ACLU sues over R.I. HIE

Claiming that not enough has been done to protect the privacy rights of patients, the Rhode Island chapter of the American Civil Liberties Union (ACLU) filed suit Tuesday against the R.I. Department of Health (DOH), challenging the rules the agency has adopted to implement a centralized database of patient healthcare records in the state for its statewide health information exchange (HIE).

The HIE, established by legislation approved by the R.I. General Assembly in 2008, will allow medical personnel to routinely access a patient’s entire medical file, including mental health records and other sensitive medical information, according to the ACLU.

In an interview, Mike Healey, a spokesperson from the R.I. Office of the Attorney General, which is handling the case for the DOH, acknowledged being “served papers” Wednesday. "We are still reviewing the ACLU suit, and can't fully comment yet, but we will be defending DOH's position," he said.

Healey noted that the DOH formulated the regulations in “good faith. “ He also said that the ACLU initially commented on the regulations, and the DOH is still welcoming input. However, he was unable to comment on whether this case could potentially set legal precedent for suits against other state HIEs.

Last year, when the R.I. DOH proposed regulations to implement the statute, the ACLU objected that the proposed regulations “provided virtually no details as to how the system would actually work, and how it would protect the privacy, confidentiality and informed consent interests of patients.” The organization stated it has been “battling over these issues” since the HIE proposal was first floated a few years ago.

In written testimony about the DOH’s proposed regulations, the ACLU noted that there are no fewer than seven provisions in the HIE statute that require the department to flesh out HIE implementation details through a public rule-making process. However, the ACLU alleges those issues were “only minimally addressed, if at all, in the regulations.”

The ACLU’s lawsuit, filed in Rhode Island Superior Court by volunteer attorney Frederic Marzilli, argues that the DOH’s position violates the Administrative Procedures Act (APA), “since all department policies that have general application and which implement, interpret or prescribe law” are subject to the APA’s public vetting process. The suit seeks a court order declaring unenforceable the DOH’s adoption of non-promulgated policies, rather than regulations adopted through a public rule-making process, and requires DOH to promulgate “regulations that completely fulfill its obligation” under the HIE statute.

Noting the significant privacy issues raised by the HIE, the ACLU called it “crucial” that regulations setting up the system be as detailed as possible.

“In light of the important privacy and confidentiality issues raised by an EHR system, the legislature clearly envisioned the adoption of detailed regulations through a transparent process of public input," Marzilli said. "This lawsuit simply seeks to carry out that intent.”