Federal Privacy Rule: Contradiction in Terms?
United States citizens are in danger of having their medical information broadcast to data-processing and insurance companies, hospitals, and researchers without their prior consent or knowledge, according to opponents of the final medical privacy rule who appeared at a press conference sponsored by the Institute for Health Freedom (IHF).
Institute for Health Freedom President Sue Blevins: “People in this country will soon have to choose between health care and privacy.”
“People in this country will soon have to choose between health care and privacy,” Blevins said.
Under the new rule, “covered entities,” which include clinicians, hospitals, clinics, insurers, and data-processing companies, have federal permission to access patients’ health information. Under the new rule, medical records can also go out to business associates of these entities, such as attorneys, consultants, and accountants, until April 2004. By this date, the business associates must comply with privacy protections in the rule. Until that time, medical information can be disclosed to the associates even if they are not in compliance with the protections.
The modifications also eliminated the standard in which doctors must get patients’ consent before releasing their personal health information, including genetic information, for purposes of treatment, payment, or “health care operations,” a broadly defined term that encompasses fundraising and insurance-fraud detection.
Personal medical information can also be divulged to government agencies that check medical records for Medicare fraud.
The rule took effect on October 15 and can be applied retroactively. That means patient medical records from the 1970s, for instance, are not protected.
Misleading Information?
Blevins said that HHS has been misleading the public about the federal medical privacy rule and its effect on medical privacy ethics. “HHS tells the media that the rule improves citizens’ medical privacy, when in fact it does just the opposite.”
Blevins questioned information posted about the federal rule on the HHS Web site under a section titled, “Frequently Asked Questions About the HIPAA Privacy Rule” which, she said, leads the public to believe that their personal information won’t be compiled in government or private databases without their consent.
“While the rule does not require the creation of such databases, it does not prevent them from being created,” she said.
Furthermore, HHS says that Americans can get an accounting of their medical record disclosures, and this isn’t necessarily true, according to Blevins. “HHS says that for the first time ever, patients will get an accounting of disclosures, but here’s the trick—your records can be shared without your permission or knowledge for treatment, payment, and health care operations.”
“It’s like saying that you can see who accesses your credit report, but that you’ll only see when your credit report is released for anything other than your credit history,” she added.
Practical Implications Troubling
Health care attorney Jim Pyles, J.D., is troubled by the removal of federal protection for the right of consent, but even more disturbed by the fact that “this is your federal government giving license to more than 600,000 covered entities in this country to get your medical information—the lawyer in me is extremely offended by this.”
Pyles, who serves as counsel for the American Psychoanalytic Association on privacy issues, said that if one of these entities demands a patient’s medical information from a doctor, the doctor has the right to refuse to divulge the information.
But physicians can pay a price for refusing to disclose medical records, according to Pyles, who recently offered expert testimony in a Pittsburgh court case in which a managed care company demanded that a local psychiatrist submit medical and mental health records of each patient enrolled in the plan. The company threatened to remove the psychiatrist from its provider panel unless he forfeited the records, Pyles said.
The psychiatrist refused to divulge the records on the grounds that his patients trusted him to keep their information confidential, and the insurance company then removed him from the plan. The psychiatrist obtained an injunction, and the presiding judge is seeking to establish whether the insurance company acted within the law when it removed the psychiatrist from the plan. No verdict had been reached by press time.
“This is an example of the pressure that will be brought to bear on practitioners, even though the Bush administration tells them they have a choice to refuse to divulge medical information.”
Beside patients and physicians, politicians are another group for whom medical privacy is sacred. “The November elections [were] the last in which candidates’ medical information won’t play a prominent role,” Pyles said. He pointed out that in past elections, the American public learned of candidates’ treatment for mental disorders and substance abuse, “and that was when protections were in place—now that these protections are gone, candidates’ medical records are wide open” and could be campaign fodder.
Two major efforts are under way to challenge the federal medical privacy rule, Blevins explained. One is in the form of a bill, Stop Taking Our Health Privacy Act of 2002 (HR 5646). It seeks to restore patient consent to the privacy rule and expand privacy protections for patients. The bill’s author is Rep. Edward Markey (D-Mass.).
Blevins also cited an effort to challenge the constitutionality of the medical privacy rule in the courts, but could offer little information about this initiative since it is ongoing.
Americans can take matters into their own hands, she added, by writing letters to Congress objecting to the removal of patient consent from the final medical privacy rule.
“Citizens don’t have to accept this rule and its invasion of our medical privacy,” Blevins said.
Additional information on the privacy rule is posted on the Web at http://cms.hhs.gov/hipaa▪
