Police, physicians say Oklahoma's system for sharing medical records is unconstitutional

The state’s largest police union and four Oklahoma physicians are going to court against the Oklahoma Health Care Authority and Oklahoma Health Information Exchange, seeking to stop the collection and sale of private health care information.

Detailed in a 43-page lawsuit filed Thursday in Oklahoma County, police and physicians asked the court to declare the statutes which authorized and set up the exchange unconstitutional. The lawsuit seeks a temporary injunction to halt the transfer of private medical information until a court can decide the fate of the information exchange.

Travis Vernier, the police union's attorney, said the action was sparked by a series of laws passed by the Oklahoma Legislature in 2021 and 2022.

A history of the Health Information Exchange in Oklahoma

In May of 2022, state lawmakers passed Senate Bill 1369 which created the Health Information Exchange. The measure, written by Sen. John Haste, R-Broken Arrow, and Rep. Marcus McEntire, R-Duncan, gave the state Health Care Authority the power to create rules for the exchange. The measure cleared the House of Representatives 72-10 in late April and passed the Senate 45-2 on May 9. Gov. Kevin Stitt signed the bill May 11, 2022.

Under the bill, any person who provides information and data to the exchange retains a property right to that data but “grants to the other participants or subscribers a nonexclusive license to retrieve and use that information or data under relevant state or federal privacy laws.”

Vernier said the creation of the Oklahoma Health Information Exchange was the most dangerous attack on Oklahomans’ privacy in the history of the state. “Since 2021, the state Legislature has passed a series of laws that forces Oklahoma health care providers to upload residents’ health records from family doctors, dentists, physical therapists and most every provider,” he said.

More: 1 in 4 Oklahoma patients give health care a failing grade in new report

Because private medical records were not being shared with the state, Vernier said the Health Care Authority picked a private corporation, Tulsa-based MyHealth Access Network Inc., to receive, store and make the records available to other health care providers. He said each state health care provider is being forced to upload patient information even if the patient didn’t authorize the access to the information.

A representative for the Health Care Authority said the agency generally does not comment on potential or pending litigation. "OHCA remains committed to carrying out our mission to improve overall health outcomes for Oklahomans," Emily Long, a spokeswoman for the agency, said Friday, in an emailed statement to The Oklahoman.

Bob Burke, the physicians' attorney in the lawsuit, said the data collection was blatantly unconstitutional.

“As recent as 2010, Oklahoma voters amended the state’s Constitution to prohibit the Legislature and governor from compelling residents to provide their private medical information to any group such as is happening with the Health Information Exchange,” he said. “It is clear from the constitutional amendment that people in Oklahoma did not want to be forced to provide their information to a private corporation. It is frightening because the private corporation has the right to sell the information to others.”

Patients, health care workers have protested the Health Information Exchange

The lawsuit is the latest battle in an ongoing state war over the privacy of patient health care records. In March, hundreds of people, including therapists, counselors and their patients, protested at the state Capitol, saying their rights were being violated by the Health Information Exchange.

Mental health professionals said they were concerned the new rules would make people less willing to seek treatment if they knew their personal information could be viewed by others. In a column written in March for The Oklahoman, Leah Danley, a mental health counselor, wrote she was "deeply troubled by the requirement to release mental health information into the statewide health information exchange."

"Recently, the authority approved emergency revisions to this bill that expanded the mandate to all Oklahomans, regardless of using private insurance or if one pays out of pocket for mental health services. Authority literature continues to evolve on its website, but based on information on March 13, providers will be required to enter, at minimum, a name, diagnosis, dates of service and procedure codes," Danley wrote. "This means a client will now interface with their health care providers wearing their mental health treatment and particular struggle on their forehead, leading to possible bias and stigma."

In August, the Oklahoma Health Care Authority proposed new rules, which it said offered medical providers exemptions from the data sharing plan.

More: Mental health advocates protest proposed rule to share patients' data

The new rules were adopted after the protests and after Gov. Stitt rejected the original plan.

In an August media statement announcing the new rules, the Health Care Authority said it was "thankful for the feedback of Oklahoma patients and providers in creating these emergency rules which encourages improved collaboration among different healthcare providers while protecting a patient's right to privacy. OHCA remains committed to creating a streamlined, holistic health care approach and improving health outcomes for Oklahomans through the HIE."

Altus attorney Tatum Gallagher — whose husband is an orthopedic surgeon — said doctors across the state were confused about what they are supposed to do.

"The Oklahoma Health Care Authority says it will grant waivers to uploading the information," Gallagher said. "However, most physicians in the state have contracts with OHCA to treat patients covered by Sooner Care or Medicaid. If a physician accepts the waiver on HIE, he or she is in violation of the contract regarding treatment of Medicaid-eligible patients. More than a third of Oklahomans are covered by Medicaid.”

While patient participation is voluntary, Vernier, the attorney, said the data collection continues to raise serious privacy concerns. “Those laws allow the state to collect an individual’s private health care information and upload it to a database that is shared across the state and the nation,” he said. “The Health Care Authority says they are going to redact that information, but we have no idea how good that process will be.”

A hearing on the case is scheduled for 9 a.m. Nov. 30. The case has been assigned to District Judge Anthony Bonner.

This article originally appeared on Oklahoman: Oklahoma doctors, police file suit against state over medical records