Deborah Peel: The TT Interview

Austin-based national patient privacy advocate Deborah Peel thinks our medical histories are in grave danger. With the emphasis federal health care reform places on expanding electronic health records — and what she calls an institutional disregard for patient consent technology — Peel predicts a future in which people lose jobs or are denied college admission because of their health conditions.

In an interview with The Texas Tribune this week, Peel, the founder and chair of Patient Privacy Rights, explains how practicing Freudian psychoanalysis led her into the patient privacy realm, and what websites like Facebook can teach health care professionals about informed consent.

An edited transcript and an audio excerpt follow.

TT: Talk a little bit about yourself and how you got into the patient privacy field.

Peel: I am a Freudian psychoanalyst, and I’m a psychiatrist. I’ve been practicing for a very long time, since the late ‘70s. I thought I’d be doing that forever, but in the late '90s, the Freudians, all 3,000 of us across the U.S., who are not known for great activism, began to notice what was going on at the federal level. And what I’m talking about, of course, was HIPAA, the Health Insurance Portability and Accountability Act. It doesn’t have privacy in there for the P — it’s portability. So we noticed that Congress, essentially, was beginning to take aim at the very conditions for effective psychotherapy and psychoanalysis, namely privacy. Privacy has always been a critical condition for people’s ability to trust and share very painful or frightening or humiliating or embarrassing thoughts and feelings with us. A comparison I might make is how a sterile field is important for surgery; you can do surgery without it, but it ain’t quality care, and you really put the patient at risk. Now that I’ve been working on this at least 15 years, it’s very clear that the only rights Americans have are to control health information. If we lose these rights here, we’re never going to gain control over everything else that’s out there. I think that’s a serious matter for national debate. If all corporations and the government know everything about us, will we stay a democracy?

TT: Electronic health records have been touted for their contributions to patient safety, to doctor efficiency. You’ve been a constant voice of caution, one some critics allege is overblown. What are the dangers you perceive, and what’s the solution you propose?

Peel: The real dangers are about jobs and discrimination. The use of this information is going to create generations of discrimination if we don’t take care to keep the information away from employers. I’ve spent 35 years listening to how people lost opportunities or their lives were ruined because someone found out they saw a psychiatrist. In my experience, if employers know you’re taking medicine for depression and someone else isn’t, they’re not going to take you. Or if they know you’re taking medication for severe arthritis and someone else isn’t — I mean, that’s just how it goes. On top of the problems with that information leaking out, these [e-health records] systems are unbelievably poorly protected. The security protections are abysmal for the data. What we’re ramping up to do is create thousands and thousands of strangers’ ability to access our electronic information. And the very strong new consumer privacy protections are not being required to be built into these systems up front. It’s stunning to me that the decision-makers, who are primarily industry and people interested in our data, are able to make decisions that take away centuries of our rights. Really, if you want to think about it, they’re taking away the Hippocratic Oath, which is a set of principles that has worked pretty well for 2,400 years.

TT: And your solution?

Peel: The desire to control health information is what the public wants. At a hearing on June 29 in Washington, there was a day-long demonstration of seven different kinds of privacy-enhancing technologies that enable people to give consent to the use and disclosure of their information. There were open-source technologies, there were proprietary technologies, there were some that were just getting started. There were technologies for health information exchanges. They work fine, there’s efficiency, the benefits are there, but the information doesn’t keep flowing endlessly to business associates and strangers and data managers, electronic health vendors and others who patients have no idea can see their user information.

TT: How do you differentiate, then, between protecting data from so-called bad actors and patients withholding data from providers who might negatively affect their care?

Peel: That’s not a new problem. That’s a problem that doctors have always had in the paper world. Just because you’ve got an MD after your name doesn’t mean someone’s going to trust you. Doctors have always had to earn trust. There’s a whole group of people who will never willingly share information, who will never willingly use or make use of what’s on the internet because they know it’s not private. Privacy is in fact essential for quality medicine. But do we ever see the measurement of how private the information is, how much control the patient has, as a quality measure that’s being built into these systems? No, we don’t see privacy as a measure of quality in health care, but it is an important dimension of quality care.

TT: How much privacy are we actually talking about here? Are we saying patients would have to decide which nurses in the doctor’s office get to see their records?

Peel: No, no, no. See, those are the kind of inanities that the data-mining industry brings up. Here’s what happens: When you go to see a doctor, considering you trust him or her, you give them permission to treat you, and if they gain your trust then you’ll disclose information. Now, you don’t have to separately give permission to the nurses because there’s sort of a captain-of-the-ship deal, either in a clinic or a hospital. If you’re in a private office, that health professional is responsible for those people. If any of them screw up, do something wrong, you don’t sue them — you sue the doctor. The same goes in the hospital. Here’s the problem we have. All Americans are supposed to have an electronic health record by 2014, and all of them are being designed for backdoor data-mining, for really an endless number of different kinds of activities. The government is now creating a system that actually violates the rights that we’ve had for centuries.

TT: So your concern is less what’s happening in the doctor’s office and more what could happen on the back end with data-mining?

DP: Yes, it really is. This is why many people are not going to put in electronic health records. They know that if you have it, it’s going to be data-mined. You cannot keep the information private. There’s mandatory reporting from e-health records that the doctors, if you give them the information, they can’t keep it private. Hospitals can’t keep it private. So we now have a situation where the federal government is mandating the elimination of privacy.

TT: Let’s say you don’t give your doctor permission to transfer your records to another specialist, and something awful happens to you — you get sick, you get critically injured. Who, then, is to blame?

Peel: The patient. Here’s the thing, what we need to begin to picture is a future. And the future, if we’re going to have patient-centered care, is that patients will have a very robust electronic health consent tool where they’ll have a series of directives. It could be broad. They could be things like, "Any time I’m seen by any doctor or do anything about my health, I want a copy of that information to go to my medical home, my primary practice doctor, my internist, my gynecologist" — wherever your medical home is. Consent doesn’t have to mean talking to every single person every single time. That’s absurd. It would work very much like consents did in the paper world. They were specific to a health professional or a health care institution. There could also be broad directives like, "I want my family practice doctor to see everything but, you know what, my allergist and my dentist only need to know my medication list or my new medicines or my major changes in diagnosis. They don’t need everything." And if you get pinged for something that’s not covered by a standard directive you could answer on your cell phone or on your laptop. 

TT: And what’s the solution, then, for the segment of the population that’s not internet-savvy or computer-proficient?

Peel: We’re going to have to have assistance for people. We have to help them in the clinics and so forth. We have to truly create real ease of use and usability, and many of the people doing consent tools have done just that. Just within the last week or two I saw some stories about how consents for treatment and procedures have been redesigned electronically so that you have interactive menus. You can drop down and dig into the parts you don’t understand. Technology could be used to make consent an entirely different process, a simple process. If you think about it, Facebook is a beginning consent tool. I know my kids believe they’re able to keep people out. There are consent tools that exist now that are beginning models where people say "Yeah, you’re in," or "No, you’re out." And so we could have really beautiful technology tools that are far superior to the hideous paper consents that we’ve had. There’s a company out of California called Private Access, and to make sure people could understand what was going on, they hired the Disney Pixar people to make it really beautiful and engaging. The truth is, unless we the patients have a single place to set consents in the future, we will never have control over this information, because if you think about it, you probably can’t even count how many health providers you see that have your information.

TT: There are already some health information exchanges up and running in Texas. Have there been problems with those, from an e-health records standpoint? Do you feel like there are proper safety measures in place there?

Peel: Absolutely not. We don’t have privacy and we don’t know of the problems because we don’t have any reporting of the disclosures that are made. Today people have no idea how far their data goes — who’s using it, who’s seeing it and for what purposes. The point really is that people are usually very willing to share information with someone who’s directly involved with them.

TT: Don’t you think the public already assumes their records are being transferred, say, between their primary care doctor and their specialist?

Peel: I don’t think they assume. Physicians have traditionally shared information with other treating physicians with the patient’s permission. And there are many reasons for patients to be in charge of the information. So for example, what if you have a doctor who has made erroneous diagnoses or treated you with medicines that didn’t work or that you thought was not a good doctor? It would be in your own best interest to prevent those records from being sent around. Who has a greater stake in having doctors have accurate information about you than you? And if we can’t prevent this information from endlessly flowing, you know, it’s going to create lots of errors. Now that there are hundreds of thousands of strangers who can see your records, the fastest-growing crime coming out of the electronic health care system is medical identity theft. That’s when someone gets your insurance card number and your name and goes and gets treatment under your name that’s expensive. So into your record goes information that’s not even about you.

TT: Has that actually happened?

Peel: Yes, and it’s incredibly expensive to clear up. The public is really, really aware that in these systems the security stinks and there’s a lack of control. And the awareness is growing. All these systems were built really without any understanding of how valuable the information was or the need for iron-clad, Fort Knox-type security, which is expensive. Your average doctor with a server in the closet can’t pay for 24-hour technology staff to prevent intrusions and data theft. Can any of us? Have we even figured out how to protect our own laptops? I mean, this is really inspiring and confidence building, right? And what I say is, would we even allow a bank that operated like this to have our money? What if the bank’s systems were totally insecure? But we tolerate this in health care.