By RICK BRUNDRETT
For at least two years, a few members of an obscure state panel have routinely approved requests by public- and private-sector researchers for sensitive information contained in a massive health “data warehouse,” records reviewed by The Nerve show.
The medical records database, managed by the state Revenue and Fiscal Affairs (RFA) Office, was created in 2002 under a state budget proviso and is renewed annually via a proviso. The Nerve in August revealed that a state privacy law and inter-agency agreements for the database offer weak privacy protections for citizens who deal with S.C agencies that provide records for the database.
Lawmakers earlier this year wanted to launch a similar “data warehouse” that would track sensitive education and workforce information on children and adults in South Carolina. Gov. Henry McMaster in July vetoed a budget proviso that would have authorized the creation of the database – several days after The Nerve raised privacy concerns.
Under the proviso for the existing “data warehouse,” lawmakers and their staffs can have access to that database. The same access would have been allowed for the other proposed database, though the RFA, headed by Frank Rainwater, in an earlier written statement said under “no circumstances” would personal information be made available to lawmakers or their staffs.
The existing database contains, among other information, medical claims data provided by the S.C. Department of Health and Human Services, including the names, dates of birth and medical treatment records of Medicaid patients, an HHS spokeswoman earlier said, noting that information is used by a nonprofit organization to allow health care providers in the state access to those patients’ medical records.
The Nerve’s latest review examined requests over the past two-and-half years by public- and private-sector researchers to the S.C. Data Oversight Council (DOC) to release “restricted data” from the health “data warehouse.”
“Restricted data” can include a patient’s date of birth, patient zip code, medical record number, assigned facility, and admission and discharge dates, according to the RFA’s website. The site also says a “special request is the release of restricted data elements in a manner that would allow the identification of patients and/or health care facilities and/or professionals,” and that the “release of the patient-level data … will be made to researchers and government entities only.”
Minutes of meetings from March 2016 through August of this year show that the DOC approved 72 of 83 requests, The Nerve’s review found. Of the total requests, 27 were submitted by the University of South Carolina, 13 by the Medical University of South Carolina, and six by the state Department of Health and Environmental Control. Besides DHEC, other state agencies submitting requests included the departments of Mental Health and Social Services.
Other requests came from out-of-state researchers at Harvard, Johns Hopkins and Emory universities; and the universities of Pennsylvania and California-Davis, among others. The DOC also considered requests from private entities, including the United Way of the Midlands and the USA Today newspaper.
How well the “data warehouse” records are protected once they are released isn’t clear. On Feb. 16, 2017, for example, the DOC approved the release of a “Masterlist” containing the names, dates of births and Social Security numbers of Medicaid patients to a Harvard University researcher.
Minutes of the meeting didn’t reveal how many patients were expected to be involved in the Harvard study titled, “Randomized Evaluation of Nurse Family Partnership in South Carolina” – a project of HHS, the state’s Medicaid agency.
The minutes also didn’t indicate whether written permission from patients involved in the study would be obtained before their private information was released.
The request was approved by three DOC members, though under state law, the panel is supposed to have 15 members – 12 of whom are appointed by the governor for three-year terms. There were four members present at the meeting, including a representative from the Governor’s Office, though an HHS researcher abstained from voting, minutes show.
Spokespersons for HHS and the RFA did not respond to written questions from The Nerve about the meeting.
In an email response this week to The Nerve, Katherine Baicker, the Harvard researcher who requested the data in 2017 and now a dean at the University of Chicago, said she and other researchers involved in the study were “responsible for overseeing the obtaining of informed consent from study participants,” though she didn’t answer a question about how many people participated in the study.
“We take the protection of human subjects and the confidentiality of this information extremely seriously, and all of our work is subject to the oversight of an Institutional Review Board to ensure the protection of participants and their information,” Baicker said.
Little oversight
Currently, there are nine vacancies on the DOC, including four representatives of “non-healthcare-related” businesses, according to Secretary of State records. Other vacancies left unfilled by the governor include a hospital administrator; nursing home administrator; and representatives of the managed healthcare industry, “major” third-party healthcare payers, and the South Carolina Chamber of Commerce.
The directors of DHEC and HHS or their designees, a member of the Governor’s Office, a physician, and representatives of the state hospital and medical associations also are supposed to serve on the DOC, under state law.
The Governor’s Office did not respond to three written requests from The Nerve since last month seeking comment.
The Nerve’s review of minutes of the 13 DOC meetings from March 2016 through August of this year found the number of council members present at any given meeting ranged from three to five – easily short of a majority of the statutorily mandated size of the panel.
In several cases, minutes show that DOC members deferred the decision on the release of “restricted data” to RFA staff, who are not voting members of the panel under state law. RFA staff opened and closed meetings instead of DOC members.
Asked recently what types of information typically are approved for release, DOC member Brandt Smith, vice president of information technology at the South Carolina Medical Association, told The Nerve: “I really don’t know; you have to get with the RFA folks for that.”
Pressed further about his decision-making role on the DOC, Smith replied, “They (RFA staff) just tell me. If it sounds good, I approve it.”
In an email to The Nerve, USC spokesman Jeff Stensland said that “while there may be cases where it could be possible to obtain individually identifiable data under RFA rules, we are not aware of a USC researcher obtaining such data,” adding, “The data we get from RFA is lawfully obtained and released without specific individual consent.”
MUSC researchers “get only de-identified data,” university spokeswoman Heather Woolwine said in an email. “First, before we can get data, we have to get our IRB’s (Institutional Review Board) approval on the study to make sure that both patients’ and provider’s identities are protected. The data are stored behind our fire wall and only accessed by IRB investigators approved for the specific study.”
Pricey data
From Jan. 1, 2015, through Nov. 27 of this year, MUSC paid the RFA a total of nearly $44,000 for approved records requests, while USC paid a total of $135,525 from July 2017 through Nov. 27, according to information provided by the universities. Most of the payments by the universities were drawn from federal grant funds.
In comparison, HHS paid the RFA a total of $1.75 million – split evenly between federal and state funds – from December 2016 through June of this year for “data warehousing, analysis, and de-identification,” agency spokeswoman Colleen Mullis said in an email.
The Nerve in September submitted a formal request under the state Freedom of Information Act to the RFA for a breakdown of total annual payments by every public and private entity to the RFA from fiscal years 2014 through 2018 related to the health “data warehouse.”
The agency requested a payment of $34.36 for those records and related expense information, which The Nerve declined to do after pointing out that several state agencies provided their respective payment information at no charge.
State comptroller general records show that from fiscal 2015 through mid-November of this year, 14 state agencies – not including universities – paid a total of $14 million to the RFA, including $10.6 million from HHS and $1.5 million from DSS. Those records, however, don’t give specifics on the purpose of the payments.
Brundrett is the news editor of The Nerve (www.thenerve.org). Contact him at 803-254-4411 or rick@thenerve.org. Follow him on Twitter @RickBrundrett. Follow The Nerve on Facebook and Twitter @thenervesc.
Nerve stories are free to reprint and repost with permission by and credit to The Nerve.