Idea of national patient IDs revives privacy fight

Advocates of unique IDs to match patients to their health records may be close to lifting a decadeslong congressional ban on using federal funds to develop the system.

The effort, long mired in broader debates over patient privacy, gained steam this fall when the Senate for the first time left the ban out of a fiscal 2022 spending package. But its ultimate fate is still tied to uncertainties surrounding the appropriations process and an overdue report on the benefits and risks from the Department of Health and Human Services’ health information technology office that could influence the system’s design.

“Whenever you propose anything that sort of resembles national ID, then what happens is that the ACLU will jump down your throat from the left and then the Red Dawn people jump down your throat from … the Libertarian right,” said Rep. Bill Foster (D-Ill.), who has led efforts to drop the ban with Rep. Mike Kelly (R-Pa.). The two lawmakers last month urged HHS’ health IT agency to publish its report, which was due a year ago.

The ID is a number that health providers would use to match and manage patient information and, for example, help distinguish patients with the same name. Unique identifiers have been billed as a way to reduce clinical mix-ups and improve patient safety and data sharing, while fortifying a patchwork medical privacy system. The United States is an outlier among developed countries in not having a universal patient identifier, experts say.

But the current push comes amid a pandemic that’s spawned heated debates over matters like vaccine passports and other digital credentials that touch on privacy and equity issues.

The most prominent defender of the funding ban is Sen. Rand Paul (R-Ky.), whose father, former Rep. Ron Paul, devised the language that was inserted in annual spending bills. Opponents like Paul fear a patient identifier could infringe on privacy and allow the government to track a person’s medical history — concerns similar to those the ACLU has articulated.

Senate Democratic appropriators stripped the ban from a spending bill this fall, saying it had been a barrier for health institutions reliably sharing patient information and for public health entities tracing contacts and tracking immunizations during the Covid-19 pandemic. Paul responded with legislation (S. 3124 (117)) aimed at removing HHS’ authority to develop health identifiers. Texas Republican Rep. Chip Roy introduced a House version, H.R. 5812 (117), raising concerns about surveillance and profiling of patients.

The fate of the ID system will likely be determined in February, when a stopgap spending measure, H.R. 6119 (117), is set to expire.

Sen. Bill Cassidy (R-La.), a physician who supports the patient ID, argued that an identifier could improve privacy by ending the need to rely on Social Security numbers, which if compromised, could leave both financial and medical data vulnerable.

“I respect that Rand is concerned about privacy. I just think he has it all wrong,” Cassidy said.

Outside experts say the privacy concerns are less of an issue than Paul and others argue.

David Bates, a professor of health policy at Harvard’s public health school and a professor of medicine, said Paul’s concerns aren’t legitimate and only reflect a “highly vocal minority” of the population.

Kirk Nahra, a leading privacy lawyer at WilmerHale, said a national identifier would likely bring significant benefits with manageable privacy risks, though that is still not yet settled.

That’s where the HHS health IT report comes in.

“We’d love to see them make a recommendation that [the ban] be eliminated,” said Mari Savickis, vice president of public policy at the College of Healthcare Information Management Executives. “Is that going to happen? That’s the million-dollar question.”

Backers of the system say the pandemic underscored the country’s outdated public health infrastructure, which hampered its Covid-19 response. The holes included poor data sharing, which the advocates say patient identifiers could help patch by allowing information like positive test results to flow more freely, allowing for a quicker response.

Many of the key technical details of what a patient identifier would actually look like have yet to be resolved, including what entity manages and assigns the identifiers, said Shaun Grannis, vice president of data and analytics at the Regenstrief Institute, a research organization. Medicare already uses a beneficiary identifier that consists of a string of letters and numbers.

Grannis and other experts say the issue touches on social, political and economic fault lines, though it’s wrapped in technology.

“There’s so much friction in moving health information today in our system. This would move a piece of that friction,” said Julia Adler-Milstein, the director of the Center for Clinical Informatics and Improvement Research and professor of medicine at the University of California, San Francisco.

Dozens of influential health care organizations have banded together to form the Patient ID Now coalition, including Intermountain Healthcare, the American Heart Association, the American Health Information Management Association and the American College of Surgeons. Foster argues that since the language removing the ban is in the text, momentum is on his side.

But despite the push, not everyone’s optimistic that the ban will be repealed.

“It’s a really tough uphill battle,” Savickis said. “But [the report] is something Congress asked for and so [the Office of the National Coordinator for Health Information Technology] needs to deliver it so we can move forward.”