Nextgov

The civil liberties group Center for Democracy and Technology highlighted on Tuesday an interesting question facing the Obama administration as it promotes technology as a tool for increasing transparency: Is there such a thing as too much transparency?

CDT staffers blogged:

Last week we learned that Humana -- and possibly some other Medicare plans -- inappropriately used enrollees' personal data to send them letters saying they could lose their benefits and services due to the impending health care reform legislation in Congress. The Centers for Medicare and Medicaid Services (CMS) called on all plans serving Medicare beneficiaries to stop such communications and launched an investigation into whether Humana's use of the personal data violated any federal laws.

Some might argue that the administration asked the health care industry to be less transparent and violated free speech in this letter to Humana officials:

CMS is concerned that, among other things, this information is misleading and confusing to beneficiaries, represents information to beneficiaries as official communications about the Medicare Advantage program, and is potentially contrary to federal regulations and guidance for the MA and Part D programs and other federal law, including HIPAA. As we continue our research into this issue, we are instructing you to end immediately all such mailings to beneficiaries and to remove any related materials directed to Medicare enrollees from your Web site.

CDT's post continues:

Whether Medicare has the right to place some limits on communications from its contractor plans is only one of the issues implicated by this activity. Humana -- in using enrollees' names and addresses to facilitate communications -- arguably committed a violation of the HIPAA Privacy Rule. The Privacy Rule sets forth very specific rules governing how health plans (and other health care entities) access, use and disclose an individual's protected health information (PHI), which includes mere demographic data like names and addresses. We do not see how the Privacy Rule permits plans to use enrollee personal data for this purpose. . .