Friday, June 06, 2014
UCSD gives consent for sharing medical records without
patient approval
By Maura Larkins
[Note: the links do not show up in the article below. To see a version of this article that
includes the links, click HERE.]
I got an interesting letter from UCSD three days ago. It told me that I had
consented to share my electronic medical records.
The trouble is--I had NOT given my consent. I never signed a consent form. I
never clicked a box on the Internet agreeing to share my records.
And the letter from UCSD did NOT arrive in my home mailbox or even in my email. It was
purely by chance that I found it on MyUCSDChart—NOT among the MyChart emails. If it
had been among the MyChart emails, I would have received an alert about it in my
regular email.
UCSD was definitely NOT trying to make sure that I found out about my “consent”.
Today, each time I have clicked on the link about sharing electronic medical records on
MyUCSDChart, I found myself unceremoniously thrown back to the sign-in page.
Automatically signed out. They really don't like it when I click on the link!
UCSD seems to be remarkably fond of both signing me in and signing me out--without
my involvement--whenever it feels like it.
I found this page on the UCSD site about sharing electronic records. It seems that I am
now part of two databases: The San Diego Beacon Health Information Exchange, and
something called Care Everywhere.
It's not that I want to keep my records secret. In fact, I think sharing electronic records is
basically a good idea. It's just that I've had problems with health providers hiding my
own test results from me, so I'm sensitive about doctors violating the law regarding
medical records.
Apparently the VA is also part of this system, but the VA has a more transparent
consent process.
I've heard of falsified medical records, but this is the first time I heard of a falsified
consent for release of medical records.
I found some interesting stuff about UCSD's informed consent process for patients in
research projects:
iDASH Integrating Data for Analysis, Anonymization and SHaring
Informed Consent
Paper Consent versus Electronic Consent
Traditionally, paper-based consent has been the medium through which researchers
and physicians conducted the informed consent process. The paper-based process
consists of giving a hard copy consent form to a patient for him or her to review. Then a
care provider answers any questions from the patient and in some cases assists the
patient in reviewing the paper consent forms. The issues surrounding this procedure
are that the paper-based consent form tends to be long and monotonous, and the
retrieval of paper forms are often time consuming.
The new electronic consent forms use tablets or computers as the medium for
communicating information and seeking consent from the patient...The iDASH team is
also currently working on two systems, iCONS and iCONCUR, which are intended for
such open source use in the future.
iDASH electronic informed consent management system
iCONS is a system currently being tested in a clinical trials environment at Moores
Cancer Center Biorepository. The system supports informed consent electronically by
enhancing the consent process for patients and researchers by acting as a consent
broker and by adding multimedia aspects to the process. This consent process is opt-
in, meaning no patient information is shared with researchers until the patient specifies
what specific information he or she would like to share with researchers. The iCONS
system creates a permission ontology to model the consent choices of the patient to
assist in the process of releasing data and specimens to researchers for their
consented uses.
iCONCUR is a pilot study within the University of California - San Diego Health System.
This system transforms the sharing of electronic records from the opt-out system that is
currently in place, meaning a patient’s record is automatically entered into the system
unless the patient specifically requests to have their records taken out, to an opt-in
system. The tool presents the patient with a taxonomy of his or her medical record
allowing the patient to dictate what parts of the medical record to share and with whom it
may be shared with.
HOSPITAL FAXED MEDICAL RECORDS TO PATIENT'S WORKPLACE
Tufts Medical Center sued for faxing patient records without consent
July 15, 2011
By Karen Cheung-Larivee
FierceHealthcare
Tufts Medical Center in Boston faces a lawsuit after a patient said the hospital faxed her
medical records to her workplace without her consent, causing her embarrassment,
reports The Boston Globe yesterday.
"I feel like I might have walked in (the office) naked," said patient Kimberly White.
White requested Tufts to send a form for a disability claim, but instead the hospital
allegedly sent four pages of medical records about her hysterectomy to a shared fax
machine at her workplace.
White filed a complaint in Plymouth County Superior Court. The hospital denies any
wrongdoing, according to the article.
Tufts spokeswoman Julie Jette said, "In this matter, we complied with a patient's request
to share information. We firmly believe we responded to the patient's request
appropriately."
"I can't go back there," White said. "I am so embarrassed. ... I couldn't live with knowing
what these people knew about me."
Earlier this year, another Boston hospital, Massachusetts General Hospital, faced
accusations that an employee lost records of 192 patients on the subway. The hospital
in February settled the federal case for $1 million, according to the article.
UCLA HIPAA VIOLATIONS
UCLA Health System pays $865G to settle HIPAA violation charges
July 8, 2011
FierceHealthIT
By Ken Terry
UCLA Health System has agreed to pay a fine of $865,000 and to develop a correction
action plan to settle potential HIPAA privacy violations involving improper disclosures of
medical records at its three hospitals, the federal Office of Civil Rights (OCR) reports.
OCR launched the investigation in 2009, following complaints by two unnamed
celebrities that their medical records had been compromised. The government probe
revealed that from 2005 to 2008, "unauthorized employees repeatedly looked at the
electronic protected health information of numerous other UCLAHS patients," according
to an OCR press release.
The Los Angeles Times reports that violations allegedly occurred at all three UCLAHS
hospitals: Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center,
and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, which are regarded
as a single unit.
The hospital had disclosed in April 2008 that it had discovered that several employees
had snooped into the patient records of dozens of celebrities, including Britney Spears,
Tom Cruise and Maria Shriver.
When the alleged violations came to light in 2008, the California legislature passed a
law that imposed escalating fines on hospitals for patient privacy breaches. The state
fined UCLAHS $95,000 in 2009, reportedly in connection with the medical records of the
late Michael Jackson.
The UCLAHS settlement with OCR is much smaller than previous HIPAA settlements,
including those involving CVS Caremark ($2.25 million) and Rite Aid ($1 million).
As part of its settlement, UCLAHS agreed to institute new security and privacy policies,
improve employee training, take action against employees who violate privacy rules,
and designate an independent monitor to oversee compliance.
In a statement, UCLAHS said, "The UCLA Health System considers patient
confidentiality a critical part of our mission of patient care, teaching and research. Over
the past three years, we have worked diligently to strengthen our staff training,
implement enhanced data security systems and increase our auditing capabilities."
MEDICAL ETHICS--RESEARCH ON MEDICAL RECORDS WITHOUT INFORMED
CONSENT
J Law Med Ethics. 2008 Fall;36(3):560-6. doi: 10.1111/j.1748-720X.2008.304.x.
Research on medical records without informed consent.
Miller FG.
Observational research involving access to personally identifiable data in medical
records has often been conducted without informed consent, owing to practical barriers
to soliciting consent and concerns about selection bias. Nevertheless, medical records
research without informed consent appears to conflict with basic ethical norms relating
to clinical research and personal privacy. This article analyzes the scope of these
norms and provides an ethical justification for research using personally identifiable
medical information without consent.
PMID: 18840249 [PubMed - indexed for MEDLINE]
UCSD gives consent for sharing medical records without
patient approval
By Maura Larkins
[Note: the links do not show up in the article below. To see a version of this article that
includes the links, click HERE.]
I got an interesting letter from UCSD three days ago. It told me that I had
consented to share my electronic medical records.
The trouble is--I had NOT given my consent. I never signed a consent form. I
never clicked a box on the Internet agreeing to share my records.
And the letter from UCSD did NOT arrive in my home mailbox or even in my email. It was
purely by chance that I found it on MyUCSDChart—NOT among the MyChart emails. If it
had been among the MyChart emails, I would have received an alert about it in my
regular email.
UCSD was definitely NOT trying to make sure that I found out about my “consent”.
Today, each time I have clicked on the link about sharing electronic medical records on
MyUCSDChart, I found myself unceremoniously thrown back to the sign-in page.
Automatically signed out. They really don't like it when I click on the link!
UCSD seems to be remarkably fond of both signing me in and signing me out--without
my involvement--whenever it feels like it.
I found this page on the UCSD site about sharing electronic records. It seems that I am
now part of two databases: The San Diego Beacon Health Information Exchange, and
something called Care Everywhere.
It's not that I want to keep my records secret. In fact, I think sharing electronic records is
basically a good idea. It's just that I've had problems with health providers hiding my
own test results from me, so I'm sensitive about doctors violating the law regarding
medical records.
Apparently the VA is also part of this system, but the VA has a more transparent
consent process.
I've heard of falsified medical records, but this is the first time I heard of a falsified
consent for release of medical records.
I found some interesting stuff about UCSD's informed consent process for patients in
research projects:
iDASH Integrating Data for Analysis, Anonymization and SHaring
Informed Consent
Paper Consent versus Electronic Consent
Traditionally, paper-based consent has been the medium through which researchers
and physicians conducted the informed consent process. The paper-based process
consists of giving a hard copy consent form to a patient for him or her to review. Then a
care provider answers any questions from the patient and in some cases assists the
patient in reviewing the paper consent forms. The issues surrounding this procedure
are that the paper-based consent form tends to be long and monotonous, and the
retrieval of paper forms are often time consuming.
The new electronic consent forms use tablets or computers as the medium for
communicating information and seeking consent from the patient...The iDASH team is
also currently working on two systems, iCONS and iCONCUR, which are intended for
such open source use in the future.
iDASH electronic informed consent management system
iCONS is a system currently being tested in a clinical trials environment at Moores
Cancer Center Biorepository. The system supports informed consent electronically by
enhancing the consent process for patients and researchers by acting as a consent
broker and by adding multimedia aspects to the process. This consent process is opt-
in, meaning no patient information is shared with researchers until the patient specifies
what specific information he or she would like to share with researchers. The iCONS
system creates a permission ontology to model the consent choices of the patient to
assist in the process of releasing data and specimens to researchers for their
consented uses.
iCONCUR is a pilot study within the University of California - San Diego Health System.
This system transforms the sharing of electronic records from the opt-out system that is
currently in place, meaning a patient’s record is automatically entered into the system
unless the patient specifically requests to have their records taken out, to an opt-in
system. The tool presents the patient with a taxonomy of his or her medical record
allowing the patient to dictate what parts of the medical record to share and with whom it
may be shared with.
HOSPITAL FAXED MEDICAL RECORDS TO PATIENT'S WORKPLACE
Tufts Medical Center sued for faxing patient records without consent
July 15, 2011
By Karen Cheung-Larivee
FierceHealthcare
Tufts Medical Center in Boston faces a lawsuit after a patient said the hospital faxed her
medical records to her workplace without her consent, causing her embarrassment,
reports The Boston Globe yesterday.
"I feel like I might have walked in (the office) naked," said patient Kimberly White.
White requested Tufts to send a form for a disability claim, but instead the hospital
allegedly sent four pages of medical records about her hysterectomy to a shared fax
machine at her workplace.
White filed a complaint in Plymouth County Superior Court. The hospital denies any
wrongdoing, according to the article.
Tufts spokeswoman Julie Jette said, "In this matter, we complied with a patient's request
to share information. We firmly believe we responded to the patient's request
appropriately."
"I can't go back there," White said. "I am so embarrassed. ... I couldn't live with knowing
what these people knew about me."
Earlier this year, another Boston hospital, Massachusetts General Hospital, faced
accusations that an employee lost records of 192 patients on the subway. The hospital
in February settled the federal case for $1 million, according to the article.
UCLA HIPAA VIOLATIONS
UCLA Health System pays $865G to settle HIPAA violation charges
July 8, 2011
FierceHealthIT
By Ken Terry
UCLA Health System has agreed to pay a fine of $865,000 and to develop a correction
action plan to settle potential HIPAA privacy violations involving improper disclosures of
medical records at its three hospitals, the federal Office of Civil Rights (OCR) reports.
OCR launched the investigation in 2009, following complaints by two unnamed
celebrities that their medical records had been compromised. The government probe
revealed that from 2005 to 2008, "unauthorized employees repeatedly looked at the
electronic protected health information of numerous other UCLAHS patients," according
to an OCR press release.
The Los Angeles Times reports that violations allegedly occurred at all three UCLAHS
hospitals: Ronald Reagan UCLA Medical Center, Santa Monica UCLA Medical Center,
and Orthopaedic Hospital and Resnick Neuropsychiatric Hospital, which are regarded
as a single unit.
The hospital had disclosed in April 2008 that it had discovered that several employees
had snooped into the patient records of dozens of celebrities, including Britney Spears,
Tom Cruise and Maria Shriver.
When the alleged violations came to light in 2008, the California legislature passed a
law that imposed escalating fines on hospitals for patient privacy breaches. The state
fined UCLAHS $95,000 in 2009, reportedly in connection with the medical records of the
late Michael Jackson.
The UCLAHS settlement with OCR is much smaller than previous HIPAA settlements,
including those involving CVS Caremark ($2.25 million) and Rite Aid ($1 million).
As part of its settlement, UCLAHS agreed to institute new security and privacy policies,
improve employee training, take action against employees who violate privacy rules,
and designate an independent monitor to oversee compliance.
In a statement, UCLAHS said, "The UCLA Health System considers patient
confidentiality a critical part of our mission of patient care, teaching and research. Over
the past three years, we have worked diligently to strengthen our staff training,
implement enhanced data security systems and increase our auditing capabilities."
MEDICAL ETHICS--RESEARCH ON MEDICAL RECORDS WITHOUT INFORMED
CONSENT
J Law Med Ethics. 2008 Fall;36(3):560-6. doi: 10.1111/j.1748-720X.2008.304.x.
Research on medical records without informed consent.
Miller FG.
Observational research involving access to personally identifiable data in medical
records has often been conducted without informed consent, owing to practical barriers
to soliciting consent and concerns about selection bias. Nevertheless, medical records
research without informed consent appears to conflict with basic ethical norms relating
to clinical research and personal privacy. This article analyzes the scope of these
norms and provides an ethical justification for research using personally identifiable
medical information without consent.
PMID: 18840249 [PubMed - indexed for MEDLINE]
| ... |
UCLA
UCLA
UCLA Radiology and
Medical Records
UCLA CareConnect
UCLA Compliance
Dr. Robert Pedowitz
wins $10 million for
retaliation by UCLA for
blowing whistle on
industry payments to
doctors
Dr. Eugene
Washington, dean of
medical school
Dr. Andrew Saxon,
author of paper on
harmlessness of
indoor mold
UCLA conflict of
interest
UCLA Cull case
UCLA culture: contempt
and racism?
UCLA Dermatology
UCLA Patient Advocates
UCLA Patrick Harron to
be arraigned in burning
death in chemistry lab
UCLA contract with
Kaiser for kidney
transplants
UCLA Radiology and
Medical Records
UCLA CareConnect
UCLA Compliance
Dr. Robert Pedowitz
wins $10 million for
retaliation by UCLA for
blowing whistle on
industry payments to
doctors
Dr. Eugene
Washington, dean of
medical school
Dr. Andrew Saxon,
author of paper on
harmlessness of
indoor mold
UCLA conflict of
interest
UCLA Cull case
UCLA culture: contempt
and racism?
UCLA Dermatology
UCLA Patient Advocates
UCLA Patrick Harron to
be arraigned in burning
death in chemistry lab
UCLA contract with
Kaiser for kidney
transplants
UCSD
| San Diego Education Report |
| SDER |
San Diego
Education Report
Education Report
| SDER |
| SDER |
| SDER |
| San Diego Education Report |
| SDER |
San Diego
Education Report
Education Report
| SDER |
| SDER |
| SDER |
UCSD HIPAA violation