Statement of Patrick Leahy, Chief Sponsor, Medical Information Privacy And Security Act

March 10, 1999

Additional Background on Medical Privacy Problem

Summary of Medical Information Privacy and Security Act of 1999

[Following are the comments of Sen. Patrick Leahy (DVt.) on introduction of the Medical Information Privacy and Security Act (MIPSA), on Wedn., March 10. Leahy has led congressional efforts to focus attention on the lack of protection for individuals' medical information since 1993, when he convened a series of hearings on "HighTech Issues In Health Care." He has introduced comprehensive medical records privacy legislation in the 104th, 105th and now the 106th Congresses. Sen. Edward Kennedy (DMass.), ranking member of the Senate Committee on Health, Education, Labor and Pensions, is the leading cosponsor of the Leahy bill in the Senate, and Rep. Edward Markey, a leading member of the House Commerce Committee, now will be the bill's chief sponsor in the House. Leahy and Markey will introduce MIPSA today in the Senate and the House.]

The Millennium Bug is not the only computer-related problem Congress confronts this year. We face the deadline that Congress set for itself of August 21, 1999, to solve the multitude of privacy glitches in the handling of our medical records.

At a time when some states are selling driving license photos and information, when our leading computer chip and software companies have built secret identifiers into their products to trace our every move in cyberspace without our consent, it is time for Congress to wake up to the privacy rights and expectations of all Americans before it is too late.

With each new encroachment, more and more citizens are learning that our privacy practices have more openings than those flimsy hospital gowns. The trouble is this:

If you have a medical record, you have a medical privacy problem.

Medical privacy invasions can reach into the most sensitive area of our lives. Take the real case of a man who was being treated for depression. The medicine had some side effects.

Within weeks, he began receiving mail from drug companies suggesting remedies for impotence. It was clear from the mailings that his name, address and diagnosis had been disclosed without his knowledge or consent.

Just a few days ago The Wall Street Journal wrote about a company that is "seeking the mother lode in health 'data mining.'" This company wants to get medical data on millions of Americans to sell to any buyer. Insurance firms already compile tons of health records on us. There is no current law which would prevent companies from selling medical records specifically identifying each individual.

If this battle is between American families who want some privacy and big business buying access to their personal medical records, I will stand with American families every time.

We must not let privacy slide to the point that the only way for a person to ensure confidentiality of is to avoid seeking medical treatment.

The explosion in information technology is an enormous boon to our society. But it also poses new challenges in protecting our privacy. I am convinced that computerization can assure MORE privacy to individuals; to make technology our servant instead of our master if legislation like this is enacted

This bill would be the first comprehensive federal health privacy law. It would close the existing gaps in federal privacy rules to ensure protection of personally identifiable health information.

Our bill is broad in scope: It applies to medical records in whatever form paper or electronic. But our bill does NOT preempt any federal or state law or regulation that offers GREATER privacy safeguards. We propose a floor rather than a ceiling, achieving two goals:

First, a strong federal privacy law will eliminate much of the current patchwork of state laws governing the exchange of medical information, and will replace the patchwork with strong, clear standards that will apply to everyone.

At the same time MIPSA makes room for the many possible future threats to medical privacy that we may not even anticipate today. As medical and information technology moves forward into the next century we must maintain the public's right to seek stronger medical privacy laws closer to home.

Our bill would prevent law enforcement agents from browsing through medical records without a warrant, a grand jury subpoena or a court order.

We also require anyone that maintains your medical information to have strong safeguards. Our bill also has strong enforcement and remedies for misuse of medical information.

These elements are essential to any strong medical privacy effort.