By: Stuart Silverman

In a unanimous decision, the Supreme Court on June 15, 2022, in American Hospital Association, et al. v. Xavier Becerra, et al.,[1] ruled that the Secretary of the Department of Health and Human Services (“the Secretary” or “HHS”) exceeded statutory authority to establish payment rates for hospital outpatient drugs for 340B hospitals under Part B of the Medicare program.[2] In so ruling, the Court, as a threshold matter, ruled that the Medicare statute does not preclude judicial review of the Secretary’s rate setting for the hospital outpatient drugs at issue in the case. The Supreme Court’s ruling in AHA v. Becerra reverses the decision rendered by a divided panel of the D.C. Circuit[3] on the underlying merits of rate setting for the two years at issue, 2018 and 2019.

This Article will address the nature of the reimbursement dispute in the case, the decision by the court of appeals, and the Supreme Court’s ruling and analysis that favored the Petitioners, and rejecting Chevron deference, thereby declining to apply the Secretary’s reading of the statute. The article also concludes with observations on how the Court’s decision is an attempt to assume its traditional judicial role of engaging in statutory interpretation rather than abdication of that role in favor of agency deference to legislative enactments.

I. Background

Pursuant to statutory authority, the Secretary, through rulemaking, established an Outpatient Prospective Payment System (“OPPS”)[4] for the payment of certain drugs under Medicare Part B for hospital outpatient services. Those drugs are known as “specified covered outpatient drugs”(“SCODs”).[5] Under the OPPS, the Secretary sets payment rates annually. The rates for hospital outpatient drugs at issue here, subject to legal challenge, were set for years 2018 and 2019, and applicable for hospitals that received discounts under the 340B Program.[6] The lawsuit challenging the rates for SCODs was brought by hospitals and hospital associations whose members participate in Medicare and the 340B drug discount program under the Public Health Services Act.[7]

The operative statutory language for payment rates for SCODs is codified at 42 U.S.C. § 395l(t)(14)(A)(iii)(I) and (II). As pertinent here, the statute reads that such rates shall be equal to:

(I) the average acquisition cost for the drug for that year (which, at the option of the Secretary, may vary by hospital group…), as determined  by the Secretary taking into account the hospital acquisition cost survey data under subparagraph (D)[8] (“Subclause (I)”); or

(II) if hospital acquisition cost data are not available, the average price for the drug in the year established under… (42 U.S.C. § 1395w3a)…as calculated and adjusted by the Secretary as necessary for the purpose of this paragraph[9] (“Subclause (II)”).

The payment rates derived under Subclauses (I) and (II) are subject to adjustments to account for “overhead and related expenses” under Section 1395l(t)(14)(E)(i).[10] The statutory text for the two methodologies identified above for SCODs was the subject of competing interpretations in AHA v. Becerra.

Subclause (I) commands the Secretary to set reimbursement rates for SCODs in a given year based on average acquisition cost for a drug. To do this, it was contemplated by Congress that the Secretary would consider a hospital’s acquisition cost survey data for SCODs, as specified under subparagraph D of 42 U.S.C. § 1395l(t)(14). Subparagraph D specifies that in years 2004 and 2005, survey data would be acquired and furnished to the Secretary for setting rates for 2006, in addition to a recommendation on methodology and frequency for subsequent surveys by the Secretary. The Secretary was directed to undertake for subsequent years surveys to determine the hospital acquisition cost (“shall conduct periodic…surveys”)[11] in setting payment rates for SCODs. Since 2006, though, HHS has not had the hospital acquisition cost survey data, contemplated under Subclause (I). Thus, for the setting of annual rates for SCODs, HHS used, as mandated under Subclause (II), the “average price” of a drug. HHS has viewed average sales price data reported by drug manufacturers as representing a more reliable estimate, and a proxy for, average acquisition costs.[12] By way of a statutory reference, a drug’s “average price” has always equated to a figure that is 104 percent to 106 percent of “average sales price.” Thus, in the absence of hospital acquisition cost data, from 2013 to 2017, the payment rate for SCODs was 106 percent of average sales price, or ASP+6 %, for all hospitals.[13]

For context, as has been noted, the controversy in AHA v. Becerra arose from the Secretary’s rate setting for SCODs purchased by hospitals which participate in the “340B Program.” Under that program, safety-net hospitals providing care to low-income underserved communities receive substantial discounts from drug manufacturers in the purchase of drugs.

For years 2018 and 2019, for the first time, HHS set payment rates for SCODs separately for non-340B hospitals and for 340B hospitals.[14] Specifically, the agency deemed it more fiscally prudent to account for the discounts 340B hospitals received in the calculation of average sales price under Subclause (II). In this way, considering those discounts, substantial savings would be realized by Medicare under Part B, and beneficiaries would pay lower copays for drugs. To do this, HHS imposed its own interpretive gloss under Section 1395l(t)(14) (“par. 14”), resulting in reduced rates set for SCODs payable to 340B hospitals in 2018 and 2019 to account for the discounts 340B hospitals received under the 340B Program. Those discounts were not identified in the calculation provided in the statutory cross-reference under Subclause (II) to derive average sale price. Thus, in the two years at issue, for non-340B hospitals, the rate paid for SCODs was set at ASP+6 % for SCODs. For 340B hospitals, the rate was ASP-22.5% for SCODs. AHA brought the legal challenge contending that the downward adjustment in rates of ASP-22.5% for 340B hospitals exceeded the Secretary’s authority. According to Petitioners, the government’s rulemaking for 340B hospitals resulted in a nearly 30% cut in Medicare reimbursement, with more than $1.5 billion loss in revenue each year.

In the litigation, the parties had dueling views of par.14. Specifically, the government insisted that its construction of that paragraph is the more natural reading. The government’s overarching view of par.14 emphasized that Congress meant to set rates for SCODs that equate to the average acquisition costs of drugs. Thus, in the absence of cost survey data contemplated under Subclause (I), which was the case for 2018 and 2019, the Secretary was authorized to derive payment rates under Subclause (II), through statutory cross-reference, as a proxy for average acquisition costs for SCODs. HHS argued that it had consistently viewed Subclause (II) generally as a means to establish a proxy for “average acquisition cost” that is specified in Subclause (I). In the agency’s view, setting rates that reflect hospital acquisition costs is among the “purposes of” par.14. HHS thus employed the text in Subclause (II) allowing rates to be adjusted “as necessary for the purpose of this paragraph” to make downward adjustments to rates paid to 340B hospitals, which would account for discounts on drugs received by those hospitals.

AHA had a contrary view, insisting that par. 14 is clear on its face. Paragraph 14 provides for two distinctly different methodologies for setting payment rates. In the absence of cost survey data, mandated under Subclause (I) to calculate average acquisition cost, Congress expressly intended HHS to calculate rates based on average price, and not as a proxy for average acquisition cost under Subclause (II). Further, AHA rejected outright HHS’s reliance on the text of that subclause to make downward adjustments to payment rates for the group of 340B hospitals in rates paid for SCODs. In AHA’s view, allowance for adjustments under Subclause (II) is to be read narrowly and refers to “overhead and related expenses” provided under Section 1395l(t)(14)(E)(i), and other more modest changes to ensure accuracy in average price calculations. Simply put, Subclause (II) left no room for major reduction in rates to account for discounts received by 340B hospitals. Thus, AHA argued that par.14, when read literally, is absent ambiguity in the text that would necessitate Chevron deference afforded to the Secretary in implementing rate setting for SCODs.[15]

In its decision upholding the Secretary’s interpretation of par. 14, the D.C. Circuit applied the two-step analysis under Chevron and framed the inquiry for Chevron deference. “[W]e first ask whether ‘Congress has directly spoken to the precise question at issue’.”[16] The Court of Appeals wrote the “precise question…is whether HHS’s adjustment authority in subclause (II)” allows for “a reduction in SCOD…rates” to align payments to 340B hospitals “with actual costs to acquire the drugs.”[17] The Court further explained that “[i]f the statute does not directly foreclose HHS’s understanding, we defer to the agency’s reasonable interpretation.”[18] Applying Chevron deference, the D.C. Circuit concluded that HHS’s interpretation of Subclause (II) “is not directly foreclosed” and the agency’s reading of the statute “is reasonable.”[19]

In its briefing papers before the Supreme Court on writ of certiorari, AHA, the Petitioner, rejected outright HHS’s reading of par. 14.[20] Most fundamentally, without cost survey data acquired as contemplated under Subclause (I) of acquisition costs for drugs, AHA argued that the statute precludes HHS from setting rates by hospital group. Thus, HHS exceeded statutory authority to single out 340B hospitals as a separate group. AHA raised further doubt on HHS’s reading of par. 14. The agency relied on an authorization under Subclause (II) to adjust average price (“the average price of the drug…as calculated and adjusted…”) to derive rates for 2018 and 2019. AHA contended that exercising the authority to adjust rates, by accounting for discounts received by 340B hospitals, ascribes a meaning to the word “adjust” under Subclause (II) in such a “consequential” manner that ignores Congress’s intent. In passing the 340B program, Congress meant to provide financial relief, additional resources, to assist safety-net hospitals in treating underserved communities. “[T]he agency’s purported ‘adjustment’ seriously harms the ability of 340 hospitals to…provide essential services.”[21]

HHS, in its brief filed before the Supreme Court, directly challenged AHA’s held view that Subclause (II) dictated that the Secretary overpay 340B hospitals for drugs even though more accurate data existed that would support downward adjustments in rates. When weighed against the text of Subclause (II), providing for rates “adjusted by the Secretary…for the purpose” of par. 14, the agency considered AHA’s view as “counterintuitive.”[22] HHS argued that the purpose of par. 14 is to set rates that equate with acquisition costs of drugs for 340B hospitals. That reading is directly at odds with AHA’s view of the purpose of par. 14.[23] The government concluded that even if par. 14 was ambiguous, which it did not concede, deference was owed to the Secretary in the decision to make downward adjustments to rates for SCODs to account for discounts received by 340B hospitals.

Finally, AHA, in its briefing papers, addressed Chevron deference that the D.C. Circuit panel majority applied in the case. In AHA’s view, a court needs to rigorously employ, and exhaust all efforts by applying, traditional tools of statutory construction. Only then may it deem the text of a law to be “genuinely ambiguous” and thus subject to principles of agency deference under notions of congressional delegation to the agency to implement the statute. While not conceding that par. 14 is ambiguous, AHA was particularly critical of the D.C. Circuit’s conclusion that Chevron allowed for agency deference in support of HHS since par. 14 “does not expressly forbid”[24] the agency’s own interpretation of the statute. AHA suggested that application of Chevron, to resolve statutory ambiguities, in the manner employed by HHS, and affirmed by the D.C. Circuit, in this case brings into question the very viability of Chevron principles as controlling law.[25]

The Supreme Court’s Decision

In concluding, as a matter of law, that the Secretary exceeded statutory authority in setting rates applicable to 340B hospitals, the Supreme Court applied the plain meaning rule in construing the Medicare statute. The Court looked to the text and structure of the statute, and found no ambiguity in the statutory provisions under par. 14.

Specifically, the Supreme Court wrote that under Subclause (I), the Secretary is required to conduct a survey to acquire data that would enable rates to be set at average acquisition cost for a drug, and allows the Secretary to vary rates by hospital group. Importantly, in the absence of survey data for a given year, Subclause II directs that payment rates for drugs be set at the average price of the drug. The Court made clear that since no survey data was acquired for 2018 and 2019, then the statute did not authorize the Secretary to vary payment rates by hospital group. It thus rejected outright attempts by the Secretary to vary payment rates for drugs based on hospital groups (340B hospitals and non-340B hospitals) for the two years at issue. The Supreme Court took note that the Secretary relied on the language in Subclause (II) that allows for the average price for a drug to be calculated “and adjusted…as necessary for the purpose of this paragraph,” thus allowing for rates to be set by hospital group. The Court similarly viewed this reading as unpersuasive. The Court explained that any reference to rates that vary based by hospital group was solely authorized under Subclause (I), where the Secretary had survey data as contemplated under that particular provision to establish the acquisition costs of a drug. That was the clear reading of the statute. Since no survey data was available for 2018 and 2019, the Secretary exceeded statutory authority to single out 340B hospitals under Subclause (II). In the Court’s view, the text of the statute that allows rates to be adjusted under Subclause (II) serves an entirely different purpose. Subclause (II) requires the average price of a particular drug to be set in a given year, and thus any adjustment contemplated under Subclause (II) refers to the average price on a drug-by-drug basis, and not on a basis of hospital groups. The government seemed to suggest that it would never need to conduct a survey of cost data as required under Subclause (I) to afford it authority to set rates based by hospital group since it could simply rely on the adjustment language in Subclause (II) to set rates by hospital groups. The Court deemed the government’s view to largely rewrite the text of significant portions of the statute that is clear on its face.

The Supreme Court also rejected the government’s contention that the prospect of overpaying 340B hospitals in setting payment rates under par. 14 could not have been what Congress had intended. The Court emphasized that when the legislature enacted the payment program for outpatient drugs under Part B in 2003, surely Congress knew about drug discounts received by 340B hospitals, a program that dates back to 1992. Congress however did not express its concern about overpayment of drugs to 340B hospitals. It is thus reasonable to assume that additional funds received by that group of hospitals for drugs would be expended on other health services to low-income underserved communities.

II. Observations

It is clear that the Supreme Court based its decision on a reading of par. 14 that it found lacked any ambiguity. In doing so, it implicitly disregarded any application of Chevron deference. The government pressed the point that absent adjustments to rates paid to 340B hospitals to account for drug discounts received by those hospitals, 340B hospitals would be the recipients of windfalls in reimbursements from Medicare. The Court, though, was not persuaded by this argument. It viewed the government’s position on this as one solely based on policy considerations.

The history of the 340B program exemplifies congressional intent to afford additional financial resources to hospitals in the treatment of low-income underserved populations. Further, Congress has never raised a concern about discounts received by 340B hospitals as somehow affording such hospitals a windfall. Thus, policy concerns about that were ones that needed to be raised before the legislative branch in the first instance, rather than through any agency efforts via rulemaking to correct a perceived inequity of how 340B hospitals are reimbursed.

Since its announcement by the Supreme Court in 1984, the doctrine of Chevron deference, a judge-made rule, has been recognized as a bedrock of administrative law. Through the years though, it has been criticized as responsible for the encroachment of the “administrative state” in agency determinations about the meaning of statutes, and threatening the separation of powers between the three branches of government, the legislative branch, the executive branch and the judiciary. A central focus in the discourse on the meaning of Chevron has been, in some circles, the abdication of the respective roles of the legislative and judicial branches, with agencies assuming an ever-greater role in ascribing meaning to legislation enacted by Congress, on the grounds that a statute is ambiguous. The state of dominance of Chevron deference has been characterized as a lack of adherence to uniform application of that doctrine by the courts, including favoring other standards of review of agency action. Chevron deference has been justified by the delegation by Congress to an agency, through rulemaking, to exercise an interpretative function of legislation, predicated on agency expertise, an expertise that courts do not have, particularly involving complex regulatory regimes. To resolve the shifting roles between the legislative function and judicial function in the interpretation of statutes, the analysis has adhered to the traditional two-step process under Chevron to determine whether deference to an agency’s interpretation of a statute is appropriate. The courts have faced significant criticism in that the judiciary has been accused of rushing to conclude that an ambiguity in a statute exists, and thus courts simply defer to an agency’s interpretation, thereby abdicating the court’s role of interpreting congressional enactments.

Moreover, some courts have embraced a variant of the two-step model under Chevron that raises an initial inquiry, focusing on whether Congress, in the first instance, intended a delegation of authority to the agency to interpret a statute. This approach, known as “Chevron step zero,” is meant to provide boundaries to an all too often inclination to hastily conclude that a statute is ambiguous, thus leading to reliance on an agency’s reading on the justification of an implied congressional delegation of authority to an agency to construe a statute.

There was some speculation that the controversy in AHA v. Becerra could result in the Supreme Court overruling Chevron in view of the simmering criticism of Chevron. That did not happen. No concerted effort was made by the parties in AHA v. Becerra to overrule Chevron. Rather, the heart of the dispute centered on application of Chevron principles to the statute at issue. Each litigant claimed significant financial ramifications adverse to its interests should its reading of the statute not prevail. The Supreme Court’s ruling in AHA v. Becerra evidences the Court’s attempt to redress past criticism of the application of the Chevron doctrine by the judiciary. The Court declined to explicitly find ambiguity in the statutory text. Thus, employing its traditional role of interpreting a statute, it rigorously relied upon tools of statutory construction to derive the intent of Congress. In so doing, it avoided past criticism that courts have abdicated their judicial role of interpreting statutes, and too hastily deferred, under Chevron, to an agency’s interpretation of a statute.

_____________________________

[1] 2022 U.S. LEXIS 2943 (June 15, 2022).

[2] 42 U.S.C. § 1395l(t)(14).

[3] American Hospital Association, et al. v. Alex Michael Azar II, et al., 967 F.3d 818 (D.C. Cir. 2020).

[4] 42 U.S.C. § 1395l(t).

[5] 42 U.S.C. § 1395l(t)(14)(B) (“specified covered outpatient drugs” defined).

[6] See 42 U.S.C. § 256b(a)(4).

[7] 42 U.S.C. § 256b. For simplicity, reference to those entities challenging the rates for SCODs will be denoted as “AHA” or “Petitioners.”

[8] 42 U.S.C. § 1395l (t)(14)(D).

[9] 42 U.S.C. §§ 1395l(t)(14)(A)(iii)(I), (II). Subclause (II) cross-references 42 U.S.C. § 1395w-3a which identifies a method for calculating drug reimbursement rates for drugs under Medicare Part B.

[10] 42 U.S.C. § 1395l(t)(14)(E)(i).

[11] 42 U.S.C. § 1395l(t)(14)(D)(ii).

[12] 70 Fed. Reg. 68, 516, 68, 639-42 (Nov. 10, 2005).

[13] See 77 Fed. Reg. 68, 210, 68, 385-87 (Nov. 15, 2012); see also 82 Fed. Reg. 52, 356, 52, 494-95 (Nov. 13, 2017).

[14] See 82 Fed. Reg. 52, 356 (Nov. 13, 2017); 83 Fed. Reg. 58, 818 (Nov. 21, 2018).

[15] Chevron U.S.A., Inc. v. Nat. Res. Def. Council, Inc., 467 U.S. 837 (1984).

[16] American Hospital Association, 967 F.3d at 828 (internal quotation marks omitted).

[17] Id. 

[18] Id.

[19] Id.

[20] Brief for Petitioners at 14, 33 & 35, American Hospital Association, et al. v. Alex Michael Azar II, et al., 967 F.3d 818 (D.C. Cir. 2020) (No. 20-1114).

[21]Id. at 40.

[22] Brief for Respondents at 36, American Hospital Association, et al. v. Alex Michael Azar II, et al., 967 F.3d 818 (D.C. Cir. 2020) (No. 20-1114).

[23] Id. at 36-37.

[24] Id. at 48.

[25] Id. 46-50.

By: Erin Rutherford

I. Introduction

Capitalizing on all the benefits and promise that innovative technologies have to offer to health care requires utilizing readily transmissible health data. As the health care industry becomes increasingly digitized, health care data is essential not only for improving diagnoses and treatments, but also for improving quality, efficiency, and accessibility of care. Achieving the latter three requires use of health data in ways that might be unexpected to individuals, and even to researchers and product developers, until after obtaining the data. This presents several risks including data misappropriation, new avenues of discrimination, and increased vulnerability to security threats. Failure to address those problems and others will cause individuals to lose trust in the health care system and become hesitant to disclose information even for their own treatment purposes, let alone for secondary purposes that may not benefit them directly but instead are intended to serve a larger interest of the health care system or society.

System-wide distrust and hesitation could stall innovation and more significantly, impair the integrity and function of the health care system. To reduce frustration related to privacy of health information and encourage technological innovation, the United States should implement a flexible privacy framework that prioritizes individual autonomy and allows practices to adapt as different contexts and individual interests require.

II. Current Privacy Models for Health Care Data

The Health Insurance Portability and Accountability Act (HIPAA) is the chief federal privacy law that pertains to the privacy of health information generated in a medical context.[1] Initially, HIPAA addressed improving the design and sale of health insurance, and included provisions regarding the electronic processing of insurance claims and other types of medical information. As the need for improved privacy protections increased, HIPAA’s privacy regulations have evolved. Parts 160 and 164 of the Code of Federal Regulations contain the key privacy provisions.[2]

These privacy regulations — known collectively as “the Privacy Rule”— require certain “covered entities” to maintain the confidentiality of defined types of “protected health information” (PHI). Part 160 defines PHI as “individually identifiable health information” maintained or transmitted in electronic media or any other form or medium.[3] A covered entity under HIPAA includes: “a health plan, a health care clearinghouse, and a health care provider who transmits any health information in electric form . . .”[4] In turn, a “business associate” is a person, business, or organization who, while not an employee of a covered entity, “creates, receives, maintains, or transmits protected health information for a function or activity . . . including claims processing or administration . . . or . . . provides” services such as legal, accounting, or management services on behalf of the covered entity.[5] The Privacy Rule prohibits covered entities from using or disclosing PHI unless one of the exceptions in part 164 apply. These exceptions include:

1. PHI can be disclosed to the individual or the individual’s personal representative
2. PHI can be used for treatment, payment, or health care operations.
3. PHI can be disclosed where the entity receives a more specific valid authorization
4. A specified subset of PHI can be disclosed without written authorization in certain situations after giving the patient an opportunity to object.
5. An individual’s PHI can be disclosed without his or her authorization in exceptional circumstances (e.g. where the disclosure is required by law).
6. A limited data set that excludes most identifying information can be disclosed for use in public health, research, and operations.
7. Covered entities are also permitted to disclose PHI incident to uses or disclosures otherwise permitted or required so long as the covered entity has followed the standards governing the minimum necessary disclosure of information and has put in place proper administrative, physical, and technical safeguards.

If a covered entity does transmit PHI, it must adhere to the “minimum necessary” standard.[6] Under this standard, dissemination is limited to the amount necessary to accomplish the intended purpose of the use, disclosure, or request.[7]

Additionally, HIPAA establishes a standard for when the health information is considered deidentified, at which point it loses its legal protections and can be disseminated for secondary purposes.[8] Health information is considered deidentified when there is “no reasonable basis” for believing that the patient can be identified from the data.[9] Organizations can meet this standard through two different methods: expert determination or safe harbor.[10] Expert determination entails trained experts using statistical methods to determine that there would be a “very small risk” of reidentification.[11] The safe harbor method is the more commonly used method and entails the removal of 18 types of patient identifiers. Limited data sets only require removing 16 of those 18 types to achieve deidentified status.[12] Notably, there are no technological methods with the capability to deidentify free form text.[13]

The third exception stated above (the valid authorization exception) is relevant for secondary uses of identifiable information. To obtain consent from the patient for use of her identifiable health information, an organization must provide details regarding specifying third party interests and involvement, intended use of the data, and timeline of its use.[14] While consent may seem to offer sufficient privacy protections, current privacy models are expecting consent, and the individual, to do too much.[15]

Giving consent is often thought to mean that the individual makes a well-informed choice, however, for several reasons it falls short of legitimately ensuring individual autonomy.[16]  The first reason is that individuals rarely understand what they are consenting to and what implications of that consent will follow.[17] Several factors can lead to a failure to understand. People often do not actually read the form in front of them, particularly when an entity presents it in an electronic format (as often is the case in this digital era, with ever-changing privacy policies and terms of agreement).[18] Furthermore, it is unlikely an individual who does read the long, complex form would truly understand the terms.[19] Even if an entity makes an effort to write a consent form with plain language in the hopes of making it easy to understand, that often means that important information is left out or distilled to the point it is not completely accurate.[20]

A second reason consent practices fall short of advancing individual autonomy is that they fail to provide meaningful choice.[21] When it comes to health care, individuals are usually giving consent to a party with much more bargaining power under a take it or leave it circumstance.[22] Providers or entities often request consent shortly before a course of treatment, diagnostic test, or use of a product or app. At this moment, a patient is unlikely to decline and start all over with a search for an alternative provider. Additionally, consent for treatment accompanies consent for secondary use, which can lead a patient to believe there is no option to refuse the secondary use without refusing the necessary care.[23]

It is certainly possible, though, that if the patient were to get an accurate and thorough description of the secondary use, one may support that use and willingly consent. But this illustrates the need for consent practices that vary according to the way a party is seeking to obtain the consent, and the interest behind acquiring health data for a secondary purpose. For example, if an entity is requesting a broad consent to store data for uses not yet known, it is critical that the individual understands the consequences of long-term data storage, such as (1) the data’s eventual transfer to other parties, (2) whether the entity will notify the individual of any new party who has access to the information, and (3) if so, what this new party intends to use the information for. Without an understanding of short-term and long-term risks and benefits, an individual cannot truly make an informed decision and therefore lacks autonomy. Relying on consent in situations where the patient might understand the terms of agreement, but feels it is difficult to refuse, vitiates if not destroys autonomy.

III. Privacy Model Proposal

Realizing any of the potential benefits that digitized health care data presents depends on a foundation of individual trust in the system. If individuals do not believe that the people who they entrust their intimate health information to will protect it, they will hesitate to share that information, even for their own care and treatment needs, let alone for secondary purposes that may not directly benefit them. To establish this trust, individual autonomy must be the priority in any privacy model.

Currently, autonomy in health information privacy decisions hinges on privacy models that are too generalized and outdated for the digital health era. This places too much responsibility on the individuals and leaves them without an actual choice in what and how much information they share. The following is a proposal for a federal hierarchal framework that should apply to all entities who deal with health data:

1. Health care data shall only be collected and used with the individual’s permission and fully informed consent.
2. The collections, disclosures, and dissemination of health care data may be allowed only where such action furthers a legitimate societal interest, and does not interfere with number one.
3. Health care data may be used to benefit the collector, discloser, or disseminator of such data so long as it does not interfere with number one and number two.

A. Health care data shall only be collected and used with the individual’s permission and full informed consent

Individual autonomy in the health care industry means the individual controls what happens with their health information according to their subjective interests and privacy values. Ensuring the privacy interests of the individual fosters the sense of trust that is critical for the success of the health care system’s primary and secondary interests.

Some people may enjoy receiving customized advertisements; others may feel such advertisements violate their privacy. Nonetheless, the decision should be up to the individual. The individual needs to be able to make this decision with trust that entities will use their information according to their wishes only. They also need to be able to make this choice from a place of control, i.e., feeling like they have an actual choice in the matter. Current privacy models cannot account for these subjective preferences and foster a sense of trust or autonomy. If individuals trust the entity with which they are sharing their information, they will share information honestly and completely. This not only improves their own quality of care but builds the foundation for any downstream innovative uses as well.

B. The collections, disclosures, and dissemination of health care data may be allowed only where such action furthers a legitimate societal interest and does not interfere with number one of the proposed framework.

Innovative use of digitized health data can reform the health care industry in numerous ways, offering benefits at the individual and the societal level. Societal benefits, however, are dependent upon individual trust in the system. It is entirely possible, for example, that people would be more than willing to share identifiable information if it led to a real possibility that researchers could finally cure a devastating disease, such as Alzheimer’s. For this to work in a way that does not infringe upon an individual’s interests, the individual needs a thorough understanding as to the benefits of secondary use as well as the risks involved. In accordance with HIPAA’s data minimization principle, establishing this understanding would require an explanation of all the information to which a third party would have access and the degree of identifiability necessary for the intended use. Requiring a comprehensive explanation of both the benefits and the risks ensures that the secondary use serves a purpose that the individual finds worthy enough to warrant lessening their personal privacy protections. Without a thorough understanding of pros and cons, the individual cannot weigh them in a way that drives an informed decision.

Ensuring the individual’s thorough understanding could create a burden on the party wishing to obtain the data, but this added burden puts more responsibility on the party seeking the information to do their own weighing of pros and cons regarding their interests.[24] It is a good thing, however, for the entity to carefully consider how it wants to ensure that it meets the individual’s needs in a way that also allows it to meet its own needs. Current privacy models place all this responsibility on the individual, yet the data collectors are better suited to consider the costs and benefits in a meaningful way and adjust accordingly. Adequate patient and consumer education is critical in guaranteeing that even in the event an individual’s health information aids in achieving a more attenuated benefit, that benefit is still within the individual’s interest and therefore does not violate the first rule of this proposed privacy model. Utilizing this framework would require prescriptive guidelines regarding the appropriate degree of minimization, identifiability, and notice/informed consent. These guidelines will vary according to the context. More downstream effects and uses involved, or ambiguous uses, would entitle the individual to receive a more granular level of information about the potential uses and the types of data they require.

C. Health care data may be used to benefit the collector, discloser, or disseminator of such data so long as it does not interfere with number one and number two of the proposed framework.

Individual preferences regarding collecting, sharing, and using their health information could be (1) no notice or consent needed, (2) consent but no notice needed, (3) notice and consent needed before any action commences, or (4) somewhere else along that spectrum.[25] Some individuals, for example, may be willing to relinquish health information to provide the collector or disseminator with some kind of purely internal benefit to the collector or disseminator. Others might not.

For entities to account for these differences, it is up to the government to put forth prescriptive rules that specify which contexts and uses require what kind of protections for collection, use, and transmission of health information.[26] Data uses intended only for an internal benefit, such as to improve marketing strategies, would be permissible if the person or entity obtaining consent to use the data made those intentions clear to the individual. This secondary use would require full disclosure of the type of data and its degree of identifiability the entity is requesting. Further, the entity would need to separate the processes used to obtain consent for an internally beneficial secondary use, and consent for the treatment or use of the drug or device. Other secondary uses, such as product development, may blur the lines of an internal benefit and a legitimate societal interest, illustrating the need for governmental clarifications as to what may qualify as a legitimate societal interest. Preventing coercive or underhanded acquisition of an individual’s health information through increased disclosure and consent requirements ensures trust in the health care system. This is particularly necessary for uses that will benefit neither the individual, nor society at large.

For any given use of health data, an entity must consider and determine what types of health data it needs to meet the anticipated purpose. From there, the necessary degree of identifiability can be determined. As the degree of identifiability increases, the entity must utilize more stringent privacy protections. Similarly, as the degree of medical necessity increases, the entity must ensure that it does not condition treatment on surrendering health information. Having these prescriptive rules within a flexible framework is crucial for innovators to achieve their goals without infringing on individual interests and knowing what kind of protective measures are required will relieve the innovators of some burden and confusion. Furthermore, it ensures that organizations are using data efficiently and in a way that promotes cultural development and prioritizes individual autonomy. Innovation without proper privacy protections is of no benefit at all if it comes at the cost of trust in the system. Individual privacy interests vary, as do opinions on the types of secondary uses that warrant relaxing those privacy interests. Privacy models regarding health care data need to have the ability to adapt to these differences to promote societal development in a way that prioritizes and accommodates individual interests, thereby protecting the primary purposes of the health care industry and facilitating its improvement.

IV. Conclusion

A flexible privacy framework that prioritizes individual autonomy and allows practices to adapt to different contexts and interests will both reduce frustration related to privacy of health information and encourage technological development. Current laws are not capable of striking this balance. Many sources of health information are unregulated and even the regulations in place depend on consent practices that fall short of truly protecting privacy interests and advancing individual autonomy. Digitized health data holds tremendous innovative potential to both improve individual care experiences as well as achieve larger health care goals, such as decreased costs and increased accessibility. However, if this law and policymakers do not harness this potential in a way that preserves individual trust none of these potential benefits will come to fruition and the health system will crumble. Privacy models need to allow innovators to create revolutionary solutions without also allowing entities to violate privacy interests and create new avenues for discrimination.

_____________________________

[1] Charlotte Tschider, AI’s Legitimate Interest: Towards A Public Benefit Privacy Model, 21 Houston J. Health L. & Pol’y 125, 148 (2020).

[2] Hall et al., Health Care Law & Ethics 124-27 (Rachel E. Barkow et al. eds., 9th ed. 2018).

[3] Id.

[4] 45 CFR § 160.103.

[5] Id.

[6] 45 CFR § 164.

[7] Id.

[8] Id.

[9] April Moreno Arellano et al., Privacy Policy and Technology in Biomedical Data Science, 1 Ann. Rev. of Biomedical Data Sci. 115, 117 (2018).

[10] Id.

[11] Id.

[12] Mark A. Rothstein, Is Deidentification Sufficient to Protect Health Privacy in Research?, 10 The Am. J. of Bioethics 3, 4 (2010).

[13] Id.

[14] Tschider, supra note 1, at 148.

[15] Daniel J. Solove, Privacy Self-Management and the Consent Dilemma, 126 Harv. L. Rev. 1880, 1884 (2013).

[16] Charlotte Tschider, The Consent Myth: Improving Choice for Patients of the Future, 96 Wash. L. Rev. 1505, 1517 (2018).

[17] Solove, supra note 15 at 1888-89.

[18] Tschider, supra note 1, at 155.

[19] Tschider, supra note 16, at 1522.

[20] Id.

[21] Id. at 1519.

[22] Id.

[23] Id.

[24] See generally Tschider, supra note 1 (discussing the idea of weighing legitimate interests).

[25] Rothstein, supra note 9 at 8.

[26] Arellano et al., supra note 9 at 116.