Bush Angers Patient Advocates With Plan to Ease Privacy Rule

The U.S. Department of Health and Human Services (HHS) proposed several revisions to the medical privacy rule last month, the most far-reaching of which would eliminate the patient-consent requirement for use or disclosure of medical-record information. Specifically, the change would delete the requirement that physicians, HMOs, and other treatment entities obtain written consent from their patients before using or disclosing medical information for treatment, payment, or other health care functions.

HHS Secretary Tommy Thompson said the reversal on the patient-consent mandate last month was justified because the requirement would have “created serious unintended consequences that would interfere with patients’ access to health care.”

The requirement was so burdensome, he suggested, that patients could have been required to visit a pharmacy in person to sign paperwork before a pharmacist could fill out a prescription. “Doctors could refuse to treat patients who refused to sign their privacy consent form,” said Thompson.

Instead, under the revised rule HHS proposed in March, physicians and other clinicians would have to notify patients about their privacy rights and make “a good-faith effort” to have patients acknowledge that notification in writing. “But, doctors could treat them even if they did not” provide such an acknowledgement, said Thompson.

The proposed change is strongly opposed by APA, which has long held that patient consent is necessary before medical information is released.

President-elect Paul Appelbaum, M.D., said, “APA has long seen confidentiality as the foundation of the therapeutic alliance between patients and their psychiatric physicians. Patients, and not the government, should control the release of their medical information. Whether by written or oral means, patient consent should always be required prior to disclosure of medical information.”

Sen. Edward Kennedy (D-Mass.), chair of the Health, Education, Labor, and Pensions Committee, said that this proposed change would “wipe away the most important protections an individual had—their ability to say no to sharing their medical records.” Kennedy vowed to hold hearings on the HHS-proposed revisions this month. He also promised to introduce legislation to maintain the stricter privacy protections in the original rule.

Another proposed change to the medical privacy rule would allow parents access to their children’s medical records in states where the laws are “silent or unclear. This would allow a health care provider to use discretion to provide or deny a parent access to such records,” said Thompson.

Appelbaum said, “APA is concerned about parental access to information regarding psychiatric treatment, reproductive issues, and other sensitive areas of physician-patient interaction. This would give parents who may not place their children’s interests above their own interests access to their children’s medical records.”

APA had praise for another change HHS proposed, however, one that would improve the marketing provision by requiring patient authorization to use and disclose health information for this purpose.

The proposed rule would give health care providers an extra year—until April 2004—to rewrite their contracts with business partners to ensure that patient privacy is protected. Other aspects of the rule have to be complied with by April 2003. However, the AMA and APA objected to the “business associate” provision because it requires health care providers to report or correct patient-privacy violations by their business partners or terminate their contract with them.

The revisions to the rule would not pre-empt state laws that have stronger patient privacy protections, according to Angela Choi, field director at the Georgetown University Health Privacy Project.

Numerous state laws require patient authorization to disclose personal health information but make exceptions for treatment and payment purposes, according to a report by the Health Privacy Project.

Some states, however, have stronger privacy laws for specific health conditions than what the rule proposes, which would not be pre-empted, according to Choi.

The rule requires, for example, patient authorization before a physician can release psychotherapy notes to third parties. By contrast, Oklahoma, for example, requires patient authorization before releasing all medical records and communications between a physician or psychotherapist and patient.

Though modified, HHS kept the “minimum necessary” provision, which requires health care providers, plans, and clearinghouses to “make a reasonable attempt” to limit the amount of individual health information disclosed to other parties “to accomplish the intended purpose.”

Another proposal in the rule eliminates the need for researchers to use multiple consent forms. Instead, researchers can use a single combined form to obtain informed consent and to inform subjects of their privacy rights, according to HHS.

Health care providers, plans, and clearinghouses could develop and use a standardized authorization form to obtain a patient’s permission for a specific use or disclosure not permitted under the revised privacy rule, according to HHS.

APA is analyzing the proposed revisions and will submit a comment letter to HHS. The proposed rule was published in the March 27 Federal Register for a 30-day period in which the public can comment to HHS. This contrasts with the 60-day comment period it usually allows. The agency explained that the shortened period was necessitated by the need to incorporate and publish any regulatory revisions before the privacy rule’s previously announced effective date of April 14, 2003.

This is the second comment period HHS has requested on the medical-privacy regulations under the Bush administration. Although the rule was finalized in December 2000 under the Clinton administration, Thompson requested an additional comment period in March 2001, soon after he became HHS secretary.

Information about the Bush administration’s proposed changes to the rule on medical-record privacy is posted on the Web at www.hhs.gov/ocr/hipaa/whatsnew.html. ▪