The principle of guaranteeing the confidentiality of a patient’s medical condition is common to physicians the world over. In France, and closely inspired by the original Hippocratic Oath, the historical guiding text for the honest practice of medicine, the medical profession is bound by a modern oath of professional conduct set out by its regulating body, the Ordre des médecins, which includes the stipulation that “Admitted into the intimacy of people, I will keep silent those secrets that are confided to me.”
This duty to refrain from disclosing a patient’s medical details beyond those directly involved in their care is also inscribed into French law.
However, it has now emerged that a large number of French hospitals are violating this rule by providing patients’ medical records to private companies hired to assist them in administrative management services.
The practice became known after Jean-Jacques Tanquerel a doctor from the principle public hospital in the town of Saint-Malo in Brittany, north-west France, revealed how the confidential medical records of 950 of the hospital’s patients had been consulted by a private healthcare management consultancy company.
The company, Altao, is one of several engaged by numerous hospitals and private clinics across France to help their own administrations with the verification, and eventual correction, of the coding of medical acts that are refundable by the French social security system.
Tanquerel was in charge of the Saint-Malo hospital’s ‘medical information department’, the département de l’information médicale, or DIM, a service common to all public hospitals and which are headed by a qualified doctor. The DIM is responsible for the referencing of medical acts according to a very specific classification of no less than 650 description codes set out by the social security administration. These provide the basis upon which it refunds a hospital for care provided.
Ensuring the correct coding of refundable treatment given to patients is vital for hospital finances which, because of the complexity of the system, are exposed to significant losses in the case of medical acts that are under-reimbursed by the social security services. Mistakes in coding are relatively frequent, adding significant pressure to already-stretched hospital budgets.
It is for that reason that an increasing number of hospitals engage the back-up services of Altao and similar consultancy companies. The private consultancy companies offer sophisticated software and expert skills, including those of former healthcare professionals. They are paid between 5% and 6% of the sums they recoup by identifying cases of miss-coding, and have every interest in gaining access to a maximum amount of information about patients’ cases.
Private auditing of the coding of medical acts is perfectly legal in as far as the data consulted is of an anonymous nature that concerns the description of the medical acts performed per patient, but without giving the patient’s identity. The private consultants operate under the authorisation of the French national commission responsible for upholding personal data protection rights, the CNIL.
Enlargement : Illustration 1
But Jean-Jacques Tanquerel discovered that, in the case of his own hospital in Saint-Malo, the auditors were in fact given access to named patients’ medical files. These involved the reports written by doctors and nurses of 950 patients cared for by the hospital between 2010 and 2012.
Upon his appointment last year, the newly-arrived general manager of Saint-Malo hospital, Jean Schmid, announced he was planning to engage the services of Altao to help with the auditing of the coding system after he had hired the company for similar services at a hospital he had previously been in charge of.
For Tanquerel, who had headed the DIM in the Saint-Malo hospital from 2004 and who also taught at the EHESP School of Public Health (L'École des hautes études en santé publique), a higher education institute that trains healthcare managers in France and from abroad, nothing justified the violation of medical secrecy.
“The DIM’s head doctor is the guarantor of medical confidentiality,” he explained. “He is the only doctor in the hospital who has access to all the medical files. If I had allowed this company to consult them, I would have been guilty of a crime.” Tanquerel decided to expose the scandal.
Alerted to the problem, the body that regulates the French medical profession, the Conseil National de l’Ordre des médecins (equivalent to the General Medical Council in Britain), took the matter up with the CNIL in April this year. After a lengthy procedure, the data protection rights commission issued a formal reprimand to the Saint-Malo hospital on October 7th for its “disrespect of data confidentiality”. The health ministry said it was “very seriously” following the affair.
Altao, a consultancy company specialized in the analysis and treatment of information in healthcare administration, provides its services to about 50 hospitals around France, as well as also to the pharmaceutical industry and medical associations. Among its activities is the verification and correction of hospital’s coding of medical acts. “Our statisticians consult hospitals’ anonymised [sic] data bases in order to identify potentially atypical patient stays,” explained Yannick Berton, the company’s managing director.
These are notably cases where a patient has remained in hospital over a long period for care that is eligible for only low-level refunding. But it was in order to better define cases, and therefore valorize the refundable care provided, that Altao also gained access to confidential written reports by doctors and nurses detailing the conditions and care of identified patients.
While Berton insisted this was a “necessary” procedure, it clearly runs contrary to the deontology of the medical profession and the regulations of public healthcare as underlined by a statement issued by the Ordre des médecins earlier this month on its website. The regulating body, referring to its advice given earlier this year to the CNIL, said “personal information regarding patients’ health are covered by professional confidentiality and cannot be transmitted to a third party [which is] unauthorized by existing legislation as of the moment that they might allow for the identification of a patient.”
"The doctors [in charge] of the medical information departments [DIMs] of healthcare establishments are the guarantors of the respect of these rules,” the statement added.
The controversy indirectly highlights the current financial crisis in which many French hospitals find themselves. The hospital in Saint-Malo has been operating at a loss for several years. “The contract for a return to financial equilibrium endured by this hospital has been very painful,” said Schmid. “When the personnel discovers that these difficulties are to do not with over-staffing but with undervalued coding, it’s difficult.”
Following the CNIL’s reprimand issued on October 7th, the hospital in Saint-Malo reacted immediately, pledging that Altao would no longer have direct access to patients’ individual medical records. Information from these could only be sought via the doctor in charge of the DIM, as stipulated by law, and the hospital promised to implement increased security to guarantee their confidentiality. On October 17th, the CNIL announced the matter was closed.
Schmid described the CNIL’s move as a “severe” reaction. According to him, between 70% and 80% of French public and private hospitals provide patients’ confidential medical records to private consultancy companies. Indeed, in its initial statement issued on October 7th, the CNIL announced it was checking the conduct of other hospitals and had alerted French health minister Marisol Touraine to the potential danger of widespread abuse of the confidentiality of medical records.
A deepening malaise
Tanquerel, who since the row erupted last year has since been posted as head of the hospital’s hygiene department, is a member and local official of a union representing anaesthetists and intensive care doctors, the SNPHARE. Both the union and the Ordre des médecins report they have received numerous complaints from other doctors in charge of hospital DIMs that private administration consultancy companies have been given access to confidential medical files.
One of them is Georges Elkoury, who was until this summer the doctor in charge of the DIM of the clinic Medipôle Saint-Roch, close to Perpignan in southern France. His employment ended after a dispute with the clinic’s management over its use of private healthcare management consultancy firm, Corsacod, specialised in data collection. “The management asked me to give this company dozens of medical files along with access to our computer archives, which means the detailed medical archives of our patients,” he said.
“The contract stipulated that Corsacod acted under the responsibility of the DIM’s head doctor. I wrote to the management that I could no longer ensure the responsibility of medical confidentiality. I and my children had been hospitalized in the clinic. I am going to lodge a complaint as a patient.”
The malaise over the use of private contractors is shared by Ghyslaine Amghar, who was the doctor in charge of the DIM for the main hospital in the town of Melun, west of Paris. Without informing her, she says, the hospital management also engaged the services of the Corsacod to manage the establishment’s coding references. “When I found out, I engaged in [a total of] three legal actions [against the move] through the administrative tribunal,” she recounted. “I won the first two and the contract was invalidated. They re-signed another contract with Corsacod and I lost my job.” She says the auditing of medical acts in the hospital has now been entirely privatised while the staff of the DIM has been scaled down.
Jérôme Fauconnier, a doctor in charge of the DIM with a major teaching hospital in Grenoble, eastern France, successfully blocked a management move to engage the services of another private consultany company Sahona, after he declined to assume responsibility for its activities. Fauconnier refuses to blame hospital managements for the widespread recourse to private sector involvement, but rather targets a “system which is perverse”. He argues that the required system of coding refundable medical acts is becoming ever-more complicated, with complex subtleties between classifications that can make small mistakes carry heavy financial consequences.
In more concrete terms, if a patient developed, and was treated for, bedsores during their hospitalization but this was not recorded by doctors in the administrative file used for coding, the hospital could lose up to 6,000 euros in potential refunds. Undeclared care provided for a fungal infection can represent a loss to the hospital of 1,500 euros. “The measurement has become too sensitive,” said Fauconnier. “In any establishment you’ll find mistakes made if you look for them.”
In the case of the controversy at Saint-Malo, Altao’s analysis of the 950 personal medical records at the heart identified miss-coding of medical acts that, it claims, represented a total shortfall to the hospital, between 2010 and 2012, of 2 million euros. Altao’s general manager Yannick Berton claimed that, at a national level, his company and others providing the same services produced annual overall gains for public and private healthcare establishments of around 200 million euros. “Most of the establishments with which we work are in deficit,” he said. “We allow them to recover a financial margin of manoeuvre for reinvestment.”
Jean-Jacques Tanquerel said that when he was head of the DIM at Saint-Malo he accepted “stretching the rules” to help set the hospital’s finances back on an even keel. “In 2009, I developed my own software for searching data to identify the undervalued coding of cases,” he said, claiming he could have “done just as well as Altao”. Tanquerel argued that, instead of turning to outside contractors, the problem of miss-coding could be addressed by giving doctors in charge of DIMs, whose position he complains is not recognised as a specialized one, more resources. “Many are insufficiently trained,” he said.
The French Hospital Federation (Fédération hospitalière de France), which represents almost all public hospital managements in France, has described the recourse to private healthcare administration consultants as “an exercise in good management”. But the example of Saint-Malo and other establishments illustrates a growing unease among the medical profession at the abuses such practices encourage, not to mention the difficulties reserved for whistleblowers.
Tanquerel recounted what he described as the “testing” experience of appearing at the Saint-Malo hospital’s medical commission, which regroups the establishment’s staff of doctors, when it met on October 15th. “The hall was full, 80 people were present,” he said. “The management were there too. I was the subject of attacks during two and a half hours. I was above all accused of being responsible for whipping up the media, which damages the reputation of the establishment and runs the danger of diminishing its activities. They don’t realise that it’s the consequence of the management’s lack of interest in the problem of the confidentiality of medical information.”
Meanwhile, Pierre Bertrand, assistant director general of the Brittany regional health agency, which covers Saint-Malo, described Tanquerel as “an excellent professional.”
“I am going to set matters out with him to find a more favourable solution in another establishment,” he added.
-------------------------
English version by Graham Tearse