Proposed Standards for Privacy of Individually Indentifiable Health Information
U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attention: Privacy-P
Room G-322A, Hubert H. Humphrey Building
200 Independence Avenue SW
Washington, D.C. 20201
Dear Assistant Secretary:
The National Vaccine Information Center (NVIC), a national, non-profit, educational organization founded in 1982, represents 30,000 parents and health care professionals concerned about vaccine safety and health care freedom. NVIC has a long public record of consumer advocacy work to institute safety and informed consent protections in the mass vaccination system.
The National Vaccine Information Center opposes the medical privacy regulations proposed by the Department of Health and Human Services and published in the Federal Register on November 3, 1999 as currently written (Standards for Privacy of Individually Identifiable Health Information, 45 CFR Parts 160-164, Rin: 0991-AB08). The proposed regulations exceed reasonable interpretation of the executive branch’s rule-making authority with regard to developing privacy standards for release of individually identifiable health information under the provisions of PL 104-191, the Health Insurance Portability and Accountability Act (HIPAA) passed by Congress in 1996.
Although Congress, through HIPAA , directed DHHS to recommend privacy standards for release of individually identifiable health information in the absence of congressional action, Congress did not direct DHHS to redefine the historic concept of patient-doctor confidentiality and deny American citizens the right to protect personal biological information about their physical, mental and emotional health from government and other third party scrutiny and utilization without their informed consent. The larger impact of DHHS’s proposed medical privacy regulations transcends the issue of medicine, science, and public health and strikes at the heart of individual liberty and the foundation of freedom as we have known it since the US Constitution was ratified in 1787 and amended by the Bill of Rights in 1791.
WHERE DID THE DHHS RULES COME FROM? THE PAST IS PROLOGUE
The proposed regulations have much more to do with government monitoring of biological information on individuals and control of their health care choices than it does with protecting individual privacy. DHHS proposed rules have their roots in the 1993 Health Care Task Force which, with the support of DHHS, sought to restructure the US health care system with a plan to tag Americans with a Unique Health Care Identifier Number in order to track individual personal health information in a government operated electronic database. The idea was to create a national, integrated health care system facilitated with a universal identity card, issued at birth, which would contain a wide array of information about the health status of each individual that could be accessed and monitored electronically by government officials, the health care industry and other interested third parties.
KEEPING THE PLAN ALIVE - VACCINES ARE THE FOOT IN THE DOOR
Although national public opposition to the Unique Health Care Identifier Number, the ID "smartcard" and national electronic medical records tracking system was so strong that eventually the Health Care Task Force officially abandoned the plan, it was partially kept alive by "The Comprehensive Child Immunization Act" introduced in Congress on April 1, 1993. A key provision in the proposed bill directed the Secretary of DHHS to "establish a national system to track immunization status of children." Information obtained on individuals was to be used by government health officials and disclosed to other third parties without the consent of the individual or parent/guardian. DHHS and the bill’s supporters justified the national federally-operated electronic database and vaccination tracking system, which would monitor the vaccination status of citizens even when they moved from state to state, by arguing that the public health and the greater good was being served.
However, once again there was public opposition and the language of the bill had to be modified to eliminate the national federally operated tracking system. In its place, language was later inserted without public notice by the bill’s supporters to authorize $417 million in appropriations so DHHS could create a network of state government operated vaccine registries that would serve as the first step toward achieving the centerpiece of the 1993 Health Care Task Force Plan, which was a national medical records database. The state electronic databases would eventually be linked together to realize this ultimate goal. The law gave DHHS the authority to award federal grants to states to set up electronic vaccine tracking registries for the purpose of enforcing vaccination, with an added financial incentive of being awarded between $50 and $100 per child vaccinated with all federally recommended vaccines.
By the end of 1995, 22 states had either set up or were in the process of establishing electronic vaccine tracking registries and government officials, without the informed consent of parents, were automatically enrolling all children in the state registries, which were electronically linked to the state’s birth registry or birth certificate. One state health department had already begun to use the registries to personally contact parents, whose children were identified in the electronic database as not having received all federally recommended vaccines. In some instances, vaccine manufacturers and private foundations connected to the pharmaceutical industry, such as the Robert Woods Johnson Foundation, augmented federal and state funds used to set up the state vaccine tracking registries.
SOCIAL SECURITY NUMBERS APPROPRIATED TO TAG, TRACK AND TELL
On March 9, 1995, DHHS published a notice in the Federal Register of the intent to establish a new routine use of the Social Security Number, only providing 30 days for public comment. The rule automatically went into effect on April 18, 1995 and the Social Security Administration began disclosing the Social Security Numbers of all newborns to state government officials without the informed consent of parents of the children.
In a report filed with the Chairman, Committee on Government Reform and Oversight on Governmental Affairs of the Senate and Administrator, Office of Information and Regulatory Affairs, Office of Management and Budget on February 28, 1995, DHHS made it clear that states automatically would be sent the Social Security Numbers of all newborns "without having to secure parental consent" and that "public health program uses of the Social Security Numbers would include, but are not limited to, establishing immunization registries."
DHHS explained that the new routine use of the Social Security Number would "facilitate the process and lower the cost of creating and operating a national network of coordinated statewide immunization registries" and maintained that the Privacy Act of 1974 gave DHHS permission to "disclose information about individuals without their consent" to administer DHHS-operated programs, health maintenance programs of other agencies and "for epidemiological and similar research."
DHHS USES PORTABILITY GOAL FOR INFORMATION AND POWER GRAB
Building on the new routine use by federal and state governments of the Social Security Number as a de facto Unique Health Care Identifier Number for the purpose of monitoring individual vaccination and other health status, the 1996 Health Insurance Portability and Accountability Act (HIPAA) furthered the goal that DHHS had long advocated: the creation of a government-operated electronic surveillance and tracking mechanism for monitoring every American’s medical records, using vaccination status as the vehicle. Uniform electronic data element, collection and exchange standards were adopted under HIPAA.
Officials operating the National Immunization Program (NIP) and DHHS argued that HIPAA provisions would allow federal health officials to tag, track and monitor vaccination and other health care status without the individual’s informed consent. In a report entitled "The Interpretation of theNational Immunization Program in the Implementation of P.L. 104-191 (http://www.cdc.gov/nip/registry/kkresponse.html), the NIP stated:
"Any standards…should support the ability of health care workers and public health officials to access appropriately specific and precise health data."
"A current recommendation is for the first dose of hepatitis B vaccine to be given at birth. To record this first vaccination, when it is given in the hospital nursery and to support its ultimate linkage with the immunization registry, either the New Unique Health Care Identifier would have to be assigned expeditiously within a few hours of a request, or a temporary ID number that would ultimately link to the definitive identifier would be needed."
" We see entries in the immunization registries as a small part of what could ultimately develop into more comprehensive clinical and preventive databases."
"State laws intended to ensure privacy have presented barriers to immunization registries in some areas. Preemptive federal legislation is needed to ensure appropriate privacy while allowing participation in registries that protect the public by reducing disease. It is not clear that signed consent by the patient is necessary…."
DHHS EXCEEDED ITS CONGRESSIONAL MANDATE
HIPAA provided that, if Congress did not enact legislation to create standards to protect individually identifiable health information in electronic medical records, then the Secretary of DHHS was authorized to recommend rules governing how much information the government and other third parties can get out of private medical records without an individual’s informed consent. However, in the absence of congressional action, HIPAA did not direct DHHS to propose rules which:
destroy patient-doctor confidentiality and privacy protections which have existed for centuries in the practice of medicine;
wrest control from the people and their doctors over personal health care choices and sensitive biological information about an individual’s physical, mental and emotional health, placing it in the hands of government officials and other third parties without the individual’s prior informed consent;
create a national, government operated electronic medical records database, against the will of the majority of the American people, which will necessitate the assigning of a Unique Health Care Identifier Number to every citizen without their informed consent for the purpose of tagging, tracking and monitoring biological information on individuals and their health care choices;
give federal and state police access to every American’s personal medical records containing sensitive information about an individual’s physical, mental and emotional health without first obtaining informed consent from that person or the parent/guardian of that person, which could reasonably be interpreted as violating the Fourth Amendment to the Constitution which states "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
force individuals, without their informed consent, to divulge extremely private medical, genetic and other biological information about their or their children’s physical, mental and emotional health to government officials, scientific researchers and other third parties, who may profit personally or professionally from knowledge of that information, which could reasonably be interpreted as violating the Fifth Amendment to the Constitution stating: "nor shall any person…be deprived of life, liberty or property, without due process of law; nor shall private property be taken for public use, without just compensation."
without their knowledge or informed consent, enroll individuals in medical and scientific research conducted by government health officials, private researchers and other third parties, thereby violating the Nuremberg Code which has been internationally accepted as the bioethical standard for preventing human rights abuses in medical research;
In these "privacy" regulations, DHHS boldly proposes not only to erode but to prohibit the obtaining of informed consent from individuals to have their private medical information shared with government officials and other third parties. In the proposed regulations, DHHS states:
"We also propose to prohibit covered entities from seeking individual authorization for uses and disclosures for treatments, payment and health care operations unless required by State or other applicable law."
In the proposed DHHS regulations, "covered entities" include a multitude of third parties inside and outside of government, including numerous government agencies, health plan insurers, doctors, hospitals, scientific researchers, medical students and police if these individuals are involved in public health activities; medical research; legal proceedings; the operation of government electronic health databases; banks processing health care payments and premiums; and the military. To protect individual privacy and informed consent rights, citizens in each state will have to try to pass state legislation which would be opposed by government health officials and lobbyists for all of the "covered entities" listed in the DHHS proposed rules.
Furthermore, the DHHS proposed rules prohibit individuals from suing any third party entity who violates the minimal informed consent provisions which do apply under these proposed rules, handing over that civil right to government officials. As DHHS officials have already made it clear in the proposed rules that they want to minimize informed consent protections for individuals, predictably this power will be rarely exercised and individuals will have no realistic legal recourse for release of private medical information to other third parties without prior informed consent.
SCIENTIFIC RESEARCH WITHOUT INFORMED CONSENT
Perhaps the most serious example of DHHS’s gross overestimation of the scope of its rule making authority in developing "privacy" safeguards for individuals is when DHHS proposes to virtually abolish the central ethical premise governing medical/scientific research on humans: the inviolability of individual autonomy and the human right to informed consent to be included in medical or scientific research.
DHHS states in section 164.510:
"We propose to permit covered entities to use and disclose protected health information for research without individual authorization, provided that the covered entity receives documentation that the research protocol has been reviewed by an Institutional Review Board or equivalent body – a privacy board – and that the board found that the research protocol meets specified criteria (regarding protected health information) designed to protect the subject."
The DHHS rules create an elite class of citizens from the scientific and medical community, through an "Investigational Review Board" or its equivalent, whose members "have appropriate expertise for review of records research protocols" and who will have the power to decide which American citizens will have biological information on their physical, mental and emotional health used in scientific and medical research without their informed consent. DHHS justifies this abrogation of individual informed consent rights in cases where, says DHHS, "the public interest in the research outweighs the individual’s privacy interest…"
In so doing, federal government employees have assigned to themselves or their designees the power to decide what kind of scientific and medical research is in "the public interest" and justifies violating an individual’s privacy and informed consent rights. No longer will American citizens have the right to withhold their consent to be used by government, private researchers or other third parties for purposes with which the individual may not agree or could ultimately result in harm to the individual or society.
In cavalierly abolishing the individual’s right to informed consent to participate in medical or scientific research, DHHS demonstrates an arrogant disregard for the spirit and intent of the U.S. Constitution as well as the central ethical premise defined in The Nuremberg Code. Promulgated by the Nuremberg Tribunal after The Doctor’s Trial in 1947 and adopted internationally as the gold standard for protecting individual inviolability during medical or scientific research, the Nuremberg Code (as well as the Helsinki Declarations adopted by the World Health Council in 1964) clearly require all researchers to obtain explicit prior informed consent from individuals to include them in medical and scientific research.
THE NUREMBERG CODE AND HUMAN RIGHTS ABUSES
The first principle of the Nuremberg Code states:
"The voluntary consent of the human subject is absolutely essential. This means that the person involved should have legal capacity to give consent; should be so situated as to be able to exercise free power of choice, without the intervention of any element of force, fraud, deceit, duress or overreaching, or other ulterior form of constraint or coercion; and should have sufficient knowledge and comprehension of the elements of the subject matter involved as to enable him to make an understanding and enlightened decision."
Nowhere in the Nuremberg Code, which has been used since World War II as the informed consent standard which insures the ethical practice of medicine, does it suggest that an elite group of physicians and scientists within or outside of government should decide when, why and for what purpose an individual deserves to have his or her privacy invaded and the human right to informed consent to participate in medical or scientific research taken away. The utilitarian pseudo-ethic, which DHHS is embracing in its proposed rules, was rejected by the Nuremberg Tribunal for good reason: it is immoral for the State to justify any public health program or government policy with the utilitarian rationale that individuals can have their privacy and autonomy sacrificed for what the State has determined will benefit the majority.
The recommendation by DHHS that government employees or their designees should be allowed to decide when and for what purpose individual privacy and autonomy can be sacrificed in the name of the greater good is a fatal erosion of the concept of individual liberty defined in the US Constitution and the Bill of Rights. It sets the stage for medical research in the name of the public health which, no matter how well meaning or desirable the goals may appear to be, will sacrifice fundamental human rights in order to facilitate that research.
This cannot be allowed to happen under any circumstances in a free society that respects human life and liberty. No public health program or scientific research should ever be used to take away the individual’s human right to informed consent to undergo a medical procedure that could harm that individual or to participate in medical and scientific research which may or may not benefit that individual or society.
CONTROL OF SCIENTIFIC RESEARCH
Under the proposed DHHS rules, government employees and other selected third parties will be privy to and in control of biological information on individual Americans which can be accessed for medical research purposes. Independent scientific researchers, who propose medical records research that could potentially reflect negatively on existing government health policy (such as vaccine adverse reaction research) or affect the reputation or economic viability of other third parties (such as pharmaceutical companies, HMO’s or government health officials), could well be denied access to or be forced to pay prohibitively large sums for individually identifiable biological information on citizens held and controlled by government health agencies.
The use and control of biological information on all citizens by government officials and other selected groups of people within society will threaten the ability of independent-minded researchers to do unbiased research. This fact could also put the public health in jeopardy if (1) the truth about the potential harm of an existing public health policy is not subjected to informed consent protections for individuals included in research involving the policy in question; or (2) the personally identifying biological information used in medical research conducted by select groups of people, such as government health officials, is shielded from outside scientific and public scrutiny.
A FATAL BREACH OF TRUST
The broad erosion of privacy and informed consent rights of individuals proposed by DHHS under the guise of protecting medical records privacy and facilitating electronic medical records administration by third parties, will have the larger effect of facilitating a fatal compromise of the fragile trust between patients and their private physicians. Like public health officials, private physicians will become, in effect, agents of the State, enforcing government health policy and facilitating electronic tracking of citizens, rather than physicians whose first duty is to do what is in the best interest of their individual patients.
The specter of doctors prescribing a new drug, vaccine or medical procedure, not primarily for the benefit of the individual child or adult patient, but because that doctor knows the individual’s medical records could be used in research supported by government, HMO’s or pharmaceutical companies for purposes an IRB has judged to be "in the public interest," is a specter that does not instill confidence in the future of American health care. The pressure on doctors to conform to government and HMO health policy, including government, HMO or drug company-inspired research, would be heightened under the proposed DHHS rules because they remove from the doctor the duty to obtain prior informed consent from individual patients to participate in medical research.
As families search for ways to avoid being subjected to intrusive government medical research or monitoring and control of their health care practices, the fragile trust between American doctors and their patients will become tragically and irretrievably broken. Trying to protect biological information, including genetic information, about their physical, mental and emotional health (and that of their children), from government and other third party scrutiny without their knowledge or consent, Americans could well withhold information from doctors or avoid seeking health care altogether. Understandably reluctant to have biological information about themselves or their children used in medical research without their informed consent, others may seek out health care providers who keep no electronic medical records and accept cash rather than participate in health insurance plans. Some may travel to other countries to patronize doctors who protect their privacy and health care choices. The proposed DHHS rules will forever change the trusting relationship that has existed between the American people and their doctors.
THREATS AND SANCTIONS WHEN POLICY PRECEDES SCIENCE AND GOVERNMENT OFFICIALS REJECT INFORMED CONSENT RIGHTS
The National Vaccine Information Center has been interfacing for the past 18 years with parents, including parents of vaccine injured children; doctors; federal and state health officials; vaccine manufacturers; state legislators; consumer organizations, the US Congress and journalists about vaccine safety. Because our mission is to prevent vaccine injuries and deaths through public education and defend the informed consent rights of all citizens, we have a long public record of working to institute safety and informed consent protections in the mass vaccination system.
Part of our work has centered on requesting wider public access to scientific and medical documentation used by federal health agencies to promulgate mandatory, mass vaccination policies. Challenging the one-size-fits-all approach to mass vaccination, we have called for well designed scientific research to fill the vacuum or knowledge that exists regarding the biological mechanism of natural and vaccine-induced immunity, as well as vaccine-induced injury and death, in order to find answers to outstanding questions about vaccines and develop screening techniques to identify individuals at genetic and other biological risk for suffering vaccine reactions. We have also advocated examination of the adequacy of new vaccine licensing standards; modification of existing vaccine policies to make them safer; and the strengthening of informed consent protections in mandatory vaccination laws.
Public challenge to the quality and quantity of scientific documentation of vaccine safety and the ethical foundation of government vaccine policies, has placed American citizens in direct confrontation with government health officials and physician organizations defending existing science and policy. A growing number of parents, who are becoming educated vaccine consumers because they want to make better informed vaccination decisions for their children, are encountering stiff resistance from public health officials determined to protect the status quo rather than acknowledge the need for a more balanced and humane approach to implementing national vaccination programs.
The National Vaccine Information Center has been contacted by an increasing number of parents living in fear of the growing power of federal and state government officials who:
deny the public access to scientific and medical information about vaccine safety and efficacy used by government officials to mandate vaccines for children and make national vaccine policies;
enroll babies in experimental vaccine research in collaboration with pharmaceutical companies and health care insurers without adequate informed consent protections for parents;
charge parents with child medical neglect if their children have not been vaccinated according to government policy;
refuse to honor medical exemptions to vaccination written by private doctors for children, who have suffered previous vaccine reactions or have health conditions the doctors believe put the children at risk for vaccine reactions;
harass private doctors for giving children medical exemptions to vaccination that are not in accordance with government policy, even though it is the doctor’s opinion that the children are at risk for suffering vaccine-induced immune or neurological dysfunction;
refuse to accept religious, philosophical or conscientious belief exemptions to vaccination and bar children from getting an education if parents can’t show proof their children have received every government endorsed vaccine;
seek to professionally ruin health care providers who speak out about vaccine safety concerns, especially those engaging in complementary or alternative health care;
economically penalize families enrolled in government entitlement programs if their children have not been vaccinated according to government policy;
deliberately violate state laws giving parents the right to prior informed consent to have their children participate in state electronic vaccine tracking registries;
Private doctors are given financial incentives and/or may experience sanctions from health maintenance organizations depending upon how many children in their practice are vaccinated according to federal policies. Some doctors refuse to report health problems following vaccination to the Vaccine Adverse Events Reporting System (VAERS) or try to force parents revaccinate children, who have had previous vaccine reactions even though the children could suffer more serious health problems after re-vaccination. Parents have reported to us that doctors are denying medical care to children, who do not receive every federally recommended vaccine, and health insurers are turning down partially vaccinated children for health insurance. In some cases, parents have been turned into government social service agencies for child neglect when emergency room hospital personnel discover children presenting for emergency medical care have not been vaccinated with every federally recommended vaccine.
A national, federally operated electronic medical records database in which Americans are tagged with a Unique Health Care Identifier Number and automatically enrolled, without informed consent of the individual or parent/guardian, will exacerbate these kinds of excesses at the hands of misguided doctors and government officials placing strict enforcement of government health policy ahead of individual health, privacy and inviolability. Once the national, federally operated electronic database mechanism is in place and tracking all citizens, vaccination policy may not be the only government policy used to justify individual expendability to achieve public policy goals.
PUBLIC HEALTH POLICY VS. INDIVIDUAL AUTONOMY
The philosophical justification that DHHS repeatedly uses to limit individual privacy and informed consent rights is that individuals can be required to participate in public health programs, research or health care decision-making if it is defined by government as "in the public interest." It should not be forgotten, however, that human rights abuses have occurred in science and medicine when individual privacy and autonomy have been sacrificed for what government officials have decided is "in the public interest."
Dangerous medical research on individual American citizens without their informed consent is not without precedent, as has been documented in the history of the Tuskegee Syphilis Study exploiting African Americans in the 1930’s; the toxic vaccine and drug research using children and adults in orphanages, mental institutions and prisons in the 1940’s; the Cold War radiation experiments involving children, pregnant women and adults in the 1950’s, 60’s and 70’s; the experimental EZ measles vaccine trials on Los Angeles inner city children insured by Kaiser Permanente in the early 1990’s; and the most recent gene therapy research, among others. Virtually all of this medical research was endorsed by government health officials to improve the public health and welfare.
The war on disease and disability is a noble one but should not be fought without ethical and legal limitations. Although in Jacobson v. Massachusetts the 1905 Supreme Court permitted states to pass laws requiring citizens to be vaccinated against smallpox, the justices warned that vaccination must not be required when it could cause harm to a person, making it "cruel and inhuman to the last degree." It is doubtful those turn-of-the-century judges envisioned that one day a renowned American jurist, Oliver Wendall Holmes, would use Jacobson v. Massachusetts to justify the state-forced sterilization of a mentally retarded woman in order to protect the public health and welfare. Writing for the majority in a 8-1 Supreme Court decision, Buck v Bell (1927), Supreme Court Justice Holmes said:
"The principle that sustains compulsory vaccination is broad enough to cover cutting the Fallopian tubes."
Once the lines between public health policy and individual autonomy become blurred with government health policy taking precedence, the descent down the slippery slope has begun. The medical privacy rules that DHHS has recommended will make this slope very easy to slide down and those most vulnerable to human rights abuses in the name of the greater good will be those populations which have always been most vulnerable: the poor, the uneducated, the very young, the elderly, the mentally and physically disabled, the incarcerated, the acutely or terminally ill, military personnel, minorities, or any citizen whose ability to function in society is dependent upon conformance with government policy.
SUMMARY AND RECOMMENDATIONS:
American citizens have the constitutional and human right to protect biological information about themselves and their children, as well as information about their health care choices, from government or other third party scrutiny, utilization and control unless explicit, prior informed consent has been given. Just because unprecedented advances in computer technology enable government to be privy to personal biological and medical information on every individual does not mean that government has the ethical or legal right to access it without the informed consent of every individual. The public health was not in jeopardy before computer technology became available and it will be not be jeopardized if that technology is not used to track the health care status and choices of all Americans.
No public health program, government policy or medical research, however well intended, should ever sacrifice the constitutional right to privacy or the human right of individuals to make informed, voluntary health care decisions which affect their biological integrity and, ultimately, their very existence.
The National Vaccine Information Center maintains that any rules governing medical records privacy should include informed consent and privacy protections that:
require individuals or their parent/guardians to give prior written informed consent to be included in any electronic medical records or vaccine tracking registry system or in scientific and medical research;
require individuals or their parent/guardians to give prior written informed consent to have biological and other information in personal medical records shared with third parties such as public health officials or other federal or state government officials; police; health plan insurers; medical researchers or others;
prohibit government officials or other third parties, such as health plan insurers, from administering economic or other sanctions against individuals or their parent/guardians for refusing to participate in electronic medical records/vaccine tracking registries, medical research or sharing of personal medical information about their physical, mental or emotional health with third parties;
protect the individual’s private right of action in court for invasion of privacy;
protect the supremacy of state laws regarding the informed consent and medical records privacy rights of individuals.
Sincerely,
Barbara Loe Fisher
Co-founder & President
