AUGUSTA, Maine — An official with the Department of Health and Human Services has reacted to privacy concerns raised by the Medical Marijuana Caregivers of Maine by accusing the group of “disseminating misinformation and unnecessarily creating fear.”
Dr. Dustin Sulak, one of the leading proponents of medical marijuana in Maine, said he wants proof his concerns are unfounded.
The state announced earlier this week that as of Jan. 1, 2015, medical professionals who certify patients for the Maine Medical Use of Marijuana Program must complete the process using a new online registration tool run by a vendor called InforMe, a public-private partnership that already designs, builds and maintains the state’s website.
Kenneth Albert, director of the Maine Division of Licensing and Regulatory Services, said the new system is being implemented through a third-party vendor in part to satisfy a new law that requires the collection of patients’ ZIP codes and whether they are at least 18 years old. The new system is also intended to make it more difficult to fraudulently duplicate patient certification cards.
However, the online process requires doctors to enter the patient’s name, address, birth date and other personal information, which is why caregivers and doctors are concerned about safety.
“At this point, I’m awaiting proof that the new system protects patient information and complies with federal health information privacy standards,” Sulak said in a written statement. “I’ve participated in a demonstration of the new system, which clearly captures sensitive information and transmits it through the Internet. It is my legal and ethical responsibility to ensure my patients’ information is safe before I use the new system.”
But Albert says the only reason personal information is entered into the system is to print out the medical marijuana card. After that, he said, the only information stored or transmitted by the system is the issuing physician’s name and address, the transaction date, the patient’s ZIP code and whether the patient was older than 18. The rest is automatically deleted by the system.
“There is no database associated with the new certification process as has been wrongly asserted by detractors. … Those speaking on behalf of Medical Marijuana Caregivers of Maine know precisely how the new process works and have met and asked questions of the system architects,” Albert said. “It has been made very clear to them that there is no database and that the Division of Licensing and Regulatory Services has no interest in capturing patient information. It is alarming that this organization, at this juncture, has chosen a campaign of disseminating misinformation and unnecessarily creating fear for medical marijuana recipients.”
Maine’s medical marijuana program, implemented by a citizen-initiated referendum in 2009, has run into controversy over privacy before. In 2010, the Legislature enacted a law requiring patients to register with the state, but that provision was overturned a year later with a bill sponsored by Rep. Deb Sanderson, R-Chelsea, and signed by Gov. Paul LePage.
Hillary Lister, director of the Medical Marijuana Caregivers of Maine, said even if there is no database of patient information kept by the state, she’s worried the information still could be compromised.
“With recent data breaches ranging from international companies such as Sony to our own government agencies, the privacy of medical marijuana patients will be put at risk by requiring entry using a new Internet-based portal,” Lister said in a written statement. “The collection of private patient information could also allow federal authorities to have access to patients’ information, through court order, similar to what occurred in Oregon in 2012.”
Lister said her organization wants a public rulemaking process in which the medical marijuana community can voice its concerns. Lister said Friday she and others have been engaged with DHHS for months about the implementation of the new system. Some of those discussions were around how the system could generate a digital medical marijuana card on a PDF, on which patients’ personal information could be entered by the doctor outside the online system.
“Medical Marijuana Caregivers of Maine has made every effort to communicate these concerns to the department and suggest alternatives that could still allow implementing a more secure certification process,” Lister wrote Friday in an email to the BDN.
DHHS said one benefit of the program is that it will reduce the licensing burden on the state, which currently produces medical marijuana cards on a one-by-one basis based on information provided by doctors. Department officials argue the new computerized system will be even safer than the current system because detailed patient information won’t be sent to the state at any point in the process.
