White House Won’t Delay Medical Privacy Rule
The Bush administration signed off last month on a regulation designed to give patients greater privacy protections for their medical information. The health care industry has two years to comply with the rule, which goes into effect 2003.
APA President Daniel Borenstein, M.D., commented in a press release, “President Bush’s bold implementation decision clearly deserves our praise. The regulation is a dynamic step toward protecting patient privacy as it requires informed consent before an individual’s record can be disclosed for treatment, payment, or other health care operations.”
APA Vice President Paul Appelbaum, M.D.: “Although the regulation is imperfect, nonetheless it contains important patient protections.”
Secretary of Health and Human Services Tommy Thompson explained the action in a press release last month. President George W. Bush “wants strong privacy protections put into place now. We have laws in this country to protect the personal information contained in bank, credit card, and other financial records. Our citizens must not wait any longer for protection of their most personal information—their health records.”
Thompson also announced that his department would issue interpretive guidelines on how the rule should be implemented. He told the Washington Post that he expects that will occur this month.
Thompson also indicated that changes might be made to the rule “to ensure the quality of health care doesn’t suffer inadvertently from this rule.” These would not be wholesale changes “but a way to reduce and simplify the onerous financial burden and include a degree of common sense,” the Washington Post reported on April 13.
Thompson has the authority to make clarifications to the rule and “remove unwanted effects” within one year from the effective date, according to Appelbaum.
Thompson mentioned four areas of change being considered by HHS. These were raised in the 24,000 comments received by the agency during the 30-day comment period that ended March 30. APA also submitted comments after the Clinton administration issued the final rule in December, according to Nancy Trenti, an associate director in APA’s Division of Government Relations.
Thompson delayed the rule’s effective date of February 26 until April 14 to allow for a 60-day review by Congress, said Trenti.
These are among the potential changes:
• Allow patients to give written consent after the fact in some circumstances, for example, to enable pharmacies to fill prescriptions called in by telephone.
• Loosen restrictions for patient records used in scientific research.
• Allow health care companies to transfer records to business associates without compelling them to follow the same privacy guidelines.
• Allow parents to have access to their children’s health, mental health, and substance abuse records, including abortion information.
“APA has argued vigorously that patient consent must be obtained before health plans can disclose personal information to third parties. If HHS goes ahead with this, it will be a step backward,” said Appelbaum.
He agreed that an unintended consequence of the regulation is to require pharmacists to get written patient consent before filling prescriptions by telephone.
Appelbaum was puzzled about the need to consider allowing parents access to their children’s medical records, noting this is allowed already in all states.
Thompson indicated to the Washington Post that the abortion language is a concession to conservatives. He also said that it is less likely that the agency will review a provision that allows patient information to be shared for marketing purposes. APA has strongly urged HHS to require patient consent before patient information can be disclosed for marketing or fundraising purposes.
Appelbaum said he is pleased that the Bush administration went forward with the rule despite considerable pressure from the insurance, pharmaceutical, and hospital industries.
The American Psychoanalytic Association also announced that it was pleased with the decision by HHS to put the rule into effect. If the agency had further delayed the effective date, the association was poised to file a lawsuit against HHS in federal court in the District of Columbia with the American Civil Liberties Union (ACLU) and Public Citizen, a consumer advocacy group, according to Jim Pyles, the association’s legal counsel.
Pyles and attorneys at the law firm of Powers, Pyles, Sutter, and Verville, P.C., researched case law to determine whether HHS could legally delay the rule and make changes. They found that there was ample case law showing that a federal agency that fails to meet a deadline required by federal law can be compelled to put the rule in question into effect.
Pyles and the other attorneys also found case law showing that a federal agency cannot legally make changes to a final rule or delay the effective date without giving the public prior notice and an opportunity to comment on the proposed changes, said Pyles.
“If necessary, we would have requested a preliminary injunction in court to prevent HHS from further ignoring the December 2000 deadline imposed by the 1996 Health Insurance Portability and Accountability Act (HIPAA),” said Pyles.
HIPAA required HHS to issue a final privacy rule by December 2000 if Congress did not enact privacy legislation by August 1999. Congress never addressed the “effective date” in HIPAA because to “allow the Secretary to issues final regulations and never provide an effective date would have rendered the requirement meaningless,” he said.
When the New York Times published an article on the privacy rule on April 8 stating that the ACLU and the American Psychoanalytic Association were exploring litigation against HHS, the Bush administration realized the potential for a lawsuit, said Pyles.
After Thompson announced that HHS would put the rule into effect April 14, Pyles’s contacts at HHS, whom he asked not be named, confirmed that agency officials had discussed the threatened lawsuit.
Once HHS issues its interpretive guidelines, APA will review them and provide an analysis to APA members.
The health privacy rule is available at APA’s Web site at www.psych.org/pub_pol_adv/privacy122100.pdf. ▪
