Center for Democracy and Technology Policy Counsel Harley Geiger (a friend and colleague) takes a look at a proposal at the Department of Health and Human Services that would affect the privacy of people who have been dead for 50 years. (Related: We’ve discussed controversies over the unknowing use of individuals’ DNA reasons beyond what was stated when the samples were taken. Arizona State University recently settled a lawsuit by the Havasupai Indians. DNA samples that were given to university researchers to study the tribe’s high rate of diabetes were also used — without their consent, tribe members say — “to study many other things, including mental illness and theories of the tribe’s geographical origins that contradict their traditional stories.” And in Texas, the Texas Tribune revealed that Texas officials “were turning over hundreds of dried blood samples to the federal government to help build a vast DNA database.”)
Currently, the law requires that the health information of the dead be protected in the same manner as that of the living. Generally speaking, health care organizations can use patient data for treatment, payment and operations purposes without the consent of the patient, but must get the consent of the patient for most other purposes, like marketing or research. When the patient is deceased, health care companies must seek consent from the dead person’s personal representative, like the executor of the estate.
In the proposed rule, HHS states that the plan stems from the difficulty of locating personal representatives to obtain authorizations to use the health data of the deceased. Specifically, HHS refers to the frustrations of historians, biographers and archivists. (At last, the true might of the archivists’ lobby is revealed to us all.) HHS reasons that waiting until 50 years after death would protect the privacy of the deceased and their relatives.
CDT disagrees. We believe this proposed modification would be significantly more detrimental to patient privacy than it may seem. There are just too many unknowns to make this modification for the sake of posterity. […]
So it’s risky to assume that patients will be comfortable knowing information about embarrassing conditions, which may affect their legacies and sense of dignity, will be made available for unforeseeable purposes after death – when they cannot defend themselves. Releasing the health data of the dead could also affect the privacy of the living. Exposing a family history of certain disorders could jeopardize a person’s job prospects or insurability, even a couple generations removed – especially as science gets better at predicting an individual’s health based on family history.