Medical Privacy in Jeopardy

It’s one of the oldest tricks in the political book. Want to hide an action that you know is going to evoke howls of outrage from the public? Just release the news at a time when the fewest people are likely to be paying attention—say, late Friday afternoon, as everyone is getting ready to leave for the weekend. Better yet, make it a Friday afternoon in August, when a good percentage of the population is already on vacation. Assuming reporters can find anyone to comment, they will have only a few short hours to file their stories for Saturday’s press run (the smallest of the week) or the evening news. By the time Monday rolls around, the story will be old hat. And by Labor Day, when life starts again for real, it will be all but forgotten.

You know it can’t be good news that on a Friday afternoon this past August, the Bush administration released the long-awaited final version of the medical privacy regulations required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). The path taken by the regulations on their way to final approval was tortuous. They grew out of the impasse in Congress over medical privacy legislation in the mid-1990s. Unable to resolve the disputes between those who favored strict privacy for medical information and those who saw opportunities in making it more widely available (and distracted by issues like minors’ access to abortions, which somehow made their way into the debate), Congress decided not to decide.

If no medical privacy legislation were passed after 18 months, HIPAA turned the responsibility over to the secretary of Health and Human Services to develop federal regulations governing the use and disclosure of medical information. HIPAA’s focus was on electronic information—hence the additional regulations on transmission standards and security for electronic data—so technically the privacy standards apply only to entities (including individual practitioners) who transmit data electronically or have others do it on their behalf. But since that category includes records that are word processed and bills sent electronically by a billing agency, and since as long as one uses electronic data in any form, all of one’s records become subject to HIPAA’s regulations, there will not be many psychiatrists or other physicians who will not be subject to HIPAA.

Psychiatrists are particularly sensitive to the importance of medical privacy, and hence APA took the lead for the medical profession in working with Congress to craft reasonable, but protective rules. Former APA President Richard Harding, M.D., and I trekked to Capitol Hill repeatedly over the years to testify at congressional committee hearings. (Dr. Harding has also been an important voice for medical privacy on the National Committee on Vital and Health Statistics, a crucial HHS advisory group.) When the task was turned over to HHS, we worked closely with APA’s Division of Government Relations staff to set up repeated meetings with HHS and White House staff, arguing against some of the more egregious proposals that came along and in favor of maximizing patients’ control over their medical record information.

It has been a long haul, beginning with the Clinton administration’s first white paper outlining its approach. Then came proposed rules, which were subject to extensive comment and a year’s review, and then a set of final rules, initially held up as the new Bush administration took office, before they were ultimately released in April 2001. But the administration soon had second thoughts, and this past spring issued proposed changes to the rules. It was the final version of those changes that were issued late on a clammy Friday afternoon in August in 440 double-spaced pages of detail. As a whole, the regulations become effective April 14, 2003.

Since the regulations will profoundly affect how all of us deal with patients’ medical information, you will read and learn a great deal about them between now and when they take effect. Why sneak them out just before a summer weekend? Undoubtedly, the Bush administration wanted to avoid the criticism it knew was headed its way for its abrogation of the traditional right of patients to determine when and to whom their records can be released. Under the new regulations, records can be shared without patients’ knowledge or consent for a broadly defined set of purposes encompassed by the phrase “treatment, payment, or health care operations.” Patients’ records, particularly as they become computerized, will move around the health care system—and the insurance and related industries—as never before. Law enforcement and other governmental agencies will also have unprecedented levels of access to these records. These were precisely the outcomes that APA worked so hard to avoid.

Nonetheless, there are some positive things about the regulations. Psychotherapy notes have special protections, though they are defined so narrowly that relatively few practitioners are likely to benefit from the rule (for example, such notes must be kept separate from the patient’s treatment record, cannot be used as documentation of the patient’s care, and can contain only limited categories of information). There are new restrictions on the sale of medical information and on its transfer within organizations, like insurance companies, that provide services both related to and not related to health care. The rules governing research are generally reasonable. Patients will have the right to access their records and to request changes if they find mistakes. (I have written a more complete description of the new regulations and of the forces that shaped them that you will be able to read in the American Journal of Psychiatry in the next few months.)

Among the key pieces of information for psychiatrists are that all of us will need to develop written privacy policies for our offices and to prepare notices of privacy practices that will have to be distributed to patients at their first visit. Guidance in dealing with the new regulations is available from several excellent publications that you can find on the AMA Web site at www.ama-assn.org/ama/pub/category/4234.html. ▪