August 26, 2009 8:26 PM
Posted by Declan McCullagh
Source CBSnew.com 

"One of the problems with any proposed law that's over 1,000 pages long and constantly changing is that much deviltry can lie in the details. Take the Democrats' proposal to rewrite health care policy, better known as H.R. 3200 or by opponents as "Obamacare." (Here's our CBS News television coverage.)

Section 431(a) of the bill says that the IRS must divulge taxpayer identity information, including the filing status, the modified adjusted gross income, the number of dependents, and "other information as is prescribed by" regulation. That information will be provided to the new Health Choices Commissioner and state health programs and used to determine who qualifies for "affordability credits."

Section 245(b)(2)(A) says the IRS must divulge tax return details -- there's no specified limit on what's available or unavailable -- to the Health Choices Commissioner. The purpose, again, is to verify "affordability credits."

Section 1801(a) says that the Social Security Administration can obtain tax return data on anyone who may be eligible for a "low-income prescription drug subsidy" but has not applied for it.

Over at the Institute for Policy Innovation (a free-market think tank and presumably no fan of Obamacare), Tom Giovanetti argues that: "How many thousands of federal employees will have access to your records? The privacy of your health records will be only as good as the most nosy, most dishonest and most malcontented federal employee.... So say good-bye to privacy from the federal government. It was fun while it lasted for 233 years."

I'm not as certain as Giovanetti that this represents privacy's Armageddon. (Though I do wonder where the usual suspects like the Electronic Privacy Information Center are. Presumably inserting limits on information that can be disclosed -- and adding strict penalties on misuse of the information kept on file about hundreds of millions of Americans -- is at least as important as fretting about Facebook's privacy policy in Canada.)

A better candidate for a future privacy crisis is the so-called stimulus bill enacted with limited debate early this year. It mandated the "utilization of an electronic health record for each person in the United States by 2014," but included only limited privacy protections.

It's true that if the legislative branch chooses to create "affordability credits," it probably makes sense to ensure they're not abused. The goal of curbing fraud runs up against the goal of preserving individual privacy.

If we're going to have such significant additional government intrusion into our health care system, we will have to draw the privacy line somewhere. Maybe the House Democrats' current bill gets it right. Maybe it doesn't. But this vignette should be reason to be skeptical of claims that a massive and complex bill must be enacted as rapidly as its backers would have you believe.

Update August 27 11 a.m: Marc Rotenberg of the Electronic Privacy Information Center says in e-mail: "We would oppose section 431(a) of the bill because it violates the intent of the Privacy Act which generally requires agencies to obtain information directly from individuals and not from other agencies." EPIC still hasn't updated their Web site to reflect this sentiment, but it's good to know that other folks have concerns too."