Massachusetts residents should consider how their new universal health insurance law will affect patient privacy. The law creates a new “health care quality and cost council” authorized to “collect, analyze and aggregate data related to costs and quality across the health care continuum.” The council will be established “within, but not subject to control of, the executive office of health and human services.” It will consist of 13 representatives, including the attorney general (or his designee) and the state commissioner of insurance.

Health-care providers and insurers are mandated to submit data to the council or to an independent organization collecting data on behalf of the council. The law states that “If any insurer or health care provider fails to submit required data to the council on a timely basis, the council shall provide written notice to the insurer or provider. If the insurer or health care provider fails, without just cause, to provide the required information within 2 weeks following receipt of said written notice, the insurer or provider may be required to pay a penalty of $1,000 for each week of delay; provided, however, that the maximum penalty under this section shall be $50,000.”

Establishment of the council raises some important questions:

• What privacy law governs the new council and the collection of patient data in Massachusetts?
• What rights to privacy do patients in the state have?
• Who owns people’s health data in Massachusetts: individuals, providers, insurers, or employers? (For example, if a patient uses employer-sponsored health insurance for dental services, who has a legal right to the resulting information?)
• Will patients be informed that their data is being shared with the council?
• Will patients have a right to know what data is collected about them and held by the council?

The council is required to hold annual public hearings to obtain input from health-care industry representatives, health-care consumers and the general public. Massachusetts residents who care greatly about their health-care choices and privacy should seek clarification of these important issues and perhaps demand a stronger state medical-privacy law, one that cannot be preempted by the so-called federal medical privacy rule (which does not guarantee true confidentiality).

Source: “Chapter 58 of the [Massachusetts] Acts of 2006: An Act Providing Access to Affordable, Quality, Accountable Health Care,” Approved (in part) April 12, 2006: http://www.mass.gov/legis/laws/seslaw06/sl060058.htm