Easing of Privacy Rule Elicits Warnings of Harm to Patients
Richard Harding, M.D.: “Patients need to know where their medical information is going prior to disclosure.”
Sens. Edward Kennedy (D-Mass.), Paul Wellstone (D-Minn.), and Hillary Rodham Clinton (D-N.Y.) questioned why HHS “threw the baby out with the bathwater” by abandoning the patient consent requirement rather than fixing the unintended results. Under the previous rule, consent was required before patient information could be used or disclosed for payment, treatment, and health care operations.
Kennedy, chair of the committee, pointed out that it was “this committee that fought to have the patient consent requirement put into the final rule under the Clinton administration.”
HHS Deputy Secretary Claude Allen responded that HHS had considered keeping the original requirement but decided against it because “implementing the December 2000 rule was impractical for patients, physicians, hospitals, and pharmacists.”
He said HHS had received more than 11,000 comments by April 16. “Emergency room physicians, family physicians, specialists, and pharmacists all expressed concern about having consent forms signed before they could access a patient’s medical records and provide services,” a provision the department wants to eliminate.
HHS also viewed the consent requirement as “coercive” because patients had to sign a consent form before they could be treated, said Allen. “This isn’t our idea of voluntary consent. This also doesn’t provide patients meaningful control over their medical information.”
Instead, HHS proposed that obtaining patient consent be made voluntary and that clinicians be required only to “make a good faith effort” to obtain a written acknowledgement that the patient has been informed of the privacy practices the clinician uses. Health plans and other entities covered by the privacy rule would not be required to obtain this acknowledgment from patients under the new proposal.
Allen pointed out that “patient authorization is still required before doctors, hospitals, and other direct treatment providers can share personal medical records for nonroutine purposes, such as disclosure to employers for employment purposes and marketing.”
Testifying on behalf of APA, President Richard Harding, M.D., emphasized that “patients need to know where their medical information is going prior to disclosure. Informed consent gives the physician the opportunity to discuss that information with the patient.” Without the consent requirements in the existing rule, Harding said, the HHS version “is not privacy nor is it a protection of the patient’s information.”
Harding is a member of the Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics.
“We need to take steps to ensure that doctor-patient confidentiality is preserved and strengthened,” he continued. “APA recommends that HHS keep the privacy rule’s previous consent requirement and allow exceptions for certain circumstances, such as patients being treated in an emergency room.”
Marketing Activities
On another controversial topic, the Bush administration maintains that in the area of marketing activities directed at patients, its proposals provide enhanced protections. The proposed changes would require entities covered by the privacy rule to get a patient’s specific authorization before sending him or her any marketing materials. The provision would not, however, require physicians and other covered entities to obtain patient authorization before communicating with patients about treatment options and other health-related information, including disease-management programs, prescription-refill reminders, and wellness programs.
Harding called on HHS to eliminate these exceptions. He emphasized that “under HHS’s changes, marketers could use disease management, wellness programs, prescription-refill reminders, case management, and other related communications to send their marketing materials. . . . The regulations do no clearly restrict these marketing loopholes from abuses.”
Allen argued, however, that these are health care–related activities and that patients are entitled to know about health care products and services that may be beneficial.
Fundraising Provisions
Harding also criticized the fundraising provisions that would allow treatment facilities to publicize the names of previous patients in promotional materials without prior consent. “Can you imagine sending millions of letters telling you the names of persons served in your substance abuse program without their consent or authorization?,” he asked.
Allen also said HHS is considering changing the rule so that researchers would not have to delete patient-identifier data that might be needed for public health surveillance.
According to Robert Gellman, a health privacy expert in Washington, D.C., every state has introduced public health bills to allow broad access to patients’ medical records in case of bioterrorism. Such laws would not be subject to the federal rule.
The government is expected to publish the final medical privacy rule this summer.
APA submitted a comment letter to HHS on February 20 in anticipation of the proposed changes, which is available on the Web at www.psych.org/pub_pol_adv/hhs22102.cfm. Harding’s testimony is posted at www.psych.org/pub_pol_adv/helpcommittee41602.cfm. ▪
