[Congressional Record Volume 150, Number 130 (Monday, October 11, 2004)]
[Extensions of Remarks]
[Pages E1875-E1876]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]




  NATIONAL ALL SCHEDULES PRESCRIPTION ELECTRONIC REPORTING ACT OF 2004

                                 ______
                                 

                               speech of

                         HON. EDWARD J. MARKEY

                            of massachusetts

                    in the house of representatives

                        Tuesday, October 5, 2004

  Mr. MARKEY. Mr. Speaker, I rise to express my strong concerns about 
the lack of adequate patient privacy protections in H.R. 3015, the 
National All Schedules Prescription Electronic Reporting Act of 2004.
  H.R. 3015 is intended to support states' efforts to prevent the abuse 
of certain controlled substances through the provision of federal 
grants to the states for the purpose of establishing and implementing 
controlled substance monitoring programs. States would use the grants 
to develop and maintain an electronic database containing information 
about the type of medication prescribed, quantity dispensed, number of 
refills, and similar product information. The database also would 
collect personal information about each patient receiving prescriptions 
of the covered controlled substances, such as the patient's name, 
address and telephone number.
  The abuse of controlled substances such as oxycontin and amphetamines 
is a serious problem that plagues many Americans. In response to the 
seriousness of the problem of prescription drug abuse, more than 20 
states, including Massachusetts, have taken steps to

[[Page E1876]]

prevent such abuse through the establishment of reporting requirements 
on pharmacists and the creation of drug monitoring databases similar to 
those contemplated by H.R. 3015. In Massachusetts, for example, 
pharmacies are required to report the prescriptions they fill for 
substances in Schedules I and II to the state's department of Public 
Health.
  The problem is that H.R. 3015 does not provide the safeguards that 
are required to shield patients--the vast majority of whom will be law-
abiding citizens receiving medications as part of a legitimate plan of 
care--from unauthorized disclosure of their personal medical 
information. Instead, the legislation provides the states broad leeway 
to establish databases of patients' private medical records with little 
guidance on the privacy protections that must be in place in order to 
qualify for the grants.
  For example, H.R. 3015 does not require states to limit access to the 
database information to a finite and identifiable number of 
individuals. Instead, the bill permits disclosure of individually-
identifiable patient information in the database to a wide range of 
professionals in addition to practitioners and law enforcement 
personnel, including any local, state or federal ``narcotics control, 
licensure, disciplinary or program authority'' who can make specific 
certifications as to the need for access to the information. 
Any ``agent of another state'' with a monitoring program approved by 
the bill also could gain access to patient records in the database, 
provided that the purpose of the access is for ``implementing the 
state's controlled substance monitoring program.'' Such easy access 
puts the privacy of potentially hundreds of thousands of law-abiding 
citizens at risk of unauthorized disclosure.

  Additional privacy protections that are missing from H.R. 3015 
include: a requirement that states receiving grants under the terms of 
the bill periodically purge the database of information about any 
particular prescription after a limited amount of time; unambiguous 
language stipulating that the bill does not override established 
standards of medical ethics relating to privacy; establishment of 
specific penalties for unauthorized access and redisclosure; and a 
provision making clear that the term ``minimum necessary'' as it 
relates to the limitation of information to the ``minimum necessary'' 
needed to comply with a request for patient data be interpreted as 
defined under the Amended Privacy Rule.
  While I strongly support efforts to prevent the abuse of controlled 
substances, H.R. 3015 does not contain sufficient guidance to the 
states on the level of privacy protections that they must provide in 
the creation and maintenance of the databases authorized under the 
legislation. The potential for the invasion of patient privacy 
resulting from such databases is not merely theoretical. The New York 
Times reported on October 1, 2004 that confidential records of nearly 
4,000 abused and foster children in Central Florida were available to 
the public on the Internet for at least four months because of a 
security breach in a child welfare computer system. The records 
included the children's names, photographs, Social Security numbers, 
case histories and locations of the foster homes they were in, and were 
accessible on a Web site of a private children's agency under contract 
with the Department of Children and Families. I am including a copy of 
this article for inclusion in the Record.
  Now that H.R. 3015 has been approved by the House, I urge the Senate 
to strengthen the privacy provisions in the legislation so that the 
important goal of preventing prescription drug abuse can be advanced 
without sacrificing the privacy of law-abiding patients.

                [From the New York Times, Oct. 1, 2004]

             Confidentiality for Foster Children Is Broken

                           (By Terry Aguayo)

       Miami, Sept. 30.--Confidential records of nearly 4,000 
     abused and foster children in Central Florida were available 
     to the public on the Internet for at least four months 
     because of a security breach in a child welfare computer 
     system, the Department of Children and Families said on 
     Thursday.
       The records included the children's names, photographs, 
     Social Security numbers, case histories and locations of the 
     foster homes they were in, and were accessible on the Web 
     site of Kids Central, a private children's agency under 
     contract with the Department of Children and Families, the 
     state's child welfare agency.
       In April or May, Kids Central began using a computer system 
     designed to let private caseworkers review state child 
     welfare records through the Internet, said to Janice Johnson, 
     chief executive of Kids Central in Ocala. Although a user 
     name and a password were needed to reach the records, some 
     passwords and user names became available online in 
     unrestricted files created when caseworkers sought technical 
     help with the system.
       ``Confidentiality is critical,'' said Don Thomas, district 
     administrator for the Department of Children and Families in 
     Central Florida. ``If these kids are in the child welfare 
     system to begin with, they have a far from ideal life, and if 
     their personal information is available to those who don't 
     have to know, it violates their privacy.''
       Department administrators ordered the Web site shut down on 
     Wednesday after a reporter for The Miami Herald, which first 
     reported the problem, informed them of the flaw. It was back 
     up Thursday morning after the security issues were resolved, 
     Mr. Thomas said.
       Mr. Thomas said he knew of no one, other than the reporter, 
     who gained access to the records because of the flaw.
       ``A child's case record is a child's life. It should be 
     treated as sacred,'' said Richard Wexler, executive director 
     of the National Coalition for Child Protection Reform and a 
     strong critic of the department. ``Given the kind of 
     information, I think there is a clear danger, particularly 
     since the locations of these children were made available to 
     anyone.''
       The Department of Children and Families has been afflicted 
     by numerous problems that surfaced after it lost track of a 
     4-year-old foster child, Rilya Wilson, and did not notice she 
     was missing until 15 months later, in April 2002. She remains 
     unaccounted for. Jerry Regier, the department's secretary, 
     resigned in August as a result of accusations that he and two 
     top aides took favors from contractors.

                          ____________________