Question about patient privacy

[Gibbie]

My daughter sprained her back a couple years ago and was treated by our doctor for it. She was either 16 or 17 at the time, definitely under 18.

A few days ago she received a letter from the local hospital that bought out the clinic where she was seen. They advised that they were running a study on chronic low back pain and wanted to know if she was interested in participating.

My question, how did they know that she was treated for back pain? The letter does not specifically say that she was, but it asked if she'd suffered from back pain and if she wanted to participate. While it could be a random solicitation it seems awfully coincidental. No one else in the household received anything similar and it was addressed directly to her. No one signed any release waiver that I am aware of (I didn't and she says she didn't). How are they in possession of her name? Is this legal? Is there anything I should do about it?

Gibbie

[Lainie]

Surely, they would have come into possession of her medical records, and those of all patients treated at the clinic, when they purchased the clinic. And by contacting her, they're not violating her privacy, because they're not making her information available to a third party.

[Mama Duck]

What Lainie said. When they bought the clinic, they probably got access to her medical records. However, it could be a coincidence as well.

[geminilee]

I agree they bought access to her medical records when they bought the clinic, and they are not violating anything by looking into them for possible patients to field a study. While I have not been contacted for a study for previous problems, I have several times taken part in studies for current problems (occasionally studies not performed by my doctor, but by some doctor far away). Medical professionals with a valid reason are allowed to look into and discuss medical records.

[Gibbie]

Ahh, that's the part I was misunderstanding. I guess I figured medical records stayed between the patient and the physician(s) involved in treatment, not trolled through by the research branch of the hospital. It felt uncomfortably like having your name sold to third parties, or those Amazon suggestions. It made me especially uncomfortable because she was a minor when she was treated. I wouldn't have been concerned had it come from her doctor or her doctor's office, but was confused when it came from outside of there. The only experience I'd had with patient studies were directly doctor referred.

Lucky for everyone I guess that she's a good kid. She's off at college right now, and thinking this was a bill (she's been seen in a couple of facilities away from home recently) I opened it. Could have been awkward if she'd seen a doctor for other reasons!

Gibbie

[Lainie]

Originally Posted by Gibbie

Ahh, that's the part I was misunderstanding. I guess I figured medical records stayed between the patient and the physician(s) involved in treatment, not trolled through by the research branch of the hospital.

If it makes you feel any better, somebody probably just requested a database dump of patients who had been treaed for X condition within Y years. I doubt anybody actually examined her medical records.

It felt uncomfortably like having your name sold to third parties, or those Amazon suggestions.

It is a bit like the latter, actually, except for the intent.

Lucky for everyone I guess that she's a good kid. She's off at college right now, and thinking this was a bill (she's been seen in a couple of facilities away from home recently) I opened it. Could have been awkward if she'd seen a doctor for other reasons!

Gibbie

Bolding mine. Technically, you're the one who violated her privacy.

[geminilee]

It is pretty normal practice, since it would be very unusual for a single doctor to get enough patients with a specific condition to generate any studies. Therefore, if we want to be able to have empirically proven medicine, we have to let doctors share information about patients.

[Troberg]

Originally Posted by Lainie

Surely, they would have come into possession of her medical records, and those of all patients treated at the clinic, when they purchased the clinic. And by contacting her, they're not violating her privacy, because they're not making her information available to a third party.

They may not violate her privacy by contacting her, but they may very well be violating it by making the information available to whoever is doing the study.

I would probably report it, just in case. If it's OK, the report will not lead to anything, if not, well, then hopefully, it will lead to something.