Research security standards before storing medical data with a business

I had an MRI recently and asked for a copy of the test. Instead of giving me a CD copy, they offered to put it online with a company that would allow me to access my images and share them with my doctors as needed. It seems like a good idea, but how do I know if it is really secure or private? Should I trust this new technology or stick with a copy on a CD?

From a technological standpoint, radiology is leagues ahead of other medical specialties. It long ago established industry-wide technical standards for storing and transmitting medical images as well as protocols for sharing them that maintain patient privacy.

Federal and state efforts are now underway to develop statewide health information exchanges to securely share patient medical data. In the interim, new companies are cropping up to fill the gap. Experts say the biggest concern is whether the individual company you choose to hold onto your records is one you can trust.

"Lots of people have a product," says Stephen M. Stewart, chief information officer with Henry County Health Center in Mt. Pleasant, Iowa. "The question is who are they and what are their security standards?"

To find out whether the company is legitimate, talk with the radiologist or facility that recommended it to you. Among the most important things to determine is whether your healthcare provider has an established "business associate agreement" with the vendor. This is a contract required by the federal Health Insurance Portability and Accountability Act. HIPAA outlines when healthcare providers can share protected health information with other people or companies. The details of how that information will be safeguarded are established in a business associate agreement.

If a vendor has this contract, Stewart says, it indicates that the company that will be storing your medical information is HIPAA-compliant and that your privacy is being protected.

You should also make sure that your data will be stored in the United States (rather than offshore) and that all information will be encrypted before being sent across the network.

As with other websites, take pause if you can't find the names of any staff members or if the company doesn't list an address or telephone number.

And, of course, read the small print. "What happens if the company goes bankrupt or what happens if they get acquired? Who owns the data, where does it go?" says Dr. David Channin, chair of medical imaging for the Guthrie Healthcare System in Sayre, Pa. "All those details are part of that trust."

I'm a 43-year-old HIV-positive man who is otherwise perfectly healthy. I had group health insurance through my employer until last month, when I was suddenly and unexpectedly laid off. I can maintain the same level of benefits through COBRA, but it's more than $600 a month and money is very tight right now.

If I decline COBRA and show a break in my health insurance coverage, does that put me at risk of being declined in the future, even from an employer-sponsored group health plan?

A break in health insurance coverage is never a good idea if you can avoid it, particularly if you have a chronic illness — such as HIV — for which you need regular treatment and that would disqualify you from finding coverage in the private insurance market.

COBRA (the Consolidated Omnibus Budget Reconciliation Act) grants you the right under federal law to continue your current employer-sponsored insurance coverage for 18 months (or 36 months in California through Cal-COBRA). It's only by exhausting your COBRA benefits that you are guaranteed a policy from private insurers once your benefits run out.

In addition, if you go more than 63 days without continuous health insurance coverage — even if you land another job with insurance — your new employer can impose a waiting period for any pre-existing health conditions. The waiting period varies by state and by the length of time you've gone without coverage, but it can be as long as 12 months, says Cheryl Fish-Parcham, deputy director of health policy at the patient advocacy organization Families USA.

The problem with COBRA, as you've learned, is that it comes with a steep price tag just when you're least able to take on a big bill. You're responsible for the full cost of your employer-sponsored plan (your part and your employer's), plus a 2% administrative fee.

But here's a bright spot: All states receive federal funds to help people with HIV/AIDS get access to healthcare services and medications when no other coverage is available. The programs vary by state.

California has an Office of AIDS Health Insurance Premium PaymentProgram that helps pay COBRA premiums. Beginning Friday, eligibility will be expanded to cover the full cost of COBRA up to $1,339 a month ($1,938 if you're enrolled in the AIDS Drug Assistance Program, or ADAP). And the requirement that you have a disability will be lifted; you need only be HIV-positive to qualify.

For you to take advantage of this program, your COBRA coverage must be active, says John Riley, benefits specialist with AIDS Project Los Angeles. Though it can be pricey, Riley suggests that people reach out to family and friends "to help tide them over for the initial enrollment and carry them for a couple of months."

Once you are approved, the state will retroactively pay your insurance premium directly to your COBRA plan administrator. At that point, contact the administrator to request reimbursement for the months you already paid out. You'll have access to coverage for up to 36 months.

In California, there are 48 enrollment sites where you can sign up for this program, according to Dr. Gilberto Chavez, deputy director of the California Department of Public Health. "Enrollment workers assist potential clients with the application process and obtain all required documentation," Chavez says. The application will then be submitted to the state health department on your behalf.

To find a site near you, call the California Department of Public Health, Office of AIDS at (916) 449-5900. You can go to to download an application and program guidelines on your own.

Outside of California, check with your state's department of public health for resources available where you live. For AIDS hotlines in your area, go to, click on HIV/AIDS, "Get Help" and then State HIV/AIDS Hotlines.

Zamosky has been writing about how to access and pay for healthcare for more than 10 years.

Got a healthcare dilemma? Email or write to Health 411, Los Angeles Times Health, 202 W. 1st St., Los Angeles, CA 90012.

Copyright © 2019, Los Angeles Times
EDITION: California | U.S. & World