Print Columns   |   Web Chats   |   Blog Archives   |  

Cho's Secrets: Privacy Gone Wild

(The Sunday column.)

We can all breathe easy now: When Seung Hui Cho passed all too fleetingly through Virginia's mental health system, "everyone did everything that was required by Virginia code." So concludes Kent McDaniel, consulting psychiatrist to the state inspector general's investigation into what authorities did about Cho before he shot 56 people, killing 32, at Virginia Tech.

As the probes into the horrific events of April 16 start to come in, we're learning that Cho's rapidly escalating bizarre behavior was known to even more people than was first reported and that lots of those people tried to get someone to take action -- to no avail.

But we're also learning that when governments investigate themselves, they tend to conclude that everyone did a marvelous job; that there are gaping holes in our mental health system (We're paying people to rediscover this?); and that we've let privacy zealots run amok, rewriting our laws to make it much harder to find the truth about even a massive crime such as Cho's, let alone about ordinary doings in American health care. Just about every investigation into the Tech shootings is running into walls. Until Cho's family authorized Virginia Tech last week to give Gov. Tim Kaine's commission the shooter's medical records, privacy laws had prevented investigators from finding out essential facts, such as whether Cho ever got the outpatient treatment that a court ordered for him four months before the shooting .

Check that: Some investigators do know the truth; they just aren't saying.

At a recent public meeting in Fairfax County, when a member of Kaine's commission asked whether the state court got to see a psychiatrist's evaluation of Cho, McDaniel answered, "I can answer the question -- I know the answer -- but because of issues of confidentiality, I'm constrained."

"It's really rather remarkable," said a visibly frustrated Tom Ridge, the former homeland security secretary who serves on Kaine's panel. "We're talking about a deceased individual who's responsible for all kinds of carnage, and you as a professional are still encumbered by the law."

When I asked James Stewart, Virginia's inspector general for mental health, whether Kaine's commission will be able to gain a full understanding of the Cho case, he replied, "I can't speak to that."

The tangle of privacy laws is so maddening that even the Bush administration, not exactly a big booster of the free flow of information between government and the people, concluded last week in a report to the president that "confusion and differing interpretations about state and federal privacy laws and regulations impede appropriate information sharing" that could identify dangerous students and save lives.

The report by three Cabinet members said concern about liability at colleges is preventing the exchange of information needed to focus attention on potentially dangerous students. The report recommended looking at easing legal restrictions to create a better balance between privacy and security.

In Cho's case, an overemphasis on privacy inhibited efforts to do something about the threat he posed while he was alive. After roommates, neighbors, classmates and professors alerted officials that something was deeply wrong, Tech deans, counselors and police spoke to Cho, removed him from a class and, eventually, took him into emergency custody to see if he should be hospitalized.

But because of privacy laws, the university had no procedure for notifying Cho's family that he'd been taken in for observation, university police were not informed when Cho returned to campus and Tech's counseling center never told the state whether Cho showed up for his court-ordered treatment.

Faculty at Tech express frustration about a system that holds information too tightly. When Kerry Redican, president of Tech's faculty senate, had a student whose wild, paranoid, aggressive scrawls on a test sheet raised major alarms, he called the counseling center. But he was never told what happened. "That's where communication stops because of confidentiality -- need-to-know," he said. For the sake of the student, he said, faculty who see kids every day need to be in the loop.

Some schools take a less legalistic attitude. Peter McDonough, Princeton's general counsel, told the school's alumni magazine that he often asks counselors which "would we rather deal with: a contention or claim of a privacy violation, or a death? I think it's fair to say that, being as respectful as we possibly can be to the various laws, at the end of the day, we're going to try to preserve life."

No system can identify every Cho before disaster strikes. But any system that lets rigid laws take precedence over common sense, human caring and the free flow of information is destined to fail.

"We keep head-injured patients, trauma patients, involuntarily all the time," said Marcus Martin, an emergency room physician who is on Kaine's commission. "We don't rely on the legal system. It should be the same for mental health."

By Marc Fisher |  June 17, 2007; 12:04 AM ET
Previous: Random Friday Question: How Much Noise Is Too Much? | Next: Education Monday: The New Schools Chief

Comments

Please email us to report offensive comments.



Matthew Kennedy who killed a Fairfax police detective and another police officer had voluntarily checked himself into four treatment facilities. He never received so much as an Ambien. A professor who helped Cho said Cho declined to visit university counseling services because he had been and they were no help. Instead of complaining about patient privacy rights, why not adopt a policy of helping those who seek help?

Posted by: Kacoo | June 17, 2007 10:21 AM

As a university administrator, I agree with your column, but disagree with one comment. You said "But because of privacy laws, the university had no procedure for notifying Cho's family that he'd been taken in for observation..." It is not that the university did not have a procedure, it is that the university is legally prohibited from sharing the information. No university procedure can trump federal and state law.

Posted by: Jim | June 17, 2007 11:02 AM

Marc -- Once again, you're attacking privacy laws. The last time you did so, I pointed out that the law you were talking about did not do what you said it did:

http://www.concurringopinions.com/archives/2007/06/too_much_privac.html

Despite my blog post and comments to your post, you continue to make broad claims about unnamed "privacy laws." Can you please cite to the provisions of privacy laws you're referring to and that the people you're quoting are talking about? As one who studies privacy law in great depth and who has written a 1000-word textbook about privacy law (including an entire chapter on medical privacy), http://www.informationprivacylaw.com, I am quite perplexed. I am not aware of the privacy laws that do the things you're talking about. So I would be very interested in learning about the specific laws and what they require.

I assume that you looked up the laws prior to writing about them. Perhaps there's a law out there I'm unaware of, and if so, I'd be very interested in knowing about it.

So can you please cite to me the privacy laws you're referring to?

Posted by: Daniel J. Solove | June 17, 2007 11:11 AM

um, that would be Marcus L. Martin, M.D., Assistant Vice President of the Office of Diversity and Equity at the University of Virginia, lately head of U.Va.'s Department of Emergency Medicine. Show respect, Marc!

Posted by: wahookitty | June 17, 2007 12:07 PM

Jim: Where you say, "... it is that the university is legally prohibited from sharing the information. No university procedure can trump federal and state law."

I agree that university policy cannot trump state or federal law -- unless they provide more protection and not less -- but precisely which federal law are you referring to? HIPAA specifically excluded records that would be covered by FERPA in the Privacy Rule, even if those records contain health information. Attempts to access records containing health information for non-treatment purposes puts the records under FERPA's protections, not HIPAA's. Some of HHS's comments and explanations on this can be found at http://www.bricker.com/legalservices/practice/hcare/hipaa/preemption7.asp

If the records were not covered by HIPAA but by FERPA: (1) FERPA does have emergency exceptions that would have permitted the school to contact the family if the student required emergency hospitalization for psychiatric reasons, and (2) since FERPA protections end at death, VA Tech could have released their counseling center records to the panel even without parental consent.

Despite Mr. Fisher's repeated claims that the laws are preventing certain things, I am not convinced that the federal laws are the problem as much as lack of understanding of which laws apply and what the laws actually prohibit and what they permit under particular conditions.

Posted by: Dissent | June 17, 2007 12:35 PM

To use the Cho case as anecdotal evidence to indict all privacy laws is the same as using an individual case of a probable criminal being released on a technicality to throw out the Bill of Rights. I am glad to know that we have some privacy left.

Posted by: Paul | June 17, 2007 1:24 PM

So once again, we blithely ignore the fact that the state of Virginia is awash with easily obtained weapons to attack the privacy protections of millions of Americans against those who would eagerly troll through the most intimate medical details of their lives simply because they wish to do so.

As a HIPAA implementation consultant, and naturally familiar also with FERPA - a law of which Mr. Fisher appears blissfully unaware and that specifically permits a University to protect itself and it's student population when it is deemed appropriate and necessary - the ability of some in the uninformed media and the public in general to engage in '20/20 hindsight' and opine without checking the facts is little short of phenomenal.

So Tom Ridge, he of Yellow/Orange/Red/Green Alert and "duct tape and plastic" fame, feels that the law is inappropriately restrictive?

I am surely impressed, particularly since on his watch absolutely nothing was done to secure our ports, railways, general aviation industry and national borders against an obvious threat; but the government he served found it necessary to engage in patently unconstitutional behavior such as the destruction of habeas corpus, covert wiretapping of patriotic Americans, generating 'lists' of political dissenters and labeling them as 'terrorists', the establishmentand operation of extralegal prisons, and torture (and at least six known deaths)of suspects in our care and for whom as a nation and a society we were responsible.

No, the medical privacy aspects of the Cho case were not the problem. The problem was that officials responsible for notifying State authorities of his involuntary commitment failed to do their jobs, thus permitting him to waltz into a gun store and purchase the weaponry.

Perhaps Mr. Fisher and other so willing to cast aside medical privacy would be willing to make their own medical records publically available, including such information as whether or not they are on medication and if so, for what purpose, what counselling or mental health services he or members of their family have ever used, whether or not they have a chronic condition that would be of great interest to their health insurance provider and life insurance company, whether or not they have ever been treated for an STD, Hepatitis C, AID-related complexes, or ever smoked, or are overweight, or have high blood pressure, or have ever (females) terminated a pregnancy, or have a family history of strokes, heart disease or cancer, or have ever had a tumor, skin cancer or have ever been suspected of having any such, etc.

Posted by: Lew | June 17, 2007 2:01 PM

So once again, we blithely ignore the fact that the state of Virginia is awash with easily obtained weapons to attack the privacy protections of millions of Americans against those who would eagerly troll through the most intimate medical details of their lives simply because they wish to do so.

As a HIPAA implementation consultant, and naturally familiar also with FERPA - a law of which Mr. Fisher appears blissfully unaware and that specifically permits a University to protect itself and it's student population when it is deemed appropriate and necessary - the ability of some in the uninformed media and the public in general to engage in '20/20 hindsight' and opine without checking the facts is little short of phenomenal.

So Tom Ridge, he of Yellow/Orange/Red/Green Alert and "duct tape and plastic" fame, feels that the law is inappropriately restrictive?

I am surely impressed, particularly since on his watch absolutely nothing was done to secure our ports, railways, general aviation industry and national borders against an obvious threat; but the government he served found it necessary to engage in patently unconstitutional behavior such as the destruction of habeas corpus, covert wiretapping of patriotic Americans, generating 'lists' of political dissenters and labeling them as 'terrorists', the establishmentand operation of extralegal prisons, and torture (and at least six known deaths)of suspects in our care and for whom as a nation and a society we were responsible.

No, the medical privacy aspects of the Cho case were not the problem. The problem was that officials responsible for notifying State authorities of his involuntary commitment failed to do their jobs, thus permitting him to waltz into a gun store and purchase the weaponry.

Perhaps Mr. Fisher and others so willing to cast aside medical privacy would be willing to make their own medical records publically available, including such information as whether or not they are on medication and if so, for what purpose, what counselling or mental health services he or members of their family have ever used, whether or not they have a chronic condition that would be of great interest to their health insurance provider and life insurance company, whether or not they have ever been treated for an STD, Hepatitis C, AID-related complexes, or ever smoked, or are overweight, or have high blood pressure, or have ever (females) terminated a pregnancy, or have a family history of strokes, heart disease or cancer, or have ever had a tumor, skin cancer or have ever been suspected of having any such, etc.

Somehow, I doubt it.

Posted by: Lew | June 17, 2007 2:03 PM

While FERPA privacy restrictions may end at death, according to our other posters, don't HIPAA privacy restrictions continue into perpetuity?

These are both laws that need to be reexamined to allow educational institutions to better communicate amongst the right channels about matters of a clearly "off" student -- without the specter of lawsuits over their heads.

Posted by: vuac | June 17, 2007 2:40 PM

There is something very strange about a system that doesn't let people know that offspring of fathers who are past the age of 32-33 are at increasing risk for non-familial mental illnesses and autism. This was first written about in 1958.

Dolores M. Malaspina, M.D. Chair of the Dept. of Psychiatry, NYU School of Medicine.
"The most irrefutable finding is our demonstration that a father's age is a major risk factor for schizophrenia. We were the first group to show that schizophrenia is linearly related to paternal age and that the risk is tripled for the offspring of the oldest groups of fathers.7 This finding has been born out in every single cohort study that has looked at paternal age and the risk for schizophrenia. The only other finding that has been as consistently replicated in schizophrenia research is that there is an increased risk associated with a family history of schizophrenia. Since only 10% to 15% of schizophrenia cases have a family history, family history does not explain much of the population risk for schizophrenia. However, we think that approximately one third or one quarter of all schizophrenia cases may be attributable to paternal age. Paternal age is the major source of de novo genetic diseases in the human population, which was first described by Penrose8 in the 1950s. He hypothesized that this was due to copy errors that arose in the male germ line over the many cycles of sperm cell replications. These mutations accumulate as paternal age advances. After the Penrose report, medical researchers identified scores of sporadic diseases in the offspring of older fathers, suggesting that these could occur from gene mutations. Particular attention was paid to conditions in last-born children."
http://www.schizophreniaforum.org/for/curr/Malaspina/default.asp
Schizophrenia Risk and the Paternal Germ Line
By Dolores Malaspina


Dolores Malaspina
Paternal age at conception is a robust risk factor for schizophrenia. Possible mechanisms include de novo point mutations or defective epigenetic regulation of paternal genes. The predisposing genetic events appear to occur probabilistically (stochastically) in proportion to advancing paternal age, but might also be induced by toxic exposures, nutritional deficiencies, suboptimal DNA repair enzymes, or other factors that influence the

fidelity of genetic information in the constantly replicating male germ line. We propose that de novo genetic alterations in the paternal germ line cause an independent and common variant of schizophrenia.

Seminal findings
We initially examined the relationship between paternal age and the risk for schizophrenia because it is well established that paternal age is the major source of de novo mutations in the human population, and most schizophrenia cases have no family history of psychosis. In 2001, we demonstrated a monotonic increase in the risk of schizophrenia as paternal age advanced in the rich database of the Jerusalem Perinatal Cohort. Compared with the offspring of fathers aged 20-24 years, in well-controlled analyses, each decade of paternal age multiplied the risk for schizophrenia by 1.4 (95 percent confidence interval: 1.2-1.7), so that the relative risk (RR) for offspring of fathers aged 45+ was 3.0 (1.6-5.5), with 1/46 of these offspring developing schizophrenia. There were no comparable maternal age effects (Malaspina et al., 2001).


Posted by: anniepema | June 17, 2007 3:43 PM

anniepema, what the heck are you talking about and what the heck does that have to do with privacy laws? geez, the bats are out today.

Posted by: dgtls | June 17, 2007 4:49 PM

You inappropriately cite unspecified privacy laws as the reasons "...the university had no procedure for notifying Cho's family that he'd been taken in for observation, university police were not informed when Cho returned to campus and Tech's counseling center never told the state whether Cho showed up for his court-ordered treatment..." The breakdown in communications comes from failure by the courts, schools, police and health providers to adopt thoughtful procedures within the law and adequately training staff on their job responsibilities. Well before HIPAA, courts failed to set up efective accountability reporting mechanisms for court-referred clients requiring treatment, law-enforcement personnel didn't learn and/or follow established procedures for securing protected information, and the burden for explaining the intricacies of confidentiality fell to underfunded treatment providers...and have you ever tried to tell a judge what he or she needs to do????

The system is full of holes, and the only way we'll avoid future such tragedies is to roll up our shirt-sleeves and deal with the real complexities. Balancing privacy and security isn't about compromising either, but about making honest efforts to get systems that should work together more effectively to do so.

Posted by: las100 | June 17, 2007 5:46 PM

I don't understand why people are blaming Mr. Fischer for quoting officials who refer to unnamed, uncited privacy laws. Seems to me he is simply reporting what officials are saying.
I don't know if privacy laws (HIPPA, FERPA or whatever) continue after the death of the individual. It does seem to me, however, that if the investigators truly want to find out what kinds of treatment were offered to Mr. Cho and/or what kinds of treatment he underwent, it would be a simple enough matter to get a subpoena and, when the subpoenaed parties cite privacy laws and refuse to provide information, go to court and ask a judge to rule on the matter.

But let's not get into a pendulum overreaction. The privacy laws and the laws which prohibit involuntary commitment of an individual except in very specific circumstances were put in place because of recorded, repeated violations of individuals' rights.

And let's not forget that if the State of Virginia had a system where court-ordered psychiatric treatment, outpatient as well as inpatient, ordered because a judge deemed an individual to be sufficiently unstable to require treatment even if he didn't want it, is made a matter of record at least as far as determining whether the individual has a right to buy a gun. If Mr. Cho had been in the database, he would at least not have been able to obtain the guns legally. Certainly the guns wouldn't have killed all those people if Mr. Cho hadn't pulled the trigger (after all, "guns don't kill people, people kill people"). But one might wonder how many people he would have been able to kill with a knife or baseball bat before being stopped.

Posted by: klipvm | June 17, 2007 10:01 PM

I had hoped for real reform, but all that is happening is a lot of CYA. This is disgusting, and this type of thing will happen again because the state is more interested in covering things up than fixing the problems in the system.

Posted by: Gentry | June 17, 2007 11:55 PM

How about those wolves in blazers, Marc?

No apologies for your cheap and ill informed attack?

Your silence now speaks directly to your character.

Posted by: john perona | June 18, 2007 12:10 AM

Did the commission ever get to hear the audio tape of Cho's IVC hearing? But from everything I've read, I simply don't think anyone had any idea that he was that dangerous. I'm glad he didn't know how to make fertilizer bombs.

Posted by: rjma | June 18, 2007 7:56 AM

Fisher, thank you for keeping this serious issue in the forefront. Folks too easily forget events like Columbine and VT. Its part defense-mechanism, part selective amnesia, and part growing unsensitivity to violence and carnage. The fact is the process of how Americans obtain firearms needs to have a spotlight on it - not just in Virginia -where gun laws are particularly irresponsible. I shoot for sport and have witnessed ignorance, arrogance, and stupidity with regard to gun safety for years. Americans who know better should be silent no longer. The NRA pretends to be on the side of American shooters, but they are really just shills for the manufaturers of cheap guns. The process for obtaining a gun should be AT LEAST as strict as obtaining a drivers license. There are too many guns in the hands of folks who are either mentally unstable, violent in temperment, or have no idea of how to handle a weapon responsibly. In some cases, I've witnessed all three of these issues at shooting ranges and the idea scares the hell out of me. Yet - because of the corporate gun lobby and weak state lgun laws, this situation will get worse before it gets better.

Posted by: Bud Grant | June 18, 2007 8:06 AM

People are attacking Fischer for contributing to what they consider to be an uninformed assault on privacy laws. But it seems to me that the problem actually has to do with officials establishing institutional policies that go far in excess of what the privacy laws actually require. Why? Because their lawyers advise them to do so, to make doubly sure that they don't expose themselves to potential legal liability. It's CYA, not privacy, that's gone amok, all driven by fear of being sued.

Posted by: Claudius | June 18, 2007 12:31 PM

I believe even in death medical records are medical records and do not need to be aired to the general public. We need to stop pointing the finger at who is to blame and educate the public on the services that are available to them. We need to educate people to fight the stigma that came along with this great tragedy. I live not far from TECH and it hit very close to home. I am also a mental health consumer and I would want my rights to be protected just like anyone else.

Posted by: Lori Beth | June 18, 2007 2:29 PM

The comments to this entry are closed.

 
 

© 2010 The Washington Post Company