Data Privacy
,
Data Security
,
Healthcare
NIH, CMS Project Raises Patient Data Privacy Concerns, Advocates Say

The U.S. Department of Health and Human Services said it plans to build a “data platform” that will allow researchers to “securely” access Medicare and Medicaid claims data, patient electronic medical records and consumer wearables to better understand “root causes” and outcomes of autism spectrum disorder.
See Also: Using the Netskope HIPAA Mapping Guide
The formal announcement on Wednesday by HHS’ National Institutes of Health and the Centers for Medicare and Medicaid Services came several weeks after NIH initially disclosed plans for the project – during an April 21 presentation at a council meeting. At that time, Dr. Jay Bhattacharya, NIH director, said the project involved building a national registry of people diagnosed with autism.
In the days that followed, HHS backtracked somewhat, appearing to scale back plans for a national registry in the face of a backlash from patient privacy advocates (see: NIH’s Autism Research Project Top Data Privacy Worries).
It was unclear in HHS’ announcement on Wednesday whether the plans now still include a national registry or if that effort had been officially abandoned.
Research into autism is a top priority for HHS Secretary Robert F. Kennedy Jr.
“We’re using this partnership to uncover the root causes of autism and other chronic diseases,” Kennedy said in statement. “We’re pulling back the curtain – with full transparency and accountability – to deliver the honest answers families have waited far too long to hear.”
HHS said CMS and NIH will start this partnership by establishing a data use agreement under CMS’ Research Data Disclosure Program focused on Medicare and Medicaid enrollees with a diagnosis of autism spectrum disorder.
“Using ASD as the pilot research program, teams at CMS and NIH will establish a secure tech-enabled mechanism to enhance this data sharing with timely, privacy and security compliant data exchange,” HHS said. “This pilot research program will inform continued development of a landmark NIH platform to ultimately be used by researchers in understanding healthcare utilization, chronic disease etiology and treatment and the economic burden of chronic conditions.”
HHS said autism affects about 1 in 31 children in the U.S., based on a report released April 15 in which Kennedy declared, “The autism epidemic is running rampant.”
The research will examine autism diagnosis trends over time; outcomes from specific medical and behavioral interventions; access to care and disparities by demographic and geography; the economic impact on families and healthcare systems.
HHS did not immediately respond to Information Security Media Group’s request for additional details about the project, including how the data collection and exchange would be kept private and secured, as promised by officials.
Meanwhile, HHS’ project plans continue to fuel concerns among some privacy advocates.
“Specifically, I still have a number of outstanding questions regarding how the government plans to compile health and disability-related data about individuals with autism spectrum disorder from both federal and commercial sources into a federal research project,” said attorney Andrew Crawford, senior policy counsel of the privacy and data project at the Center for Democracy and Technology.
HHS’ announcement raises “a host of unanswered questions with big implications for individual privacy,” he said.
Among those questions is whether individuals will be notified that their data is being collected or whether the data will be collected without their consent; how long the government plans to keep the health data; what non-governmental sources will contribute data to the project; who will have access to the data; and what privacy protections will be implemented to protect this data from improper access and sharing, Crawford said.