HIE Wire   back to index

Ehealth, the USA Patriot Act and other hurdles: the black lining on the silver cloud

First published in bjhc&im November 2006

Recent anti-terrorism legislation in particular has raised the need for worldwide agreement on an ethical framework for ehealth to the level of extreme urgency. Professor Eike-Henner Kluge, the former Director of Ethics and Legal Affairs of the Canadian Medical Association, who wrote the well-known handbook Ethics for health informatics professionals,* warns of serious and far-reaching new threats to the medical-privacy rights of individuals and, in this wake-up call, discusses the issues inherent in ethical uses of healthcare ICT.

Abstract

Ehealth promises to rationalise healthcare delivery through greater accessibility, quality and efficiency. However, it also presents a series of risks to patients’ health data that extend beyond merely technical issues and include professional, legal and ethical problems.

Chief among these are threats to security and privacy posed by national legislation designed to enhance the ability of intelligence agencies to operate effectively; the absence of international standards and certification for health-information and healthcare professionals; a corresponding lack of international enforcement mechanisms; and, at a more fundamental level, a failure to appreciate the unique nature of electronic healthcare records in relation to the ethics of healthcare itself.

This paper explains the nature of these issues and relates them to the raison d’être of ehealth. Special emphasis is focused on threats to security and privacy posed by the USA Patriot Act.

Ehealth — the application of information and communications technologies to the delivery of healthcare and healthcare administration — is rapidly transforming the face of healthcare delivery in many jurisdictions and, through its promise of improved system accessibility, quality and efficiency, has the potential of becoming a valued tool on a global scale both in the private and public sectors.

As is the case with the application of any new technology, ehealth has had — and continues to have — its growing pains. Thus, it was recognised from the start that technical issues like reliability, quality control, accessibility and usability presented major challenges. (1) Indeed, something as basic as the standardisation of EHR (electronic healthcare record) structures and architectures — considered a major hurdle and still presenting serious problems — and record portability (and structural as well as operational integration) are still matters of concern. (2) Over the last few years, most of these problems have received considerable attention, and various methods for dealing with them have been explored. Another focus of a great deal of work has been the interoperability of networks,(3) the standardisation of nomenclatures, syntax and semantics and related issues. (4–7)

Nor has attention focused solely on technical matters. From the very beginning it was obvious that electronic healthcare presented major ethical and legal challenges that had to be resolved if its potentials were to be realised. That is why concerted efforts were made to deal with issues such as consent to data collection and usage (8–15), exchange protocols, (16–18) record ownership and right of disposition, etc. All of these became matters of professional and juridical discussion and analysis (1,3,13,16–18) and attempts were made to forge a consensus.(1,8) Moreover, it was soon realised that the ethics of professional behaviour would be integral to the deployment of ehealth, and a move was initiated to develop relevant codes of ethics for healthcare information professionals (HIPs) and for ehealth practitioners. (19–22)

Given the complexity of the issues and the multitude of stakeholders, it is scarcely surprising that as yet there has been no globally accepted solution to any of them. Still, developments continue apace with the shared understanding that the matter should be seen as a work-in-progress that will always be open to further improvement. However, there is the conviction that the right issues have been identified, the right players have become involved, the right moves have been initiated and that the direction in which further work must be done is relatively clear.

But this optimism may be more a matter of appearances than of reality because it derives from a limited perspective of the ethics of what is at stake. There are several aspects integral to the ethical deployment of ehealth that have received little attention and even less discussion either in the professional literature or in policy circles. Nevertheless, unless they are appropriately addressed and resolved, these issues may well impede and even undermine continued ethical development. They fall under five rubrics. In general terms, they may be characterised as follows:

1. the apparent subordination of international ethical standards to individual state interests;
2. the absence of international agreement on ethically appropriate mechanisms to ensure the qualification of the HIPs who actually deploy and manage this technology and on the enforceability of appropriate standards;
3. the failure to develop and institute relevant ehealth qualification standards for healthcare professionals and administrators;
4. the absence of any global agreement on the precise status of healthcare records; and
5. on a philosophically deeper level, lack of agreement on the very raison d’être of healthcare itself.

In this brief note, I can do no more than sketch the issues. However, even on that basis it should become clear that unless these matters are addressed and resolved, ehealth may become a global reality and utility may triumph — but ethics will be the loser.

National interests and ethical standards

The threat presented by the subordination of international ethical standards to individual state interests is most glaringly illustrated by the USA Patriot Act.(23) This Act, the full title of which is Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism, stipulates at section 215 that: "The Director of the Federal Bureau of Investigation or a designee of the Director (whose rank shall be no lower than assistant special agent in charge) may make an application for an order requiring the production of any tangible things (including books, records, papers, documents, and other items) for an investigation to protect against international terrorism or clandestine intelligence activities..."

The Act thus allows the Federal Bureau of Investigation to apply to the US Foreign Intelligence Surveillance Agency Court (FISA Court), which is a special court that was established by the Foreign Intelligence Surveillance Act of 1978 to deal solely with legal matters arising in the conduct of intelligence gathering, for an order to compel the production of any record or tangible thing from anyone under the jurisdiction of the United States for any investigation that is alleged to protect the United States against international terrorism or clandestine intelligence activities.

The Act applies to any American person or corporation and includes foreign subsidiaries under the control of US corporations. The standard of proof required in such applications is not that of reasonable doubt but of perception in the eyes of the applying agency.

It should further be noted that section 215 (2)(d) stipulates that: "No person shall disclose to any other person (other than those persons necessary to produce the tangible things under this section) that the Federal Bureau of Investigation has sought or obtained tangible things under this section."

In other words, section 215(2)(d) mandates that if access to records or tangible things has been requested, the subjects of those records may not be notified of the fact that a breach of their otherwise guaranteed privacy rights is being contemplated or has occurred. (23,24) The FISA Court generally grants such requests. (24,25)

Since the FBI has co-operation agreements with other US intelligence agencies, the Act essentially gives US government agencies the right to abrogate individual privacy rights, including EHR privacy rights, without due process in the normal sense of that phrase.

Since the FBI and US intelligence agencies share information with intelligence agencies all over the world, it has the further implication that intelligence agencies that are prevented by law from accessing records of interest by the laws of their own jurisdictions may achieve their intelligence gathering objective simply by establishing a link between the person-of-interest and security concerns for the United States — something that is relatively easy to do in the post 9/11 security climate — and suggest to the FBI that it would be in the interests of the US to proceed under the provisions of the Act in that particular instance. Since information is shared, that information would then become accessible to the foreign initiating agency — effectively doing an end-run around their otherwise applicable legal restrictions.

Some jurisdictions have attempted to deal with this threat by legislating that healthcare records in the possession or under control of a US corporation or affiliate and operating within their own boundaries may not be exported or in any way communicated to a US agency without explicit permission from a duly empowered and responsible state agency.

Thus, British Columbia, which has contracted with Maximus BC (a subsidiary of a US-based corporation) to provide record services to the Ministry of Health, has adopted that very expedient. The legislation that stipulates this is ineffective, however, because the USA Patriot Act prevents corporations from informing anyone if the records in their possession or under their control have been subpoenaed and accessed by US security agencies.

There is no effective juridical mechanism that controls the in-house transfer of records either within a US corporation or between a US corporation and its subsidiaries. The matter may therefore never come to the attention of a responsible agency. Where there is no plaintiff, there is no judge. Consequently such legislation fails in its objective because it cannot effectively be enforced.

Another solution that has been suggested is encryption. Encryption is of course desirable in its own right, and in fact is standard practice in record communication. (3) To avoid the impact of the Patriot Act, this would require that encryption keys not be communicated — which would rule out precisely what makes ehealth so attractive in the first place, namely consultation with centres of excellence located in or affiliated with the US. The relevant communications would have to be decrypted in order for consultations to proceed. With due alteration of detail, similar considerations apply to US-affiliated healthcare providers and insurance agencies.

Other solutions will no doubt be investigated and attempted. However, all of them are doomed to failure because they ignore one crucial aspect of the Act: the clear stipulation that "any tangible thing (including books, records, papers, documents, and other items)" must be produced. In other words, not merely patient records but also the software that is used to record, store, process, communicate and manipulate the records is implicated.

Among other things, this means that if the software has been produced by a US corporation or by the subsidiary of a US corporation that falls under the jurisdiction of its parent office or that shares any of its software and development data with its parent corporation (arguably, US-linked software corporations such as IBM and Microsoft are cases in point), then the Act allows US intelligence agencies to request production of the source codes for the software, since this is clearly covered by the phrase "other items."

This, in turn, means that the FBI (and intelligence agencies with whom the FBI shares information) would have the opportunity to identify security flaws and possible back doors in the software. This would obviate the need for requesting the actual patient and institutional records themselves (and thus avoid possible legal entanglement with countries in the European Union or other jurisdictions) by simply hacking the relevant programs.

In other words, the Act potentially results in a legally sanctioned hacker’s paradise for any security agency that shares information with the US security establishment and wishes to access EHRs or institutional records that are of interest to it.

Issues of ethical principle

What is most troublesome about this legislation (and any like it) is that it bespeaks a certain perspective about the relationship between ethics and pragmatics. That is to say, legislation of this kind can only be adopted (or defended) if the responsible parties adopt the stance that ethical principles, standards and traditions may be subordinated to the pragmatics of national interests.

Its significance, therefore, extends beyond the particulars of any such legislation and raises two fundamental questions: first, and most generally, should ethical principles be sacrificed on the altar of practical expediency? More specifically, does ethics cease to matter when security is at stake? Secondly, is it ethically appropriate to try and solve problems that arise in areas of social concern that have nothing to do with healthcare by abandoning the standards that are rooted in the tradition of healthcare and that are integral to the ethics of healthcare itself?

A defensible answer to the first question must begin by acknowledging that no rights are absolute. Minimally, all rights must be balanced against the equal and competing rights of others. Therefore, as the old legal adage has it, ‘Your right to swing your fist stops where my face begins’ — minimally, because I have the same rights. Therefore all rights have limits.

Logic itself demands that, whatever these limits may be and however they may be drawn, they must be drawn within the overall framework of ethics itself because the justification of the limitation is grounded in the very fact of competing rights. In other words, it means that any abrogation of specific rights — inclusive of informatics rights — must be consistent with the fundamental principles that define the domain of ethics.

It therefore means that pragmatic considerations do not justify an abrogation of otherwise existing rights unless the means themselves are ethically defensible within the general framework of the ethical principles that ground the justification of right-limitation. This, in turn, means that ethically justifiable ends must be achieved only through measures that are consistent with the ethical principles that justify the ends in the first place. Moreover, it entails that if an abrogation of individual rights is ethically permissible, that abrogation must itself be limited to the minimal extent that is demonstrably necessary to safeguard the supervening right that justifies the abrogation.

This immediately highlights the fact that an appeal to the greatest good for the greatest number is incomplete and lacks ethical force unless the nature of that good has been identified and justified in ethical terms. Arguably, to define the greatest good for the greatest number independently of ethical considerations is to adopt a materialistic perspective that is antithetical to the very ideas that underlie the UN insistence that privacy is a fundamental human right.26 Further, it simply ignores the international consensus that informed consent to the collection and use of personal health information is a basic right that must be protected. Ethically and logically, therefore, an appeal to mere pragmatics will have no probative force.

These considerations find reflection in the Code of Ethics of the International Medical Informatics Association19 and at least to some degree are respected in EU Directive 95/46EC.8 While that Directive permits privacy and security intrusions similar to those mandated by the USA Patriot Act, it provides for protocols and review mechanisms that are quite distinct from those contained in the Patriot Act — those of the latter resemble more the provisions of a Star Chamber court than of an ethical and judicial process in a free and democratic society. So although the EU provisions are not perfect, they do go some way towards accommodating the principles of openness and of the least-intrusive alternative that are integral to information ethics.(16,17,19)

At the same time, it should be a sobering thought that, as has been indicated, the provisions of the USA Patriot Act effectively undermine legislation such as EU Directive 95/46 EC and emasculate its ethical force. All that European security agencies who wish to place pragmatics before ethics have to do to achieve their objective and avoid the boundaries set by the Directive is to adopt a co-operative — and uncheckable — agreement with US intelligence agencies.

As to the much larger philosophical question — whether it is ethically appropriate to try to solve problems that arise in areas of social concern that are fundamentally distinct from healthcare by abandoning the standards that are rooted in the tradition of healthcare and that are integral to the ethics of healthcare itself — this presents a whole new problematic. Answering it requires a decision about the relationship between healthcare and other social undertakings. Is healthcare special? If so, does it mean that the ethical standards that are appropriate in healthcare, inclusive of privacy and security (which have been integral to healthcare from its very beginnings) are immune from outside pressures? Dealing with these fundamental issues transcends the scope of the present discussion. The matter has to be resolved, though, if regulatory structures are to be ethically defensible and more than merely ad hoc devices.

Development, harmonisation and enforcement of standards

The security and privacy challenges that face healthcare today originate in more than merely pragmatically oriented and ethically dubious legislation. They also may arise from technically deficient and ethically inappropriate professional conduct. That is why globally integrated and harmonised technical and ethical standards are necessary for HIPs as well as healthcare professionals. In their absence, electronic healthcare threatens to devolve into a service delivery modality that is ruled by the principle of caveat emptor.

One way to achieve the technical desideratum is through the development of an internationally validated certification mechanism for HIPs and through the international harmonisation of informatics training for healthcare professionals as part of their education and certification. Of course, this will not be easy. At present there is no mechanism to ensure that the training and certification for any professionals is internationally harmonised. In a sense, this is not surprising. In the case of HIPs it derives from the fact that there is an almost universal lack of appreciation that HIPs fulfil a socially sensitive function and, therefore, should be legally certified as professionals even within their own jurisdictions. This is coupled with a failure to appreciate that with ehealth, the qualification harmonisation for HIPs becomes a functional necessity precisely because of the interjurisdictional nature of the enterprise.

In the case of clinicians, this lack derives from the fact that until the advent of ehealth, they practised only within the particular jurisdiction in which they were certified and relocation required recertification. Ehealth is interjurisdictional by its very nature, and neither informaticians nor healthcare professionals have to leave their jurisdictions when exercising their professions. The radiologist may be in Bangalore and the contracting hospital in Maine or Leeds; data input may occur in Glasgow and the data processing, storage and manipulation take place in Chennai, Hong Kong or West Virginia.(27) In the absence of certification integration and harmonisation, the safeguards that exist for traditional healthcare delivery will not obtain in the case of ehealth. How this will be explained to patients — or how it will be handled in the courts — then becomes a nice question.

However, the absence of globally integrated and harmonised technical and ethical professional standards is only part of the problem. The best standards and measures are useless if there are no enforcement mechanisms. A first step towards an effective enforcement could be achieved by developing appropriate national bodies that impose an integrated set of rules. Ultimately, however, there has to be some international body that oversees their enforcement independently of parochial interests.

In some jurisdictions — such as the EU and the USA — a first step in this direction has been taken by developing legal mechanisms to ensure that the originator and transmitter of a healthcare record must guarantee that the security provisions that are in place in the receiving jurisdiction are at least as strict as those in the originating country and that product quality meets a minimum standard.8 It is reasonable to assume that similar developments will integrate these provisions with those of other global blocks. Such blocks, though, tend to be dominated by the interests of the economically more powerful partners. In an ideal world, these interests would be consistent with the ethical requirements of appropriate and timely healthcare — which supposedly is the underlying driver for the development of ehealth itself. Consequently, in an ideal world, standards, certification and discipline would ultimately be referable to an independent body functioning in association with the United Nations Educational, Scientific and Cultural Organisation or the World Health Organisation and that would rely on the expertise of professional organisations such as the International Medical Informatics Association to achieve uniformity. It remains to be seen whether the real world will approximate this ideal.

Finally, when all is said and done, the considerations that have been raised in the preceding section should caution anyone who assumes that merely developing international strategies will be effective if countries insist on enacting legislation similar to the USA Patriot Act.

Ehealth and the philosophy of healthcare

A final, and conceptually profound, issue concerns the nature of EHRs and the philosophy of healthcare. The two are closely connected.

If, as per Article 25 of the Universal Declaration of Human Rights,26 healthcare is a fundamental right, then the collection, storing, processing and communicating of personal health data comes under the protective umbrella of human rights. This limits what could be done if healthcare were a commodity that was governed by purely contractual considerations. That is why in some jurisdictions — Canada and the EU are examples — any abrogation of healthcare informatics rights has to be defended in a stringent process that (at least in principle) is open, accountable and fair and that finds its roots not in contractual arrangements but in fundamental rights.

By contrast, if healthcare is considered a commodity, then considerations of social justice — and hence of fundamental human rights — do not enter the picture. Any incursion into or abridgement of health information privacy becomes an issue that may be dealt with solely in terms of contract and as an infringement of commercial rights. In other words, EHRs would not fall under the protective umbrella of human rights. They would become sensitive documents that must indeed be protected — but only as is required by the privacy rights that surround any sensitive commercial document. Contractual obligations predominate, and fiduciary obligations that find their basis in the traditional ethics of the physician–patient relationship — which, by extension, apply to the actions of healthcare institutions and HIPs insofar as they facilitate the delivery of healthcare (19) — do not arise.

In practical terms, therefore, the contrast between these two perceptions could not be more stark and the protocols that are appropriate for each perspective could not be more distinct. On a commodity approach, providers need not adopt a proactive approach except as a matter of good business strategy. Efficiency, quality and availability assume purely economic importance, and privacy and related issues need not be solved unless required by economic indicators. When these are absent or economically insignificant they may be dealt with in an ad hoc manner — for instance, by merely notifying patients of any concerns or limitations. Correspondingly, proactive measures are relevant only insofar as they increase the profit margin or reduce the likelihood of successful litigation. By contrast, on a rights approach, the fiduciary relationship that exists between provider and patient requires proactive measures on all fronts: efficiency and effectiveness become social responsibilities, and privacy, quality and availability become primary ethical concerns.

The distinct logic of these approaches subtly but profoundly affects the view of what constitutes an infringement of information rights. Consequently, the harmonisation of ehealth protocols has to take this orientational difference into account. The basic philosophical conundrum of the nature of healthcare, therefore, rather than having merely academic significance, has an immediate and direct impact on any regulations and mechanisms that structure the development of ehealth, and affects all parties involved in the endeavour.

The ethical status of EHRs

Of course — and this takes us to the second, closely related issue indicated at the beginning of this section — there is a way of dealing with the issue without becoming embroiled in the thorny question of the nature of healthcare. One could simply come to some international agreement about the status of EHRs either by defining them as very sensitive documents that deserve special protection, or by identifying them as patient analogues.(18) On the first alternative, differential treatment by distinct jurisdictions is ethically acceptable; interoperability of standards becomes merely an issue of efficiency; and privacy and security issues are properly resolved through economically centred multilateral treaties. On the other hand, if EHRs are identified as patient analogues, then the ethical construction of ehealth requires uniform international regulations and standards.

However, it should be clear that adopting the first alternative does not address the ethical problem: it ignores it. More precisely, it assumes that legal provisions are eo ipso ethical — a perspective that is profoundly mistaken. It is also dangerous from a pragmatic perspective. It makes informatics provisions in healthcare subject to international challenges on the basis of human rights, and it may force a later — and potentially more costly and complicated — revision of contractual and other legal obligations that could have been avoided if ethical considerations had been paramount in the first place.

Be that as it may, the fact remains that currently there is no global agreement on the precise status of medical records. That does have implications for ehealth, and it therefore is a challenge that should be addressed.

Conclusion

Technology lies at the very heart of ehealth. Inevitably, therefore, this presents the ethical question of what should be the driver of its development and implementation. The technology itself? The interests of service providers? Of governments? Or should it be the interests of patients?

Depending on what stance one adopts, different answers will follow. However, when all is said and done, the following remains a fundamental fact: ehealth is a species of healthcare. Patients are the focus of healthcare. Arguably, therefore, ethical considerations that centre in patient rights should play a fundamental role in the structuring and implementation of ehealth itself. This, in turn, means that pragmatic and legal considerations that cannot be defended in terms of patients’ rights are ethically objectionable.

It remains to be seen whether institutions and jurisdictions will adhere to ethics — or to pragmatics.

Professor Eike-Henner W Kluge, Department of Philosophy, University of Victoria, Canada.

References

*Obtainable from The British Computer Society’s Publications Department. Free plus the following post & packaging charges: UK £2.50; Europe £5; RoW £12. An order form accompanies information about the book on www.bcs.org
Return to place of reference in text

To top