National All Schedules Prescription Electronic Reporting Act of 2004

NATIONAL ALL SCHEDULES PRESCRIPTION ELECTRONIC REPORTING ACT OF 2004 -- (Extensions of Remarks - October 11, 2004)

Mr. MARKEY. Mr. Speaker, I rise to express my strong concerns about the lack of adequate patient privacy protections in H.R. 3015, the National All Schedules Prescription Electronic Reporting Act of 2004.

H.R. 3015 is intended to support states' efforts to prevent the abuse of certain controlled substances through the provision of federal grants to the states for the purpose of establishing and implementing controlled substance monitoring programs. States would use the grants to develop and maintain an electronic database containing information about the type of medication prescribed, quantity dispensed, number of refills, and similar product information. The database also would collect personal information about each patient receiving prescriptions of the covered controlled substances, such as the patient's name, address and telephone number.

The abuse of controlled substances such as oxycontin and amphetamines is a serious problem that plagues many Americans. In response to the seriousness of the problem of prescription drug abuse, more than 20 states, including Massachusetts, have taken steps to prevent such abuse through the establishment of reporting requirements on pharmacists and the creation of drug monitoring databases similar to those contemplated by H.R. 3015. In Massachusetts, for example, pharmacies are required to report the prescriptions they fill for substances in Schedules I and II to the state's department of Public Health.

The problem is that H.R. 3015 does not provide the safeguards that are required to shield patients-the vast majority of whom will be law-abiding citizens receiving medications as part of a legitimate plan of care-from unauthorized disclosure of their personal medical information. Instead, the legislation provides the states broad leeway to establish databases of patients' private medical records with little guidance on the privacy protections that must be in place in order to qualify for the grants.

For example, H.R. 3015 does not require states to limit access to the database information to a finite and identifiable number of individuals. Instead, the bill permits disclosure of individually-identifiable patient information in the database to a wide range of professionals in addition to practitioners and law enforcement personnel, including any local, state or federal "narcotics control, licensure, disciplinary or program authority" who can make specific certifications as to the need for access to the information. Any "agent of another state" with a monitoring program approved by the bill also could gain access to patient records in the database, provided that the purpose of the access is for "implementing the state's controlled substance monitoring program." Such easy access puts the privacy of potentially hundreds of thousands of law-abiding citizens at risk of unauthorized disclosure.

Additional privacy protections that are missing from H.R. 3015 include: a requirement that states receiving grants under the terms of the bill periodically purge the database of information about any particular prescription after a limited amount of time; unambiguous language stipulating that the bill does not override established standards of medical ethics relating to privacy; establishment of specific penalties for unauthorized access and redisclosure; and a provision making clear that the term "minimum necessary" as it relates to the limitation of information to the "minimum necessary" needed to comply with a request for patient data be interpreted as defined under the Amended Privacy Rule.

While I strongly support efforts to prevent the abuse of controlled substances, H.R. 3015 does not contain sufficient guidance to the states on the level of privacy protections that they must provide in the creation and maintenance of the databases authorized under the legislation. The potential for the invasion of patient privacy resulting from such databases is not merely theoretical. The New York Times reported on October 1, 2004 that confidential records of nearly 4,000 abused and foster children in Central Florida were available to the public on the Internet for at least four months because of a security breach in a child welfare computer system. The records included the children's names, photographs, Social Security numbers, case histories and locations of the foster homes they were in, and were accessible on a Web site of a private children's agency under contract with the Department of Children and Families. I am including a copy of this article for inclusion in the Record.

Now that H.R. 3015 has been approved by the House, I urge the Senate to strengthen the privacy provisions in the legislation so that the important goal of preventing prescription drug abuse can be advanced without sacrificing the privacy of law-abiding patients. [From the New York Times, Oct. 1, 2004]

CONFIDENTIALITY FOR FOSTER CHILDREN IS BROKEN
(By Terry Aguayo)

MIAMI, Sept. 30.-Confidential records of nearly 4,000 abused and foster children in Central Florida were available to the public on the Internet for at least four months because of a security breach in a child welfare computer system, the Department of Children and Families said on Thursday.

The records included the children's names, photographs, Social Security numbers, case histories and locations of the foster homes they were in, and were accessible on the Web site of Kids Central, a private children's agency under contract with the Department of Children and Families, the state's child welfare agency.

In April or May, Kids Central began using a computer system designed to let private caseworkers review state child welfare records through the Internet, said to Janice Johnson, chief executive of Kids Central in Ocala. Although a user name and a password were needed to reach the records, some passwords and user names became available online in unrestricted files created when caseworkers sought technical help with the system.

"Confidentiality is critical," said Don Thomas, district administrator for the Department of Children and Families in Central Florida. "If these kids are in the child welfare system to begin with, they have a far from ideal life, and if their personal information is available to those who don't have to know, it violates their privacy."

Department administrators ordered the Web site shut down on Wednesday after a reporter for The Miami Herald, which first reported the problem, informed them of the flaw. It was back up Thursday morning after the security issues were resolved, Mr. Thomas said.

Mr. Thomas said he knew of no one, other than the reporter, who gained access to the records because of the flaw.

"A child's case record is a child's life. It should be treated as sacred," said Richard Wexler, executive director of the National Coalition for Child Protection Reform and a strong critic of the department. "Given the kind of information, I think there is a clear danger, particularly since the locations of these children were made available to anyone."

The Department of Children and Families has been afflicted by numerous problems that surfaced after it lost track of a 4-year-old foster child, Rilya Wilson, and did not notice she was missing until 15 months later, in April 2002. She remains unaccounted for. Jerry Regier, the department's secretary, resigned in August as a result of accusations that he and two top aides took favors from contractors.