[FROM EPIC ALERT]

     =============================================================
     Volume 2.13                                  October 30, 1995
     -------------------------------------------------------------

 * * *

=======================================================================
[3] Principles for Federal Privacy Protection of Medical Records
=======================================================================

With interest in Washington about the development of real privacy 
protection for medical records, here are preliminary suggestions 
from EPIC for a good medical privacy bill. Your comments are always
welcome.  Please send email to alert@epic.org.

>> Scope

Legislation must cover all  medical information, wherever it is 
collected, stored, processed, transferred or used, no matter the form.
Legal coverage should not be limited to only medical information 
collected in the provision of health care but should include information 
collected for financial, educational, employment, marketing, and other 
reasons. 

>> Patient Access

Patient should have full access to all personally identifiable medical
records. No records should be kept secret. Record keepers should be
required to notify patients that they maintain records. Patients should
have the ability to correct or remove any inaccurate, irrelevant or out-
of-date information. Any card-based data system must allow consumer
access to all personal information contained on the card.

>> Enforcement and Oversight

Substantial criminal and civil fines should be imposed for actual or 
attempted unauthorized access, disclosure, or use of medical 
information.  Individuals should be able to enforce rights and obtain 
damages and related costs in civil court. An independent agency should 
be created to conduct oversight and enforce the provisions of any 
federal medical privacy law.

>> Third Party Access

Third party access to medical records should be strictly limited to a
need-to-know basis.  Law enforcement officials should be required to 
obtain a warrant after showing a compelling government interest for 
each piece of information sought. Civil litigants should have to show a
compelling interest for each piece of information.  Privileged 
communications should never be disclosed. Use of medical information by 
employers or for marketing purposes should be prohibited.  

>> National Databases

The creation of electronic databases of unified clinical records without 
the consent of the patient should be prohibited.  Psychiatric records 
should not be included in any system of electronic records.

>> Research Records

Use of personally identifiable information for research purposes should 
require consent from the individual.  New technologies that create 
pseudo-anonymous records should be used for any personally identifiable 
information.  Research records should not be used for any other purpose 
and should be protected from disclosure by warrant or subpoena. 

>> Security 

Medical information should be protected by the best available physical 
and electronic security. Records in storage or transit should be 
encrypted. Audit trails should track each access to an individuals file.
Access should be limited to data relevant to the matter at hand. 

>> Identification Number

The Social Security Number should not be used as a patient record
identifier.  The number that is used for record identification should
not be used for any other purpose.  Any health care card issued should 
not be used for any other purpose, particularly not for determination
of employment eligibility or for personal identification 

>> Preemption

A federal medical privacy law should set a minimum level of protection 
for medical record privacy. States should be provide to higher levels of
protection given. No state statute should be preempted.