HHS proposes changes to federal privacy regulation
Proposal removes patient consent requirements
The Bush administration has proposed changes to the federal privacy rule, to the relief of some pharmacy and hospital advocacy groups.
The proposed changes, announced by the U.S. Department of Health of Human Services (HHS) in March, will "ensure strong privacy protections while correcting unintended consequences that threatened patients’ access to quality health care," according to HHS Secretary Tommy G. Thompson. The regulations, which were released Dec. 20, 2000, are part of the requirements of the Health Insurance Portability and Accountability Act (HIPAA) of 1996. These regulations were designed to limit the nonconsensual use and release of private health information and to give patients rights to access their medical records and to know who has access to them.
The proposed change most likely to affect hospital and health care system pharmacists involves removing the consent requirements for treatment, payment, and health care operations while strengthening requirements for providers to notify patients about their privacy rights and practices. HHS says it had received comments saying that the consent requirements in the current rule interfere with pharmacists filling prescriptions, referrals made to specialists and hospitals, treatment provided over the telephone, and treatment provided by emergency medical providers.
In the proposed change, patients would be asked to acknowledge the privacy notice, but doctors and other providers could treat them if they did not. This change would ensure that patients can consider a provider’s privacy policies before making health care decisions, but would eliminate barriers to patients’ access to care, according to HHS.
"The consent becomes optional so that health care providers could use information for treatment, payment, or health care operations," explains Susan C. Winckler, RPh, JD, group director of policy and advocacy for the American Pharmaceutical Association (APhA) in Washington, DC.
"The hospital likely will get a consent," she says. "At a minimum, it will share with the consumer the notice of privacy practices — this is the important part. So consumers do have access to information about how their information will be used. That will likely be done by the hospital for all of the hospital entities, including the pharmacy.
"It’s a change that is appropriate and really necessary to have health care continue," Winckler says.
The American Hospital Association (AHA) in Chicago is pleased with the proposed change as well. "Replacing the redundant requirement that patients sign a written consent form for routine uses of their information with a simple but effective written acknowledgement is a common-sense way to enhance patient privacy," writes Dick Davison, president of the AHA, in an editorial/opinion article in USA Today. AHA has called on 164 lawmakers who advocated changes to the privacy rule last year to reiterate their support to HHS.
Others are not so happy with the proposed change. Sen. Edward Kennedy (D-MA) says the administration has "effectively gutted the cornerstone of the medical records privacy regulation" by proposing the change to the consent requirement. "There are few issues of privacy more important than the right to keep information about one’s own personal health private." Kennedy, who accuses the Bush administration of putting the interests of corporate America first, intends to hold hearings on the issue and to introduce legislation to reverse this "ill-considered" action.
Privacy groups sounded off, as well. "The elimination of this prior consent requirement strikes at the very heart of the privacy regulation," according to a statement issued by the Health Privacy Project, Georgetown University, Washington, DC. "HHS could have fixed certain unintended consequences of the consent requirements [for example, the impact on filling prescriptions] with more targeted changes, but the department chose instead a more radical and unfortunate approach. This proposal not only eliminates the consent requirement, but it also fails to require that patients acknowledge receipt of the privacy notice."
The American Medical Association (AMA) in Chicago also is concerned that the administration is removing the patient consent requirement instead of modifying it. "If the final privacy rule will be issued without a consent provision, the AMA urges the administration to strictly limit the activities for which patient information could be used without consent," says Donald J. Palmisano, MD, JD, AMA’s secretary-treasurer. "Right now, patient information can be used without consent for a wide range of business activities, including underwriting, and there is no incentive to de-identify patient records. De-identified medical information should be used whenever possible to best protect patient privacy."
The AMA has been supportive of the idea of the prior written consent in part because in many of their operations, they do secure the prior written consent, Winckler says. "Unfortunately, that reality does not exist for much of the health care system. I have heard their opinion. It’s simply one with which we disagree."
The administration is trying to come up with a good solution, and APhA thinks the administration has found one, she continues. "They have actually done a good job in trying to protect the privacy without disrupting care. There are folks who disagree with that. We will see where things go. It is certainly a better proposal than the [current] final regulations."
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content