HIPAA privacy: what is the dilemma?

We were asked to respond to the concerns raised by Drs. Herman and Peel regarding the HIPAA privacy rule. In their article they contend:

* Elimination of the consent requirement creates an open book for all Americans' medical records

* HIPAA interferes with the physician-patient relationship and creates new ethical conflicts for physician executives and

* HIPAA privacy notices are inaccurate or incomplete

Recognizing the privacy rule has generated some stress and confusion for physician executives, our conclusion is that the HIPAA privacy rule actually strengthens the physician-patient relationship and offers a new set of tools and resources for physician executives tasked with managing patient privacy issues within their organizations.

Elimination of the consent requirement did not create an open book for all Americans' medical records.

The HIPAA privacy rule granted all Americans a core set of federal rights and protections related to their medical record information while preserving those existing state laws that provide greater rights and protections. These regulations reinforce the long-standing ethical duty of all physicians to maintain patient confidentiality.

The privacy rule provides a national framework from which to meet those ethical obligations while keeping in mind a need for balance between privacy and availability of information for the provision of and payment for health care.

Elimination of the burdensome consent provision is one example of how this balance is being reached. Under earlier versions of the rule, regulators proposed a requirement that mandated written patient "consent" be obtained prior to any use or disclosure of protected health information (PHI). This included exchanges of routine information needed in order to simply make a referral to a specialist, or have a prescription filled.

In the preamble of the December 28th, 2000 final privacy rule, it was acknowledged that, "it would be difficult, if not impossible, for health care providers to treat their patients and run their business without being able to use or disclose protected health information for these purposes (treatment, payment and health care operations)." (65 Federal Register 82649 (Dec. 28, 2000))

After months of discussion and comment from a very broad range of constituents, including providers and patients, a reasonable determination was made that consent would not be required for exchanges for purposes of treatment, payment and health care operations (TPO).

Instead, providers would be required to make a good faith effort to obtain the patient's written acknowledgement (45 CFR [section] 164.520(c)(2)(B)(ii)) of receipt of the notice of privacy practices. The version also emphasized the providers' obligation to use and disclosure only the "minimum necessary" (45 CFR [section] 164.514(d)) information needed to effectuate the care, payment or health care operation associated with that exchange.

This minimum necessary provision provides an added layer of scrutiny to the process of exchanging PHI. Both the "sender" and the "recipient" of PHI, have the burden of not only limiting the amount and type of information exchanged, but also the "use" of that information once exchanged.

The HIPAA privacy rule places much greater constraints on the use and dissemination of PHI than ever existed prior to HIPAA.

Furthermore, the privacy rule requires that prior to every exchange that the covered entity verifies the identity and authority of the person requesting the PHI. This validation process--another added layer of scrutiny--protects the patient from having his or her information disclosed to unintended or unauthorized recipients.

Every covered entity with access to PHI, and every covered entity's business associates, are now subject to voluminous rules and procedures dictating who can receive PHI, how they can receive it, when they can receive it and why they can receive it.

Prior to HIPAA, few states had any procedural protections in place, and even fewer states offered the patient any rights with regard to how their health care information was shared or maintained.

No harm to physician/patient relationship

The privacy rule does not interfere with the physician/patient relationship and does not create new ethical conflicts for physician executives.

Physicians have long dealt with conflicts of interest. No group is more aware of this than physician executives, each of whom must balance the interests of their organization against the interests of their patients and patients' families.

Physicians, indeed, have a duty to their patients first; however, this duty does not allow a physician to simply overlook other obligations to legitimate interests such as family members, hospitalization utilization directors, insurance companies (who pay the bill) attorneys, etc.

Physician executives now have a powerful added tool in their arsenal to protect and maintain patient privacy standards within their organization, as well as additional rules that allow for the protection and limited use of PHI for purposes of health care operations.

The HIPAA regulations provide physician executives with greater authority to assert and maintain privacy standards on behalf of patients and families. Unlike the "Golden Rule," the HIPAA privacy standards impose specific duties and obligations upon all covered entities, including obligations to track the flow of PHI between entities and to provide an accounting to patients and families with respect to the sharing of PHI for any purpose other than TPO.

It is clear that patients will not divulge health care information to physicians if there is no trust. A strong physician/patient relationship is vital to the successful diagnosis and treatment of the patient.

HIPAA's privacy rule--a rule that codifies the obligations of each covered entity to protect and secure all patient information maintained by such organizations--enhances patient and family confidence in the integrity of the physician/patient relationship.

However, the physician's obligation to the patient to provide confidentiality is an ethical obligation that is not absolute.

For example, in the case Tarasoff v. Regents of the University of California (17 Cal. 3d 425, 551 P.2d 334, 131 Cal. Rptr. 14 (Cal. 1976)) the court ruled that a psychotherapist has a positive duty to take reasonable steps to protect third parties from harm, stating "the protective privilege (of confidentiality) ends where the public peril begins."

Physicians are required to report such things as suspected child or elder abuse, gunshot wounds, STDs, or other infectious diseases. SARS, for example, would be a reportable event.

Privacy notices

HIPAA privacy notices should not be inaccurate or incomplete.

"Consumers do not what to be barraged with an excess of paperwork even if the intent is protect their privacy," wrote Rick Pollack of the American Hospital Association in a letter to George W. Bush dated Dec. 4, 2001.

The HIPAA privacy rule requires that each covered entity provide patients with a Notice of Privacy Practices intended to inform patients of the routine uses and disclosures of their health care information and provide them with contact information should they desire more specific information.

Of more importance, patients now have a uniform statutory right to an accounting of those uses and disclosures as well as the right to seek specific restrictions in the use and disclosure of their protected health information.

Health care consumers are overwhelmed with state and federal paperwork required to initiate even the simplest clinical encounter. Patients have limited capacity for additional detail. HIPAA recognizes this and allows patients more access to detailed information should they want or need such detail.

Privacy notices should accurately inform patients as to how their PHI will be used, reflecting both state and federal requirements intended to maintain privacy and confidentiality of those records. If privacy notices do not meet those standards, they are not meeting the intent of HIPAA

It is important for physicians to know their state health laws, as well as the federal privacy laws. However, no law can be written so carefully that it cannot be abused by individuals who choose to act in an inappropriate manner.

Before HIPAA and after HIPAA that remains true. Therefore, it is the ethical duty of all physicians to maintain patient confidentiality and to only allow that information to be used in matters of patient care that promote the interests of the patients.

IN THIS ARTICLE ...

But others say the HIPAA privacy rule actually strengthens protection for patients and improves the physician/patient relationship.

Richard Stubbs, MD, MBA, CPE, FACPE, is vice president of medical affairs at MultiCare Health System in Tacoma, Wash. He can be reached by phone at 253-403-1087 or by e-mail at [e-mail].

[ILLUSTRATION OMITTED]

Laird A. Pisto is Associate General Counsel for MultiCare Health System. He can be reached by phone at 253-403-1186 or by e-mail at [e-mail]

Cherbon VanEtten is the HIPAA Program Manager for MultiCare Health System. She can be reached by phone at 253-403-7244 or by e-mail at [e-mail].

[ILLUSTRATION OMITTED]

By Richard Stubbs, MD, MBA, CPE, FACPE, Laird Pisto, JD and Cherbon VanEtten