APA Says Final Privacy Rule Provides Inadequate Patient Safeguards

The final federal medical privacy rule issued last month does not require patients’ written consent before personal health information can be disclosed or used for routine transactions, including treatment and payment. The rule, which becomes effective April 14, 2003, applies to “covered entities” that conduct certain financial and administrative functions electronically.

These entities are defined as providers, health plans, hospitals, insurers, and health care clearinghouses. Certain small health plans have until April 14, 2004, to comply with the rule. Covered entities have an extra year—until April 14, 2004—to rewrite their business associate contracts to ensure that patient privacy is protected.

“APA is very disappointed that the Bush administration has abandoned the traditional principle that patients have the right to control when their medical records are released to others, especially when those parties are not directly involved in their care,” APA President Paul Appelbaum, M.D., told Psychiatric News.

Though the final rule released last month by the Department of Health and Human Services (HHS) “has some positive aspects, including a recognition that psychotherapy notes are entitled to a higher level of protection, their rejection of informed consent for release of information is a huge step backward for patients’ right to medical privacy,” said Appelbaum.

The final privacy rule requires that covered entities make a good-faith effort to obtain an individual’s written acknowledgement that he or she has received that entity’s notice of privacy practices, according to the regulation.

Patient authorization is required before personal health information can be disclosed for nonroutine transactions such as for employment and marketing purposes. The final rule does not preempt stronger state privacy laws.

The Clinton administration issued the final patient privacy rule in December 2000 with the patient consent requirement. The Bush administration proposed several changes in March of this year to the final rule, including elimination of the patient consent requirement, a proposal APA opposed.

“APA has been in the vanguard of defending patients’ medical record confidentiality. It has advocated forcefully to Congress and the executive branch for patients’ right to prior consent to the use and disclosure of personal medical information,” said Appelbaum in a prepared statement.

HHS Secretary Tommy Thompson defended the decision to eliminate the patient consent requirement, saying, “It was coercive and would have interfered with patients’ access to quality care” (Psychiatric News, May 3). “Sick or injured patients would have been forced to run all around town getting signatures before they could get care or medicine.”

The final privacy rule prohibits health care providers, plans, and clearinghouses from selling personal medical information, including patient lists, to third parties for marketing purposes. The rule also bars pharmacies and covered entities from using business-associate agreements to circumvent the rule’s marketing prohibition.

However, the final rule contains another marketing change. Covered entities that receive payment for marketing activities are not required to notify patients of the payment or give them a chance to refuse being recipients of marketing material.

“This creates a loophole that allows a pharmacy to receive payment from a pharmaceutical company to recommend to patients that they switch from one medication to another without disclosing the arrangement to patients,” said Appelbaum.

“This unwarranted interference with the patient/physician relationship is not justified by any benefit to patients, but is motivated solely by the economic interests of the pharmaceutical industry,” said Appelbaum.

He praised the rule’s positive provisions, including the right of patients to see and correct errors in their record and the prohibition on the sale of patients’ medical information. “But the value of these positive measures is seriously compromised by the retreat on patients’ rights to determine what happens to their records and to prevent their information from being used for commercial purposes,” said Appelbaum in the statement.

The text of the final privacy rule and related information are posted on the HHS Web site at www.hhs.gov/ocr/hipaa/. The HHS Office of Civil Rights will post materials at www.hhs.gov/ocr/hipaa to assist entities covered by the rule with compliance. APA’s Division of Government Relations will post a summary of the rule on its HIPAA Educational Materials Web page at www.psych.org/pub_pol_adv/hipaa/privacy_reg.cfm. ▪