The recent U.S. Food and Drug Administration (FDA) approval of human use of implantable RFID tags has generated a lot of debate even among tech analysts and has again provided fodder for privacy advocates.

AIM, Inc. has no position on the use of implantable RFID transponders in people. The following is offered as an impartial examination of the current VeriChip technology, its potential benefits as well as some of the issues and concerns its use would raise.

The Current Situation

The medical VeriChip program, offered by Advanced Digital Solutions (ADS), is very similar to the one currently used for companion animal (pet) identification. The transponder, which is encapsulated in glass is biologically inert and thus will not react with the body tissue or chemistry, is injected into the arm (preferably) using a large veterinary needle. The transponder does not contain any personally identifiable information beyond a unique 16-digit code that points to the individual's records in an ADS database and requires a proprietary (ADS) reader.

The VeriChip is a 128kHz transponder that uses a coiled wire antenna. Because it is implanted under the skin (subdermally), it is affected by the high water content of the human body. Although no figures are offered by ADS for read range, the similar companion animal ID system requires a reader to be in extremely close proximity and properly aligned with the transponder to effect a read.

FDA approval means that the VeriChip transponder has been determined to be safe for use in humans. The FDA has, however, raised questions about data security, potential migration of the transponder to other locations in the body, and possible concern that it might have adverse effects within a patient during an MRI.

Who's In Charge?

In commenting on the FDA's approval, some articles have questioned why the FDA did not make stronger recommendations. The simple answer is that the FDA's authority ends with determining the safety, or potential risks, of the use of a medical device, drug or blood product, or food item. Existing U.S. governmental and public agencies are responsible for other aspects of possible uses of human-implanted RFID. Some of these agencies are listed below.

HIPPA (the Health Insurance Portability and Accountability Act of 1996) sets standards for patient data security -- in other words, how patient data is stored and with whom it can be shared . This act has already caused significant changes in patient information policies among healthcare providers.

The FCC (Federal Communications Commission) regulates radio frequency spectrum, power levels and similar technical aspects.

The ABA (American Banking Association) issues recommendations and standards for financial institution information. The ABA set the standard for magnetic ink character recognition (MICR) on checks and track 2 financial information on magnetic stripe cards (i.e., credit and debit cards).  [There is no current provision in the VeriChip program to include any payment or financial institution information however this question is frequently asked.]

Currently, the ADS VeriChip database is proprietary and can only be accessed, via encrypted communications, by subscribing healthcare providers with an ADS reader.

Individuals who participate in the VeriChip program pay between $150 and $200 to get the chip implanted, according one report. There is also a monthly subscription fee for the VeriChip Subscriber Registry.

In short, there is currently no single entity to regulate the use of implantable RFID in humans.

The Concerns

There are the expected concerns from privacy advocates that "they" will be able to track you anywhere you go, although the potential read range of the transponder strongly argues against this being possible. Similarly, there are those concerned that it will become part of a mandatory program on the part of the government.

A more valid question about implantable RFID tags is whether such "chipping" might become a prerequisite for membership in an HMO or other insurance plan. Some have questioned the "ethics" of identifying individuals however these are the same as the ethical concerns regarding requiring photo driver's licenses, birth certificates, passports, signatures on credit cards and other means of personal identification. While it is impossible to predict future events, consent of the individual would be a critical issue.

Of more immediate concern are questions about data security as well as timeliness.

The first concern is over what measures will be put into place to verify that the patient has authorized access to his or her database records. This becomes a problem if the patient is unconscious and in an emergency situation.

Equally problematic, however, is assuring that the person using the reader has the proper authorization to do so. For example, during a routine pre-employment physical, should the physician have access to the patient's ADS record?

And then there's the question of whether information in the ADS database is current or accurate. Just as there are spurious entries on individuals' credit reports, there may be incorrect or incomplete (and therefore misleading) information in an individual's medical records.

It is unclear how information in the database can be updated. Must healthcare providers subscribe to the VeriChip program to update information? What about individual practitioners? And how timely will the information be?

The other significant concern is the possible effect of an MRI on the transponder. There have been suggestions that MRIs will cause metal to heat up during the scan. It is unclear whether this would pose a safety hazard to those with the VeriChip. [Experience with the companion animal tagging procedure might help clear up this question but, to date, no data have been suggested on either side of the question.]

Other concerns that have been expressed are about the cost of the program (versus some low tech approaches), whether it will gain sufficient volume to make it desirable for healthcare providers to sign onto the idea, whether the transponder could be removed as a form of "healthcare theft." (It is reported that individuals without healthcare coverage sometimes mis-identify themselves to healthcare providers, using the name of a relative who does have coverage.)

A final concern is similar to that of the abuse of Social Security numbers. While the law states that the Social Security number should not be used for personal identification, it is one of the most commonly used means of identifying individuals (and a key to identity theft). The concern is that the code on an implanted RFID transponder intended only for medical use could be co-opted other groups as a form of ID.

The Benefits

In emergency situations, particularly with unconscious and unaccompanied patients, providing healthcare providers with a patient's accurate medical history could be the difference between life and death. Although there are many low-tech means of identifying individuals and gaining access to medical records (for example, insurance cards, MedicAlert® emblems, and so forth), these items do not always arrive with a patient.

The use of implantable RFID offers a high level of assurance that the transponder will arrive with the patient, allowing healthcare providers with the ability to instantly pull up a patient's medical record from anywhere in the world.

On a more somber note, they could also be used to instantly identify victims of catastrophic events who are too badly disfigured to allow visual identification.

Identifying infants at birth could provide positive ID of those who are abducted and possibly found years later after their physical characteristics have changed radically.

Implantable RFID could also help prevent healthcare coverage theft by significantly reducing the possibility that an uninsured individual could assume the identity of a relative or friend with healthcare coverage. Reducing healthcare insurance theft could help keep healthcare costs under control.

Conclusion

The debate is over whether the benefits outweigh the concerns.

A great deal depends on whether sufficient actions are taken -- by ADS or someone else -- to address concerns over access and security.

Of equal weight is whether healthcare insurance companies and providers see sufficient benefit to adopt the system, particularly in light of other pressing requirements to implement bar code scanning and possibly RFID tracking of pharmaceuticals.