April 12, 2001 (Washington) -- The rules of the healthcare game are going to change for every American starting on April 14. That's when new patient privacy rules go into effect after a decade of arguing about how extensive these protections should be.
"For the first time, patients will have full access to their medical records and more control over how their personal information will be used and disclosed," said President George W. Bush in a statement announcing the regulations Thursday. The rules were imposed during the waning days of the Clinton administration.
Originally, Health and Human Services Secretary Tommy Thompson put the regulations on hold for 60 days after the controversial proposal had received some 24,000 comments. Many of the complaints came from healthcare providers who insisted the requirements imposed an undue burden and that carrying them out would generate tremendous costs.
However, in the end, the Bush administration opted to appease patient concerns about the potential breach of sensitive medical information. "The president considers this a tremendous victory for American consumers, who will continue to receive high-quality health care without sacrificing the confidentiality of their private health matters," Thompson said in a statement.
While the law goes into effect on Saturday, providers have two years to comply with the following requirements:
- Patients can access and control the release of their medical records.
- Doctors and hospitals will face specific limits about how they can use healthcare data, especially information about payment and treatment.
- Law enforcement officials are also subject to restrictions on data release.
- Federal penalties can be imposed for misuse of medical information.
- Privately funded researchers must meet the same privacy standards as their public counterparts.
"This is the biggest privacy law that we have seen in decades," Janlori Goldman, JD, who heads Georgetown University's Health Privacy Project, tells WebMD.
Frank Torres, legislative counsel of the 4.5-million member Consumers Union, was surprised but pleased by the move. "The biggest plus for the consumer is now they have some reasonable protections put in place to help ensure that your private medical information doesn't get shared by your healthcare provider ... without you knowing about it, without your ability to put a stop to it," he tells WebMD.
However, bigger isn't necessarily better if you're a medical provider. Though the American Hospital Association (AHA) says it endorses a federal privacy law, the group claims this one won't work. "[The Department of Health and Human Services] has micromanaged these regulations without really a thorough understanding of the industry ... and that's why these regulations are fraught with unintended consequences," Melinda Hatton, vice president and chief legislative counsel of the AHA, tells WebMD.
Even to implement the basics, Hatton says, it would cost the industry some $22 billion over five years. The high price tag would result in part from the need to revise the current information technology system. Computers would have to be re-tooled so only the right people had access. New programs would be needed to keep track of all medical disclosures.