Patient privacy: a policy shift. (Health Policy Update).

The 1996 Health Insurance Portability and Accountability Act (HIPAA) called for new privacy standards to be set by regulation by the U.S. Department of Health and Human Services if Congress was unable to by August of 1999.

Congress missed this deadline and the Clinton Administration issued final regulations in December 1999.

The general requirements of HIPPA were limited to the electronic transactions of health care providers, health plans and health care clearing houses (covered entities) and their business associates. However, the privacy provisions of HIPPA apply to all forms of communication: written, oral and electronic.

The change

The incoming Bush Administration expressed concerns with the regulations as originally proposed but decided to move forward with them anyway and let the door open for the possibility of altering several components of the rule to address their concerns.

Legal analysts believe the administration did not have the authority to simply retract the regulations without demonstrating that they had a reasoned process to change them. One year later, the administration has returned after many internal debates with proposed changes.

The rule in its original form gave patients the right to review their medical records and required written patient consent for the transfer of oral, written and electronic medical information.

It also set criminal penalties for improper disclosure. The original regulations took effect on April 14, 2001, and require most covered entities to be in compliance by April 14, 2003. Small health plans have an additional year to meet the standards.

Concerns voiced by some medical groups included the complexity of the new regulations and fear that the limit on the exchange of information could impede patient care.

Estimates of the cost to implement the rule range from $17.6 billion over 10 years to $40 billion over five years. These high costs at a time of growing medical inflation and shrinking health care dollars created additional concerns.

Belief that the new rule would fundamentally alter the practice of medicine by preventing current practice is another commonly voiced complaint. Practice problems often cited include:

* Prohibiting family members or friend from picking up prescriptions without written consent

* Impeding access to prescription drugs with telephone calls for prescriptions requiring both parties to verify patient consent to the exchange of information

* Delaying the transfer of clinically significant medical information between providers

* Reducing quality assurance efforts by limiting access to medical records for peer review

* Limiting participation in medical research due to concerns about access to records

Alleged abuses by some health and medical companies that use patient information for marketing purposes fueled the debate for increased control over individual patient records.

Disclosures of computerized patient information to marketing companies and patient lists for psychiatric medications as a result of e-mail errors are recent examples.

Proposed rule changes

The proposed changes in the rule include:

* Dropping the consent requirement for health care operation, medical treatment and referral

* Requiring providers to inform patients of their privacy rights

* Requiring patients to acknowledge that they were informed of their rights

* Changing the restriction on exchanging individual patient medical information for the purpose of allowing companies to directly market to the individual patient

Such marketing would allow companies to send information to the patient about alternative medications or therapies based on their medical database. Sharing individual patient information still requires written consent.

* Allowing oral information to be shared between covered entities and clarifying that reasonable effort to protect personal health information from being overheard is an acceptable standard

* Providing templates for the required contract between business associates of covered entities (It also extends the compliance date by one year.)

* Allowing for a single consent form and recognition of the concerns that researchers have about the requirements for the identification process

* Allowing covered entities to use a single type of consent form

* Clarifying that the rule does not trump state law and allowing providers to use community practice standards when the local law is silent

Some patient advocates are concerned that this last change will allow parental access to the confidential portion of their adolescent children's records that have historically been unavailable in many states.

Such records include the confidential portion of the mental illness report, abortion or sexual history and history of sexually transmitted diseases.

Clarifications

The proposed rule clarifies that group health plans and insurers can exchange enrollment information without amending plan documents. It defines what happens to medical information during the sale of a covered entity.

Under the changes, covered entities must account for the disclosure of information that required written authorization. Finally, the proposal clarifies that non-governmental entities under the jurisdiction of the Federal Drug Administration may share personal medical information for patient safety, effectiveness an quality purposes.

The impact

While some privacy experts decry these new changes, many in the medical community believe they are needed relief from a process they believe was unworkable and confusing.

Whether these changes will significantly weaken patient privacy remains to be seen. Continued concern from patients about abuses from marketers could reignite the debate as well as additional disclosures about unauthorized releases of medical information.

Physician executives have a responsibility to ensure the compliance of the health systems by the required dates. HIPAA compliance requires technology changes and a range of behavior changes to ensure patient confidentiality.

The proposed regulation changes will undergo a period of review and comment before they become final. However, significant alterations are unlikely since these changes represent responses to the original comment period.

For more information, visit www.hhs.gov/ocr/hippa/whatsnew.html.

Georges Benjamin, MD, FACP, is the Secretary of the Department of Health and Mental Hygiene in Baltimore, Md. He can be reached by calling 410/767-6505 or by e-mail at [e-mail]