Keeping Your Medical Info Private

(CBS)  A month to the day before his presidency ends, reports CBS News White House Correspondent Mark Knoller, President Clinton formally announced new federal regulations to protect the privacy of people's medical records.

He calls them the most sweeping privacy protections every written.

"It is quite a problem that with a click of a mouse, your personal health information can be accessed without your consent by people you don't know — who aren't physicians — for reasons that have nothing to do with your health care," the president said.

Under the new rules, which don't take effect for more than two years, doctors, hospitals and pharmacies cannot disclose your medical records to anyone without your written consent.

"Recently expectant mothers who haven't even told their friends the good news are finding sales letters for baby products in their mailboxes," the president said. "That's also wrong. And under these new rules, it will also be illegal."

Violators who unintentionally disclose information would face civil fines of $100 per violation, up to a total of $25,000 per year.

Those who intentionally disclose information face criminal sanctions of up to $50,000 and up to a year in prison. And intent to sell the information is punishable by up to $250,000 and 10 years in prison.

Until now, there's been no federal law protecting medical privacy, even as technology allows personal information to bounce swiftly from one computer to the next.

Nearly a decade in the making, the new rules were intensely debated as privacy advocates sought broad protections and industry officials looked for greater flexibility.

Under the rules, patients could sign a one-time consent form on their first visit to a doctor allowing disclosures for routine matters like billing and treatment. But they would have to explicitly authorize most other uses of their records, said administration officials and others who have been briefed on the rules.

Patients also are gaining the right to inspect and request corrections to their records. And employers will be barred from perusing medical information about their workers unless it's directly related to providing health care.

"This will touch nearly every aspect of health care," said Janlori Goldman, who directs the Health Privacy Project at Georgetown University. "We have tried for years and years to get these protections, and we have been unsuccessful until now. This is just a huge victory."

Until now, patients have had to rely on state laws, which range from comprehensive to nonexistent.

The new federal rules, which take effect in two years, cover both electronic and paper records, as well as oral communications — a major change won by privacy advocates. As originally proposed last year, the rules would have affected only electronic records.

And, in a change won by industry, thadministration deleted a provision that could have opened the door for patients to sue if their records were improperly released.

The administration would have liked to include an explicit new right to lawsuits, but did have the legislative authority to do so.

Law enforcement agencies could obtain access to records with an administrative subpoena or summons, but they would not have to go to court as advocates would have liked.

The ACLU worries that it will be too easy for the police to get their hands on private records, said Ronald Weich, legislative consultant to the civil liberties group. But overall, he said, "we think it's a significant step forward."

The administration revised its initial regulation after receiving some 52,000 comments from the public, an overwhelming number that highlights the intense interest in the matter.

President-elect Bush could undo the rules with a new regulation, but starting over would be a tremendous task. Likewise, Congress could overturn them, but lawmakers would be unlikely to agree on specific changes.

The health industry supports the notion of improved medical privacy, but worries because the rule allows states to write even stricter standards.

"Without uniformity, the regulations are going to cause more, not less, confusion," Chip Kahn, president of the Health Insurance Association of America, complained Tuesday.

And industry officials argued that requiring consent might prevent doctors and insurers from trading information needed to ensure quality health care.

In 1996, Congress gave the Department of Health and Human Services the power to issue privacy regulations if it failed to enact legislation within three years. Negotiators in the Senate came close but couldn't close the deal.

"The administration has done much of what Congress should have done," said Sen. Patrick Leahy, D-Vt., a leader in the failed effort.

Administration officials estimate the rules will cost the health care industry and employers about $17.6 billion over 10 years, but that would be offset by an estimated $30 billion in savings from companion rules that eliminate paperwork and allow for electronic filing of insurance claims.

The new regulation also:

• Requires health providers and insurance companies to rewrite contracts with business partners, including attorneys, auditors and consultants, to ensure they adhere to the privacy rules. But if the outside businesses violate the rules, there are no federal sanctions.
  
  
• Holds health care providers responsible for the partners' violations only if they knew about them. The original proposal held them accountable if they should have known.

The rules could be reversed by the next Congress, reports Knoller — but that's not expected.


©2000 CBS Worldwide Inc. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed. The Associated Press contributed to this report