HHS Proposes Easing Consent Requirement in Medical Privacy Rule
HHS yesterday proposed a series of changes to the federal medical privacy rules implemented last year, including a proposal eliminating the requirement that providers, insurers and pharmacies obtain written consent from patients before disclosing their medical records, the Washington Post reports. Instead, the new requirement would state that patients "must at some point be notified about their privacy rights by those who use their records" for purposes such as treatment and payment of claims. The changes would also "loosen" the rules by giving parents greater access to their teenagers' medical records and making it easier for researchers to access patient records. However, they would tighten the regulations by requiring providers to get "explicit permission" from patients before using their records for marketing purposes. The Clinton administration first issued the rules in December 2000. Last April, President Bush announced he would move ahead with the privacy regulations, but indicated he would "modify some rules to make them simpler and less onerous for health care companies and practioners" (Goldstein, Washington Post, 3/22).
In announcing the proposed changes, HHS Secretary Tommy Thompson said that the current consent requirement could have "serious unintended consequences" that would harm or delay access to care. Drugstores, for instance, said that the rules might have prevented them from filling prescriptions phoned in by a physician, while hospitals said they would not have been able to schedule a medical procedure until a patient had read a privacy notice and signed a consent form (Pear, New York Times, 3/22). HHS officials also said that physicians might have faced problems in referring patients to specialists, and paramedics and emergency workers could also have faced complications in treating patients (Zitner, Los Angeles Times, 3/22). Based on these concerns, the proposed changes would instead require providers, insurers and pharmacists to make a "good-faith effort" to obtain written acknowledgement from patients that they had been informed of their privacy rights (Lueck, Wall Street Journal, 3/22). This effort could come after treatment or services begin. Instead of a consent form, patients would sign an acknowledgement that they had seen the privacy policy (Los Angeles Times, 3/22). HHS spokesperson William Pierce said the consent change would eliminate the chance that patients could be "stopped in [their] tracks" from getting treatment for failing to provide consent for the use of records (Washington Post, 3/22). The proposed changes would also specify that the "incidental releas[e]" of private information, such as conversations in hospitals or names listed on a sign-in sheet at a doctor's office, would be permitted (AP/Dallas Morning News, 3/22).
Privacy advocates and some Democrats criticized the consent modifications, while the health care industry, which lobbied the Bush administration to make the changes, praised them. "It's a major step toward creating a workable rule," American Association of Health PlansWashington Post, 3/22). Mary Grealy, president of the Healthcare Leadership Council, added, "We think they've come a long way in striking the right balance between protecting privacy and still making sure people can access the system." But Janlori Goldman, director of the Health Privacy Project at Georgetown University, called the proposed changes a "devastating blow to patient privacy," adding, "If people aren't given a consent form and are required to sign it, chances are likely that they won't know what their right to privacy is and how their personal information is being used" (Los Angeles Times, 3/22). Rep. Edward Markey (D-Mass.) added, "By stripping the consent requirement from the health privacy rule, the Bush administration strips patients of the fundamental right to give their consent before their health information is used or disclosed" (New York Times, 3/22).
Among the other proposed changes outlined by HHS, parents would have easier access to their children's medical records in any state that does not have a law that "specifically guarantees minors their medical privacy rights" (Washington Post, 3/22). The change would give providers the discretion whether to provide parents with their child's records (Los Angeles Times, 3/22). In addition, the changes call for creating "model contracts" for providers to use with business associates with whom they share patients' medical information. The rules also maintain the existing requirement that providers share only the minimum amount of information needed to provide treatment (Wall Street Journal, 3/22). HHS will publish the proposed revisions in the Federal Register next week, after which 30 days will be given for public comment (New York Times, 3/22). The unaltered parts of the regulation, including patients' rights to inspect their medical records and propose corrections, have already gone into effect, although compliance is not required for most groups until April 2003 (Washington Post, 3/22). Health industry representatives want to delay the implementation date until two years after a final rule is issued (Wall Street Journal, 3/22). Violation of the rules could bring civil and criminal penalties up to a $250,000 fine and 10 years in prison (New York Times, 3/22).
This is part of the California Healthline Daily Edition, a summary of health policy coverage from major news organizations. Sign up for an email subscription.