RE-EXAMINING PERCEPTIONS ON HEALTHCARE PRIVACY

Moving from a Punitive Model to an Awareness Model

Mowafa Househ

College of Public Health and Health Informatics, King Saud Bin Abdul Aziz University for Health Sciences,

Riyadh, Kingdom of Saudi Arabia

Keywords: Post-privacy, Health information, Social media, Privacy.

Abstract: In this position paper, I argue that, in the near future, the advent of social media, patient empowerment, and

post-privacy will lead individuals to openly share their personal health information online with other

individuals and groups. These actions will undermine the need for current privacy legislation, which cannot

prevent individuals from divulging their own personal health information. As a result, current privacy

legislation must change from a punitive and restrictive model to a model that empowers and promotes

awareness about how individuals use their personal health information online.

1 INTRODUCTION

Over the years, there has been great emphasis on the

protection of patient privacy through the

implementation of various laws to protect health

information. One of the earliest papers on the subject

of privacy and confidentiality in health information

was published by the New England Journal of

Medicine in 1968 (Curran, Steams, & Kaplan, 1968).

In the paper, the authors advocate for state laws that

provide ethical and clearly defined regulations for

the protection of health information. It was not until

30 years later that the United States passed the

Health Insurance Portability and Accountability Act

(HIPPA) to protect the privacy and confidentiality of

health information (Wager, 2005). Although various

laws have been enacted to protect health

information, a recent Markle survey on health

reported that privacy related to the exchange and use

of health information was a primary concern for

physicians and patients (Lewis, 2011). Patients may

fear that their health information will be violated and

used by unscrupulous individuals or organizations,

as reported by the Health Privacy Project (Wager,

2005), which found health privacy violations such as

the following:

1) A woman’s medical records were posted on the

internet after she was treated for complications

resulting from an abortion

2) A man was fired after an insurance company

informed his employer that he had received

treatment for alcohol abuse

3) A clerk working in a hospital stole social

security numbers and used them to apply for

credit cards and open bank accounts

4) Files of persons living with sexually transmitted

diseases were sold by a U.S. state.

Over the past few years, the introduction of

social media such as Facebook, Twitter, and

YouTube has revolutionized the way individuals

seek, share and use information, specifically health

information. A recent study on the sharing of

sensitive health information through Facebook found

that Facebook users openly sought and shared

information related to behavioral, mental, and

genetic information (Househ, 2011). An interesting

finding from the research was that most Facebook

users included in the study publicly identified

themselves by divulging their name, photo, and

location when seeking sensitive health information

through online postings. The author of the study

suggested that the growing use of social media and

sharing of personal information may be changing

society’s perceptions on privacy from a strict

implementation of privacy to one that is more

lenient.

Over the past few years, the post-privacy

movement, which advocates the end of privacy rules

and legislation, has begun to gain traction. Post-

privacy advocates argue that even though laws

protect how information is shared and used by

organizations, there are no laws to prevent

individuals from sharing their own information

287

Househ M..

RE-EXAMINING PERCEPTIONS ON HEALTHCARE PRIVACY - Moving from a Punitive Model to an Awareness Model.

DOI: 10.5220/0003873602870291

In Proceedings of the International Conference on Health Informatics (HEALTHINF-2012), pages 287-291

ISBN: 978-989-8425-88-1

 2012 SCITEPRESS (Science and Technology Publications, Lda.)

(Heller, 2010). There are indications that a post-

privacy world is beginning to emerge in healthcare,

especially through the website Patients Like Me,

where individuals can post their health information

online and share it through a social network.

In this position paper, I argue that that with the

advent of social media, patient empowerment, and

post-privacy, individuals will openly share their

personal health information online with other

individuals and groups, undermining the need for

current privacy legislation. As a result, current

privacy legislation must change from a punitive

model to one that promotes awareness about how

individuals use their personal health information

online.

2 HEALTHCARE PRIVACY

In the United States, privacy has been defined as the

“constitutional right to be left alone, to

be free from unwarranted publicity, and

to conduct [one’s] life without its being

made public” (Wager, 2006).

Within healthcare, privacy and confidentiality define

how health information is shared; these factors form

the basis of all healthcare privacy legislation.

Privacy is viewed as an individual’s right to place

limits on who can use his or her personal health

information (Wager, 2006). Confidentiality relies on

trust that healthcare providers and organizations will

not use healthcare data for purposes other than those

intended, such as treatment or research. These two

fundamental principles have guided United States

legislation, such as the Freedom of Information Act

(1966), The Privacy Act (1974), and the Health

Insurance Portability and Accountability Act.

The two basic concepts of privacy and

confidentiality can be summarized as follows:

“As an individual, I have the right to

limit who can use my healthcare

information. When I am a patient, I will

share my personal health information

with my healthcare provider because I

trust that they will not use it in any way

to harm me.”

This is a valid assumption currently held by

many individuals. It stems from the fear that other

individuals may access one’s personal information,

resulting in societal and economic repercussions. For

example, if people find out that an individual suffers

from a drug problem, their friends and neighbors

may ostracize or reject them, or the individual may

lose his or her job. Other examples may include

cases of sexually transmitted diseases or genetic

diseases, where people can be harmed as a result of

healthcare privacy violations.

The various privacy laws attempt to reduce

privacy violations and punish those who commit

these healthcare violations. The government has

taken the responsibility of protecting individuals

from improper use of their healthcare information

and has established laws that allow healthcare

information to be released without the patient’s

consent in cases of communicable disease (e.g.,

AIDS), patient transfers to another hospital, billing

or court cases (Wager, 2009).

In sum, the government has taken the liberty of

enacting laws to protect the privacy and

confidentiality of health information from improper

use. Nevertheless, if privacy is an individual right,

then government should not implement punitive

measures to limit how health information is shared.

Rather, the individual should decide who may access

their personal health information. It is assumed that

the government puts individual interests before its

own, but the government also divulges information

for court orders and in cases of communicable

disease. Therefore, privacy legislation does not

empower the individual; rather, it empowers the

government by allowing it to control the flow of

health information. This shows that situation is

beginning to change as the consumer becomes more

informed and empowered through access to and

control over their health information.

3 EASTERN SOCIETIES

For years, Middle Eastern societies have existed

without the need for privacy laws. The concepts of

privacy and confidentiality within healthcare, and in

society in general, is of little concern. This may be

because the use of healthcare information has not

matured to the point that it is seen as a threat. More

likely, this situation stems from the cultural attitudes

of society.

In Middle Eastern societies, when someone is

suffering from a health problem, family members,

close friends and neighbors become aware of the

situation and visit the family at home and at the

hospital. They bring food and offer emotional and

financial support, if needed. This practice has

existed for hundreds of years and is rooted in Islamic

religious practices.

However, people in Middle Eastern societies are

less likely to discuss sensitive issues, such as drug

HEALTHINF 2012 - International Conference on Health Informatics

288

addiction, sexually transmitted diseases, and genetic

disorders. Discussion of these subjects could result

in the individual being socially ostracized.

In sum, in Middle Eastern cultures, awareness of

healthcare privacy is of little concern. Healthcare

privacy is necessary when there are social

repercussions for sharing sensitive health

information, especially regarding sexual, genetic, or

addiction issues.

Advocates of the post-privacy movement agree

with these assertions and see social media as a

conduit for changing perceptions of healthcare

privacy. The post-privacy movement promotes the

individual’s freedom to share information with

others who share the same disease, values, or norms

(Heller, 2010). In a post-privacy world, a person

ostracized from their society can create an online

society that is more accepting and tolerant. The

individual is no longer bound by the norms of the

physical world; he or she is free to create virtual

societies with individuals who share the same goals,

views, values and challenges.

4 THE ROLE OF SOCIAL MEDIA

There has been recent growth in the use of social

media, especially online social networking, within

healthcare. One of the earliest studies on the use of

social media in healthcare examined the use of the

Bulletin Board System for nurses’ education (Russin

& Davis, 1990). The study found that the major

impediments to implementing such a system

included cost, maintenance, and the lack of

preparation for the technology in the nursing

profession.

With the current widespread use of the internet

and its relatively inexpensive bandwidth, social

media, particularly social networking, is beginning

to be used by healthcare professionals and patients.

In a commentary published by the Journal of the

American Medical Association, authors Shachak and

Jadad argue that the use of social networks will

eventually lead to a more people-centered healthcare

system that will improve communication and

information flow between patients, providers, and

administrators (2010). Other studies have shown that

users of Facebook seek health information online

(Househ, 2011). Websites for social networking,

such as Patients Like Me, are beginning to cater to

the need for social networks for health information

support.

There is a growing awareness within society

about patients’ engagement and empowerment in

taking control of their health. For example,

Sunnybrook Hospital in Canada has recently

provided its patients with full access to their

personal healthcare records (CBC, 2011). Google

Health and similar technologies empower patients to

manage their own health. Facebook provides a

platform for individuals to connect with others

suffering from the same disease or disorder. With

over 500 million users (Facebook, 2011), the

potential to connect with people suffering from the

same disease or disorder is higher on Facebook than

on any other social media networking site.

With the advent of social media, millions of

people seek and share health information online. As

Househ’s study revealed, individuals are creating

groups to share information relating to sensitive

health information, such as AIDS and cystic fibrosis

(2010).

In 2004, I conducted a research study on online

forums where people shared information on bipolar

disorders. I found that many people shared

psychological, spiritual, and relationship advice on

the internet. The online forums were anonymous,

and it was difficult to identify a person unless he or

she shared personal information, which did not

happen often. However, with the increasing use of

Facebook, people are beginning to share personal

health information online. This becomes an issue

when sensitive health information is shared, such as

information relating to sexually transmitted diseases,

addictions, and genetic disorders. Many people

create their own groups to discuss and share

information relating to various diseases, and they

openly reveal their identities. These individuals

create their own societies of people facing similar

health problems that cannot be discussed outside of

these online communities.

Thus, the concepts of privacy and confidentiality

are changing as a result of social media. People are

taking ownership of their own data and sharing this

information with others with similar characteristics.

There is currently no legislation to prevent

individuals from sharing their information. This is

the dilemma: governments have introduced privacy

legislation to limit the use of health information and

to protect the individual’s right to privacy, but with

the advent of social media, individuals are taking

ownership of their own health information and

sharing it with social networking and media groups.

With these changes in perceptions of privacy and

the use of health information, many questions arise

about the usefulness of privacy legislation. I suggest

that privacy legislation should be re-examined in the

wake of social media because this type of legislation

RE-EXAMINING PERCEPTIONS ON HEALTHCARE PRIVACY - Moving from a Punitive Model to an Awareness

Model

289

is ineffective when individuals decide to share their

information publicly. The current privacy laws are

mainly applied to the organizations that house the

data, such as medical facilities. No legislative

authority can prevent a person from sharing his or

her information online.

A comparable situation is the U.S. witness

protection program. The government established this

program to protect witnesses before, during, and

after trial. The government provides witnesses with

new identities and relocates them in an attempt to

protect the individual from harm. However, the

individual choose to leave the program at any time

may and make his or her whereabouts known. The

government may advise against it, but the choice

remains with the individual, and he or she is

responsible for the consequences that arise as a

result of his or her own actions.

Today, many individuals share their health

information online without knowing or caring about

the potential consequences of their actions. These

individuals may feel that the potential to create and

join online societies through social media sites

provides them with support and acceptance from

others. They become part of a community of

individuals who share the same values, norms, or

disease, where they can seek emotional support,

health information, and guidance. They do not feel

judged within these groups because all of the

members share similar identities.

I suggest that, as a result of these changes,

privacy legislation will be repealed or changed

dramatically as more individuals feel empowered by

social media to post their personal health

information online. With the growing awareness of

patients’ engagement and empowerment in control

of their health, individuals will ultimately have the

sole responsibility of deciding who can use their

health information, how it can be used, and where it

can be shared. The government’s role will be to

ensure that proper mechanisms are in place for the

patient to access his or her personal health record. In

this emerging trend, patients are becoming

increasingly empowered to take control of their

personal health information.

Given these social changes with respect to the

use of health information by individuals, I suggest

that privacy legislation must move from a model that

is punitive and restrictive to one that creates

awareness and openness about the sharing and use of

health records.

The privacy awareness model should focus on

creating policies that allow the patient full access to

his or her personal health record. The individual

becomes the sole owner of this information and can

use information technology to determine which

hospitals, physicians, groups, and individuals can

view his or her health record. Policies should be

created to ensure that individuals have the sole

responsibility for viewing and controlling access to

these records. Furthermore, guidelines should be

developed to educate individuals about what it

means to maintain control of their personal health

records.

In conclusion, this paper argued that the current

societal changes as a result of social media, patient

empowerment, and the post-privacy movement will

change current perceptions about privacy and

privacy legislation. The current privacy legislation

empowers governments, although the individual is

the owner of the patient record. Current privacy

legislation imposes punitive measures on

organizations and individuals that violate the health

privacy laws. The move toward an awareness model,

in which patients have control and access to their

health records, requires a model that focuses on

educating individuals about how to understand, use,

and share their personal health information. The goal

of the personal health information record should be

to give patients the freedom and liberty to use their

health information as they see fit.

ACKNOWLEDGEMENTS

I would like to thank the King Abdullah Institue for

Medical Research for their help in editing this

document. I would like to thank Dr. Wesly Roher for

his feedback and support. As well, I would like to

thank Ms. Zaina Al-Enizy for help in the editing

process.

REFERENCES

Canadian Broadcast Corporation (CBC). Online health

records popular with patients. Canada. January 30,

2011. Webaccess [http://www.cbc.ca/health/story/

2011/01/30/e-health-records-sunnybrook.html#ixzz1D

5SAJCKU]

Curran W J, Steams B, Kaplan H. Privacy, confidentiality

and other legal considerations in the establishment of a

centralized healthdata system. N Engl J Med.

1968;281:241-8.

Heller Christian (2010) Accessed October 25, 2011 [http://

www.dailymotion.com/video/xfihu5_christian-heller-

post-privacy_tech]

Househ M. Sharing Sensitive Personal Health Information

through Facebook: the Unintended Consequences.

Stud Health Technol Inform. 2011;169:616-20.

HEALTHINF 2012 - International Conference on Health Informatics

290

Lewis N. (2011) Privacy, accountability, lead health IT

concerns. Information Week Healthcare. Webaccess

February 3, 2011 [http://www.informationweek.com/

news/healthcare/EMR/showArticle.jhtml?articleID=22

9200192&subSection=News]

Wager K, Wickham F, Glaser J. (2005). Managing

healthcare information systems: A practical approach

for healthcare executives. Jossey-Bass. San Francisco,

CA, U.S.A. pg. 83-84

Facebook. Statistics. Webaccess February 3, 2011 [http://

www.facebook.com/press/info.php?statistics]

RE-EXAMINING PERCEPTIONS ON HEALTHCARE PRIVACY - Moving from a Punitive Model to an Awareness

Model

291