WPF files a FOIA to obtain the DOJ’s annual report of their uses of protected health information

Via fax and E-FOIA Portal

FOIA/PA Mail Referral Unit Department of Justice
Room 115, LOC Washington, DC 20530-0001

September 26, 2012
This is a request by the World Privacy Forum under the Freedom of Information Act.

Section 3 of Executive Order 13181, To Protect the Privacy of Protected Health Information in Oversight Investigations, states:

(d) On an annual basis, the Department of Justice, in consultation with the Department of Health and Human Services, shall provide to the President of the United States a report that includes the following information:
(i) the number of requests made to the Deputy Attorney General for authorization to use protected health information discovered during health oversight activities in a non-health oversight, unrelated investigation;

(ii) the number of requests that were granted as applied for, granted as modified, or denied;
(iii) the agencies that made the applications, and the number of requests made by each agency; and

(iv) the uses for which the protected health information was authorized.

This request is for a copy of every annual report made by the Department of Justice under this provision of Executive Order 13181. We prefer to have the copies in a widely available electronic format, such as a PDF file or a Word document. Having an electronic format will facilitate the posting of the reports on the World Privacy Forum’s website at www.worldprivacyforum.org. We note this is our second request for this report. Our first request was made November 29, 2007. The DOJ responded to our 2007 FOIA by saying the annual report could not be located.

The World Privacy Forum is a non-partisan, non-profit public interest research and consumer education organization. Our focus is on conducting in-depth research and analysis of privacy issues, including issues related to health care.

As a non-profit public interest organization that qualifies as a representative of the news media because of its demonstrated ability to disseminate information to the public, fees for this request should be limited to copying charges. You may visit our World Privacy Forum in the Press Page to find a partial list of articles in which the World Privacy Forum or its researchers are quoted. We also actively disseminate information to the public and the press. A leading example is our report Medical Identity Theft: The Information Crime that Can Kill You, which received extensive attention from the public, press, and policy makers.

We request a waiver of all fees because:

1) Disclosure of the requested information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government.

The reports in question should illustrate the extent to which the federal government uses individual health records discovered during the course of health oversight activities for unrelated civil, administrative, or criminal investigations of a non-health oversight matter. This was an important enough matter to warrant the issuance of an Executive Order shortly after the HIPAA health privacy rules were finalized by the Clinton Administration. The subject of the requested reports will directly illuminate government activities for which information is otherwise unavailable. As far as we can tell, the reports have not been made available to the public. From a previous FOIA, we suspect the reports may not even exist.

The disclosure is in the public interest because it will show how the government implements its authority to obtain health records for health oversight purposes and then uses the records for other purposes. This is a significant health privacy issue today, and its importance will expand as health records continue to migrate to digital platforms and as law enforcement agencies interface with those data. We note that much attention has been given to Fusion Centers, and that Fusion Centers are collecting and using health care data in some capacity. The DOJ published a document regarding the collection of medical data for Fusion Centers, Health Security: Public Health and Medical Integration into Fusion Centers, July 2011. (Available at http://www.it.ojp.gov/docdownloader.aspx?ddid=1450)

Shedding light on these activities will contribute to understanding of government activities and contribute to increased public understanding of those activities. Public debates on the structure and operations of a health information network are ongoing, and law enforcement use of health records is a significant part of that debate. We do not know whether secondary use of health records for non-health oversight, unrelated investigations is a major or minor activity by law enforcement and other agencies, and the mandated annual reports may be the only source of clear, factual information.

Given the World Privacy Forum’s past record of putting privacy information before the public and the press, there can be no doubt about its expertise in the subject area and its ability to effectively convey information to the public. We refer you to our website’s materials on medical identity theft and other issues at our Medical Identity Theft Resource Page as well as our materials on medical privacy in general at our Medical Privacy Resource Page.

The subject of use of medical records affects every patient in the United States and is of broad public interest.

2) Disclosure of the information is not primarily in the commercial interest of the requester.

The World Privacy Forum is a non-partisan, non-profit public interest research and consumer education organization that has no commercial interests.
Rather than delay processing of this request or disclosure of the requested materials, the World Privacy Forum agrees to pay fees up to $25.00. If the Department intends to charge fees that exceed $25.00, please contact us beforehand so that we can reconsider or adjust the request. If our fee wavier request cannot be granted promptly or is denied, we are likely to be willing to pay fees promptly to obtain the documents and affirmatively defend our status for the assessment/waiver of fees on appeal.

Thank you for your consideration of this request.

Pam Dixon
Executive Director
World Privacy Forum

3108 Fifth Avenue Suite B
San Diego, CA 92103

Posted September 26, 2012 in Freedom of Information Act (FOIA), Government privacy, US Department of Justice

New Report: Risky Analysis: Assessing and Improving AI Governance Tools

We are pleased to announce the publication of a new WPF report, “Risky Analysis: Assessing and Improving AI Governance Tools.” This report sets out a definition of AI governance tools, documents why and how these tools are critically important for trustworthy AI, and where these tools are around the world. The report also documents problems in some AI governance tools themselves, and suggests pathways to improve AI governance tools and create an evaluative environment to measure their effectiveness. AI systems should not be deployed without simultaneously evaluating the potential adverse impacts of such systems and mitigating their risks, and most of the world agrees about the need to take precautions against the threats posed. The specific tools and techniques that exist to evaluate and measure AI systems for their inclusiveness, fairness, explainability, privacy, safety and other trustworthiness issues — called in the report collectively AI governance tools – can improve such issues. While some AI governance tools provide reassurance to the public and to regulators, the tools too often lack meaningful oversight and quality assessments. Incomplete or ineffective AI governance tools can create a false sense of confidence, cause unintended problems, and generally undermine the promise of AI systems. The report contains rich background details, use cases, potential solutions to the problems discussed in the report, and a global index of AI Governance Tools.
National IDs Around the World — Interactive map

About this Data Visualization: This interactive map displays the presence...
Report: From the Filing Cabinet to the Cloud: Updating the Privacy Act of 1974

This comprehensive report and proposed bill text is focused on the Privacy Act of 1974, an important and early Federal privacy law that applies to the government sector and some contractors. The Privacy Act was written for the 1970s information era -- an era that was characterized by the use of mainframe computers and filing cabinets. Today's digital information era looks much different than the '70s: smart phones are smarter than the old mainframes, and documents are now routinely digitized and stored and perhaps even analyzed in the cloud, among many other changes. The report focuses on why the Privacy Act needs an update that will bring it into this century, and how that could look and work. This work was written by Robert Gellman, and informed by a two-year multi-stakeholder process.