Oregon bill gives consumers ownership of health info

A group of more than 40 Oregon legislators has introduced a bill that would protect consumer privacy when it comes to personal health records.

The bipartisan Senate Bill 703 – the Health Information Property Act – was brought forward by chief sponsors Sen. Floyd Prozanski, D-Eugene, Rep. David Gomberg, D-Central Coast, and Rep. Paul Holvey, D-Eugene.

Backers said in a news release Tuesday that the legislation moves beyond the current consumer protections under the Health Insurance Portability and Accountability Act by enabling patients to own their health data as their own property.

This will put an end to commercial sale of health data by third party companies without the person’s knowledge. It also would stop these companies from selling the information without the person’s identifying information attached to it.

“Consumers are now realizing how little privacy we have and how often we sign it away,” Gomberg said. “By treating personal data as property, legislators can empower individuals to better control information about themselves and how it is used by others.”

HIPAA already provides a national framework for ensuring the privacy of protected health information, but consumers lack the ability to prevent certain companies’ inappropriate use of their own information.

Those companies obtain consumers’ data because HIPAA allows them to de-identify – defined as the process of separating personally identifiable data from a person’s health records – and, in some cases, selling personal health information. These transactions often happen without the person’s knowledge or consent.

Oregon’s Health Information Property Act would require companies subject to HIPAA to obtain signed authorization from each consumer before de-identifying their personal health information for sale to a third party.

Companies would be barred from discriminating against consumers who refuse to sign the authorizations or who elect to receive payment for allowing their data to be used.

Several other states are exploring similar legislation. Violations of the bill would be considered an unfair trade practice, which are enforced at the state level.

“Oregon is proud to be at the forefront of this important and meaningful effort to bring data ownership back to who it belongs – the people,” Prozanski said. “We look forward to passing this legislation and providing Oregonians with the means to protect and control the use of their health data.”