|
HIPAA
Questions and Answers [This
analysis of the modified, final federal medical privacy rule
was prepared by Sue Blevins, President, Institute for Health
Freedom and Deborah Grady, Research Associate, Institute for
Health Freedom.
The
full text of this article (which has been slightly
abbreviated, here, for reasons of space), with source
citations, can be found at http://www.forhealthfreedom.org/Publications/Privacy/TruthAbout.html]. Does
the federal medical privacy rule provide consumers greater
control over the flow of their personal health information?
Also, under
the modified, final federal medical privacy rule, health
insurers, doctors, and medical data-processing companies will
not need to get patients' written, informed consent before
sharing patients' personal health information—including past
medical records and genetic information—with many third
parties…. Does the
federal medical privacy rule prevent data-processing
companies, health care providers, health plans and/or
government agencies from compiling individuals' personal
health information in databases without individuals' consent? No, there
is nothing in the rule that prevents data-processing
companies, health care providers, health plans and/or
government agencies from compiling individuals' personal
health information—including genetic information—in
databases without first obtaining individuals' consent. How Does
Congress or HHS Define "Medical Privacy" or
"Privacy"? They don't.
Ironically, while the federal medical privacy rule includes
many definitions, the terms "medical privacy" or
"privacy" are not clearly defined in the rule.6
Instead, a federal committee composed primarily of
fact-gathering experts was given the legal authority to advise
specifically the U.S. Department of Health and Human Services
(HHS) in establishing standards for Americans' medical
privacy.7 Are
patients guaranteed the right to sign private contracts with
their doctors to withhold personal health information from
third parties? No,
patients cannot withhold their personally identifiable health
information from the U.S. Department of Health and Human
Services. In fact, the rule creates a massive federal mandate
that requires every doctor and other health care practitioner
to share patients' records with the federal government—HHS—without
patient consent.8
The federal government even has the right to access an
individual's psychotherapy notes in order to monitor
compliance with the rule.9
Will
patients be guaranteed the right to an accounting of to whom
and when their personal health information was disclosed for
health care services related to their treatment and processing
of health claims? No,
patients will not receive an accounting of to whom and when
their records were disclosed for most health care
services, including activities related to treatment, payment,
or health care operations (a broad definition encompassing
many uses).10
Patients' personally identifiable health information is going
to be flowing over the Internet—without patients'
permission—for purposes related to treatment, payment, and
health care operations. But patients won't even know this is
happening because they won't be able to obtain an accounting
of disclosures for treatment, payment, and health care
operations. Do
President Bush's modifications to the federal medical privacy
rule (published August 14, 2002) strengthen or weaken
Americans' medical privacy? It is
important to note that the Clinton Administration initially
proposed prohibiting doctors and hospitals from getting
patients' consent before releasing their medical information.11
But after receiving more than 52,000 public comments, the
Clinton Administration revised the rule and added a weak,
coercive consent provision. However, the Bush Administration
is legally permitting health insurers, doctors and medical
data-processing companies to release patients' personal health
information without asking patients for their permission.
Instead, these entities can simply provide notices of how the
information will be shared. This policy takes the active
decision-making authority away from patients and shifts it to
doctors and hospitals. This is a major shift away from the
precious health care ethics that we have honored for many
years in this country: the ethics of consent and
confidentiality. In
addition to allowing patients' medical records to be disclosed
for treatment, payment and health care operations, who else
can see patients' records without patients' consent? Under the
Bush Administration's modified rule (as under the Clinton
Administration's final rule), Americans' medical records can
be disclosed for many broadly defined purposes without
patient consent, including, but not limited to, the following:
Why
was the federal medical privacy rule created in the first
place? The federal
medical privacy rule was established as dictated by the Health
Insurance Portability and Accountability Act of 1996 (HIPAA)
that fosters the development of a national health information
network through standardized codes for all health care
services nationwide.15
The HIPAA law requires health plans to use national
standardized codes for electronic transactions for payment of
medical care. The HIPAA law additionally requires that unique
health identifiers be assigned to four groups, including
every: (1) individual, (2) health care provider, (3) employer,
and (4) health plan.16 Those
identifiers will facilitate electronic transactions for all
types of health care, whether services are paid by government
or privately. (Note: the individual identifier has been put on
hold temporarily.) The result will be that each patient's
visit to a doctor or hospital will be easily tracked. It is becoming increasingly simple to transfer electronic medical records over the Internet. With just a click of a mouse, it will be much easier to access and share individuals' records with many third parties. That is why all Americans should become informed about the federal medical privacy rule and demand the right to control their most personal information—their health information, including genetic information. |
No,
under the modified, final federal medical privacy rule,
patients will not be in control of deciding whether they want
health insurers, doctors, and medical data-processing
companies to share their personal health
information—including genetic information—with others.
Rather, health insurers, doctors and medical data-processing
companies were granted "regulatory permission" to
share patients' health information for any activities related
to patients' health care treatment, processing of their health
care claims, or "health care operations"—a term
which encompasses many activities unrelated to patients'
direct care (such as fundraising and permitting government
officials to search patients' medical records looking for
fraud and abuse activities).4