New York Times Examines ‘Unintended Consequences’ of HIPAA Privacy Rule

The New York Times today looks at some of the "unintended consequences" of the medical privacy regulations in the Health Insurance Portability and Accountability Act of 1996, which were implemented nationwide in April. Under the privacy regulations, hospitals must offer patients written notice of how they use patient medical information and how it can be released, as well as information about how patients can view their records and make corrections. Patients must sign an acknowledgement that they received the notice; however, doctors are not required to obtain written permission from patients before releasing their information for medical purposes, the Times reports. Hospital staffs over the last couple years "have been combing through their systems ... looking for privacy leaks" and have taken "great lengths to comply with the rules, given that the violations are federal offenses," according to the Times. The American Hospital Association estimates that hospitals will spend $22 billion over five years to comply with the rules, the Times reports. Melinda Hatton, chief Washington counsel for AHA, said, "By and large, I think hospitals did a heroic job in getting ready for these regulations. But there have been some bumps in the road on all levels."

Janlori Goldman, director of the advocacy group Health Privacy Project, said that some hospitals are being "overcautious" and misapplying the law, the Times reports. Suburban Hospital in Bethesda, Md., has interpreted a federal regulation that requires hospitals to allow patients to opt out of being included in the hospital directory as meaning that patients want to be kept out of the directory unless they specifically say otherwise. As a result, if a patient is unconscious or otherwise unable to choose to be included in the directory, relatives and friends might not be able to find them, Goldman said. A hospital representative said, "We've enacted policies and procedures to protect the privacy of our patients." Dr. Jeffrey Brown, a pediatrician practicing in Rye Brook, N.Y., said, "Some of these new rules have created a hindrance in places where it probably wasn't necessary. I think that most physicians have had an awareness of reasonable privacy concerns with patients before these rules were written" (Tarkan, New York Times, 6/3).