By Ronald L. Scott
rscott@central.uh.edu

Texas law now protects the confidentiality of an individual’s biometric information by restricting the collection, sale, lease, or disclosure of it. In passing House Bill 678, the Legislature recognized that many transactions that now require a password or some other form of identification would utilize biometric technology in the future.

Security systems use biometrics to identify an individual user by her or his fingerprint, iris, voice, retina, face, or hand geometry. Law enforcement uses biometrics systems for identification. Identification is labor intensive since these systems must compare an individual sample with all possible candidates. Verification systems are simpler. The software looks up the template related to a user name and compares the new sample against the template to determine whether a match exists. Such systems are already being used in biometrics automated teller machines (ATMs) and would be appropriate for most health care applications

A Florida hospital already uses a system allowing doctors to access the hospital’s electronic health care data via a finger scanning biometrics security system. Such a system is more secure than one using passwords that can be guessed or stolen. A scanner can capture a fingerprint, or a camera can capture the image of an iris. Some ATMs already use iris or fingerprint scans to prevent fraud in monetary transactions. The technology holds even more potential for healthcare. Physicians are notorious for giving out their passwords to secretaries, nurses, and other support staff. It would be impossible for a physician to loan her finger or iris ensuring the accuracy of medical records by limiting and identifying those who access and alter medical records. The systems are becoming less expensive. A fingerprint scanning system costs less than $300 per workstation, down from $2,000 only a few years ago.

Biometrics technology may be used for patient registration and identification to ensure that medical records are properly associated with each patient. A children’s health care project in Florida has adopted another approach using iris scan technology. Authorized health care providers have access to children’s Internet-based medical records. Using the iris scan technology, providers can identify a child and link to the appropriate medical record, even if the child cannot communicate.

The new Texas law (Section 35.50 of the Business & Commerce Code) provides that a person may not capture a biometric identifier of an individual for a commercial purpose unless the person first informs the individual and then receives the individual's consent to capture the biometric identifier. Also, any person who possesses a biometric identifier of an individual may not sell, lease, or otherwise disclose it to another person unless the individual first consents to the disclosure (or the disclosure completes a financial transaction authorized by the individual). There are also exceptions allowing disclosure for law enforcement purposes and when required by a federal statute. The law requires a person possessing a biometric identifier to protect the identifier in the same manner as the person protects other confidential information. Violation of the law can result in a civil penalty of up to $25,000 per violation.

Except for the penalty provisions, governmental bodies that possess biometric identifiers are subject to similar restrictions on use and disclosure. See Title V, Texas Government Code, Chapter 559. Texas shows foresight in protecting biometrics information before the technology becomes widespread.

08/24/01