News

Patient privacy rule goes into effect

Charles Marwick, Washington, DC

This article originally appeared in BMJ USA

WashingtonAs the final rule aimed at protecting the privacy of patients' medical records goes into effect, it is giving rise to just as much controversy as it generated when it was being drafted. The criticisms come, not just from health insurers, hospitals, and the health care industry (who say it will impose unacceptable costs), but also from significant segments of the medical profession, such as the American Medical Association (AMA) and the American Psychiatric Association (APA). At the same time, among the professional medical groups at least, there is agreement that it is better than nothing. The AMA has long supported patient records protection, but points out that the final rule does not fully achieve that goal.

The rule was issued by the Department of Health and Human Services (HHS) at the end of December. It lays out standards for protecting personal health records of all typeselectronic, paper and even oral communications. "This is what American patients and their providers want and need," said Dr Donna Shalala, the previous HHS Secretary, speaking at a press conference. She hailed the rule as a landmark in achieving privacy of medical records.

The origins of the rule go back to 1996, when Congress, recognizing the need for national standards for patient records privacy, passed the Health Insurance Portability and Accountability Act (HIPAA). This law gave Congress until August 1999 to pass comprehensive health privacy legislation.

But after three years of debate Congress could not reach a consensus and, under the Act, the job of drafting a rule passed to HHS. HHS issued a proposal in November of that year and received over 52 000 commentsitself a measure of the widespread interest in the topic.

Publication of the rule was among the last acts of the Clinton administration. On February 23, new HHS Secretary Tommy Thompson announced that the department will re-examine the rule and re-open it for a 30-day public comment period. One consideration that will undoubtedly come into play is that the effort to protect the privacy of medical records is very popular with the public. Any steps that delay or appear to water down the rule are likely to be politically unacceptable.

One group, however, wants action. At the end of January, the American Hospital Association (AHA) requested Secretary Thompson to reopen the rule for further comment. Doing so, said Rick Pollack, the Association's executive director, will give hospitals an opportunity to fully gauge the impact of the privacy rules, reform them where necessary, and find additional sources for funds needed to implement them. Mr Pollack said that the rule will be "exceedingly costly" to implement. An AHA study puts the cost at more than $22 billion over a five-year period. HHS estimates the cost as more than $17 billion over 10 years.

Dr Gail Wilensky, health policy adviser to President Bush, believes that the new Administration will need to consider the impact of the new privacy rule. But revising it is something else, she pointed out in an interview. "It's not easy to revise a rule after it has been published," she said. If the Administration decides to do so, "it will be necessary to go through the whole rule-making process." She noted the continuing widespread concerns raised by providers about the implications of the rule.

"We do like certain things about the rule," says Dr Donald J. Palmisano, a member of the AMA's Board of Trustees, in an interview. "We agree that patient privacy should be protected. The AMA has been in the forefront of this effort. Also, we like the fact that the rule sets a floor, not a ceiling. States, in other words, can make stricter laws."

Meanwhile, it seems unlikely that the average practicing physician has given the rule and its implementation much thought. "I think it is very doubtful that physicians are thinking about them now," said a spokesperson for the American Academy of Family Physicians. The Academy is developing educational materials for its members to help them comply with the new privacy regulations when they go into effect.

The AMA is advising its members to adopt a wait-and-see attitude, for several reasons. Although the privacy rule goes into effect on February 26th, there is a two-year period before it is enforced. Also, the privacy rule is only one of several new federal regulations concerning patient data; others are still to be published. One of these other regulations, for example, will set standards for the security of electronic transmission of medical data.

The other new regulations are likely to have an impact on the privacy rule, said Dr Palmisano. "So, we are encouraging physicians not to rush out and buy a lot of new software or whatever in order to comply, when other regulations may supplant it." HHS estimates the cost to the individual physician of implementing the rule at around $4000.

One aspect of the new rule that irks doctors is that it assumes that keeping health information confidential is a physician problem. "Physicians are not the problem with patient privacy. It's in our ethical precepts to keep confidential information about their health that people tell us," said Dr Palmisano.

He characterizes the privacy rule as treatment for a disease that does not exist in the doctor's office. "The entities that are most likely to wrongfully disclose and to misuse confidential information are those not covered by the rulethe insurers, the employers, the contractors, the marketers, the life insurance people. Most of these abuses will not be resolved by this regulation," said Dr Palmisano. "What is really needed is a comprehensive regulation that would apply to the release of all patient information."

Meanwhile the rule's drafters are not dismayed by the controversy. They are reported to have taken the position that since no one seemed happy with the rule, they must have done something right.