APA Urges Federal Agency To Close Privacy-Rule Gaps

After a long battle to secure the privacy of medical records for all patients, APA is urging the U.S. Department of Health and Human Services (HHS) to beef up those protections, especially in the area of patient consent for release. The protections arose from the Health Insurance and Portability and Accountability Act (HIPAA) final privacy rule, approved last April by the Bush administration.

APA Vice President Marcia Goin, M.D., voiced APA’s concerns about patient consent last month to the Privacy and Confidentiality Subcommittee of the National Committee on Vital Health Statistics (NCVHS). NCVHS is the public advisory body to HHS that was appointed by the Clinton administration and offers advice on medical privacy issues. It also serves as a forum for discussion by private-sector interest groups about important health issues.

APA President Richard Harding, M.D., is a member of the committee.

“Regrettably,” Goin testified, “what is often overlooked is that confidentiality is an essential element of high-quality health care.”

In April President George W. Bush approved the federal medical privacy regulation set in motion by the Clinton administration. The health care industry must comply with the rule by April 2003 (Psychiatric News, May 4).

Goin told subcommittee members that health care plans and clearinghouses, which can be billing services or community health management information systems that collect medical data, are not required to obtain patient consent before disclosing medical records to marketers. “Patients should be able to choose who will see their medical records,” said Goin. “This is a huge hole in the privacy coverage.”

Another problem with the current regulation, remarked Goin, is the blanket consent that patients may give at the time that they enter into a health plan. “To rely upon such a blanket consent means that a patient is unwittingly authorizing subsequent disclosures of personal information without knowing the type of information allowed to be disclosed or who can receive this information.”

Furthermore, Goin testified, while the rule allows patients to give this consent, it does not protect patients from being forced out of the plan for not doing so.

Other problem provisions in the regulation would allow health care professionals to disclose a patient’s medical information without a court order when presented with a subpoena or discovery request.

Goin said that law enforcement agents could issue written demands to doctors, hospitals, and insurance companies to obtain patient records with no judge to mediate such requests.

The rule “provides no check on attorneys’ behavior in requesting records of marginal relevance to a case or for the purpose of embarrassing or intimidating opposing parties,” said Goin, who added, “Once the information is disclosed, the damage is done.”

In addition, Goin said, APA is concerned about a marketing and fundraising provision that exists in the regulation. Currently, companies are free to market to patients without their prior knowledge or consent as long as the communications are face to face, for example. Patient consent is still necessary when marketing communications are made via telephone or over e-mail under certain circumstances.

While patients can choose to “opt out” of receiving future marketing materials, Goin urged the commission to require patient consent before the marketing occurs in the first place.

Goin also recommended that HHS expand the definition of psychotherapy notes, and she pointed out that APA is presently developing a formal policy position on psychotherapy notes.

After Goin testified to the subcommittee, she had an opportunity to respond to questions from subcommittee members, as well as from representatives of other organizations that were not in favor of a mandate requiring written consent from patients before releasing medical information in certain instances. Some of these organizations included the American Hospital Association, Kaiser Permanente, and the Mayo Foundation.

One representative from the American Hospital Association proposed posting the privacy regulations on the Internet or on bulletin boards in hospitals or doctors’ offices instead of getting a patient’s informed consent about disclosure of medical information.

Goin replied that she worked at a county hospital where most patients did not have access to the Internet. She also said that patients treated in hospitals and physician offices are usually ill, in distress, and not in a state in which they are reading the signs posted in the office or hospital.

According to APA President-elect Paul Appelbaum, M.D., who has previously testified on medical privacy before Congress, “The requirement for patient consent prior to the release of records has been the touchstone for protection of patient privacy.”

Appelbaum said that the failure to protect the information that patients disclose in treatment will have deleterious effects on patient care. “We can expect that patients will stop coming for care or will decline to disclose the information we need to know in order to diagnose and treat them.” ▪