Debate over privacy regulations continues
The mid-August release by the U.S. Department of Health and Human Services’ comprehensive patient privacy regulations renewed the loud debate over whether they actually help or hurt people.
The regulations announced by the Bush administration to take effect next April are significantly different in some respects from those first proposed by the Clinton administration in December 2000.
Secretary of Health and Human Services Tommy Thompson says the initial proposal had to be changed "to address the serious unintended consequences of the rule that would have interfered with patients’ access to quality care.
For example, patients would have been required to visit a pharmacy in person to sign paperwork before a pharmacist could review protected health information in order to fill their prescriptions. Similar barriers would have arisen when a patient is referred to a specialist and in other situations.
"We took great care to make sure we weren’t creating greater hardships or more health care bureaucracy for patients as they seek to get prompt and effective care. The prior regulation, while well-intentioned, would have forced sick or injured patients to run all over town getting signatures before they could get care or medicine. This regulation gives patients the power to protect their privacy and still get efficient care," Mr. Thompson says.
Privacy efforts at risk
But privacy advocates think the administration has changed things much more than necessary, and in the process, has actually hurt efforts to protect privacy. Washington, DC-based Georgetown University Health Privacy Project director Janlori Goldman says that with the changes, the department has eliminated the patient consent requirement and opened the door for use of people’s medical records for marketing purposes without notice or consent.
"Today’s changes will undermine patient control over private medical information and further erode patient trust in the health care system," Ms. Goldman said.
"Already, privacy concerns drive people away from the health care system. Data show that one in six people engages in privacy-protective behaviors. These behaviors include doctor-hopping’ to avoid a consolidated medical record, paying out-of-pocket to avoid disclosure to their insurance company, giving inaccurate or incomplete information about their medical history, asking doctors not to put information in their medical record, and failing to seek care altogether.
"People are often forced to put their own health care at risk in order to prevent their sensitive medical information from being used outside the health care context by employers, drug companies, and others," she points out.
HHS says that under its regulation, patients must give specific authorization before entities covered by this regulation could use or disclose protected information in most non-routine circumstances, such as releasing information to an employer or for use in marketing activities. Doctors, health plans, and other covered entities are to follow the rule’s standards for use and disclosure of personal health information.
Providing written notice
Covered entities generally will need to provide patients with written notice of their privacy practices and patients’ privacy rights.
The notices are to contain information that is useful to patients choosing a health plan, doctor, or other provider. Patients generally will be asked to sign or otherwise acknowledge receive of the privacy notice from direct treatment providers.
But Ms. Goldman says the original privacy regulation’s requirement that health care providers obtain written consent of patients before using or disclosing protected health information should have been retained.
"Seeking prior consent gives patients the power to decide whether to entrust others with their private medical information, under what circumstances, and for what purposes," she says.
"A patient consent requirement does more than give patients control over the health information; it is the best way to ensure that patients actually know how their health information will be used or disclosed and know what their privacy rights are.
"The process of obtaining consent defines an initial moment during which patients can raise questions about privacy concerns and learn more about options available to them . . . . Notice alone does not provide a comparable opportunity for dialogue or understanding," Ms. Goldman explains.
Redefining marketing
On the other major area of concern, marketing, HHS says that pharmacies, health plans, and other covered entities must first obtain an individual’s specific authorization before sending marketing materials. But the rule also permits doctors and other covered entities to communicate freely with patients about treatment options and other health-related information, including disease management programs.
The agency says that the improvements made to the final rule "strengthen the marketing language to make clear that covered entities cannot use business associate agreements to circumvent the rule’s marketing prohibition.
"The improvement explicitly prohibits pharmacies or other covered entities from selling personal medical information to a business that wants to market its products or services under a business associate agreement," HHS explains.
Ms. Goldman counters that what HHS actually has done is allow the use of health information for commercial types of communications that most people would consider to be marketing. "Although, the modified regulation requires prior authorization for marketing,’ it defines the term so narrowly that it does not include many of the aggressive drug marketing tactics that have recently been in the headlines," she says.
"For instance, the regulation permits pharmacies to receive money from drug manufacturers to data-mine patient prescriptions and to send to targeted patients letters encouraging them to switch to the manufacturer’s brand of drug," Ms. Goldman adds.
Financial over medical reasons
"These communications are not necessarily based on what is medically best for the patient, but are sent due to financial incentives [an activity that most people would consider to be marketing’].
"However, because this activity is not defined as marketing under the regulation, pharmacies do not have to obtain the patients’ prior permission to use their health information for this commercial purpose," Ms. Goldman explains.
In fact, the prior authorization requirement applies only to materials that encourage the purchase or use of products and services that are not related to health care," she says.
Ms. Goldman says that in addition to changing the definition of marketing, the final rule also makes two other changes to the regulation as proposed by the Clinton administration. First, pharmacies never have to give patients an opportunity to be removed from the mailing list for letters. And they also don’t have to tell patients that a drug company is paying them to send the letters.
[Download the regulation and other HHS materials from http://www.hhs.gov. Contact Ms. Goldman at (202) 687-0880.]
Subscribe Now for Access
You have reached your article limit for the month. We hope you found our articles both enjoyable and insightful. For information on new subscriptions, product trials, alternative billing arrangements or group and site discounts please call 800-688-2421. We look forward to having you as a long-term member of the Relias Media community.