Advocates Ask Federal Court To Overturn Privacy Rule

In an effort to safeguard the health privacy of U.S. citizens, a coalition of more than a dozen consumer, professional, and health care organizations filed suit in April in a federal court in Philadelphia to challenge key provisions of the Health Insurance Portability and Accountability Act (HIPAA) of 1996.

The plaintiffs in the suit, Citizens for Health v. Thompson, include the American Psychoanalytic Association, which originated the suit; American Association of Practicing Psychiatrists; National Coalition of Mental Health Professionals and Consumers; and Citizens for Health, a consumer-based organization in Washington, D.C.

The suit seeks to overturn amended portions of the federal privacy rule issued by the Department of Health and Human Services (HHS) last year.

The amendments grant regulatory permission to all “covered entities” and their business associates to use and disclose patients’ medical information for purposes of treatment, payment, and “health care operations” without patients’ knowledge or consent.

Although the Bush administration, which removed patient consent for these purposes from the privacy rule in August 2002, claims the privacy rule increases patients’ medical privacy, as of April 14—the date by which the health care industry was to comply with the rule—patients’ medical information could be accessed by an unprecedented number of organizations known as covered entities—approximately 600,000 by the government’s estimates—and their business associates.

The covered entities include specific physicians, health care clinics, and hospitals and must, under the final privacy rule, have a relationship to the patient to be able to access his or her information. However, the business associates of the covered entities, which include attorneys, researchers, consultants, and accountants, need not have any relationship with the patient to access his or her health information.

In a typical example, a physician may hire an attorney to determine whether the office is overbilling or underbilling patients. To determine the nature of the billing practices of the office, the attorney may review patients’ medical records to find out more about the services they receive.

Constitutional Rights

Attorney Jim Pyles, counsel for the American Psychoanalytic Association, told Psychiatric News that he filed the suit in Philadelphia, the birthplace of the U.S. Constitution, because “there are fundamental constitutional issues at stake, and we thought they either ought to be preserved or come to an end where they began.”

U.S. District Court Judge Mary McLaughlin will hear the case and is expected to rule later this year.

The suit alleges that HHS, in issuing the amended privacy rule, violated the right to privacy of personal information under the Fifth Amendment of the Constitution and the right to private conversation guaranteed by the First Amendment. It also claims that HHS violated the intent of Congress under HIPAA to extend greater privacy protections to U.S. citizens.

Said Pyles, “The Supreme Court and many other courts have held routinely that the Constitution contains a right of privacy for personal information. That includes medical information, which is the most personal type of information.” Under the amended privacy rule, Pyles said, “we’ve lost that right.”

Parity Without Privacy?

Among the privacy rule’s most troubling provisions, according to psychiatrist Deborah Peel, M.D., is that sensitive mental health information is up for grabs.

Peel is co-chair of the American Psychoanalytic Association’s Committee on Government Relations and has helped to raise more than $10,000 for expenses related to the lawsuit. She also is the psychoanalytic association’s representative in the APA Assembly and has testified before Congress on medical privacy.

Peel noted that some special protections are extended to psychotherapy notes under the privacy rule, such as the provision that they must exist separately from patients’ medical records. These protections, however, are inadequate. For example, Peel pointed out that the majority of Americans do not see a psychiatrist when they have mental health problems. “Internists may get information about a patient’s problems with depression or anxiety and can’t segregate this sensitive information from the rest of the patient’s medical chart,” because nonpsychiatric physicians rarely keep psychotherapy notes.

“Mental health parity without privacy is worthless,” Peel stressed. “Who will seek mental health treatment if their information can later be used to harm them?”

Another objection voiced by Peel and Pyles about the privacy rule is that it can be applied retroactively, which means that even if people pay out of pocket for their health care or never see another physician as long as they live, their medical information can still be disclosed.

For instance, Peel said, “An insurance company or research firm can use federal regulatory permission for health care operations to gain access to your cradle-to-grave medical records for prospective health studies.”

In another scenario, a potential buyer of a person’s health insurance company can demand beneficiaries’ cradle-to-grave medical records to determine health risk in that population, Peel added.

Insurance companies stand to gain from the amended privacy rule, she said, because they can sell medical information to some 600,000 “covered entities” or use it to create policies that deny care for people with chronic or expensive medical conditions.

Federal court is just one venue for the battle to protect health privacy. Last month Rep. Edward Markey (D-Mass.) introduced a bill, HR 1709, that he calls the Stop Taking Our Health Privacy Act.

The bill seeks to restore patients’ right to consent to the release of medical information, limit the disclosure of health information for certain public health activities, and expand the notion of marketing established by the amended privacy rule to prohibit disclosure of patient information from pharmacies to drug companies that pay for that information.

“As health care becomes increasingly complex and automated,” Markey said in a press release, “I will continue to restore fundamental patient privacy protections, which are essential for the delivery of quality care.”

Peel encouraged psychiatrists and others who wish to preserve health privacy to contact their legislators and express support for the measure.

In addition, the Health Privacy Project (HPP), a Washington, D.C.–based organization dedicated to raising public awareness about health privacy issues, announced plans in April to launch a privacy complaint monitoring initiative.

The organization plans to monitor the oversight and enforcement of the privacy rule by the HHS Office for Civil Rights and wants members of the public, if they feel their medical privacy rights have been violated, to provide HPP with copies of complaints they file with HHS.

Peel believes, however, that the HPP’s mission is unworkable. “I think the idea of reporting a breach of privacy is absurd,” she said. “It will be virtually impossible to discover that the information is gone, so what are you going to be able to complain about?”

Peel explained that due to the broad regulatory permission granted to covered entities and business associates, “there is hardly any use or disclosure that won’t be legal under the new regulations.”

In addition, there is no stipulation under the privacy rule for any accounting of disclosures, according to Pyles. “The disclosures authorized are so routine and numerous. . .that it would be impossible for a consumer to detect an improper disclosure.”

Added Peel, “Most people will be victimized by this [privacy rule] and never even know who mugged them.”

[Citizens for Health v. Thompson, E.D., Pa., No. 2:03-CV-2264, 4/10/03; No. 72 HCDR 04/15/03]

More information about the lawsuit is posted on the Web at www.appealforprivacy.com. ▪