Congress is likely to enact federal legislation that will pre-empt state confidentiality, for better or worse

Otherwise, expect HHS Secretary Donna Shalala to dictate regulations that offer compromises

Activists on both sides of the issue say it is likely that federal legislation soon will pre-empt state confidentiality laws regarding medical records, but they differ sharply on whether that is going to be a good or a bad thing. Depending on whom you listen to, federal pre-emption could be either a big step forward from a mishmash of state laws that sometimes don’t offer enough protection, or a concession to managed care plans that will rob patients of much of their privacy rights.

Efforts to enact federal legislation that would somehow pre-empt state confidentiality laws have been around for years, starting as early as the Carter administration. In the 1980s, the federal government offered a model of uniform state legislation that could be enacted to eliminate differences among states, but states did not adopt the model. The 105th Congress toyed with the idea again by trying to pass several bills that would have involved creating federal laws that usurp state confidentiality laws, but the bills did not pass before the session ended.

Deadline may force action

It looks now as though the next session of Congress will see some sort of action on the issue. Most observers say either Congress will pass a law that pre-empts federal legislation, extend the deadline it is under for addressing confidentiality concerns, or punt the matter to the Secretary of Health and Human Services (HHS).

A deadline imposed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) will force some resolution of the issue, said Kathleen Frawley, J.D., M.S., R.R.A., vice president of legislative and public policy services with the American Health Information Management Association in Washington, DC. HIPAA requires Congress to pass legislation regarding uniform state confidentiality laws by August 1999.

"I’ve been involved in this issue for seven years and I’m surprised that it is taking this long to get something done on a federal level," Ms. Frawley said. "We’ll probably get something done in the next Congress because they have to. They could extend the deadline, but if they can’t settle on legislation, I think they’re more likely to let the Health and Human Services secretary do it."

If Congress hands the issue off to HHS Secretary Donna Shalala, the result may be a change that falls somewhere between the extremes of the debate. In her recommendation to Congress required by HIPAA, Ms. Shalala said on Sept. 11, 1997, that the country needs a new national standard for protecting the privacy of health information. She went on to say that, under her recommendation, "This new national standard would not limit or reduce other stronger legal protections for confidentiality of health information. Stronger state laws (such as those covering mental health and HIV infection and AIDS information) would continue to apply."

Federal law and state law would apply simultaneously so that if either forbade disclosure of the information, it could not be disclosed. The goal would be what Ms. Shalala calls "floor pre-emption" of state laws so that everyone is assured the protection afforded in the federal law. But in some cases, they would be afforded an extra measure of protection from their own state laws.

"Floor pre-emption" is a goal that seems acceptable to those on both sides of the debate, with some seeing it as the most they would accept and others seeing it as the least they would accept. On one side of the debate is Donald Palmisano, M.D., J.D., a member of the American Medical Association Board of Trustees and a surgeon in New Orleans. Representing the official views of the AMA, Mr. Palmisano is a strong opponent of any measure that would threaten the privacy of medical records. He says floor pre-emption might be the way to settle the debate.

"We have seen bills so far that handled the issue in different ways, with some establishing a ceiling and some establishing a floor," he said. "We say it must be a floor. We support efforts that improve the protection of medical information, but some of the proposals have sacrificed some state confidentiality laws in favor of uniformity. Uniformity is not sufficient cause to weaken a state’s laws."

The AMA could support federal legislation that would establish more privacy protection than is currently found in any state, but Mr. Palmisano says that is unlikely.

Many of Mr. Palmisano’s concerns about federal pre-emption are related to the way patients must confide in their doctors regarding delicate health matters. If federal laws take away some rights to the confidentiality of that information, patients may be reluctant to tell their doctors about mental health problems, drug and alcohol abuse, and similar issues. Some proposed legislation has included provisions that would allow managed care companies to collect such data on a routine basis without obtaining specific permission from the patient, such as for the purpose of accounting research, marketing, medical research, law enforcement or other ends that do not directly benefit the patient.

"We recognize the importance of medical research and don’t want to impede it. We also recognize the importance of technological efficiency, but those needs do not supersede the patient’s right to confidentiality of health information," Mr. Palmisano said. "We’re not Luddites. We’re not anti-technology. But at the same time, we don’t want to violate basic rights of our patients just because that makes it easier to use some types of technology."

In particular, Mr. Palmisano said, whatever law is passed should not put the burden on the patient to prevent the release of information. Patients will be harmed, he says, by catch-all phrases that would allow the health care plan to use information about patients "to further the activities of the health plan," for instance. Patients also should not be asked to sign a blanket statement that allows the health plan to use information in that way, he says.

"We don’t want any kind of default in favor of the insurance company so that the patient has to protest if he doesn’t want information used in that way," he said. "Whatever the phrasing, it should put the burden on the health care plan to ask for that information if it wants to use it in some way."

AHIMA favors uniformity

AHIMA’s Ms. Frawley does not dispute much of what Mr. Palmisano said about the need to protect patient privacy, but said the nature of health care and management of medical records has changed dramatically in recent years. Information is flowing between states much more than it did previously because of the upsurge in managed care, so matters are complicated by conflicting state laws, she said.

"Our recommendation would be to get the strongest federal regulation possible and you wouldn’t need the state legislation," she said. "States are all over the place in terms of what they’ve done. If one rule applies in this state, what happens when that information goes to an insurer in another state? The notion of preserving existing state statutes and protections is probably comforting to individuals, but it doesn’t give the patient better protection."

Interstate commerce often can leave insurers, providers and patients wondering what restrictions apply to a particular situation, and Ms. Frawley said the individual patient rarely is present or capable of arguing about the fine points of one state law vs. another. A strong federal law would eliminate the ambiguity and protect the patient, she said.

"A lot of other issues have been worked out in the previous bills we’ve seen, but pre-emption is a very complex issue," she said. "States are responsible for the health of their citizens, so Congress is reluctant to intrude in an area that has long been reserved for state action."

Contact Ms. Frawley at 312-573-8508 and Mr. Palmisano at 312-464-4016.