[Politech] One last round on blood & SSNs, with cite to federal law [priv]

From: Declan McCullagh (declan@private)
Date: Thu Apr 29 2004 - 21:28:17 PDT

  • Next message: Declan McCullagh: "[Politech] FTC officials irk Congress by suggesting "anti-spyware" law unnecessary"

    -------- Original Message --------
    Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
    donate [priv]
    Date: Wed, 28 Apr 2004 11:01:06 -0500 (EST)
    To: Declan McCullagh <declan@private>
    References: <408F2E57.6090407@private>
    (If you post this, please omit my name/email address.  thanks!)
    Several years ago, Congress added a provision to the Internal Revenue Code
    disclosure provisions (6103) explicitly allowing disclosures of donors'
    address information to blood banks on the chance that a donor would be
    HIV+.  These are not "wholesale" disclosures; they can only occur when a
    donor has tested + for HIV/AIDS and where the bank/center has no other
    information (or has bad information) on locating the donor.  As of 4 years
    ago (the last time I checked) no disclosures have ever occurred under that
    provision. (The program is called the "Blood Donor Locator Service.") In
    any event, that's the main reason that blood centers "require" the SSN.
    Here's the language of the section from the IRC:
    45 USC 6103(m)(6)
    (6) Blood Donor Locator Service
    (A) In general
    Upon written request pursuant to section 1141 of the Social Security Act,
    the Secretary shall disclose the mailing address of taxpayers to officers
    and employees of the Blood Donor Locator Service in the Department of
    Health and Human Services.
    (B) Restriction on disclosure
    The Secretary shall disclose return information under subparagraph (A)
    only for purposes of, and to the extent necessary in, assisting under the
    Blood Donor Locator Service authorized persons (as defined in section
    1141(h)(1) of the Social Security Act) in locating blood donors who, as
    indicated by donated blood or products derived therefrom or by the history
    of the subsequent use of such blood or blood products, have or may have
    the virus for acquired immune deficiency syndrome, in order to inform such
    donors of the possible need for medical care and treatment.
    (C) Safeguards
    The Secretary shall destroy all related blood donor records (as defined in
    section 1141(h)(2) of the Social Security Act) in the possession of the
    Department of the Treasury upon completion of their use in making the
    disclosure required under subparagraph (A), so as to make such records
    -------- Original Message --------
    Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
    donate [priv]
    Date: Thu, 29 Apr 2004 00:01:20 -0700
    From: Chris Hibbert <hibbert@private>
    Reply-To: hibbert@private
    Organization: It's Just Me
    To: Declan McCullagh <declan@private>
    References: <408F2E57.6090407@private>
    Andrew G.Feinberg wrote:
     > Here where I go to school in Madison, WI, I had a protracted
     > argument with the campus blood donation center (run by the Red
     > Cross) over this. When I pointed out that they were not an agency
     > allowed by law to demand my SSN, they relented and gave me an unique
     > ID, with sincere apologies from a supervisor who was more familiar
     > with the law. Perhaps the donor should try another blood bank run by
     > the ARC, since they seem to have a clue and some respect for
     > privacy.
    Well, you may have convinced them, but you were probably wrong about
    the legalities.  If you were talking to the Red Cross, rather than a
    school official, "not an agency allowed by law to demand my SSN" is the
    wrong criterion.  The laws on collecting SSNs mostly apply to
    government agencies (federal, state, and local), and not to
    non-government actors or all kinds.
    As someone pointed out in the same compendium from Declan, there are
    actually several laws that permit (or recommend that) blood donation
    agencies collect SSNs.  But they'd be allowed anyway, because they
    aren't in the set of agencies that are forbidden to ask.  They're
    allowed to ask, you're allowed to walk away.
    In most cases, AFAICT, they'll give in and let you donate with an
    alternate ID.  Most blood centers actually have reasonable policies,
    since they want your blood; you just have to talk to the right person
    to find out.  This is also as pointed out by a few people in the same
    Read the SSN FAQ on the question:
    protecting privacy in the computer age is
    like trying to change a tire on a moving car.
      --Colin Bennett
    -------- Original Message --------
    Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
    donate [priv]
    Date: Wed, 28 Apr 2004 08:15:37 -0500
    From: Rich Wellner <rich@private>
    Organization: The society for better programming of greater Chicago
    To: Declan McCullagh <declan@private>
    CC: politech@private
    References: <408F2E57.6090407@private>
    A bit of flawed logic here, just to make sure people understand what the 
    Declan McCullagh <declan@private> writes:
     > The really stupid thing about using the SSN is that it utterly fails to
     > serve the Red Cross' purpose, to screen out people with HIV and other
     > conditions that make them unsuited to donate.  Why?  Because they make no
     > attempt to verify it.  If I had AIDS and wanted to give it to as many 
     > as possible, I'd donate every seven weeks and make up a different SSN 
     > time.  I mean, really, duh.  How could they tell?
    The SSN isn't meant to stop malicious donors.  As pointed out it would 
    fail at
    that.  It is meant to stop accidentally dangerous donors from repeating 
     > The six digit donor ID is a much better ID because the Red Cross doesn't
     > really care who I am, they care that I'm the same person who claimed 
    to be
     > me last time, and the donor ID card verifies that reasonably well.
     > One of the fixed axioms of bureacracy is that it doesn't occur to 
    them that
     > bad guys won't play by their rules.  They may invent a procedure to keep
     > people from breaking one rule, but people who break one rule will break
     > other rules, and are not all so dim that they won't figure out what the
     > procedure is for and circumvent it.
    Right.  And if a card is handed out in place of using SSN as an identifier
    then the bad guys can still game the system.  All they must do is invent 
    a new
    identity each time they donate.
    IOW, the card will identify you each time you donate with some veracity, but
    will do nothing to prevent the bad guys identified in the first instance 
    doing their evil.
    -------- Original Message --------
    Subject: RE: [Politech] New York Blood Center requires SSN to donate [priv]
    Resent-Date: Thu, 29 Apr 2004 10:52:51 -0700 (PDT)
    Resent-From: Declan McCullagh <declan@private>
    Resent-To: declan@private
    Date: Thu, 29 Apr 2004 13:11:46 -0400
    From: Jones, Robert <RJones@private>
    This is a very important observation of yours.   We are actively 
    designing programs to share this and other health information with our 
    blood donors so that they realize a benefit that goes beyond the great 
    benefit of altruism - health assessment information.  Thanks for 
    validating this idea with us.
    -----Original Message-----
    From: Douglas Campbell [mailto:drcampbell@private]
    Sent: Thursday, April 29, 2004 10:39 AM
    To: talcottk@private
    Cc: Declan McCullagh; Jones, Robert
    Subject: Re: [Politech] New York Blood Center requires SSN to donate
    Well, they use SSNs; they just don't require them.
    But speaking of blood donation, here's another topic which has troubled 
    me for a while:
    When you donate blood, they run a bunch of tests on it.  Typing, testing 
    for blood-borne diseases.  It would seem to me that since
    those tests were conducted on my blood, the lab results would be part of 
    my medical records - and I should have access to them.  The
    Red Cross sees it otherwise; they never give me any of the lab results.
    Now I must confess that I haven't gotten a flat denial from the Red 
    Cross when I've asked for copies of the lab tests.  I've only gotten
    lost in their byzantine bureaucracy.  Would anybody like to pursue this? 
      It seems like both a potentially valuable medical tool and part
    of a fundamental right to have access to your own records.
    ----- Original Message -----
    From: talcottk@private
    Date: Wed, 28 Apr 2004 09:27:16 -0400
    To: Douglas Campbell <drcampbell@private>
    Subject: Re: [Politech] New York Blood Center requires SSN to donate [priv]
     > Thanks, Douglas.  The Regional Services Director at the NY Blood 
    Center wound up our correspondence thus:
     > "All blood centers that I know of use ss#.  In any case I stand by 
    the statement that the information in our system is secure."
     > Oh, okay.
    New York Blood Center
    For more information or to make an appointment we invite you to call 
    or to visit our website www.nybloodcenter.org
    This message and any files transmitted with it is intended only for the 
    designated recipient(s).  It may
    contain private or confidential information.   If you are not a 
    designated recipient, you may not use, disclose,
    review, copy or distribute this message.  If you receive this in error, 
    please notify the sender by reply e-mail,
    destroy all copies and delete this message.  Thank you.
    -------- Original Message --------
    Subject: Re: [Politech] Replies to N.Y. blood center requires SSN to 
    donate [priv]
    Date: Thu, 29 Apr 2004 20:03:12 -0500
    From: Jim Davidson <davidson@private>
    To: Declan McCullagh <declan@private>
    Dear Declan,
    Lost in this entire discussion is why people should
    donate blood ever.  The idea seems to be that human
    blood and human organs should never be bought or sold.
    In fact, the free market operates in both blood and
    organs and would operate a good deal better if it were
    not for the insistence by the Red Cross and other
    agencies that blood has to be donated.
    One of the problems that arises as a result of a lack
    of free market choices in the blood supply is that
    viable donors who have privacy concerns about their
    SSN are not free to choose another place to contribute
    or sell their blood.  The notion that everyone ought
    to donate blood is as nasty as the notion that everyone
    ought to pay taxes or donate money.
    Politech mailing list
    Archived at http://www.politechbot.com/
    Moderated by Declan McCullagh (http://www.mccullagh.org/)

    This archive was generated by hypermail 2b30 : Thu Apr 29 2004 - 22:28:35 PDT