Today the Palm Springs, CA Desert Sun reported that a medical marijuana dispensary has to turn over client names; it discusses whether this is a violation of HIPAA.  The key to that answer is whether or not such an organization is considered as a covered entity.  Of course, there could very well be other privacy laws being violated; however, sometimes the main focus for an information health-related automatically goes to HIPAA…which makes sense, but could be the least effective route to take with regard to privacy rights.

"Palm Desert medical marijuana dispensary is being required to turn clients’ names over to authorities, and client advocates say that violates their privacy rights.  Palm Desert city attorney David Erwin said the deal between the city and the CannaHelp dispensary on El Paseo, is merely meant to ensure that the dispensary is obeying state law.  The agreement, negotiated by Erwin and James Warner of San Diego, a lawyer for the CannaHelp dispensary, requires the dispensary to turn over clients’ names and state ID card numbers to the Riverside County Sheriff’s Department.  Calls to Warner on Friday from The Desert Sun were not immediately returned.  Under the agreement, finalized and made public this week, CannaHelp is allowed to sell medical marijuana only to users with a state medical-marijuana ID card.

The Desert Sun obtained a copy of the March 31 agreement signed on April 10 through the city clerk’s office.  The dispensary must also provide the sheriff’s department with weekly sales records, including clients’ names and ID numbers, and allow officers to review sales records at the dispensary every other week.  And that, said Lanny Swerdlow of Palm Springs, head of the Marijuana Anti-Prohibition Project, a patient support group, is a violation of the federal Health Insurance Portability and Accountability Act – HIPAA – which ensures the confidentiality of patients’ medical records. Under the law, patient records can be released if the patient signs a waiver.  "The dispensary should be viewed as a health care provider; all health care providers are bound by HIPAA," Swerdlow said. "I can’t imagine any patient in their right mind wanting their name to be released to the sheriff’s office."

But Erwin said the state and federal laws do not apply to the dispensary because it is not a medical facility and its customers are not patients.  "We’re getting nothing about the individual or anything else," he said. "We are getting information to see if they are complying with the Compassionate Use Act of California.""

It’s not considered a covered entity?  What is a "medical marijauna dispensary"?  Every article I could find referenced the people who got their legal marijuana there as "patients" getting their doctor prescriptions.  It appears from a state of California website that the folks going to these dispensaries are considered as patients.  Would these dispensaries be considered as a type of pharmacy then…dispensing of what seems to be considered as drugs in similar ways?  That’s probably the sticky wicket in this case.

"Passed by ballot initiative in 1996, that act, better known as Proposition 215, legalized medical marijuana for individuals with a doctor’s letter of recommendation. Senate Bill 420, passed in 2003, provided guidelines for implementing the law and required counties to set up offices to help issue the state IDs, which are supposed to be voluntary.  Mike Lerner of La Quinta, a CannaHelp client, said he had not applied for an ID yet, but if he had, he would not mind the sheriff’s office getting his name and ID number.  "You’re putting your name on the county register when you sign up. It’s a matter of public record," he said.

Room for compromise?  At the dispensary, owner Stacy Hochanadel said he would comply with the agreement but was still uncomfortable about turning over clients’ names.  "I’m trying to figure out if giving them just the ID numbers would be good enough to see if they’re verified," he said. "I don’t want to be sued for divulging confidential client information.""

I don’t know…would this be a case of the state of California law preempting HIPAA? 

"Palm Desert Mayor Jim Ferguson indicated Friday there might be room for compromise.  "(The agreement) should probably (be limited to) the ID number," he said. "I am not of the mind to collect information on individuals and turn it over to law enforcement. We honestly are trying to do the right thing."  But Erwin said that without clients’ names, "the agreement is not very effective. All you get is a number. What are we going to do with a number?" 

Conflicts of law

The question of exactly which laws do and don’t apply to the dispensary is further complicated by the conflict between California and federal law.  Using, growing or selling marijuana is illegal under federal law, and the U.S. Supreme Court ruled in June in Raich v. Gonzales that federal law takes precedence over state medical marijuana laws like California’s.  Alan Zamansky of the California Office for HIPAA Implementation said that means medical marijuana users are not covered by federal privacy protections.  And he said SB420 allows the city "to adopt and enforce regulations and laws relative to (the dispensary). The conditions that they made would appear to be helping to enforce that by ensuring only appropriate people would be able (to buy medical marijuana).""

Well…this is interesting…a precedence has been established…that HIPAA should preempt the state law?

"On the other side of the argument, Peter Warren, spokesman for the California Medical Association, notes that the California Supreme Court ruled in 2004 that doctors’ records relating to a patient’s use of medical marijuana are confidential.  And, he said, that protection could extend to dispensary records, like ID card numbers or the doctors’ letters of recommendation required to get them.  "One can presume under Proposition 215, something that authorizes (medical marijuana use) in a legal circumstance for a medically approved use is a medical record," he said."

This is a very good point…if a doctor has to prescribe it to get it from a licensed dispensary, then that would certainly seem to fall under HIPAA TPO…and the accompanying HIPAA PHI protections.

"Another state Supreme Court decision, People v. Mower, in 2002, ruled that state officials have to treat medical marijuana the same as any other doctor-recommended drug, said Kenneth Michael White, a legal adviser for the Marijuana Anti-Prohibition Project, Swerdlow’s group.  "We’re talking about people’s medicine," White said. "You don’t usually have to waive medical privacy to get your medicine at a pharmacy."

Patients come first

Hochanadel said he will be posting notices at the dispensary advising clients that their names may be given to the sheriff’s department.  He is also concerned that sheriff’s officials could turn the biweekly reviews of his sales record into fishing expeditions.  "Am I going to have to justify every person? I have no idea who’s coming into my store, what their educational background is in medicine; it’s up in the air," he said. 

Representatives from the Riverside County Sheriff’s Department did not return calls seeking comment Friday.  Ryan Michaels, a former client at CannaHelp, said he had decided to find other sources for the medical marijuana he uses for his arthritis.  "My decision is to go to a different collective. I can’t be associated with that situation," he said. "When I look at medical marijuana, (dispensaries) come second, patients come first. You protect the patient.""

Hmm…does seem like HIPAA should protect this information, though, doesn’t it?

Technorati Tags
privacy
HIPAA
protected health information
Proposition 215
law
government

I recently spoke with Jenny Wiseman at TechTarget about some common compliance myths.  The story, "Compliance Q&A: Myths, mistakes and management advice," was published today.

Check it out and let me know what you think…especially if you think I left out something critical during my discussion.

Technorati Tags
compliance
information security
TechTarget

The Transportation Security Administration (TSA) today announced that Peter Pietra has been named the agency’s director of privacy policy and compliance.  He now is TSA’s assistant chief counsel for information law.

"The Homeland Security Department agency said in a press release that Pietra’s appointment, along with expanded staffing of TSA’s privacy office, showed its commitment to privacy protection. "Peter’s appointment extends the privacy functions he currently serves and is expected to build a strong privacy program within the agency," said Kip Hawley, TSA administrator. "That knowledge, along with the close working relationship he has established with the DHS Privacy Office, makes him well suited for this new post." TSA said the pending launch of the Transportation Worker Identification Credential, Registered Traveler and Secure Flight programs highlight the increased workload and need for improved public communication about privacy policies. All three programs involve the use of personal information to conduct background checks needed to approve transportation workers and travelers for speedy transit of checkpoints or access to sensitive facilities. Pietra earned an undergraduate degree from the University of Pennsylvania and was a field artillery officer in the Army. He graduated from Temple University’s law school. He practiced law in the private sector and as an attorney for the Coast Guard before joining TSA’s Chief Counsel Office in 2003."

Appears from the org chart posted on the TSA site that R. Gunderson is/was the current Chief Privacy Officer…in the Acquisition Department.

Technorati Tags
privacy
TSA
CPO

The Honolulu Star Bulletin reported today

"Records containing the names, Social Security numbers and birth dates of more than 40,000 individuals were illegally reproduced at a copying business sometime before January while they were waiting to be put onto a compact disc for the state.  State Attorney General Mark Bennett said federal authorities notified his office of the theft in January but asked that the information be withheld while an unrelated drug investigation was ongoing."

This illustrates one of the concerns with the loopholes in the existing and proposed breach notification laws; they allow law enforcement to delay notifications following such theft of personal information that can easily be used for identity theft and fraud, without providing any accompanying accountability to the law enforcement for the bad things that happen to the impacted individuals in the meantime. 

The information was withheld because of "an unrelated" drug investigation?  Someone, or perhaps several people, had 40,000 people’s SSNs and birthdates, and law enforcement thought it was okay that they be kept in the dark because of the remote chance that an unrelated drug investigation may somehow be involved? 

Accountability to law enforcement should be written in with these loopholes.  Perhaps then it would not be such a seemingly flippant decision for law enforcement to restrict notification if they were responsible for fixing all the messes that resulted from the crimes that occurred with the stolen data during that wait time when the corresponding people were kept in the dark.

""We are taking this issue very seriously and strongly advise those affected … to obtain and review their credit reports," state Attorney General Mark Bennett said yesterday in a news release. "Social Security numbers and other personal information can be used by thieves to obtain credit cards, to open fraudulent bank accounts, to mortgage property and purchase automobiles.""

They understand the risks, and yet they waited over four months to notify the individuals?  And now, they are advising them to obtain and review their credit reports?  They should at least be offering to pay for credit monitoring services for these people.  Again, organizations and law enforcement need to be more directly accountable for what happens to stolen personal data when they choose to delay notification.

"The records from the Voluntary Employees Benefit Association of Hawaii were set to be copied at NewTech Imaging in Honolulu when they were apparently illegally reproduced by one or more people, said Bennett’s special assistant, Dana Viola."

This is another surprising risk that was taken; highly confidential data was taken to a local public copy store and left to be reproduced?  Why was such a decision made to leave highly sensitive data in the hands of an untrusted third party, in what appears to be a neighborhood copy store, where the public mills about?

"She could not say when the records were taken, but Bennett believes it was after February 2005.  Federal investigators learned in January that the records had been stolen, Bennett said. Police later found the data on a computer that had been confiscated as part of an investigation into drugs.  Russell Okata, HGEA’s executive director, said the state is to blame for the theft because officials failed to "adequately protect the records" of the union’s members."

The sensitive data should never have been taken to a public store and dropped off for duplication in the first place.  Organizations who collect and maintain sensitive data must be responsible for it at all times, especially when they choose to entrust it to other organizations, for whatever reasons, and they need to be accountable when bad things occur as a result of those decisions.

Technorati Tags
privacy
law
identity theft
identity fraud
breach notification

Last week I posted that this was Health Information Privacy and Security Week.  Seems fitting that I should put a few resources out in observance of the week, doesn’t it?  🙂

• The American Health Information Management Association (AHIMA) has a site, myPHR, to help the public understand their rights over their personal health information, communicate how to preserve the privacy of their health information, and they also provide many tools and resources, many of them free, to help individuals keep track of their health information.
• Interesting news story appeared April 9 in the Delaware Cape Gazette, "Supreme Court’s Lawson ruling a win for privacy in death"  The first couple of sentences read, "The Delaware Supreme Court this week ruled that when a natural or accidental death occurs, a family’s right to grieve in private outweighs the public’s right to know what caused the death.  The ruling marks the first time that the court has reviewed Delaware’s 2002 health record privacy statute, which ensures that health information gathered by the state will not be improperly disclosed."
• Patient Privacy Rights provides some interesting information about health information privacy
• The American Medical Association (AMA) provides information about health information privacy and HIPAA.
• Privacy Rights Clearinghouse provides a "Medical Records Privacy Fact Sheet"
• The Privacy Commissioner of Canada provides some nice health links

Technorati Tags
privacy
law
PHI
HIPAA
health information