The Bush administration has proposed changing some of the federal rules designed to protect the confidentiality of medical records, including the ability of patients to decide in advance who should be able to use their personal health information.
The Bush proposal would eliminate the requirement that patients give written permission before their records may be disclosed to doctors, hospitals, pharmacies, and insurance companies. Instead, the Bush rules would require only that patients be notified of their privacy rights at some point by those who use their records.
The Bush rules would also make it easier for parents to discover what medical services their teenagers seek, and researchers would find it easier to gain access to patients’ records. Business associates of various health care providers would be given more time before they have to comply with the confidentiality rules.
In one respect, the administration is suggesting a significant strengthening of privacy rights, by allowing patients to decide up front whether to allow their records to be used for marketing purposes.
Aimed at Improving Access to Care
The proposal represents President George W. Bush’s effort to address an issue that has dogged Presidents and lawmakers for years: How much control to give consumers over access to medical records in an electronic age.
As reported in the June 2001 issue of Health Care News, Bush had announced he would move ahead with the medical confidentiality rules adopted by Clinton—but indicated he would modify some of those rules to make them simpler and less onerous for health care companies and practitioners.
In disclosing what form those modifications will take, Health and Human Services (HHS) Secretary Tommy G. Thompson is now saying, “The changes we are proposing today will allow us to deliver strong protections for personal medical information while improving access to care.”
The rules do not require congressional approval.
No Shortage of Critics
Bush’s revised rules were warmly embraced by the insurance industry. “It’s a major step toward creating a workable rule,” said Karen Ignagni, president of the American Association of Health Plans. She and other insurance industry representatives would like the administration to go further to ease regulatory costs and give the industry time to adapt to the rules.
Privacy advocates, physicians, and some Congressional leaders were far less accepting of the Bush proposal. Janlori Goldman, director of Georgetown University’s Health Privacy Project, said the elimination of advance permission “cuts the legs off the privacy regulation.”
In a New York Times story, medical writer Robert Pear quotes Rep. Edward J. Markey (D-Massachusetts) as saying, “By stripping the consent requirement from the health privacy rule, the Bush administration strips patients of the fundamental right to give their consent before their health information is used or disclosed. The administration’s proposal throws the baby away with the bath water.”
The Bush administration has denied it is abandoning privacy protections. “The President believes strongly in the need for federal protections to ensure patient privacy,” Thompson said.
In the meantime, the parts of the Clinton-era rules Bush agrees with have already taken effect, although health care providers will not be required to comply with them until next year. Health care providers and insurers must comply by April 14, 2003. Anyone who violates the rules after that date will be subject to civil and criminal penalties, including a $250,000 fine and 10 years in prison for the most serious violations.
The basic aspects of the privacy rules remain intact and guarantee Americans the right to inspect their own medical records kept in electronic form, determine who else has seen them, and complain when they are used without permission.
No End in Sight
The proposed changes are part of a controversy that has been bouncing around Capitol Hill for years. In 1996, as part of a broader health reform law, Congress set itself a deadline for adopting patient privacy protections, saying it had to do so within three years or cede authority to HHS.
When lawmakers missed the deadline, Clinton’s aides began writing the rules, a process they finished shortly before he left office. Once Bush took over, opponents of the regulations resumed fierce lobbying, trying to capitalize on what they sensed was a more lenient attitude in the new administration toward federal regulation.
The newer proposals provide the first insight into how far Bush wants to go to address their complaints.
HHS officials, who briefed the media on condition of anonymity, said “very targeted changes” were intended to protect patients’ privacy while eliminating facets of the original rules they said would interfere with patients’ access to care. This reasoning essentially embraces the arguments the insurance industry has raised.
Striking a Balance
Specifically, the new rules strike a different balance in patients’ control over access to their records.
While eliminating the requirement that consumers give written consent for records disclosure, HHS officials said, the proposal would strengthen the requirement for health care providers to make sure patients are aware of their privacy rights. Doctors, pharmacies, and others who use records would have to make a “good faith effort,” although not necessarily ahead of time, to obtain written acknowledgment from patients that they had been told about privacy practices.
Thompson said he wanted to remove the consent requirements because he believed they could delay care. HHS spokesman William Pierce said the revision would avert the possibility that “you could have been stopped in your tracks” from getting needed treatment for failing to give permission for use of records.
Pharmacists and hospitals had expressed the same concern. Drugstores said they could not fill prescriptions phoned in by a doctor for pick-up by a patient’s relative or neighbor. Hospitals said they could not schedule medical procedures until the patient had read a privacy notice and signed a consent form. The Bush proposal would also relax some consent requirements medical researchers saw as potentially harmful to advancing medical technology.
The Bush administration also said it wants to make sure parents have “appropriate access” to the medical records of their children, including information about mental health, abortion, and treatment for drug and alcohol abuse. The Clinton rules, in the current administration’s view, may have unintentionally limited parents’ access to that information. The proposal makes clear that state law governs disclosures to parents.
Under Bush’s revised rules, health care providers would still have to notify patients of their rights and the providers’ disclosure policies. Patients would be asked to acknowledge in writing they received such notice, but they could receive care without the acknowledgment.
The rules, the first comprehensive federal standards for medical privacy, affect virtually every doctor, patient, hospital, pharmacy, and health plan in the United States.
