Regulating health information: a US perspective

Technologically mediated health care raises problems of quality of information, cross border practice, and patient confidentiality. Nicolas Terry probes the legal aspects of these complexities, and Benedict Stanberry adds a European perspective

Identifying the regulatory agenda for health information is not difficult. The quality of publicly available health information, cross border medical and pharmacy practice, and the privacy of medical records appear on the radar screens of most public health and consumer protection organisations. Left unregulated, any of these issues can cause considerable harm. Each issue also embodies difficult tensions: state versus federal rights, increased access to care versus quality assurance, and confidentiality versus professional discourse.

US state and federal legal systems have not achieved a coherent approach to regulating the dissemination of health information. Furthermore, the American experience will not always transfer directly to publicly funded medicine and government initiatives. Nevertheless the American experience with private sector ehealth is an instructive model, even if some areas have been neglected and others over-regulated.

Summary points

• Quality of publicly available health information, cross border medical and pharmacy practice, and privacy of records will be key issues for European regulators

• Concerns about medical advice sites may be exaggerated

• US regulators have yet to find the appropriate balance between risk and benefits of cross border practice

• New US federal laws on health privacy appear cumbersome but may be instructive for other legal systems

Regulating the quality of online health information

Concerns about widespread inaccuracies in online health information are speculative and intuitive rather than based on robust research. Berland's quality assessments, at least for English language sites and well educated users, suggest the picture is not so gloomy as critics expected.¹

Public law regulation of health information may conflict with US guarantees of free speech, and differences of opinion among medical professionals make the broad regulation of health advice difficult. Consequently, intervention through public law is reserved for obviously dangerous health content where government agencies can apply traditional consumer protection, drug regulation, and fraud powers, as with the Federal Trade Commission's “Operation Cure.All.”²

Arguments about freedom of speech can be used to defend private legal actions against web sites offering medical advice, and precedents from actions against publishers of “advice” or “how to” books show that such claims are hard to win.³ Case by case, retrospective, private law “regulation” may, however, be judicially more acceptable than blanket public law regulation.

Since regulation can do only so much to deter the web's snake oil salesmen, the focus inevitably shifts to strengthening the role of the market by reducing the costs of health information to the consumer. “Kitemark” or “trustmark” schemes seek to limit the need for consumers to assess the quality of information themselves by encouraging providers to rate their own contributions or to comply with codes of conduct. With compliance or rating in place, a technology layer can be added that leverages downstream filtering technology or upstream filtering through membership in a distinct top-level domain⁴; Medcertain is an example of downstream filtering technology,⁵ whereas the World Health Organization favours the upstream approach.⁶ Filtering persuades content producers to participate in ratings systems because search engines and, increasingly, browsers may be set to ignore unrated sites.

One approach that is emerging in the United States is to combine the evaluation of online content—for example, kitemarking—with private accreditation, a quality assurance system widely adopted by bricks and mortar healthcare providers.⁷ For this, a provider of online health information would subscribe to an accrediting agency's quality standards and pay the agency to check for compliance. Accreditation is a particularly interesting model because it uses a well respected method of quality assurance that is already recognised in private malpractice actions and brings traditional healthcare bodies and online providers under the same quality assessment umbrella. The use of such a model will also be of interest to litigators as US courts have held that failure to comply with applicable accreditation standards may constitute sufficient evidence of medical malpractice.

Whether simple or sophisticated, and whether relying on self regulation or rating by third parties, kitemarking systems are not without their difficulties,⁸ critics,⁹ or legal pitfalls, including the potential liability of rating organisations to private legal actions.¹⁰ The voluntary adoption of codes of conduct in good faith by health websites should not be trivialised or discouraged. Equally, the potential for fraudulent self rating and the likelihood that kitemarking will reduce consumers' natural skepticism about health information continue to trouble US regulators; this may explain a lack of enthusiasm relative to that of their colleagues in Europe.

Controlling cross border practice

With the appearance of online medical advice sites, it is easy to overlook the proportion of cross border health information provided by physicians and pharmacists. In the United States, healthcare institutions are subject to national accreditation standards, and they educate their medical students according to a national curriculum with a view toward national testing. Medical professionals, however, are exclusively regulated by state authorities. Most state licensing and disciplinary systems assume that there will be some level of cross border medical practice by providers who consult with colleagues in other states or treat their travelling patients; these activities are not required to be licensed. Such exceptions aside, however, US states insist on local licensing.

Theoretically, increasing cross border services through technologically mediated health care should stimulate interest in an overall liberalisation of cross border practice. In reality, state authorities are strengthening their legislation to deter interstate ehealth services that either originate from or are received within their borders.¹¹ While some of the voices raised against ehealth may have protectionist accents, the reality is that states' disciplinary and quality assurance powers are tied to the licensing process and there is no political will for moving such functions to a federal body.

In the United States federal regulators have legal competence over drug approval and marketing. Nevertheless, pharmacists, like doctors, face a state-by-state system of licensure and discipline. Licensing and quality issues, however, are not such a problem in pharmacy because it is easier for pharmacy chains to comply with multiple licensing requirements. The National Association of Boards of Pharmacy has facilitated compliance and consumer education by setting up a national system for trustmarking online pharmacies.¹² Additional state by state regulation of pharmacists may, however, be imminent. At least one state now believes it can achieve indirectly what it has failed to do directly: stopping internet doctors from writing prescriptions for its citizens by placing the responsibility on the pharmacist to make sure that the prescription was the product of a traditional doctor-patient interaction.¹³ Such regulations will function as an indirect but effective method of controlling cross border medical practice.

MARK OLDROYD

This stringent regulation of ehealth exchanges across borders assumes too readily that indirect health care is inferior. Valid questions have been raised about the quality of email communications between doctor and patient,¹⁴ particularly doctors' responses to unsolicited email from patients. Though they pose some marginally interesting legal questions, these are essentially transitional issues that call for better education of doctors more than for regulatory intervention. A more important issue is whether doctors must disclose the risks of remote consultations. The American Medical Informatics Association has cogently argued that an informed consent instrument should “provide instructions for when and how to escalate the contact from being via the internet to phone calls and office visits” and that it should “describe the security mechanisms that are in place.”¹⁵ Some US states already require specific consent for remote, technologically mediated care and professional organisations increasingly are recommending the use of encrypted systems for doctor-patient communications.¹⁶ Such regulation is appropriate when motivated by concerns over quality or patient autonomy but less so if designed to discourage non-traditional care.

It may be time to review the marketing activities of pharmaceutical companies both on the internet and in more traditional media. Direct to the consumer advertising is commonplace in the United States. The Federal Drug Agency's Center for Drug Evaluation and Research seeks valiantly to enforce advertising standards¹⁷ through its general regulatory standards and processes.¹⁸ In comparison with the constant barrage of pharmaceutical advertising aimed at US consumers, however, regulatory efforts tend to pale into insignificance. Against the background of the tightly controlled environment of doctors and patients under managed care, pharmaceutical companies are using direct to consumer advertising to try and persuade patients to pay for items not covered by their managed care plans, while simultaneously using both patients and doctors to coerce managers of health plans to add the company's products to their formularies. The importance to pharmaceutical manufacturers of direct advertising to consumers, however, may be illustrated by manufacturers' sanguine acceptance of increased exposure to liability for their products when they circumvent the traditional channel—doctor to patient—for drug information.¹⁹

Apart from suggesting the need for increased direct regulation (such as the American Medical Assoociation's demand that direct to consumer advertising should contain warnings that a doctor might actually recommend a different treatment²⁰), the growth of direct advertising presents difficult issues of ethical and possibly legal conflicts of interest for health advice sites that seek click-stream revenue from their links to the sites of pharmaceutical manufacturers or pharmacies.²¹

Privacy of medical information

Health websites on both sides of the Atlantic have failed to establish acceptable standards of data protection.²² Somewhat ironically, the European Union's green paper exploring the development of a community-wide approach to consumer protection was published within days of the Federal Trade Commission's announcement that it was abandoning plans to introduce any new online privacy legislation.²³ Without such legislation, the commission's ability to protect consumer privacy on the internet is limited to cases where websites breach their own published privacy policies.²⁴ Websites need not have privacy policies, however, and if they do, the content goes unregulated. The United States' trading partners are justifiably concerned by this neglect for consumer privacy, and the Federal Trade Commission's recent backtracking on guarantees for online privacy for children will increase discomfort.²⁵

Although US regulators have been derelict in protecting the general privacy of citizens, concerns regarding the privacy of health information in the United States are not necessarily warranted. The new federal standards for privacy of individually identifiable health information²⁶ (and related draft security regulations) issued under the Health Information Portability and Accountability Act (HIPAA) provide the world's most robust protection for medical information, although recent developments in Australia threaten that status.²⁷

Most modern privacy regimes, including the EU data protection directive,²⁸ are collection-centric. That is, they limit the collection of consumer information, frequently by reference to a concept such as proportionality. Serious questions arise, however, as to whether health privacy regimes should place any limits on the collection of patient data, at least for purposes related to treatment. Thus HIPPA is a disclosure-centric confidentiality scheme. It protects patient information by prohibiting most disclosures unless they are preceded by highly regulated processes of consent for treatment or payment purposes. Even more stringent provisions, together with a “minimum necessary” rule, limit disclosures for other purposes, such as marketing or fundraising.

These privacy and security rules were not developed in a vacuum. US regulators are introducing a vastly more efficient system for health transactions, based on electronic data interchange. Unfortunately, this origin exposes the fundamental flaw in the HIPAA privacy and security schemes: they apply only to healthcare entities that use the electronic data interchange system. As a result, hospitals, doctors, and health insurers are likely to find their internet activities regulated, while the more typical ecommerce sites offering health advice or medical products, which collect and resell customer information, are far less likely to fall within the regulatory scope. State statutory and common law systems that provide higher levels of privacy protection are not, however, pre-empted by the federal HIPAA scheme. These unharmonised state law protections will become increasingly important as health websites sell their visitor data to research companies²⁹ and if healthcare organisations continue their unfortunate accidental postings of confidential patient information on the web.³⁰

Conclusion

Industry consolidation around a few well known brands and the dot.com implosion have taken their toll on health advice sites. In the near term the major ehealth players will be drawn from basic health organisations looking to technology to improve the quality and efficiency of their services³¹ and government agencies seeking to improve healthcare delivery to underserved populations.

It is both appropriate and practical to shift regulatory emphasis away from advice sites. Outdated, inaccurate, fraudulent, or even dangerous information on the web is notoriously difficult to regulate. Our regulatory energies are better devoted to pressing health information problems that are soluble, such as Balkanised approaches to regulating cross border health interactions and the security and privacy of personal medical information.