Friday, February 01, 2008

Kansas Abortion Provider Ordered to Turn Over Medical Records

What do you consider identifying personal data in your medical records? It's not a trick question, but a genuine one based on the ruling, earlier this week, that a Kansas abortion provider must turn over 2,000 patient records - the records of all women who have had late term (21 weeks or later) abortions in the past five years.

In Kansas, citizens have a right, based on an obscure 19th century law, to convene grand juries when they feel the government isn't enforcing a law. As far as I can trace back, the two citizen subpoena's are based on two separate laws that Kansas for Life feels are not being enforced, and that these records are necessary to prove it. The first law requires reporting sexual abuse in minors (and they argue that 11 and 12 year old's are receiving late term abortions without the 'abuse' being reported), while the second prohibits late term abortions unless they are medically necessary.

In other words, it's a wide dragnet to investigate abortion in Kansas.

Now, to be clear, I'm not basing this conclusion on who is behind the subpoena, or even the stated goals of the prosecuting attorneys. I'm basing it on the argument that they are looking for signs of abuse, or medical necessity - in health records that are supposedly going to be redacted of name, age, and identifying medical history.

If you take away name, age, and identifying medical history - exactly what do you have left, that allows the investigation of either of these laws that Kansas for Life says are not being enforced?

Further indications that this is a wide dragnet hidden behind other laws is the fact that they also want the records of any woman who was 22 or more weeks pregnant who came in and even consulted about an abortion, even if she didn't have one. Where's the necessary information here in enforcing laws? I can't see one - and the request is construed broadly enough that it sounds as if even mentioning abortion (even to say "well, I know it's an option because the fetus has XYZ problem, tell me more about it... mm, I don't think that's for me, but thanks") is enough to flag your record.

So the question then becomes - can you truly redact medical records that will remove personal and identifying information, and still leave meaningful data that will tell them what they want to know about abortions in Kansas? Your medical history is a map across your body, building a record that's unique to each individual. Every scar I have leads the way to a story, every surgery, every break and set of bone, every time my lungs decide to stop working. Every medication taken is a marker along the path, all of which will build to create a single individual.

Yes, in theory Tiller, the abortion provider, will be passing these files to another doctor and attorney to independently review and redact. But I remove identifying data from papers all the time, and I know how easy it is to miss just a single word that clearly flags who the person is. Attempting to redact 2,000 medical records in 68 days? The magnitude of error possible is staggering.

As of yesterday, Tiller's attorneys have filed an appeal to the Kansas Supreme Court, and refused to hand over any files until after the Supreme Court makes their ruling.



GrannyGrump said...

Do you honestly believe that the people sitting on that grand jury are going to memorize women's ages, medical information, and such, and from that somehow track down who they are?

They'd have to have photographic memories and a hell of a lot of spare time.

Who are you going to track down based on how pregnant she was on a particular date, and the fact that afterward she was no longer pregnant at all? All without knowing what state she lives in, much less what county, what city.

Kelly Hills said...

grannygrump - I worry about a lot of things in these situations. I worry about the people outside of the doctor's practice who will be "blinding" the files, who will have access to the women's names, ages, where they live, medical information. I worry about notions of privacy, because it's all too common for information like that to go wild, especially the more people who're involved and can see it to begin with. I worry about people with agendas working behind the scenes, and I worry about the intimidation that's inherent in this.

It's not just about medical privacy, it's about intimidation - that, if you go have an abortion, it's no longer a matter between you, your partner, your medical provider. It becomes part of the larger community, and you lose the choice and control over who has the information and what they do with it.

They're removing name, age, and supposed identifying medical information - the things very necessary, at the heart, for what they purport the investigation to be about. But identifying medical information is a vague concept; does it identify me to say "tall caucasian female, blonde, history of high blood pressure, family history of cancer, deceased mother, asthmatic, on [list of medications]"?

On the face of it, you could say "oh, that describes SO many people in this country" - and it does. But they're not removing where the women live - at least, not city and state - from the records. And with that small bit of information (even just a more basic quandrant local), anyone with a background in security, informatics, and privacy can easily narrow the scope down. There have already been studies with medical records showing that, even redacting everything but general age, general medical and prescription history, it's possible to track people down. For that matter, something as simple as "lived in Seattle, moved to Albany in 2006" narrows the field dramatically. You don't need a name to trace people.

The people who will have access have access - and don't need the memories. And given that this case has been going on, in some iteration, for several years, they have certainly proven the have the time.

Ultimately, my concern is this: it's a privacy issue. What treatment you receive at the hands of your doctor is your business, and not mine. And my medical records are mine, and not yours - and the only way to sanitize them to the point that they could never be traced to me [or you, or anyone] would be to remove all content, period.