The Vermont General Assembly passed a law in 2005 called the "Vermont Prescription Monitoring System" (VPMS). Sound ominous? Well it is worse than it sounds. The Department of Health is in the process of seeking legislative approval of administrative rules the Department drafted to govern VPMS. The proposed rules will monitor your physician's provision, and your access to, hundreds of treatments for thousands of conditions. The purpose of the law is intended to identify substance abusers and to facilitate their treatment -- nothing inherently wrong with that and in fact it is a laudable goal. However, the proposed regulations by the Department of Health do not accomplish the goal set out by the legislature, violate the laws governing the VPMS and present too many dangers for disclosure, misuse, mishandling of sensitive patient medical information. "Administrative Rules" Administrative rules, or regulations, are the Vermont regulatory laws that implement state agency programs. These regulations flesh out the details of the tatutes that fall under the jurisdiction of various bureaucracies. The Department of Health's proposed regulations violate the laws they are intended to facilitate. Here a few reasons why these regulations must be stopped before they go into effect.
The law creating VPMS, Title 18 Chapter 84a requires the Department of Health to do ONE THING. The legislation states that the Department of Health must: adopt rules for the implementation of VPMS . . . 45 C.F.R. Part 164 [federal privacy and data protection guidelines] that limit the disclosure to the minimum information necessary for purposes of this act. In other words, the legislature passed a law requiring, and authorizing, the Department of Health to regulate, with the strictest protocols possible, any potential disclosure of medical information it collects as part of VPMS. The legislature did not give the Department of Health authority to do much else. It was the legislation's intent that the Department of Health develop a system to protect the confidential information it collects in VPMS. It must then use that information consistent with the overall purpose of the legislation, which is to facilitate public health and treatment of those who need it. That did not happen. Instead, there are a significant number of legal, policy, practical problems and mistakes in the Department's proposed VPMS regulations. I will highlight just three. * * * #1 The legislature required the Department to write ONE policy and procedural objective into the regulations, and the Department ignored this statutory mandate. The law requires procedures to identify and then disclose if necessary the minimum necessary information to achieve VPMS's goal. Facing just this one requirement, the Department of Health has given birth to VPMS Regulations devoid of a single strand of "Disclosure Limiting" DNA. The Department has effectively ignored its primary responsibility to Vermont patients and physicians. On the flip side of this same problem, the VPMS law prohibits the Department from disclosing your medical information in specific instances for your protection and for your medical provider's protection. The Department's proposed rules ignore this critical aspect of the law as well. For this reason alone, the proposed rules must be withdrawn, rewritten or outright rejected by the Legislative Committee on Administrative Rules. * * * #2 The Department of Health is also attempting, in proposed Rule 1.7, to divest Vermont Courts of jurisdiction over one critical aspect Vermont patients and physicians may encounter with VPMS. Without any legislative authorization, the Department is claiming for the Commissioner of Health “sole discretion” over any decisions related to erroneous, or other corrupt or suspect data. Consider this, like the federal no-fly list, if your records have a mistake (purely hypothetical, right?) you cannot ask a court to require VPMS to account accurately or report to your health care providers reliable information about your prescription history. Vermonters have a right, under our Constitution, to remedies at law and it is doubtful that the legislature could have given the Commissioner this type of authority even if it wanted to. Here the Department of Health is merely claiming legal authority for its Commissioner, which the law in no way envisions. For this reason alone, the proposed rules must be withdrawn, rewritten or outright rejected by the Legislative Committee on Administrative Rules. * * *#3 The Department's proposed rules violate one of the key compromises worked out in the legislature among the various parties involved in developing the final statutory language passed and signed by the Governor. The legislature, medical providers, patient advocates and others were rightly concerned that this program might turn into a state tool to spy on people or that highly sensitive personal medical information may circulate through policing agencies inappropriately. To curb possible abuses, the legislature MANDATED (18 V.S.A. §4284(6)) that only the commissioner of health "personally" - in limited and defined circumstances - may disclose your medical information to Vermont police. The law specifies that the commissioner of public safety may receive, directly and personally, limited information from the health commissioner, personally, in rare emergency circumstances. The point of this disclosure limitation and requirement was due to the fact that this is a public health statute, not a police monitoring statute. Disclosure to policing agencies, if made at all, is only permitted under the VPMS law in a rare emergency case of an "imminent" threat to public safety as personally determined and evaluated and communicated by the Commissioner of Health. No Exceptions. To sneak around this legal requirement, the Department of Health’s proposed regulation (Rule 3.4) includes this gem: For “purposes of this [law],” the term Commissioner shall mean: “A deputy Commissioner of Health” and on the law enforcement side, “Commissioner” shall mean “Director of Vermont State Police” or “other management designated by the Commissioner of Public Safety to receive” the information. In other words “anyone.” Hey, why not define your neighbors, your employer and business associates as “Commissioner for the purposes of implementing VPMS” while we are at it? The contempt for the enabling legislation is palpable in this proposed rule 3.4. The Department of Health has taken an important legislative compromise -- one that received significant testimony and deliberation, -- and it has re-written the law to suit its own agenda outside of the governing law. * * *The Department of Health must not be allowed to treat the administrative rulemaking process as an opportunity to re-write state law. The rulemaking process is an obligation to implement state law not an opportunity to change it. The proposed rules ignore the critical restrictions the legislature put on the transfer of health data to Vermont police. For this reason alone, these proposed regulations must be either withdrawn and re-written or outright rejected by the legislative committee on administrative rules. The Department of Health has spent months of work and invested significant State resources on VPMS but: A. the Dep't did not write the regulations the law requires the Dep't to do; and B. the Dep't exceeded is statutory authority by revising VPMS beyond anything permitted in Vermont law; and C. the Dep't, in addition to exceeding its authority, is now poised to impose regulations that violate the express language of the VPMS statute. This is really the scary part. The Department of Health, before it even begins assembling your most personal and confidential medical data into a giant and ill-defined state program, has already telegraphed its intention to ignore the governing law. Tomorrow, Monday the 5th of November, is the final day to comment on the Department of Health's proposed rules. If the Department of Health does not withdraw the proposed rules after the public comment period, then the proposed rules will go to the Legislative Committee on Administrative Rules (LCAR) for its approval. No Vermonter or citizens' group should have to go to court to stop these rules from taking effect. The Department of Health needs to withdraw the rules and rewrite them or LCAR must reject them. The public is invited comment directly on the proposed rules at the Department of Health website: http://healthvermont.gov/admin/comment/RxMonitoring_comment.aspx. The Department of Health is required to respond and to consider any substantive comments, suggestions or proposed changes it receives. I will post VPMS updates in the upcoming days addressing comments to the Department of Health on the proposed rules, and Department of Health's responses to those comments. Private medical information is serious business affecting people's lives and livelihoods in many ways. This makes it a dangerous area for irresponsible government. No matter what the subject, however, there is no excuse for state agencies jeopardizing our rights by acting so blatantly outside of the law. |
250-1
55-1
