HHS Proposes Easing Consent Requirement in Medical Privacy Rule
HHS yesterday proposed a series of changes to the federal medical privacy rules implemented last year, including a proposal eliminating the requirement that providers, insurers and pharmacies obtain written consent from patients before disclosing their medical records, the Washington Post reports. Instead, the new requirement would state that patients "must at some point be notified about their privacy rights by those who use their records" for purposes such as treatment and payment of claims. The changes would also "loosen" the rules by giving parents greater access to their teenagers' medical records and making it easier for researchers to access patient records. However, they would tighten the regulations by requiring providers to get "explicit permission" from patients before using their records for marketing purposes. The Clinton administration first issued the rules in December 2000. Last April, President Bush announced he would move ahead with the privacy regulations, but indicated he would "modify some rules to make them simpler and less onerous for health care companies and practioners" (Goldstein, Washington Post, 3/22).
Privacy advocates and some Democrats criticized the consent modifications, while the health care industry, which lobbied the Bush administration to make the changes, praised them. "It's a major step toward creating a workable rule," American Association of Health PlansWashington Post, 3/22). Mary Grealy, president of the Healthcare Leadership Council, added, "We think they've come a long way in striking the right balance between protecting privacy and still making sure people can access the system." But Janlori Goldman, director of the Health Privacy Project at Georgetown University, called the proposed changes a "devastating blow to patient privacy," adding, "If people aren't given a consent form and are required to sign it, chances are likely that they won't know what their right to privacy is and how their personal information is being used" (Los Angeles Times, 3/22). Rep. Edward Markey (D-Mass.) added, "By stripping the consent requirement from the health privacy rule, the Bush administration strips patients of the fundamental right to give their consent before their health information is used or disclosed" (New York Times, 3/22).
Among the other proposed changes outlined by HHS, parents would have easier access to their children's medical records in any state that does not have a law that "specifically guarantees minors their medical privacy rights" (Washington Post, 3/22). The change would give providers the discretion whether to provide parents with their child's records (Los Angeles Times, 3/22). In addition, the changes call for creating "model contracts" for providers to use with business associates with whom they share patients' medical information. The rules also maintain the existing requirement that providers share only the minimum amount of information needed to provide treatment (Wall Street Journal, 3/22). HHS will publish the proposed revisions in the Federal Register next week, after which 30 days will be given for public comment (New York Times, 3/22). The unaltered parts of the regulation, including patients' rights to inspect their medical records and propose corrections, have already gone into effect, although compliance is not required for most groups until April 2003 (Washington Post, 3/22). Health industry representatives want to delay the implementation date until two years after a final rule is issued (Wall Street Journal, 3/22). Violation of the rules could bring civil and criminal penalties up to a $250,000 fine and 10 years in prison (New York Times, 3/22).This is part of the California Healthline Daily Edition, a summary of health policy coverage from major news organizations. Sign up for an email subscription.