State: Privacy secure on insurance site, despite warning
By Peter Hirschfeld
Vermont Press Bureau | October 03,2013
Some visitors to the website for Vermont’s health insurance marketplace were greeted by this privacy notice Tuesday morning.
MONTPELIER — Visitors to the state’s new online health insurance marketplace were greeted Tuesday morning with a notice warning that users “have no explicit or implicit expectation of privacy” and that their files may be “intercepted,” “monitored” or “recorded” by police, federal agencies and even foreign governments.
But Robin Lunge, director of health care reform for the Shumlin administration, said the language has since been axed from the site and that prospective customers of Vermont Health Connect can rest assured that, barring a court order, their data won’t be vulnerable to inspection by outside eyes.
“Being a lawyer, I will make a caveat that there are instances where a court could order the disclosure of certain information,” Lunge said Wednesday. “But that’s a pretty extreme example, and under the normal course of business, our commitment is to protect individuals’ information.”
Screen shots of the “notice of acceptable use” policy began appearing on Twitter shortly after Vermont Health Connect went live Tuesday morning, setting off alarm among people who encountered the starkly worded warning.
Lunge said the verbiage was provided to Vermont, and other states operating their own health insurance exchanges, by the Centers for Medicare and Medicaid Services.
While patient data is usually protected under a federal law known as HIPAA, those protections can be suspended during public health emergencies to expedite the transfer of relevant medical information to entities looking to contain the problem. Lunge said the notice language provided by the federal government is designed to inform users that their data may be shared under such a scenario.
When the state began seeing Vermonters register their concern about the notice on social media, Lunge said, officials met to discuss the issue. Since Vermont Health Connect doesn’t actually ask users for personal medical information that could be relevant in public health emergencies, she said, the administration opted to take the notice-of-use policy down.
“Since we’re not collecting that sort of information that would need to be disclosed in the event of an emergency, we decided it wasn’t necessary to have it on there,” Lunge said. “We’re not collecting information we would ever have to share in that eventuality.”
Lunge said exchanges in other states might opt to keep the notice online, since they could be collecting information about personal medical conditions or lifestyles. In Vermont, Lunge said, “community rating” standards make that information irrelevant when it comes to calculating insurance rates.
“In other states they could ask some questions, where they’re allowed to charge different amounts depending on different issues,” Lunge said. “But in our case, because of our community rating law, I don’t believe we are collecting any health information at all.”
Lunge said the state has taken pains to ensure the security of patients’ data on Vermont Health Connect, the web portal through which more than 100,000 residents will soon be required to purchase their insurance. She said information about personal income is likely to be the most sensitive piece of data users are asked to disclose when buying their insurance on the site.
About 13,000 people visited Vermont Health Connect during the site’s first 24 hours online, and nearly 800 created personal accounts, according to the Department of Vermont Health Access.