My name is Robert Litt. I am a Deputy Assistant Attorney General in the Criminal Division of the Department of Justice. I am pleased to be here to present the views of the Department on medical record privacy.
I would like to begin by outlining a couple of principles that I think everyone agrees with. The first is that protection of the privacy of patient medical information from unwarranted invasion is an important goal. As computers replace file cabinets, and databases increasingly become networked, this goal becomes both more important and more difficult. The Department of Justice fully supports efforts to minimize the improper disclosure and misuse of patient medical information.
On the other hand, I think that we also all recognize that patient privacy, like every other kind of privacy, is not absolute but must be balanced against other societal interests. One such interest is our common goal of apprehending and punishing criminals, and I would like to discuss today why we believe that a law enforcement exemption should be built into any federal legislation on medical records privacy. This was the position that the Administration arrived at last year, after lengthy interagency consideration of S. 1360, the Medical Records Privacy Act: that new restrictions on medical records should not apply to legitimate law enforcement investigations.
To begin with, there is no demonstrated need for placing increased burdens on law enforcement in this area. Present law provides substantial protection for the privacy of medical records obtained in the course of criminal investigations. On the federal level, the Privacy Act, grand jury secrecy requirements, and the Substance Abuse Patient Medical Record Privacy Act all serve to protect patient privacy, and many states have comparable measures which regulate law enforcement access to medical records. Both these legal requirements and, frankly, law enforcement's own interest in preserving the confidentiality of its investigations have generally served to maintain the privacy of patient information obtained during criminal investigations. Indeed, testimony to Congress over the last few years on the issue of medical records privacy has been largely devoid of any reference to significant law enforcement abuse. I repeat: although law enforcement access to medical records today is not limited by any of the requirements that would be imposed by legislation such as S. 1360 or similar proposals, there is no indication of widespread abuses by law enforcement.
Nor, in our view, is such abuse likely in the future, even as we move towards greater computerization of medical records. Some people have fantasized the federal "health police" sitting at computer terminals and scanning patient medical records to see what crimes might be revealed there. But law enforcement's resources are limited, and I cannot imagine any federal agents adopting such an unproductive method of ferreting out crime. Rather, as is the case today, law enforcement is going to seek medical records only in cases where there is reason to believe that those records will advance a criminal investigation in a specific way.
And there are unquestionably circumstances in which law enforcement needs patient medical information. This is most obvious in the case of health care fraud; I know that Jack Hartwig talked to you a couple of weeks ago about this, but I want to emphasize that it is generally impossible to build a criminal health care fraud case without access to patient records, including patient identifying information. For example, if a doctor or a laboratory is defrauding Medicare by billing for unnecessary procedures -- a common type of fraud -- we can't prove the procedures are unnecessary without knowing who the patient is and getting his or her medical records.
But there are many other circumstances in which access to medical records can be crucial to a criminal investigation. Let me give you a couple of examples; these are hypothetical but extremely realistic:
o While escaping from a bank robbery the suspect is wounded by police officers. The police want to check local hospitals to see whether anyone seeking the suspect's description has been treated for a wound.
o An armed suspect is barricaded in a store holding employees hostage. His neighbor reports that he has a history of mental illness. Hostage negotiators want access to his medical records to help determine the best way to negotiate with him and save the hostages' lives.
o The police have a possible suspect in a rape investigation, but insufficient evidence to arrest him. They fear he may flee if he becomes aware that the police are on to him; they also don't want to arrest him if he is not the rapist. They have identified the rapist's blood type from blood at the scene of the crime and want to check medical records to determine whether they have the right man.
o Organized crime is believed to have infiltrated an HMO and to be using it to launder money. When the books and records are subpoenaed they show a tenfold increase in revenues over a one-year period. Federal agents need to review patient medical and billing records to see if the increase in cash flow was legitimate or not.
In each of these cases, and many others, law enforcement must be able to have quick, confidential, unhindered access to patient medical records -- although we will agree that they should not be allowed to make unfettered use of these records, but limit the use to what is necessary for the criminal investigation. And I want to emphasize one important point here. I represent the federal government. You have separate representatives from state and local law enforcement. As important as this issue is for us, it is far more important for them; after all, they prosecute over 95% of the crimes in this country. We should not be imposing substantial burdens on them -- burdens that might amount to an unfunded federal mandate -- in the absence of a concrete showing of need which I don't think has been made out.
And we should not underestimate the burdens that proposals such as S. 1360 would impose on law enforcement. First, any limits on law enforcement access, whether they be procedural or substantive, will create more litigation that will burden the courts and provide fertile opportunities for creative defense lawyers to litigate issues unrelated to guilt or innocence. Prosecutors will spend time and energy litigating whether proper notice was given, or whether law enforcement really needed the records, rather than putting criminals in jail.
Second, requiring notice to patients will be very expensive, particularly in the case of large scale frauds that may require analysis of thousand of patient records -- even though our experience under the substance abuse records law suggests that few patients care when their records are obtained for law enforcement purposes. On the other hand, requiring notice will often delay or frustrate criminal investigations while collateral issues are litigated. And requiring any threshold showing of probable cause or other factual showing would work a dramatic change in the law of grand jury investigations.
We do not, in principle, object to reasonable restrictions on how law enforcement handles records it obtains for the purposes of a criminal investigation, such as requiring records obtained by grand jury subpoena to be actually presented to the grand jury, limiting storage of and access to medical records, and requiring the return or destruction of records at the close of a case. But there should not be any new rule that would prevent making full use of information that is discovered in "plain view" from medical records that are lawfully obtained. To require law enforcement to ignore evidence of criminal activity that properly comes to its attention is perverse, to say the least. There is no indication that today people are deterred in any way from seeking appropriate medical treatment because of the possibility that law enforcement might for some other reason obtain their medical records and learn of a crime they have committed.
To sum up, therefore, law enforcement has a legitimate and important need to have access to patient medical records in a wide range of circumstances. Present law appears adequate to protect against abuses of patient privacy by law enforcement, and new restrictions would be costly and burdensome. With the cost so high and the benefits so meager, law enforcement should be exempt from any new restrictions -- procedural or substantive -- on its ability to obtain patient medical records.
Thank you. I'd be pleased to answer any questions that you may have.