Medical Privacy, For Now

Medical privacy regulations issued in December by the U.S. Department of Health and Human Services (HHS) and greeted as a milestone by health privacy advocates may soon be reworked by the Bush administration.

The Health Insurance Portability and Accountability Act (HIPAA), passed by a Republican Congress in 1996, set in motion the process that led to the new privacy protections.

HIPAA gave Congress three years to pass comprehensive medical privacy regulations. After Congress failed to meet the deadline, HHS stepped in as required by HIPAA to fill the void.

HHS’s final regulations, which took effect in mid-April, are the first and only federal rules to protect the privacy of medical information kept by private health care providers and HMOs. The regulations would give patients increased control over the use and disclosure of their personal health information and give them important new rights such as the right to see, copy and amend their medical records.

Despite an aggressive campaign by some in the health care industry to delay the effective date of the regulations, HHS allowed the regulations to go into effect on April 14, 2001. Key players in the delay campaign included the American Hospital Association, Blue Cross and Blue Shield Association and the Healthcare Leadership Council, a coalition of chief executives of leading hospitals, health plans, medical device manufacturers, drug companies and pharmaceutical chains.
Now that the regulations have taken effect, industry groups are urging they be revised and the timetable for compliance be extended.

These regulations “will set back protections for patients and consumers,” says Mary Grealy, Healthcare Leadership Council president, and will “have a significant real world impact in the doctor’s office, in the hospital ward and at the pharmacy counter.”
Industry opponents complain about multiple elements of the final rule, including the requirement that health care providers obtain a patient’s written consent before using and disclosing protected health information, the requirement that plans and providers only use or disclose the minimum amount of information that is necessary to accomplish the purpose of the use or disclosure (Grealy says such provisions are “unworkable, unnecessary and, in a hospital setting, potentially harmful to patients”), and the circumstances under which providers and plans are allowed to disclose information to third-party “business associates” (e.g. claims processors) acting on behalf of the plan or provider.

Supporters say most of the industry complaints about the regulations are based on distortions and exaggerations. For example, Blue Cross/Blue Shield representatives have asserted that the regulations will “jeopardize the quality and timeliness of patient care.” Supporters of the rules say that it is the current lack of privacy that drives a wedge between patients and their providers and impedes the provision of quality health care, as privacy concerns lead patients to withhold information, avoid asking certain questions or fail to seek care altogether. Privacy advocates say people withdraw from full participation in their own health care because they are afraid sensitive health records will fall into the wrong hands, leading to discrimination, lost benefits, stigma and unwanted exposure.

Not all health-related entities share the goal of weakening the regulations. Many on-the-ground health care managers and professionals support the regulation and the timeline for implementing it. A recent survey of health care managers, chief information officers and systems analysts, conducted by Phoenix Health Systems, suggests that the vigorous opposition of some Washington, D.C.-based industry groups does not accurately reflect the views of the people actually charged with implementing the privacy regulations.

Time will tell if the Bush administration satisfies corporate and other interests seeking to weaken the regulations, or defers to the strong public support fro privacy protections.

— Joanne L. Hustead is senior counsel for the Georgetown University Health Privacy Project.