In a step forward for patients’ privacy rights, the ACLU today announced the favorable settlement of a lawsuit it had filed against the RI Department of Health in 2010, challenging the adequacy of rules the agency had adopted to implement a centralized database of patient health care records. The Health Information Exchange (HIE), authorized by the General Assembly in 2008, allows medical personnel to routinely access a patient’s entire medical file, including mental health records and other sensitive medical information.
When the DOH first adopted regulations to implement the HIE, the ACLU objected that they provided virtually no details as to how the system would actually work, or how it would protect the privacy, confidentiality and informed consent interests of patients. At the time, the DOH responded that those issues would be dealt with through internal “policies” that would not be subject to the public notice and comment requirement that agency regulations must normally undergo.
The ACLU’s lawsuit, filed in R.I. Superior Court by volunteer attorney Frederic Marzilli, argued that the Department’s position violated the Administrative Procedures Act (APA), “since all department policies that have general application and which implement, interpret or prescribe law” are subject to the APA’s public vetting process. Noting the significant privacy issues raised by the HIE, the ACLU had called it crucial that regulations setting up the system be as detailed as possible, explaining, for example, the rights patients have to opt out of the system, to correct information contained in it, and to ensure appropriate confidentiality of the data.
Under the settlement agreement, the DOH agreed it would halt its practice of “adopting unofficially promulgated policies to implement” its obligations under the HIE law. In their place, the DOH this month unveiled significantly revised regulations that specify how patients can, among other things, revoke their participation in the HIE, limit healthcare providers’ access to their HIE information, and correct errors in their medical records. The proposed revisions to the regulations were the subject of a public hearing last week. Patients remain free not to have their medical information submitted to the HIE.
RI ACLU volunteer attorney Marzilli said today: “I am very pleased that we were able to resolve this lawsuit in a way that strengthens the privacy rights of patients. The Department’s agreement that it will no longer adopt unofficial policies to implement the Health Information Exchange will better ensure public oversight of the way that Rhode Islanders’ sensitive health care information is treated.”
