OCMA Blog

 
“We always knew this flawed measure was bad for the pocketbooks of everyday Californians, but the more they read the fine print, the more they realize it’s equally bad for their personal privacy,” said Jim DeBoo, campaign manager for the broad-based coalition of Californians formed to oppose the initiative.  “If this measure passes, it will mandate a database that isn’t properly working and open the privacy floodgates to the sensitive personal medical data of millions of Californians with no increased security safeguards or funding.  It’s a hacker’s dream – and a privacy nightmare.”

The so-called MICRA (“Medical Injury Compensation Reform Act”) initiative requires health care practitioners and pharmacists to consult a government-run prescription drug database (known as CURES) prior to prescribing or dispensing Schedule II or III controlled substances to patients.

The mandate relies on the uploading of personal prescription drug records of millions of California patients onto the database – accessible by hundreds of thousands of users.  But the initiative fails to add new funding for its expedited expansion or require any additional security standards or safeguards to prevent hacking, theft or improper access by non-medical personnel.

What’s more, experts say the CURES mandate will not work as required by the measure, will not be operational by the law’s effective date and will put doctors in the impossible position of choosing between violating their oath as health providers or violating the law.

“The CURES mandate on physicians cannot be implemented as written.  CURES needs to be updated and modernized and nothing in the initiative does that.” said Tim Gage, former California Finance Director and Principal at Blue Sky Consulting.  “Therefore, the initiative will put health providers in the untenable position of either violating the new law or withholding necessary treatment from patients unless the law is suspended.”

“The consequences of mandating the use of a government-run website that experts say won’t work when required before physicians are allowed to prescribe needed medication is nothing less than a recipe for disaster,” said Dr. Richard Thorp, M.D., President of the California Medical Association.    
 
The CURES database mandate problem comes at a time of widespread reports of illegal hacking, much of it involving digital medical records. Studies show that public fears about personal privacy are at an all-time high.  Last month, it was reported the FBI had taken the extraordinary step of warning that the entire health sector was particularly vulnerable to “attacks by hackers searching for Americans’ personal medical records” (Reuters, April 23, 2014). 
 
Since 2009, the U.S. Department of Health and Human Services has reported 991 separate incidences of medical data breaches involving 500 people or more, affecting a total of 30 million patients.  While many states are moving to increase protections for online prescription drug data, this measure would have the opposite effect in California.

“The public and lawmakers are really starting to understand what kinds of threats to privacy come when you start centralizing great quantities of sensitive personal information in giant electronic databases,” said Nathan Wessler, an attorney with the American Civil Liberties Union, last week to the Wall Street Journal (May 7, 2014).

As proposed, the CURES database maintains an accessible online record of every dispensed prescription of a Schedule II or III controlled substance, including highly sensitive and potentially stigmatizing details about a person’s health.  This prescription information could include medicines used to treat anxiety, insomnia, obesity, narcolepsy, drug detoxification, pain, epilepsy, conditions related to cancer and AIDS, asthma, chronic infection, and other sensitive medical conditions.

The MICRA lawsuit measure which qualified today is formally opposed by (partial list):