies, improve employee training, take action against employees who violate privacy rules, and designate an independent monitor to oversee compliance.

In a statement, UCLAHS said, "The UCLA Health System considers patient confidentiality a critical part of our mission of patient care, teaching and research. Over the past three years, we have worked diligently to strengthen our staff training, implement enhanced data security systems and increase our auditing capabilities."


MEDICAL ETHICS--RESEARCH ON MEDICAL RECORDS WITHOUT INFORMED CONSENT

J Law Med Ethics. 2008 Fall;36(3):560-6. doi: 10.1111/j.1748-720X.2008.304.x.
Research on medical records without informed consent.
Miller FG.

Observational research involving access to personally identifiable data in medical records has often been conducted without informed consent, owing to practical barriers to soliciting consent and concerns about selection bias. Nevertheless, medical records research without informed consent appears to conflict with basic ethical norms relating to clinical research and personal privacy. This article analyzes the scope of these norms and provides an ethical justification for research using personally identifiable medical information without consent.

PMID: 18840249 [PubMed - indexed for MEDLINE]

UCLA Radiology Department--Who's in charge of losing my X-rays?

I'm trying to figure out how--or why--ALL my digital X-rays got "lost" at UCLA.

[Update October 20, 2012: It seems that UCLA wants to protect Kaiser from having to answer questions about this problem at Kaiser Permanente's new Garfield Specialty Center in San Diego. My UCLA primary care doctor explained it to me, saying, "You need to forget about Kaiser." She was worried that I might "have a case against Kaiser."]

It appears that I have these people to thank for my X-rays being unavailable:

UCLA RADIOLOGY DEPARTMENT

Dieter R. Enzmann, M.D.
"Leo G. Rigler" Chair and Professor (What's up with that Cheshire Cat smile? He looks like he might have swallowed my X-rays.)

Brenda Izzi, R.N., M.B.A.
Chief Administrative Officer and head of Radiology Image Library
(310) 481-7516 (310) 794-8056
BIzzi@mednet.ucla.edu
(From the look on her face, I think she knows where those X-rays are.)







Brenda Jones, Director of Radiology Image Library


UCLA MEDICAL RECORDS DEPARTMENT

The head of the Medical Records Department won't even let employees give out his or her name. Perhaps the Los Angeles Times article at the bottom of this post explains the desire for anonymity.

Katherine Mair, special project manager (Her existence might be just a rumor, but I suspect she's simply too important to deal with missing X-rays.)

Erik Lozano--contractor (He had his door closed, and later was in a meeting.)

Pazzette McCray, contractor, manager 310 825 9381 (She ignored all my messages.)

Erika, contractor (She was the only one who would talk to me, but I don't think she was authorized to say much. I'm sure that's difficult for her. As far as I know, she's the only one earning her pay.)

See more information HERE.


UPDATE October 5, 2012

I got the following email this morning, but I'll believe that Ms. Izzi is sincere when I have the digital images in my possession. Erika Lee told me that the images can be burned to a CD within a day. That means they could also be sent in an email within a day. Anyone want to bet that I don't get all the digital images today? (Note to UCLA: it doesn't count if you print out an image, then scan it. You remove a huge amount of detail when you do that.)

Dear Ms. Larkins,
I am happy to look into any imaging provided by Radiology and ensure you can obtain copies of those studies. I have asked my Director of the Image Library to research your concern.
I will let you know what we uncover.
Sincerely,
Brenda
Brenda M. Izzi, RN, MBA
Chief Administrative Officer
UCLA Radiology


I SENT MS. IZZI THIS EMAIL IN RESPONSE:

Dear Ms. Izzi:

It is ridiculous for your department to claim that X-rays might have gotten misplaced inside Dr. Raz's office. The Chair of the Radiology Department, Dr. Enzmann, states "the Department of Radiological Sciences is completely digital." The digital images are available on your computers, and it's simply false to say that they aren't there.

Also, please don't print out a few images, then scan them, and then call them the original digital images. You remove a huge amount of detail when you do that. By law you must provide all the videos and all the original still images. Your department has been in violation of the law for almost two weeks.

It is also shameful for your department to claim that my September 18, 2012 Request for Images was not received. I have a FAX transmission report with a photocopy of the Request to prove that you received my Request on Sept. 18.

I assume you are talking about Brenda Jones when you refer to your Director. Surely she has been researching this matter for the past three days, since Erika Lee sent a FAX on October 2, 2012 asking that my request be prioritized? Isn't Brenda Jones the person who told her subordinates to tell me that no images were available? I suggest you look into this matter yourself, Ms. Izzi.

Sincerely,
Maura Larkins


THE PLOT THICKENS ON FRIDAY AFTERNOON, OCT. 5, 2012

Apparently Brenda Izzi and Katherine Mair and the mysterious head of Medical Records decided that the best response to the situation was to make up a bizarre story in which they would claim that images don't exist, and if they did, they wouldn't be able to release them.

So why would UCLA, a public entity, pay all these people in Medical Records and the Radiology Image Library to do nothing? Well, they don't exactly do nothing. They actually work very hard. It can't be easy to conduct phone calls like the following one.

THE CONFERENCE CALL

On Oct. 5, 2012 at 4:50 p.m. I became part of a conference call with Ms. P. M. and the elusive Mr. E. L. of UCLA’s Medical Records office.

When I had called the office on October 2, 2012, a receptionist had gone to ask E. L. to talk to me, but then she came back and told me that his door was closed.

P. M. had ignored my messages for several days, but when I called earlier today, she had picked up the phone and talked to me.

Only P. M. spoke in the beginning of our conference call, and I began to wonder if E. L. was actually on the line. "Are you there, E.?" I asked. Then I heard his voice for the first time.

From all this I concluded that E. L. must actually be P. M.'s superior, rather than her subordinate, as I had assumed when told that P. M. was the "manager." I figure the higher-ups tell their subordinates what to say, but they don't like to actually talk to patients themselves.

In fact, I suspect that there may have been others on the line during the call who never said anything. I think B. J. was probably on the line, since she called me back just minutes after the following call. I also think that the people who were calling the shots did not speak to me at all. I think E. L., P. M. and B. J. are all following orders.

Here's my transcript of the call:

P. M.: ...I called the physician [Dr. Raz] and was told that they don't make videos in that office.

[Maura Larkins comment: I knew this statement was false. I saw the videos myself on the computer monitor as they were being taken.]

P. M.: The X-rays are the physician's product to release. We're not experts and we're not able to release it. He's a private physician.

[Maura Larkins comment: I knew that all these claims were false, too. It says on the UCLA website that the Radiology Image Library releases images on CD for free, and that it does so within 5 days of the request--because this is what is required by California law. All X-rays at UCLA are digitized, and the Radiology Image Library has access to all X-rays. In further proof, Dr. Raz's office had given me the phone number of the Radiology Image Library and told me to call that number to get copies of my images.

Also, UCLA doctors are public employees, hired by the Regents of the University of California, NOT private doctors.]

Maura: No one in your department knows California law regarding medical records?

McCray: We can not provide patient information. Erika (Lee) was being kind in trying to help you out.

Maura: (repeating the unanswered question) No one in your department knows what California law is regarding medical records?

P. M.: We know the law.

Maura: Why are you disobeying the law?

P. M.: Miss Larkins, we do not release information from a private physician.

Maura: I didn't get everything you said written down in my notes here. P. M., you said you spoke to Dr. Raz?

P. M.: E. L. called Dr. Raz's office. The number he called was 310 794 0206.

Maura: E. L., did you speak to Dr. Raz? Did he say they don't make videos in his office?

E. L.: His office said that they don't make videos.

Maura: Who was it who said that?

E. L.: I don't have her name written down. A woman said they don't make videos. If they do make videos, we don't have access.

[Maura Larkins comment: I can't believe that anyone in Dr. Raz's office would claim that they don't make videos. But it does appear that for some reason Dr. Raz's office didn't want the videos released, and Medical Records came up with this cover story. Why wouldn't a doctor want a video of abdominal X-rays released? This is all very bizarre.]

Maura: E. L., are you a contractor?

E. L.: Yes.

Maura: P. M., are you a contractor?

McCray: Yes.


MAYBE I SHOULD ASK THE NATIONAL ENQUIRER TO GET MY RECORDS FROM UCLA; THEY SEEM TO HAVE BETTER LUCK

UCLA hospitals to pay $865,500 for breaches of celebrities' privacy
July 08, 2011
By Molly Hennessy-Fiske
Los Angeles Times

UCLA Health System has agreed to pay $865,500 as part of a settlement with federal regulators announced Thursday after two celebrity patients alleged that hospital employees broke the law and reviewed their medical records without authorization.

...Violations allegedly occurred at all three UCLA Health System hospitals — Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, according to UCLA spokeswoman Dale Tate...The same month, the U.S. Department of Health and Human Services' Office for Civil Rights began investigating alleged violations of the federal Health Insurance Portability and Accountability Act at the hospitals, according to the settlement agreement.

Investigators found that UCLA employees examined private electronic records "repeatedly and without a permissible reason" in 2005 and 2008, including an employee in the nursing director's office, according to the agreement reached Wednesday.

..."Our patients' health, privacy and well-being are of paramount importance to us," said Dr. David T. Feinberg, chief executive of the UCLA Hospital System. "...We remain vigilant and proactive to ensure that our patients' rights continue to be protected at all times."

Access to Doctors' Notes Aids Patients' Treatment

Access to Doctors' Notes Aids Patients' Treatment
By LAURA LANDRO
Wall Street Journal
October 1, 2012

Patients who have access to doctor's notes in their medical records are more likely to understand their health issues, recall what the doctor told them and take their medications as prescribed, according to a study published Monday.

The study, published online in the Annals of Internal Medicine, is the culmination of an experiment known as OpenNotes, an effort to improve doctor-patient communication by letting patients know everything their doctor has to say about them, including after a visit.

Beth Israel Deaconess Medical Center in Boston, Geisinger Health System in Danville, Pa., and Harborview Medical Center in Seattle took part in the trial, which included 105 primary-care doctors and 13,564 of their patients who had at least one note available to them during the voluntary program.

While patients legally have the right to see their entire medical record, including doctor's notes, the notes aren't automatically included in requests for records and doctors don't make it easy for patients to see them, says Tom Delbanco, a primary-care doctor at Beth Israel who is co-lead author of the study and a professor at Harvard Medical School. Some doctors were initially resistant to the idea of sharing notes, he says. According to the study, doctors who declined to participate expressed concerns that their workflow might be disrupted and that they might scare or offend patients.

But the study, based on surveys of doctors and patients taken in fall 2011 after 12 to 19 months of participation, found most fears weren't realized, and patients were enthusiastic about accessing the notes.

Close to 11,800 patients opened at least one note contained in their electronic medical record. Of 5,391 patients who opened at least one note and returned online surveys, 77% to 87% across the three sites reported that OpenNotes made them feel more in control of their care and more adherent to medications...

Parents assail malpractice caps after daughter's death at UCLA hospital

Parents assail malpractice caps after daughter's death at UCLA hospital
Center for Justice and Democracy
Los Angeles Times
JANUARY 22, 2011

Two years ago last week, Olivia Cull, 17, was taken off life support. The standout student — who planned to study classics at Smith College — had slipped into a coma during a routine, outpatient procedure at Mattel Children's Hospital UCLA in Westwood.

The story of her death was presented to Congress a few days ago, among cases cited by patient advocates pushing to lift the caps on damages for medical malpractice lawsuits.

As lawmakers search for ways to trim healthcare costs, debate continues over the country's medical malpractice laws. Physician groups say caps limit frivolous lawsuits that can drive good doctors out of business. But patients and their families argue that limits on payouts diminish accountability, making it hard to find lawyers to take cases and force full disclosure from doctors.

... "It's confusing," Joy Cull said. "I could imagine this happening over and over again because families don't have the resources to find out how their loved one passed away. We had to claw our way through the system."

To get more information, the Culls decided to sue the hospital. But like others, they had trouble finding a lawyer willing to take the case. Given the state cap on damages, they said, many lawyers did not consider their case worth pursuing.

Although doctors groups complain of frivolous malpractice lawsuits, the number of malpractice claims has actually decreased in recent years as families have had difficulty pursuing claims, Joanne Doroshow, executive director of the Center for Justice & Democracy, a New York-based advocacy group, told Congress at a hearing Thursday, the second anniversary of Olivia's death...

Computer medical records stolen from Kaiser and from Sutter Health

After data theft, Sutter Health sued
By The Associated Press
Nov. 22, 2011

SACRAMENTO, Calif. — A group of patients are suing Sutter Health after more than 4 million patient records were stolen.

The Sacramento Bee reports ( http://bit.ly/sKNKT3 ) the class-action lawsuit was filed Monday in Sacramento Superior Court.

The suit alleges the health care provider was negligent in keeping patients' electronic data safe, and in notifying the patients within 30 days of the theft.

A computer containing the data was stolen in October from the Sutter Medical Foundation's headquarters in Natomas. The computer held descriptions of diagnoses, names and addresses.

Plaintiffs' attorney Robert Buccola says the company should have taken far more measures to keep the data safe.

Sutter "deeply regrets the theft," said spokesman Bill Gleeson. He defended the time it took to reach patients, saying Sutter had to figure out what data were stolen.



Computer medical records stolen from Kaiser
By The Associated Press
Jan. 12, 2010

SACRAMENTO, Calif. — Kaiser Permanente says a computer drive containing thousands of patient records was stolen from an employee's car.

Hospital officials said Tuesday the external drive stolen Dec. 1 held data on as many as 15,500 patients throughout Northern California, including the patient's name and Kaiser medical records number.

The records could have also included a patient's sex, birth date, phone number and other medical information.

All of the patients live in the Sacramento area, and Kaiser says they have notified those affected.

Hospital spokeswoman Kristin Chambers says the theft presents a "low risk to our patients."

[Maura Larkins' comment: That sounds just like what they tell people with conditions that are not properly diagnosed. Thousands of those people end up dead.]

The hospital has fired the employee, who was authorized to access the data as part of her work, and says it is unclear why she took the device home.

Information from: The Sacramento Bee, http://www.sacbee.com

My doctor said I was paranoid to doubt medical report--but I was proved right

My primary care doctor, Jae Kyo Lee of Kaiser Permanente in San Diego, said that I was paranoid when I didn't believe that a medical report could be signed three days before it was written. It turned out I was right. My urologist, Dr. Huathin Khaw, had supposedly co-signed a report on June 17, 2011. The report had supposedly been written by Dr. Jay Grimaldi on June 20, 2011. I was also suspicious because the date of the X-ray procedure was wrong and the name of the referring doctor was wrong.

It turned out I was right. The original report had actually been written on June 16, 2011 by a completely different doctor. That's the report Dr. Khaw co-signed. Then somehow large parts of it got erased. NONE of my digitized X-rays were ever made available on the Kaiser server--not even Emergency Room doctor could see them.

Dr. Jae Kyo Lee and Dr. Eugene Rhee told me I should accept the report "because it had my name on it." Why would they both make the same bizarre statement? They must be trained to say that when documents are obviously compromised.

Dave Horton, who is in charge of Radiology and Radiology Files, has refused to respond to a letter and an email. His underlings obediently spout a ridiculous story about my X-rays, taken at the brand new Garfield Specialty Center, having been saved only on thermal paper. But Kaiser's own newsletter says all X-rays at the new center are digitized. Is Kaiser guilty of false advertising? I don't think so. I think they're guilty of covering up incorrect diagnoses.

My digitized X-rays remain "unavailable". Why the cover-up, guys? (Well, I shouldn't say "guys" since Lynette Seid and Mary Ann Barnes have supported the cover-up.) I'd say these folks are a bit paranoid if they're afraid of a few X-rays.