Proposed HIPAA changes draw fire and support
Although the Department of Health and Human Services (HHS) has tried to position proposed changes to health privacy regulations as necessary to ensure strong privacy protections and correct unintended consequences, it has drawn fire from those concerned about patient privacy. But some provider representatives have said the changes are necessary.
HHS Secretary Tommy Thompson says the changes would accomplish the following:
- Strengthen notice provisions and remove consent requirements that hinder access to care
- Maintain the "minimum necessary" rule, while allowing treatment-related conversations among health care professionals
- Assure appropriate parental access to their children’s records
- Prohibit use of records for marketing, while allowing appropriate communications
- Assure privacy, without impeding research
- Provide model business associate provisions
- Simplify authorizations
"The president believes strongly in the need for federal protections to ensure patient privacy, and the changes we are proposing . . . will allow us to deliver strong protections for personal medical information while improving access to care," Mr. Thompson explained.
But the Health Privacy Project, a private research and monitoring organization in Washington, DC, takes a dim view of the proposed changes. "Although the HHS press release claims that the department’s proposed changes to the [Health Insurance Portability and Accountability Act] HIPAA privacy rule would tighten the marketing provisions, the changes actually make it easier for health plans and providers, like chain drug stores, to engage in activities that a consumer would consider marketing without first asking for permission. HHS proposes an authorization requirement for the use and disclosure of health information for marketing purposes, but the new expansive definition of what is not marketing leaves very few marketing activities subject to this authorization requirement," the group said in a call for consumers to write letters of protest.
Health Privacy Project founder Janlori Goldman tells State Health Watch the group is "extremely concerned that the department is proposing to gut the privacy regulations." Her reading is that HHS would eliminate the requirement completely for patient consent, one of the key provisions relating to release of health information.
"That provision already was too weak because doctors could condition care on getting consent for release of information. HHS is saying it is too burdensome to doctors, so the consent provision has to be eliminated. We’re urging that it keeps the requirement and fix the problems in a more targeted way."
Another key provision that would be changed, Ms. Goldman says, is the marketing provision that also was too weak in its original form because it gave marketers one free shot at patients before they could opt out of receiving additional materials. While the HHS proposed change would require an upfront initial authorization, the trade-off is that they would re-label a lot of what are considered marketing activities and call them treatment activities that don’t require patient consent.
An example she cites is when a pharmacy wants to send letters to patients suggesting that they consider switching the antidepression drug they are taking. (Pharmacies often are hired by drug companies to send such letters.) Ms. Goldman says most consumers would consider such a letter to be a marketing tool rather than a treatment tool.
"I don’t think there’s any malice on the part of HHS staff, but we’re concerned that their explanation of the changes is very misleading," she tells State Health Watch. "What people care about most at the core of the law is now in danger. The regulations, as initially finalized, had significant limitations and weaknesses, and it’s disturbing that they now want to weaken them even further."
Support for the changes came from the American Association of Health Plans in Washington, DC, whose president and CEO Karen Ignani says that the proposal addresses many concerns that were raised with the agency.
"With these proposed modifications, the administration has taken a major step toward crafting a balanced, workable rule that will protect the privacy of patients without undermining their health care," she explains.
"While these modifications will substantially improve the overall rule on medical privacy, several concerns remain. First, we urge the administration to continue to work toward establishing uniformity so that confusion and inconsistency between the federal rule and the individual laws of 50 states do not complicate the ability to provide quality health care. Second, the April 14, 2003, deadline for implementing this rule does not take into account the enormous undertaking of overhauling administrative systems across the health care system, a process that will require substantial time and resources," Ignani says. "We urge the administration to work with health plans and providers on a transition schedule that reflects the challenges we all face in implementing these rules."
A California HealthCare Foundation survey of 100 health care organizations operating in that state concluded that some changes are needed to implement the rule successfully, but eliminating major components is not warranted.
The foundation said key responses included:
- Planning for compliance is progressing, although implementation progress varies.
- The minimum necessary requirements are "somewhat workable."
- Health care organizations believe the consent and minimum necessary requirements limit access to information needed for quality assessment.
- Health care organizations view the business associates provision as "burdensome."
- Health care organizations need additional resources to analyze preemption of state medical privacy rules by HIPAA.
- Health care organizations have not allocated resources to fund compliance efforts completely.
- There is a "general need" for clarification and/or modifications to the rule.
Provider pros and cons
On the physician side, Donald Palmisano, American Medical Association (AMA) secretary-treasurer, says doctors are concerned that HHS is proposing to remove the patient consent requirement rather than modifying it to make it more workable.
"If the final privacy rule will be issued without a consent provision, the AMA urges the administration to strictly limit the activities for which patient information could be used without consent," he says.
"Right now, patient information can be used without consent for a wide range of business activities . . . and there is no incentive to de-identify patient records. De-identified information should be used whenever possible to best protect patient privacy," Palmisano adds.
However, other provider groups, such as the American Academy of Family Physicians, the American Academy of Nurse Practitioners, and the American Academy of Physician Assistants, said they supported the proposed changes, including elimination of the prior consent provision. They said the changes strike a fair balance between protecting privacy and autonomy of patients and removing unnecessary barriers to health care delivery.
At a Senate Health, Education, Labor, and Pensions Committee hearing on the proposed changes, Democratic committee members were harsh in their criticism, while department officials defended the steps they want to take.
Committee chairman Edward M. Kennedy (D-MA) called elimination of the prior consent requirement a "serious step backward" for patient privacy. But Claude Allen, HHS deputy secretary, contended that "mandating consent is coercive [and] a hurdle to health care."
The prior consent provisions would have required providers to obtain written consent from patients before using their personal information for treatment, payment, or other health care operations. Under the revised plan, health care organizations would only have to notify patients of their privacy rights. Mr. Kennedy also said changing the definition of marketing would create a "major loophole." He threatened to introduce legislation to reinstate the prior consent requirement if it is dropped from the final rule, and Sen. Ernest Hollings (D-SC) introduced a bill to require on-line businesses to get users’ permission before collecting medical information or other sensitive data.
"You may think privacy rights are the major overriding issue," Mr. Allen told the committee. "But we stepped back and concluded that it’s far more important that we do nothing to impede access to care. Having privacy means little if you don’t have access to care."
[For HHS information about the HIPAA changes, go to www.cms.gov.
Contact Mr. Goldman at (202) 687-0880, Ms. Ignani at (202) 778-3200, and Mr. Palmisano at (202) 789-7447.]
You have reached your article limit for the month. Subscribe now to access this article plus other member-only content.
- Award-winning Medical Content
- Latest Advances & Development in Medicine
- Unbiased Content