Protection from prying eyes: Physician Medicare data stays confidential
■ A federal appeals court ruled against a company's request for Medicare claims data, saying that would violate a 31-year-old injunction against revealing individual payment information.
Posted Feb. 1, 2010.
The urge by some to delve into Medicare data and use it for purposes for which it was never intended, and should not be released, is neither new nor likely to go away.
Even with attempts to get this information previously rebuffed, there may be new ways to ask the question, and the motivation will be particularly strong if there is potential profit in the answer. A recent unanimous decision by a three-judge panel of the U.S. Circuit Court of Appeals in Atlanta demonstrates both what's at risk and what the AMA has accomplished to protect physician privacy.
At issue was a case brought by Real Time Medical Data and its partner, Jennifer Alley, that would have effectively opened the books on how much individual physicians are getting paid by Medicare. Filing under the Freedom of Information Act, the plaintiffs wanted physicians' names and addresses matched with the procedures they performed, and with the Current Procedural Terminology codes associated with those procedures. The stated purpose was to sell that data to hospitals, physicians' offices and others.
In rejecting the attempt, Judge Edward E. Carnes noted that a 1979 U.S. District Court injunction declared any disclosure of individual physician Medicare payment is "contrary to federal law."
That earlier case stopped the Dept. of Health, Education and Welfare, predecessor to the Dept. of Health and Human Services, from publishing Medicare claims data for individual physicians. The effort was launched to assess physician costs in the midst of a contentious health system reform debate. But a U.S. District Court in Orlando, Fla., ruling in a lawsuit that included the Florida Medical Assn. and the AMA, said publishing individual payment data served no public purpose.
"Even if history does not repeat itself, events do sometimes rhyme," Carnes colorfully wrote in his opinion announcing the court's decision, "While its meter might not match our own, that decades-old decision and the injunction issued control the closing couplet of this case."
The company in the current case was not asking for individual pay data, but Carnes noted the mere fact it wanted CPT codes meant that all anyone would have to do is match the codes with the publicly available rates, based on locality, and then calculate how much a doctor is being paid by Medicare.
The 11th Circuit Court's ruling followed another appeals court's decision, earlier in 2009, that also cited the 1979 injunction as a reason for denying a private company's request for Medicare physician data. A District of Columbia court ruled against Consumers' Checkbook, a company that wanted to get claims data so it could publish a guide that featured how many times individual physicians performed certain procedures. The AMA was an appellant in that case, as well as in the Alley case.
Despite those victories, keeping Medicare physician claims data private is not guaranteed. After all, in both the Alley and Consumers' Checkbook cases, U.S. District Courts ruled in favor of releasing information -- a clear signal that troubling rulings will be made, even if the ones so far have not cleared the scrutiny of the appeals courts.
As Carnes noted, Alley or anyone else who wanted to overturn the 1979 injunction had a clear path to doing so -- go to the U.S. District Court that issued it, and convince that court to overturn it.
Technically speaking, the Alley ruling protects only doctors in Florida and, in a special way, members of the American Medical Association. Because of the way the case was filed, the ruling applies to AMA members in Georgia, Mississippi and Tennessee, as well as Florida. But each decision effectively protects the privacy of every physician who participates in Medicare, because HHS cites the court rulings in its refusal to release claims data.
The motivations may come and go, but the privacy risks here are fundamental. The release of data that is rightly confidential is bad enough; the potential to pair it with other information compounds the problem. The AMA has fought, and thus far won. But it remains to be seen what curious new twist might be applied to access confidential Medicare data.