The bill, “An Act To Ensure Patient Privacy and Control with Regard to Health Information Exchanges” (LD 1337), is sponsored by State Senator Roger Katz (R-Augusta).

[See also: ACLU brings suit against Rhode Island HIE.]

“Maine patients and healthcare providers can realize the benefits of a statewide health information exchange without sacrificing privacy or security,” said Katz. “In order to maximize trust, participation and value in a statewide exchange, we must protect a patient’s right to control what happens to their highly personal medical information.”

Zachary Heiden, legal director of the MCLU, said his organization's support of the bill is meant to help "make sure that people have knowledge" about how their health data is shared and disseminated.

"Changes in health technologies mean two things," said Heiden. "One, that health information is likely to be shared very widely across the healthcare spectrum. Other doctors, and people who work with those doctors, are going to have access, potentially, to all that sensitive information."

In addition, he said, "there's the possibility of inadvertent disclosure of that information" thanks to hackers or an accidental breach. "There's no such thing as a perfectly secure database."

The MCLU's support of Katz's opt-in legislation, he said, is meant to ensure that patients take part in health information exchanges willingly and fully-informed. Because, he said, some people "might be uneasy about having health information shared without their explicit knowledge. ... Does your dentist need to know if you've had an abortion? Does your podiatrist need to know if you're on anti-depressants?"


An estimated 50 percent of Mainers are already included in Maine’s statewide HIE, called HealthInfoNet. But the MCLU points out that many of them do not know whether they are in it.

“Patients should have a choice as to whether they want their private medical records to be shared in a statewide database or not,” said Shenna Bellows, the MCLU's executive director. “Patient privacy and consent need not be barriers to improving coordinated care.”

Recent data breaches at private companies such as Hannaford and Bank of America – as well as cases like the one in which medical staff viewed George Clooney's medical records out of "curiosity" – have highlighted the issues at stake, privacy advocates say.

“Not all data breaches are the result of malicious activity," said Mark Stone, president of Reliable Networks in Portland, Maine. "The Texas State Comptroller's office recently reported some 3.5 million Texans' personally identifiable information – including names, mailing addresses, Social Security numbers, dates of birth and driver's license numbers – had inadvertently been made publicly available and remained available for more than a year before the breach was discovered."

[See also: Poll: Huge majorities want control over health info.]

Katz's bill requires an opt-in form, mandates that patients be able to review their records and that they be notified in case of a breach, prohibits disclosure for marketing or sales without patient authorization and prohibits the denial of treatment or payment on the basis on non-participation in HealthInfonet.

“Opt-in patient consent models are working in other states" such as Massachusetts, New York and Vermont, said Ruth Lockhart, executive director of Mabel Wadsworth Women’s Health Center in Bangor, Maine. “Providers benefit when our patients have full confidence and trust in the systems we use, which is why it’s so important that the law require true patient consent.”

The MCLU pointed out, for example, that the Northern Berkshire eHealth Collaborative in Massachusetts exceeded 95 percent participation using opt-in.

Heiden doesn't buy the argument that, in order for an HIE's true potential to be realized, a critical mass of patients need to participate – and that opt-out is the only way to ensure that. He said patients should want to participate in a health information exchange after being educated on the merits of the technology.

"I've heard that argument, but I've never quite understood it," he said. "Because it seems to presume that people are not going to want to participate in this system if they know about it. Why make that assumption? Why not have a system where, the more people know about it, the more they'd want to participate?"