Right on Target: Clinton health data proposal calls for patient opt-in

For once, the Direct Marketing Association and the Clinton administration see eye to eye.

In October, President Clinton proposed strict regulations protecting medical privacy. Only days before that, the DMA’s executive board approved guidelines for the collection and transfer of health-related data.

Both proposals say that most medical information should not be transferred to third parties without permission.

Clinton’s measures would prohibit release of medical information contained on computers without the patient’s written consent unless it concerns treatment or payment. Banks and credit card issuers would not be able to access treatment information when handling payments.

Violators who improperly disclose personal information would be subject to civil and criminal penalties.

Issued by Human Services Secretary Donna Shalala, the proposal would also give patients the right to see – and correct mistakes in – their medical records. And it would prohibit use of the records by law enforcement agencies without a warrant or a court order.

Blown Deadline

Congress failed to meet a self-imposed Aug. 21 deadline for legislating new protections, throwing the ball into Clinton’s and Shalala’s court.

Clinton singled out marketers and employers as the biggest offenders when it comes to unauthorized access to health records. Invoking the specter of George Orwell’s Big Brother, he added, “Every American has a right to know his or her medical records are protected at all times from falling into the wrong hands.”

Clinton said lawmakers should still pass legislation to cover records kept on paper.

Despite general agreement among privacy advocates that a federal law is needed, Clinton’s proposal did not draw universal applause.

“It’s an improvement over what Congress has imposed, although it is not as strong as necessary to protect consumer privacy,” said Robert Ellis Smith, publisher of the Privacy Journal, Providence, RI. But Smith added, “It is an improvement over the administration’s proposal a year ago which had a major weakness, granting law enforcement unfettered access to that information.”

Privacy advocates also complained that the proposal fails to protect psychiatrists’ notes on patients. And they argued that paper records should be protected.

Common Ground

The new DMA guidelines mirror the Clinton proposal, at least in part. They state, for example, that information cannot be transferred to a third party without the individual’s prior consent, a clear departure from the DMA’s usual preference for opt-out.

In an interview, DMA president H. Robert Wientzen said that patient-doctor information deserves “a higher degree of protection. It cannot be transferred without the express permission of the consumer.”

But notification and opt-out are sufficient when a healthcare provider is using its own customer data for marketing purposes, or using data gathered or inferred outside the customer relationship, according to the new guidelines, Wientzen said.

“We’re trying to be ahead of the curve,” Wientzen added. “The guidelines were rewritten more times than anything we’ve done since I’ve been head of the DMA.”

DM lobbyists are happy with the banking industry overhaul agreed to last month by Congress and the White House. The bill, which overturns Depression-era laws, would allow banks, insurance companies and securities firms to enter each other’s businesses.

But the privacy measures included in the bill have already drawn fire from consumer advocates and small bankers.

Essentially, the bill provides for “notice and opt-out for transfer of data to third parties,” said Jerry Cerasale, senior vice president for government affairs at the Direct Marketing Association. “That’s straight [from the] DMA guidelines.”

Although the DMA was unclear at press time on the extent and wording, the industry apparently lost on one provision: Banks will be prohibited from distributing bank or charge account numbers to third parties in encrypted form. “We wanted to allow that to facilitate direct marketing,” Cerasale said.

Despite these measures, privacy advocates fear the creation of vast data pools about consumer borrowing and other financial activity. Consumers Union complained that consumers will not be able to prevent firms from sharing personal information with affiliates, according to Reuters.

The future debate may center on the definition of the word “affiliate.”

The bill exempts data flows to credit reporting agencies, said Marty Abrams, vice president for information policy at Experian.

Some trade groups are also unhappy with the provisions.

“Community banks, which are already most sensitive to their customers’ privacy, again are being asked to a carry a disproportionate regulatory burden,” said the Independent Community Bankers of America in a statement. “These burdens are not imposed on information sharing among affiliates of the new financial conglomerates.”

The bill has also drawn its share of praise. Cerasale called it “a significant marketing opportunity for banks,” and said that it should lead to a DM increase.

For the first time, banks will be allowed to pursue securities underwriting and enter other areas through operating subsidiaries.

Hjalma Johnson, president of the American Bankers Association, noted in a statement that “…banks and other financial institutions have been forced to operate under the legal equivalent of the rotary phone.”

The bill, which had not yet been signed by negotiators at press time, awaits a final vote by the House and Senate and signature by President Clinton. It repeals sections of the Glass-Steagall Act, which was passed at the outset of the New Deal in 1933.