Drew Clark

Preserving medical privacy may be too complicated for the Senate to tackle in one bite, and Sen. Bill Frist, R-TN, instead predicts that the chamber could seek to craft legislation on three separate topics.

The three-pronged effort would includes the Senate's ban late last month on genetic discrimination, which Frist expects will be followed by a proposal to extend the Clinton administration's proposed electronic privacy rules to include paper records, and then further restrictions on an insurer's use of a customer's personal data.

Speaking following a Friday panel on medical and genetic privacy sponsored by his Forum on Technology and Innovation, Frist said, "we would have preferred comprehensive legislation ensuring medical privacy." But he said that a piecemeal approach was better than an approach to legislating privacy -- such as that endorsed by the Senate Banking Committee's Sen. Richard Shelby, R-AL -- that attempts to address medical privacy in the context of sharing financial records.

But after a presentation in which Carnegie Mellon University professor Latanya Sweeney demonstrated the ease with which supposedly anonymous data could be personally identified, Forum Co-chairman Sen. John Rockefeller, D-WV, expressed doubts about the feasibility of passing effective legislation.

"If we pass a policy that protects health, including mental health and genetic records, will it work?" Rockefeller asked Sweeney.

Sweeney had highlighted the massive amounts of data now routinely collected about individuals in hospitals and by physicians, much of it publicly available in de-identified form. Using off-the-shelf software, Sweeney was able to obtain medical information about former Massachusetts Gov. William Weld, R, by matching such hospital databases with voter records.

Sweeney responded to Rockefeller's question by saying that the current framework permitting researchers to access medical records "absolutely does not work. Instead, we need to ask to what extent can you 'anonymize' data." The easier it is to personally identify such records, the more limitations there should be on access, she said.

But Kari Stefansson, CEO of deCODE Genetic -- which is compiling a comprehensive database of medical, genetic and genealogical profiles of nearly every citizen of Iceland in a quest to obtain medical breakthroughs -- pleaded with the senators not to allow privacy concerns to destroy medical progress.

"Make sure that whatever you do, scientists in the States will be allowed to use health care information with the informed consent of individuals," Stefansson said.