Patient Privacy Rules -- What Is Going On in Washington?

From the WebMD Archives

March 23, 2001 (Washington) -- It's not only unclear what is happening with "final" federal patient medical privacy rules, it's tough to get people to agree on what the rules would do.

Welcome to another full-on Washington war of words, with talk on one side of the "unintended consequences" of the rules and countercharges that these objections are "misinformation" to kill off the new requirements.

According to Robert Heird, senior vice president for Anthem Blue Cross and Blue Shield, the rules as written would "harm consumers" since they would "slow the delivery and payment of care." The rules, he claimed, "will require a major reorganization of every doctor's office, hospital, pharmacy, laboratory, research facility, and health plan."

But Janlori Goldman, a privacy advocate who heads Georgetown University's Health Privacy Project, tells WebMD, "The industry is putting a full-out assault on the regulation, and they have a receptive ear" with the Bush Administration.

She adds, "We [must] not be swayed by distortions and exaggerations. I think that consumers have a lot to be concerned about right now, looking at how hospitals and health plans and pharmacists are resisting. I just think they [providers] don't want to be regulated. It will cost money -- there's no question."

The new standards, in the works for years, had been published in "final" form in the last weeks of Clinton's term in office last year. They establish for the first time a national right to privacy over individual health information.

Under the rules, patients would have the right to see and amend their medical records. Moreover, they would have more authority over the use of their health information; patients would have to give a one-time consent before their records could be used for treatment, payment, and other healthcare operations.

The rules apply to doctors and other healthcare providers, health plans, and companies that process and transmit claims data.

The regulations do not, however, allow consumers to sue over breaches of their privacy, and does not directly apply to others who may handle patient health information, such as life insurers and employers. And advocates of the rule said that it doesn't offer adequate protections in some areas, by allowing law enforcement relatively easy access to patient records, and permitting limited use of personal health information for fundraising and marketing efforts.


The requirements are supposed to go into effect on April 14 -- most providers would then have two years to comply -- but that date may well slip.

Pres. George W. Bush's Health Secretary Tommy Thompson has opened up the rules for additional public comments; in the coming weeks, the Administration may delay the effective date and rework the rules.

According to CVS pharmacy executive Carlos Ortiz, who testified Thursday at a congressional hearing on the rules, the standards would require pharmacies to obtain written consent from patients before filling any of their prescriptions. The rules are a "prescription for chaos," he said, since 40% of prescriptions are dropped off and picked up by someone other than the patient. To continue serving patients, CVS would have to prepare patients for the written consent requirement. That would cost more than $60 million, Ortiz claimed.

Not true, says Goldman, who also participated in Thursday's hearing. She tells WebMD, "They are overreacting. For prescriptions to be filled and for relatives to pick up prescriptions, the government intended that, and they say that [in the rule]."

Moreover, she says, pharmacies are not directly treating patients and do not need to get written consent. "If the doctor gives the prescription to the pharmacist, or if they send it with a patient, that then creates an indirect treatment relationship," she says.

According to John Clough, MD, director of health affairs for the Cleveland Clinic Foundation, by requiring that patients give their consent for release of their records, "routine practices by providers will be disrupted, from sending out reminder notices about appointments to conducting disease management and maintaining quality assurance programs."

But Goldman tells WebMD, "The regulation is very clear that you can get consent as it's practical to get it after the two-year period, that you get it as you can get it. The next time a patient comes in for care, you can get it. In the meantime, you can use their information."

Health providers are also raising cost concerns. John Melski, MD, a medical director at Wisconsin's Marshfield Clinic, said, "We will have to explain the consent and notice to each patient. We wonder who will explain these forms to our patients. We suspect that we will need to hire and train informed consent counselors who must staff our regional centers on a full-time basis."


On the other hand, Mary Foley, president of the American Nurses Association, said Thursday, "The concern for our patients must be our overriding concern, not whether the rule will be inconvenient for hospitals or practitioners or staffers who handle insurance paper work."

Rep. Michael Bilirakis (R-Fla.), who chaired Thursday's hearing, said he was concerned that the rule would divert dollars from patient care into compliance efforts.

But earlier this week on Tuesday, several dozen Democratic lawmakers wrote Thompson urging that the rules go into effect. According to the letter, "Further delay of these crucial protections would be a major setback in years of effort to grant Americans the privacy they have demanded for so long."

WebMD Health News
© 2001 WebMD, Inc. All rights reserved.