PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Medical and Workplace Privacy Michael I. Shamos, Ph.D., J.D. Institute for Software Research International Carnegie Mellon University

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Outline Medical privacy stakeholders: –patient –heath care provider –insurer –federal government –(sometimes) employer –What is the basis for privacy? Workplace privacy stakeholders: –employee –employer –basis for privacy?

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS U.S. Privacy Law Privacy law is a patchwork of state and federal statutes and judicial decisions The Federal government has limited powers to protect privacy –“Interstate commerce” (Federal Trade Commission) There are three Federally protected categories of personal data: –financial (Gramm-Leech-Bliley) –educational (FERPA) –medical (HIPAA) Plus some narrow protections, e.g. video rental data

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Cliff Notes Version of HIPAA Covered Entities (healthcare providers, health plans, insurance companies, healthcare clearinghouses) May Not Use or Disclose Protected Health Information (PHI) Except with the Written Consent or Authorization of the Employee Or Unless Required or Permitted by Law or to the Minimum Extent Necessary or Allowed to Accomplish the Purpose of Treatment SOURCE: LITTLER, MENDELSON

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Protected Health Information (PHI) Information created or received by a health plan or healthcare provider; and Relates to the condition or care of an individual; or Relates to the payment for care; and Permits identification of the individual (or creates a reasonable basis upon which to identify the individual) 45 CFR § CFR § SOURCE: LITTLER, MENDELSON

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS HIPAAHIPAA: Health Insurance Portability and Accountability Act of 1996 A covered entity may not use or disclose protected health information, except as permitted or required … –pursuant to … a consent … to carry out treatment, payment, or health care operations –pursuant to … an authorization –pursuant to … an agreement (opt-in) –[other provisions] 45 CFR § CFR § Health information that meets … specifications for de- identification … is considered not to be individually identifiable health information 45 CFR § (d) 45 CFR § (d) Compliance deadline was April 14, 2003 REGULATIONS

De-Identification A covered entity may determine that health information is not individually identifiable only if: … the following identifiers of the individual or of relatives, employers, or household members of the individual are removed: Names; All geographic subdivisions smaller than a State, including street address, city, county, precinct, zip code, …, except for the initial three digits of a zip code if … All elements of dates (except year) for dates directly related to an individual, including birth date, admission date, discharge date, date of death; and all ages over 89… Telephone numbers; Fax numbers; addresses; URLs; IP addresses Social security numbers; Medical record numbers; Health plan beneficiary numbers; Account numbers; Certificate/license numbers; vehicle identifiers, serial numbers, plate numbers; Device identifiers and serial numbers; Biometric identifiers, including finger and voice prints; Full face photographic images and any comparable images; and Any other unique identifying number, characteristic, or code; and The covered entity does not have actual knowledge that the information could be used alone or in combination with other information to identify an individual who is a subject of the information. 45 CFR §

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Wrongful Disclosure Under HIPAA A person who knowingly … uses or causes to be used a unique health identifier; obtains individually identifiable health information relating to an individual; or discloses individually identifiable health information to another person, shall be fined not more than $50,000, imprisoned not more than 1 year, or both; if the offense is committed under false pretenses, be fined not more than $100,000, imprisoned not more than 5 years, or both; and if the offense is committed with intent to sell, or use information for commercial advantage, or malicious harm, be fined not more than $250,000, imprisoned not more than 10 years, or both 42 U.S.C. §1320d-6 BUT: no private lawsuit

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Genetic Privacy Federal Executive Order (Clinton) –“Nondiscrimination in Federal Employment on the Basis of Protected Genetic Information” State –Cal Gov Code § (Unlawful employment practices) It shall be an unlawful employment practice … for an employer... to subject, directly or indirectly, any employee, applicant, or other person to a test for the presence of a genetic characteristic. –Cal Gov Code § (Test for genetic characteristic) No insurer shall require a test for the presence of a genetic characteristic for the purpose of determining insurability other than for those policies that are contingent on review or testing for other diseases or medical conditions SOURCE: KARL MANHEIM, LAWRENCE SLOCUM

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Employee Polygraph Protection Act Make it illegal for an employer in interstate commerce to require an employee or prospective employee to take a lie detector test to use the results of a lie detector test to use the refusal to take a test to discharge the employee Exceptions: –governments –employer investigations of theft where the em,oyer has reasonable suspicions the employee was involved –security personnel 29 U.S.C. § U.S.C. §2002

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS O’Connor vs. Ortega, 480 U.S. 709 (1987)480 U.S. 709 Search warrants not needed by employers Executive director O’Connor of a public hospital suspected Dr. Ortega of management improprieties Search his office and found incriminating evidence Was his expectation of privacy violated? Reality of workplace may vitiate some expectations Standard of “reasonableness” is sufficient for work- related intrusions by public employers 5-4 decision by the Supreme Court

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Skinner vs. Railway Labor Executives Assoc., 489 U.S. 602 (1989)489 U.S. 602 Federal Railroad Administration (FRA) implemented regulations requiring mandatory blood and urine tests of employees involved in certain train accidents Expectations of privacy by employees engaged in an industry regulated to ensure safety are diminished Testing procedures pose only limited threats Rights of the individual are superseded by the rights of the organization to conduct business. Government's interest in assuring safety on the nation's railroads constitutes a “special need” SOURCE: CAYLEN TICHENOR

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS U.S. vs. Simons, 206 F.3d 392 (4 th Cir. 2000)206 F.3d 392 Simons was a subcontractor to the CIA. Agency policy stated: –employees could use Internet for official government business only –Accessing unlawful material prohibited –Agency would conduct electronic audits to ensure compliance Firewall detected queries containing “sex” from Simon’s computer Simons’ office and computer were searched; child porno found; Simons tried and convicted Employee cannot maintain expectation of privacy when there is a monitoring policy in place.

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Computer Surveillance In general, surveillance by the employer is legal if –the computer being monitored belongs to the employer; or –the computer is connected to the employer’s network; and –even if communications are encrypted McLaren v. Microsoft Corp., No (Tex. Ct. App. May 28, 1999).McLaren v. Microsoft Corp –Employee used private password to encrypt messages stored on office computer. –Company decrypted and viewed files. – account and workstation were provided for business use, so Microsoft could legitimately access data stored there. Notice of Electronic Monitoring Act (CT) –Versions introduced in other states and Congress

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Office Snooping? Doe v. SEPTA, 72 F.3d 1133 (3d Cir. 1995)72 F.3d 1133 Doe (not identified in the case) was awarded $125,000 when his co-employees learned from his prescription records he has being treated for AIDS Appeals court reversed The information was learned in a routine audit of the company’s health plan for fraud, drug abuse, and excessive costs No prohibition against employers making use of medical records in employment decisions All co-employees had a “need to know”

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Phone Calls and Omnibus Crime Control Act of 1968 prohibits monitoring of employee phone calls unless –it occurs in the regular course of business; or –the employee consents to the monitoring 1986 Electronic Communications and Privacy Act –Allows employers the same access to employee s on the job –If employees are informed that their s can and will be monitored there is no reasonable expectation of privacy

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Tiberino v. Spokane County 13 P.3d 1104 (2000) 13 P.3d 1104 Gina Tiberino worked for Spokane County, WA She misused her office computer for personal and was fired She threatened to sue; Spokane printed out her (551 messages; 467 were personal) The media requested copies Tiberino sued to prevent disclosure Held, the s were “public records” but the contents were exempt from disclosure. The fact of the s, not their contents, were of public interest

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Q A &

Texas Privacy Laws Texas Health and Safety Code § Texas Medical Privacy Act Texas Labor Code –HIV –Genetic testing

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Texas Medical Practices Act Prohibits access to computerized records of a “confidential communication” between a physician and patient –Without consent –Authorized purposes –May be released if relevant to civil action for monetary damages

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Passage of HIPAA in 1996 At the time of the passage of HIPAA there was no federal protection for the privacy of medical records except for: –Privacy Act of 1974 Does not cover records held by private entities –Americans with Disabilities Act Does not cover the nondisabled or the disabled in many situations Doe v. Septa case is a real eye-opener

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Future Privacy Issues –In the future, medical privacy is only going to get more difficult to secure There is a trend toward larger and larger medical databases of computerized medical records –Computerized records radically lower the costs of acquiring, storing, and integrating medical records –DNA testing probably has the greatest potential for treatment breakthroughs –DNA results in the medical records could have more damaging effects on future insurability and employability

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Need For Reform Much of HIPAA is devoted to the privacy of medical records –Since HIPAA was passed the issue of health insurance portability has receded while concern about privacy of medical records has increased Federal government is dealing with privacy issues on several fronts, most notably, on the Internet

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS HIPAA-Mandated Rule When HIPAA was passed it was anticipated that Congress would enact privacy legislation –Congress was given until August 21, 1999 –That deadline came and went and HHS was required to promulgate its own regulations –These regulations became law in April of Actual implementation is scheduled to take place in phases several years from now--a minimum of 2 years

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS HIPAA Rule: Goals of HHS The goals of HHS HIPAA Regs. are an adaptation of the FTC Fair Information Principles –Allow for free flow of medical information to promote treatment, payments, and healthcare operations –Prohibit secondary uses of medical information unless authorized by the subject of the info –Allow individuals access to their own records and give them an opportunity to correct errors

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Goals of HIPPA Regs. Continuing with the goals of the HIPAA Rule: –Allow individuals to know who is using their health information and how it is being used –Require persons who hold identifiable health information to safeguard that information from inappropriate use or disclosure –Hold those who store health information accountable for their handling of the information

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Rules of Thumb –HIPAA limits jurisdiction of HHS Rule to “covered entities” Healthcare providers, health plans (insurance companies are included), and healthcare clearinghouses HHS laments its lack of ability to totally control electronic transfer of health information HHS develops the “business partner” concept for those that receive medical information from a covered entity

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS HIPAA Rules Protected healthcare information could be transferred within covered entities without authorization of the patient if –The transfers were for the purpose of facilitating treatment, payment, or healthcare operations –Special protections are provided for notes of psychotherapist

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS HIPAA Rules –Other transfers of health information would require authorization of the patient except if: The transfer of information fell into one of 12 designated categories: Oversight of the healthcare system, public health, medical research, law enforcement, emergency situations, government health data systems, financial payment plans through banks that facilitate credit cards, and where state law requires disclosure

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Workplace Privacy Governmental employer: O’Connor v. Ortega –Balance right of employee to privacy against employers’ needs for supervision, control and the efficient operation of the workplace Private employer –Use same balancing test Nardinelli et al., v. Chevron: harassing s Blakey v. Continental Airlines: bulletin board offsite Michael A. Smyth v. Pillsbury Company: employee’s McLaren v. Microsoft: employee’s having password did not give him protection SOURCE: WEST LEGAL STUDIES

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Impact of the ECPA on Workplace Privacy Robert Konop v. Hawaiian Airlines –Posted messages on his password-protected bulletin board –One of his users with a password gave the password to a third party –Third party went online and viewed Robert’s BB Ct.: no violation of Title I, no interception Violation of Title II, not authorized use to give password to third party SOURCE: WEST LEGAL STUDIES

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Workplace Privacy Needs of the business outweigh the privacy of the individual. Burden of proof is on employee. Must prove “invasiveness.” If there is no “reasonable expectation of privacy” there is no fourth amendment protection. SOURCE: CAYLEN TICHENOR

PRIVACY POLICY, LAW & TECHNOLOGY FALL 2004 COPYRIGHT © 2004 MICHAEL I. SHAMOS Employer Eavesdropping Employers cannot eavesdrop on private phone calls. Federal law does allow unannounced monitoring for business related calls. If employer provides notice of monitoring and that communication systems shall be used for business purposes only monitoring of voice mail and is permissible. SOURCE: CAYLEN TICHENOR