The HIPAAcratic oath: do no harm to patient data. (Implementing HIPAA and Other Compliance Programs).

PHYSICIAN EXECUTIVES who have weathered the storm of Y2K will have ample opportunity to apply their honed skills and lessons learned to the next great system-wide challenge--HIPAA, the Health Insurance Portability and Accountability Act. Passed on August 21, 1996, the act is named for its health insurance portability provisions. However, the section that will impact health care organizations the most will be Title II, Subtitle F, entitled Administrative Simplification, which includes provisions covering privacy protection and system security.

Physician leaders need to familiarize themselves with HIPAA and organize their institutions to plan for and execute a compliance program with the same vigor and system-wide participation as they did for Y2K.

Administrative simplification and privacy protection

HIPAA can be divided into two general categories of mandates: (1) administrative simplification, and (2) privacy and security provisions. The purpose of the administrative simplification subtitle is to improve "the efficiency and effectiveness of the health care system" by setting standards that encourage "electronic transmission of certain health information" (http://aspe.os.dhhs.gob/admnsimp/p1104191.htm).

The provisions of HIPAA apply only to providers, health plans, and clearinghouses (referred to as "covered entities"). The Department of Health and Human Services (HHS) was mandated to set standards for administrative transactions (e.g., claims, eligibility, benefits), code sets (e.g., diagnosis, billing), unique health identifiers (for providers, plans, and patients), security provisions, and electronic signatures. Once HHS issues final regulations, covered entities must comply with the standards for electronic transactions within two years (small health plans will have three years) or they will be subject to a penalty of $100 for each violation up to a maximum of $25,000 in a calendar year.

HIPAA also contained provisions for protecting the privacy of individually identifiable health information. Congress acknowledged that passage of federal legislation was the preferred way to deal with privacy protection. Sensing the challenges, however, Congress wrote a backup plan, giving itself three years to pass comprehensive privacy legislation. Failing that, the act called on HHS to issue privacy regulations within six months of the deadline. Several bills were introduced in both the Senate and the House of Representatives, but bipartisan differences prevented any from being passed by the August 21, 1999 deadline, Consequently, the Secretary of HHS is required to issue privacy regulations.

Penalties for wrongful disclosure of individually identifiable health information include up to $50,000 in fines and one year in prison, or both. If the offense is committed with the intent to sell, transfer, or use health information for commercial advantage, personal gain, or malicious harm, the penalties include up to $250,000 in fines and 10 years' imprisonment, or both. Obviously, the stakes are high. This is an area where physician executives should devote much of their attention.

Rulemaking process and timetable

When issuing regulations, a government agency such as the Department of HHS must post a 'notice of proposed rule making' (NPRM) in the Federal Register and allow the public 60 days to comment. After reviewing feedback, the agency makes revisions it deems appropriate before issuing the final rule.

The initial NPRMs were due February, 1998 (18 months after passage of HIPAA), however, most weren't published until the summer of 1998 (http://aspe.os.dhhs.gov/admnsimp/nprm/txlist.htm). Because of the complexity of the issues, final regulations for the transaction standards haven't been released, although most are expected sometime this year. Many of the proposed administrative standards are commonly used, such as code sets (e.g., ICD-9 CM and CPT-4) and transaction standards (e.g., X12 with payers and NCPDP with pharmacies). Some of the identifier standards are being developed (e.g., national provider and plan identifiers) and will be released soon.

In contrast, during an emotionally charged public hearing, concern was raised that assigning unique health identifiers to individuals would make it easier to link information. Under public pressure, Congress instructed HHS not to pursue defining identifiers for individuals until privacy protections are put in place.

Privacy protections for individually identifiable health information

The single biggest issue that will affect physician executives is the HIPAA mandate to adopt uniform protection of individually identifiable health information. The Secretary published the privacy NPRM on November 3, 1999 (http://aspe.os.hhs.gov/admnsimp/nprm/pvclist.htm). The pro posed regulations represent a significant step forward in privacy protection and incorporate several widely endorsed principles. For example, laws guaranteeing patients the right to examine their medical records would be extended to all 50 states (only 28 states have them currently). The NPRM gives covered entities statutory authorization (i.e., specific patient authorization is not required) to use and disclose information for "treatment, payment, or health care operations."

What constitutes health care operations has been a subject of debate. Some examples include quality assurance, quality management, outcomes evaluation, disease management, peer review, and credentialing. Activities that would be disallowed include using patient information for marketing; sale, rent, or barter; sharing with non-health care sister divisions; determining employment decisions; and fundraising. The NPRM requires covered entities to develop policies governing the use and disclosure of confidential information and to disseminate these to patients. To reduce the risk of disclosing confidential information, personal identifiers should be removed as soon as feasible while maintaining the usefulness of the data.

Improving the protection of confidential health information in the conduct of research is another objective. The proposed regulations call for the use of criteria to weigh the potential benefits of research against the possible invasion of individual privacy. Institutional review boards would be responsible for assessing the merits of a publicly-funded research proposal and an equivalent board would need to be formed to evaluate privately-sponsored research.

Some caveats

What follows are provisions in the privacy NPRM that warrant special attention because of their unintended and intended effects on health care operations.

Covered information

HHS has interpreted their scope of jurisdiction to cover all health "information," that has been, is, or will be stored or transmitted electronically. This is intended to eliminate an obvious loophole, whereby electronically transmitted information could be stored on paper to obviate the need for complying with regulations covering only electronic data.

From a practical standpoint, however, it would be difficult, if not impossible, to segregate information that has been, is, or will be transmitted or maintained electronically from information that exists only on paper. Physician executives should plan on applying the privacy regulations to all data maintained in patient records, the only sensible approach to complying with the spirit of the requirements.

"Opting out"

A controversial topic that plagued many of the bills introduced in Congress is the notion of allowing patients to "opt out" of having certain information stored in their medical record. Physicians recognize that some information may be sensitive and could cause social harm to the patient if it were to be disclosed to unauthorized persons. On the other hand, there are risks to the patient and provider when medical information is excluded from the decision-making process by virtue of its being secreted.

Rather than walking this tightrope between interfering with informed decision-making and placing additional restrictions on access to specific pieces of the record, we need to raise the overall bar of protection and accountability, treating all health information as highly confidential.

An analogy can be made to how policies for universal precautions evolved. In the 1980s, when it became recognized that blood-borne diseases posed a hazard, special precautions were instituted requiring health care workers to wear gloves when working with infected patients. However, we also inadvertently identified patients as having blood-borne diseases, including AIDS. Current policies establishing universal precautions not only improve the protection of health care workers, but also reduce the risk of invading patients' privacy. Likewise, we would help prevent the spread of confidential information by treating all information as highly confidential, instead of encouraging "opt-outs."

Minimum necessary disclosure

Covered entities are required to use the "minimum amount" of identifiable health information for all uses and disclosures. The intent of the provision is well motivated. The operational test to determine whether someone should have access to confidential health information is whether that individual has a professional need-to-know.

The minimum-necessary disclosure requirement is especially important in the era of megamergers. In the past, most laws and regulations covered disclosure (to an external organization) of information. However, when one company acquires another, information exchanged within the new organization becomes unregulated. Hence, a health insurance company acquiring a life insurance company, or vice versa, could make unfair use of health information when determining underwriting decisions on life insurance policies. Similarly, pharmaceutical companies that purchase pharmacy benefits managers would have access to confidential information and could, for example, target certain patients for advertising.

This provision would apply need-to-know tests to internal and external uses of individually identifiable health information. However, controlling access to only the minimum amount of information needed will be difficult to implement using paper records. Ultimately, the only efficient way to comply is by using a computer-based patient record (CPR) system, which can filter information by the user's need-to-know. One reason that the Institute of Medicine declared the CPR an essential technology for health care is because it can increase the protection of confidential patient data. (1)

Business partner contracts

Since the regulations are limited in scope to providers, plans, and clearinghouses, HHS proposed that these covered entities include provisions in their contracts with all business partners to extend privacy requirements. Although well intended, this has the effect of making covered entities responsible for the actions of their business partners, which is neither feasible nor practical.

In addition, the NPRM proposed that patients be designated as "third party beneficiaries" in the business partner contracts. In some states, this creates an opportunity for patients to sue covered entities for harm caused by business partners that violate their privacy. This area needs further study by every organization's legal and risk management teams. A more appropriate solution would be federal legislation that applies equally to all entities that store or transmit health information, not just covered entities.

The HIPAA hole

One of the most glaring loopholes in the privacy NPRM is that, except for providers, plans, and clearinghouses, all other entities that store or use individually identifiable health information are unfettered in their use of confidential data. For example, medical websites routinely gather identifiable health information and their advertisers can identify users and their browsing patterns over multiple websites--for financial gain. Hence, there is a compelling need to pass comprehensive federal privacy legislation to apply protections uniformly to all entities that use or disclose individually identifiable health information.

Preemption of state laws

The regulations act as a "floor" in the sense that they set the minimum standards necessary. Any state statute that is "more restrictive" would supersede the federal regulation. As a consequence, when dealing with entities or patients outside state boundaries, organizations may find themselves faced with conflicting rules.

It is impractical to apply different laws to data depending on the residency of each patient. If federal health information standards do not preempt the patchwork of inconsistent state requirements, covered entities may be reluctant to transmit important clinical data or may attempt to get blanket releases from patients for routine disclosures. The former situation would be detrimental to patient care, and the latter would defeat the purpose of having privacy protection in the first place.

Physician executives must help shape policies that balance the protection of confidential patient data and the need to make informed decisions about treatment, payment, and quality of care.

System security for health information

The National Research Council's report, "For the Record: Protecting Electronic Health Information" (2) defines security as: "the protection of information systems against unauthorized access to or modification of information, whether in storage, processing, or transit, and against the denial of service to authorized users or the provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats." More simply, system security must ensure the integrity of the data stored, limit access to authorized persons only, and provide audit trails of all who access the data.

Importantly, the standards apply to all electronic data--stored or transmitted. Since virtually all health care organizations store some information electronically (for example, lab test results), the security provisions will affect all covered entities. The proposed standards cover four categories (http://aspe.os.dhbs.gov/admnsimp/nprm/seclist.htm):

Administrative procedures include information access controls (who has access to patient data), training on security, internal audit, security incident procedures, termination procedures (for violators of security policies), contingency plans (for threats to data integrity), and certifying compliance with security requirements.

2. Physical safeguards to protect computers and media (e.g., backup tapes) that contain patient data.

3. Technical security services include features implemented in a computer system to control access to information based on the professional role of the user (e.g., physician, nurse, clerk, billing personnel), provide audit trails and ensure data integrity. Special requirements, such as encryption, are mandated for communications occurring over unsecured lines such as the Internet.

4. Where required, an electronic signature must ensure that the user is authenticated, the messages are delivered intact, and the authenticity of the signature cannot be disputed. Currently, an electronic signature isn't required for any of the transactions covered by HIPAA. HHS is expected to work with the Department of Commerce to develop standards.

To comply with these requirements, larger organizations may appoint a security officer with overall responsibility for this area. In smaller organizations, this role may be delegated to the director of health information management or other appropriate person. Although the NPRM for security standards was published in August of 1998, the final regulations are not expected until later in 2000 in order to harmonize the system security requirements with the final privacy regulations.

Conclusion

Implementing the HIPAA-mandated privacy regulations will not be inexpensive. HHS estimates the five-year cost to be about $3.8 billion (http://aspe.os.dhhs.gov/admnsimp/nprm/pvclist.htm) and the health insurance industry projects several times that amount. However unlike the expenditures made to fix the Y2K software bug, which contributed nothing to health care quality this effort will improve the protection of confidential patient identification and, by setting standards for administrative simplification, will improve the overall efficiency of the health care system.

Physician executives can take several steps to prepare their organizations, even while waiting for the final regulations to be issued. As with prior compliance efforts, it is important to educate the board of directors and the management team early about the requirements and how they will impact the organization. Establishing a high-level HIPAA compliance steering committee involving security officers, chief information officers, chief medical officers, and executive administration, health information management, legal, and human resources staff will help disseminate information to the functional areas that will be affected.

Both time and resources need to be budgeted to effectively deal with compliance. Individuals should be assigned to monitor the laws, regulations, and standards that will be emerging throughout 2000. Organizational preparedness needs to be assessed by reviewing applicable policies, confidentiality forms, business partner contracts, procedures, and information systems capabilities.

Although the comment period for the proposed regulations from HHS has ended, the need for federal legislation remains. Physician executives need to educate their organizational leadership, Congress, and their patients about the importance of preserving authorized access to patient information, while offering the highest protection of confidential health information. As guardians of confidential patient health information, we cannot accept the status quo of inadequate privacy protections.

Acknowledgements

I would like to thank Doug Peddicord, who provided many helpful comments on an earlier draft and Steven Lane, MD, who originally dreamed up the phrase "HIPAAcratic oath."

References

(1.) Institute of Medicine Committee on Improving the Patient Record. The Computer based Patient Record An Essential Technology for Health Care, Revised Edition. 2nd ed. Washington, D.C.: National Academy Press, 1997.

(2.) Committee on Maintaining Privacy and Security in Health Care Applications of the National Information Infrastructure. For the Record: Protecting Electronic Health Information. Washington, D.C.: National Academy Press, 1997.

Recommended Resources

1. Committee on Maintaining Privacy and Security in Health Care Applications of the National Information Infrastructure. For the Record: Protecting Electronic Health Information. Washington, D.C.: National Academy Press, 1997.

This Institute of Medicine report contains an analysis of some existing security practices at major health care organizations and provides recommendations for immediate and future security policies and procedures to be adopted. It formed the basis of the Secretary of Health and Human Services' recommendations.

2. Institute of Medicine Committee on Improving the Patient Record. The Computer-based Patient Record: An Essential Technology for Health Care, Revised Edition. 2nd ed. Washington, D.C.: National Academy Press, 1997.

This revised edition of the original report by the Institute of Medicine called for the routine use of computer-based patient records in the United States.

3. The Computer-based Patient Record Institute (CPRI)

CPRI has developed a useful toolkit to help prepare organizations to comply with the proposed HIPAA security regulations (http://healthcare.3com.com/securitynet/hipaa/toc.html).

4. The text of the Health Insurance Portability and Accountability Act of 1996: http://aspe.os.dhhs.gov/admnsimp/p1104191.htm.

5. The text of the proposed HIPAA regulations and privacy regulations: http://aspe.os.dhhs.gov/admnsimp/nprm/txlist.htm and http://aspe.os.dhhs.gov/admnsimp/nprm/pvclist.htm.

Paul C. Tang, MD, FACP, FACMI, FCHIME, is Medical Director of Clinical Informatics at Palo Alto Medical Clinic in Palo Alto, California, and Vice President of Epic Research Institute in Mountain View, California, He can be reached by calling 650/254-5218 or via email at [e-mail].