SENATE  BILL  99
INVASION  OF  THE  BODY  SNATCHERS,  21^ST  CENTURY-STYLE

This bill would allow any “health care provider” - from local doctor or dentist to neurosurgeon to jailhouse physician - to “retain genetic information of an individual without obtaining an authorization from the individual or a personal representative of the individual” under certain conditions.  How the doctor would obtain that information is not specified, but as every movie-goer knows, it could be gained from any tissue sample, from blood or urine to a fallen hair. This authorizes its covert retention; the law already, to a certain extent, approves its covert collection. We fear such information could be used for anything from identify theft to identity confirmation, medical research and treatment to covert cloning and genetic manipulation.   

The conditions under which a medical provider could secretly retain genetic information are about as broad as one could imagine.

1.         For “payment.“ A medical provider could retain a patient’s genetic sample if the patient has not paid him. Since the provider can do so without notice or consent, the patient may never know what happened, even if he may wonder why he never got billed for that visit. Can the provider deliberately not bill the patient and, without notice or consent, take a sample at their next meeting?  SB 99 says he can.  

2.         For “his own treatment?” This seems a red herring, inserted into the bill because it feels equitable. But how will a doctor use a patient’s genetic data for his own treatment, when doing so requires specialized, costly equipment only a few biotechnology firms possess? Besides, isn’t secretly taking something because we want it usually called theft?

3.         For “health care operations.” Now we get to the meat of this legalized invasion of the body snatchers. Could a provider, having covertly but legally gotten your genetic data, go into business with it, and be legally shielded from his theft? Would SB 99 allow him to sell it, or use it in a partnership with a technologically equipped biotech company?. Yes, if for “health care operations.” That’s pretty broad.

Ah, but there is a limit, passed in 2003. The law already limits who the health care provider can give that genetic information to. A provider can disclose genetic information, taken under SB 99 without consent or notice, only if he does so in accordance with ORS 192.520(3). Under that, a health care provider

“(3) May disclose protected health information of an individual without obtaining an authorization from the individual or a personal representative of the individual:

(a) To another covered entity for health care operations activities of the entity that receives the information if:

(A) Each entity has or had a relationship with the individual who is the subject of the protected health information; and

(B) The protected health information pertains to the relationship and the disclosure is for the purpose of:

(i) Health care operations as listed in ORS 192.519 (4)(a) or (b);* or

(ii) Health care fraud and abuse detection or compliance;

(b) To another covered entity or any other health care provider for treatment activities of a health care provider; or

(c) To another covered entity or any other health care provider for the payment activities of the entity that receives that information.”*

* Two points about the above text. One is that the intent of (c ) above is clear enough, even if the language itself is gibberish. The second is what ORS 192.519 (4) (a) and (b) refer to: “(a) Quality assessment, accreditation, auditing and improvement activities; and (b) Case management and care coordination.”

The key to the mess SB 99 makes when combined with this existing statue is in the existing ORS approval of the transfer of medical information “for treatment activities” and for “payment activities,“ in (b) and (c ) however ill-stated the later.

SB 99 combined with 192.520 allows the retention and transfer of genetic information - like, it appears, all other medical information - from virtually any health care provider to any health care provider if there is some sort of treatment proposed or some transaction between the provider with the genetic data and the provider that wants it. 

The 2003 legislation was bad law, and now SB 99 would plunge our genes as well as our organs and illnesses through the door the 2003 legislation opened. There are dangers here we cannot yet imagine, yet we all know are present. The legislature should go back to square one, undo this mess and replace it with a coherent structure than respects personal privacy, our property rights in our own genes, and the normal rules about notice and consent. If we get this wrong - and the 2003 bill already has and SB 99 makes it worse - we may face unpredictable, vast and frightening consequences. Must we make Oregon the Wal-mart of stolen somatic samples and pirated personal genetic data, just to encourage biotechnology companies to locate here?

Ed Johnston 541-336-1233