Health IT Policy Committee: Policies on non-targeted queries discussed

In a continuing Privacy & Security Tiger Team discussion on patient record query and response recommendations, team co-chair, Deven McGraw—director of the Health Privacy Project at the Center for Democracy & Technology—said the group has decided not to add additional policies for non-targeted queries.

McGraw reported the team’s decision at the May 7 Health IT Policy Committee. At its April 3 meeting, McGraw and the team had agreed on several recommendations for targeted query scenarios and since then had re-examined non-targeted queries for additional policies at the request of the committee. (For more information on the April discussion and specific recommendations, go here).

The team looked at geographic or other limitations for non-targeted queries, which may require use of an aggregator service to find possible sources of the record, McGraw said. However, after some exploration, the team felt at this point its recent recommendations for targeted queries are adequate for non-targeted queries as well.

“Assuming the recommendations are in fact adopted, we did not see a need to layer on additional policies,” McGraw said, stressing that although the record could be located, it still would be up to the data holder whether to release that information. While the team put forth no additional recommendations, McGraw said, “we wanted to reserve the right to monitor and revisit this issue.”

“There is still a professional obligation of data holders to make decisions to release information consistent with legal obligations,” she added.

Several Health IT Policy Committee members voiced concern about the lack of additional rules to guard against misuse. For example, Florida state legislator Gayle Harrell said there is inadequate knowledge out there on the implications of being in a patient locator service.

“We’ll see push back and misuse of services,” she said. “This is where patients get very scared.”

Arthur Davidson, MD, director of public health informatics at the Denver Public Health Department, said additional parameters for non-targeted queries are important. For instance, he said recommendations could inform providers on how to handle queries for a comatose patient in the emergency department or for patients residing in multiple states. “We shouldn’t be silent on this, we should take a stance.”