Ruling Sets Off Med Privacy Alarms
Doctors and hospitals can share patient information with HMOs and insurance companies without a patient's permission, as long as these records are directly related to health services, under a new Bush administration medical policy that has privacy advocates worried.
The rule - years in the making - was released Friday by the Department of Health and Human Services.
It offers the first comprehensive federal protections for health privacy and applies to nearly every patient, doctor, hospital, insurance plan and pharmacy.
The administration said it struck the right balance between privacy concerns and the provision of timely medical care. But privacy advocacy groups weren't so sure, and Sen. Edward M. Kennedy said he intended to introduce legislation to overturn the policy.
HHS Secretary Tommy Thompson touted the rule, saying it "protects the confidentiality of Americans' medical records without creating new barriers to receiving quality health care."
The regulation, which takes effect in April 2003 for all but the smallest health plans, sets aside a Clinton administration proposal that would have required a patient's written consent before such information could be released. The smallest plans will have an additional year to comply.
Under the Clinton rule, health care providers would have had to get written permission to disclose patient information - even for routine matters such as treatment and payment.
Under President Bush's change, no such permission will be needed, just as it's not needed today. Rather, doctors and other health care providers must notify patients of privacy policies and make a "good faith effort" to get written acknowledgment.
Health care providers are prohibited from disclosing patient information for reasons unrelated to health services, under the final rule. Civil and criminal penalties are established for violators. And beginning next spring, federal law will bar doctors, hospitals and pharmacies from improperly disclosing personal medical information.
The final version modified the March proposal to clarify prohibitions against using health data for marketing purposes, HHS spokesman Bill Pierce said.
Under the final rule, patients must give authorization before health care providers and others covered by the rule can use or disclose protected information in most "non-routine circumstances," such as releasing information to an employer or for use in marketing, an HHS statement said.
The Clinton version "would have forced sick or injured patients to run all around town getting signatures before they could get care or medicine. This regulation gives patients the power to protect their privacy and still get efficient health care," Thompson said.
The administration's approach "strikes a common sense balance by providing consumers with personal privacy protections and access to high quality care," he said.
"Patients now will have a strong foundation of federal protections for the personal medical information that they share with their doctors, hospitals and others who provide their care and help pay for it," he said.
Privacy advocates maintained that patient consent forms should be required, nevertheless.
"Having somebody sign a form makes it more likely they are going to read it and more likely that they're going to understand how their information is going to be used," said Janlori Goldman, who directs the Health Privacy Project at Georgetown University, a group of privacy advocates.
The rule "will undermine patient control over private medical information and further erode patient trust in the health care system," the Project said.
And Kennedy, a leading congressional player on health-care issues, said the changes were a "serious setback for medical privacy."
"Action by Congress is clearly needed to guarantee all Americans that the privacy of their medical records will not be abused," the Massachusetts Democrat said.
Health care providers celebrated the changes and predicted the regulations will have a major effect on all who work in the health care system.
"The rule helps put the patient in the driver's seat when it comes to their own medical information," said a statement from Dick Davidson, president of the American Hospital Association. "Unfortunately, earlier proposals could have created logjams in providing patients with timely care and more paperwork in a system already choked with paper."
The Healthcare Leadership Council, a coalition of executives, said the final regulations "strike a sensible balance between privacy and quality health care."