Protecting Patient Confidentiality

ASA quickly discovered a glaring problem with the protocols in the DHS-issued county handbook. As part of the requirements placed on counties by the state, DHS defined a set of record maintenance procedures. These procedures instructed county departments of public health, or administrating agency to retain patient records (specifically, a patient's recommendation and any other medical records needed for the application process), which "must" be kept for "at least one year." Since the handbook requires counties to renew applications each year, allowing the administering agency to use "applications and supporting documentation on file," to make its determination, patient documentation could be retained indefinitely.

With the possibility of federal subpoena and risk of self-incrimination ever-present for patients participating in the ID card program, the DHS document retention policy created unnecessary vulnerability and potential harm for tens of thousands of people in California.

In addition to ASA urging DHS to revise its document retention (and, by extension, its patient privacy) policy, other public officials weighed in. California legislator and co-author of SB 420 Assembly Member Mark Leno wrote a letter to DHS. Santa Cruz Health Services Agency Director Rama Khalsa also wrote a letter to DHS (furnished courtesy of ACLU). Both decried a document retention policy that went beyond what records the state requires of counties: a photo, a unique identifying number, and ID card expiration date.

ASA was successful in getting DHS to revise its handbook and strike the original language in the section on maintenance of records that applied to the length of time administering agencies are required to retain documents. On October 28, 2005, DHS issued a letter to local administering agencies making them aware of the revision to the handbook.

Review the DHS letter of October 28, 2005, revising its county handbook regarding maintenance of records.

DHS now leaves it up to each county to determine its own record retention policy, in terms of what documents to keep and for how long. This will certainly be helpful for counties such as San Francisco and Santa Cruz who already had a policy of returning or destroying patient records after a card is issued. And even though this is a better DHS protocol than the one that previously existed, explicit instruction from the state on record retention is still necessary.

The state DHS should clearly instruct counties to return or shred confidential patient data that could compromise both health officials and patients should they be subject to federal subpoena. See the action alert below to help change DHS policy on this important issue of patient confidentiality.

Action Alert

Take action and call the Medical Marijuana Program at (916) 440-7836 to express your concerns! Urge them to change the policy to instruct counties to return or destroy confidential records! And ask your friends to do the same.

Suggested Script:

"My name is ___________. I live in ____________ County. I am calling the Medical Marijuana Program on behalf of the thousands of patients in California who stand to be effected by the confidentiality issues of the ID card program.

"Right now, patient privacy is at risk. I am calling on the state to instruct counties to return or destroy confidential records after the application has been answered. This is the only way to protect our privacy from federal subpoena.

"If the state Medical Marijuana Program can assure me of my privacy, I will work to speed up the implementation of the ID card program in my county."

After you call, please email George@safeaccessnow.org to report on the response you receive.