Patient Privacy Revisited

Doctors and hospitals could disclose private information about patients and provide medical services without prior consent under proposed Bush administration revisions to Clinton-era patient privacy rules.

Privacy advocates protested that the administration is stripping out a core element of the privacy rules. Sen. Edward Kennedy, D-Mass., promised hearings and legislation to reinstate the mandatory consent forms.

"The administration has come down on the side of major health corporations at the expense of individuals," Kennedy charged Friday from the Senate floor.

The changes also would give parents greater access to their children's medical records.

Years in the making, the privacy rules are scheduled to take effect in April 2003. They offer the first comprehensive federal protections for health privacy and apply to nearly every patient, doctor, hospital, insurance plan and pharmacy in the nation.

The rules prohibit health care providers from disclosing patient information for reasons unrelated to health services and establish civil and criminal penalties for violators. They give patients the right to inspect and copy their records and to ask for corrections.

Last year the Bush administration allowed the rules developed under President Clinton to go forward but promised a variety of changes to make them more workable. The changes were announced Thursday.

"These are commonsense revisions that eliminate serious obstacles to patients getting needed care and services quickly while continuing to protect patients' privacy," Health and Human Services Secretary Tommy Thompson said in a statement.

Both the Bush and Clinton proposals strengthen medical privacy: all patients would get access to their medical records and their data couldn't be sold without their permission. But CBS News Correspondent Sharyl Attkisson reports there are key differences.

The Clinton rule would have required written consent up-front before patient information could go to medical facilities, pharmacies or insurers. The Bush rule eliminates the idea of written consent, saying it could get in the way of patient care, hampering paramedics, prescriptions couldn't be called in and people couldn't be treated by phone.

Medical professionals will have to tell patients about their privacy rights and practices, but don't need their consent.

Health care providers welcomed many of the changes, including scrapping of consent forms. They also were pleased that the revisions make clear that incidental disclosures of private information are permitted, such as a conversation at a hospital nurses' stand or names listed on a sign-in sheet at a doctor's office.

Privacy advocates were unhappy about the consent forms and the elimination of some privacy rights for minors, including teen-agers who may seek abortions, drug treatment or other medical care.

"It's really unfortunate that HHS is proposing to eliminate the consent requirement," said Janlori Goldman, who directs the Health Privacy Project at Georgetown University. "If people don't know what their rights are, how are they going to protect themselves?"

The administration was reacting to health care providers who complained that the need to get permission could stall needed treatments. Pharmacies, for instance, worried that a prescription telephoned in by a doctor could not be picked up by a friend if the patient had not signed a consent form.

Business groups said consent forms would amount to more bureaucracy, and HHS officials said they were not meaningful since people who didn't sign the form could and probably would be denied care anyway.

"The forms would have been a paperwork hassle without providing any additional privacy rights or protections for patients," said a statement from the American Hospital Association.

Both the Clinton and the Bush versions of the privacy rule allow minors to keep privacy rights if specified under state law. Absent a state law, both would allow doctors to disclose information to parents.

The Clinton rule said, however, that minors who have the right under state law to access certain medical services should have the right to privacy, even from parents. Various state laws give minors the right to obtain services without parental approval for mental health, substance abuse or abortion services.

Under the Bush revision, minors would not have that right except in unusual cases where state law explicitly allows it.

The regulations clarify that personal information cannot be sold or given to drug companies or others that want to market a product or service without patient permission.

However, doctors, hospitals and insurance companies can communicate with patients about benefits, new treatments and products without permission as long as the information is meant to benefit a patient's treatment.

The revised rules will be published next week and are subject to a 30-day public comment period before becoming final.