Vol. 83, No. 2, February 2010
In May, hackers broke into a medical records database in Virginia and demanded extortion payments after causing considerable damage.1 This was similar to a previous cyber-attack in California that started in October 2008.2 Not only are medical records and other health-care information Web sites vulnerable, but so are sites engaged in e-commerce in the health-care field. A crude Internet search using a term like “drugs without prescription” yields thousands of results. Both the Food and Drug Administration (FDA) and the Drug Enforcement Administration (DEA) have issued warnings regarding Internet drug sales, and such sales are a major source of spam email. According to the DEA, “Prescription drugs … are widely accessible and often illegally purchased through the Internet. … [R]ogue Internet sites are not there to benefit the public, but to generate millions in illegal sales. … More often than not, a ‘rogue’ site will also provide for invalid prescriptions based on the completion of a cursory questionnaire. This process … elicit[s] what drug the customer wants and what the method of payment will be, rather than diagnosing a health problem and establishing a sound course of medical treatment.”3 While there is a myriad of health-care information available on the Internet, much of it is highly technical and difficult for even trained professionals to understand. Without necessarily intending to, well-meaning people who provide health-care information on the Internet may mislead or otherwise confuse desperate patients and families.4
Although the potential benefits of the Internet will likely lead to increased efficiency and quality of health care and significant cost savings in a $2.51 trillion industry,5 there are many legal pitfalls that must be addressed. In the midst of the heated health-care reform debate, calls for electronic medical record-keeping and widespread use of the Internet for obtaining medical information and health-care related advice and engaging in health e-commerce, these potential legal issues must be carefully considered to make full use of the Internet’s potential in the health-care field.6 This article, although not exhaustive, examines some of the more important areas that require consideration by lawyers, judges, policymakers, and others involved with health-care issues and health-care reform. While Internet use can be an important part of lowering health-care expenditures, the possible problems that may arise with such increased use of Internet resources in the health-care arena have only just begun to be recognized and addressed.
Legal Issues of Providing Medical Information and Advice via the Internet
At one end of the spectrum of health-care sites on the Internet are those that simply provide information, ranging from general to specific, on diseases.7 Medical and scientific organizations, such as the American Heart Association and the American Medical Association (AMA), and Medscape, WebMD, and other information providers maintain Web sites containing medical information and discussions of health-care public policy, ethics, and many other topics.8 Many medical publishers, drug companies, and other commercial entities in the health-care field also provide general information.9 Other sites allow consumers to ask a physician or other health-care professional questions about specific problems that relate to the consumer’s own situation.10
The value of this kind of interaction over the Internet is not in question. However actions by hackers and identity thieves should raise alarms regarding confidentiality and privacy.11 The Health Insurance Portability and Accountability Act of 1996 (HIPAA) continues to apply, but more laws and regulations may be needed in the Internet era to protect privacy and confidentiality.12 Encryption software is available to protect privacy and confidentiality, but such software is needed both to send and to receive confidential information. Many consumers are unaware of the dangers, and standard encryption software must be made available to both users and providers at a reasonable price. This is not currently the case.13
The AMA, Intel, and others have proposed developing digital credentials for physicians to help ensure reliability and accountability of the information and advice provided.14 The AMA also has promulgated guidelines for maintaining privacy and confidentiality in Internet communications, and a consortium of health-care Web sites has produced its own ethical guidelines.15The Department of Health and Human Services (DHHS) also has announced regulations for securing electronic medical data.16 Patients and physicians are increasingly using email to communicate, raising the possibility that hackers will be able to obtain personal information provided to the physician.17 Specific state and federal statutes may apply, and suits for breach of privacy or confidentiality, and in some contexts medical malpractice, provide tort-law protections in health-care Internet communications.18
While direct access to MEDLINE, Medscape, WebMD, and other such sources provides valuable information to the health-care consumer, reading the medical literature can be a daunting task. A study by a group of physicians at the University of Michigan examining Web sites about Ewing’s sarcoma, a form of bone cancer, illustrates the magnitude of the problem.19 More than half of the studied sites contained information that had never undergone scientific review, and a significant proportion contained easily misunderstood, inaccurate, misleading, or confusing information. Impaired judgment and emotional strain may allow easily confused users to be manipulated, even when there is no intent by the information provider to mislead the consumer.20
Philip M. Kober, Valparaiso 2001, also holds a Ph.D. in physiology (Loyola-Chicago 1983) and an M.D. (Rush Medical College, Chicago, 1994). He maintains a law office in Watertown, practicing at the interface of law and medicine. He consults on significant health care-related issues and advocates for patients and families with medicolegal problems. Reach him at firstname.lastname@example.org.
A license to practice medicine is not generally required to simply provide information unless a patient-physician relationship is created by providing a diagnosis or recommending treatment.21 Indeed, self-help Web sites created by patients and their families can be very useful in coping with diseases. Clearly stated, prominent disclaimers should be used to prevent over-reliance on such Web sites. However, self-help and other Web sites that simply provide information are not a substitute for seeking the advice of one’s own physician, and the legal enforceability of such disclaimers remains unclear.22
There have been many proposals for rating or accrediting Web sites to ensure quality, but these proposals have all met with substantial criticism and resistance to implementation. Minimally, there should be adequate disclosure of authorship and credentials or background to allow consumers to make their own judgments as to quality, and physicians should be willing to answer questions about particular Web sites that their patients may be using.
The provision of specific advice with regard to diagnosis and treatment or prevention may create a patient-physician relationship and thus the potential for malpractice liability. Even if there is no patient-doctor relationship, causes of action for fraud or misrepresentation may still lie, especially in situations in which willful, wanton, or reckless conduct is involved.23 Long-arm jurisdiction and determination of when a patient-physician relationship exists under these circumstances of Internet-based interactions are issues that may need to be resolved in court.24 Modification of state medical-licensure laws has been proposed to clarify the applicability of the laws to situations in which medical advice is proffered over the Internet, but this has created considerable resistance among state governments.25 With increasing remote consultation by specialists and other uses of e-health information, it is time for medical boards, legislatures, and members of the legal profession to debate and discuss the issue of medical licensure laws and other aspects of the application of law to health-information exchange over the Internet.
Drugs, Medical Devices, and Health-care Services on the Internet
At the other end of the spectrum of Internet health-care sites are health e-commerce sites that provide cost savings and convenience by allowing consumers to purchase prescription drugs and medical devices and make arrangements for health-care services, including surgery.26 The convenience to consumers and physicians makes online pharmacies and Internet sellers of medical devices and supplies extremely attractive to patients.27
Health e-commerce, however, is prone to fraud and other problems. Several online pharmacies provide prescription drugs on the basis of questionnaires that are evaluated by unscrupulous physicians, without any physical examination or other direct interaction between physician and patient, and some Internet pharmacies provide drugs, including narcotics and other scheduled drugs, without any prescription whatsoever.28 There is little or no follow-up and only minimal effort is made to ascertain whether there is a clinical indication for the requested drug in many cases, and there may be little or no discussion of risks and benefits of a particular medication.29 Some sites openly advertise the availability of unapproved medications.30 Other sites have provided counterfeit drugs to unsuspecting consumers.31 Sales from Internet pharmacies are fueled by pharmaceutical manufacturers’ direct-to-consumer advertising, which is often poorly understood by consumers.32
Although a few states have sued online pharmacies to stop these impermissible practices, there has not been any concerted effort in this regard.33 New federal legislation, the Ryan Haight Online Pharmacy Consumer Protection Act of 2008, has only recently taken effect and its impact is still unknown.34 This act, moreover, focuses on the problems of narcotics availability but does not even begin to address the wide variety of other drugs that are available on the Internet. Additional enforcement tools certainly are needed.
The AMA and other medical professional societies, including the Federation of State Medical Boards, have issued guidelines for Internet prescribing practice, which have been thoroughly critiqued for potential negative impact.35 The principles, however, are correct: One-stop online pharmacies that diagnose illnesses (often via a short questionnaire) and prescribe and dispense drugs are not providing good medicine – a history and at least a directed physical exam and adequate follow-up are required.36 Medical malpractice and other forms of tort liability should apply here as well.37 Refill prescriptions often can be handled via the Internet, but even then a doctor should occasionally see the patient to monitor progress and to check for complications or adverse side effects. Experimental and unapproved drugs and narcotics and other drugs of abuse should not be freely available. While fraud and abuse in the sale of medical devices and supplies over the Internet has not been widely reported, the potential for trouble is clear.38 The various enforcement and regulatory authorities should pay attention to these sites as well.
Health Care and the Challenges of the Information Age
The Internet is an important and valuable tool in the health-care field, but the legal issues related to privacy and confidentiality, quality assurance, and medical e-commerce need to be resolved. Only then can we as individuals and as a society reap the benefits of greater efficiency and lower health-care costs that this new and expanding resource can provide.