One last round on blood & SSNs, with cite to federal law [priv]

[Declan McCullagh <declan () well com>]

-------- Original Message --------
Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
donate [priv]
Date: Wed, 28 Apr 2004 11:01:06 -0500 (EST)
To: Declan McCullagh <declan () well com>
References: <408F2E57.6090407 () well com>

(If you post this, please omit my name/email address.  thanks!)

Several years ago, Congress added a provision to the Internal Revenue Code
disclosure provisions (6103) explicitly allowing disclosures of donors'
address information to blood banks on the chance that a donor would be
HIV+.  These are not "wholesale" disclosures; they can only occur when a
donor has tested + for HIV/AIDS and where the bank/center has no other
information (or has bad information) on locating the donor.  As of 4 years
ago (the last time I checked) no disclosures have ever occurred under that
provision. (The program is called the "Blood Donor Locator Service.") In
any event, that's the main reason that blood centers "require" the SSN.

Here's the language of the section from the IRC:

45 USC 6103(m)(6)

(6) Blood Donor Locator Service

(A) In general

Upon written request pursuant to section 1141 of the Social Security Act,
the Secretary shall disclose the mailing address of taxpayers to officers
and employees of the Blood Donor Locator Service in the Department of
Health and Human Services.

(B) Restriction on disclosure

The Secretary shall disclose return information under subparagraph (A)
only for purposes of, and to the extent necessary in, assisting under the
Blood Donor Locator Service authorized persons (as defined in section
1141(h)(1) of the Social Security Act) in locating blood donors who, as
indicated by donated blood or products derived therefrom or by the history
of the subsequent use of such blood or blood products, have or may have
the virus for acquired immune deficiency syndrome, in order to inform such
donors of the possible need for medical care and treatment.

(C) Safeguards

The Secretary shall destroy all related blood donor records (as defined in
section 1141(h)(2) of the Social Security Act) in the possession of the
Department of the Treasury upon completion of their use in making the
disclosure required under subparagraph (A), so as to make such records
undisclosable.






-------- Original Message --------
Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
donate [priv]
Date: Thu, 29 Apr 2004 00:01:20 -0700
From: Chris Hibbert <hibbert () mydruthers com>
Reply-To: hibbert () mydruthers com
Organization: It's Just Me
To: Declan McCullagh <declan () well com>
References: <408F2E57.6090407 () well com>

Andrew G.Feinberg wrote:

> Here where I go to school in Madison, WI, I had a protracted
> argument with the campus blood donation center (run by the Red
> Cross) over this. When I pointed out that they were not an agency
> allowed by law to demand my SSN, they relented and gave me an unique
> ID, with sincere apologies from a supervisor who was more familiar
> with the law. Perhaps the donor should try another blood bank run by
> the ARC, since they seem to have a clue and some respect for
> privacy.

Well, you may have convinced them, but you were probably wrong about
the legalities.  If you were talking to the Red Cross, rather than a
school official, "not an agency allowed by law to demand my SSN" is the
wrong criterion.  The laws on collecting SSNs mostly apply to
government agencies (federal, state, and local), and not to
non-government actors or all kinds.

As someone pointed out in the same compendium from Declan, there are
actually several laws that permit (or recommend that) blood donation
agencies collect SSNs.  But they'd be allowed anyway, because they
aren't in the set of agencies that are forbidden to ask.  They're
allowed to ask, you're allowed to walk away.

In most cases, AFAICT, they'll give in and let you donate with an
alternate ID.  Most blood centers actually have reasonable policies,
since they want your blood; you just have to talk to the right person
to find out.  This is also as pointed out by a few people in the same
issue.

Read the SSN FAQ on the question:
  http://www.cpsr.org/cpsr/privacy/ssn/SSN-Private.html#bloodBanks

Chris
--
protecting privacy in the computer age is
like trying to change a tire on a moving car.
 --Colin Bennett
hibbert () cpsr org






-------- Original Message --------
Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
donate [priv]
Date: Wed, 28 Apr 2004 08:15:37 -0500
From: Rich Wellner <rich () objenv com>
Organization: The society for better programming of greater Chicago
To: Declan McCullagh <declan () well com>
CC: politech () politechbot com
References: <408F2E57.6090407 () well com>

A bit of flawed logic here, just to make sure people understand what the 
issue
is.

Declan McCullagh <declan () well com> writes:

> The really stupid thing about using the SSN is that it utterly fails to
> serve the Red Cross' purpose, to screen out people with HIV and other
> conditions that make them unsuited to donate.  Why?  Because they make no
> attempt to verify it.  If I had AIDS and wanted to give it to as many 
people
> as possible, I'd donate every seven weeks and make up a different SSN 
each
> time.  I mean, really, duh.  How could they tell?

The SSN isn't meant to stop malicious donors.  As pointed out it would 
fail at
that.  It is meant to stop accidentally dangerous donors from repeating 
their
actions.

> The six digit donor ID is a much better ID because the Red Cross doesn't
> really care who I am, they care that I'm the same person who claimed 
to be
> me last time, and the donor ID card verifies that reasonably well.
>
> One of the fixed axioms of bureacracy is that it doesn't occur to 
them that
> bad guys won't play by their rules.  They may invent a procedure to keep
> people from breaking one rule, but people who break one rule will break
> other rules, and are not all so dim that they won't figure out what the
> procedure is for and circumvent it.

Right.  And if a card is handed out in place of using SSN as an identifier
then the bad guys can still game the system.  All they must do is invent 
a new
identity each time they donate.

IOW, the card will identify you each time you donate with some veracity, but
will do nothing to prevent the bad guys identified in the first instance 
from
doing their evil.

rw2






-------- Original Message --------
Subject: RE: [Politech] New York Blood Center requires SSN to donate [priv]
Resent-Date: Thu, 29 Apr 2004 10:52:51 -0700 (PDT)
Resent-From: Declan McCullagh <declan () well com>
Resent-To: declan () well com
Date: Thu, 29 Apr 2004 13:11:46 -0400
From: Jones, Robert <RJones () NYBloodCenter org>

This is a very important observation of yours.   We are actively 
designing programs to share this and other health information with our 
blood donors so that they realize a benefit that goes beyond the great 
benefit of altruism - health assessment information.  Thanks for 
validating this idea with us.

-----Original Message-----
From: Douglas Campbell [mailto:drcampbell () engineer com]
Sent: Thursday, April 29, 2004 10:39 AM
To: talcottk () optonline net
Cc: Declan McCullagh; Jones, Robert
Subject: Re: [Politech] New York Blood Center requires SSN to donate
[priv]


Well, they use SSNs; they just don't require them.

But speaking of blood donation, here's another topic which has troubled 
me for a while:

When you donate blood, they run a bunch of tests on it.  Typing, testing 
for blood-borne diseases.  It would seem to me that since
those tests were conducted on my blood, the lab results would be part of 
my medical records - and I should have access to them.  The
Red Cross sees it otherwise; they never give me any of the lab results.

Now I must confess that I haven't gotten a flat denial from the Red 
Cross when I've asked for copies of the lab tests.  I've only gotten
lost in their byzantine bureaucracy.  Would anybody like to pursue this? 
 It seems like both a potentially valuable medical tool and part
of a fundamental right to have access to your own records.


----- Original Message -----
From: talcottk () optonline net
Date: Wed, 28 Apr 2004 09:27:16 -0400
To: Douglas Campbell <drcampbell () engineer com>
Subject: Re: [Politech] New York Blood Center requires SSN to donate [priv]

> Thanks, Douglas.  The Regional Services Director at the NY Blood 
Center wound up our correspondence thus:
>
> "All blood centers that I know of use ss#.  In any case I stand by 
the statement that the information in our system is secure."
>
> Oh, okay.
>
> 
Kelly------------------------------------------------------------------------------------
New York Blood Center
For more information or to make an appointment we invite you to call 
1-800-933-BLOOD
or to visit our website www.nybloodcenter.org
------------------------------------------------------------------------------------
This message and any files transmitted with it is intended only for the 
designated recipient(s).  It may
contain private or confidential information.   If you are not a 
designated recipient, you may not use, disclose,
review, copy or distribute this message.  If you receive this in error, 
please notify the sender by reply e-mail,
destroy all copies and delete this message.  Thank you.





-------- Original Message --------
Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
donate [priv]
Date: Thu, 29 Apr 2004 20:03:12 -0500
From: Jim Davidson <davidson () net1 net>
To: Declan McCullagh <declan () well com>

Dear Declan,

Lost in this entire discussion is why people should
donate blood ever.  The idea seems to be that human
blood and human organs should never be bought or sold.
In fact, the free market operates in both blood and
organs and would operate a good deal better if it were
not for the insistence by the Red Cross and other
agencies that blood has to be donated.

One of the problems that arises as a result of a lack
of free market choices in the blood supply is that
viable donors who have privacy concerns about their
SSN are not free to choose another place to contribute
or sell their blood.  The notion that everyone ought
to donate blood is as nasty as the notion that everyone
ought to pay taxes or donate money.

Regards,

Jim



_______________________________________________
Politech mailing list
Archived at http://www.politechbot.com/
Moderated by Declan McCullagh (http://www.mccullagh.org/)