March 7, 2024
Dear Governor Reynolds,
To protect the privacy of all Iowa residents, we urge you to oppose H.F. 2623 – an act relating to the Iowa health information network… (state designated health data utility).
For more than 20 years, Citizens’ Council for Health Freedom (CCHF), a national, 501(c)3 non-profit organization based in Saint Paul, Minnesota, has existed to protect patient and doctor freedom. This includes privacy because privacy is the foundation of freedom.
The future Supreme Court Justice Louis Brandeis once wrote that protecting privacy rights secures “the right to be left alone.” Today, because state legislatures presume (wrongly) that the HIPAA rule protects privacy, many Americans have no medical privacy. This bill would further degrade the ability of Iowa residents to keep their confidential medical records confidential:
“Beginning July 1, 2024, the Iowa health information network shall function as the state-designated health data utility or state-designated HDU, operated and governed by the designated entity. The state-designated HDU shall operate as a public-private partnership…” (lines 7.21-7.25)
“Health care entities have a duty to share health information and data, in accordance with applicable law, with other health care entities to ensure that optimal patient and population health is achieved…” (lines 8.12-8.15)
“The purposes of the state-designated HDU include all of the following:
(1) The transmittal, collection, aggregation, and analysis of clinical information, public health data, and health administrative and operations data to assist the department, local health departments, health care professionals, patients, policymakers, and the governing board in understanding the population health of Iowa…” (lines 8.19-8.26)
We oppose H.F. 2623 and all efforts to create a Health Data Utility (HDU) for six reasons:
- Establishing a centralized state database of confidential medical data lays a public claim to private data, violating constitutional, patient privacy, and ownership rights.
- A centralized database of medical record information allows for ever-expanding uses and outsider access to private and sensitive patient data—without patient consent.
- True consent (Opt-In) is not required and the bill’s Opt-Out is a façade.
- A centralized database poses national and personal security threats.
- The un-elected governing board of the proposed public-private Health Data Utility (HDU) would be empowered to write, interpret, and enforce their own policies.
- Patients would have no right of action or affordable way to be compensated by the HDU if their data is shared without their consent or the subject of a data breach/hack.
Please download the PDF file to read the complete letter.
April is “Truth About HIPAA” Month!