ACLU Sues Health Department Over Failure to Adopt Rules Protecting Patient Privacy
Posted: Jun, 29, 2010
Claiming that not enough has been done to protect the privacy rights of patients, the Rhode Island ACLU today filed suit against the R.I. Department of Health (DOH), challenging the inadequacy of rules the agency has adopted to implement a centralized database of patient health care records in the state. The Health Information Exchange (HIE), established by legislation (link to bill as enacted) approved by the General Assembly in 2008, will allow medical personnel to routinely access a patient’s entire medical file, including mental health records and other sensitive medical information.
Last year, when the DOH proposed regulations to implement the statute, the ACLU objected that the proposed regulations provided virtually no details as to how the system would actually work, and how it would protect the privacy, confidentiality and informed consent interests of patients. The Affiliate has been battling over these issues since the HIE proposal was first floated some years ago.
In written testimony about the DOH’s proposed regulations, the ACLU noted that there are no fewer than seven provisions in the HIE statute that require implementing details about the system to be fleshed out by DOH through a public rule-making process. However, the ACLU argued that those issues were only minimally addressed, if at all, in the regulations. When the ACLU sought an explanation as to why they had not been addressed, the DOH responded that it felt that they could better be handled through internal “policies” that were not subject to the public notice and comment requirement that agency regulations must undergo.
The ACLU’s lawsuit, filed in R.I. Superior Court by volunteer attorney Frederic Marzilli, argues that the Department’s position violates the Administrative Procedures Act (APA), “since all department policies that have general application and which implement, interpret or prescribe law” are subject to the APA’s public vetting process. The suit seeks a court order declaring unenforceable the DOH’s adoption of non-promulgated policies, rather than regulations adopted through a public rule-making process, and requiring DOH to promulgate “regulations that completely fulfill its obligation” under the HIE statute.
Noting the significant privacy issues raised by the HIE, the ACLU called it crucial that regulations setting up the system be as detailed as possible, explaining, for example, the rights patients have to opt out of the system, to correct information contained in it, and to ensure appropriate confidentiality of the data. RI ACLU volunteer attorney Marzilli said today: “In light of the important privacy and confidentiality issues raised by an electronic health records system, the legislature clearly envisioned the adoption of detailed regulations through a transparent process of public input. This lawsuit simply seeks to carry out that intent.”