Even opt-in doesn't protect data exchange privacy

The healthcare industry still has room for improvement when it comes to health information exchange privacy, even in states that have an opt-in or opt-out option, according to a recent article from Bloomberg News.

Although not all states are required to tell patients if their medical data is being used, even those that do so aren't necessarily doing a good job, according to the article. In New York, for example, a state with an opt-in option for patients, studies published in March by the state's civil liberties union and the Consumers Union determined privacy "rules of the road" to be undefined, patient education efforts to be weak, and the opt-in effort to be too broad. As it stands, a one-time opt-in allows "blanket permission" by providers to release all medical information.

What's more, many exchanges are likely to be targets for data thieves, considering that medical providers are hacked more often than any other organization, according to Privacy Rights Clearinghouse statistics cited in the article. A report published last December by PRC found three of the six worst data breaches in 2011 occurred in healthcare.

Still, the article does outline some of the benefits of HIEs. For instance, it shares the story of a chronically ill elderly woman who was able to be diagnosed quickly by doctors when she thought she might be having a heart attack.

However, many patients remain unconvinced by such benefits. One of those, Victor Hand of Maine, who spoke with Bloomberg News, was more concerned with insurance companies, marketers and drug companies getting a hold of his information than getting timely care. "If I knew for sure that nobody could get it but my doctors, then maybe I'd participate," Hand said. "But there's no way to guarantee that."

To learn more:
- here's the Bloomberg News article