Telemedicine (electronic communication with patients or the use of electronic communications in diagnosing and consulting from a distance) holds great promise for timely, efficient, and expert delivery of health care. It also results in health care practitioners giving advice to patients living in other jurisdictions, often without opportunity for physical examination, and exchanging confidential patient data in electronic form with a number of parties. Like any professional relationship (including the lawyer-client relationship) conducted over the Internet, doctor-patient interactions may raise legal risks. In particular, Congress is likely to enact medical privacy legislation of which companies and practitioners will need to be aware.
Privacy concerns are the current focus of attention.
Congress is now considering wide-ranging medical privacy legislation that would apply to health care professionals, insurers, employers, laboratories, database outsourcers, and any other parties involved in the storage or transmission of individual medical data. It is likely that federal legislation adopted in 1999 will have a controlling effect on the development of With this edition of the E-Commerce News, we are initiating a regular update on e-commerce developments in broad areas of interest (financial services, privacy and telemedicine transmission and data storage techniques. Three comprehensive federal health privacy bills have been introduced in the 106th Congress. Of these, Sen. Patrick Leahy’s (D-VT) bill (S. 573) and a companion House bill (H.R. 1057) sponsored by Rep. Ed Markey (D-MA) are the leading contenders for passage. In addition, patients’ rights bills introduced in both the House and Senate include provisions related to confidentiality of identifiable health information and the right of individuals to access their personal health information.
Until this legislation is adopted, state legislation and common law govern the treatment of patient records and the disclosure of information to third parties. Unfortunately, the rules differ from one sector to another (hospitals, doctors, pharmacists, nurses, paramedics, insurers, and employers are subject to different standards and liabilities), as well as from one state to another. This phenomenon is especially pronounced across national borders. The European Data Protection Directive (Directive 95/46 EC) is being implemented this year in national legislation in the 15 EU member states and ultimately in most other European countries. It generally requires express prior consent to collect and store health-related informationabout an individual, and it obliges any party with such data to so inform the individual and to give the individual access, on request, to the data. Moreover, medical data generally cannot be disclosed to any other party without consent. Canada, Australia, and other countries are considering similar legislation, with uncertain consequences for data transfers between the U.S. and those countries. Proposed federal legislation on medical privacy in the U.S. may or may not satisfy the test of "adequate protection" to justify cross-border data transfers under the laws of those countries.
Key issues for telemedicine applications include the following:
- What information is subject to confidentiality? How must the patient be notified of data practices and rights?
- May medical data be stored indefinitely?
- Under what circumstances may an individual waive privacy protection or consent to specific disclosures? How is informed consent established and recorded in purely electronic transactions?
- What exceptions are made for individual or public health emergencies, medical and scientific research, clinical trials and adverse events reporting, insurance and other payment systems, discovery in civil and disciplinary cases, internal use of health information by employers, etc.?
- Are the individual’s rights to access data limited? How may the individual object to secondary uses of data (e.g., for marketing or employment) or correct inaccurate data?
- What standards apply to the secure processing and communication of sensitive personal data?
- In providing information electronically, how does a telemedicine provider ensure the identity of the person with whom it is communicating?
Some of these issues are common to other forms of electronic services and commerce (including, for example, the financial services industry), and the security and identification issues, in particular, will likely be resolved in increasingly standard ways.
What law governs?
The key jurisdictional issue for doctors practicing medicine over the Internet is which state’s (or country’s) laws govern the doctor-patient relationship. In other words, must a doctor be licensed to practice medicine in the state (or country) where his or her patient lives, or is licensure in his or her own state (or country) sufficient? Currently, there is no uniform answer to this question. Several states have adopted legislation stipulating that when the patient and doctor are in different states, the patient’s jurisdiction prevails. This rule may not make much sense. Under current law, Florida’s laws would govern the doctor-patient relationship between a patient who physically travels from Alaska for an appointment in a doctor’s Florida office. If that patient returns to Alaska and calls her Florida doctor for advice, Florida law still governs their interaction. Why should doctor-patient communication over the Internet be treated differently?
Possible solutions to the jurisdictional problem include the establishment of a mutual recognition scheme, or reciprocity, among states. That is, Alaska and Florida could agree that the doctor’s state will have jurisdiction over the relationship, and the doctor will be required to be licensed to practice medicine only in his or her home state. The drawback to this solution is that it requires coordination between states and would not be effective unless reciprocity is agreed to by a large number of states. The Federation of State Medical Boards is drafting a model statute recognizing a limited license for physicians licensed in another state to practice telemedicine. (There is a similar initiative in the European Union, for physicians licensed in another EU country.)
This memorandum is for general purposes only and does not represent our legal advice as to any particular set of facts, nor does this memorandum represent any undertaking to keep recipients advised as to all relevant legal developments.
