AJ-2PROTECTION OF PERSONAL HEALTH INFORMATION AND ETHICS OF HEALTH INFORMATION TECHNOLOGY IN THE US

Abstract Health information technology is impacting the legal and ethical approaches to protecting patient privacy in the United States. Widespread adoption of electronic health records, massive data storage capacity, sophisticated measurement and reporting tools, and new communication channels offer tremendous potential benefit for patients and providers, but also give rise to serious responsibility for the stewardship of information. Across the US, the HIPAA law and regulations govern the privacy and security of individually identifiable health information. HIPAA also sets out patients' rights with respect to their health information. Other federal laws govern the use of identifiable health information in research. In addition, most of the 50 states have their own health privacy laws. This regulatory structure affects every aspect of health information technology, from patient portals to e-mail communication to clinical decision support. Because the law treats quality improvement activity differently from research activity, there is debate about how to characterize some data-driven work. New tools are emerging to statistically anonymize health records, but concerns remain about the risk of re-identification. Government regulators are considering when software programs should be regarded as medical devices. Feeling the laws do not always keep pace with technological advances, ethicists are proposing new frameworks for patient engagement, focusing on transparency about data use, responsible data governance policies, and meaningful ways for patients to “opt out.” More research is needed to understand patient perceptions about the use of their health data. ASCO's CancerLinQ initiative provides an opportunity to grapple with these issues and develop a thoughtful approach to health data stewardship.