House Republicans are alleging that the healthcare reform law would turn over everyone's private medical records to the federal government.
The latest broadside against Democrats' signature domestic achievement is pegged to an arcane regulation requiring insurers to provide claims data. The data will be used to justify extra payments to plans that cover more people with serious illnesses such as cancer, in order to keep those plans from going out of business.
"I am deeply concerned by the proposed options for data collection under risk adjustment, which would give bureaucrats access to health information about every American," Huelskamp wrote to Sebelius. "Regardless of whether the data collection would involve raw claims data or individual risk scores, the creation of such a risk adjustment database constitutes extreme government overreach, impinges on patients' rights to privacy and jeopardizes fair competition in the health care market."
The Obama administration says the concerns are baseless.
In a blog post, the director of the office implementing the healthcare law writes that the proposed regulations simply lay out "general options for collecting information" and that "work has not begun on this project."
The Centers for Medicare and Medicaid Services "does not propose that States collect personal data such as name, social security number or address for the risk adjustment program," writes Steve Larsen. "Protecting an individual's personal health information continues to be among CMS's highest priorities. That is why CMS will not require States to collect your medical record or information that identifies your doctor; nor would the Federal government collect this information."
A similar risk adjustment mechanism exists in the Medicare prescription drug program, which was passed by Republicans.
The proposed regulation lays out three options for collecting claims data:
• A centralized approach in which issuers submit raw claims data sets to the federal government;
• An intermediate state-level approach in which issuers submit raw claims data sets to the state;
• A distributed approach in which each issuer must reformat its own data and then pass on self-determined individual risk scores and plan averages.
The proposed regulation favors the second option, but acknowledges that "this approach may raise concerns related to consumer privacy."
To resolve that issue, the proposed regulation goes on to recommend that "states must utilize specific privacy standards in its data collection risk adjustment procedures."
CMS has already received comments from private individuals about the proposal, several of which raise privacy concerns.
"Personal medical records and patient information are private and should remain so," wrote one. "The government should not be maintaining dossiers of this personal, private information of individuals. The government has a bad track record of security and maintenance of information it collects and personal health records should not be exposed to this risk."
Comments are due by the end of the month.