Episode #4 of the Healthcare Beans podcast

In the United States, privacy protections for health data are not as restrictive as most people think. Your doctor is not the only person who can access your data.

In this episode I talk about: (1) how health data is used, (2) who has access to our health data, and (3) who benefits from sharing health data.

Check out these links for background content on health data privacy laws and value-based healthcare.

~ James

Transcript

Hello friends and welcome to the Healthcare Beans podcast, I’m your host James Haven. Today I want to talk about issues involving your health data; so questions like how’s your data being used; who exactly is benefiting from your data; the types of people and entities who can access your data, and of course – why you should care about how your data is being used.

When it comes to health data sharing, the first thing you should understand is that you actually do not have much control over your data (when you have a medical event, be it a basic checkup or emergency care or something else, there’s a host of entities that have legal access to your data, for the purpose of providing good care to you) – and I know (from a privacy perspective) that’s not a very comforting thought, but for the most part, your data is being handled in a way that is aligned with your overall health interests.

Now, there are folks out there who might disagree and think your health data is being used to expose you or harm you in some way, but I want to share my experiences working in healthcare data operations, including my work with health data under federal and state programs – and after hearing that I hope to (alleviate some of your concerns on data privacy) persuade you about the benefits of sharing your health data, because there are benefits.

Once you receive any type of medical care – your diagnoses, the procedures and tests you went through, and your demographic data, that can all be accessed by several types of entities. And these entities include your doctor (of course), your doctor’s health network (which could be a small group of providers, or could be thousands of providers in your state or region), your insurance company (we refer to these groups as payors) so thinking about Medicare, Medicare Advantage, Medicaid, and also technology companies that contract with your healthcare provider – so companies providing data management services (like EMRs) or some number-crunching analytics or whatnot. And to be clear, that means a lot of different people have access to your data.

When I was working as a data analyst, I had access to tons of data, and that includes people’s names, addresses and health conditions. Now, did I personally know any of these people – absolutely not. Do I recall these data? – to be perfectly honest, no, I do not. The reason is that when analyzing the data, I almost always used some sort of alpha-numeric IDs, not patient names. So if my job was to find people with diabetes, who visited the ER in the past 6 months, and have not had a wellness checkup this year – I’d dig through the data, pull that list together, and it would be filled with IDs like “patient: NZ8211560” and I would send that info off to folks on the care management team (nurses, social workers, and doctors).

By and large, the people who actually witness your personal data (like your name, gender, address) & your medical data are the clinical folks you interact with. Now, that doesn’t mean other people cannot access personal information and medical conditions, but there’s really no reason (incentive) for people outside your care team to do this. Again, I’m not quoting hard-n-fast rules here; I’m just sharing my experience in healthcare data operations – nobody digs through personal-level data because you probably have to jump through some hoops to do that (which means getting actual names behind these obscure IDs) and there’s just no reason to do it,