Bush Administration Issues Final Rules on Medical Privacy Restricting Use of Patient Records
As expected, the Bush administration on Friday issued final medical privacy rules that first were offered by the Clinton administration, the Washington Post reports. When the rules take effect next spring, patients will have a "host of new protections," including the right to review their medical records and correct errors. The rules, which apply to all electronic records but not those kept on paper, permit personal medical records to be shared only for purposes of treating patients, paying bills and carrying out various "health care operations," a broad, undefined category, the Post reports. The rules say that only the smallest amount of information should be disclosed for specific purposes and that patients' names should be left out whenever possible (Goldstein, Washington Post, 8/10). Under the rules, providers must obtain patients' approval before they can disclose private information in "nonroutine" cases, such as giving information to an employer or using medical information for marketing purposes (Lueck, Wall Street Journal, 8/12). However, providers do not need to obtain written permission before disclosing medical records, a provision included in the Clinton administration rules (Washington Post, 8/10). Rather, providers must give patients notice of their new rights and make a "good faith effort" to obtain written acknowledgment from patients saying they have received the information (HHS release, 8/9).
The privacy rules also state that:
- Providers cannot sell patient names and health information to a third party, such as a drug company. However, providers are permitted to accept payment from a drug company to send their patients letters recommending that they switch to a medication made by the company (Kemper, Los Angeles Times, 8/10);
- Parents have access to their children's medical records, provided that state law permits such disclosure;
- Law enforcement agencies have "relatively unfettered" access to medical records (Washington Post, 8/10);
- Researchers may use medical records to track disease outbreaks if they strip records of patient names and other personal information (Pear, New York Times, 8/10); and
- Researchers who access patient records may use a single form to obtain informed consent and authorization to disclose medical records (HHS release, 8/9).
The new standards supersede "weaker" state laws and regulations concerning medical privacy but do not interfere with "more aggressive policies" in some states (Washington Post, 8/10). Providers who violate the rules, which will take effect April 14, 2003, face fines and prison time (Pugh, Philadelphia Inquirer, 8/11). "The rule protects the confidentiality of Americans' medical records without creating new barriers to receiving quality health care," HHS Secretary Tommy Thompson said, adding, "It strikes a common sense balance by providing consumers with personal privacy protections and access to high-quality care" (HHS release, 8/9). The final rule "appears to bring to a close Congress' years-long effort to establish basic privacy rights for patients," which began in 1996 when the Health Insurance Portability and Accountability Act was approved, the Los Angeles Times reports. The law called for Congress to pass medical privacy legislation by 1999, but after efforts there stalled, the Clinton administration worked to draft regulations, issuing them shortly before President Bush took office. Although Bush had said he would let the Clinton rules stand as issued, lobbying by health plans and other industry members prompted the administration revise the rules in March, the Times reports.
While the Bush administration and other supporters said the rules "strike just the right balance" between protecting patients and the need to share some medical information, privacy advocates said the rules "fall woefully short," the Los Angeles Times reports (Los Angeles Times, 8/10). Joanne Hustead, senior counsel to Georgetown University's Health Privacy Project, said the rules "undermine patient control over private medical information" and "will erode patient trust in the health care system." According to a spokesperson for Sen. Edward Kennedy (D-Mass.), the senator will attempt to strengthen the rules after the August recess. The rules do not require congressional approval to take effect (Washington Post, 8/10).
The following highlights additional reaction to the new rules:
American Hospital Association: In a statement, the association said that the new rule "guarantee[s] strong privacy rights to patients and families in a way that puts common sense ahead of bureaucracy." The statement added, "But no regulation should interfere with a patient's ability to get timely, effective care. The final rule strikes the right balance" (AHA News Now, 8/9).
American Psychiatric Association: APA President Dr. Paul Appelbaum criticized the rules for not including the Clinton administration's written disclosure requirement, saying the new regulation "abolishes the traditional control that patients have had over access to their medical records." He added, "It may discourage patients from revealing information to their physicians that's necessary for their treatment, and it may encourage doctors not to record important but embarrassing information in the patients' medical charts" (New York Times, 8/10).
California HealthCare Foundation: Sam Karp, CHCF's chief information officer, said that although it is "significant" that federal regulations have been issued, "loopholes" in the rules regarding disclose of medical information "will erode patients' trust in the health care system" (Hendricks, San Francisco Chronicle, 8/11).
Health Insurance Association of America: In a statement, Jeff Gabardi, HIAA's general counsel, said the new rule will "inevitably increase the cost of health care ... [which] will hurt consumers." He added, "We hope Congress recognizes the need to keep regulatory costs low and acts to create a uniform national standard" to "pre-emp[t] myriad state privacy requirements" (HIAA release, 8/9).
- Healthcare Leadership Council: In a statement, HLC President Mary Grealy said the Bush administration "deserves credit for modifying" the Clinton administration's proposals to create "tougher rules ... without burdening patients and health care providers with unnecessary paperwork and without placing federal bureaucrats in the position of deciding how doctors and hospitals can use information to treat patients" (HLC release, 8/9).
NPR's "Weekend Edition" on Aug. 10 examined the new medical privacy rules. The report is available in RealPlayer online. This is part of the California Healthline Daily Edition, a summary of health policy coverage from major news organizations. Sign up for an email subscription.