Congress still racing to meet looming privacy law deadline
June 4, 1999 3 minutes read
Could end up in hands of HHS
Congress still racing to meet looming privacy law deadline
A Healthcare InfoTech Staff Report
Congressional efforts to beat this summer’s deadline for passing medial record confidentiality legislation suffered a setback last week when the Senate Committee on Health, Education, Labor and Pensions postponed consideration of the issue until June 9.
That gives Congress only a few short weeks before and after the July 4th recess to settle outstanding issues. If Congress fails to pass a bill, the Health Insur ance Portability and Accountability Act (HIPAA) of 1996 will pass the torch to the Department of Health and Human Services (HHS), which would have until next year to come up with final regulations on its own.
Don Asmonga, government relations director at the Washington office of the American Health Information Management Association (Chicago), said, "They are busy drafting those regulations as we speak."
A major stumbling block that surfaced last week was an effort by Sen. Ted Kennedy (D-MA) to make it harder for healthcare investigators to acquire patient medical records. "The current drafts still allow law enforcement to use tools that don’t require judicial oversight, such as an administrative subpoena," explained Kennedy aide Jim Manley. "There are also no limitations on the use of the information that is gathered."
The Department of Justice (DOJ) is trying to avoid those restrictions. John Bentivoglio, special counsel for health care fraud at DOJ, recently told the same committee that in many cases DOJ’s ability to investigate and prosecute serious crimes including healthcare fraud will turn on its ability to obtain "individually identifiable health information in a timely and appropriate manner."
As an example, he cited the need to conduct "a comprehensive review of patient medical charts" in a potential investigation of a hospital suspected of billing health insurance plans for services that were never provided.
Among the three bills currently vying for the top spot, only the one sponsored by Sen. Patrick Leahy (D-VT) would require law enforcement officers to obtain a court order before gaining access to medical records. Leahy’s bill would also prohibit law enforcement agencies from using medical records as part of any centralized law enforcement database. The other two front-runners bills sponsored by Sen. Robert Bennett (R-UT) and Sen. Jim Jeffords (R-VT) would give law enforcement much wider latitude.
But that’s not the only issue that has Congress stymied. Another question is whether or not the bill passed by congress should override existing state privacy laws. The bills sponsored by Bennett and Jeffords would essentially blast existing state laws, but Leahy’s bill would not.
Multi-state health care providers say a patchwork of state and federal regulations in this area would spell disaster. Already, they point out, the draft bills each approach 100 pages. And that’s before HHS turns those laws into regulations.
A third issue is "private right of action," says Asmonga. "The Democrats want a private right of action where somebody could sue an institution for wrongful disclosure of health information," he reports. "But that is something that is going to be a tough sell in the Republication conference."
Doug Peticord, a health care information expert with Health Advocates (Washington), reports that a new feature added to the Senate’s privacy bill is the requirement for an Information Protection Officer. "This would mean that every hospital and provider group would have to designate a person with the authority and obligation to establish and maintain safeguards over the confidentiality of patient information," he said.
"I think it is a good idea for every institution to have somebody assume this role right now if they have not already done so," Peticord added. "Even if this concept gets dropped from the bill itself, it is a step that makes a lot of sense."
Bob Gelman, of Gelman & Associates (Washington), said that security requirements providers will have to live by have already been outlined under HIPPA regulations. "Institutions don’t have to wait for that to become final because those regulations are probably not going to be much different than the draft regulations," he said. "That is where a lot of time and money and effort will be required."
As of now, it seems to be anyone’s guess whether Congress will sort these issues out in time to meet the Aug. 21 deadline. If it doesn’t, federal lawmakers might try to extend their deadline until the end of the year, but the Clinton Administration could always eliminate that option with a presidential veto.
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content