Concern raised over health record database

By Aimee Miles
Kaiser Health News
Monday, December 6, 2010

An Office of Personnel Management plan to launch a comprehensive database of federal workers' health-care records has raised the ire of some privacy advocates, employee unions and consumer groups.

The OPM is organizing a research database of insurance claims filed by the 8 million workers and dependents enrolled in the Federal Employees Health Benefits Program, as well as participants in two other federally administered programs. The claims data, which will be supplied by the private insurers that participate in the FEHBP, will help the OPM figure out ways to lower costs, improve quality and fight fraud, the agency has said.

But critics - including the American Civil Liberties Union, Consumers Union and the American Federation of Government Employees - argue that the government should avoid setting up a repository of sensitive information that could be vulnerable to privacy breaches. At minimum, they say, the OPM should provide more information about how the database, the Health Claims Data Warehouse, will work and who will have access to it.

"We're talking about a government database with health diagnoses, payment information and procedures," said Harley Geiger, policy counsel at the Center for Democracy and Technology, a public interest firm based in Washington. "Enrollees are almost certainly unaware that the government plans to compile all that into one big federal database."

The OPM has asserted that it has "a strong track record" of protecting the privacy of sensitive employee information. It also extended, until Dec. 15, the comment period for the project and said it's considering putting out "a more detailed explanation of how the records in this system will be protected and secured."

The database, approved as part of the new health-care law, will collect data on health services from about 230 private health plans offered to federal workers through the FEHBP.

Information also will be compiled from enrollees in two other programs created by the health law. One involves the high-risk pools set up by the Department of Health and Human Services for people who cannot get insurance because of medical problems. The other involves private "multi-state plan options" for individuals and small businesses. These plans, to be administered by the OPM, will be available on state-based exchanges beginning in 2014. The database will be the largest government aggregation of private health plan data compiled in the United States, analysts say.

Once the OPM database is functioning, the agency plans to gather monthly updates on such things as medical diagnoses, surgical procedures and prescription drug use. In theory, the database will allow the OPM to scrutinize a specific group of enrollees - those with diabetes, for example - to identify the most effective treatments.

The data, according to an Oct. 5 Federal Register notice by the OPM, will be used by agency analysts, as well as some other federal agencies, to discern costs and trends. Certain outside researchers also could get access to the material, almost always in an aggregated form, according to a senior OPM official involved in the project who spoke on the condition of anonymity because details for the database remain under review.

Researchers say the database could be helpful if constructed and used properly; it could, for example, lead to wider adoption of "best practices" as well as lower costs, said Kevin O'Brien, a director of the California-based data analytics firm Berkeley Research Group.

Even modest cost reductions could produce substantial savings for the government and workers. OPM Director John Berry, in a report on the agency's 2009 performance, said reducing annual premium growth by 0.1 percent for three consecutive years would save the FEHBP $1.25 billion over 10 years. The agency, on average, picks up 70 percent of the cost of premiums; workers pay the rest.

But privacy advocates aren't assuaged. They note that the data collected by the OPM will include names, birth dates and other personal identifying information. In addition, they say it is unnecessary for the OPM to set up its own database because insurers already store health information.

"One of the big concerns here is the duplication," said Chris Calabrese, legislative counsel to the ACLU. Calabrese would rather see the OPM use a "pointer system" to locate the information it needs. "Instead of having all the information in one database, if you want info on Patient X . . . go directly to the record source," he said.

OPM officials counter that the privacy concerns are overblown. The senior OPM official said researchers will not be permitted to see personal identifiers. The agency had said earlier that the health data could be subject to the "routine uses" that apply to most federal databases under the Privacy Act of 1974. That means the records could be pulled by law enforcement officials in a criminal investigation or used in a congressional inquiry. Now, the official said, the agency is considering narrowing the list of agencies that would be granted special access to its records. Within the OPM, the data will be made available only to analysts with the proper clearances, the official said.

In addition, the OPM official said, asking insurance companies to independently analyze their own data would defeat a key purpose of the database - which is to compare health plans. For example, one plan might charge more than another for prescription drug programs, and the data could help the OPM decide whether to drop one pharmacy benefits manager in favor of another. About 30 percent of the FEHBP's spending goes for prescription drugs.

The OPM's proposal is not unprecedented - Tricare, the military's health-care program, has data on its participants, and the federal Centers for Medicare and Medicaid Services keeps information on Medicare beneficiaries. But Tricare, Medicare and Medicaid are public health programs; OPM's database will be collecting health information from private plans. The California Public Employees' Retirement System maintains a database on the private health plans it manages. The OPM's project would be similar.

Kaiser Health News ( is an editorially independent news service of the Kaiser Family Foundation, a nonpartisan health-care policy organization that is not affiliated with Kaiser Permanente.

© 2010 The Washington Post Company