[House Hearing, 106 Congress]
[From the U.S. Government Publishing Office]
CONFIDENTIALITY OF PATIENT RECORDS
=======================================================================
HEARING
before the
SUBCOMMITTEE ON HEALTH
of the
COMMITTEE ON WAYS AND MEANS
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTH CONGRESS
SECOND SESSION
__________
FEBRUARY 17, 2000
__________
Serial 106-89
__________
Printed for the use of the Committee on Ways and Means
U.S. GOVERNMENT PRINTING OFFICE
66-897 CC WASHINGTON : 2001
_______________________________________________________________________
For sale by the U.S. Government Printing Office
Superintendent of Documents, Congressional Sales Office, Washington, DC
20402
COMMITTEE ON WAYS AND MEANS
BILL ARCHER, Texas, Chairman
PHILIP M. CRANE, Illinois CHARLES B. RANGEL, New York
BILL THOMAS, California FORTNEY PETE STARK, California
E. CLAY SHAW, Jr., Florida ROBERT T. MATSUI, California
NANCY L. JOHNSON, Connecticut WILLIAM J. COYNE, Pennsylvania
AMO HOUGHTON, New York SANDER M. LEVIN, Michigan
WALLY HERGER, California BENJAMIN L. CARDIN, Maryland
JIM McCRERY, Louisiana JIM McDERMOTT, Washington
DAVE CAMP, Michigan GERALD D. KLECZKA, Wisconsin
JIM RAMSTAD, Minnesota JOHN LEWIS, Georgia
JIM NUSSLE, Iowa RICHARD E. NEAL, Massachusetts
SAM JOHNSON, Texas MICHAEL R. McNULTY, New York
JENNIFER DUNN, Washington WILLIAM J. JEFFERSON, Louisiana
MAC COLLINS, Georgia JOHN S. TANNER, Tennessee
ROB PORTMAN, Ohio XAVIER BECERRA, California
PHILIP S. ENGLISH, Pennsylvania KAREN L. THURMAN, Florida
WES WATKINS, Oklahoma LLOYD DOGGETT, Texas
J.D. HAYWORTH, Arizona
JERRY WELLER, Illinois
KENNY HULSHOF, Missouri
SCOTT McINNIS, Colorado
RON LEWIS, Kentucky
MARK FOLEY, Florida
A.L. Singleton, Chief of Staff
Janice Mays, Minority Chief Counsel
______
Subcommittee on Health
BILL THOMAS, California, Chairman
NANCY L. JOHNSON, Connecticut FORTNEY PETE STARK, California
JIM McCRERY, Louisiana GERALD D. KLECZKA, Wisconsin
PHILIP M. CRANE, Illinois JOHN LEWIS, Georgia
SAM JOHNSON, Texas JIM McDERMOTT, Washington
DAVE CAMP, Michigan KAREN L. THURMAN, Florida
JIM RAMSTAD, Minnesota
PHILIP S. ENGLISH, Pennsylvania
Pursuant to clause 2(e)(4) of Rule XI of the Rules of the House, public
hearing records of the Committee on Ways and Means are also published
in electronic form. The printed hearing record remains the official
version. Because electronic submissions are used to prepare both
printed and electronic versions of the hearing record, the process of
converting between various electronic formats may introduce
unintentional errors or omissions. Such occurrences are inherent in the
current publication process and should diminish as the process is
further refined.
C O N T E N T S
__________
Page
Advisory of February 11, 2000, announcing the hearing............ 2
WITNESSES
U.S. Department of Health and Human Services, Hon. Margaret A.
Hamburg, M.D., Assistant Secretary for Planning and Evaluation,
accompanied by Gary Claxton, Deputy Assistant Secretary for
Health Policy.................................................. 11
______
American Medical Association, William G. Plested, III, M.D....... 40
Blue Cross Blue Shield Association, Alissa Fox................... 47
Goldman, Janlori, Institute for Health Care Research and Policy,
Georgetown University.......................................... 55
Healthcare Leadership Council, Mary R. Grealy.................... 63
Synergy Health Care, N. Stephen Ober, M.D........................ 73
SUBMISSIONS FOR THE RECORD
American Academy of Pediatrics, statement........................ 88
American College of Physicians-American Society of Internal
Medicine, Whitney W. Addington, letter......................... 89
American College of Surgeons, Thomas R. Russell, letter and
attachment..................................................... 98
American Council of Life Insurers, statement and attachment...... 99
American Federation of State, County and Municipal Employees,
AFL-CIO, Charles M. Loveless, letter........................... 105
American Healthways, Inc., Nashville, TN, statement.............. 106
American Psychoanalytic Association, New York, NY, statement..... 109
Association for Healthcare Philanthropy, Falls Church, VA,
William C. McGinly, statement and attachments.................. 110
Association of American Medical Colleges, statement.............. 116
Association of American Physicians and Surgeons, Inc., Tucson,
AZ, Jane M. Orient, statement.................................. 118
Condit, Hon. Gary A., a Representative in Congress from the State
of California; Hon. Henry A. Waxman, a Representative in
Congress from the State of California; Hon. Edward J. Markey, a
Representative in Congress from the State of Massachusetts;
Hon. John D. Dingell, a Representative in Congress from the
State of Michigan; Hon. Sherrod Brown, a Representative in
Congress from the State of Ohio; Hon. Edolphus Towns, a
Representative in Congress from the State of New York; Hon.
David E. Bonior, a Representative in Congress from the State of
Michigan; Hon. Major R. Owens, a Representative in Congress
from the State of New York; Hon. Patsy T. Mink, a
Representative in Congress from the State of Hawaii; Hon. Gene
Green, a Representative in Congress from the State of Texas;
Hon. Barney Frank, a Representative in Congress from the State
of Massachusetts; Hon. Lucille Roybal-Allard, a Representative
in Congress from the State of California; Hon. Paul E.
Kanjorski, a Representative in Congress from the State of
Pennsylvania; Hon. Albert Russell Wynn, a Representative in
Congress from the State of Maryland; Hon. Fortney Pete Stark, a
Representative in Congress from the State of California; Hon.
Lynn C. Woolsey, a Representative in Congress from the State of
California; Hon. William D. Delahunt, a Representative in
Congress from the State of Maryland; Hon. Mike Thompson, a
Representative in Congress from the State of California; Hon.
John F. Tierney, a Representative in Congress from the State of
Massachusetts; Hon. Carlos A. Romero-Barcelo, a Resident
Commissioner in Congress from the U.S. Territory of Puerto
Rico; Hon. Jim McDermott, a Representative in Congress from the
State of Washington; Hon. Janice D. Schakowsky, a
Representative in Congress from the State of Illinois; Hon.
Neil Abercrombie, a Representative in Congress from the State
of Hawaii; Hon. Eleanor Holmes Norton, a Delegate in Congress
from the District of Colombia; Hon. Carolyn B. Maloney, a
Representative in Congress from the State of New York; Hon.
Harold E. Ford, Jr., a Representative in Congress from the
State of Tennessee; Hon. John Joseph Moakley, a Representative
in Congress from the State of Massachusetts; Hon. James P.
McGovern, a Representative in Congress from the State of
Massachusetts; Hon. Dennis J. Kucinich, a Representative in
Congress from the State of Ohio; Hon. Ellen O. Tauscher, a
Representative in Congress from the State of California; Hon.
Sam Farr, a Representative in Congress from the State of
California; Hon. Bernard Sanders, a Representative in Congress
from the State of Vermont; Hon. Gerald D. Kleczka, a
Representative in Congress from the State of Wisconsin; Hon.
Donna MC Christensen, a Delegate in Congress from the U.S.
Virgin Islands; Hon. Tom Lantos, a Representative on Congress
from the State of California; and Hon. Louise McIntosh
Slaughter, a Representative in Congress from the State of New
York, joint letter and attachment.............................. 119
Consortium for Citizens with Disabilities, statement............. 125
Family Violence Prevention Fund, San Francisco, CA, statement.... 129
Health Industry Manufacturers Association, statement............. 135
Licthman, Judith L., National Partnership for Women & Families,
statement...................................................... 165
Loveless, Charles M., American Federation of State, County and
Municipal Employees, AFL-CIO, letter........................... 105
LPA, Inc., Daniel V. Yager, statement............................ 138
McGinly, William C., Association for Healthcare Philanthropy,
Falls Church, VA, statement and attachments.................... 110
Medical Group Management Association, statement.................. 144
National Association of Insurance Commissioners, Kathleen
Sebelius, letter and attachment................................ 145
National Breast Cancer Coalition, Fran Visco, letter............. 160
National Partnership for Women & Families, Judith L. Licthman,
statement...................................................... 165
Orient, Jane M., Association of American Physicians and Surgeons,
Inc., Tucson, AZ, statement.................................... 118
Paul, Hon. Ron, a Representative in Congress from the State of
Texas, statement............................................... 167
Physican Insurers Association of America, Rockville, MD,
statement...................................................... 169
Ramstad, Hon. Jim, a Representative in Congress from the State of
Minnesota...................................................... 172
Russell, Thomas R., American College of Surgeons, letter and
attachment..................................................... 98
Sebelius, Kathleen, National Association of Insurance
Commissioners, letter and attachment........................... 145
Slaughter, Hon. Louise McIntosh, a Representative in Congress
from the State of New York, statement.......................... 172
VHA Inc., statement.............................................. 175
Visco, Fran, National Breast Cancer Coalition, letter............ 160
Yager, Daniel V., LPA, Inc., statement........................... 138
CONFIDENTIALITY OF PATIENT RECORDS
----------
THURSDAY, FEBRUARY 17, 2000
House of Representatives,
Committee on Ways and Means,
Subcommittee on Health,
Washington, DC.
The Subcommittee met, pursuant to notice, at 11:37 a.m., in
room 1100, Longworth House Office Building, Hon. Bill Thomas
(Chairman of the Subcommittee) presiding.
[The advisory announcing the hearing follows:]
ADVISORY
FROM THE COMMITTEE ON WAYS AND MEANS
SUBCOMMITTEE ON HEALTH
CONTACT: (202) 225-3943
FOR IMMEDIATE RELEASE
February 11, 2000
No. HL-13
Thomas Announces Hearing on
the Confidentiality of Patient Records
Congressman Bill Thomas (R-CA), Chairman, Subcommittee on Health of
the Committee on Ways and Means, today announced that the Subcommittee
will hold a hearing on the Administration's proposed regulations
regarding privacy of individually identifiable health information. The
hearing will take place on Thursday, February 17, 2000, in the main
Committee hearing room, 1100 Longworth House Office Building, beginning
at 10:00 a.m.
In view of the limited time available to hear witnesses, oral
testimony at this hearing will be from invited witnesses only. The
Subcommittee will receive testimony from a representative of the U.S.
Department of Health and Human Services (HHS), and from a variety of
private sector witnesses representing different perspectives from
within the health care system. However, any individual or organization
not scheduled for an oral appearance may submit a written statement for
consideration by the Committee and for inclusion in the printed record
of the hearing.
BACKGROUND:
Congress addressed the issue of medical record confidentiality in
1996 when it passed administrative simplification requirements for
electronic health transactions as part of the Health Insurance
Portability and Accountability Act (HIPAA) P.L. 104-191). HIPAA
required the Secretary of HHS to make recommendations to Congress about
how to better protect the confidentiality of personal health
information that is transmitted electronically. The Secretary submitted
her recommendations to Congress in September of 1997. Additionally,
Congress granted the Secretary the authority to draft regulations if a
privacy law was not enacted by August 21, 1999. On November 3, 1999,
HHS published a Notice of Proposed Rule Making for ``Standards for
Privacy of Individually Identifiable Health Information.'' The comment
period for this ruling was extended until February 17, 2000, and a
final ruling will follow. Generally, covered entities must comply with
these regulations no later than 24 months following the effective date
of the final rule.
The proposed rule establishes standards to protect the privacy of
individually identifiable health information maintained or transmitted
electronically in connection with one of the mandated electronic
transaction standards established by HIPAA. Since the release of the
proposed ruling, many provider groups, health care organizations, and
privacy advocates have expressed various concerns about different
interpretations of the regulation, and its potential implications. As a
result, thousands of comments are expected to be submitted on the
regulation by the end of the comment period.
In announcing the hearing, Chairman Thomas stated: ``Protecting the
confidentiality of personal health information is critical to ensuring
patient confidence in our health care system. The Secretary has taken
on a monumental task. She has tried to lay out a comprehensive
framework for regulating the flow of virtually all health care
information, while still allowing data to be used to further research
that will improve patient care. This hearing is intended to assist us
in determining whether the regulation will ultimately prove to be
workable or whether legislation might be necessary.''
FOCUS OF THE HEARING:
The hearing will focus on various aspects of the Department's
proposed confidentiality regulation, and examine what implications the
rule presents for Medicare and the private health sector.
DETAILS FOR SUBMISSION OF WRITTEN COMMENTS:
Any person or organization wishing to submit a written statement
for the printed record of the hearing should submit six (6) single-
spaced copies of their statement, along with an IBM compatible 3.5-inch
diskette in WordPerfect or MS Word format, with their name, address,
and hearing date noted on a label, by the close of business, Thursday,
March 2, 2000, to A.L. Singleton, Chief of Staff, Committee on Ways and
Means, U.S. House of Representatives, 1102 Longworth House Office
Building, Washington, D.C. 20515. If those filing written statements
wish to have their statements distributed to the press and interested
public at the hearing, they may deliver 200 additional copies for this
purpose to the Subcommittee on Health office, room 1136 Longworth House
Office Building, by close of business the day before the hearing.
FORMATTING REQUIREMENTS:
Each statement presented for printing to the Committee by a
witness, any written statement or exhibit submitted for the printed
record or any written comments in response to a request for written
comments must conform to the guidelines listed below. Any statement or
exhibit not in compliance with these guidelines will not be printed,
but will be maintained in the Committee files for review and use by the
Committee.
1. All statements and any accompanying exhibits for printing must
be submitted on an IBM compatible 3.5-inch diskette in WordPerfect or
MS Word format, typed in single space and may not exceed a total of 10
pages including attachments. Witnesses are advised that the Committee
will rely on electronic submissions for printing the official hearing
record.
2. Copies of whole documents submitted as exhibit material will not
be accepted for printing. Instead, exhibit material should be
referenced and quoted or paraphrased. All exhibit material not meeting
these specifications will be maintained in the Committee files for
review and use by the Committee.
3. A witness appearing at a public hearing, or submitting a
statement for the record of a public hearing, or submitting written
comments in response to a published request for comments by the
Committee, must include on his statement or submission a list of all
clients, persons, or organizations on whose behalf the witness appears.
4. A supplemental sheet must accompany each statement listing the
name, company, address, telephone and fax numbers where the witness or
the designated representative may be reached. This supplemental sheet
will not be included in the printed record.
The above restrictions and limitations apply only to material being
submitted for printing. Statements and exhibits or supplementary
material submitted solely for distribution to the Members, the press
and the public during the course of a public hearing may be submitted
in other forms.
Note: All Committee advisories and news releases are available on
the World Wide Web at ``http://waysandmeans.house.gov''.
The Committee seeks to make its facilities accessible to persons
with disabilities. If you are in need of special accommodations, please
call 202-225-1721 or 202-226-3411 TTD/TTY in advance of the event (four
business days notice is requested). Questions with regard to special
accommodation needs in general (including availability of Committee
materials in alternative formats) may be directed to the Committee as
noted above.
Chairman Thomas. The subcommittee will come to order. When
I was younger there was a little rhyme that my mother used to
recite to me and I never really appreciated it as much as I do
now when the House is not going to meet and vote today, and
members make choices. We had planned on voting today. We will
not have as many members at this hearing as we obviously would
like. There are others that are forced to arrive a little late
because of other factors.
But the little rhyme was that man works from sun to sun, a
woman's work is never done. This committee has a decidedly
female bent in terms of the workload that we have. But we are
dealing with a number of issues in which we need to lay a
hearing record fairly early, and frankly, I believe February is
a fairly early time period, in looking at issues such as
medical errors, prescription drug being integrated into
Medicare.
Nothing is probably more important since it undergirds many
of those areas, the question of medical records,
confidentiality of those records. But more importantly, the
ability to use those records in a confidential way to continue
to work on a systematic examination of medical decisions for
outcomes policy and for making sure that with the limited
dollars available, to try to stretch as far as we can to
provide health care to a number of individuals in our society,
among those the eldest and the most needy, the taxpayers'
dollars are spent in the wisest possible way.
Congress addressed the issue of medical record
confidentiality in 1966, although the whole question of
confidentiality in the general area of records has been looked
at since the 1970s. In the legislation, the Health Insurance
Portability and Accountability Act, there was a positive
attempt to get at especially the area of electronic health
transactions. We had a deadline for Congress to act, but with
some degree of prescience said that if we did not, the
Secretary of Health and Human Services should go forward with
the attempt.
The context in which we examine the Secretary's attempt,
and indeed look at Congressional attempts, one to meet the
deadline, and continue to try to produce policy after the
deadline even today, is one that I think has been an honest
effort to deal with a very difficult area. There are some I
think who would like to politicize this area as they are
attempting to politicize other areas, and use it for whatever
political advantage they may think.
As far as serving the society in the areas, for example,
that we have held committee hearings on and this one today, I
hope that we will try to tone down the politics. That is, the
assumption that people who are in opposition to some attempt to
create confidentiality in some manner have ulterior motives.
I think when you look at it from the number of different
perspectives that people look at it, they all see the problem
from a slightly different perspective and try to examine it
from how they fit into the proposed scheme. Indeed, I am
hopeful that with the initial panel of Health Care Financing
Administration and the other panels it will be clearly
illustrated that to a very great extent beauty is in the eye of
the beholder, depending upon how you see yourself within this
larger structure.
So we come today with the last day of the extended comment
period closing, and that is one of the reasons I wanted to make
sure that we had a hearing today. Now generally, covered
entities must comply with these regulations no later than 24
months following the effective date of the final rule. As we
have seen with other legislation, that may be forever. Our goal
is not to have that happen. To the degree regulations that seem
to be generally supported cannot be finalized, then obviously
legislation is even more critical.
So let me just preface our discussion by stating that the
Secretary has undertaken a monumental task. I strongly support
the overall goals of her proposal. Within the confines of the
health care legislation the Secretary has tried to lay out a
comprehensive framework while still allowing the data to be
used for research, quality improvement, case and disease
management, and other important purposes that sometimes we fail
to realize how important they are until someone in one
particular niche comes to us and says, you did not think about
me. You did not realize that we do these sorts of things.
So this hearing is intended to assist us in determining
whether the regulation will ultimately prove to be workable or
whether, as I said, we really need to have legislation
notwithstanding the best efforts. Obviously from the number of
words on pages with this proposed ruling it is evident this is
a complicated issue. From all indications, and I think we have
got--hopefully in the testimony we will get some indication of
the number of public comments. Since this is nearing the last
day you may get additional, but you should have a pretty good
idea of the count.
Frankly, this is helpful, useful. This kind of scrutiny is
good. This is a very important area that we get right. Everyone
agrees that patient records should be kept confidential. The
difficulties come in determining the best way to accomplish
that goal. How much, to what degree, in what instance, how
clear is it? To me, the importance of this issue in health
policy cannot be overstated. In fact it undergirds our
attempts, especially in areas such as medical errors, to get it
right.
So what we really need to do is listen carefully to all of
the concerns, and indeed some of the difficulties of the
Secretary in trying to put together a package, so that in our
effort to maintain confidentiality we minimally hinder, if at
all, the flow of information that is essential to the delivery
of quality health care and improving the quality of care for
patients in the future.
The Secretary's effort represents the Administration's
initial attempt after several false starts at resolving this
very perplexing policy challenge. Today begins this committee's
examination of whether or not the effort is minimally
acceptable or whether we are going to have to enter the
legislative thicket in dealing with that.
[The opening statement follows:]
Opening Statement of Chairman William M. Thomas, a Representative in
Congress from the State of California
Good morning and welcome. Congress addressed the issue of
medical record confidentiality in 1996 when it passed
administrative simplification requirements for electronic
health transactions. This legislation, the Health Insurance
Portability and Accountability Act (or HIPAA), required the
Secretary of Health and Human Services to make recommendations
to Congress on how to better protect the confidentiality of
personal health information that is transmitted electronically.
The Secretary submitted her recommendations to us in September
of 1997. Additionally, Congress granted the Secretary the
authority to draft regulations if a confidentiality law was not
enacted by August 21, 1999. On November 3, 1999, Health and
Human Services published their proposed regulations for medical
record confidentiality. The comment period for this ruling was
extended, upon our urging, until today, February 17, 2000, and
a final ruling will follow. Generally, covered entities must
comply with these regulations no later than 24 months following
the effective date of the final rule.
Let me just preface our discussion by stating that the
Secretary has undertaken a monumental task and I strongly
support the overall goals of her proposal. She has tried to lay
out a comprehensive framework for regulating the flow of health
care information, while still allowing data to be used for
research, quality improvement, case and disease management, and
other important purposes that will improve patient care. Today
the Subcommittee will be examining these proposed regulations
and the possible effects that they may have on the health care
system. This hearing is intended to assist us in determining
whether the regulation will ultimately prove to be workable or
whether additional legislation might be necessary. From the
length of the proposed ruling, it is quite evident that this is
a complicated issue. From all indications, HHS will have
received a deluge of public comments by the end of today
regarding this issue. This kind of scrutiny is good. For this
rule will have broad implications. One thing is clear, we need
to get this one right. Everyone agrees that patient records
should be kept confidential, the difficulties come in
determining the best way to accomplish this goal.
To me, the importance of this issue in health policy cannot
be overstated. It is imperative that we ensure the
confidentiality of Medicare beneficiaries' health information.
Protecting the confidentiality of this information is critical
to ensuring patient confidence in our health care system. Yet,
it is equally important that, in the effort to maintain
confidentiality, we do not hinder the flow of information that
is essential to the delivery of quality health care, and to
improving the quality of care for patients in the future. The
Secretary's regulation represents the Administration's initial
attempt at resolving this perplexing policy challenge. My hope
is that today's hearing will be instrumental in helping us
determine whether this initial attempt strikes the right
balance.
With that I would yield to my colleague from Washington,
someone who has a significant interest in this area and has
attempted on his own in the past to help resolve the
difficulties in this area. The gentleman from Washington, Mr.
McDermott.
Mr. McDermott. Thank you, Mr. Chairman. I want to comment
you on having this hearing, and I think that as you rightly
state it is not a partisan issue. It is an issue of extreme
importance I think for the health care system in this country.
For that reason I think that it is important that we start as
early in the session as we come airing the issues so that if we
are going to write legislation in this session we ought to have
an opportunity to actually let the public be involved in the
process.
I practiced as a psychiatrist for about 20 years so privacy
and patient's confidence that what he or she said to me would
remain private has always been a crucial component of my
personal practice, but it is in all of medicine. It is the
basis for going to a doctor and saying to a doctor what my
problem is. If you do not trust the physician, or the nurse or
whoever the health provider is that this information is going
to be kept private, you are liable to withhold or tell only
half the story or whatever. So it is important if you are going
to get good health care that you have privacy guaranteed.
But it is more than as an observer of standard medical
practice that I became convinced we need strong Federal privacy
laws. Having had surgery I have had already the impacts of
getting a medication and then getting mailings from people that
I did not know where they came from. I do not know who let
these companies know that I was on a particular medication and
therefore should send me medical device information. It is
everywhere and everybody is being impacted on it, including
members of Congress. This is not something that is Democrats or
Republicans. It is everybody in this country who receives
health care is a part of this system.
Now Congress had, as the chairman rightly says, a chance to
establish standards but up to this point we have not done it.
So I would like to commend the Administration, especially
Secretary Shalala, for doing what the Congress so far has been
unable to do and moving forward with the medical
confidentiality standards. I want to thank the Secretary and
the department for working within the constraints placed upon
them by the Congress and delivering a good regulation.
Based on the thousands of comments--I understand the figure
is in excess of 30,000 or 40,000--HHS has been receiving on
this issue it is safe to say that they must be on the right
trace, because they are coming from both sides or--there really
is more than two sides. There are about nine sides to this
issue.
But in spite of the good faith efforts by the
Administration I think we all receive that adequate systemic
protection of medical privacy cannot be achieved simply by
regulation. When Congress passed the Health Insurance
Portability and Accountability Act, the so-called HIPAA,
Congress gave itself two years to do this. And if we did not
act we said Donna Shalala, the Secretary, should do it. But we
imposed severe restrictions--and I want to emphasize that--on
the Secretary. These constraints are reflected by the narrow
scope of the regulation that we have before us. In my view it
is a narrow scope.
As members of the committee and as the Congress begins to
think about this I think we have to keep in mind that we
prevented the Secretary from doing more than is in this
regulation. The only entities that are directly covered by the
regulation are health care providers, health care plans, and
health data clearinghouses. Additionally, the regulation only
applies to electronic records.
Now I am the only one on the dais that ever filled out a
health care record, kept records. Most of it is written, or has
been for a very long time. The advent of the computer has
changed it obviously, but for the regulation only to deal with
electronic data seems to me an unnecessary or an improper
narrowing of the scope of the regulation.
In addition, we also said there was a limited enforcement
mechanism and no right to sue. If your information is used
against you and you are unable to--if you are damaged in some
way or feel you are, you have no right to go to the courts.
Now by restricting the entities covered by the regulation
we left a huge vacuum of unregulated entities. For instance,
researchers and oversight agencies that collect, use, and
disclose protected health information will not be directly
covered. Clearly, the only way to ensure that all parties to
sensitive health information are required to maintain privacy
is through strong and comprehensive legislation. That is why I
think the chairman is correct in holding this hearing and
setting us on the road.
Now I started in 1995 on this issue after I read an article
in the New York Times Sunday magazine section about a young man
who had a disease called Marie-Tooth disease. It is a very rare
upper limb muscular dystrophy which makes weak upper arms. He
was taken and they did the genetic testing on him and all of
this, and they did the counseling with the family.
The family thought that was the end of it until about three
months later the father lost his auto insurance. Now he lost
his auto insurance without a moving violation, with an
accident. Just got a notice, you no longer are covered by our
company. He started to investigate this and they told him that
they had discovered that his son's disease was a genetic
disease and they did not want anybody who had that disease to
have their automobile insurance.
Now you ask yourself, how did that get from the doctor's
office to the auto insurance company that pulled his policy? It
is because we are all open to this, the entire public at this
point can be affected by that thing. And I hope that the
chairman will be willing to work with members of the entire
committee on this issue. I think we have started well and I
think it is a good thing to do because this is an issue that
affects everyone. It is not going to get better. It is going to
get worse as we go down the road.
It is increasingly difficult to ensure the privacy of
sensitive health information because of the tremendous
technological advances and the more efficient transmittal of
large quantities of data. Computers have absolutely
revolutionized the way medical information is collected,
stored, and disseminated. If you walk through a hospital,
doctors have computers in their lap and they are typing things
into them and then dumping them into the larger mainframe and
away it goes. So without adequate, enforceable controls, this
information can easily be used to breach the privacy of
patients and to allow discrimination against them.
Now rightly, Americans are becoming increasingly concerned
about this lack of privacy. If we do not step in with strong
protections we will seriously undermine the credibility of the
health care system. That is, the doctor-patient relationship
which we say we want to protect. But there is another issue
which I want to put on the table and I think in some ways this
hearing is really a precursor for a much bigger problem down
the road.
The United States Government has spent billions of dollars
in something called the human genome project. Soon we will have
a map of the entire genetic makeup of the body. But while this
scientific advance carries with it many promising benefits, it
also raises significant concerns about privacy.
One test can determine a woman's potential susceptibility
to breast cancer. The work was done at the University of
Washington by a Dr. Mary Claire King and I know intimately what
went on in that whole thing. But many in this country are
unwilling to be tested because they are fearful that if it gets
into their record that they have the gene, or it is in their
record and their children are also receiving treatment or need
treatment or are wondering about it, they may lose insurance.
The fear about having that genetic information known and in the
computer system is a restraint on the kinds of prevention that
would be possible if we had good assurance of privacy.
So we must ensure that our citizens can take advantage of
medical breakthroughs without the worry that information may be
used against them.
To I think we will also hear concerns from companies. Some
of the information that I read comes from companies that make
money from marketing of sensitive health information. But I
believe medical records must not be commodities that are bought
and sold. I think we may hear many claims that the new
regulation must not interfere with those particular interests,
but the group we have to listen to most carefully in my view
are the patients and their families. Think about your own
family records being available for anyone to look at and you
immediately see what the problem is.
Now the question we have to ask ourselves as we write
legislation is, what value can you place on the confidentiality
of a doctor-patient relationship? It is essential that we
protect the privacy of individuals, including their genetic
privacy. Good legislation can ensure that the new technologies
are used not to deny care or to deny medical privacy, but to
benefit all of us.
Mr. Chairman, as I close I would like to enter in the
record the following statements, one from Congresswoman Louise
Slaughter, one from the American Psychiatric Association, one
from the American Psychoanalytic Association, one from AFSME,
one from the Consortium for Citizens for Disabilities, and one
from the National Breast Cancer Coalition, and finally I would
like attached a letter signed by a number of members of the
Congress who are interested in this whole issue. This is a
beginning of what I think is a very important process and I
commend you on it.
Chairman Thomas. Without objection, those will be submitted
for the record.
[The opening statement and material follow:]
Opening Statement of Jim McDermott, a Representative in Congress from
the State of Washington
want to thank Chairman Thomas and the ranking member, Mr.
Stark, for yielding me time to talk about medical privacy, an
issue that I have been concerned about for some time.
Most of you know that I was a practicing psychiatrist for
more than 30 years. Privacy, and the patient's confidence that
what he or she says will remain private, is a crucial component
of that profession. But more than that, as an observer of
standard medical practices, I became convinced that we need a
strong federal privacy law protecting patients.
Congress had a chance to establish those standards but
couldn't do it. So I would like to commend the Administration,
especially Secretary Shalala, for doing what the Congress
hasn't been able to do and moving forward with medical
confidentiality standards.
I thank the Secretary and the Department for working within
the constraints placed on them by Congress and delivering a
good regulation. Based on the thousands of comments HHS is
receiving from all sides of the issue, it is safe to say they
are on the right track.
But despite those good-faith efforts by the administration,
I think we all realize that adequate, systemic protection of
medical privacy cannot be achieved through regulation.
When Congress passed The Health Insurance Portability and
Accountability Act (HIPAA), Congress gave itself two years to
write comprehensive privacy regulations. If we did not act--and
we didn't--then Secretary Shalala could issue rules. But we
imposed some strict constraints on the secretary. These
constraints are reflected by the narrow scope of the regulation
before us.
As the members of the subcommittee listen to the testimony
today, I urge you to keep in mind what we prevented the
Secretary from doing. The only entities that are directly
covered by the regulation are health care providers, health
plans, and health data clearinghouses. Additionally, the
regulation only applies to electronic records--not even paper
records are protected--and there is a limited enforcement
mechanism, and no right to sue.
By restricting the entities covered by the regulation, we
have left a large vacuum of unregulated entities. For instance,
researchers and oversight agencies that collect, use, and
disclose protected health information will not be directly
covered.
I applaud the Secretary's effort to limit disclosures by
binding the business partners of cover entities through
contracts. This intermediary step heads in the right direction
by ensuring the rights of patients are not violated.
Unfortunately, it targets the liability on covered entities,
while failing to prevent re-disclosures by entities that are
not covered.
The intent of HIPAA's Administrative Simplification section
was to move the health care industry toward using electronic
records--a worthwhile goal.
Clearly, we must take action to apply the regulation's
protections to all patient records. Congress' preventing
Secretary Shalala from covering paper records doesn't pass the
laugh test. I believe the Secretary has the authority to cover
both paper and electronic records and encourage her to do so in
the final rule. Applying this regulation only to electronic
records will create a disincentive for organizations to convert
existing records to electronic form--which is contrary to
Congress' intent.
Congress also failed to allow the Secretary to include
adequate enforcement of the regulation. The enforcement
mechanisms in this regulation are minimal at best. We have
established rules for the use and disclosure of sensitive
health information without providing meaningful repercussions
for breaking them. Compounding the problem is the fact that
Congress did not provide a right-to-sue provision in HIPAA.
Clearly, the only way to ensure that all parties to
sensitive health information are required to maintain privacy
is through strong, comprehensive legislation. In May 1996, I
introduced my first medical privacy bill. I hope the Chairman
will be willing to work with all members of the committee in
pursuit of a strong, comprehensive, and bipartisan bill.
If privacy is not maintained, the public will lack
confidence in our health care system. If individuals doubt
their information will be kept private, they will either delay
treatment or be less forthcoming with their physicians. This
self-monitoring of personal health information will result in
increased personal and financial costs. We could even see a
decline in societal health stemming from the increase in
transmission of communicable diseases.
Also, it is increasingly difficult to ensure the privacy of
sensitive health information. Tremendous technological advances
make it easier and more efficient to transmit large quantities
of data. Computers have revolutionized the way medical
information is collected, stored, and disseminated. Without
adequate, enforceable controls, this information can easily be
used to breach the privacy of patients and to allow
discrimination against them.
Americans are becoming increasingly concerned about their
lack of privacy. If we don't step in with strong protections,
we will seriously undermine the credibility of our health care
system.
One technological advance which we need to address is the
Human Genome Project. Soon, we will have a map of the entire
genetic makeup of the body. But while this scientific advance
carries with it many promising benefits, it also raises
significant concerns about privacy.
One test can determine a woman's potential susceptibility
to breast cancer. But some women, afraid that they or even
their daughters will be denied employment or health insurance
if they carry the gene, won't submit to the test.
We must ensure that our citizens can take advantage of
medical breakthroughs without the worry that private
information may be used against them.
Today, we will hear concerns about companies that stand to
make money marketing sensitive medical information. But,
medical records must not be commodities that are bought and
sold.
We may hear many claims that any new legislation must not
interfere with those particular interests. But the group we
should listen to most will be hardest to hear: patients and
their families. Think about your own family's medical records
being available for anyone to look at. What value can we place
on the confidentiality of the doctor-patient relationship? It
is essential that we protect the privacy of individuals,
including their genetic privacy. Good legislation can ensure
that new technologies are used, not to deny health care or to
deny medical privacy, but to benefit all of us.
Mr. Chairman, I would like to enter the following
statements into the record:
1. Congresswoman Louise Slaughter;
2. American Psychiatric Association;
3. American Psychoanalytic Association;
4. AFSME, the American Federation of State, County and
Municipal Employees;
5. Consortium of Citizens for Disabilities;
6. National Breast Cancer Coalition; and
7. The attached comment letter signed by a number of
Democratic members of Congress who are leading health privacy
advocates.
Thank you.
Chairman Thomas. Now Dr. Hamburg, thank you very much for
coming before us. Dr. Hamburg is the assistant secretary for
planning and evaluation, U.S. Department of Health and Human
Services. She is narrowly responsible, but obviously the
Secretary is broadly responsible. And as is the case in our
offices many times, we may be the point person but we are not
the one that either has a broader command of the particular
area, and Dr. Hamburg has asked Mr. Claxton to sit at the
table. Since our goal is to try to understand rather than play
gotcha, we are more than willing to allow that to occur.
So Dr. Hamburg, your written testimony will be made a part
of the record and you can address us in any way you see fit in
the time that you have available.
STATEMENT OF HON. MARGARET A. HAMBURG, M.D., ASSISTANT
SECRETARY FOR PLANNING AND EVALUATION, U.S. DEPARTMENT OF
HEALTH AND HUMAN SERVICES; ACCOMPANIED BY GARY CLAXTON, DEPUTY
ASSISTANT SECRETARY FOR HEALTH POLICY
Dr. Hamburg. Thank you very much, Mr. Chairman, and
distinguished members of the subcommittee. I appreciate the
opportunity to appear before you to discuss the need for
Federal legislation to safeguard the privacy of health
information. As you know, health information privacy is the top
priority for the department and the Administration and we
continue to believe that legislation is the only way to achieve
that goal.
I am joined by Mr. Gary Claxton, the deputy assistant
secretary for health policy in my office who has been deeply
involved with issues of health privacy and the development of
the proposed reg.
At the outset, I want to commend the members of the
subcommittee for their interest in health care privacy and
efforts to develop this important and complex legislation. In
addition, we are encouraged by the recent appointment of two
Congressional task forces to address privacy issues. These
efforts have the potential to generate the momentum needed to
enact legislation this year.
We are here today to emphasize our support for passage of
bipartisan legislation providing comprehensive privacy
protection to people's health care information. Stories abound
that raise concern that our sensitive medical information can
enter the wrong hands and be misused. Almost 75 percent of our
citizens say that they are at least somewhat concerned that
computerized medical records will have a negative effect on
their privacy.
Numerous analyses by Government, industry, and professional
groups have identified serious gaps in protections for health
information and have recommended Federal legislation to close
them. And of course, we have already heard your personal
stories about this concern. If we do not act now, public
distress could deepen and ultimately stop citizens from
disclosing important information to their doctors or getting
needed treatment.
In September of 1997, Secretary Shalala presented her
recommendations for protecting the confidentiality of
individually identifiable health information. In that report
the Secretary concluded that Federal legislation establishing a
national floor of confidentiality is necessary to provide
rights for patients and define responsibilities of
recordkeepers. She recommended that Federal legislation focus
on health care payers and providers and the people who receive
health information from them.
The Secretary legislation to implement five key principles.
First, information about a consumer that is obtained for
delivering and paying for health care should, with very few
exceptions, be used and disclosed for health purposes and
health purposes only.
Second, those who legally receive health information should
be required to take reasonable steps to safeguard it.
Third, consumers should have access to their health
records, should know how their health information is being
used, and who has looked at it, and should be given clear
explanations of these rights.
Fourth, people who violate the confidentiality of our
personal health information should be accountable.
These first four principles must be balanced against the
fifth principle, public responsibility. Just like our free
speech rights, privacy rights cannot be absolute. We must
balance our protections of privacy with our public
responsibility to support other critical national goals: public
health, research, quality care, and our fight against health
care fraud and abuse.
To prepare the proposed privacy regulation we assembled a
team from all the relevant Federal agencies. We published the
proposed rule on November 3rd, 1999 and the period for public
comment, as you noted, closes today. We explained the basis for
our proposals in detail in the preamble to the proposed rule,
but also asked for comment on over 150 specific issues. We will
review all the comments we receive and we will make whatever
changes are appropriate.
We are committed to achieving the proper balance between
ensuring patient privacy and the needs of the health care
system to function properly and to continue advances in health
protection and medical treatment. Our commitment to getting it
right led us to extend the comment period from January 3rd to
February 17th so the public and stakeholders would have
adequate time to consider the proposed rule.
Since we have just begun to review the comments I will not
be able to speculate on or debate the contents of the final
rule today. But I can tell you that as of yesterday we had
received about 40,000 comments by mail or hand-delivery and
roughly another 10,000 on our web site. Further, we have met
with dozens of individuals and groups to hear more about their
concerns and clarify provision of the proposed rule.
While we are moving ahead to prepare the final regulation
let me give you a few reasons why we continue to call for
legislation. First, the HIPAA limits the application of our
proposed rule to three entities, health plans, clearinghouses,
and certain providers. But it does not provide authority for
the rule to reach many people who receive health information
from these entities. In short, in the rule we cannot put in
place appropriate restrictions on how such recipients of
protected health information may use and redisclose that
information.
Second, we are concerned that the enforcement provisions in
the HIPAA are not adequate. The penalty structure is not
commensurate with the importance of privacy in our lives, and
there is no statutory authority for a private right of action
for individuals to enforce their privacy rights.
There are additional reasons we continue to call for
legislation. For example, under the HIPAA only those providers
engaged in electronic transactions can be covered. Any provider
who maintains a solely paper information system cannot be
subject to these privacy standards.
Mr. Chairman, the principles embodied in our
recommendations and proposed regulation should guide a
comprehensive law that will create substantive Federal
standards and provide our citizens with real peace of mind. The
principles represent a practical, comprehensive and balanced
strategy to protect health care information that is collected,
shared, and used in an increasingly complex world.
Thank you again for giving me this opportunity to testify
and I look forward to answering any questions that you may have
and working closely with you as you move forward on this
important agenda.
[The prepared statement follows:]
Statement of Hon. Margaret A. Hamburg, M.D., Assistant Secretary for
Planning and Evaluation, U.S. Department of Health and Human Services
Mr. Chairman, Congressman Stark, distinguished members of
the Committee: I appreciate the opportunity to appear before
you to discuss the need for federal legislation to ensure
comprehensive privacy safeguards for health information. This
issue is a top priority for the Department and the
Administration, and although the regulation that we recently
proposed serves as a foundation for providing strong privacy
protections for consumers' health information, we continue to
believe that legislation is ultimately necessary if we are to
appropriately protect the privacy of the health information of
all Americans.
As the outset, I want to commend the members of this
Subcommittee Mr. Thomas, Mr. Stark, and Mr. McDermott, as well
as Mr. Cardin, for their interest in health care privacy and
efforts to develop this important and complex legislation. In
addition, we are encouraged by the recent appointment of two
congressional task forces to address privacy issues. The
``Congressional Privacy Caucus'' has the potential to generate
the momentum needed to enact legislation this year.
As you may remember, Secretary Shalala first presented her
recommendations, required by the Congress under Section 264 of
the Heath Insurance Portability and Accountability Act (HIPAA),
in September 1997.\1\ I think it is fair to say that the
recommendations were well received and have been used to assist
others in crafting their own legislative proposals.
---------------------------------------------------------------------------
\1\ Confidentiality of Individually-Identifiable Health
Information, Recommendations of the Secretary of Health and Human
Services, pursuant to section 264 of the Health Insurance Portability
and Accountability Act of 1996'' can be found on the HHS web site at:
http://aspe.os.dhhs.gov/admnsimp.
---------------------------------------------------------------------------
HIPAA also requires that if legislation establishing
comprehensive privacy protection was not enacted by August of
last year, HHS must prepare final regulations. We assembled an
interagency team to assist us in preparing the proposed
regulation, including representatives from the Departments of
Labor, Defense, Justice, Commerce, the Social Security
Administration, the Office of Personnel Management, the
Department of Veterans Affairs, and the Office of Management
and Budget. We published the proposed rule on November 3 of
1999; the period for public comment closes today, February 17,
2000, and we will call upon a similarly broad team to review
and respond to the public comments.
We explained the basis for our proposals in detail in the
preamble to the proposed rule and asked for comments on over
150 specific issues. We are committed to reviewing all the
public comments. Nothing in our proposed rule is set in stone.
We are committed to achieving the proper balance between
ensuring patient privacy and the needs of the health care
system to function properly and continue advances in medical
treatment. Our commitment to 'getting it right' led us to
extend the comment period fro January 3 to February 17, so the
public and stakeholders would have adequate time to consider
the proposed rule, comment, and suggest alternative proposals.
Since we have just begun to review the comments, I will not
speculate on or debate the contents of the final rule today. I
can tell you that, as of yesterday, we had received over 30,000
comments by mail or hand delivery, and another 10,000 on our
web site. Further, we met with dozens of individuals and
organizations to hear more about their concerns and clarify
provision of the proposed rule.
While we are moving ahead to prepare the final regulation,
the President and Secretary Shalala have made it very clear
that their first priority is to see Congress enact a health
information privacy bill that builds upon the progress made by
our proposed regulation and ensures comprehensive privacy
protections. We believe our rule will be a very good start in
providing confidentiality protections, but legislation is
needed to complete this important task and provide the
protections envisioned in the Secretary's recommendations. Our
staff have been working closely with many of your staff, and
staff in the Senate, to assist you in achieving that goal.
Again, let me reiterate, we want to see legislation, and we
want to work with you to make that happen.
The issue of health information privacy is quite complex--
in order to resolve it legislatively, some difficult choices
will have to be made. We believe that our recommendations
strike the appropriate balance between the privacy needs of our
citizens and the critical needs of our health care system and
our nation. This is an issue that touches every single
American, and to reach resolution we will need a bipartisan
effort.
THE NEED FOR LEGISLATION
It has been over 25 years since a public advisory committee
appointed by former HEW Secretary Elliot Richardson set forth
principles of fair information practices that led to the
landmark Federal Privacy Act. The Privacy Act is premised on
the idea that individuals have a right to know what personal
information the government holds about them, how that
information will be used, and the right to review that
information. Those 25 years have brought vast changes in our
health care system.
Changes in our health care delivery system mean that we
must place our trust in entire networks of insurers and health
care professionals--both public and private. The computer and
telecommunications revolutions mean that information no longer
exists in one place--it can travel in real time to many
hospitals, physicians, insurers, and across state lines.
In addition, new discoveries in biology mean that a whole
new world of medical tests have the potential to help prevent
disease. However, they also reveal the most personal health
information about an individual and his or her family. Without
safeguards to assure citizens that getting tested will not
endanger their families' privacy or health insurance, we could
endanger one of the most promising areas of research our nation
has ever seen.
Health care privacy can be safeguarded. It must be done
with national legislation, national education, and an on-going
national conversation.
Currently, when we give a physician or health insurance
company precious health information, the level of protection
will vary widely from state to state. We have no comprehensive
federal health information privacy standards. Because the
practice of health care is increasingly becoming interstate
through mergers, complex contractual relationships and enhanced
telecommunications, we can no longer rely on the existing
patchwork of state laws. The patchwork does not provide
Americans the privacy protections they need or expect. The
Congress should seize upon this opportunity to create strong
federal standards and reassure the public that they can trust
their health care providers and insurers to keep their health
information secure.
In developing our recommendations for federal legislation,
we learned a great deal through consultations with a variety of
outside groups and from six days of public hearings conducted
by the National Committee on Vital and Health Statistics, our
statutory federal advisory committee for health data and
privacy policy. The hearings involved over 40 witnesses from
across the health community, including health care
professionals, plans, insurance companies, the privacy
community, and the public health and research communities.
We believe our recommendations provide a balanced framework
for legislation that can protect the privacy of medical
records, guarantee consumers the right to inspect their
records, and punish unauthorized disclosures of personal health
data by hospitals, insurers, health plans, drug companies or
others.
THE PRINCIPLES
The Secretary's recommendations for legislation, and our
proposed regulation, are grounded in five key principles:
Boundaries, Security, Consumer Control, Accountability, and
Public Responsibility.
Boundaries
The first is the principle of Boundaries: With very few
exceptions, personally identifiable health care information
should be disclosed for health purposes and health purposes
only. It should be easy to use it for those purposes, and very
difficult to use it for other purposes.
For example, employers should be able to use the
information furnished by their employees to provide on-site
care or to administer a health plan in the best interests of
those employees. But those same employers should not be able to
use information obtained for health care purposes to
discriminate against individuals when making employment
decisions--such as hiring, firing, training, placements and
promotions. To enforce these boundaries, we recommend strong
penalties for the inappropriate use or disclosure of medical
records.
We recommend that the legislation apply specifically to
providers and payers, and to anyone who receives health
information from a provider or payer, either with the
authorization of the patient or as authorized explicitly by
legislation. To the extent allowed under the HIPAA statute, we
have taken this approach in our proposed regulation. Our
proposed rule would authorize the use and disclosure of
personal information by heath plans and providers without the
person's consent for specified health care and national
priority purposes, and would require fair and informed consent
from individuals for all other uses. However, as discussed
below, the statute limits our authority to ensure that
information that leaves a health plan or provider remains
protected.
Our recommendations also recognize that these providers and
payers do not act alone. In order for a provider or payer to
operate efficiently, it may need to enlist a service
organization to perform an administrative or operational
function. For example, a hospital may hire an organization to
encode and process bills, or a managed care organization may
contract with a pharmaceutical benefit management company to
provide information to pharmacists about what medications are
covered and appropriate for their customers.
The numbers and types of service organizations are
increasing every day. While most do not have direct
relationships with the patients, they do have access to their
personal health care information. Therefore, we recommend that
they should be bound by the same standards. For example, a
health plan's contractor should be allowed to have access to
patient lists in order to do mailings to remind patients to
schedule appointments for preventive care. But it should not be
able to sell the patient lists to a pharmaceutical company for
a direct mailing announcing a new product (without the person's
consent). With the Business Partner provisions of our proposed
Privacy Standards, we have taken this approach to the extent
allowed under the HIPAA statute.
Security
The second principle is Security. Americans need to feel
secure that when they give out personal health care
information, they are leaving it in good hands. Information
should not be used or given out unless either the patient
authorizes it or there is a clear legal basis for doing so.
There are many different ways that private information like
your blood tests could become public. People who are allowed to
see it--such as lab technicians--can misuse it either
carelessly or intentionally. And people who should not be
seeing it--such as marketers or even hackers--can find a way to
access it, either because the organization holding the
information doesn't have proper safeguards or the marketers can
find an easy way around the safeguards. To give Americans the
security they expect and deserve, Congress should develop
legislation that requires those who legally receive health
information to take reasonable steps to safeguard it or face
consequences for failure to do so.
What do we mean by reasonable steps? The organizations
should be required to have in place protective administrative
and management techniques, educate their employees about these
procedures, and impose disciplinary sanctions against employees
who use information improperly or carelessly.
We addressed some of these steps in our Security Standards
regulation, implementing the Administrative Simplification
mandate under HIPAA.\2\ That NPRM laid out a range of
approaches for safeguarding the information to which the HIPAA
mandate applies. In the privacy NPRM we proposed related steps
for safeguarding health information, and we will coordinate
these requirements in the final Security and Privacy
regulations. However, these regulations will not reach all
health information held by health plans and providers. We need
legislation to cover all health information that needs this
kind of protection.
---------------------------------------------------------------------------
\2\ The notice of proposed rule making for Security and Electronic
Signature Standards, covering security safeguards for electronic
information, was published on August 12, 1998.
---------------------------------------------------------------------------
We don't believe a law can specify the details of these
protections because each organization must keep pace with the
new threats to our privacy and the technology that can either
abate or exacerbate them. But a federal law can require
everyone who holds health information to have these types of
safeguards in place and specify the appropriate sanctions if
the information is improperly disclosed. In our regulations, we
have proposed such a ``scalable'' approach, to reflect the
differences in the size and nature of the entities that hold
health information. The proposed regulations set forth the
basic principles and general criteria for securing health
information, and leave the specific steps for meeting these
principles to each regulated entity. In this way, each entity
can take the steps most appropriate to its size, the nature of
the information it holds, and its business practices.
Consumer Control
The third principle is Consumer Control. The principles of
fair information practice (formulated in 1973 by a committee
appointed by Secretary Richardson) included as a basic right:
``There must be a way for an individual to find out what
information about him is in a record and how it is used.''
With very narrow exceptions, consumers should have the
right to find out what is contained in their records, find out
who has looked at them, and to inspect, copy and, if necessary,
correct them. Consumers should be given a clear explanation of
these rights and they should understand how organizations will
use their information. Let me give you an example of why this
is important. According to the Privacy Rights Clearinghouse, a
California physician in private practice was having trouble
getting health, disability, and life insurance. She ordered a
copy of her report from the Medical Information Bureau--an
information service used by many insurance companies. It
included information showing that she had a heart condition and
Alzheimer's disease. There was only one problem. None of it was
true. Unfortunately, under the current system these types of
errors occur all too often. Consumers often do not have access
to their own health records and even those who do are not
always able to correct some of the most egregious errors.
With that in mind, our Recommendations set forth a set of
practices and procedures that would require that insurers and
health care providers provide consumers with a written
explanation of who has access to their information and how that
information will be used, how they can restrict or limit access
to it, and what their rights are if their information is
disclosed improperly.
We also recommend procedures for patients to inspect and
copy their information, and set out the very limited
circumstances under which patient inspection should be properly
denied.
Finally, we recommend a process for patients to seek
corrections or amendments to their health information to
resolve situations in which innocent coding errors cause
patients to be charged for procedures they never received, or
to be on record as having conditions or medical histories that
are inaccurate. The proposed privacy standards follow these
Recommendations.
Accountability
The fourth principle is Accountability. If you are using
information improperly, you should be punished. This flows
directly from the second principle of security--the requirement
to safeguard information must be followed by real and severe
penalties for violations. Congress should send the message that
protecting the confidentiality of health information is vitally
important, and that people who violate that confidence will be
held accountable.
We recommend that offenders should be subject to criminal
felony penalties if they knowingly obtain or use health care
information in violation of the standards outlined in our
report. The penalties mandated in privacy legislation should be
higher when violations are for monetary gain. In addition, when
there is a demonstrated pattern or practice of unauthorized
disclosure, those committing it should be subject to civil
monetary penalties.
In addition to punishing the perpetrators, we must give
redress to the victims. We believe that any individual whose
privacy rights have been violated should be permitted to bring
a legal action for actual damages and equitable relief. The
standard for such actions should not be set so high as to make
the right meaningless in practice. Attorney's fees and punitive
damages should be available when the violation is particularly
egregious. As described more fully below, the HIPAA legislative
authority does not allow the regulation to accomplish these
goals.
These first four principles--Boundaries, Security, Consumer
Control and Accountability--must be carefully weighed against
the fifth principle, Public Responsibility.
Public Responsibility
Just like our free speech rights, privacy rights can never
be absolute. We have other critical--yet often competing--
interests and goals. We must balance our protections of privacy
with our public responsibility to support national priorities--
public health and safety, research, quality care, and our fight
against health care fraud and abuse and other unlawful
activities.
Our Department is acutely aware of the need to use personal
health information for each of these national priorities. For
example, researchers have used health records to help us fight
childhood leukemia and uncover the link between DES and
reproductive cancers. Public health agencies use health records
to warn us of outbreaks of emerging infectious diseases. HHS
auditors use health records to uncover kickbacks, overpayments
and other fraudulent activity. In addition, our efforts to
improve quality in our health care system depend on our ability
to review health information to determine how well health
institutions and health professionals are caring for patients.
For public health and safety, research, quality
evaluations, fraud investigations, and legitimate law
enforcement purposes, it's not always possible, or desirable,
to ask for each patient's authorization for access to the
necessary health information. And, in many cases, doing so
could create major obstacles in our efforts. While we must be
able to use identifiable information when necessary for these
purposes, we should use information that is not identifiable as
much as possible.
To demonstrate how access must be balanced against public
responsibility, let me outline a few of the areas in which we
recommend that disclosure of health information should be
permitted without patient authorization.
Public Health and Safety
Under certain circumstances, we recommend permitting health
care professionals, payers, and those receiving information
from them to disclose health information without patient
authorization to public health authorities for disease
reporting, adverse event reporting, public health and safety
investigation, or intervention. This is currently how the
public health system operates under existing State and federal
laws.
For example, consider the outbreak of E. coli in hamburger
that resulted in the largest recall of meat products in
history. Public health authorities, working with other
officials, used personally identifiable information to identify
quickly the source of the outbreak and thereby prevent
thousands of other Americans from being exposed to a
contaminated product.
Research
An important mission for the Department of Health and Human
Services is to fund and conduct health research. We understand
that research is vitally important to our health care and to
progress in medical care. Legislation should not impede this
activity.
Today the Federal Policy for Protection of Human Subjects
(the Common Rule) and FDA's Human Subject Protection
Regulations protect participants in research studies that are
funded or regulated by the federal government. These rules help
protect the research subjects while not impeding the conduct of
research. To protect patient privacy, we recommend that similar
protections should be extended to all research in which
individually identifiable health information is disclosed
without patient authorization, and not just federally funded or
regulated research.
Researchers should determine whether their research
requires the retention of personal identifiers. There are
research studies that can only be conducted if identifiers are
retained; for example, outcomes studies for heart attack
victims or the recent study which identified a correlation
between the incidence of Sudden Infant Death Syndrome and the
infant's sleep position. In addition, if, and when, personal
identifiers are no longer needed, the researcher should be
required to remove them and provide assurances that the
information will be protected from improper use and
unauthorized additional disclosures.
Under the Common Rule, if personal identifiers are
necessary, an IRB (Institutional Review Board) must review the
research proposal and determine whether informed consent is
required or may be waived. In order for informed consent to be
waived, an IRB must determine that the research involves no
more than minimal risk to participants, that the absence of
informed consent will not adversely affect the rights and
welfare of participants, that conducting the research would be
impracticable if consent were required, and that whenever
appropriate, the participants will be provided with additional
pertinent information after participation. This kind of IRB,
privacy board, or a similar mechanism of review should be
applicable for all research using individually identifiable
health information without a patient authorization, regardless
of funding source.
Because the Common Rule was designed for protection of
human subjects in general, not specifically with privacy
protection in mind, our Recommendations included additional
criteria for release of information without the subject's
consent. We included those criteria in our proposed rule. We
believe that, before an IRB or privacy board can approve
disclosure of health information without the subject's consent,
it should determine that: the research would be impracticable
to conduct without the identifiable health information; the
research project is of sufficient importance to outweigh the
privacy intrusion that would result from the disclosure; there
is an adequate plan to protect the identifiers from improper
use and disclosure; and there is an adequate plan to destroy
the identifiers at the earliest opportunity, unless there is a
health or research justification for retaining identifiers. We
have included these additional criteria in the proposed privacy
regulation.
PREEMPTION
Our recommendations call for national standards. But, we do
not recommend outright or overall federal preemption of
existing State laws that are more protective of health
information.
Some protections that we recommend will be stronger than
some existing State laws. Therefore, we recommend that Federal
legislation replace State law only when the State law is less
protective than the Federal law. Thus, the confidentiality
protections provided would be cumulative and the Federal
legislation would provide every American with a basic set of
rights with respect to health information.
This is consistent with the broader approach taken to
preemption in the HIPAA statute, both in the insurance reform
provisions and the administrative simplification and privacy
provisions. For the most part, State laws that go further than
the federal law are preserved. We recognize that there are some
concerns with this approach. In fact, some of these concerns
are recognized in the privacy provisions of the HIPAA statute,
which create carve outs from preemptions for state laws
governing certain public health functions as well as other
specific activities such as fraud and abuse. At the same time,
we believe that, if a federal law is sufficiently strong,
states will not need to enact additional privacy legislation.
HHS PROPOSED PRIVACY STANDARDS
Process and Status
To assist us in developing the proposed rule, we assembled
an interagency team including representatives from all parts of
HHS, as well as the Departments of Labor, Defense, Commerce,
and Justice, the Social Security Administration, the Department
of Veterans Affairs, the Office of Personnel Management, and
the Office of Management and Budget. We published the proposed
rule on November 3 of 1999; the period for public comment
closes, today, February 17, 2000 and we will call upon the same
broad team to review and respond to the public comments.
We have also continued the consultations with outside
groups that we began in preparing the Recommendations. Since
the proposed rule was published, we have meet with over____,
and many of these were coalitions representing still more
interested parties. We have learned a great deal from these
consultations, and will continue fact-finding outreach as
necessary based on our review of the public comments.
As of February 15, we had received over 30,000 comments by
mail or hand delivered, and roughly 10,000 electronically via
the web. Once we have logged in all the comments, we will make
them available to the public on our web site. Although we have
not set a target date for the final rule, largely because we do
not know how many comments we will receive, we intend to
continue to make this regulation a top priority and publish a
final rule as soon as possible, consistent with our
responsibility to take the public comments into account.
The proposed rule is based on the five key principles
outlined above, from the Secretary's recommendations:
Boundaries, Security, Consumer Control, Accountability, and
Public Responsibility. To the extent possible under the HIPAA
statutory authority, it implements these principles as
discussed in detail in the Recommendations.
Because the proposed rule is widely available, we will not
repeat it here. Rather, we will highlight a few areas in which
we are unable to implement our Recommendation in full due to
limitations in the Statutory authority provided under the
HIPAA. A summary of the proposed rule is attached, and is
available at our web site.
WHY THE REGULATION DOES NOT PROVIDE COMPLETE PROTECTION
Coverage
The Recommendations call for legislation that applies to
health care providers and payers who obtain identifiable health
information from individuals and, significantly, to those who
receive such information from providers and payers. The
Recommendations follow health information from initial creation
by a health plan or health care provider, through various uses
and disclosures, and would establish protections at each step:
``We recommend that everyone in this chain of information
handling be covered by the same rules.''
However, the HIPAA limits the application of our proposed
rule to health plans, health care clearinghouses, and to any
health care provider who transmits health information in
electronic form in connection with transactions referred to in
section 1173(a)(1) of the Act (the ``covered entities'').
Unfortunately, this leaves many entities that receive, use and
disclose protected health information outside of the system of
protection that we propose to create.
In particular, the statute does not directly cover many of
the persons who obtain identifiable health information from the
covered entities. In the rule we are, therefore, faced with
creating new regulatory permissions for covered entities to
disclose health information, but cannot directly put in place
appropriate restrictions on how many of the likely recipients
of such information may use and re-disclose such information.
For example, the Secretary's Recommendations proposed that
protected health information obtained by researchers not be
further disclosed except for emergency circumstances, for a
research project that meets certain conditions, and for
oversight of research. In the rule, however, we cannot impose
such restrictions directly on researchers; instead, we propose
that plans and providers obtain proof of IRB or privacy board
approval of the research protocol. Additional examples of
persons who receive health information but whom we cannot reach
with the regulation include employers, workers compensation and
life insurance issuers, and law enforcement officers. We also
do not have the authority to directly regulate many of the
persons that covered entities hire to perform administrative,
legal, accounting, and similar services on their behalf, and
who would obtain health information in order to perform their
duties. This inability to directly address the information
practices of these groups leaves an important gap in the
protections provided by the proposed rule.
In addition, only those providers who engage in the
electronic administrative simplification transactions can be
covered by this rule. Any provider who maintains a solely paper
information system would not be subject to these privacy
standards, thus leaving another gap in the system of protection
we propose to create.
The need to match a regulation limited to a narrow range of
covered entities with the reality of information sharing among
a wide range of entities led us to consider severe limits on
the type or scope of the disclosures that would be permitted
under the proposed regulation. The disclosures we propose to
allow, however, are necessary for smooth operation of the
health care system and for promoting key public goals such as
research, public health, and law enforcement. We decided that,
on balance, such severe limits on disclosures could do more
harm than good. The only appropriate way to fill this gap in
protection is with legislation that regulates not just the
disclosing plans and providers, but also those receiving health
information from plans and providers.
Enforcement
Requirements to protect individually identifiable health
information must be supported by real and significant penalties
for violations. We recommend federal legislation that would
include punishment for those who misuse personal health
information and redress for people who are harmed by its
misuse. We believe there should be criminal penalties
(including fines and imprisonment) for obtaining health
information under false pretenses, and for knowingly disclosing
or using protected health information in violation of the
federal privacy law. We also believe that there should be civil
monetary penalties for other violations of the law, and that
any individual whose rights under the law have been violated
should be permitted to bring an action for actual damages and
equitable relief. Only if we put the force of law behind our
rhetoric can we expect people to have confidence that their
health information is protected, and ensure that those holding
health information will take their responsibilities seriously.
In HIPAA, Congress did not provide sufficient enforcement
authority. There is no private right of action for individuals
to enforce their rights. In addition, we are concerned that the
penalty structure does not reflect the importance of these
privacy protections and the need to maintain public trust in
the system.
For these and other reasons, we continue to call for
federal legislation to ensure that privacy protection for
health information will be strong and comprehensive.
CONCLUSION
Mr. Chairman, the five principles embodied in our
recommendations and proposed regulation--Boundaries, Security,
Consumer Control, Accountability, and Public Responsibility--
should guide a law that will create comprehensive federal
standards and provide our citizens with real peace of mind.
The principles represent a practical, comprehensive and
balanced strategy to protect health care information that is
collected, shared, and used in an increasingly complex world.
In addition to creating new federal standards, we must
ensure that every single person who comes in contact with
health care information understands why it is important to keep
the information safe, how it can be kept safe, and what will be
the consequences for failing to keep it safe. Most of all, we
must help consumers understand not just their privacy rights,
but also their responsibilities to ask questions and demand
answers--to become active participants in their health care.
Mr. Chairman, we in the Department and the Administration
are eager to work with you to enact strong national medical
privacy legislation.
Thank you again, for giving me this opportunity to testify.
I look forward to answering any questions that you may have.
Proposed Standards for Privacy of Individually Identifiable Health
Information
Statutory Requirement
Section 264 of the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), Public Law 104-191, enacted
August 21, 1996, requires that, if legislation establishing
privacy standards is not enacted ``by the date that is 36
months after the date of the enactment of this Act, the
Secretary of Health and Human Services shall promulgate final
regulations containing such standards not later than the date
that is 42 months after the date of the enactment of this
Act.''
The statutory deadline for Congress to enact legislation
was August 21, 1999. Absent legislation, HHS has developed its
proposed rule.
Overview
The proposed rule would:
allow health information to be used and shared
easily for the treatment and for payment of health care;
allow health information to be disclosed without
an individual's authorization for certain national priority
purposes (such as research, public health and oversight), but
only under defined circumstances;
require written authorization for use and
disclosure of health information for other purposes, and
create a set of fair information practices to
inform people of how their information is used and disclosed,
ensure that they have access to information about them, and
require health plans and providers to maintain administrative
and physical safeguards to protect the confidentiality of
health information and protect against unauthorized access.
Scope
a. Entities covered by the proposed rule
Health care providers who transmit health
information electronically
Health plans
Health care clearinghouses
b. Health information covered by the proposed rule
(``Protected health information'')
Protection would start when information becomes
electronic, and would stay with the information as long as the
information is in the hands of a covered entity.
Information becomes electronic either by being
sent electronically as one of the specified Administrative
Simplification transactions or by being maintained in a
computer system.
The paper progeny of electronic information is
covered; the information would not lose its protections simply
because it is printed out of the computer.
HIPAA protects the information itself, not the
record in which the information appears.
The information must be ``identifiable.'' If the
information has any components that could be used to identify
the subject, it would be covered.
General rules
We propose that covered entities be prohibited from using
or disclosing health information except: as authorized by the
patient, or as explicitly permitted by the regulation. The
regulation would permit use and disclosure of health
information without authorization for purposes of health care
treatment, payment and operations, and for specified national
policy activities under conditions tailored for each type of
such permitted use or disclosure.
The amount of information to be used or disclosed
would be restricted to the minimum amount necessary to
accomplish the relevant purpose, taking into consideration
practical and technological limitations.
There would be exceptions for situations in which
assessment of what is minimally necessary is appropriately made
by someone other than the covered entity (e.g., such as when an
individual authorizes a use or disclosure of information, or
when the disclosure is mandatory under another law).
We would allow covered entities to rely on
requests by certain public agencies in determining the minimum
necessary information for certain disclosures.
Under the principle of minimum necessary use, if
an entity consists of several different components, the entity
would be required to create barriers between components so that
information is not used or shared inappropriately.
To encourage covered entities to strip identifiers
from health information when it is possible to do so, we would
permit a covered entity to use and disclose such de-identified
information in any way, provided that:
it does not disclose the key or other mechanism
that would enable the information to be re-identified, and
it has no reason to believe that such use or
disclosure will result in the use or disclosure of protected
health information (e.g., because the recipient has the means
to re-identify the information).
We would treat the key to coded identifiers the
same as the information to which it pertains. A covered entity
could use or disclose a key only as it could use or disclose
the underlying information.
We would permit covered entities to disclose
protected health information to persons they hire to perform
functions on their behalf, where such information is needed for
that function. These ``business partners'' would include
contractors such as lawyers, auditors, consultants, health care
clearinghouses, and billing firms, but not members of the
covered entity's workforce.
Except where the business partner is providing a
treatment consultation or referral, we would require covered
entities to enter into contracts with their business partners
and would require the contracts to include terms to ensure that
the protected health information disclosed to a business
partner remains confidential. Business partners would not be
permitted to use or disclose protected health information in
ways that would not be permitted of the covered entity itself.
We use the contract as a tool for protecting information,
because the HIPAA does not provide legislative authority for
the rule to reach many such business partners directly.
The uses and disclosures permitted by this rule
would be exactly that--permitted, not required. For disclosures
not compelled by other law, providers and payers would be free
to disclose or not, according to their own policies and
principles. At the same time, nothing in this rule would
provide authority for a covered entity to refuse to make a
disclosure mandated by other law.
Only two disclosures would be required by this
proposed rule: disclosure to the subject individual pursuant to
the individual's request to inspect and copy health information
about him or her, and certain disclosures for the purposes of
enforcing the rule.
Health information covered by the proposed rule
generally would remain protected for two years after the death
of the subject of the information, subject to certain
exceptions.
Disclosures without authorization for health care treatment,
payment, and operations
Covered entities could use and disclose protected
health information without authorization for treatment, payment
and health care operations. This would include purposes such as
quality assurance, utilization review, credentialing, and other
activities that are part of ensuring appropriate treatment and
payment.
Individuals generally could ask a covered entity
to restrict further use and disclosure of protected health
information for treatment, payment, or health care operations,
with the exception of uses or disclosures required by law. The
covered entity would not be required to agree to such a
request, but if the covered entity and the individual agree to
a restriction, the covered entity would be bound by the
agreement.
Uses and disclosures with individual authorization
Covered entities could use or disclose protected
health information with the individual's authorization for
almost any lawful purpose.
We would prohibit covered entities from
conditioning treatment or payment on the individual agreeing to
disclose information for other purposes, and require the
authorization form to state this prohibition.
While the provisions of this proposed rule are
intended to make authorizations for treatment and payment
purposes unnecessary, some States may continue to require them.
Generally, this rule would not supersede such State
requirements. However:
the rule would impose a new requirement that such
State-mandated authorizations must be physically separate from
an authorization for other purposes described in this rule.
the authorization would have to meet the rule's
requirements for the content of such authorizations (although a
state law could require that an authorization contain
additional provisions).
We would require authorizations to specify the
information to be disclosed, who would get the information, and
when the authorization would expire. If an authorization is
sought so that a covered entity may sell or barter the
information, the covered entity would have to disclose this
fact on the authorization form.
Use or disclosure of information by the covered
entity inconsistent with the authorization would be unlawful.
Individuals could revoke an authorization.
Permissible uses and disclosures for purposes other than
treatment, payment and operations
Covered entities could use and disclose protected
health information without individual authorization for the
following national priority activities:
Oversight of the health care system, including
quality assurance activities;
Public health, and in emergencies affecting life
or safety;
Research;
Judicial and administrative proceedings;
Law enforcement;
To provide information to next-of-kin;
For identification of the body of a deceased
person, or the cause of death;
For government health data systems;
For facilities' (hospitals, etc.) directories;
To financial institutions, for processing payments
for health care; and
In other situations where the use or disclosure is
mandated by other law, consistent with the requirements of the
other law.
Specific conditions would have to be met in order
for the use or disclosure of protected health information to be
permitted. These conditions are tailored to the need for each
specific category listed above and to the types of
organizations involved in such activities.
Individual rights
The proposed rule would provide several basic rights for
individuals with respect to protected health information about
them. Individuals would have:
The right to receive a written notice of
information practices from health plans and providers. The
notice must describe the types of uses and disclosures that the
plan or provider would make with health information (not just
those uses and disclosures that could lawfully be made). When
plans and providers change their information practices, they
would also have to update the notice. Plans and providers would
be required to follow the information practices specified in
their most current notice.
The right to obtain access to protected health
information about them, including a right to inspect and obtain
a copy of the information.
The right to request amendment or correction of
protected health information that is inaccurate or incomplete.
The right to receive an accounting of the
instances where protected health information about them has
been disclosed by a covered entity for purposes other than
treatment, payment, or health care operations (subject to
certain time-limited exceptions for disclosures to law
enforcement and oversight agencies)
Administrative requirements and policy development and
documentation
This proposed rule would require providers and payers to
develop and implement basic administrative procedures to
protect health information and the rights of individuals with
respect to that information.
Covered entities would be required to maintain
documentation of their policies and procedures for complying
with the requirements of the proposed rule. The documentation
must include a statement of the entity's practices regarding
who would have access to protected health information, how that
information would be used within the entity, and when that
information would or would not be disclosed to other entities.
Covered entities would be required to have in
place administrative systems, appropriate to the nature and
scope of their business, that enable them to protect health
information in accordance with this rule. Specifically, covered
entities would be required to:
designate a privacy official;
provide privacy training to members of its
workforce;
implement safeguards to protect health information
from intentional or accidental misuse;
provide a means for individuals to lodge
complaints about the entity's information practices, and
maintain a record of any complaints; and
develop a system of sanctions for members of the
workforce and business partners who violate the entity's
policies.
Scalability
We propose privacy standards that covered entities must
meet, but leave the detailed policies and procedures for
meeting these standards to the discretion of each covered
entity.
We intend that implementation of these standards
be flexible and scalable, to account for nature of each covered
entity's business, and the covered entity's size and resources.
We would require that each covered entity assess its own needs
and implement privacy policies appropriate to its information
practices and business requirements.
The preamble to the proposed rule will include
examples of how implementation of these standards are scalable.
Preemption
Pursuant to HIPAA, this rule will preempt state laws that
are in conflict with the regulatory requirements and that
provide less stringent privacy protections, with specified
exceptions for certain public health functions and related
activities.
Enforcement
Under HIPAA, the Secretary is granted the
authority to impose civil monetary penalties against those
covered entities which fail to comply with the requirements of
this regulation.
HIPAA also established criminal penalties for
certain wrongful disclosures of protected health information.
These penalties are graduated, increasing if the offense is
committed under false pretenses, or with intent to sell the
information or reap other personal gain.
Civil monetary penalties are capped at $25,000 for
each calendar year for each standard that is violated.
What this proposed rule does not do
The HIPAA limits the application of our proposed
rule to the covered entities. It does not provide the authority
for the rule to reach many entities that receive health
information from these covered entities, so the rule cannot put
in place appropriate restrictions on how such recipients of
protected health information may use and re-disclose such
information.
Any provider who maintains a solely paper
information system cannot be subject to these privacy
standards.
There is no statutory authority for a private
right of action for individuals to enforce their privacy
rights.
Chairman Thomas. Thank you, Dr. Hamburg.
In my opening comments I indicated some concern about the
timeline for issuing final regulations and it has become
something of, if not a joke, at least a model for us to be
concerned about. I am referring to the 1993 legislation that is
commonly referred to as Stark II in terms of self-referral,
compensation and ownership. I have long thought that the
ownership portion made complete sense and that portion has not
been too difficult to get a handle on. But you have been
chasing the elusive butterfly of compensation for seven years
now and you still have not issued final regulations.
I am guessing, as you indicated with all of the concerns
and frustrations with the underlying legislation, although I
think setting up some parameters that you bumped into, some of
which you seemed to be able to knock over and keep going for
whatever reasons and decided to stop with the others that were
in the legislation, it might be ultimately a useful thing so
that we can at least focus on friction areas or problem areas.
But in the Stark II legislation, seven years no final
regulation in the area of compensation.
I personally believe that if you do issue final regs all
they will be will be intermediate final regs which will then
have to be fine-tuned by legislation and in fact I am trying to
short-circuit that.
That is by way of a preamble of saying, I do not think we
can let that history be a model in this particular area. There
have been attempts, primarily on the Senate side, to move
forward legislatively. I want to underscore the gratitude from
myself, and based upon the comments, shared by other members of
this subcommittee on your willingness to jump in and move
relatively expeditiously.
However, you have come up with just a couple of points that
I would like to highlight in terms of the difficulty and invite
your response. I do not want to go into an extensive question
and answer period. I will submit in writing to you so you can
feel comfortable in commenting on them about two dozen
additional questions, some of which I might have ordinarily
asked, so that we can better understanding your thinking in
particular areas.
So the questions that I would ask you are kind of general
but highlight the concerns in particular areas. You indicate
that you have made a cost estimate of this particular
legislation of about $3.8 billion. Often times we joke about
how close something is for Government work. So if you are off
by a factor of two, that is close enough for Government work. A
factor of three to five, that is probably sloppy Government.
But what we are going to hear is testimony that you may be
off as much as seven, eight, 10 times the amount of money, in
part because, I believe, of the ripple effect to secondary
structures otherwise known, for example, as business partners
who are covered entities and that you require a level of
knowledge and performance on a ripple out aspect that I have a
hard time believing was part of your estimate contained in the
$3.8 billion.
Do you have a comfort level that the $3.8 billion is a
pretty complete cost analysis on what will be hopefully, with
minor adjustments, the final rule? Or are you planning on
doing, based upon the comments submitted, a more complete cost
analysis before publishing a final rule?
Dr. Hamburg. That, of course, is a very important question.
We had put forward a cost estimate that spanned a range, about
$1.6 to $6.3 billion, but recognized that there were areas of
activity contained within the proposed regs where we did not
have very good data for doing cost analysis, and one of the
things we asked for in the process of comment was for
additional data that could help enlighten these concerns.
There have been cost estimates that have been put out and
other evaluations that we think are quite inflated, that cost
out activities that in fact are not contained within our regs.
Of course, we recognize that we put forward a proposed reg on a
complex issue for which there are many, as you say, ripple
effects, many interested parties, and the final regulation will
be shaped very much by the kinds of comments that are coming
in.
We will be looking very closely the cost issues but we do
believe that the cost estimates that have been put forward by
some other entities really do not crosswalk with what is in the
reg as it currently exists. We will look closely at those so
that we can compare how they got to their numbers, how we got
to our numbers, and we have been engaged in that. We do need to
look at some areas where we did not feel we had adequate data
and see if new data sheds new light.
Chairman Thomas. I do not want anyone to assume that what
is driving this is a cost consideration. It is just that I
would like to have it as accurate as we can because, frankly,
when you move to these other business partners as covered
entities--I mean, there are existing relationships--you are
going on top of, in many instances, State laws. And of course,
there are preexisting State licensing requirements that deal
with professional conduct.
It just seems to me that as you extend this umbrella of a
partial Federal structure as you do, it is going to require
necessarily renegotiations of a number of contracts which may
in fact either impede care that is out there or produce some
disruption in the structure which will have dollar value to it.
It may be extremely difficult to put a value on that.
But one of the questions that I would have and you may want
to respond briefly now but it will be a part of the written
question area is, did you consider and why did you reject
dealing with business partners being required to certify that
they comply with the regulations, not take one of the covered
entities and hold them liable for a business partner's failure
to comply? Some degree of certification would partially shift
the responsibility.
Now I know you are limited by the legislative window that
is available to you. Would this be an area in which clearly
from a legislative point of view we would want to focus in some
detail?
Dr. Hamburg. I think we all share the concern that these
privacy protections be meaningful, real, and enduring, and our
desire in addressing the business partners question was to
ensure that, if we had privacy protections on the covered
entities, that information that they would be sharing with
business partners would continue to receive the same
protections that the consumers would now have the expectation
of having.
Because of, as you say, the constraints of the statute, we
cannot directly regulate those business partners, but we felt
that we were trying to achieve in the proposed reg just what
you were asking about: the certification that they would comply
with the same privacy protections, and through the contractual
mechanism we thought that could be achieved.
Chairman Thomas. One of the real concerns I have shared by
the way by a colleague on this committee, Ben Cardin, as we
have attempted to move forward in concert in a bipartisan way
in dealing with this area is that although there is some great
desire to maintain a State structure and a Federal structure
and your goal was to build a floor while allowing individual
States to have ceilings.
But the very fact that you have got to reconcile this kind
of crazy quilt of relationships, especially when you throw in a
number of phrases that deal with minimums, in what way do they
relate to State structures, that perhaps it just might be a
better way of looking at this whole area if you do not say that
given today's world, paper or electronic, that a Federal
preemption providing a uniform structure across all States,
one, might not be a better way to afford protection and
confidentiality. But two, would eliminate this extremely
difficult job of trying to mesh from a floor to a ceiling,
different State as well as now, new Federal regulations and
impositions.
Do you personally believe that the approach that the
legislation requires you--that is, you could not offer Federal
preemption--that structure is in fact the better way to go?
Dr. Hamburg. This has been the topic of great debate and
many well-informed thoughtful thinkers weighing in on differing
sides. I think what we are trying to achieve is, as you say,
the establishment of a clear set of protections in which the
consumers can have confidence. If that were to be achieved I
think States would feel less of a need to fill in the gaps and
create their own privacy laws.
There are, however, different concerns in different States.
There are different issues that emerge. There are new
technologies that impact different places differently. So to
allow States to continue to have some flexibility as they see
fit to tailor the law to suit their needs seems like a
reasonable approach. But I do think that having comprehensive
national privacy legislation would go very far in reducing this
patchwork approach.
Chairman Thomas. So you have firmly established yourself on
the one hand, and then on the other. One of the frustrations of
this job is that I almost always want to inquire if any agency
that is going to testify has a one-armed member of the agency
so that when they come they would not be able to be on the one
hand and on the other.
For example, you actually propose to preempt State law, do
you not, in this regulation?
Dr. Hamburg. We propose that where the regs would be more
stringent that it would--
Chairman Thomas. Preempt State law.
Dr. Hamburg. --override State law.
Chairman Thomas. Preempt State law.
Dr. Hamburg. Yes.
Chairman Thomas. Override State law. Say that a State in
its wisdom in making a decision in this was not very wise and
we are going to impose our regulation in this area. So you
already have what I consider to be taken the first step. You
believe there are States whose laws should be preempted by this
Federal standard. But then you say you are going to allow
States to continue to make regulations in particular areas.
We are going to enter an area, in large part based upon the
publicity of data that is somewhat aged at the current time, in
the area of medical errors with the publication of the
Institute of Medicine's, To Err is Human. Would not your
proposal, that is preempt some areas and not preempt others,
invite States to then go ahead and pass laws in terms of
restricting the ability to collect information which we might
consider to be essential in removing what everyone says they
want to remove, and that is the up to 100,000 deaths a year
through medical errors?
I would like you, if you could succinctly as possible,
explain the Administration's position that in certain areas we
want uniformity, but in the most sensitive, most extreme areas
where we have got to gather the data that is most important,
you think it is best to have a crazy quilt of State laws
controlling the flow of this information. What is the rationale
behind that approach?
Dr. Hamburg. I think that, as I have articulated already,
the approach that is being put forward is to create a strong
foundation of privacy protection that would capture what is
believed to represent a firm foundation, and then allow States
the flexibility to respond to the issues that arise within
their States and from their specific constituencies, and
respond to--
Chairman Thomas. Including a strong feeling that certain
information, notwithstanding the fact we believe it is
necessary by building that floor, should not be allowed to flow
and therefore we are going to restrict it?
Dr. Hamburg. I think that States should not be prevented to
respond to needs that they believe have not been addressed, to
respond to emerging concerns, and to respond--
Chairman Thomas. You started off your statement by
indicating that just like freedom of speech it is not absolute,
and that in fact in some areas individual rights need to be
weighed in relationship to the public's right to know and I
guess public health is one of the better areas. My concern is
that you begin to get into this thicket very clearly with the
Administration's approach in which we are going to have to play
catch-up, and as soon as these regulations become final, if
they do, there is no question in my mind that a number of State
legislatures will begin to move.
They are not moving as rapidly now--Minnesota being one of
the prime examples in terms of the enormous difficulty that an
institution with as much as prestige as the Mayo Clinic has,
has done its darnedest to get the private agreement of
individuals, which is the requirement of the Minnesota law. And
the foundation for the excellence of medicine at the Mayo
Clinic is the epidemiological studies in which they are now
looking at a 3 percent hole in their information. Somebody
might say, gee, 97 percent is pretty good. As most of know in
terms of collecting data or doing research, it is not. It is a
hole in the data that makes the data sometimes absolutely
useless.
Very concerned about the attempt to create a structure
which in fact will expedite our inability to go where we need
to go, especially in the area, for example, of medical errors.
Let me give you just one example in terms of the rule that
I have some concern about, because the proposed rule prohibits
the disclosure of research information unrelated to treatment
without an individual's authorization. Would you at least,
since obviously you have a medical background and I do not,
indicate to me that there are sometimes disagreements as to
what information is or is not related to treatment? That a
phrase, unrelated to treatment, is at least open to differing
interpretation?
Dr. Hamburg. To respond to the broad comment that you made
about access to information for research, there are within the
proposed regs clear issues raised about that, and an indication
that there should be circumstances in which researchers can
receive data about individual patients, but that there needs to
be a process that is clearly defined and a set of standards
that are met in terms of that information being made available
and then how it is handled. Not all research requires patient
identifiers with that information. So when you do not need to
use patient identifiers, that clearly provides more patient
protection.
With respect to your question of is there a fuzziness
around whether the information that would go to a researcher is
relevant to treatment--
Chairman Thomas. No, not relevant. Unrelated. Not relevant.
Unrelated is the term that is used in the proposed reg.
Dr. Hamburg. I am not completely sure that I understand
your question. If you are asking whether it will have--
Chairman Thomas. I will submit it in writing and you can
have others who were more directly involved in writing it--
This is the kind of dilemma that I would like to leave with
you and then I will allow my colleague some questions. What
would the department do--just as a for instance, what would the
department do if a State passed a privacy law that enabled
providers to withhold what you considered to be critical public
health information? Now again, sometimes this information is in
the eye of the beholder.
Or for example, that enabled providers to frustrate a
Federal anti-fraud investigation. Not related to public health
but related to an anti-fraud investigation. Is it still the
Administration's position that in these particular instances
the sovereign would be able to go in and overturn the State law
and overturn the State law and get the information they thought
was important?
Dr. Hamburg. I think the proposed rule makes clear that
where there are existing laws that require certain information
be made available, such as with respect to public health, that
information would be made available.
Chairman Thomas. No, the State passed a law saying it was
not going to be provided. So you would go in and say,
notwithstanding what you may assume to be a State right, we are
going to say no in this area; is that what you said?
Dr. Hamburg. For critical issues such as--
Chairman Thomas. Who defines the critical issue?
Dr. Hamburg.--public health would be--
Chairman Thomas. Who defines the critical issue? Does not
the sovereign, does not the Federal Government define it, as
you have done in this regulation in preempting certain State
laws that you thought did not reach a particular level
associated with what you considered to be appropriate?
Dr. Hamburg. We are, as I said, going to be reviewing all
the comments that come in. The final reg is not established
yet, but it is the clear intent as we move forward toward
shaping that final regulation to ensure that such critical
national security, national health protection needs are not
inhibited--
Chairman Thomas. And that is a good position to rally
around, because national security health needs--but I also
mentioned anti-fraud. Would you then push your ability to
overturn State laws if in withholding information it inhibited
the inspector general or others? Because this majority has
passed more than 65 specific assistances in going after fraud
and abuse which the Administration has rightly touted has
produced more than $10 billion of savings over the last several
years in using the tools that we have provided you in stopping
fraud and abuse.
But if a State passed, based upon the desire to withhold
personal information, which may in fact conflict with your
ability to get at anti-fraud, then would you not also want to
move in that area in terms of preemption?
Dr. Hamburg. I think it has been very clear that on the
public responsibility side of this, public health as well as
the fraud and abuse areas, certain law enforcement needs, et
cetera, have to balanced against the other protections and we
feel that is a critical component of what we are trying to
achieve.
Chairman Thomas. All I am saying is that clearly I could
name any number of specific instances in which you would choose
for the sovereign; that is, preempting the State. My argument
is, that is a really slippery slope. Set up a structure and
then have this conflict over a number of years over something
as sensitive as patient medical records, and how they are
handled. And the crazy quilt that your basic structure would
produce across the country.
Perhaps we ought to just face the issue--now this is a
Republican talking about Federal preemption. We should just
face the issue that it ought to be done in a way that gives us
the maximum opportunity to afford uniform security protection,
confidentiality. And that it ought to be a Federal preemption
rather than your Federal floor over where today you think it is
important to preempt State laws, but where tomorrow there is no
question you will find you are put in a choice situation in
which you choose to preempt State laws willy-nilly, which means
you drive other States to pass laws based upon the reaction to
the Federal move.
I just think that direction is fraught with danger in
providing a uniform appropriate data collection for research,
for error correction, commensurate with protecting the
individual's right to confidentiality on their medical records.
The gentleman from Washington.
Mr. McDermott. Thank you, Mr. Chairman. I want to address
my questions both to you, Dr. Hamburg, and also Mr. Claxton,
because I think you had something to do with the writing. You
are not sitting there for no reason. So whichever of you feel
is you are the best to answer the question I think it would be
helpful.
In response to--it is interesting to listen to the
chairman. I do not often hear you suggesting Federal
preemption, big Government. So it is always interesting to
hear.
Chairman Thomas. Uniform Government.
Mr. McDermott. Yes. I am sorry. It may become big, right?
Chairman Thomas. Uniform big is better than non-uniform
big.
Mr. McDermott. When the bill was written--
Chairman Thomas. In the protection of individual rights.
[Laughter.]
Mr. McDermott. I did not interrupt you at all. I let you
have your go here.
The issue of the bill having been written giving you a
Federal preemption, you wrote your regulation with that in
mind. The Congress said you are to preempt State laws; is that
correct?
Dr. Hamburg. With respect to the--yes.
Mr. McDermott. To the narrow areas that are covered by this
regulation.
I make that point because on the one hand we said, preempt
State laws and then we tied your hands. We said, you cannot
look at the whole area of privacy, you just have to look at
this one little narrow area. Coming from having a background in
a State legislature, I do not know how many times we had to
adjust our laws to fit a Federal law. It was a constant part of
being a State legislator was always making adjustments.
So I think the chairman raises an issue, but the reason we
are here on this issue at the national level is because it is
not being done at the local level in a uniform way. I think
there are only 28 States that allow patients to actually look
at their own record. You have a legal right to look at your
record. In many States you cannot go in and say, I want to see
what is in my record.
So it seems to me that is a big part of what you are trying
to do here is to set a floor. Now the question is, how high you
set the floor as to how much you are going to get in the State
legislature. Is that your anticipation?
Dr. Hamburg. I think that you have framed it exactly right.
Mr. McDermott. Because I listen to this and I think to
myself, there is a specific issue that, this business about why
you went at the business partners the way you did. The law says
that you can regulate health plans, providers, certain
providers, and clearinghouses. And anybody who knows anything
about the health care delivery system realizes there is a whole
other series of entities out there that can use, have used for
a variety of reasons, either for research or for marketing
purposes, this data.
Your job was--then they tied our hands with only three, how
do we get at these things? That is the reason why you have the
business partner section in there; is that correct?
Dr. Hamburg. Absolutely. I think it also underscores one of
the reasons why we fundamentally believe that while we have
made a very good faith effort in trying to achieve privacy
protections through this reg, that comprehensive national
legislation will enable a much broader and more protective
approach.
Mr. McDermott. If you had not reached out through this
indirect mechanism of saying that a health care provider or
whatever, or a clearinghouse has to have a contract with their
business partners about this issue, it essentially would be a
loophole big enough to drive--I do not know, anything could fly
through it, if I understand--
Dr. Hamburg. I think that is right, and we would not want
to undermine the public confidence in the protections we are
trying to put forward for them by allowing surrogates of the
covered entities to do exactly the kinds of things with their
health information that we are trying to prohibit through the
proposed reg.
Now we certainly have heard a lot of concerns about how
this concept of reaching to the business partners should be
structured and we will be going over the comments very
carefully and trying to think that through, because we
recognize from important partners that this is an arena that
raises concerns about additional burden, additional cost,
additional liability, and we have to look at that carefully and
take those concerns into consideration.
But we do feel that we cannot simply put forward
protections that would address the covered entities and not
recognize that, as you say, the information goes out in many
different directions. That we have a very complex health care
system and many people are involved, and that our reg only
formally has the power of enforcement and authority over a very
circumscribed element.
Mr. McDermott. Can I ask you a question that I was sitting
here thinking about? If you have an HMO and you have all this
data about your patients, this regulation would prohibit you
from selling that in some kind of commercial means to health
marketing or to wellness whatever or any other entity outside,
would it not?
Dr. Hamburg. Without specific patient authorization.
Mr. McDermott. Now if you have a wholly owned subsidiary
and you transfer it to them, can they then put it out?
Dr. Hamburg. If it would be to be used for marketing and
related activities it would still, even if it was another
entity that was part of this umbrella covered entity, it would
still require specific patient authorization for those
purposes.
Mr. McDermott. But if you spun off--because of the business
partners question or is it because it is part of one entity?
Dr. Hamburg. Any use for marketing would require the
patient authorization.
Mr. Claxton. In your case, because it is part of one
entity.
Mr. McDermott. I am sorry?
Mr. Claxton. In your example it is because it is part of
one entity.
Mr. McDermott. Part of one entity.
Mr. Claxton. If they spun it off--
Mr. McDermott. Now if they spun it off and it is totally
unrelated, has an arms-length relationship with the HMO, it is
now our data marketing organization and we have created a new
entity, Inc., then they have that information and they can do
whatever they wish with it unless you have this contract
between the HMO and this arms-length company--
Dr. Hamburg. Correct.
Mr. McDermott.--that is marketing the data; is that
correct?
Mr. Claxton. Assuming that the entity could have gotten it
in the first place as a partner. If it is doing something on
behalf of the HMO it could have gotten the information in the
first place, and then you need the business partner
relationship to continue to protect the information.
Mr. McDermott. So they give this information to a survey
company and they are doing work for the HMO, and that would be
the relationship. Then whatever they did with it after that is
their own business unless you have this contract.
Dr. Hamburg. Correct.
Mr. McDermott. That is why I think it is important that the
way we wrote the law you had no other way to get at that
relationship, if I understand correctly what you were trying to
do.
Dr. Hamburg. That is absolutely correct.
Mr. McDermott. Now when you look at the whole question of
assuring--
Chairman Thomas. The gentleman's time has expired. We will
move to the other members. If you want to go on for a second
round, you can do that.
Mr. McDermott. Thank you.
Chairman Thomas. The gentleman from Pennsylvania wish to
inquire?
Mr. English. I do, Mr. Chairman, and I appreciate the
opportunity. Secretary Hamburg, reviewing these regulations
which I think address one of the more challenging issues we in
Congress have to face this year I wonder, we can all agree on
the need to prohibit disclosure of patient information as a
central tenet of protecting confidentiality. It is obviously
disclosure of information that patients are rightly concerned
about.
However, this rule, this proposed rule attempts to limit
uses of information without individual authorization, even
within a covered entity such as a hospital. Question, do you
really believe that you know and have included all of the
possible current and future appropriate uses of patient
information? If this rule had been promulgated 15 years ago,
could you have predicted all of the innovations that the
delivery system has today?
Dr. Hamburg. No. I think, first of all in formulating the
reg we tried to think as carefully through all of the many
ramifications as well as emerging potential issues. But it is a
very complex issue, very multi-layered, and we are hoping
through the comment period to broaden our thinking in the short
term. In the long term, of course, things are so rapidly
changing both in terms of how our health care delivery system
is structured, the technology available to support that, and of
course the application of new technologies and procedures and
the implications raised.
So I think that there is not going to be one set of privacy
regs or one comprehensive piece of privacy legislation that
will resolve all the issues now and in the future. But what we
are trying to do is really put forward a framework for
addressing the problems. But we are going to have a dynamic
process.
Mr. English. I understand, but that is the rub. Would it
not be more workable to focus the regulation on disclosure of
patient information and not attempt to regulate use,
particularly within a covered entity?
Dr. Hamburg. I think the two are hand in hand. What we are
trying to define are the circumstances, how information within
a covered entity can be appropriately used and the protections
that should apply. Then also there are needs for others outside
of that covered entity to access that information and then to
clearly define the circumstances under which that will occur
and the responsibility on those outside entities or individuals
in terms of how they appropriately handle the information.
Mr. English. I would like to get your reaction to some
general comments that were sent to Secretary Shalala by
Pennsylvania's department of health. They put forward the
following recommendation. Even though the intent of the
regulation is clear concerning what information is allowed to
be released absent individual authorization, DOH is concerned
that covered entities may react to the regulations by
overprotecting information; i.e., not releasing information to
a public health entity for one of more of the above purposes.
This would undermine the intent of the regulations as well
as core public health functions. DOH will engage in public
education efforts and request that HHS take similar steps to
make sure the intent of the regulations is conveyed.
Are you prepared to do that kind of a public education
effort?
Dr. Hamburg. I can assure you that the concerns raised by
the Pennsylvania Department of Health will be looked at very
seriously. On a very personal basis, I was New York City's
health commissioner for six years prior to taking this job.
Many of the issues they raise are very close to my heart and I
have seen it from the other side. So we will be working
intensively during this comment review period to look at all of
the comments that come in and to address the concerns. But I
can assure you that the issues that surround the issues of
public health information will get a serious look.
Mr. English. I take that as a very important commitment.
One other recommendation they made, they recommend that HHS
should indicate, perhaps in the preamble to the regulation,
that agencies receiving information for the above--that is
public health function purposes--remain bound by existing State
laws which govern the use of such information. Do you agree
with that and are you prepared to respond?
Dr. Hamburg. I would like to be able to look at the comment
before responding in this forum.
Mr. English. Very good. My time has expired, Mr. Chairman,
and I will hopefully get another shot. Thank you.
Chairman Thomas. Thank the gentleman. Although he is not
now a member of the subcommittee--his party rules preclude him
from doing that--I know his heart is always with us, and it is
a pleasure to see the body and mind attached with the heart
today. So the gentleman from Maryland, if he wishes to inquire.
Mr. Cardin. Thank you, Mr. Chairman. I thank you for the
courtesy of allowing me to sit in on this panel. This is a very
difficult subject. Secretary Hamburg, I applaud your efforts
considering the legislative authority that we gave you. It is
difficult to do. And considering the amount of public comment
that you have received, you are finding out exactly how much
interest there is out there and how many people have their own
ideas on how they could draft privacy legislation as it relates
to medical records.
One thing I think is clear, Mr. Chairman, and that is, we
need a bill. It is wonderful that HHS must go forward with a
regulation that is required under law. But ultimately, it is
going to be important I think for Congress to pass the
framework for medical privacy, and to do it in a more
comprehensive way then you are allowed to do under the
regulation that has been submitted to you. Mr. Chairman, I do
want to applaud your efforts to try to bring out a bill on a
bipartisan basis because I think the only way we can do this is
in a bipartisan way. It is a very sensitive issue to all of our
constituents and it cries out for us to get it done right.
I also want to talk just one minute, if I might, about this
idea of a Federal floor and people concerned about preemption,
or whether we preempt or whatever. I think that is the wrong
way to really look at this. We need national standards as to
how medical records should be kept so that we protect the
identity of individuals. That should be a national standard.
There should be no question about that.
The States are clearly going to be involved. There is
public health issues. There are public safety issues, and we
need to make sure the States have the ability to protect their
citizens where it is appropriate. But we also need to have
national standards as to when identifiable information can be
made available for research, or when it can be made available
for payment, or for treatment. I think that is what we are
trying to get at, the right balance.
So the question I have for you, Secretary Hamburg, is that
one of the issues that we are having a great deal of difficulty
is, how do you enforce whatever standards we come up with? How
have you done that in your regulations and how do you think is
the best way for us to make sure that these standards, whatever
standards are developed, that all parties that are affected by
it comply with the standards? And how do you go about making
sure that becomes reality?
Dr. Hamburg. There are a set of enforcement standards that
I believe were given to us through the HIPAA statute in terms
of our opportunities for enforcement. And that is one of our
concerns, one of the reasons why we feel that in fact national
legislation would provide benefits that we cannot achieve
through the reg process. There are both civil and criminal
penalties that can be applied, but in truth, the enforcement
teeth we do not feel are fully adequate.
Mr. Cardin. So will you be coming forward to us with
recommendations as to legislative changes as it relates to
enforcement?
Dr. Hamburg. We are hoping to be working closely with you
to develop national privacy protection legislation, and within
that context addressing the issue of enforcement.
Mr. Cardin. But you have no specific recommendation at this
time?
Mr. Claxton. The Secretary's recommendations in 1997
suggested that we thought there should be civil money penalties
for violations criminal penalties for knowing and wrongful
conduct. And that there should also be private right of action
to address the rights of individual whose privacy rights were
violated and who suffer damages.
Mr. Cardin. This should all be Federal, or not?
Mr. Claxton. We thought Federal law should have that in
place, yes.
Mr. Cardin. How does that relate to State enforcement?
Mr. Claxton. States would have their own penalties if they
had laws. We have not commented on the level of State penalties
that should exist as far as I know. We have had some
discussions with respect to specific issues such as HIV
reporting, but nothing broad.
Mr. Cardin. I take it an awful lot depends on the
standards. I know I am asking a difficult question, but I think
it is important as we get into this discussion to make sure
that whatever system we have come up with is one that there is
effective enforcement on so that we can in fact tell our
constituents that we are not only telling in law the standards
that protect their medical privacy but that it can be enforced.
Thank you, Mr. Chairman.
Chairman Thomas. Thank the gentleman. I find it ironic that
your goal for Federal legislation is to make sure that you have
uniform penalties to go after these people, but the standards,
the collection of data, the flow of data, the uses of the data
above whatever minimum structure you are talking about would
not be afforded the same level of concern. The gentleman uses
the term standards and I have no quarrel with that as long as
they are high enough that in essence they produce a preemption
for uniformity.
My goal is to get your folks to look at the need for
standardization on the other side of the ledger as to how you
deal with this information and not just the side of the ledger
that makes sure that when people do make mistakes in confusing
crazy quilt structures of not only all the States and the
Federal, but that you can wham them with a real good, uniform
penalty. I think it has to be evenhanded on both sides or you
do not get the uniform hammer if you do not provide the uniform
standard codes and procedures.
Dr. Hamburg. I can assure you we have heard your message
and we understand the rationale that you are putting forward. I
think it would be unfair to characterize our position as that
we only are interested on the enforcement side for national
standards. We very much support your leadership and that of
your colleagues in terms of pushing for national legislation
that will provide a very firm standard both for how data is
utilized, but also how when there are transgressions in terms
of appropriate use, we can enforce appropriate behavior.
Chairman Thomas. My goal is to create a situation in which
my friend Ben Cardin and I present to you a proposal that you
cannot refuse.
The gentleman from Washington.
Mr. McDermott. Mr. Chairman, thank you. I want to clarify
something because in listening to the chairman's questions at
one point it sounded as though States could erect barriers
against legitimate national purposes, and my understanding is
that your regulation clearly makes Federal preemption in key
national priority areas, including oversight and research and
public health, that these are areas where the Federal
Government is preeminent in those issues. Is that correct, that
they can override a lesser State or an obstructive State issue?
Mr. Claxton. In the case where there is already a
requirement under Federal law to allow access or make reporting
there is nothing in the regulation which would resurrect a
State barrier to a Federal law.
Mr. McDermott. So the States could not use regulation in
some way that they could get around the Federal regulation?
Mr. Claxton. No. For example, there is nothing about our
regulation that makes a State law applicable to an ERISA plan,
because they already have Federal preemption.
Mr. McDermott. So you are saying that the purpose of the
Congress; that is, looking at fraud and other medical errors
and so forth, no State could pass a law that would prevent us
from getting the information to do those kinds of researches?
Mr. Claxton. As long as the Federal priority was manifested
through a requirement on a provider. If a provider has a choice
now, the State law could affect that provider's choice. But the
provider in that case would not have had to comply with the
Federal request anyway.
Mr. McDermott. Now there is another area where it seems to
me that there is a lot of uncertainty, this whole business of
the pharmacy benefit managers, and pharmacy programs, and
disease management. These are programs that are new. I mean,
they have been going for the last four or five, or maybe eight
or nine years, and they gather enormous data about what people
are taking in this country. Therefore, you could extrapolate
what their disease may be. A lot of people are concerned about
their ability to have that data and use it in a variety of
ways.
Tell me what you did here, and did you consider making it a
requirement that before these entities could use this
information they had to have a check-off from the patient that
they wanted to be given mailings about X, Y, or Z? If you have
diabetes, the pharmacy knows that you have diabetes. Now you
then are subject to having that spread all over the place for
whatever anybody can think of that they ought to be doing for
you. Did you consider putting a restriction or a requirement
for a positive, I want to get further information?
Dr. Hamburg. With respect to the issues you raise, again we
are getting lots of comments, different interpretations, people
mean different things when they say disease management
programs, for example, so that there is going to be a lot of
sorting out. But as long as within a covered entity information
is being used as part of the ongoing care and treatment of that
individual it does not require a specific patient
authorization. If it is being used to send out mailings to
market new drugs, et cetera, that would be an inappropriate
use.
Mr. McDermott. And that is for medical devices and
everything else? Anything anybody would use that for a
marketing tool, it is prevented unless there is a specific--
Mr. Claxton. What you said is right. I think the difficult
issue is trying to address a situation where a provider is
rightfully trying to make his or her patient aware of new
information or new products that might be beneficial to that
patient and where they are actually engaged in marketing where
the provider is relatively indifferent but just saying, here is
someone who might be interested. Those are hard lines to draw.
We are going to look at the comments and do our best.
But the distinction between disease management and
marketing is not clear every time, but it is I think something
people feel very strongly about being able to distinguish. It
might be that the physician has a fairly key role to play in
that and we have heard from various sides on this and expect to
hear a lot more.
Mr. McDermott. If the contract that the HHS wants between
the covered entities and the contractual ones, the business
partners, is that possible to handle that by having a standard
contract that you people would draw up and put out there so
that each one of the partners or each one of the entities
covered would have in hand something to hand to a business
partner and say, sign this?
Dr. Hamburg. I think that there are so many differing types
of partners and the requirements in terms of the working
business relationship involve different kinds of elements--not
all the business partners are doing the exact same things--that
it is unlikely that we would develop standard model contract
language. We could certainly identify the critical elements of
understanding about how data would be handled, and the
expectations should be explicit and will be.
We are certainly open to examining the question, but I
think model contract language would not be the primary approach
because they are not cookie cutter kinds of relationships where
one size fits all. But understanding the elements that need to
be included should be explicitly defined.
Mr. McDermott. Thank you, Mr. Chairman.
Chairman Thomas. The gentleman from Pennsylvania with to
further inquire?
Mr. English. Yes, thank you, Mr. Chairman. Secretary
Hamburg, within your proposed regulation, Section 160.204
outlines the process for requesting exception determinations,
and subsection A.1 outlines the process by which a State may
request an exception for a particular State law. Our State
department of health has characterized this process as
particularly burdensome given the multiple confidentiality laws
that exist in Pennsylvania.
I am not as familiar with what other States have, but for
Pennsylvania this section would require multiple requests for
exception. They argue, the department of health argues that
request for exception should be required only when a challenge
is brought against a particular State law. The presumption
should lie with State laws.
What was your philosophy in crafting this provision, and
how do you assess the merits of the department of health's
argument?
Dr. Hamburg. I think I will ask Mr. Claxton to address that
as he was intimately involved--
Mr. English. Mr. Claxton?
Mr. Claxton. Thank you. The HIPAA itself sets forth certain
areas where State law--where the Secretary has to make a
determination whether or not certain State laws are in
conflict. We tried to carry out that section as it was in
HIPAA. We have gotten a fair number of inquiries about this and
tried to clarify it and we are going to look at the comments.
To some large extent I think we are constrained by what the
statute says, which is that the Secretary can make a
determination with respect to State laws in certain areas.
Mr. English. I will accept that and I would appreciate any
further response you might want to provide in writing.
Mr. Claxton. Certainly.
Mr. English. Subsection A.4 limits the length of time for
an exception to three years explicitly. I would question why it
would be necessary, if there has been no change in State law,
to require States to reapply for exceptions. Do you have a
policy reason for doing that?
Mr. Claxton. I do not recall why that is there. We will be
happy to respond in writing.
Mr. English. If you would be willing, I would appreciate a
response in writing on that point as well.
Finally, Dr. Hamburg, in HIPAA the Secretary was instructed
to promulgate regulations that are ``consistent with the goals
of improving the operation of the health care system and
reducing administrative costs.'' Several of the department's
provisions significantly increase the amount of administrative
procedures for covered entities.
For example, requiring the review of each protected health
information request in order to ensure that ``minimum necessary
standard'', requiring significant allocation of resources to
contract with and monitor business partners. Do you not think
that these requirements would significantly increase the
administrative burden for health care organizations, and is
there a better way to do this?
Dr. Hamburg. I think in shaping the proposed reg we have
tried very hard to balance what systems need to be put in place
to afford appropriate protection with trying to avoid undue
burden. As we have looked at some of the elements that you
referred to, our sense is that while it would add in some cases
additional administrative activities and some new burden, that
in fact in terms of overall costs our estimates suggest it
would be less than one-tenth of 1 percent of overall spending
for health care when you break it down on a per-patient basis.
It really is not an overwhelming additional cost.
You have to think about it in terms of the additional
benefits that would accrue in terms of improving quality of
care, reducing the likelihood that individuals would not seek
appropriate medical evaluation and treatment because of fears
of their important, sensitive health information being misused.
So it is a very difficult balancing act.
One of the things that we are going to look at very
carefully as we review the comments are the inputs that have
come in concerning this issue because we want this to be
workable. It is a balancing act and it is very complicated, as
we all recognize, but it is an area of major focus and concern
and it will be reflected in--
Mr. English. And I very much appreciate that. Let me say, I
am very sensitive to the enormous paperwork burden we are
already putting on health care organizations which is
distorting some of their decisions and having an indirect and
sometimes hidden insidious effect on the quality of health care
in this country. So if there is a way of reducing that
paperwork burden as you put forward these regulations I think
we should be sensitive to that as well.
Thank you, Mr. Chairman, and I appreciate the opportunity
to inquire.
Chairman Thomas. Thank the gentleman. As I stated earlier,
any written questions that any members want to submit, we will
leave it open till the close of business because there may be
additional questions that need to be asked. In listening to the
gentleman's questions, a number of individuals would be envious
of your ability to inquire on behalf of the State of
Pennsylvania because if this goes into effect I am quite sure
there are a number of individuals who would love to ask, which
is stricter, the Federal or the State, and create some degree
of comfort that they are doing the right thing. When I realized
that the outer edges of this is ultimately is going to be
enforced by trial lawyers, it should give us all pause.
Thank you very much. Good luck in firming it up. I hope we
see a product prior to the ongoing, and counting, seven years
of attempting to write a final regulation for Stark II. You are
going to need all the help you can get. Thank you very much,
Dr. Hamburg, Mr. Claxton.
Dr. Hamburg. Thank you.
Chairman Thomas. The next panel, which I guess on an issue
like this could extend for row after row after row of witnesses
who believe they are going to be impacted by this regulation,
and obviously our inability to accommodate it, I do believe
that we have got a pretty good cross-section with this panel.
We have Dr. William Plested who is a member of the board of
trustees of the American Medical Association, obviously an
interested party; Ms. Alissa Fox, executive director for
legislative policy, Blue Cross-Blue Shield; Janlori Goldman,
director of the health privacy project, Institute for Health
Care Research and Policy at Georgetown University; Mary Grealy,
president, Healthcare Leadership Council, a consortium of a
number of interested partes; and then Dr. Stephen Ober, who is
president and chief executive officer of Synergy from Waltham,
Massachusetts who is an active player in the transmission of
data and who had quite interesting testimony.
Dr. Plested, we will just start with you and then move
across the panel. Your written testimony will be made a part of
the record and you can address us in the time that you have,
which will be five minutes, to give us any flavor of your
concern, interest, passion, et cetera.
STATEMENT OF WILLIAM G. PLESTED, III, M.D., MEMBER, BOARD OF
TRUSTEES, AMERICAN MEDICAL ASSOCIATION
Dr. Plested. Mr. Chairman and members of the committee, my
name is Dr. Bill Plested. I am a practicing vascular surgeon
from Santa Monica, California, and a member of the AMA Board of
Trustees. It is an honor to appear before your committee again.
Thank you for inviting the AMA to speak to you today on an
issue of overwhelming importance, not only to physicians, but
to every person who finds him or herself as a patient. That is,
protecting the confidence and trust that patients place in us.
Trust is the foundation of the patient/physician
relationship. My patients assume that the private information
they discuss with me will be used to benefit them, not to
benefit anyone else who may find a way to profit from their
personal information.
Frankly, we see signs that patient records are becoming
items of commerce. With many groups clamoring for unfettered
access to fulfill some alleged compelling need. But perceived
need is not a right.
Let me emphasize that, a need is not a right.
Every business, every company, every government body that
wants patients private information must be required to make its
case to the American people as to why its professed need should
override people's most basic right to keep their medical
information private. This is AMA policy, and this is the
approach that we have adopted in our comment letter to the
Secretary of Health and Human Services, in response to her
proposed rule on patient privacy.
First, we are concerned about access to patient records
without patient's consent, usually without their knowledge. If
medical records were stored in our homes, we would have all
kinds of protections, the Fourth Amendment or civil and
criminal laws, to keep others from getting and using our
information without our permission. Today, patients are forced
to share private medical information in order to get the very
help that they need. In doing so, they are vulnerable to
exploitation by unrelated third parties looking simply for
profit.
Physicians are unable to stem this tide. We think the
Secretary's regulation makes this situation worse and this is
unacceptable.
The Secretary identifies a series of ``national
priorities'' where patients' private medical information would
be used without their consent. In fact, most of these can be
accomplished using de-identified or aggregate information.
If some information must be individually identified, the
first question we should ask should be why not get the
patient's consent? Are we concerned that a truly informed
patient would not give his or her consent? This should
certainly give us pause.
On the other hand, if it is not feasible to obtain consent,
there should be an objective, accountable way to make this
decision for the patient who is unable to do so. If someone
wanted access to your medical information, would you not want
to know why do they need to know who I am? Do they truly need
information linked to my name? What is the alleged benefit and
who stands to profit by getting personal information? What risk
am I exposed to if such information is disclosed? What kind of
security measures are in place to protect my records and make
sure that people use them in the way they said they would or
that unauthorized people do not have access?
Such a system already exists in Federally funded research
programs. The Secretary's proposed rule would expand such an
evaluation to all research, regardless of who is funding this,
and this is good. But it needs to be expanded. So-called health
care operations that do not benefit a specific patient require
especially close scrutiny.
Second, we must comment on the irony that all these new
administrative burdens and documentation requirements proposed
by the Secretary are the result of so-called administrative
simplification. The physicians of America are buried in paper
with less and less time to spend with our patients. We object
in the strongest terms to the bureaucratic school of thought
reflected yet again by the Secretary's proposal that requires
extensive and repetitive documentation. This kind of redundant
paperwork requirement is for the ease of bureaucrats, not for
physicians, and certainly not for patients.
This burden would be especially difficult for smaller sized
physicians' offices. These paperwork and administrative
requirements need to be completely rethought and, if they are
implemented at all, they should have a more realistic and
flexible information approach for all physicians' offices.
Let me sum up by getting back to our basic point. The
patient/physician relationship is all about trust. It must be
fiercely protected. Privacy is a precious right. Once it is
lost, it can never be retrieved. We must remain focused on the
patient as our first concern in any Federal approach to medical
records privacy and confidentiality.
Thank you again for the opportunity to present the AMA's
viewpoint today.
[The prepared statement follows:]
Statement of William G. Plested, III, M.D., Member, Board of Trustees,
American Medical Association
The American Medical Association (AMA), representing
approximately 300,000 physicians and medical student members,
appreciates the opportunity to submit testimony to the Health
Subcommittee of the Ways and Means Committee regarding an issue
central to the patient-physician relationship: protecting
patient confidentiality. We particularly appreciate the chance
to share with you our concerns regarding the Secretary of
Health and Human Services' (HHS) proposed rule on patient
privacy, for which public comments are due today (``Proposed
Standards for Privacy of Individually Identifiable Health
Information,'' 45 CFR Parts 160 through 164, 64 Fed. Reg. 59917
(November 3, 1999)).
Personal health information is used by various entities in
the health care delivery system, including hospitals and health
plans, for purposes beyond direct treatment planning and claims
payment. Each of these entities argues it needs patient-
identifiable health information to achieve its legitimate
objective; most believe they do not need explicit patient
consent to receive and use such information. That philosophy is
reflected in the Secretary's proposed rule and preamble. It is
a philosophy rejected by the AMA.
The AMA has consistently maintained that an expressed
``need'' for information does not confer a right. Patient
consent continues to be a critical consideration in the use and
disclosure of personally identifiable health information.
Consistent with AMA's baseline philosophy regarding individual
privacy rights, informed consent should be obtained, where
possible, before personally identifiable health information is
used for any purpose. However, this is clearly not practical or
even possible in some instances. In those situations in which
patient consent is not feasible, either (a) the information
should have identifying information stripped from it or (b) an
objective, publicly-accountable entity must conclude that
patient consent is not required after weighing the risks and
benefits of the proposed use. A local review board system has
already been adopted successfully by several parties to the
health care system, including physicians, some researchers, a
few health plans, and others.
Some parties may reject this principle as too deferential
to patients' rights at the expense of administrative
feasibility. The AMA believes that this approach properly
balances the interests at stake. Furthermore, it is the right
thing to do. At a time when the American public is looking to
its leaders for a strong stand on patients' rights, any other
policy fails patients, their families and their caregivers.
The AMA cannot support the proposed HHS regulation on
patient privacy in its current form. The complexity of the
task, compounded by the inherent restrictions under the Health
Insurance Portability and Accountability Act's (HIPAA) limited
grant of regulatory authority, have resulted in a proposed
regulation that does not adequately protect patient
confidentiality and privacy and that substantially and
unacceptably increases administrative burdens for physicians.
The AMA's overarching concerns are as follows:
that patients' confidential information could be
disclosed without their consent for a broad array of purposes
unrelated to the patient's individual treatment or payment and
extending far beyond the necessary disclosures and uses
patients would expect when they seek health care;
that many holders of patient information who may
misuse such information would not be held accountable under the
proposed regulation, despite attempts to bring them within
regulatory reach by compelling physicians and other covered
entities to, in effect, ``police'' them;
that physicians will be held liable for the
uncontrollable misdeeds of their ``business partners,''
although the physicians themselves are in compliance with the
regulation's provisions;
that the administrative burden and costs of
implementing the proposed regulation have not been adequately
calculated, and would have a disproportionate impact on small
physician offices; and
that the proposed rule contradicts the intention
of its legislative directive under HIPAA to ``simplify'' health
care administration and reduce costs, and does not improve
patients' expectation of privacy in the health care system.
Applicability
The proposed regulation does not cover a broad spectrum of
entities that are positioned to disclose and misuse
confidential patient information. The AMA finds unacceptable
the Secretary's attempt to ``fill the gap'' in its legislative
authority by requiring physicians and other health care
practitioners to, in effect, ``police'' others who should be
held accountable. Such a proposal is not only inherently
unfair, it is also ineffective insofar as patients may be left
without any recourse against a party who wrongfully discloses
or misuses their confidential medical information.
General rules
The proposed regulation seemingly is more concerned with
facilitating the ease of information flow for the broadly
defined purposes of treatment, payment, and health care
operations than it is with protecting patients' confidentiality
and privacy interests. AMA's policy states that ``[c]onflicts
between a patient's right to privacy and a third party's need
to know should be resolved in favor of patient privacy.'' In
the AMA's view, the general rule should begin with preserving
confidentiality and privacy and allowing disclosure only when
it is ethically and legally justified.
Scalability--The AMA applauds the Secretary's recognition
that a ``single approach to implementation of these
requirements would be neither economically feasible nor
effective in safeguarding health information privacy.'' Though
we appreciate the flexibility physicians and other health care
practitioners will be accorded in implementing this proposed
regulation, we are concerned that a lack of clear guidance
inevitably will lead to costly disputes about compliance.
Minimum necessary use and disclosure--We agree with the
Secretary's goal of precluding wholesale transfers of complete
medical records when only a small portion is pertinent to the
patient's current treatment, but believe the proposed rule's
solution may be unworkable. In crafting a solution to the
question of limiting disclosures, we recommend a requirement
for requesters to make the ``minimum necessary demand.'' While
physicians could certainly engage the requester in a dialogue
regarding what specific information might be needed in any
given instance, the liability would be on the requester for
seeking prohibited information, rather than on the physician
for not adequately divining the motivations of the requester.
Creation of De-Identified Information--The AMA favors any
provisions of the rule that would have the effect of creating
incentives to ``de-identify'' medical information. However, we
believe the proposed rule would actually create a disincentive
to de-identify information. We recommend revising the list of
``identifiers'' to be removed from the medical record, combined
with an explicit prohibition against ``linking'' or re-
identifying without authorization. This will provide entities
with a greater incentive to de-identify information, while
holding wrongdoers properly accountable.
Business partners--The AMA strongly objects to the proposed
rule's approach of holding physicians and other covered
entities responsible for certain violations of the rule's
requirements by their business partners. As a matter of
fairness, the proposal fails. A physician group, for example,
could be subject to the full weight of enforcement and
sanctions under the regulation for prohibited activity by its
business partners, even if the group had no knowledge or
control over the practices of its business partner. The AMA
objects to these provisions because they present the potential
for significant liability for physicians who, themselves, are
complying with the regulation's requirements.
Component entities--We believe the proposed regulation
should be modified to expressly recognize the necessity of
firewalls within businesses or entities that provide health
care as a non-core function. Examples might be school health
clinics, on-site employee health services offered by businesses
or, employers who operate self-funded health plans for their
employees. We are particularly concerned about this last
category; public polling indicates that people are deeply
concerned that their employers are inappropriately accessing
their private medical information. Our key concern in these
instances is in assuring that firewalls exist between the
health provider function and all other elements of the entity.
Uses and disclosures with individual authorization
The AMA strongly supports a requirement for an individual's
authorization for most uses of his or her identifiable health
information. The Secretary notes, and the AMA agrees, that
individuals generally do not recognize that their information
may be used for a multitude of purposes beyond their individual
care and payment for that care. This fact underlies the AMA's
advocacy for a consent requirement for most uses of an
individual's private health information.
We strongly object to the provision that would prohibit
physicians from seeking their patients' authorization for
treatment, payment or health care operations. This provision
flies in the face of medical ethics and directly contradicts
the Secretary's expressed intent in the preamble, and should be
deleted from the rule.
Uses and disclosures for treatment, payment and health care
operations without patient authorization
The AMA questions the Secretary's rationale for choosing to
construe the terms ``treatment'' and ``payment'' so broadly.
The definition of ``treatment,'' for example, would include
cost containment mechanisms such as case and disease management
that go to managing the costs of populations, rather than the
health care of an individual.
Patients reasonably expect that the treatment rendered by
their physician will be revealed to their health plan or other
insurer to pay the claim for benefits. However, patients do not
expect, nor do they welcome, unauthorized access to health
information disclosed in the context of a confidential
relationship for the wide range of purposes HHS believes to be
somehow ``compatible with and directly related'' to treatment
or payment.
The AMA strongly opposes any ``disease management''
language in the proposed rule that is not qualified by
requiring the coordination and cooperation of the individual's
physician. Patients should have the right to consent to-or
refuse-participation in disease management programs offered by
providers and plans.
The diversity of proposed uses for information advocated by
various groups illustrates the inherent difficulty in
addressing these evolving functions within any static
legislative or regulatory definition. We recommend application
of the controlling rule iterated throughout AMA's comment
letter: informed consent should be obtained before personally
identifiable health information is used for any purpose. For
those many functions or circumstances for which patient consent
is not feasible, the information would either have to be de-
identified to be used, or the decision regarding its use
without patient consent would be made by an objective,
publicly-accountable process that weighs the risks against the
benefits of the proposed use. This should apply to all
operational uses of personally identifiable health information
that do not go directly to the individual's specific care, as
well as research projects that fall outside the purview of an
IRB process.
Right to restrict--We believe the ``right to request
restriction'' is an unworkable ``consolation prize'' for
patients who have had their right to consent taken away from
them by government fiat. In addition to its ethical flaws, we
believe that offering a right to restrict presents the
potential to drive a wedge between patients who want to impose
further restrictions and providers who cannot agree to such
arrangements due to the overwhelming administrative burdens and
potential liability that such individual arrangements would
entail.
Permissible uses and disclosures for purposes other than
treatment, payment and health care operations
The preamble notes that certain ``national priority''
activities, as well as the ``smooth functioning of the health
care system,'' require the extensive use of individually
identifiable health information. The AMA believes that the
proposed rule weighs far too heavily in favor of those who seek
access to patients' private medical information (often the
government), with inadequate deference paid to patients'
fundamental right of privacy.
Public health--While mindful that we should not create
unduly restrictive barriers for public health researchers to
access information, the AMA believes that epidemiologic
research on public health and problems should be guided by the
same principles for, and safeguards on, privacy and
confidentiality that apply to all other medical research. These
breaches in confidentiality for a public health purpose are no
different from any other breach of a patient's confidentiality
that benefits others beside the patient, barring imminent
public health emergencies.
Health oversight agencies--The AMA agrees with the
Secretary that, generally, oversight activities are important
to support national priorities; however, we believe that a
majority of these activities could be conducted in a manner
that is less intrusive and more sensitive to the need to
protect confidential patient information. We believe that the
definition's sweeping inclusion of virtually all government
agencies that may have any connection, albeit remote, to health
care may result in widespread fishing expeditions for
confidential patient information. Even more troubling, is that
the proposed regulation promotes such access knowing that there
are few safeguards in place to protect against the government's
wrongful disclosure or use.
The AMA strenuously objects to the seemingly unfettered and
unauthorized access governmental agencies will be accorded
under the proposed regulation as it is currently drafted. We
recommend that if identifiable information is used, it should
be accompanied by a limitation on further uses or access by
other entities. Our chief concern here is that access by health
oversight agencies does not become a ``backdoor'' for law
enforcement access.
Judicial and Administrative Proceedings--While the AMA
supports the general provisions of this section, we recommend
strengthening the language to increase objectivity and to limit
subsequent unauthorized use and re-disclosure. An order by a
court or administrative law judge provides some opportunity for
an objective screening mechanism to balance the interests at
stake in the proceeding, and should be required for all access
in judicial and administrative proceedings.
Law Enforcement--The AMA believes strongly that the
requesting law enforcement entity should be allowed access to
medical records only through a court order. Our position is
that a strong legal standard, accompanied by a set of
parameters on need and use, is essential to protecting not only
personal medical information, but the confidence of citizens in
their government.
This is not an abstract concern. Physicians and their
patients have repeatedly experienced the intrusion of law
enforcement into patients' personal medical information when no
need for identifiable information is established and no
protections are provided. The unfortunate result is less -
rather than greater-confidence in the law enforcement and
judicial systems of this country.
Governmental Health Data Systems--The AMA strongly objects
to the troubling premise seemingly underlying the entire
proposed rule, and particularly evident here, that government
oversight of the efficiency and effectiveness of the health
care ``system'' is somehow a more compelling national priority
than protecting individual citizens' right to privacy. We
cannot agree with reasoning wherein the federal government
appears to value even marginal increments of administrative
efficiency over the basic rights of individuals to protect the
privacy of their own health information.
The AMA sees no reason why government's research and policy
analysis purposes could not be fulfilled using de-identified
individual or aggregate information. Further, if the government
believes it requires individually identifiable health
information for its particular purpose, it should be required
to obtain the individual's consent for such disclosure and use,
or to justify the value of the proposed project and the reasons
why obtaining consent is impracticable or impossible.
Research--The AMA strongly supports the extension of the
Common Rule to all entities conducting human subject research,
regardless of their federal nexus, and applauds the Secretary's
efforts in this important area. We agree with the Secretary's
conclusion that the nexus of federal funding is irrelevant in
deciding the question of whether human research subjects should
be protected. As a matter of public policy, individuals should
be protected if they or their information are the subject of
health-related research. The source of the funding should not
result in different levels of protection.
Individual rights
The AMA supports the rights of individual to access their
medical records, subject to limited exceptions, which is the
approach adopted by the Secretary. We believe that the physical
record and notes made in treating the patient belong to the
physician; however, the information contained in the record is
the patient's. Thus, certain rights should attach for both the
patient and the physician.
Administrative requirements and policy development and
documentation
This provision sets out an extensive series of
administrative requirements that physicians and other covered
entities would have to incorporate into their practice or
business. The AMA has significant concerns about the
substantial administrative and financial burdens this might
place on physician practices, particularly those smaller
practices whose administrative personnel are already stretched
to the limit with various governmental and health plan
requirements.
The AMA objects in the strongest terms to the school of
bureaucratic thought that requires documentation that one is
going to do something, followed by documentation that one is
doing that same thing, and then requires documentation that the
same thing has been done. Physicians and their office staffs
are absolutely overwhelmed by current paperwork requirements
generated by well-intended, but poorly thought out,
regulations. Such redundant documentation requirements are for
the administrative ease of compliance officers--not for
physicians and certainly not for patients. Masses of
documentation allow compliance officers to push their familiar
paper and quibble over parenthetical clauses rather than to
really investigate to see when a true wrong has been committed.
The AMA recommends that the paperwork and documentation
elements of the proposed rule be withdrawn completely and
rethought with a more realistic and flexible implementation
approach for smaller physician offices. After all, is the goal
to actually protect patient privacy, or is it to create paper
saying that we do?
Physicians and other licensed health care professionals
already use an array of administrative tools to honor existing
ethical and legal obligations to keep patient information
confidential. We believe that a prudent implementation of the
proposed rule's administrative requirements would permit these
covered entities to modify these existing tools, rather than
requiring them to ``reinvent the wheel.'' The corporate
entities that currently do little or nothing to protect patient
privacy are those that the proposed regulation should highlight
for additional administrative protections. In addition, we
believe that the Secretary has not adequately calculated the
costs of implementing the administrative requirements under the
proposed regulation. We believe the proposed regulation would
have a disproportionate impact on small business (individual
and groups of physicians and other health care practitioners).
Preemption and Relationship to State Laws
The AMA is deeply concerned that, while the proposed rule
suggests that its preemption provision sets a federal ``floor''
for preemption, a raft of subsequent exceptions and qualifiers
completely undermine the provision, creating a federal
``basement,'' rather than a federal ``floor.''
AMA policy supports a preemption provision that preserves
more stringent state confidentiality laws, so that federal and
state privacy protections would be cumulative. The proposed
rule fails to provide due deference to the States.
This section is also flawed by the fact that entities--
specifically physicians--regulated by the rule would not be
able to independently ask the Secretary for clarification as to
which law to abide by. All queries must be presented by the
States. Two implementation problems are immediately evident:
(1) physicians who seek to comply with state law, believing
in good faith that it is more stringent than the federal
standard, could be in violation of the regulation without ever
knowing or having an opportunity to directly request guidance
from the Secretary; and
(2) State governments could have a conflict of interest, as
one of the largest health data collectors, in bringing forward
queries to the Secretary.
Compliance and Enforcement
Due to the lack of concrete guidance in its current form,
the proposed regulation may unwittingly expose physicians and
other covered entities to fines for noncompliance despite good
faith efforts to comply. The AMA is also troubled by the
implicit federal overlap created by this rule wherein the
traditional role of the states' medical licensure boards in
overseeing physicians' ethical practice is usurped by federal
enforcement.
We are encouraged to note the Secretary's philosophy of
providing ``a cooperative approach to obtaining compliance,''
that looks to an educational, rather than punitive, approach to
resolve disputes. The AMA nevertheless questions the role of
the Secretary or any federal officer to investigate complaints
against physicians for breaches of patient confidentiality.
This is the traditional realm of state medical licensing boards
and their premier role in pursuing this type of activity is
clearly articulated in State medical practice acts.
Cost of Compliance
The AMA notes that the cost to comply with the proposed
privacy regulations clearly is not a one-time cost but will be
a perpetual and continuing commitment, and this should be
reflected in the analysis. These continuing costs are not
anticipated by the proposed rule. Furthermore, the proposed
rule could impose significant new costs on physicians'
practices, with the potential to disproportionately burden
small physician offices. We believe this runs counter to the
explicit intent of HIPAA's ``Administrative Simplification''
provisions, which require ``any standard adopted under this
part shall be consistent with the objective of reducing the
administrative costs of providing and paying for health care.''
(Sec. 262. ``Administrative Simplification,'' ``Sec. 1172(b)
Reduction of Costs.'')
Conclusion
The Secretary notes that she has attempted to create a
regulation that strikes a balance between permitting important
uses of health information while respecting an individual's
right to privacy. We commend the Secretary for the attempt to
address these complex issues, particularly within the
restrictive framework permitted under HIPAA. The AMA does not
believe, however, that the proposed regulation achieves the
necessary and proper balance. The proposed regulation would not
adequately protect patient privacy and confidentiality and it
would substantially and unacceptably increase administrative
burdens for physicians. For these reasons, we cannot support
the proposed regulation in its current form.
Further, the parameters set under HIPAA for regulatory
action do not permit the full scope of protections that
physicians believe patients deserve in any federal privacy law.
We believe that the first step of any ultimately successful
proposal, legislative or regulatory, must be to place the
patient first. Each entity seeking access to patients' most
confidential medical information must pass the stringent test
of showing why its professed need should override individuals'
most basic right in keeping their own information private.
Moreover, citizens deserve a full and open discussion of
exactly who wants their private medical information and for
what purpose. Only then may the true balancing of interests
take place. These are the ground rules of AMA policy and they
should be the ground rules for the federal debate regarding
patient privacy.
Chairman Thomas. Thank you, very much, Doctor. Ms. Fox?
STATEMENT OF ALISSA FOX, EXECUTIVE DIRECTOR, OFFICE OF POLICY
AND REPRESENTATION, BLUE CROSS BLUE SHIELD ASSOCIATION
Ms. Fox. Mr. Chairman and members of the committee, thank
you very much for this opportunity to speak to you today.
Blue Cross and Blue Shield Association agrees that
standards are necessary to assure all consumers that their
medical information is kept strictly confidential. For our
plans, there is absolutely no question as to whether patient
records should be kept private, but only as to how this should
be done.
We have extensive reviewed the proposed HHS rules with our
plans and have concluded that without substantial changes, the
proposal is operationally infeasible, extremely costly, and
would threaten quality improvement efforts throughout the
health care system.
Today, we submitted over 50 pages of detailed formal
comments, as well as recommendations to HHS. I would like to
highlight our four top issues.
First, as discussed earlier, this proposal would layer new
Federal rules on top of existing state laws that will make it
extremely confusing for everyone. HLC has an excellent chart
illustrating this.
For consumers, it will be extremely difficult to know what
their rights are, and who do you call when you have questions
or problems? Do you call the state? Which state? How many
states? Or do you call HHS?
Second, the new business partner requirement would force
plans, doctors, and hospitals to assure all of their partners
comply with these rules. This is simply unworkable and would be
very expensive because everyone would end up monitoring
everyone else. Hospitals monitoring doctors, plans monitoring
hospitals. We have urged HHS to drop this requirement.
Third, the new minimum necessary rule would require all of
us to establish new procedures and reorganize and redesign our
operations, so we are only disclosing the minimum information
necessary in each and every case. This would undermine all of
our efforts to assure that patients receive the right care at
the right time.
Simply put, this erects road blocks to assuring patients
receive the best possible care and runs counter to the new
Institute of Medicine report, which highlights the need for
complete and timely access to patient medical information to
prevent the wrong care.
Fourth, we are concerned that the way the proposal is
constructed, it may make it difficult and perhaps even
impossible for plans to continue existing beneficial functions
such as disease management programs. This is because the list
of the functions in the health plan definition misses many key
functions we do today. And we worry that it could limit what we
do in the future as we evolve to meet consumer demands in the
21st century, where the pace of technological advances
continues to amaze us all.
Finally, we are extremely concerned about the cost of
implementing such a complicated proposal. We commissioned the
Nolan Company to estimate the cost of several provisions and
their estimate is over $40 billion for the entire health care
system over a five year period. This estimate is multiple times
higher than the HHS estimate.
A key reason for this difference is that HHS did not
estimate many of the provisions we believe will be extremely
expensive. HHS has said they did not have the information and
data to do these estimates. We hope that our study will be
useful to them.
Mr. Chairman and members of the committee, let me close by
saying that we must be smart in what we ask of the health care
system. We must evaluate new requirements very carefully to
make sure that they are the most cost effective and efficient
way of protecting patients. We believe that major changes are
needed to assure we are not unnecessarily adding to the cost of
insurance coverage or jeopardizing our health care system which
continues to provide the best care in the world. And most
importantly, we must avoid redirecting scarce dollars from
benefits to administrative costs.
Thank you very much.
[The prepared statement follows:]
Statement of Alissa Fox, Executive Director, Office of Policy and
Representation, Blue Cross Blue Shield Association
Mr. Chairman and Members of the Committee, I am Alissa Fox,
Executive Director for the Blue Cross and Blue Shield
Association. The Blue Cross and Blue Shield Association (BCBSA)
represents 49 independent Blue Cross and Blue Shield Plans
across the country, covering over 74 million Americans -or one
in every four individuals.
Thank you for the opportunity to testify today regarding
our major concerns with the proposed regulations setting
privacy standards for individually identifiable health
information issued by the Department of Health and Human
Services (HHS) on November 3, 1999.
BCBSA believes that safeguarding the privacy of medical
records is of paramount importance. All consumers should be
confident their medical information is kept confidential. For
BCBS Plans, there is no question as to whether patient records
should be kept confidential, but only as to how this should be
accomplished. We look forward to working with Congress and the
Department of Health and Human Services (HHS) to implement
practical privacy protections that:
allow for the timely delivery of and payment for
health care services;
facilitate efforts to deliver safe and high
quality care; and,
minimize costs and administrative paperwork for
consumers, providers and others in fulfillment of the
objectives of Health Insurance Portability and Accountability
Act's (HIPAA) Administrative Simplification provisions.
It is clear from the proposed regulation that HHS sought to
balance the need to safeguard medical records with the ability
of the health care system to provide health care services
efficiently. We recognize that the staff of HHS has worked long
hours in an attempt to develop regulations that would not
impede our modern health care system.
However, despite their efforts, we remain concerned that
the proposed regulation needs significant revision. Without
substantial changes, the proposal is operationally infeasible
and extremely costly. It would slow the delivery and payment of
care to providers and consumers, threaten the assurance of
quality, and exacerbate the cost of health care.
My testimony focuses on five key areas:
I. Scope of the Regulation
II. Key Concerns with the Regulation
III. Positive Aspects of the Regulation
IV. Cost of the Regulation
V. Recommendations
I. Scope of the Regulation
HIPAA provided HHS the authority to promulgate privacy
standards for consumer health information if Congress did not
pass legislation by August 1999. The statute directed HHS to
issue rules governing standards with respect to the privacy of
individually identifiable health information transmitted in
connection with the transactions described in section
1173(a)''--certain standardized transactions for claims payment
and other functions. This directs the Secretary to develop a
narrow set of privacy rules for the specific transactions that
are developed and transmitted under Administrative
Simplification. However, the proposed rule establishes
standards that far exceed this mandate. The proposal would
affect virtually all players in the health care industry as
well as many other organizations--such as schools, employers,
and accounting firms -and the vast majority of information.
The proposal would require covered entities (i.e., health
plans, providers, and clearinghouses) to:
Obtain new authorizations from consumers before
using or disclosing information, except for purposes of
treatment, payment, health care operations and other limited
circumstances;
Allow individuals to inspect, copy and amend much
of their medical information;
Track all disclosures made other than for
treatment, payment and health care operations;
Recontract with all business partners to require
them to use and disclose information according to the new
privacy rules and assure that business partners are complying;
Institute procedures to assure that only the
minimum information necessary is used or disclosed for a given
purpose;
Designate a privacy official and train staff;
Follow specific rules before using protected
health information for research; and,
Develop a host of new policies, procedures and
notices.
In understanding the full scope and implications of the
regulation, it is important to be aware of the following:
The Regulation is Not Limited to Electronic
Records: Many news accounts describe the proposed regulation as
applying to electronic records only. This is far from accurate.
The regulation specifically applies to electronic records, as
well as any format of a record that has ever (or will ever be)
electronically transmitted or maintained. This broad brush
covers millions of paper records, oral records and other
storage formats. In addition, because it would be so difficult
to distinguish ordinary paper records from paper records that
had been (or would be) electronically transmitted, the
practical effect of the regulation would be that doctors,
health plans and other covered entities would need to apply the
protections to all of their records, of any format.
The Regulation Affects Internal Uses of
Information as well as Disclosures: A common misconception
regarding the regulation is that it simply regulates the
disclosure of information to a third party. In fact, the
regulation actually affects the use of information internally
within an organization. This means that organizations would be
required to comply with all the rules even when they use
information internally for treatment purposes, claims
management, utilization review and other routine health care
purposes.
The Regulation Affects a Broad Array of
Organizations and Information: The definition of ``covered
entity'' in the regulation is broad in scope--including not
only doctors, hospitals and health plans but employers
operating their own health plans (insured/self-funded),
laboratories, pharmacists and many others. Many organizations
that are not included specifically as a ``covered entity'' are
indirectly subjected to the privacy rule through a new
requirement that all covered entities must regulate their
``business partners.'' For instance, lawyers, accountants and
other non-health oriented organizations could fall into this
category.
In addition, the definition of ``protected health
information'' (PHI) in the regulation is much broader than what
most individuals consider their health information. The
definition of PHI goes beyond an individual's medical records
to include insurance records and status, oral information,
demographic data, and insurance status.
II. Key Concerns with Regulation
Today, BCBSA submitted over 50 pages of detailed formal
comments to HHS on a whole host of important operational
issues. This testimony highlights the four most problematic
provisions in the regulation.
1. Preemption of State Law
We believe doctors, health plans, and other covered
entities will be unable to navigate the labyrinth of state and
federal privacy laws under the complex construct of the HIPAA
regulatory model. The regulation follows HIPAA regulatory
construct in that state laws are preempted only if contrary to
the regulation, and less stringent. In addition, the regulation
specifically ``saves'' certain state statutes from preemption,
such as those relating to health surveillance.
Everyone in the health care system needs a clear
understanding of the rules that guarantee privacy. We are
concerned that the lack of a complete preemption over state law
creates a serious problem for consumers, doctors, health plans
and other covered entities.
Doctors, health plans and other covered entities must
determine, on a provision by provision basis, which parts of
state law would be retained, and which would be replaced by
federal law. This is further complicated by the free flow of
patients and information in today's health care industry. For
instance, an individual may live in the District of Columbia,
work in Virginia, and visit a physician located in Maryland.
Covered entities dealing with this individual must evaluate the
interplay of three state statutes with the federal law. In
addition, covered entities also must factor in the interplay of
other federal laws relating to privacy. Even if each covered
entity engaged an attorney to prepare a preemption analysis,
different attorneys would prepare conflicting interpretations--
leading to costly litigation with the states, the federal
government and consumers.
This regulatory construct particularly will be confusing
for consumers. Instead of facilitating an individual's ability
to know their privacy rights, this complex preemption process
is sure to confound patients. First, individuals will be hard
pressed to determine which aspects of the state and federal
privacy laws apply to them, so it will be impossible for them
to determine if in fact, they have been wronged. In addition,
consumers will not know where to direct complaints if they do
feel that their rights are violated --Maryland? Virginia? The
District of Columbia? The Secretary of Health and Human
Services? It is likely that consumers will be bounced from one
jurisdiction to the next until the consumer locates the one
which has the law that has been violated -or the consumer
becomes frustrated and terminates the effort.
We recognize that a complete preemption of state law is
outside the statutory authority of the Department of Health and
Human Services (HHS). Therefore, we recommend HHS prepare a
detailed privacy guide for each state on how existing state
laws intersect with the new federal rules. The guide should
also address whether a privacy provision is triggered by a
consumer's residence, location of provider or other criteria.
HHS should prepare the guide in collaboration with state
government officials. HHS should assure this guide also
incorporates other federal privacy laws, such as the Federal
Privacy Act. As part of this process, each individual state
should certify agreement with HHS' analysis so everyone has a
clear understanding of the rules.
It is imperative that this legal guidebook is prepared well
in advance of the final regulations. Doctors, health plans, and
other covered entities will need this completed analysis before
computer systems can be redesigned, forms and notices are
changed, consumer brochures are modified and updated, and other
procedures can be brought into compliance. Bringing plan and
provider operations into compliance with these complex new
regulations will be expensive, so it is critical that these
entities only have to modify systems and other items once.
Therefore, we recommend that the analysis be provided two years
prior to the effective date of the regulation.
2. Business Partners
The business partner provisions of the regulation require
that doctors, health plans and other covered entities enter
into prescribed contracts with all of their ``business
partners'' to assure these partners follow specific HHS privacy
rules. The doctors, health plans and other covered entities
would be considered to be in noncompliance with the regulations
and could be subject to penalties and/or litigation if they
``knew or reasonably should have known'' of certain privacy
violations of their business partners. We believe these
provisions are unworkable, as well as outside of the authority
of HHS.
The definition of business partner is so broad that
physicians could be the business partners of independent
laboratories; health plans could be the business partners of
their lawyers and accountants; and hospitals could be the
business partners of independent physicians that practice
within their walls. Doctors, hospitals, Coordination of Benefit
(COB) partners, and health plans could all be construed as
``business partners'' of each other. These provisions also
could result in unworkable relationships between government
agencies. For instance, we believe the Social Security
Administration--who makes eligibility determinations for the
Medicare program--could be interpreted to be a business partner
of the Health Care Financing Administration (HCFA). Medicare
contractors could be business partners of HCFA, subjecting HCFA
to the fines and penalties under the regulation.
The potential liability is likely to force all of these
doctors, health plans, and other covered entities to monitor
each other (as well as sub-contractors). This would result in
an enormous amount of duplicative monitoring and auditing,
making it likely that all members of the health care industry
would be monitoring each other (including covered entities)--an
obvious conflict with the efficiency and cost-saving goals of
the Administrative Simplification provisions of HIPAA.
Moreover, these costly actions would provide little or no real
benefit to consumers since most of these entities already would
be covered by the regulations.
The contractual specifications included in the regulation
compound the problems in the unworkable business partner
framework. For instance, one of the specified contract
standards in the regulation is that doctors, health plans, and
other covered entities require business partners to either
destroy or return all protected health information (PHI) when a
contract is terminated. But clearinghouses, for example, keep
health data on file for some time to respond to disputes and
complaints. Health plans, employers, and other covered entities
and business partners must maintain PHI in order to provide
HIPAA certificates of coverage and protect themselves from
legal disputes, complaints, etc. In addition, some health plans
are required by state law to keep information for a certain
period of years for state purposes. This is only one of a
number of examples demonstrating the operational infeasibility
of the contract provisions. In our detailed comments, we
identified a number of other.
And finally, we believe the business partner provisions are
outside of the statutory authority of the Department of Health
and Human Services. HIPAA clearly delineates the covered
entities subject to HHS oversight: health plans,
clearinghouses, and providers conducting standard transactions.
Attempts to indirectly regulate other organizations--through
doctors, health plans and other covered entities or otherwise--
is an overreach of regulatory authority. We believe recent
District and Supreme Court cases support this premise as well
as the viewpoint that inherently federal powers cannot be
delegated to non-federal authorities.
3. Minimum Necessary
The proposed regulation instructs doctors, health plans,
and other covered entities to use or disclose only the minimum
information necessary to accomplish a given purpose and
discourages the exchange of the entire medical record. This
requirement also implies determinations should be made on an
individual basis. At first blush, this standard seems to be a
perfectly reasonable, common sense provision.
However, upon an operational implementation perspective, it
becomes increasingly clear that it would be impossible to
implement a legal standard that only the minimum information is
used or disclosed. First of all, it is important to recognize
that this standard applies to the use of information as well as
disclosure, and that the definition of disclosure includes
broad terms such as ``provision of access to.'' We believe this
standard would require a massive reorganization of workflow, as
well as possible redesign of physical office space and would
jeopardize the quality and timeliness of patient care, benefit
determinations and other critical elements of the health care
system. For instance:
As part of the description regarding the minimum
necessary standard, the regulation includes a strong
discouragement regarding the release of entire medical records
of patients. The complete exchange of medical information is
absolutely critical to assuring a patient receives the right
treatment at the right time. The recent Institute of Medicine
report, ``To Err is Human,'' highlighted the medical mistakes
that are common in our health care system today. The IOM report
states that errors are more likely to occur when providers do
not have timely access to complete patient information. The
discouragement of complete medical records would make it more
difficult to guard against these problems. One covered entity
may determine that a subscriber's prescription is not relevant
to be released. Further down the line, that lack of information
may impede clinicians' decisionmaking.
It is well documented that fraud and abuse is a
costly element of our health care system. The Medicare program
as well as private health plans have made combating fraud and
abuse a priority. However, the minimum necessary standard is
likely to impede fraud detection, because fraud and abuse units
may be accused of using more than the minimum information
necessary. Any impediment to fraud detection would increase the
cost to consumers.
Health plans and providers actually may be forced
to redesign their facilities to comply with the minimum
necessary standard. For instance, when visiting friends in
maternity wards, there generally is a white board describing
all of the patients and their medical needs. Any visitor may
view the information on the board. Or take an orthopedist's
office, where a x-ray lightboard is centrally located outside
of the patients' rooms for easy access by the physician. Anyone
in the office could view the x-rays, and x-rays are
identifiable information. Would the regulation require these
providers to renovate their facilities to comply with the
regulation?
These are a few examples of the types of activities that
could fall awry of the proposed privacy regulations. If
implemented, this would impose incredible costs on consumers--
not just in dollars and cents--but in lives as well.
4. Health Care Operations
One of the fundamental building blocks of the regulation is
its definition of health care operations. Items that are listed
in this definition are exempt from the requirement to track
disclosures of protected health information, and do not require
a separate authorization from an individual. As changes are
made to the final regulation, we expect the definition to
continue to play a key role.
We believe the current definition of health care operations
misses important functions. As a result, covered entities may
have to solicit authorizations for certain functions or track
disclosures as part of routine operations. The end result would
be that health plans could encounter major obstacles to
conducting these activities and could be discouraged from
conducting these important functions. The following is a sample
of overlooked functions:
Disease management, case management, risk
assessment, epidemiological studies and drug interventions.
Many of our Plans conduct these important programs that benefit
consumers through improved health care, better outcomes, and
lower cost. For instance, the Blue Cross and Blue Shield
Federal Employee Program provides disease management services
to improve care for patients with respect to congestive heart
failure and diabetes as part of its benefit plans. When claims
are processed, the names of enrollees that could benefit from
disease or case management are compiled. This information also
may be used to conduct epidemiological studies of particular
populations within FEP or to implement drug intervention
programs.
Private accreditation by organizations such as
National Committee for Quality Assurance (NCQA), as well as
auditing, evaluating and accreditation functions performed by
other private entities, such as associations. The NCQA and
other private accrediting organizations sometimes require the
review of information that could be considered as protected
health information. In addition, other private entities--such
as associations--sometimes perform auditing and evaluation of
their members as part of membership or other standards.
Routine Plan operations such as ``security
activities,'' data processing activities and general
maintenance: Some health plans conduct a series of security
activities designed to assure that employees are complying with
corporate privacy policies. For instance, they may monitor
``same name'' look-ups, to guard against employees checking the
records of family members, or monitor access to celebrity
files, as well as other initiatives. With regards to computers,
``live'' data is often used in order to assure that system
changes and upgrades have correctly been made. Health Plans
also must conduct a number of routine operations, for instance
the printing of ID cards, etc.
Health promotion and other educational activities.
For instance, FEP has established a 24-hour nurse hotline, Blue
Health Connection. Enrollees' PHI may be disclosed to the
vendor responsible for Blue Health. This information is used to
provide enrollees with health education, treatment options, and
assistance with questions for enrollees to ask their
physicians. We also may notify enrollees -or require our
physicians to notify patients--regarding mammography screenings
or immunizations.
Insurance underwriting and other activities: While
the regulation does specify insurance underwriting, we believe
the proposed definition may be deficient because it relates
only to the renewal of a contract, and to the protected health
information of individuals already enrolled. This could inhibit
our ability to develop an appropriate premium for group
coverage as well as the ability of covered entities to obtain
stop-loss coverage or reinsurance.
This is only a sample of the types of functions that have
been overlooked. We believe many more items will be discovered
as doctors, health plans, and other covered entities begin
implementing the regulation. In addition, we believe the
definition is static, and cannot reflect the new roles and
functions that health plans may develop in the future that
benefit consumers, improve quality, and reduce costs. For
instance, if this definition had been developed ten years ago,
disease management programs would not be as common as they are
today. We are concerned that such strict definitions could
limit health plans' roles as they seek to redefine themselves
to meet consumer demands of the 21st century. We believe a
static definition of health care operations will squelch
innovation because health plans will not invest in development
unless they know the new program would fall under health care
operations.
III. Positive Aspects of the Proposed Regulation
Clearly, we believe there are significant issues in the
proposed regulations. However, the regulations did include
certain provisions that demonstrated interest in balancing
operational impacts with the overall goal of privacy. We have
urged HHS to retain these provisions in the final regulation.
In particular:
``Statutory'' Authorization for Treatment, Payment
and Health Care Operations: The proposed regulation does not
require a new authorization for treatment, payment, and health
care operations. We believe a ``statutory'' authorization,
meaning that covered entities may use or disclose protected
health information (PHI) without authorization as matter of
law, is imperative and would oppose a requirement for new
authorizations for these vital activities.
Requiring health plans to obtain a new authorization from
current subscribers would require numerous mailings and phone
calls from health plans--a process akin to a ``late bill''
collections process--in order to obtain the new authorizations.
In the interim, subscribers and providers would experience
delays in payment and other services and confusion in the
health care system.
Tracking of Disclosures, Other Than For Treatment,
Payment and Health Care Operations: The proposed regulation
requires tracking of disclosures made for purposes other than
treatment, payment or health care operations. This requirement
is operationally more feasible than a requirement to track all
disclosures. We would oppose any expansion of this standard.
Expanding the tracking standards would result in duplicative
and unnecessary tracking of millions of routine transactions
that occur every day (e.g., Coordination of Benefits, lab
disclosures to physicians, etc.) and a blizzard of paperwork
for all, especially physicians. However, we remain concerned
that this more reasonable tracking standard is undermined by
provisions in the amendment and correction standard that
requires doctors, health plans and other covered entities to
notify previous recipients of information. If the amendment and
correction standard is not modified, we believe it would have
the operational effect of a ``de facto'' tracking standard for
all disclosures, even those made for treatment, payment, and
health care operations.
Inspection And Copying Of PHI Contained In A
Designated Record Set: The proposed regulation allows consumers
to inspect and copy those records retrieved from a designated
record set used to make substantive decisions. Using a
designated record set standard is operationally more feasible
than requiring access to all protected health information.
Expansion of this standard to all records would result in reams
of meaningless information being retrieved and copied at a
great cost to the health care system. We oppose expansion of
the current standard.
VI. The Cost of the Regulation
The proposed regulation includes an estimated total cost of
$3.8 billion over five years. We think this figure greatly
underestimates the cost of implementation. The regulation
itself indicates the HHS cost estimates are incomplete. The
proposed regulation itemizes 10 standards for which HHS was
unable to complete a cost analysis, noting that ``the cost of
these provisions may be significant in some cases. . ..'' The
minimum necessary standard, business partner monitoring,
designation of privacy officials and privacy boards, and
creation of de-identified information were all items excluded
from the HHS cost estimate.
Due to our concern regarding costs, we engaged the Robert
E. Nolan Management Consulting Company to provide an
independent estimate of several key provisions of the proposed
regulation; the Nolan estimate is over $40 billion over five
years to health plans, providers and other members of the
health care community. These costs stem from:
Business Partner Monitoring: The business partner
provisions would make doctors, health plans and other covered
entities liable for the compliance of their business partners,
including lawyers, schools and other organizations. As a
result, covered entities would monitor each other as well as
their non-health business partners. This provision is estimated
to cost about $4 billion over five years.
Privacy Officials, System Changes and other
Infrastructure: Doctors, health plans and other covered
entities would need to retrain current employees and
periodically recertify their employees, hire privacy officials,
upgrade systems, and address other infrastructure issues in
order to implement the proposed privacy regulations. This is
estimated to cost about $23 billion over five years.
Tracking and Disclosure: The amendment and
correction provision requires covered entities to send amended
records to previous recipients of the information. This could
result in a ``de facto'' requirement to track all disclosures
of information. As a result, this provision could cost as much
as $9 billion over five years.
Inspection, Copying and Amendment: Covered
entities would have to allow individuals to inspect, copy and
amend all information contained in a designated record set. The
definition of accessible information extends beyond the
traditional medical record to other electronic, or written
information that includes an individual's name, social security
number or other identifying feature. This provision is
estimated to cost almost $4 billion over five years.
Impact on Medical Management: Deficiencies in the
term health care operations and other definitions could reduce
the ability of health plans to conduct effective disease
management programs. These programs improve the quality of care
of consumers, and decrease overall medical costs. Less
effective disease management programs is estimated to cost $3
billion over five years.
Obviously, estimates will vary depending on the final
interpretations of the regulation, however we believe an
estimate of over $40 billion remains conservative. For
instance, it does not include the new liability costs that will
arise from this regulation, the impact of underwriting changes,
or the impact on health research. Ultimately, the additional
administrative costs faced by providers and health plans will
increase the cost of insurance coverage.
V. Recommendations
In general, the proposed regulation require doctors, health
plans and other covered entities to implement complex new rules
that require extensive new procedures, documentation processes,
form specifications and notice standards. These requirements
would require the re-organization of workflows as well as
possibly the physical facilities of doctors and hospitals in
order to comply with the law. We believe the level of
documentation and procedures is unnecessarily excessive, and
should be rewritten to reduce the complexity, burden and cost.
Specifically, we urge the following:
(1) Detailed Guidance on Preemption of State Law: While we
recommend a full preemption of state law in the privacy area,
we understand that it is outside of the statutory authority for
HHS. In the absence of full preemption, we recommend HHS,
working with the states, prepare a detailed analysis of state
and federal law to provide a clear guide on all provisions
affecting the health care industry.
It is critical that this guidance is available at least two
years prior to the effective date of the regulation. Bringing
operations into compliance with these complex new regulations
will be expensive so it is critical that doctors, health plans,
and other covered entities only have to modify systems and
other items once.
(2) Removal of Business Partner Provisions. The business
partner provisions should be removed from the regulation
because they are:
Outside of the Secretary's statutory authority
Unworkable and would create expensive and
duplicative monitoring between doctors, health plans, and other
covered entities
Unnecessary since the vast majority of protected
health information is maintained by organizations that are
covered by the regulation.
(3) Change the Minimum Necessary Standard from Legal
Standard to Organizational Objective: While we believe the
minimum necessary standard is a laudable goal, we are concerned
that it would be impossible to implement this standard
operationally and comply with a rigid legal standard.
Therefore, we recommend that organizations include the minimum
necessary standard concept as an objective, rather than as a
legal standard.
(4) Revise Definition of Health Care Operations: The
current definition of health care operations is static and
missing key elements. As the building block of the regulation,
this definition is crucial because it triggers whether or not
new authorizations are required, disclosures are tracked, and
other important issues. Instead of using a narrow, prescriptive
definition, we recommend inclusion of a definition that is
flexible enough to incorporate the industry's current
operations as well as new ones that develop as our ability to
improve quality and other areas increase.
(5) Additional Funding for Medicare Contractors and other
Government Programs. We also urge congressional appropriators
to factor the additional cost of privacy compliance into budget
development regarding the Medicare fee for service contractors,
Medicare+Choice plans, the Federal Employees Health Benefit
Program, and other federal programs.
VI. Conclusion
Once again, we appreciate the opportunity to testify before
you on this critical issue.
We would like to continue working with you, and the
Department of Health and Human Services, on crafting privacy
rules that meet our common goals of protecting consumers,
improving quality, and minimizing costs.
Thank you again for this opportunity to testify on this
important issue.
Chairman Thomas. Thank you, Ms. Fox. Ms. Goldman?
STATEMENT OF JANLORI GOLDMAN, DIRECTOR, HEALTH PRIVACY PROJECT,
INSTITUTE FOR HEALTH CARE RESEARCH AND POLICY, GEORGETOWN
UNIVERSITY
Ms. Goldman. Good morning, Mr. Chairman, Mr. McDermott,
members of the subcommittee, thank you very much for testifying
today.
The Health Privacy Project at Georgetown was created a
number of years ago to look at the impact of privacy in the
health care setting. We have since participated in and there
has since been numerous polls and surveys that have shown that
the lack of privacy in health care has been a major barrier to
people seeking care and to the quality of care that people
receive.
Congress, of course, acknowledged that concern and, in the
Health Insurance Portability and Accountability Act, you
imposed a deadline on yourselves to address this issue in a
comprehensive way. Of course, after many bills were introduced
and many hearings, many of which were held by this
subcommittee, the deadline did pass and that then triggered the
requirement on the administration to issue regulations.
They did extend the comment period based on our request and
a number of requests of those sitting here at this table, so
that we had a full chance to put our comments in. That comment
period closes today. This hearing is important because it gives
us again another opportunity, while we are still in the draft
stage, to make sure that this is as strong and workable a
regulation as possible.
What I want to focus on in my testimony are two areas. One,
there are gaps in the Secretary's proposed regulation that are
there because of the legal constraints on her delegation of
authority from HIPAA. The second is to just go through quickly
the strengths and weaknesses in the proposed regulation itself.
There are three major gaps in the regulation, again
stemming from the delegation of authority in HIPAA. They have
already been covered, but let me please go through them
quickly. The issue of electronic versus paper records. We think
it is really senseless to have a rule that only applies to
electronic records, because it goes against the intention in
HIPAA which is to create a uniform standard electronic network.
And you do not want to create a disincentive for people to put
information into electronic form as a way of avoiding the
privacy regulations.
The second is the issue of covered entities. Some of the
concerns that many of my colleagues have about how the
regulation is drafted is based on the fact that the
administration can only cover three entities directly, the
plans, the providers, and the clearing houses. So the scope of
coverage through the business partners language and through
other prohibitions on disclosure is in there as a way of making
this a workable regulation. And it is there because the
screening is limited in what she is able to do in terms of
scope. So I think that is an important issue to look at.
The third gap obviously is on enforcement. We are very
concerned about the weak enforcement and the weak remedies that
are available under the proposed regulation. Again, HHS was
constrained because of HIPAA.
We do think though that, on balance, the regulation is
vitally important as an intermediary step and I say that
recognizing that Congress still has a very important role to
play in both filling the gaps and strengthening certain
provisions. We look forward to working with you on that. I
think the regulation will set a baseline of protection, but we
need to look at some of the major provisions that are being
proposed.
One, it gives people the right to see their own records, a
critical right, one that is not uniformly and comprehensively
provided for at the state level. The regulation itself creates
an overall incentive to use de-identified data. Again, if you
create de-identified data, you are outside the scope of the
regulation. It provides notice to patients about how their
information will be used and by whom. It provides for an
authorization process.
We are very concerned, however, that in that first tier of
authorizations, for treatment, payment, and health care
operations, the lack of any opportunity for individuals to sign
a form either saying ``I understand how my data is going to be
used'', or ``I am authorizing the use of that data''--which is
essentially what the status quo is. We are very concerned that
people will not truly understand how their information is
flowing.
While the business partners proposal, is awkward in many
ways, it is a necessary way of creating a chain of trust in how
information flows and to whom. In many ways, it is codifying
what is already good business practice. You clearly do not
disclose information to agents or others without entering into
a written agreement about how that information will be used.
On research, we are very pleased to see the Secretary's
proposal to expand either the institutional review board
structure or a privacy board to cover all research. However, we
would like to see it be an institutional review board.
On law enforcement, I think she has fallen short of where
the regulation needs to be. It appears to be an improvement
over the initial recommendation, but it allows for a kind of--
excuse the cliche--a Chinese menu of choices in determining
what kind of legal process law enforcement needs to get. We
think that must be strengthened.
On remedies, again a private right of action is necessary
to make this an effective provision. Clearly that is an
important area for Congress to explore. All other Federal
privacy laws include a private right of action.
On preemption, I want to address some of the comments that
my colleagues have made about preemption. We did a survey of
state confidentiality laws to look at what was the state of
health privacy right now. What we have found is that if you
read the regulation that is being proposed, you will create
significant uniformity in how health privacy is handled at the
state level, because many of the laws are weaker than what is
being proposed by the Secretary at this stage. And where they
are more detailed and more protective are in, for the most
part, condition specific areas, where the states have gone to
great pains to enact detailed specific provisions dealing with
HIV, with mental health, with reporting, with abuse and
neglect.
And so our state report essentially shows you will have
substantial uniformity with the passage of a Federal law, even
one that sets a floor. It will make the operation of the health
care system much more efficient, more cost effective and, I
think, more fair.
In conclusion, Congress set the wheels in motion for where
we are today with the Secretary's proposal. I think it was an
important trigger mechanism so that we would have something,
again as an intermediary step.
This has been a tough issue for Congress. There are lots of
different interests. It has been hard to find consensus. But in
fulfilling the legal duty imposed under HIPAA, the Secretary
has proposed some regulations that will take us part of the
way.
What we urge is for Congress to take us the rest of the
way, to finish the job, and to fill the gaps and to strengthen
the weaknesses. In the meantime, we hope that the proposed
regulation will be strengthened, that the Secretary will have
an opportunity to respond to many of the concerns that we have
all raised, and that you have raised this morning, and that the
regulation should go forward.
Thank you very much.
[The prepared statement follows:]
Statement of Janlori Goldman, Director, Health Privacy Project,
Institute for Health Care Research and Policy, Georgetown University
I. INTRODUCTION AND OVERVIEW
Mr. Chairman and Members of the House Subcommittee on
Health of the Committee on Ways and Means: I very much
appreciate the invitation to testify before you today on the
Administration's proposed regulations regarding the privacy of
individually identifiable health information.
In December 1997, I launched the Health Privacy Project at
the Institute for Health Care Research and Policy and
Georgetown University Medical Center. The Project is dedicated
to raising public awareness of the importance of ensuring
health privacy in order to improve health care access and
quality, both on an individual and a community level.
Congress recognized the importance of protecting health
privacy when it passed the Health Information Portability and
Accountability Act of 1996. HIPAA requires that if Congress
failed to pass comprehensive health privacy legislation by
August 21, 1999, the Secretary of Health and Human Services
must issue regulations by February 21, 2000.
Congress did in fact fail to meet the August deadline.
Consistent with its legal duty under HIPAA, the Administration
did issue draft health privacy regulations November 2, 1999.
The comment period was extended to February 17, 2000. We expect
the regulations to be finalized in April.
The proposed federal health privacy regulations constitute
a significant step towards restoring the public trust and
confidence in our nation's health care. These rules, however,
are by no means the final solution. By virtue of the limited
authority delegated by Congress, the proposed rules have
limited applicability and cover only health plans, health care
clearinghouses and health care providers who transmit health
information (``;covered entities'') in electronic form. We
appreciate the fact that the Secretary has made a strong effort
to extend this coverage to a covered entity's business
partners. But a large segment of those who hold health
information remains beyond the scope of these regulations.
Our testimony today focuses on two areas: 1) the
limitations of the Secretary's authority and the role Congress
should play to strengthen the final rule and fill remaining
gaps in protection, and 2) the strengths and weaknesses of the
proposed regulation.
II. PUBLIC NEED AND DEMAND FOR HEALTH PRIVACY
A substantial barrier to improving the quality of care and
access to care in this country has been the absence of
enforceable privacy rules. People are withdrawing from full
participation in their own health care because they are afraid
their health records will fall into the wrong hands, and lead
to discrimination, loss of benefits, stigma, and unwanted
exposure. A January 1999 survey by the California Health Care
Foundation found that one out of every six people engages in
some form of privacy-protective behavior to shield themselves
from the misuse of their health information, including lying to
their doctors, providing inaccurate information, doctor-hopping
to avoid a consolidated medical record, paying out of pocket
for care that is covered by insurance, and--in the worst
cases--avoiding care altogether. (Survey released by the
California HealthCare Foundation, January 1999)
Without trust that the personal, sensitive information they
share with their doctors will be handled with some degree of
confidentiality, people will not fully participate in their own
health care. As a result, they risk inadequate care or
undetected and untreated health conditions. In turn, the
integrity of research and public health initiatives that rely
on complete and accurate patient data may also be compromised.
Thus, protecting privacy and promoting health care quality and
access are values that must go hand-in-hand.
III. THE ROLE CONGRESS SHOULD PLAY
The Secretary's authority to promulgate health privacy
regulations is delegated to her in the Health Insurance
Portability and Accountability Act. Due to the constraints
imposed on her authority by HIPAA, the practical impact is that
the draft regulation falls short in terms of scope of coverage
and enforcement. Congress should act swiftly to fill these gaps
to ensure that Americans have strong and comprehensive health
privacy protections.
A. Who is Covered: Scope Should be Expanded
The draft rules issued by HHS only apply to certain
entities: health care providers, health plans, and
clearinghouses (entities that process and transmit claims
data). We recognize that the scope of entities covered by the
regulations is limited by the terms of HIPAA, and that the
Secretary has attempted to cover as many entities as possible
given her limited delegated authority. By limiting the
regulations to health plans, health care clearinghouses, and
certain health care providers, however, Congress has left a
large number of entities unregulated, leaving gaps in the
protection afforded health information. Many providers,
researchers, and oversight agencies, for example, will not be
subject to this regulation even though they collect, use, and
disclose protected health information that identifies
individuals.
The Secretary has chosen to bind some non-covered entities
to the principles of the draft regulation by requiring covered
entities to establish contracts with business partners, or by
prohibiting disclosures. This is a good intermediary step to
fulfill the intention of the privacy language of HIPAA.
However, this approach has significant limits, including the
liability borne by covered entities, and the difficulty in
prohibiting re-disclosure by non-covered entities.
The only way to eliminate these gaps is for Congress to
enact a comprehensive health privacy law. We therefore strongly
urge Congress to pass a comprehensive health privacy law
applicable to all those who generate, maintain, or receive
protected health information.
B. What is Covered: Paper Records Should be Protected
The draft regulations only apply to electronic health
information, but the vast majority of health information is
currently maintained in paper form. We believe that the
Secretary has the authority to extend the regulations that
apply to all health information--whether it is maintained in
paper or electronic format--and we recommend that she does so.
In the event that the final regulations do not cover paper
records, we believe that it is appropriate and necessary for
Congress to extend the protections to cover all records
maintained or transmitted by covered entities.
The vast majority of health information is currently
maintained in paper form. As proposed, the regulations
distinguish between health information that at some point has
been electronically maintained or transmitted and that which
has not. This distinction is nonsensical, unworkable and
unenforceable. At some point, some, but not all, of the
information in the record may be transmitted electronically.
Under the current proposal, the paper record would then contain
both protected information (i.e., information that has been
electronically transmitted), and unprotected information
(information which has not been so transmitted). It would be
burdensome and difficult to identify and designate which
information in any particular record is protected.
It would be easier for a covered entity to treat all
information it maintains or transmits in the same fashion.
Additionally, for enforcement purposes, it may prove difficult,
if not impossible, to establish that specific health
information at some point in its existence has been transmitted
or maintained electronically and, therefore, is subject to the
regulations. The best way to reduce these implementation and
enforcement ambiguities is to make the privacy standards
applicable to all individually identifiable health information
transmitted or maintained by a covered entity regardless of its
form.
Finally, the administrative simplification provisions of
HIPAA appear to encourage the development of a uniform
computer-based health information system. This goal is impeded
by allowing paper records to remain beyond the scope of the
regulations. There is little incentive for covered entities to
convert to computer-based health information systems if they
may avoid regulation by maintaining paper-based systems.
C. Enforcement: Private Right of Action Needed
Under HIPAA, the Secretary is unable to confer on
individuals a private right of action in the event the rules
are violated. When finalized, the regulation will be difficult
for HHS to oversee and enforce, and no federal remedy will be
available to individuals. Only Congress can fill these
significant gaps.
In every other federal law that protects the privacy of
peoples' records--from the Right to Financial Privacy Act to
the Video Privacy Protection Act--Congress has seen fit to give
people the legal right to go to court to seek injunctive relief
and damages when the law has been violated. The remedies
available under the proposed regulation are inadequate to
ensure that the law will be fully, and forcefully, enforced. In
the absence of a set of meaningful remedies, a real danger
exists that compliance will be weak and spotty. While we
understand the recent concern over lawsuits, we are unaware of
significant problems that have resulted from the remedies now
available to people under existing federal privacy statutes.
IV. STRENGTHS AND WEAKNESSES OF THE PROPOSED REGULATION
The following is a summary of the major provisions of the
proposed regulation, with our comments. The Health Privacy
Project also staffs the Consumer Coalition for Health Privacy,
whose mission is to educate and empower healthcare consumers to
have a prominent and informed voice on health privacy issues at
the federal, state, and local levels. (A copy of the
principles, Steering Committee, and endorsing organizations is
attached. Information is also available at http://
www.healthprivacy.org.) Members of the coalition are committed
to the development and enactment of public policies and private
standards that guarantee the confidentiality of personal health
information and promote both access to high quality care and
the continued viability of medical research. Funding for the
Consumer Coalition is provided solely by the Open Society
Institute. Many members of the Coalition are planning to submit
their own comments on the draft Regulation. Others have
endorsed the comments submitted by the Health Privacy Project
and are reflected in the comments themselves.
The full text of our comments, with the names of endorsing
organizations, is attached. (The comments are also available at
http://www.healthprivacy.org.)
A. Who is Covered
Again, by statute, the Secretary can directly regulate only
health care providers, health plans and health care
clearinghouses, all of which are defined as ``covered
entities.'' We believe that the most effective way to extend
the scope of coverage is through a comprehensive health privacy
law that covers all entities that use and disclose individually
identifiable health information.
In the draft regulation, the Secretary attempts to address
this statutory weakness by requiring covered entities to have
contracts restricting uses and disclosures with their
``business partners,'' i.e., certain persons and organizations
to whom they disclose protected health information. We commend
the Secretary on her efforts to encompass as broad a field as
possible under the proposed regulations. In our complete
comments, we suggest ways in which the contracts between
business partners might be improved.
The Secretary also attempts to address the circumstance
under which an organization provides some health care or has
created a health plan, but is not primarily engaged in these
activities (such as a school that has an infirmary). Although
the Secretary discusses treating only the health care component
as a ``covered entity,'' the regulations do not expressly carry
out this intent. We suggest that this intent to designate only
the health care component of a mixed entity as a ``covered
entity'' be incorporated in the regulations. Additionally, the
Secretary's explanation concerning employers and how they fit
into the regulatory scheme is somewhat confusing. We suggest
that the Secretary clarify the responsibilities of employers
that sponsor health plans.
B. What is Covered
Again, the draft regulation currently only applies to
health information maintained and transmitted in electronic
form. We believe that the Secretary currently has the authority
to promulgate regulations that apply to all health
information--whether it is maintained in electronic or paper
format--used and disclosed by covered entities.
C. Patients' Access to their Own Health Records
The draft regulations give people the right to see and copy
their own health information, and to request that it be
corrected or amended. We commend this effort to extend these
fair information practices to health information.
We believe, however, that the Secretary has used a somewhat
minimalist approach towards these rights. In our comments, we
suggest a number of ways in which the right of access can be
made more meaningful. Our major suggestions include:
The decision to deny an individual's request for
access to his health information should ultimately be made by a
health care provider who is qualified to treat the patient for
the condition that is the subject of the health information;
There should be a meaningful appeals process for
denials of access to health information; and
The regulations should expressly state that a
covered provider may not deny an individual access to his
protected health information because of an unpaid bill for
health care services.
D. Notice of Information Practices
The regulations give individuals the right to receive
adequate notice of the information practices of covered plans
and providers. We approve of this approach. We are also pleased
that the regulation requires the notice to address the entity's
existing information practices, rather than possible
information practices, and suggest that this component of the
regulation be preserved. We recommend changes that strengthen
the notice provisions, including a requirement that covered
entities make a reasonable effort to obtain a signed
acknowledgment that the individual has received and read the
notice of information practices.
E. Patient Authorization
The proposed rules would allow health information to be
used and shared easily for treatment, payment and health care
operations, without the consent of the patient. While we
understand the need to strike a balance between individuals'
privacy rights and the practical necessity of using and
disclosing health information for certain purposes, we believe
that the proposed regulations give too little weight to
individual rights. Under the proposed rules, people have no
ability to control or even monitor the use and disclosure of
protected health information for purposes of treatment, payment
and health care operations. We find this particularly
disturbing given the Secretary's proposed construction that
``treatment'' includes the treatment of all individuals, not
just the individual subject of the information.
The regulations should require authorization from
the individual for the use and disclosure of information for
treatment, payment and health care operations, which should be
renewed at least once every three years or whenever the patient
changes insurance companies, whichever occurs first. At an
absolute minimum, covered entities should have the option to
require patient authorization for treatment, payment and health
care operations.
The terms ``treatment'' and ``payment'' should be
narrowly interpreted as applying to the individual who is the
subject of the information.
The definition of ``treatment'' should be amended
to ensure that disease management programs are only conducted
with the authorization of the treating physician.
The regulation should expressly state that the
term ``health care operations'' includes only disclosures made
to the covered entity (or a business partner of such entity) on
whose behalf the operation is being performed.
The regulations should limit the definition of
health care operations to include only those operations that
cannot be carried on with reasonable effectiveness and
efficiency without protected health information.
Health care providers should be subject to the
verification requirements of the regulations when the request
for information for treatment purposes originates outside of
the covered entity.
We support the regulations' requirement that covered
entities obtain an authorization from the individual for most
uses and disclosures that are not directly related to
treatment, payment or health care operations. We also strongly
agree that consent must be voluntary, and cannot be tied to the
delivery of any benefits or services. In addition to these
requirements, we recommend that covered entities be required to
obtain individual authorization prior to making certain
disclosures of information pertaining to an individual's
request or receipt of sensitive health services.
F. Minimum Necessary
The proposed regulation requires organizations to ``make
all reasonable efforts not to use or disclose more than the
minimum amount of protected health information necessary to
accomplish the intended purpose of the use or disclosure.'' We
believe that this is the proper approach but that it does not
go far enough because it does not apply to a large number of
uses and disclosures. We urge the Secretary to extend this
minimization requirement to most uses and disclosures.
G. Patient's Right to Restrict Disclosures
The proposed regulations give an individual the right to
request restrictions on the use and disclosure of protected
health information for purposes of treatment, payment, and
health care operations. That request can only be made to a
health care provider, and it must be agreed to by that
provider. We suggest that the regulations be amended in the
following ways:
Allow individuals to have a true right to restrict
(not just the right to request restrictions on) the use and
disclosure of their protected health information where the
disclosure of that information could jeopardize the safety of
the individual.
Allow individuals who pay for their own medical
care (self-pay) to have a true right to restrict the disclosure
of their protected health information.
Allow individuals to require or request
restrictions from all covered entities, not just health care
providers.
Require all covered entities that receive health
care information that are subject to a restriction to comply
with the restriction.
H. Psychotherapy Notes
We strongly commend the Secretary for excepting
psychotherapy notes from the general rule allowing for the free
flow of information for treatment, payment and health care
operations purposes. The proposed regulations limit access to
psychotherapy notes, absent specific consent from the
individual. We believe, however, additional protections are
critical for ensuring the level of privacy essential for
effective mental health care.
I. Law Enforcement
While we acknowledge the positive shift in the Secretary's
approach from her 1997 position that law enforcement should
continue to have unfettered access to medical records, this
current proposal continues to fall far short of meaningful
standards. We urge that the final regulation:
Require that law enforcement officials obtain
legal process issued by a neutral magistrate, and
Require that legal process issue only after the
magistrate has applied a strong legal standard in weighing the
request.
J. Health Oversight
We believe it is critical for the Secretary to clearly
distinguish between law enforcement access and access to
conduct health oversight activities.
We are also deeply concerned that the health oversight
section contains too few limits on access and reuse of
protected health information. In particular, we believe that
where health information is used in a health oversight
investigation, there should be a prohibition on the re-use and
re-disclosure of protected health information in actions
against individuals. Such a limit is essential to ensure that
the relatively easy access afforded to health oversight
officials does not become the back-door for law enforcement
access.
While this prohibition may be beyond the Secretary's
authority in this regulation, we do believe that the Executive
Branch is empowered to issue an Executive Order barring the re-
use and re-disclosure of protected health information obtained
pursuant to oversight. Such an order would establish legally
enforceable limits directly on the federal employees charged
with executing health oversight responsibilities.
K. Research
We support the general approach towards research in the
regulations. We are pleased that the regulation aims to
establish uniform rules for researchers regardless of the
source of funding. The regulation seeks to accomplish this
goal, however, by allowing covered entities to disclose
protected health information to researchers without patient
authorization if the disclosure has been approved by an
Institutional Review Board (IRB), or a newly created privacy
board. We believe that the Secretary should eliminate the
option of using a privacy board.
If the regulation does not bring all research under the
Common Rule, the proposed regulation should be revised to
ensure that there are similar standards and equal oversight and
accountability for both IRBs and privacy boards.
L. Enforcement
We recognize that the Secretary is limited in addressing
enforcement mechanisms by the delegation of authority in HIPAA.
Thus, it is critical that the Congress act to grant people a
private right of action to enforce their rights under this
regulation.
M. Preemption
We strongly support the approach in HIPAA and the proposed
regulations that the federal privacy regulations will act as a
floor, but not a ceiling, on privacy protections afforded by
the States. Under this approach, weaker State health privacy
laws are preempted (or overridden) while State laws that offer
more protection than the federal regulations will remain.
Furthermore, this approach allows a State, in the future, to
enact stronger privacy protections to meet the changing needs
of its citizens.
We believe that the regulations should provide definitions
of the terminology used in the preemption provisions for
general purposes, not just for use in the Secretary's advisory
opinions. We also believe that the regulation should treat
state laws pertaining to disclosures about minors the same as
other state laws generally, preempting state laws that are
contrary to the proposed rule and less protective of the
privacy of minors. Lastly, we are very concerned about the
breadth of the provision under which a State may request a
waiver that would allow a weaker State health privacy law to
stand, essentially making the analogous federal regulation
inapplicable in that State.
V. CONCLUSION
On balance, we believe that the proposed health privacy
regulations are a significant and vitally important step
towards guaranteeing the American public a greater degree of
privacy protection for their medical records. When finalized,
the regulation will be the first comprehensive federal rules on
health privacy, establishing a minimum set of standards by
which health care providers, health plans, and others, must
comply. As such, the regulations will not only foster greater
public trust and confidence in our nation's health care system,
but they will also bring much-needed uniformity and
predictability to the privacy rules that must be adhered to
across the country. Most importantly, the regulation will
establish greater uniformity while leaving states the
flexibility to act on behalf of their residents and augment the
regulation as needed.
We do believe that it is crucial for Congress to act to
fill the gaps in the proposed rule: the regulation should be
extended to cover all medical information, whether paper or
electronic form; the regulation should cover all of those who
generate, maintain or receive protected health information; and
the regulation should include a private right of action.
[An attachment is being retained in the Committee files.]
Chairman Thomas. Thank you very much, Ms. Goldman. Ms.
Grealy?
STATEMENT OF MARY R. GREALY, PRESIDENT, HEALTHCARE LEADERSHIP
COUNCIL
Ms. Grealy. Mr. Chairman and members of the subcommittee,
thank you for this opportunity to testify regarding the
proposed HHS regulations regarding the confidentiality of
patient information. I am Mary Grealy, President of the
Healthcare Leadership Council.
The HLC is an organization of chief executives of the
Nation's most respected health care companies and institutions.
The views I express today are those of innovative leaders from
the full spectrum of American health care, health plans,
physicians, hospitals, universities, pharmaceutical,
biotechnology, and medical device manufacturers. Our members
formed the Healthcare Leadership Council to promote their
vision of a consumer centered health system that offers
accessible, affordable health care of the highest quality.
The HLC has led a broad-based coalition of 90 organizations
and has sought to apply this vision to the issue of patient
confidentiality. Our goal has been, and continues to be,
legislation that establishes strong, uniform, Federal standards
to protect the confidentiality of patient information.
We share the desires of the administration and many members
of Congress in this regard. Our members know firsthand how
important it is that patients have trust that their medical
information will be kept confidential and disclosed only when
appropriate.
We appreciate and applaud you, Mr. Chairman, and
Congressman Cardin for your efforts to move us closer to the
very necessary uniform Federal standards for privacy.
In the absence of legislation, however, we concentrate on
the matter at hand, the regulations proposed by Health and
Human Services. We share the goal of members of this committee
and of the regulations that they must achieve a critical
balance. We must give patients confidence that their medical
information will be kept confidential and that those who
violate the patient's privacy will be subjected to strong
penalties.
At the same time, we must ensure that no regulatory
barriers will be erected to obstruct the flow of information
that has led to virtually every health care advance that has
saved and enhanced lives. Can we achieve confidentiality
protection without establishing costly regulatory burdens that
will divert important resources away from patient care?
Striking that balance is the standard that these regulations
must meet.
We have determined that in certain critical aspects they
fall short of reaching that balance. While there are a number
of very positive aspects to these regulations that we can
endorse, there are also some ambiguities, gaps and, in some
instances, explicit language that will make compliance
difficult if not impossible and will have a detrimental effect
on the quality and safety of patient care.
Let me make clear at the outset that we support the
Department's approach of permitting patient information to be
used for payment, treatment, and health care operations without
requiring individual authorizations. When individual hospitals
and other providers experience millions of patient encounters
every day, seeking individual authorizations to disclose
information for each of those encounters would have a
catastrophic effect on our health care system and patient care
delivery.
Under tab one of my testimony is a chart that illustrates
the many integrated components of our complex health care
delivery system. Requiring those separate authorizations would
impede the flow of information that is needed for the various
activities, such as lab tests, ordering prescriptions,
immunization programs, and a variety of other encounters, as
well.
HHS has handled this important issue properly, and we
endorse the approach that they have taken. Now let me address
some of the aspects of the regulation that we cannot, at this
time, support. My full written testimony addresses this in much
more detail, but let me focus on just five areas this morning.
Number one, these regulations become unworkable by
attempting to restrict all uses of information as opposed to
the disclosure of information. We agree that the limits on
disclosure are necessary and appropriate, but attempting to
regulate all uses creates a myriad of problems.
Let me put this into prospective. It is inconceivable that
regulators in Washington today can predict and define today
what necessary use of patient information will be six months
from now, much less six years from now. An attempt to do so
will really have a chilling effect on the efforts to develop
beneficial new uses of patient information.
Number two, these regulations raise questions as to whether
population data can be used without unreasonable restrictions
to support patient treatment and important health care
activities. For example, many health plans today review their
entire enrollee database and analyze patterns of emergency room
visits and pharmaceutical usage to identify those patients who
can benefit from asthma management programs. These are the
kinds of things that perhaps, if this regulation is not
implemented appropriately or is not clear enough, would be
prevented and necessary treatment would not be given.
Number three, there is a two word phrase in these
regulations that can have a major detrimental impact on patient
care. That phrase is minimally necessary. These rules stipulate
that the covered entity must individually review every
legitimate request for patient information and provide only
that information that is minimally necessary. We have heard
that discussed today in the question and answer period, but I
think you can detect that this would be a very burdensome
requirement given the many patient encounters that occur in our
health care system.
Really a catch-22 exists here where you perhaps would have
physicians that might be reviewing that request or nurses that
are doing the review of those patient records. They would be
experts, but that would be a real diversion away from patient
care in using those resources. If we decide not to use a
physician or a nurse, and we have others do it, there is a real
chance that critical information would not be transmitted if
they are trying to apply that minimally necessary rule.
Number four, it is also troublesome that the regulations
are requiring the cumbersome use of individual authorization
for research unrelated to treatment. It is not clear what that
phrase unrelated to treatment means. Again, you have heard
earlier today some of the concerns raised about the use of that
information and the need for having it for medical research
that is critical to our health care delivery system.
Finally, Mr. Chairman, it is clear in reviewing these
regulations, that HHS has tremendously underestimated the cost.
I think Blue Cross Blue Shield has highlighted that very well
in their testimony and the study that they had done. The cost
burden could have a very serious effect on the cost of health
care and the delivery cost, and also on the access to health
insurance coverage, about which we are all very concerned.
In this vein, it needs to be emphasized that the Secretary
really has, we believe, reached beyond her authority by
requiring covered entities to apply these regulations in
contracts with their business partners, and to monitor their
business partners' activities. We also believe that it is
outside the Secretary's authority to impose an implied private
right of action, as we think has been done in these
regulations.
It is imperative, we believe, that there be a national
uniform standard that will provide certainty and clarity to all
who are involved in the health care delivery system, patients,
providers, researchers and plans.
We look forward to working with members of this committee
and Congress, and also working with HHS as they produce this
regulation, to see if we can come up with some constructive
recommendations. And we think we have done that in the comments
that we have submitted. We look forward to working with you and
with the Department on this very important issue. Thank you.
[The prepared statement follows:]
Statement of Mary R. Grealy, President, Healthcare Leadership Council
Mr. Chairman and members of the Subcommittee, thank you for
this opportunity to testify regarding the proposed HHS
regulations governing the confidentiality of patient
information.
The Healthcare Leadership Council is the organization of
chief executives of the nation's most respected health care
companies and institutions. The views I express today are those
of the innovative leaders from the full spectrum of American
health care--health plans, physicians, hospitals, universities,
pharmaceutical, biotechnology and medical device manufacturers.
Our members formed the HLC to promote their shared vision of a
consumer centered system that offers accessible, affordable
health care of the highest quality.
The HLC has led a broad-based coalition of 90 organizations
that has sought to apply this vision to the issue of patient
confidentiality. My testimony this morning is on behalf of HLC.
Our goal has been, and continues to be, legislation that
establishes strong uniform federal standards to protect the
confidentiality of patient information. We share the desires of
the Administration and many members of Congress in this regard.
Our members know first hand how important it is that patients
have trust that their medical information will be kept
confidential and disclosed only where appropriate.
We appreciate and applaud you, Mr. Chairman, and
Congressman Cardin for your joint efforts to move us closer to
those very necessary uniform standards.
In the absence of legislation, however, we concentrate on
the matter at hand, and apply our consumer-centered health care
principles to the regulations proposed by HHS. We share the
goal of members of this Committee that these regulations must
achieve a critical balance. Are we giving patients confidence
that their medical information will be kept confidential, and
that those who violate a patient's privacy will be subjected to
strong penalties? And, at the same time, are we ensuring that
no regulatory barriers will be erected to obstruct the flow of
information that has led to virtually every health care advance
and breakthrough? Can we achieve confidentiality protections
without establishing costly regulatory burdens that will divert
important resources away from patient care?
Striking that balance is the standard these regulations
must meet, Mr. Chairman, and we have determined that, in
certain critical aspects, they fall short. There are a number
of positive aspects to these regulations that we can endorse.
There are, however, ambiguities, gaps and, in some cases,
explicit language that will make compliance difficult, if not
impossible, and will have a detrimental effect on the quality
and safety of patient care.
Let me make it clear at the outset that we support the
Department's approach of permitting patient information to be
used for payment, treatment and health care operations without
requiring the use of individual authorizations. When individual
hospitals and providers experience millions of patient
encounters every day, seeking an individual authorization to
disclose information for each of those encounters -and the
transactions resulting from them--would have a catastrophic
effect on our health care system and on patient care.
Tab one of my testimony is a chart that illustrates the
many integrated component parts of our health care system.
Requiring separate authorizations would impede the flow of
information needed for various activities such as lab tests,
ordering prescriptions, immunization programs, medical research
and case and disease management, just to name a few.
HHS has handled this important issue properly, and we
endorse their proposed policy in this regard.
Let me address, though, the aspects of these regulations
that we cannot, in the name of quality health care, support. My
full written testimony addresses our comments in greater
detail, but allow me to highlight this morning five areas of
particular concern.
Number one, these regulations become unworkable when they
attempt to restrict all uses of patient information, as opposed
to disclosure of information. We agree that limits on
disclosure are necessary and appropriate. Attempting to
regulate all uses, however, particularly uses within an entity,
creates a myriad of problems.
For example, the regulations create a finite list of
narrowly-defined activities for which data can be used without
individual authorization.
Let's put this into perspective. In the field of health
care, there have been more new strides, developments and
breakthroughs, more new ideas, practices and approaches in the
last five years than in the previous 25 years combined. It is
inconceivable that regulators in Washington can predict and
define today what a necessary use of patient information will
be six months from now, let alone six years. And to attempt to
do so could have a chilling effect on our efforts to develop
beneficial new uses of patient data.
Number two, these regulations raise questions as to whether
population data can be used, without unreasonable restriction,
to support patient treatment and important health care
activities. For example, many health plans today will review
their entire enrollee database and analyze patterns of
emergency room visits and pharmaceutical usage to identify
those patients who can benefit from an asthma management
program. These regulations are ambiguous, at best, as to
whether this would continue to be an acceptable use of patient
information without first obtaining an individual's
authorization. If it is not, too many Americans will continue
to suffer needlessly from treatable chronic conditions.
Number three, there is a two-word phrase in these
regulations that can have a major detrimental impact on patient
care. That phrase is ``minimally necessary.'' These rules
stipulate that the covered entity must individually review
every legitimate request for patient information and provide
only that information that is minimally necessary.
Beyond the burdensome nature of this requirement -and
imagine, for just one hospital handling hundreds of thousands
of information transactions a year, how costly and time-
consuming it will be--it creates a problematic catch-22. If
those reviewing the information are not medical professionals,
you run the real risk of excising information that can be
critically important to a physician or a medical researchers.
If, on the other hand, you assign trained nurses and physicians
to review data to determine what is minimally necessary, you
are taking vital resources away from patient care. In either
case, information critical to treatment and research could be
withheld. That could expose patients to harm.
The minimally necessary standard, as proposed, simply will
not work.
Number four, it is also troublesome that the regulations
require the cumbersome task of individual authorizations for
research unrelated to treatment. What does that phrase mean--
research unrelated to treatment?'' The regulations are not
clear, and that ambiguity could lead to restrictions down the
line that undermine vital medical research. What we do know is
that the great research facilities of this country--the Mayo
Clinic, Johns Hopkins and so many others--do extensive medical
research that is not targeted to a particular disease or
condition but that results in unforseen and unanticipated
health breakthroughs. No regulation should inhibit or undermine
this type of research. I have detailed other concerns with the
rule's research provisions in my written testimony.
And, finally, Mr. Chairman, it is clear in reviewing these
regulations that HHS has tremendously underestimated the impact
of these rules on health care costs. The total estimated
compliance cost of $3.8 billion over five years fails to
account for several new requirements found in these pages. The
cost of personnel to determine the minimally necessary amount
of information to be disclosed. Requiring health care providers
to monitor the practices of their business partners.
Establishing and operating federally-mandated privacy boards.
The list goes on and on, Mr. Chairman, and the bill to
patients, providers and the employers who provide health
coverage will be a high one.
In this vein, it needs to be emphasized that the Secretary
has reached beyond her authority by requiring covered entities
to apply these regulations in contracts with their ``business
partners'' and to monitor those business partners' activities.
And, it is outside the Secretary's authority to provide an
implied private right of action not envisioned by HIPAA.
Ultimately, as I mentioned earlier, we hope that Congress
will pass comprehensive confidentiality legislation. As well
intentioned as these regulations are, the Department cannot,
under the HIPAA law, preempt state laws that are contrary to or
stricter than the federal rules. Thus, as illustrated in Tab
two of my testimony, we will continue to have a situation in
which the simple act of filling a prescription can involve the
separate and sometimes contradictory confidentiality laws of
half a dozen or more states.
A nationally uniform standard would provide certainty and
clarity for all involved in the health care delivery system--
patients, providers, researchers and plans.
We wish to continue to work with you, Mr. Chairman, and the
members of this committee to advocate a legislative approach
that will protect confidentiality while, at the same time,
allow the free flow of information that saves lives and ensures
quality health care for the American people.
We will also continue to work with HHS on its regulation
and have submitted what we hope are constructive comments to
improve this rule.
Again, thank you for this opportunity to testify today.
Summary of HLC Comments on the Proposed HHS Regulations
Since enactment of HIPAA, which set in motion this debate,
the HLC has supported several general principles: (1) Patient
information should be protected, safeguards should be provided,
and patients should have access to their own records; (2) clear
boundaries should be set around disclosure of patient
information; (3) penalties for violating these requirements
should be imposed; (4) patient information should be available
for research; and, (5) a nationally uniform set of standards
should replace the ``crazy quilt'' of conflicting, confusing,
and sometimes harmful, state laws.
The HLC has thoroughly reviewed the proposed HHS
regulations and has submitted extensive comments from a broad
industry-wide perspective on aspects of the rule we support,
and others that we cannot support without substantial
modifications. The following will highlight our comments on the
proposed rule.
Aspects Of The Proposed Rule HLC Supports
Allowing Disclosure/Use Without Authorization For Appropriate
Activities
The HLC supports the Department's approach of permitting
patient information to be used for payment, treatment, and
healthcare operations without requiring entities to obtain
individual authorizations. This so-called ``statutory
authorization'' approach is clearly correct. Alternative
approaches requiring separate authorizations from the
individual each time information is disclosed or used for
appropriate health care activities would seriously disrupt our
health care system and harm patient care.
For example, providers routinely order tests and other
services through unrelated providers (such as laboratories or
radiology services), not all of which have contact with a
patient. Family members routinely pick up prescriptions for a
sick family member at home. Each of these potential exchanges
of information could be subject to separate authorizations by
the individual under multiple authorization schemes.
Health plans often cover spouses, dependents, and even
children not living with the parent who subscribes to the plan.
Collecting authorizations from these individuals could create
serious obstacles for the delivery of health care services.
The potential harm caused by such multiple authorization
schemes is not idle speculation. Maine passed such a law that
was so disruptive it was repealed in an ``emergency'' bill just
14 days after taking effect.
Some Americans still view our health care delivery system
as the relationship between patient, doctor, hospital, and
pharmacist. The reality, of course, is that our system has
evolved into a highly integrated, complex, and, as a result,
better delivery system. Tab one of HLC's testimony illustrates
the many integrated component parts of our health care system.
Requiring separate authorizations to allow information to move
among these components would be highly disruptive and
compromise patient care.
We do have concerns with several limitations put on the
``statutory authorization'' which are discussed later.
Including Important Health Management Activities
The HLC also supports the inclusion of treatment, payment
and health care operations in the activities for which no
individual authorization is needed. We are pleased that the
Department recognized the importance of such activities as case
and disease management to patients by including them in their
definitions. Disease management programs for chronic diseases
such as asthma, diabetes, heart disease, and others are
dramatically improving the lives of millions of Americans. We
do have concerns with some limitations on these programs which
we discuss later.
Other Allowed Uses and Disclosures
The HLC supports the need for disclosure to public health
authorities and is pleased that the rule allows disclosure to
someone complying with such an authority. We also support the
need for the disclosure to health oversight agencies to improve
health care quality and protecting public health, as well
as for government health data systems.
Research
Finally, the HLC supports the general direction of the
research provisions of the rule to the extent it does not
require individual authorization for disclosure of data to
research entities. We do have some major concerns about the
research provisions will be discussed later in our testimony.
Provisions of the Proposed Rule of Concern to HLC
Regulating Use of Information
While the HLC supports the need for the rule to restrict
disclosure of patient information outside of appropriate
entities, we are concerned about the numerous and burdensome
restrictions on the uses of such information, particularly uses
within a covered entity. These restrictions on use of
information create several problems.
The rule prohibits all internal uses of data that
do not fall in to a relatively narrowly defined set of
activities. The Department is, thereby, taking the position
that it can define all conceivable appropriate uses of patient
information. We believe that this is not only impossible for
current uses, but such an approach would have a chilling effect
on the development of beneficial new uses of patient
information.
The HLC is concerned that the rule will unduly
limit the use of population data that is used to support
patient treatment and other legitimate activities. This is
because the allowable uses of patient information are closely
tied to the provision of health care to an individual patient.
This raises a question as to whether, for example, a health
plan could review an entire enrollee database to identify
specific individuals whose utilization patterns of asthma
drugs, or emergency room visits, indicate they would benefit
from being enrolled in an asthma management program.
Again, because an entity's internal uses of
patient information are so sharply restricted by the rule,
several important internal business operations of health care
providers and plans could be left out. For example, a national
health plan recently undertook a study to evaluate the cost
effectiveness of its preauthorization requirements. Audits of
real cases containing patient information were necessary. The
audit resulted in the plan dropping some preauthorization
requirements, a good result for patients and the plan.
The HLC is concerned that the definitions of
treatment, payment, and health care operations may be diluted
by the rule's approach broadly defined as ``marketing.'' If a
use or disclosure is deemed to be for the purpose of
marketing--a term not defined--an individual authorization
would be required. This determination could be made on a
retrospective basis and could be applied to certain types of
disease management programs, and also the use of formularies by
health plans, and providers (most notably hospitals). For
instance, a candidate for an asthma disease management program
may receive a more effective drug therapy under a disease
management program. There is the risk that under the rules such
activities could be viewed as marketing activity. To the extent
arrangements fall within the definition of treatment, payment,
or health care operations, they should not be subject to
conflicting rules under ``marketing.''
The HLC recommends that the rule focus on restricting
disclosure of patient information, not use (particularly use
within an entity). At a minimum, internal management functions
of providers and plans that involve only the use, not
disclosure, of patient information should be broadly included
under the definition of health care operations.
Minimum Necessary Rule
The rule requires that entities ``review each request for
disclosure individually on its own merits [from preamble]'' and
determine which information is minimally necessary. It is
neither practical nor consistent with good medical practice to
promote a rule that would encourage and possibly require
excision of data in a medical record. The recent Institute of
Medicine report underscores the potential harm to patients when
providers have only limited access to information. The HLC
suggests that, alternatively, entities be allowed to have
general practices and guidelines and not be required to make
individual determinations.
Unnecessary Administrative Burdens
The HLC is concerned that the requirements for
accounting for the disclosure of patient information, detailed
provisions governing the practices of ``business partners'' and
their relationship with covered entities, and the training and
certification requirements will greatly increase the
administrative burden borne by covered entities.
The Department has exceeded the scope of its
authority under HIPAA in several provisions, most notably in
those provisions pertaining to the ``business partner'' of a
covered entity. And, it is outside the Secretary's authority,
and not envisioned by HIPAA, to provide an implied private
right of action.
De-identifying Data
The HLC has serious concerns that the standard for de-
identifying data in the rule sets the bar too high. Requiring
that 19 identifiers--including even ``account numbers'' and
``zip codes''--be removed to de-identify data would make data
anonymized and nearly worthless to most researchers. The
practical effect of this standard will be to discourage, rather
than encourage, encryption and other efforts to de-identify
records. The HLC recommends that these ``identifiers'' be
limited to a more reasonable list of characteristics that truly
identify individuals.
Research
The HLC believes that modifications to the
Institutional Review Board (IRB) process should be addressed
separately in a comprehensive review of the IRB process and not
via this rule. Several of the criteria to be used by an IRB (or
``privacy board'') exceed the Department's authority by
regulating the content of research, as opposed to overseeing
the confidentiality of data in research.
The requirement that individual authorization be
obtained to use data in ``research unrelated to treatment'' is
unworkable and unnecessary.
The HLC is concerned that the disclosure or use of
data may be subject to the ``minimum necessary'' requirements
mentioned earlier.
National Uniformity
One of the primary reasons HLC supports comprehensive
legislation to protect confidentiality is the need to provide a
nationally uniform standard. The confusing and contradictory
patchwork of state laws is an ineffective -and sometimes
harmful--approach to regulating a highly integrated and
decidedly interstate health care delivery system.
An illustration of why state confidentiality laws are
inappropriate in health care is included under tab two of my
testimony. In this example, a college student living in New
York is prescribed a medication in New Jersey. Before the
transaction is completed, entities in seven states are
involved. Which state's confidentiality laws apply? The answer
is ``all of them!''
The HLC has examined all of the state confidentiality laws
on the books, and many more being proposed, and concludes that
a nationally uniform standard would do more to protect the
confidentiality of patients' information than any other single
reform. Such a nationally uniform standard would provide
certainty and clarity that would at once protect patients and
not unduly burden health providers, plans, and others.
Of course, under HIPAA, the Department does not have
authority to preempt state laws that are contrary or stricter
than the federal rules. Thus, the need for comprehensive
legislation. At the very least then, the HLC believes that it
is incumbent upon the Department to evaluate state laws and
provide guidance to covered entities regarding which state
standards covered entities should follow.
[GRAPHIC] [TIFF OMITTED] T6897.001
[GRAPHIC] [TIFF OMITTED] T6897.002
Chairman Thomas. Thank you very much, Ms. Grealy. Dr. Ober?
STATEMENT OF N. STEPHEN OBER, M.D., PRESIDENT AND CHIEF
EXECUTIVE OFFICER, SYNERGY HEALTH CARE, WALTHAM, MASSACHUSETTS
Dr. Ober. Chairman Thomas, members of the subcommittee,
thank you for the opportunity to appear before you today. My
name is Stephen Ober. I am a physician and President and CEO of
Synergy Health Care, a health research and data analytics
company headquartered in Waltham, Massachusetts.
Synergy is a subsidiary of Quintiles Transnational
Corporation, the largest contract research organization in the
world and a leader in health care informatics services. As a
subsidiary of Quintile, Synergy is an affiliate of ENVOY, the
largest claims clearinghouse in the United States, which
processes an average of 3.5 million electronic data
transactions per day, providing connectivity between 270,000
providers and 800 payers. I have been part of a Quintiles work
group which has closely analyzed the NPRM in relation to its
impact on claims clearinghouses and their business partners.
Let me begin my comments by stating that Synergy and
Quintiles, in general, believe that the proposed NPRM standard
to protect the privacy of individually identifiable health
information are reasonable. However, I would like to offer four
brief comments.
First, clearinghouses are defined as covered entities by
the rule. But because clearinghouses are also business partners
of providers and health plans and do not have direct
relationships with patients, several requirements of the rule
appropriately do not apply to clearinghouses, such as providing
a notice of information practices, and offering access for
inspection or copying of records. We applaud this sensible
approach and fully support the concept that clearinghouses and
other business partners would not be permitted to use or
disclose identifiable health data in ways not permitted to the
covered entity to which such information was initially
provided.
We are concerned, however, by the provision that would
require a covered entity, when acting as a business partner of
another covered entity--as claims clearinghouses always do--to
be bound by the health information policies and procedures of
its partners. Thus, the health care clearinghouse would have to
establish its own privacy policies and procedures, but then be
required to attempt to adhere to the privacy policies and
procedures of the thousands--and I do mean thousands--of other
covered entities for which it acts as a business partner.
This approach would needlessly complicate the network of
existing relationships and be practically impossible to
administer.
Second, the NPRM stipulates that covered entities must have
each business partner sign a contract which details the uses of
identifiable health information and requires its protection.
Again, we agree with this principle. However, we suggest that
HHS should adhere to its stated intention of promoting de-
identification of individual health information whenever
possible by clarifying that business partners who are in lawful
possession of identifiable health information may create de-
identified health data and, in fact, should be encouraged to do
so.
Third, in the NPRM, the Department proposes to establish a
safe harbor for the creation of de-identified health
information if covered entities eliminate 19 potential
individual identifiers. While we agree with the elimination of
most of the identifiers mentioned, eliminating others would
negatively impact the ability to use these data in research
activity.
For example, certain geographic identifiers and patient
date of birth are two of the most important demographic data
elements required in performing most health care research. The
rule, as written today, requires elimination or modification of
these valuable elements.
Finally, one of the most exciting potential of health care
clearinghouses, and the one I am personally most passionate
about, lies in the capacity to create de-identified data on a
large scale.
In the NPRM, HHS comments on the ``many instances in which
such individually identifiable health information is stripped
of the information that could identify individual subjects and
is used for analytical, statistical, and other related
purposes.'' This is, in fact, what we do at Synergy.
For instance, one study for the Centers for Disease
Control, we showed that the use of hepatitis B vaccine by
physicians decreased dramatically following several reports of
adverse effects of this immunization, something CDC had been
struggling to monitor for several months. In another, we were
able to illustrate the positive impact of an education program
aimed at increasing appropriate physician testing and treatment
of the bacteria that causes peptic ulcer disease, a curable
illness today. In working with a major drug manufacturer and
the FDA, Synergy's timely monitoring of a patient prescription
usage patterns lead to a withdrawal of a previously used drug.
And yes, Mr. Chairman, we have also done work looking at
medical errors. These are just a few examples of what are
virtually limitless uses of de-identified health care
information.
While we are most supportive of the NPRM rule as a covered
entity and a business partner, we at Synergy and Quintiles want
to be certain that all parties realize the impact of these
regulations, if not carefully derived, could have on the status
of health care research.
On behalf of Synergy Health Care and Quintiles
Transnational, thank you for the opportunity to appear before
you today.
[The prepared statement follows:]
Statement of N. Stephen Ober, M.D., President and Chief Executive
Officer, Synergy Health Care, Waltham, Massachusetts
Chairman Thomas, Members of the Subcommittee: Thank you for
the opportunity to appear before you today to discuss
provisions of the proposed regulation relating to the
operations of health care clearinghouses, the creation and use
of de-identified health information, and the preemption of
state laws.
My name is Stephen Ober. I am a physician and President and
CEO of Synergy Health Care, a health research and data
analytics company headquartered in Waltham, Massachusetts.
Synergy is a subsidiary of Quintiles Transnational Corporation,
the largest contract research organization (CRO) in the world
and a leader in healthcare informatics services. As a
subsidiary of Quintiles, Synergy is an affiliate of ENVOY, the
largest claims clearinghouse in the United States, which
processes an average of 3.5 million electronic data
transactions per day, providing connectivity between 270,000
providers and 800 payers. Some of you may have read of the
pending purchase of ENVOY from Quintiles by Healtheon/WebMD. As
part of this transaction, Synergy will continue to receive de-
identified data from ENVOY, maintaining our historic ties. The
matters before this Subcommittee regarding data privacy and
medical research have been of constant interest to our family
of companies. I have been part of a Quintiles workgroup, which
has closely analyzed these matters, including the NPRM and its
relation to the impact on claims clearinghouses and their
business partners, and I am happy to speak to you on this topic
today.
Health Care Clearinghouses
As you know, one of the objectives of the Health Insurance
Portability and Accountability Act (HIPAA) was to improve the
efficiency and effectiveness of the health care system, ``by
encouraging the development of a health information system
through the establishment of standards and requirements for the
electronic transmission of certain health information.'' One
reason why HIPAA was so crucial is demonstrated by the rapid
growth in the electronic transfer of health information: today
62% of all healthcare claims are processed electronically, and
for hospital and pharmacy claims the percentage is over 80%. In
1998 some 2.7 billion out of a total of 4.4 billion claims were
processed electronically, an important factor in ongoing
efforts to improve the efficiency of our health care system and
reduce health care costs.
In a section on ``administrative simplification,'' HIPAA
directed HHS to adopt a series of standards that would
encourage uniformity for a range of electronic health
information transactions. The proposed standards for the
privacy of individually identifiable health information that is
maintained or transmitted electronically were also mandated by
HIPAA in the absence of the passage of comprehensive medical
records privacy legislation by Congress. The NPRM proposes
standards to protect the privacy of individually identifiable
health information, outlines the rights of individuals who are
the subject of this information, and defines the authorized and
permitted uses of identifiable health information. In general,
Synergy and Quintiles believe that the proposed rule
establishes reasonable standards for security and efficiency of
the health information infrastructure. We applaud HHS's efforts
to encourage the de-identification of health care data for
medical research.
The ``covered entities'' defined by HIPAA include health
plans, health care providers that transmit health data
electronically, and health care clearinghouses. Although
clearinghouses are indeed covered entities, the proposed rule
recognizes that they are also ``business partners'' of the
health care providers or health plans for whom they are
processing the full range of administrative transactions and
providing connectivity. Because claims clearinghouses do not
have any relationship with individual patients, the NPRM
appropriately does not apply several requirements that must be
followed by health plans and providers. These include,
providing a notice of information practices, offering access
for inspection or copying of records, and accommodating
requests for amendment or correction.
We endorse this sensible approach, and support the concept
that clearinghouses and other business partners would not be
permitted to use or disclose identifiable health data in ways
not permitted to the covered entity to which such information
was initially provided. We are concerned, however, by the
provision that would require a covered entity, when acting as a
business partner of another covered entity (as claims
clearinghouses always do), to be bound by the health
information policies and procedures of its partners. Thus, a
health care clearinghouse would have to establish its own
privacy policies and procedures, which is entirely sensible,
but then be required to attempt to adhere to the privacy
policies and procedures of the thousands of other covered
entities for which it acts as a business partner. Obviously,
this approach would needlessly complicate the network of
existing relationships by which health care is delivered and
paid for today, and potentially thwarts the administrative
``simplification'' HIPAA meant to foster. In our written
comment, we have requested that HHS clarify this provision, as
it appears redundant and more likely to produce confusion than
improved protection of identifiable health information.
Creation and Use of De-Identified Health Information
The NPRM stipulates that covered entities must have each
business partner sign a contract which details the uses of
identifiable health information and requires its protection.
Again, we agree with the principles that the use of
identifiable health information by a business partner can be
limited by contract and that business partners are not
permitted uses or disclosures not allowed to the covered
entity. However, we suggest that HHS should adhere to its
stated intention to encourage de-identification of individual
health information whenever possible by clarifying that
business partners who are in lawful possession of identifiable
health information may create de-identified health data and, in
fact, are encouraged to do so.
In the preamble to the proposed rule, HHS suggests that
covered entities and business partners would be encouraged to
create de-identified health data and ``would be permitted to
further use and disclose such de-identified information in any
way, provided that they do not disclose the key or other
mechanism that would enable the information to be re-
identified, and provided that they reasonably believe that such
use or disclosure of de-identified information will not result
in the use or disclosure of protected health information.''
One of the most exciting potentials of health care
clearinghouses lies in the capacity to create de-identified
data on a large scale. Certainly, using de-identified data for
health research affords the greatest security for patient
privacy, and the Department hopes that de-identified data would
always be used when it is sufficient for a given research
purpose. In the NPRM, HHS comments on the ``many instances in
which such individually identifiable health information is
stripped of the information that could identify individual
subjects and is used for analytical, statistical and other
related purposes'' such as epidemiological studies, comparisons
of cost, quality or specific outcomes across providers or
payers, studies of incidence or prevalence of disease across
populations, areas or time, and studies of access to care or
differing use patterns across populations, areas or time.'' In
regard to the activities of claims clearinghouses, the NPRM
suggests that such covered entities ``could want to use codes
or identifiers to permit data attributable to the same person
to be accumulated over time or across different sources of
data'' and, further, that a ``business partner generally could
create a database of de-identified health information drawn
from the protected health information of more than one covered
entity with which it does business, and could use and disclose
information and analyses from the database as they see fit, as
long as there was no attempt to re-identify the data to create
protected health information.''
At Synergy we use de-identified, aggregated health
information to provide real-time data analysis to improve
pharmaceutical and medical service outcomes. For instance, in
one study for the Centers for Disease Control (CDC), we showed
that use of the Hepatitis B vaccine by physicians decreased
following several reports of adverse effects of this
immunization--something CDC had been struggling to monitor. In
another, we were able to illustrate the positive impact of an
education program aimed at increasing appropriate physician
testing and treatment of the bacteria that causes peptic ulcer
disease. In working with a major drug manufacturer and the FDA,
Synergy's timely monitoring of patient prescription usage
patterns led to the withdrawal of a previously approved drug.
These are only three examples of what are virtually limitless
uses of de-identified health information.
In the NPRM, the Department proposes to establish a ``safe
harbor'' for the creation of de-identified health information
by stipulating that ``[a] covered entity may use protected
health information to create de-identified information by
removing, coding, encrypting, or otherwise eliminating or
concealing'' nineteen potential identifiers. Thus, regardless
of a large or small population size, anyone removing all of
these nineteen identifiers to create de-identified information
could safely conclude that the information is not identifiable.
As we have posed in our comments to the NPRM, the problem is
that the anonymized data produced by this ``safe harbor''
method and the resulting aggregated database has little value
for research purposes.
For example, the list of nineteen identifiers includes
information such as ``city, county, zip code, and equivalent
geocodes.'' However, in order for de-identified data to be
useful as health research, researchers must have a means to
track information demographically. By excluding all means of
demographic analysis, i.e., city, county, zip code and
equivalent geocodes, the value of such health research would be
diminished greatly. In our written comment we recommend that to
maintain demographic value of the de-identified data, some
geographic locators should be excluded from the list of
nineteen identifiers. We are aware that there is a higher
probability of identifying an individual if a nine-digit zip
code is included as an identifier. By retaining city, county
and five-digit zip code in the de-identified data, however, the
probability of identifying an individual would be reasonably
low.
Similarly, HHS includes ``[b]irth date'' in the list of
identifiers that must be removed or concealed to qualify for
the de-identification safe harbor, but would allow age to be
retained. However, the actual date of birth is of critical
value for research purposes. For example, without date of birth
it would be impossible to perform research on neonatal and
pediatric populations. In these age groups differences in
health status are measured in weeks and months, not years.
Access to date of birth also avoids any of the ambiguities in
assigning patients to age cohorts that can mire research
efforts and produce erroneous results. For example, it may be
unclear when a patient labeled as ``35 years old'' was actually
that age--was it when they joined their health plan, saw their
physician, or submitted their medical claim. Accordingly,
retaining the date of birth or, at least, month and year of
birth would be critical to research and produce higher quality
results.
In the NPRM, HHS proposes an alternative method for the
creation of de-identified data, that is, ``entities with
appropriate statistical experience and expertise may treat
information as de-identified'' even if it contains one or more
of the nineteen ``identifiers.'' We appreciate that HHS has
provided concrete guidance regarding de-identification for
entities that need it, but allows a sophisticated entity, using
a standard of ``reasonableness,'' to make a determination
whether sufficient information has been removed so that ``the
result is still a low probability of identification.''
Nevertheless, even sophisticated users could decide to utilize
a reasonable ``safe harbor'' that established a presumption of
de-identification. Such a universal safe harbor would allow a
framework that would serve as a benchmark for all, promoting
uniformity in the health care industry and providing greater
comfort to individuals with respect to their privacy.
While I have focused on the potential impact of the
proposed rule on health care clearinghouses, and the creation
and use of de-identified data, I must comment briefly on the
preemption of state laws. The proposed rule would establish a
floor and preempt only those state laws that provide ``less
stringent'' privacy protection. However, allowing states to
create more stringent standards governing particular kinds of
information or certain entities will create a confusing and
ineffectual array of requirements. The proposed rule provides a
logical and reasonable federal standard for ``authorized''
uses, but without preemption of state laws there can be no
uniformity of protections or consistent guidance concerning the
handling of identifiable health information for health plans,
providers, researchers or, most importantly, patients.
On behalf of Synergy Health Care and Quintiles
Transnational, thank you for the opportunity to appear before
you today. I will be happy to answer any questions.
Chairman Thomas. Thank you very much for your testimony,
Doctor, and I do thank all of you for the far more extensive
written testimony. My assumption that your submission to HCFA
is also far more extensive.
Dr. Plested, your position is one which I think is fairly
recognizable in terms of physicians, the desire to protect that
relationship between the doctor and the patient. Does the AMA
or, if they do not have a position do you as a practicing
physician, have any concern about the fact that the access to
data, even if we were to restrict it to just the physician and
the patient, is a two-way street under this structure? That is,
patients have the right to look at data and, in certain
instances, ``correct'' the data?
Does that concern you all about whether or not the
integrity of the medical record could be compromised, by the
patient's ability to make changes?
Dr. Plested. There is no question that in certain instances
that is true, Mr. Chairman. I am sure Dr. McDermott can tell
you, from the point of view of a psychiatrist, that there are
times when it is not in the best interest of a patient that he
continually review the chart and the notes that are made about
him. We feel that it is important that the patient be a part of
the treatment and we have suggested repeatedly that excerpts or
that summaries should be prepared for all patients. Whether or
not every patient should look at everything that is written, we
are afraid, will lead to a practice of omitting sensitive
material from records that physicians keep.
Chairman Thomas. One of the reasons it is really hard to
get this done is that it goes to the heart of who we are and
how we operate. Whenever you deal with individual rights versus
public rights, in trying to get that proper balance, especially
in today's information rich world, it is very difficult. Look
at the Bill of Rights. It starts out Congress shall make no
law, and then away we go over the centuries, making laws. So it
is a very difficult thing.
Doctor, in trying to reconcile this individual versus the
public rights relationship, do you believe that it is
appropriate for us to collect the data, notwithstanding the
very strong statement you have made, to attempt to get at the
heart of the accidental deaths, upwards of 100,000, that the
Institute of Medicine's To Error is Human Report indicates?
That is, use this data for the public good, attempting to
collect it in a way to examine practice procedures which might
be collected in a systemic way to reduce medical errors?
Is that a public good that you place fairly highly or low?
Dr. Plested. Well, there is no question that the AMA is
strongly on record that this is an absolute public need and a
public good, and that is why we established the National
Patient Safety Foundation, who I am sure you are quite familiar
with. The question is how much sensitive, personally identified
data is necessary for this type of activity to be carried out?
I think that is debatable. There would be those who say that
they must have access to all.
Clearly that is not the case. We can do this type of a job
that must be done and we support being done without having free
access to everything in a patient's medical record.
Chairman Thomas. Of course, if the choice is all or
nothing, we would not be here and we would all be home already.
Ms. Fox, you heard the testimony of HCFA, that they felt
fairly comfortable about their $3.8 billion cost over five
years. You have indicated that it is somewhere near $40
billion.
It is very disconcerting when you get those kinds of
ranges. My assumption is that the lower the amount, I would put
to you, the stronger you or Ms. Grealy or others would feel
about the number being accurate. For example, if I said let us
just cut it in half, and you go from $40 billion to $20
billion, and let us take their number and double it from $3.8
billion to $7 billion, that is still a pretty wide range, in
terms of what the costs are going to be rippling through the
system.
I think that is your concern. Did you submit information
which might assist HCFA in looking at the final reg, getting a
better understanding of what your concerns were about where the
cost centers might be that they had not appropriately looked
at?
Ms. Fox. Yes, we did, Mr. Chairman. I think one aspect is
in their preamble to their proposed rule, they stated that
there were a number of the areas they just did not have data to
base the estimate. Three of the 10 areas they mentioned were
areas that we thought were particularly expensive that we did
very detailed estimates. We have met with them. We have
submitted all of our materials, the backup materials. We have
also met with the General Accounting Office, the Congressional
Budget Office, and others, because we thought it would be
really helpful for everybody to really take a look at some of
these assumptions.
I will just give you one example of where they did make an
estimate where our estimates are very different, just to give
you a sense of perspective. The regulation requires everybody
to train their employees about these new privacy rules. We
estimated, we assumed that employees would spend one to two
hours over the five year period learning about privacy rules.
We do not know what their hourly estimates were, but I can tell
you for health plan their preamble says an entire health plan
would spend $100 training their employees.
I can tell you, as an employee of Blue Cross Blue Shield
Association, on virtually any issue we get training on, we
spend an entire day and it is a mandatory training. I do not
know that we would do that on this, but $100 a health plan is
just way underestimating the cost of training your employees.
Chairman Thomas. Especially if you get caught in the web,
it could be $250,000. The $100 would not have been well spent.
What usually occurs in those instances is the dollar amount
goes up in relation to the potential downside. I agree with
you, $100 sounds a little short, especially with what $100 can
buy today.
Ms. Goldman, how many pages of information did you submit
to HCFA?
Ms. Goldman. We submitted nearly 120 pages of comments.
Chairman Thomas. And yet your testimony indicated you were
pretty supportive of the direction that they were going, yet
you found 120 pages worth of areas worthy of commenting on?
Ms. Goldman. Not to be accused of being verbose, we were
mindful of the request the Secretary made when she issued the
draft, that we should comment both on the things that we
thought should be strengthened, and on the provisions we
thought should be maintained.
In addition, we had a number of groups sign on to our
comments. And so each section of the regulation that we comment
on also has the sign on of the supportive groups. So not every
piece of paper is taken up with substantive comments, but there
are about 120 pages.
Chairman Thomas. Good, because I know that you were
instrumental in producing for the this Health Privacy Project,
the Best Principles for Health Privacy. I just have to tell you
that I was a little concerned, as this group pulled together,
that given the cross-section of individuals involved, which
again was a very representative sample, and the ability to--I
am sure there were differences--to resolve them and present
specific examples for principles. One has been very helpful to
me and I know, too, the gentleman from Maryland, in our looking
at what we are doing, so I was interested.
You made a comment and I want people to understand it,
because you said in the area of law enforcement it fell short.
What you meant by saying that it fell short was that there were
not enough individual protections, vis-a-vis the ability of
Government to get at data for what may or may not be worthwhile
reasons. That is what you meant by falling short?
Ms. Goldman. Exactly.
Chairman Thomas. Because if somebody heard it and said you
thought law enforcement fell short they might, if they did not
know you, think it was the other way.
Ms. Goldman. We hope, and we have not looked obviously at
all of the comments that have been submitted as of today, all
of the 40,000, but our hope, based on everything we have heard
in the last few years, after the Secretary issued her
recommendations, is that every single group, the consumer
groups, disability rights groups, the health plans, providers,
researchers, all think that law enforcement should be required
to present some kind of legal process that is issued by a
neutral magistrate and has a strong standard in it.
I realize internally, within the administration, there is a
debate over how that should be handled. We are hoping that they
come down on the right side and strengthen that section.
Chairman Thomas. But on a continuum, would you say that it
is fair that, in comparison to the Secretary's first attempt in
dealing with the records and law enforcement, that this most
recent attempt is an improvement? Have you seen movement,
significant movement, modest movement, not enough to really
count?
Ms. Goldman. Her initial recommendation said we should
maintain the status quo, which is essentially unfettered access
by law enforcement to people's medical records. So in a few
years they have moved from that to saying here are three
options that law enforcement can choose from that the covered
entities can acknowledge, three options.
Our concern is there is no guidance in the proposal as to
when law enforcement should choose which option. So if
information is highly sensitive and there is a serious risk of
abuse, they could get an investigative demand that issues
internally and that is just as sufficient as getting a warrant
or a subpoena.
So in some ways, it appears to be an improvement, but I
think that it is a little misleading.
Chairman Thomas. It may be the appearance, rather than
actual.
Ms. Goldman. Exactly.
Chairman Thomas. Dr. Ober, your background and your
business is an interesting one. Your description of it and the
terminology you use is more and more becoming commonplace,
about these companies that do not make widgets but provide very
significant services to the society. There was an old ditty
about big bugs have bigger bugs that jump on them and bite
them, and bigger bugs have bigger bugs and so on, ad infinitum.
This business of having entities that you articulated very
clearly, nevertheless creates this kind of rotational aspect.
Did you submit information to HCFA to assist in perhaps
breaking that--if it is not a catch-22, it certainly is a big
bugs have bigger bugs cycle?
Dr. Ober. Yes, we did our best.
Chairman Thomas. Given the way you deal with information,
are there ways to--
Dr. Ober. Sir, I think in what we submitted we tried to be
quite clear in the myriad of business partners that we have and
who Synergy is and what Synergy's mission is, as distinct from
the claims clearinghouse partners that we have that submit the
de-identified data directly to us.
Chairman Thomas. I am very interested in this business of
de-identified data, notwithstanding the identifier, since
especially in dealing with electronics you can flag and do a
number of things that allows you to deal with de-
identification, but if something comes up you can go back and
look up a critical or health care nature.
But most importantly, the absolute desperate need for
broad-based data for outcomes research and for medical errors
correction. We simply would not be able to make significant
progress in those two areas. One, cost saving is very
important. And the other, lifesaving is very important and we
appreciate the data that you have and I may want to tap into
it.
The gentleman from Washington?
Mr. McDermott. Thank you, Mr. Chairman.
I would say that, having done this for a few years, I
recognize the technique of burying people in paper and giving
inflated estimates and doing a lot of things to create
confusion, which stops things. I looked at that cost estimate
that you put out and I do not want to spend my five minutes
going through all of it, except to say that one of the things
that was assumed by your contractor, Ms. Fox, was that there
would be rules requiring new authorizations from current
subscribers to use their data for treatment, payment of claims,
or other health care plan options. And they estimated it for
you at about $2 billion.
Now the fact is that the proposal does not require
providers or health plans to obtain patient authorization to
use data for treatment, payment, or health care operations. So
they created a burden and put a $2 billion tag on it. That is
just one. There are a whole series.
I think that if we are going to make the decisions here on
the basis of what privacy is worth, then we ought to be real
careful about how we estimate what it is going to cost. Because
maybe we say to the American people we do not care about your
privacy because it is going to cost too much. If that is the
way we make the decision here, we will have a serious problem.
I do not think the Chairman or I, or anybody else, and I
think when you get these kind of estimates where clearly there
are other things in here that I can go through, you have to be
careful about using that because I think you create a problem
for yourself.
Dr. Ober, let me ask you a couple of questions, because I
have a diagram about how your company operates. I was trying to
figure out what kind of health information do you get and from
whom do you get it?
Dr. Ober. Currently, our stream of health care information
is electronic, de-identified and encrypted data from ENVOY
Corporation, which is as I mentioned earlier the country's
largest claims clearinghouse. It is, from Synergy's standpoint,
a single source, as a go-between between the providers of
health care and the payers of health care, ENVOY has set up,
over years and years, very standard formats in encryption
technology, such that Synergy is the daily recipient of those
data streams.
Mr. McDermott. It is not individually identified?
Dr. Ober. No, sir.
Mr. McDermott. It is all de-identified?
Dr. Ober. It is de-identified and encrypted; that is
correct. At Synergy's end we ``use'' the pharmacy data and the
medical data to do our work.
Mr. McDermott. But you use that data, it comes over the
Internet?
Dr. Ober. No, sir, it comes through a direct T-1 hookup
between Nashville and Boston, Massachusetts.
Mr. McDermott. You have one line that goes all the way?
Dr. Ober. Yes, sir.
Mr. McDermott. And nobody can break into that?
Dr. Ober. No, sir, it is a dedicated, dial-up line,
security.
Mr. McDermott. As we have watched recently, there have been
some privacy breaches in health-related websites. You are
saying, in public and on the record, that there is no way
anybody can break into your system?
Dr. Ober. I would not be that naive, to say that there is
no way someone could, sir. I think there is probably three or
four levels, when you think about what we mean by security in
the technology age today. And there is a major difference
between Internet technology, as we know it in common parlance,
and also the dial-up direct networks that we have set up with
ENVOY. So that the multiple levels of security that we have,
and certainly the fact that it is not Internet right now, and
that it is a direct dial-up, which offers one level of
security.
Secondly, if someone were to get into our ``network'' as
does happen every now and then, there are no less than three
levels of firewall and security checks, passwords and double
passwords and changing passwords, that one would need to crack
that.
But then we are also offered a third level, which I think
is quite valuable to the business we are in. And that is, if
somebody were, God forbid, to get into our claims level
database, it would almost be nonsensical because it is still
encrypted. Certainly, it is already de-identified. But on top
of that, most of the data we have in our warehouse, in our
database, is alpha-numeric codes that to a layperson would mean
nothing, such as an 11-digit for a particular pharmaceutical.
They would have to know that digit means a particular drug.
Not infallible but certainly, we think, offers quite a bit
of protection.
Mr. McDermott. When your company sells ENVOY to WebMD, as
they are in the process, what are they selling to WebMD?
Dr. Ober. The assets of the transaction business.
Mr. McDermott. What are you giving them?
Dr. Ober. It is a company of X numbers, hundreds of
employees, and the technology that goes into transacting the
process of those claims from providers to payers.
Mr. McDermott. But no access to any database?
Dr. Ober. No, sir.
Mr. McDermott. You are just selling the people; is that
what I understand?
Dr. Ober. Peoples, computers, hard assets.
Mr. McDermott. Why would WebMD buy that bunch of people and
not want the database that they have?
Dr. Ober. You would have to ask Mr. Arnold.
Mr. McDermott. How did they cut them off?
Dr. Ober. Well, we still are going to--
Mr. McDermott. Did they say we will leave this over here,
you can buy everything but the database?
Dr. Ober. We were very much arms-length from day one with
ENVOY because we have set up these very elaborate encryption
and de-identification processes.
Mr. McDermott. It does not look like there is much arms-
length when you see this, it says product development and
commercialization. You are down in the--
Dr. Ober. Informatics.
Mr. McDermott. Informatics. You gather the information and
pass it to the product development, who then commercialize it.
That is what your diagram, that is what your promo is?
Dr. Ober. Yes, and that is maybe confusing. I would have to
look at it. But what Synergy's core business is, again, it is
medical research and it is analyzing transaction data which we
receive encrypted and de-identified from ENVOY. It has always
been our business, even prior to joining Quintiles and that
organization.
Mr. McDermott. With your indulgence for just a second, then
what are you worried about? This is de-identified?
Dr. Ober. Correct.
Mr. McDermott. So what are you worried about?
Dr. Ober. Absolutely nothing.
Mr. McDermott. You came down here to Washington to
testify--
Dr. Ober. I was asked to testify, particularly I think
based on the value of de-identified health care information for
the public good, as we have met with Mr. Cardin and others
throughout the last several months. Quintiles is a very large
organization, and we have clinical research groups,
commercialization groups, and of course informatics.
We wanted to really rest assured that the ability for our
business partners to do the de-identifying and continue to pass
that very valuable stream to us, to do our business, would not
be impeded by the regs. And as near as we can tell, it really
is not.
Mr. McDermott. But what is the problem, when the regulation
simply requires the contract between you and the people who are
shipping this de-identified information to you, you are a big
company. Why would you bristle or object to signing a simple
contract and say we are not going to give away information that
we do not have anyway? What is the problem with that?
Dr. Ober. I went over the three or four points that we were
concerned about in my testimony, and which we have submitted.
We wanted to really rest assured that our ability to do the de-
identification, receive de-identified data, would not be
encumbered by the regs. And the early drafts were still
questionable.
I think the rule, as we have read it today, we appear to be
very comfortable with it.
Mr. McDermott. So you are setting up a false ghost here,
and you are now clobbering it; right? We do not want that
ghost? Because it is not in the regs now.
Dr. Ober. We are certainly glad to hear you say that and we
agree that most of what we were looking for is not in the regs,
so we are quite pleased by that. Setting up contracts with
individual business partners of which for example, wearing my
ENVOY affiliate hate right now, ENVOY has thousands of business
partners. And it becomes quite unclear whether or not those
business partners have to execute contracts with ENVOY, of
which there are thousands or tens of thousands, providers,
pharmacies, payers, et cetera, et cetera.
Mr. McDermott. When you get that data, you guarantee that
no one can unscramble your encryption and get out names or
anything else, or mailing lists for anything?
Dr. Ober. It is as secure as anything that is
technologically available, is what I can rest assured on.
Mr. McDermott. I really find it hard to understand why you
are here, what you are worried about. If you are not exposing
individuals in the society--
Dr. Ober. That is correct.
Mr. McDermott.--in any way, why should these regulations
bother you? It is very curious to me. Maybe somebody else knows
what he is worried about. I do not know. Ms. Goldman, do you
have an idea?
Ms. Goldman. I am heartened actually to hear that he
supports essentially the draft regulation, which I think is
important. Because if the description is accurate, that what
ENVOY is transmitting is de-identified, it is then not covered
by the regulation at all. The transmission of that information
is then not covered because it is de-identified.
Mr. McDermott. Thank you for your indulgence for an extra
20 seconds.
Chairman Thomas. One of the values of this testimony, I
think, beyond doubt, especially your somewhat incredulous
belief that there was some value in whatever it was that these
folks did from a business point of view--I was curious whether
they were publicly held and how much they were selling this
stuff for--is just an indication of how much is going on out
there that even knowledgeable people may not be familiar with,
but if you say something that sounds innocuous, business
entities must and therefore in extension with other business
partners create relationships in which you may have had no
intention whatsoever of disrupting, but in fact you may very
well.
His initial statement, the description of what they do, the
fact that someone believes there is value in it, and that they
would have to then comply with everybody else who may or may
not be identified as business partners, I think he has every
right to be concerned about how HCFA in the reg does identify
business partners, notwithstanding the content being de-
identified. I doubt if, in fact, it was going to get into de-
identifying public partners in terms of the data they have
versus identified public partners in the data that they have,
versus those that are merely transmitters of that data from
someone else.
It is that kind of complexity that is out there today
producing value that people are willing to spend literally
millions of dollars for that may, in fact, be significantly
disrupted. That is the concern we have. I appreciate the
gentleman taking valuable time out of doing whatever it is you
do that people think is really valuable, for however much it is
worth, to sensitize us to the concerns that you have.
The gentleman from Maryland?
Mr. Cardin. Thank you, Mr. Chairman.
Of course, if we had given HHS proper authority or
delegation or if we had passed a bill, we would not have this
problem. I think the only reason we have this convoluted
process is because of the desire of HHS to have an enforceable
privacy act and under the HIPAA statute they do not have the
ability to do it. That is why we need to enact a bill.
Chairman Thomas. I obviously totally agree with the
gentleman but I do hope that people understand that, by that
inference, I do not think that you mean that the HIPAA
legislation was designed to be perverse or to create a
structure which would, in anticipation, create the problems?
Mr. Cardin. No, I think we anticipated that Congress was
going to pass a privacy act, and we have not done that.
Chairman Thomas. Exactly.
Mr. Cardin. All these are trade-offs. It is interesting,
you talk about the trade-offs for privacy for the patient
versus the need for information to be available for good
purposes, whether it be law enforcement, whether it be
research, or whether it be treatment. And there is trade-offs
on cost. Every time we put additional requirements in to
protect privacy, there is going to be some sacrifice of
efficiency. So it is going to be all trade-offs.
I want to just concentrate on one, which we affectionately
call the statutory authority, or when the identifiable
information can be made available without the specific
authorization of the patient. If I understand Ms. Goldman's
point, you are concerned that in the regulation the use of that
information should be signed off by the patient. That is the
patient gives specific authorization, but must know that
information can be made available by signing off on a form
indicating an acknowledgement of that. Is that correct?
Ms. Goldman. Exactly. It essentially makes the notice
requirement that is currently in the proposal more meaningful.
Right now, the way the health care system operates is that
people do not get care or enroll in a health plan unless they
sign an authorization form. People sign at the point of care
and the point of enrollment right now. The Secretary is
proposing not only eliminating that practice but prohibiting
that practice for the sharing and collection of information.
It is not necessarily a meaningful requirement right now in
current practice, in other words you do not have a real choice
about withholding your authorization. But it does, I think,
alert the public to how their information is being used and who
might get access to it.
Mr. Cardin. I certainly agree that notice should be given
to patients. Patients should absolutely know that. My concern
is what happens if the patient does not sign off on the
acknowledgement?
Ms. Goldman. My understanding of the way the current system
operates is that you can withhold treatment and deny benefits
if people do not authorize the use and disclosure of
information for treatment and payment. And right now, they are
authorized to release the information for a broad category--
Mr. Cardin. There is broader reasons than just treatment
and payment. I guess my question is if the patient does not
sign off on the acknowledgement, or if the user does not have a
copy of that in the file, what does that mean?
I think we have to think that ought. Clearly, I agree with
you, notice is absolutely essential, that the person
understands what the information can be used for. I just do not
know whether signing off is the right way to do it, and whether
that does not just create more problems for Ms. Fox and Ms.
Grealy on administrative costs.
Dr. Plested, I want to just follow up, so I understand the
AMA's position, because you have a narrower interpretation of
what should be allowed. You want to have more specific
authorization from the patient. I take it not in regards to
treatment? Or is it in regard to treatment, also?
If you get a request from a physician who you have referred
a patient to, can you make that medical information available
without a specific authorization, under your position?
Dr. Plested. Clearly, if we have had a referral from
another physician and the patient comes to see us, I think
there is an implied consent that we share the information about
that patient.
Mr. Cardin. So you would not need specific authorization
for that?
Dr. Plested. No.
Mr. Cardin. How about paying a bill? Would you require
specific authorization for that?
Dr. Plested. This gets a lot tougher. Because what
information is needed to pay a bill? Today, if I submit a bill
for a consultation, I have to submit the full consultation to
the insurer. Why does the insurer need to know your mother's
family history or what your sexual preference is, or anything
else, because I saw you because you have a sore foot?
Mr. Cardin. That is fair enough, I agree with you. It
should be related to the need for payment.
Dr. Plested. That is right. But now the insurer has a form
signed that he gets everything, and I cannot get paid without
it.
Mr. Cardin. That is specific authorization in most cases
today. The problem we have, and I think Ms. Goldman mentioned
it, routinely when a person signs up for a health care plan
they sign a lot of forms. In many cases, they do not even know
what they are signing. And they are giving blanket authority
right now to release everything.
At one point we are going to have to talk about the use of
specific authorization. But I think what HHS is trying to
achieve, and I know what Mr. Thomas is attempting to do, is to
have reasonable statutory authority specifically as to what
information is really needed so that we get away from these
blanket authorities, so that we get away from people not
knowing that they have released so much information that is
unnecessary, because your point is well taken. The doctor
should not have to submit the whole family history for payment.
And if we have proper statutory authority, I would submit,
that would not be happening. But because of the absence of
statutory authority in this area, we find that there is more
information being made available through specific authorization
than is needed.
Dr. Plested. And if I could continue that, that goes
directly to the Chairman's question about whether we have a
floor or a preemptive rule, and it depends on where the bar is.
If the bar is high like you suggest to protect patient's
privacy for only that information that is absolutely necessary,
the AMA says yes, we will look at a Federal preemption.
But now the Secretary's bar is so low, protecting the
patient and giving any entity outside all the information that
they want, that is why we feel that stronger state laws are
important.
Mr. Cardin. Thank you, Mr. Chairman.
Chairman Thomas. Thank the gentleman. I want to thank all
of the witnesses and the members. Another question? Go ahead.
Mr. McDermott. I appreciate your letting me ask one more
question.
Chairman Thomas. I reserve the right to thank all members.
Mr. McDermott. I want to go back to Dr. Ober. The Quintiles
1998 report states that by combining services and connections
and information ``Quintiles is creating on the Internet a
unique software bridge of information between pharmaceutical
products, patients, physicians, payers and regulators.''
Now, they do clinical trials?
Dr. Ober. Correct.
Mr. McDermott. So they have somebody's name then; correct?
Dr. Ober. I am sorry, sir?
Mr. McDermott. They have somebody's name then, when they
are doing a clinical trial?
Dr. Ober. For clinical trial purposes they certainly, they
would have the names at the physicians' clinical site, but
everybody is blinded, to the best of my knowledge, to
information that is centralized. The clinical trial results in
many, many sites worldwide. Where an individual would collect,
through case report forms, a variety of critical information
about the study at hand.
Mr. McDermott. So Quintiles never receives anybody's name,
ever?
Dr. Ober. No, I cannot make that statement, sir. Actually,
our informatics group does not work with the clinical trials
group at all.
Mr. McDermott. But you are all connected in this business
relationship in your picture here; right?
Dr. Ober. Not Synergy, sir. Not ENVOY. The clinical trials
capability, if you will, which is emerging for administrative
efficiency to take place over the Internet and other
interactive connectivities, is not part of the core business of
the informatics group at all.
Mr. McDermott. But you are all business partners, by the
definition of this rule and regulation; correct?
Dr. Ober. Okay, well, business partners with respect to the
fact if we were using that information, which we are not. We
have nothing to do with the clinical trial site of Quintiles.
It is a separate entity.
I know the diagrams can be misleading, but there is no
relationship at all between the clinical trials group and the
information they collect is completely different information
for very specific clinical purposes, which I believe is outside
the reg, as opposed to what we are doing with de-identified
information at Synergy and the informatics group. Completely
different datasets.
Mr. McDermott. We have the wrong guy here. We should have
the guy from Quintiles, as to whether he lets the information
go over to the commercialization under Inovex, right?
Dr. Ober. I can assure you that there is no connection
between patient names going from clinical trails to Inovex.
That I can assure you of, sir.
Mr. McDermott. Thank you, Mr. Chairman.
Chairman Thomas. As they usually say, this prospectus is
for information only and it should not be considered to be
legal. They have a whole lot of papers on file, and you are
working off of one little picture here.
It is very complicated and if they have any clinical trials
worth their salt, they are usually double-blind at the time of
the clinical trials.
Dr. Ober. That is exactly correct.
Chairman Thomas. Let alone with the transmittal of
information.
I thank the gentleman very much.
I also thank all of you and, as I intended to say
initially, this is a very difficult area. I appreciate
everybody keeping the politics down to a minimum and, in fact,
very visible because the policy is tough enough standing on its
own.
Thank you very much and I look forward to working with you
as we move forward. The subcommittee stands adjourned.
[Whereupon, at 12:43 p.m., the hearing was adjourned.]
[Submissions for the record follow:]
Statement of the American Academy of Pediatrics
The American Academy of Pediatrics was pleased to comment
on the November 3, 1999 Notice of Proposed Rules on Standards
for Privacy of Individually Identifiable Health Information.
The Academy and its 55,000 members support the goal of
protecting the privacy of identifiable health information.
These proposed regulations are an important first step.
However, because the Health Insurance Portability and
Accountability Act of 1996 gives the Department of Health and
Human Services only limited authority in this area, federal
legislation protecting the privacy of all identifiable health
information used by all entities is still necessary.
Our comments address many provisions of the proposed
regulations. In particular, we would like to highlight the
following:
1) Adolescents have a unique need for privacy concerning
the many sensitive issues they often face. In many cases
adolescents will obtain health care only if they are guaranteed
that their parents will not learn about it. The privacy
regulations must protect adolescents' rights. Generally, the
regulations create a ``floor,'' preempting less stringent state
laws on privacy of health information. However, the regulations
have a ``hole in the floor'' since minors are not guaranteed
that the federal regulations will preempt less stringent state
laws concerning their confidentiality rights. The regulations
should provide minors with a uniform privacy standard, must
preserve health care providers' ability to treat adolescents
confidentially and must ensure that minors and their parents
are informed of their privacy rights.
2) Health care providers should not be held accountable if
protected health information is used for prohibited purposes by
the entities to which they disclose the information. Once the
information has been transmitted responsibly to a legitimate
entity for a specified purpose, its privacy should be the
responsibility of the receiving party.
3) Privacy standards should apply to all identifiable
health information, regardless of whether it has ever been
electronically transmitted or maintained.
4) The scalable nature of the regulations is very important
in preventing an undue burden for physicians and ensuring
effective provision of health care.
5) The provisions regarding research require substantial
revision and clarification to better direct Institutional
Review Boards and privacy boards and so that responsible
research into important health concerns is not hampered.
The full text of the AAP comments will be available shortly
at ``http://www.aap.org''
The AAP comments are also endorsed by the Association of
Medical School Pediatric Department Chairs, the American
Pediatric Society, and the Society for Pediatric Research
American College of Phsicians-
American Society of Internal Medicine
Washington, DC 20006-1834
February 17, 2000
Margaret Ann Hamburg, M.D.
Assistant Secretary for Planning and Evaluation
U.S. Department of Health and Human Services
Attention: Privacy-P
Room G-322A, Hubert H. Humphrey Building
200 Independence Avenue, SW
Washington, D.C. 20201
Re: Comments on the Proposed Standards for Privacy of Individually
Identifiable Health Information, 45 CFR Parts 160-164, 64 Fed. Reg.
59917 (November 3, 1999)
Dear Dr. Hamburg:
The American College of Physicians-American Society of Internal
Medicine (ACP-ASIM), representing 116,000 physicians who specialize in
internal medicine and medical students, is pleased to submit comments
in response to the Notice of Proposed Rulemaking (NPRM) issued by the
Department of Health and Human Services (HHS) and published in the
Federal Register dated November 3, 1999. ACP-ASIM is in a unique
position to evaluate patient privacy legislation: our members represent
the gamut of internal medicine, including both general internists and
subspecialists engaged in the practice of internal medicine as
individual practitioners, members of group practices, government
employees, professors of medicine, and medical researchers.
Summary of Comments
We support the flexibility that would reject a ``one size
fits all'' approach in implementing the privacy provisions, and the
``minimum necessary'' standard;
We support the way the rule deals with disclosure of
protected health information for research purposes, protecting patient
privacy without imposing undue burdens that would impede research;
We support providing patients with the right to inspect,
copy and amend their patient records, and requiring notice to patients
of their privacy rights and of how their medical information might be
used or disclosed;
We support the provisions regarding public health
activities, health oversight, and judicial and administrative
proceedings;
In general, we oppose allowing the use and disclosure of
confidential medical records without individual authorization for
treatment, payment and health care operations (as defined in the NPRM);
We are very concerned that the provisions on business
partners would be very difficult to enforce, create open-ended and
unpredictable liability for physicians and are unduly burdensome;
We believe the provisions concerning law enforcement are
too broad and would violate privacy rights;
The costs of implementing the proposed rule have been
vastly underestimated and would have a disproportionate impact on small
business; and
Physicians, especially those in small practices, will be
subject to disproportionate administrative burdens as a result of the
proposed rule, and should be exempted from the most onerous provisions
of the rule. Physicians, unlike some of the other covered entities, are
already bound by ethical obligations to uphold confidentiality and
privacy rights of patients.
General Comments
Confidentiality is increasingly difficult to maintain in this era
of computerized record keeping and electronic data processing, faxing
of patient information, third-party payment for medical services and
sharing of patient care among numerous medical professionals and
institutions. ACP-ASIM commends HHS for tackling this difficult and
complex issue and for attempting to ensure protection of patient
confidentiality without impeding or preventing access to data that is
essential to the efficient delivery of quality patient care and for
medical, public health and health services research. Given the
limitations on HHS's authority, the approach of trying to protect the
information itself is understandable. We are concerned, however, that
the proposal generally sweeps all covered entities together under the
same complex regulatory framework. Individual physicians, governed by
ethical codes of conduct and state professional disciplinary codes, are
being lumped together with large institutional providers, health plans,
and clearinghouses. Are there data to suggest that individual health
care professionals are routinely and intentionally breaching
confidentiality, or that patients fear that they are? Anecdotally,
patients express concerns about health plans, organizations and
institutions breaching confidentiality, not their individual
physicians. Physicians are obligated to protect patient
confidentiality, especially in light of the increased risk for invasion
of patients' privacy from the computerization and electronic
transmission of medical records. We are concerned that the rule,
proposed as ``a basic set of legal controls,'' might be viewed instead
as all that is required of physicians, and could undermine the
traditional ethical and professional obligations to uphold
confidentiality. Moreover, the proposed rule does not cover entities
that are more likely to wrongfully disclose and misuse confidential
information.
The ACP-ASIM recognizes the need for appropriate safeguards to
protect patient privacy, because trust and respect are the cornerstones
of the patient-physician relationship and quality health care. Presence
of trust, respect, and privacy create an atmosphere in which full
disclosure of information from patient to physician can occur,
enhancing treatment. Patients have a basic right to privacy that
includes the information contained in their medical records. Medical
personnel who collect health information have a responsibility to
protect patients from invasion of their privacy. Patients need to be
treated in an environment in which they feel comfortable disclosing
sensitive personal information to a physician that they trust.
Otherwise, they may fail to fully disclose conditions and symptoms,
thereby reducing the effectiveness of treatment and perhaps seriously
imperiling their health, or, they may avoid seeking care altogether for
fear of the negative consequences that could result from a disclosure.
Physicians have a responsibility to respect patient privacy first,
except when doing so may result in serious harm to the patient or
others, or when required by law. See ACP-ASIM Ethics Manual (Fourth
Edition), Annals of Internal Medicine 1998, 128: 576-594). We are
concerned that the NPRM goes too far in the direction of disclosure of
protected health information without individual authorization; our
concerns in this regard are set forth in more detail under the section
dealing with ``Treatment, Payment and Health Care Operations.''
The NPRM is an important step in ensuring federal protection for
the privacy of medical records and represents significant progress
toward finding the right balance between the privacy rights of patients
and the free flow of information that is necessary for the provision of
effective and efficient health care services. The limited scope of
HHS's authority pursuant to the Health Insurance Portability and
Accountability Act (HIPAA) of 1996, however, illustrates that
comprehensive federal privacy legislation is needed. Because of the
limitations imposed on HHS, too many burdens for compliance are placed
on physicians. While we are not suggesting that the medical privacy
rule should not be applied to physicians, we do think that there should
be a reexamination of the need for some of the provisions, as they
would be applied to small physician offices. To the extent that small
physician practices are not exempted from the provisions, HHS should
apply them in the least burdensome fashion.
Introduction to General Rules
ACP-ASIM supports the ``scalability'' approach taken in the NPRM,
under which a ``one size fits all'' standard would be rejected for the
implementation of the privacy provisions. It is critical that each
affected entity be able to assess its own needs and devise, implement
and maintain appropriate privacy policies, procedures and documentation
to address its business requirements. Our members range from physicians
working in solo practitioners' offices to multi-group practices to
academic health centers, all of which have different needs and business
practices.
ACP-ASIM also supports the stated general approach of the rule
whereby protected health information (PHI) could not be used or
disclosed by covered entities except as authorized by the individual
who is the subject of such information or as explicitly provided in
this rule. We disagree, however, with the actual approach taken by HHS
whereby most uses and disclosures of an individual's PHI would not
require explicit individual authorization (see discussion below).
Since Congress has not yet passed comprehensive confidentiality
legislation, ACP-ASIM believes that special safeguards are needed to
cover certain highly sensitive parts of a patient's medical record,
such as HIV status, mental health disorders, drug and alcohol-related
problems, sexually transmitted diseases, sickle-cell anemia, sexual
orientation, and other highly sensitive health information.
Treatment, Payment and Health Care Operations
Subject to limited exceptions for psychotherapy notes and research
information unrelated to treatment, a covered entity would be permitted
to use or disclose protected health information (PHI) without
individual authorization for treatment, payment or health care
operations. The proposal would actually prohibit covered entities from
seeking individual authorization, unless required by State or other
applicable law. While ACP-ASIM recognizes that this proposal is
intended to make the exchange of PHI relatively easy for health care
purposes and more difficult for other purposes, we are very concerned
that this approach would allow the use and disclosure of confidential
medical records without the consent of the patient in extraordinarily
broad circumstances. The proposed rule allow records to be shared
without limit throughout the health care system; the confidentiality of
medical records can be set aside for almost any reason at all. This
approach undermines the bedrock principle critical to the physician-
patient relationship of informed consent, and will undercut traditional
codes of medical ethics.
Confidentiality between the doctor or other health care
professional and the patient is an essential component of high quality
health care. Physicians must obtain informed voluntary consent from the
patient before their medical information is disclosed for any purpose,
except for appropriately structured medical research (see below) or as
required by law. (ACP-ASIM Code of Ethics; ``Confidentiality of
Electronic Medical Records,'' Public Policy Paper 2000). At some point
in the treatment relationship between the patient and the physician,
preferably at the first encounter, there should be some type of signed
written authorization that is a legal, informed consent to the release
of PHI for treatment and payment purposes. ACP-ASIM supports the
approach taken in S. 578 (Jeffords-Dodd), e.g., some form of
consolidated authorization by which health care providers and
organizations can perform their various functions without having to
stop and obtain authorization at every point in a patient's treatment.
Consent is particularly important since the proposal generally would
not restrict to whom disclosures could be made for treatment, payment
or operations. When disclosures are made to non-covered entities (other
than business partners), the protections afforded by this rule would
not be applicable. While this limitation points to the need for passage
of more comprehensive privacy legislation, until such legislation is
passed, individual's health information must be protected more strongly
than provided under the NPRM.
Likewise, allowing disclosure of PHI without authorization for
health care operations is problematic, given the broad definition of
``health care operations.'' As indicated above, ACP-ASIM supports
requiring authorization before PHI can be used or disclosed for most
health care operations. At the very least, the definition of what is
considered to be health care operations should be narrowed to include
only those activities that truly are related to treatment or payment.
Minimum Necessary
ACP-ASIM agrees with HHS that a covered entity must make all
reasonable efforts not to use or disclose more than the minimum amount
of PHI necessary to accomplish the intended purpose of the use or
disclosure. Access should be limited to only those individuals who need
access to the information to accomplish the use or disclosure. De-
identified patient data should always be used in medical research and
quality improvement processes, unless the nature of the research
necessitates identification because coded data would be impracticable.
We support the use of firewalls to limit the possibility for
improper data uses within an entity, but note that the proposed
scalability standard is particularly desirable in creating barriers to
access and review of PHI. Physicians maintain records in a variety of
settings, from large academic institutions to private offices with two
staff members who perform all administrative functions. Current
conditions in medical offices typically place physical barriers between
medical records and non-staff, as well as limiting business partners'
access to records.
Practice management software and electronic medical record software
packages are widely used by health care providers. Privately owned
physician offices have limited access to technology with the capacity
to create firewalls within their offices. Although software packages
are available with a wide range of customizable features, they
typically do not limit access on a field-by-field basis. Many programs
limit access on a screen-by-screen basis or a function basis (such as
appointment scheduling, billing, viewing laboratory results), but these
are not completely customizable. Purchase of custom programming or
replacement of current computer systems would represent an undue burden
on providers who currently have as little as $300 or as much as $50,000
invested in computer software. Encryption technology is not currently
available to most small businesses.
Proposed Sec. 164.506(b) generally would place the responsibility
for determining what is the ``minimum necessary'' disclosure on the
covered entity making the disclosure. Covered entities would be
required to make ``reasonable efforts'' and to incur ``reasonable
expense'' to limit the use and disclosure of PHI. This standard, while
flexible, when combined with the scalability approach leaves a health
care provider's staff with a large amount of discretion and complete
liability. It is not clear what ``reasonable'' means in this context;
there is much gray area between what is ``necessary'' information for
medical reasons and what is too much disclosure. In addition, a covered
entity would be required to review each request for disclosure
individually on its own merits, rather than institute a policy to
approve certain types of requests. This provision will require that an
individual with authority and knowledge to make ``minimum necessary''
determinations must review each record request. In small practices,
page-by-page review of multiple record requests on a daily basis could
pose excessive administrative time requirements. In many cases, it will
be cumbersome to determine the exact need for every piece of
information and exact measurement of information that may be required
to meet that need.
We would encourage HHS to reconsider the excessive requirements
placed upon clinical staff by transferring the burden of responding to
medical record requests from clinical staff to administrative
personnel. Each hour of record review is deducted from the limited time
that physicians and nurses are able to perform their primary functions,
caring for patients. Covered entities, particularly small businesses,
should be allowed to create an internal policy to allow clerical staff
to respond to many routine types of releases, including 1) disclosures
allowed under any section of this proposed rule without patient
authorization, and 2) any request accompanied by a written
authorization signed by the patient. Moreover, the burden should be on
the requestor of the information to make the ``minimum necessary
demand.''
Right to Restrict
ACP-ASIM generally supports the right of an individual to request
that a covered entity restrict further uses and disclosures of PHI for
treatment, payment or health care operations. However, administering a
system in which some information is protected and other information is
not poses significant challenges. In reality, this right will be
severely hampered by health care providers' contractual obligations to
insurers. Managed care organizations normally require that
participating physicians not enter into private contracts for treatment
and payment outside the physician's contract with the MCO. Thus, in its
practical application, this right may be restricted to self-pay
patients.
In cases not involving reimbursement, such as release to other
physicians, providers may make good faith efforts to avoid those
disclosures, but implementing security systems and tracking those
limitations will be extremely difficult due to systems limitations.
Electronic systems do not provide the capacity to exclude transmissions
to particular providers. Physician office groups may request paper
records and administrative staff may be unaware of the affiliation of a
particular provider within that group. Tracking a myriad of
restrictions may be impractical and could result in denial of all
requests to avoid disclosure liabilities. We would support providing
examples in the final rule of appropriate, scalable systems that would
be in compliance with this proposed provision.
The Preamble notes that the proposed rule would not require a
covered entity to agree to a request to restrict, or to treat or
provide coverage to an individual requesting a restriction. HHS
correctly recognizes that the medical history and records of a patient,
particularly information about current medications and other therapies,
are often very much relevant when new treatment is sought. Physicians
have an ethical and in many cases legal obligation to treat a patient
until that patient has been formally transferred to the care of another
provider and/or discharged. Provisions should be made to accommodate
provider treatment and disclosure after the covered entity has refused
a non-disclosure request.
Creation of De-identified Information
ACP-ASIM supports the approach proposed in Sec. 164.506(d) for de-
identifying identifiable information and the use of restrictions
designed to ensure that de-identified information is not used
inappropriately. We believe that health information should be encrypted
before being transmitted electronically for research purposes. For the
majority of physicians in private practice, however, development and
implementation of procedures for stripping identifiers will be
cumbersome. A typical physician's office has neither the technical
ability to create de-identified data nor the staff to manually de-
identify data. We support a ``reasonableness'' standard whereby
entities with sufficient statistical experience and expertise could
remove or code a different combination of information.
Business Partners
We have major concerns with and strongly object to the business
partner provisions. While we recognize the limitations imposed on the
authority of HHS to directly regulate entities other than health plans,
health care providers and clearinghouses, we are concerned that under
the business partner provisions, physicians would become regulators for
HHS. These provisions would not only be unduly burdensome to
physicians, but also would be exceedingly difficult to enforce.
Physicians would be exposed to open-ended, unpredictable liability.
Each of these concerns is discussed in further detail below.
Under the proposal, for purposes other than consultation or
referral for treatment, covered entities would be able to disclose PHI
to business partners only pursuant to a written contract that would
limit the business partner's uses and disclosures of PHI. The contract
between the covered entity and the business partner would be required
to include certain provisions that are specified in the proposal. Each
specified contract term would be considered a separate implementation
specification under the proposal, and a covered entity would be
responsible for assuring that the business partner meets each such
implementation standard. These complex contract terms and new
obligations will necessitate the investment of much more time and
resources by medical and legal personnel. Business partners may incur
substantial expenses in meeting privacy requirements, which could
result in more expensive contracts for health care providers.
Non-compliance by a business partner or its sub-contractor of the
terms of the contract could expose the physician to significant civil
or criminal sanctions. Physicians would be in violation of the rule if
they knew or ``reasonably'' should have known of a material breach of
the contract by a business partner and failed to take reasonable steps
to cure the breach or terminate the contact. Physicians would also be
responsible for mitigating the harm caused by such violations. It will
be very difficult, if not impossible, for most physicians to enforce
the required contracts. No analysis has been done of the number of
single-source business partners used by health care providers. A
Medicare carrier acting as a fiscal intermediary, for example, would
qualify as a business partner. However, HHS awards single-source
contracts, leaving the physician with no viable alternative if required
to terminate a contract. These provisions, by making physicians liable
for disclosures by others not under their control, raise serious
questions of fairness, and should not be included in the final rule.
Business partners will be impacted by the need to maintain business
records for legal and/or financial auditing purposes. This may make the
destruction or return of all PHI unlikely or impossible in certain
circumstances. For example, billing services are subject to HHS audit.
If business partners cannot maintain PHI, they cannot provide
documentation of coding or submissions material, nor protect themselves
from claims made against them related to bookkeeping errors. Computer
back-ups that are maintained by many business partners might include
PHI. Business partners cannot be expected to destroy all forms of
electronic back-up just because they have completed work for one
particular client. Outside entities that provide financial services and
have access to information included on standard explanation of benefits
forms will also be required to identify and destroy substantial numbers
of documents. Such entities could include banking entities providing
lockbox services, billing services, third-party medical collection
agencies, third-party coding experts, consulting and auditing services
and third-party claims processors, such as Medicare carriers.
Finally, and perhaps of most concern, a requirement included in the
proposed contractual agreement would create a private right of action.
Individuals whose PHI is disclosed by a business partner in violation
of the rule would be considered to be third-party beneficiaries. As a
third-party beneficiary, a patient would have a right under contract
law to enforce the terms of the agreement by seeking damages against
the breaching business partner and against the covered entity for
failure to select and monitor properly the business partner. Covered
entities would most likely have to purchase a rider under their
insurance policies in order to be covered against such claims.
Uses and Disclosures with Individual Authorization
The regulation would require that covered entities have
authorization from individuals before using or disclosing their PHI for
any purpose not otherwise recognized by this regulation. ACP-ASIM
supports the requirement that individuals must give specific
authorization before a covered entity could use or disclose PHI for
purposes unrelated to health care treatment or payment. (As discussed
earlier, ACP-ASIM opposes disclosure of PHI without patient
authorization except in limited circumstances).
We support the provisions in this section. Physicians must release
information to the patient or a third party at the request of the
patient. (ACP-ASIM Ethics Manual) Patient-initiated authorizations
should be specific enough in terms of the information to be disclosed
and to whom the information is to be disclosed to enable the physician
to comply with the individual's request. Specific authorization is much
better than the current practice of using broad disclosure forms. ACP-
ASIM supports requiring an expiration date as well as allowing
authorization to be revoked by a patient unless action has been taken
in reliance on the authorization. With respect to authorizations
initiated by covered entities, we support the requirement that the
authorization form should identify the purposes for which the
information is sought as well as the proposed uses and disclosures of
that information. Patients need to be able to make informed decisions.
Finally, we support the provision stating that treatment and payment
should not be conditioned on a patient's authorization.
Public Health Activities
ACP-ASIM supports the provisions that would permit covered entities
to disclose PHI without individual authorization to public health
authorities carrying out public health activities authorized by law, to
non-governmental entities authorized by law to carry out public health
activities, and to persons who may be at risk of contacting or
spreading a disease. Confidentiality may be overridden to protect the
public health or individuals such as sexual partners at risk, or when
the law requires it (e.g., mandatory public health reporting). However,
before breaching confidentiality, physicians should make every effort
to discuss the issue with the patient. (ACP-ASIM Ethics Manual).
Health Oversight
ACP-ASIM supports allowing disclosure or use of PHI without
individual authorization for health oversight activities. However,
individual identifiers should be coded or encrypted whenever
practicable.
Judicial and Administrative Proceedings
ACP-ASIM supports permitting covered entities to disclose PHI in a
judicial or administrative proceeding if the request for such PHI is
made through or pursuant to an order by a court or administrative
tribunal. A court order would not be required if the PHI being
requested relates to a party to the proceeding whose health condition
is at issue, and where the disclosure is made pursuant to a discovery
order or is otherwise authorized by law. In the latter instance,
however, we are concerned that the burden and possible liability is on
physicians to determine whether the request relates to the PHI of a
litigant whose health is at issue. Physicians and their staff are not
best suited for making such determinations.
Law enforcement
The proposed rule would permit covered entities to disclose PHI
without individual authorization to a law enforcement official
conducting a law enforcement inquiry authorized by law if the request
for PHI is made pursuant to a judicial or administrative process. We
think that these provisions are too broad. Access by law enforcement
officials to individual health records constitutes an inherent privacy
violation. Health information is collected to provide quality care to
patients and to help society through use of data in public health
research. This information is not intended for law enforcement because
of the potential for abuse. Access by law enforcement agents should be
restricted to searches that are not open-ended and for which there is a
just cause. Release of confidential medical records to law enforcement
officials should be permitted only when sustained by either subpoena or
court order, except in limited emergency circumstances. Broad-based
access is not an acceptable option. Law enforcement should be required
to go through an independent review or neutral magistrate.
Administrative subpoenas may be issued based on an individual law
enforcement request, sometimes without any higher review. HHS should
require that law enforcement officials obtain a judicial order
Research
It is critical that the provisions dealing with research recognize
the precarious balance between protecting patient privacy and expanding
on our knowledge of health and disease. Rules need to be structured so
that they will not unduly burden health researchers in their quest to
further public health and other vital medical research.
We generally support the way the proposed rule deals with research
and the privacy of patient information. The proposal would permit
covered entities to use and disclose PHI for research without
individual authorization, provided that the covered entity receives
documentation that the research protocol has been reviewed by an
institutional review board (IRB) or equivalent body, and that the board
found that the research protocol meets specified criteria designed to
protect the subject. Absent such documentation, the subject's PHI could
be disclosed for research only with the individual's authorization.
IRBs review research requests to ensure adherence to standards of
patient protection and treatment in medical research. The boards are
established to ensure that patients have been fully informed and that
they have consented to their participation in clinical research. Any
research using patient information--whether the information is
identified or not, whether consent is obtained or waived--should be
approved by an IRB. IRBs are an efficient and effective way to protect
the rights and privacy of patients who consent to sharing their health
information for the benefit of medical research. The conduct of
research and the protection of patient confidentiality also must be in
compliance with professional ethical guidelines and codes of conduct.
De-identified data should be used in medical research whenever
possible, unless the nature of the research necessitates identification
because coded data would be impracticable. All medical research studies
that use potentially individually identifiable information must contain
measures to protect the confidentiality of individual patient records
and should be examined and approved in advance by an IRB or similar
ethics review board.IRB functions include carefully reviewing the type
of patient consent needed within the context of each study. Additional
protection for subjects should be required if the information is
identified and the waiver of consent in these instances should be
limited.
The use of data sets for secondary research studies should be
allowed for statistical analyses and public health, but the records
should remain encoded whenever possible. Patients, however, should be
notified when information is to be used for purposes other than
originally agreed on, and they should have the option to deny consent.
These other purposes include billing, organizational research and
quality improvement programs. Unfortunately, there is no clear line to
differentiate between a routine use and a research use. Often, primary
and secondary data uses overlap, and their definitions are dependent on
the context within the individual studies. Uses of ``de-linked''
information require review by an IRB or other similar panel. While we
recognize the limited authority of HHS over researchers who are not
covered entities, the ACP-ASIM believes that the burden for information
requests should be borne by those requesting access to the information;
we realize the need for stringent review in determining who has access
to de-identified information.
Notice of Information Practices
We generally support the provisions in this section that would
require health plans and providers to give notice of their
confidentiality practices and procedures to patients. Such notice would
be intended to inform patients about what is done with their PHI and
about any rights they may have with respect to that information. Notice
is an essential component of giving individuals the ability to make
informed choices about their medical treatment. We support a flexible
approach in allowing each provider to create a notice that reflects its
own unique information practices.
We do have concerns, however, about the administrative burdens and
costs of such requirements, particularly for small practices. Small
businesses are required to provide a notice of information practices on
the patient's date of first service after the effective date of the
rule. Determining the ``first service'' would place an undue
administrative burden on many small practices. On a daily basis, staff
would have to manually review each chart, or, in many cases, access a
computer system to determine whether the patient has been seen since
implementation of the rule. Internal medicine physicians average 4,000-
5,000 patient charts; approximately 2,200 charts are considered to be
``active.'' (``active'' should be defined as those patients who have
been seen in the last two years) The initial cost to produce, copy and
mail notices could easily exceed the estimated $375 first year cost per
provider office. Assuming 50 cents per authorization, the total cost
could easily reach $1100 per provider in medical offices. Moreover, the
cost attributed to tracking individual patient receipt of the notice
would be extensive. These administrative costs would be incurred again
whenever a notice is updated. Physicians who mail notices to active
patients, prominently display the notice and provide the notice to all
new patients should be relieved of any additional notification
requirements.
Requiring signed acknowledgment of the notice, which in theory
sounds like a good practice, in reality will only increase
administrative burdens and costs. We also suggest a clarification to
the provisions. The proposal does not clearly define the scope of
initial notifications required. Will notification be required if the
patient's last treatment date was prior to the rule's effective date?
Access for Inspection or Copying
Patients have a legal and ethical right to review information in
their own medical records. In rare and limited circumstances, health
information may be withheld from a patient if there is significant
likelihood of a substantial adverse effect on the physical, mental or
emotional health of the patient or substantial harm to a third party.
The onus is on the provider to justify the denial of access.
The proposed rule would allow, but not require, a researcher/
provider to deny a request for inspection and copying of the clinical
trial record if the trial is still in progress, and the subject-patient
had agreed to the denial of access in conjunction with the subject's
consent to participate in the trial. The IRB or privacy board would
determine whether such waiver of access to information is appropriate,
as part of its review of the research protocol. In the rare instances
in which individuals are enrolled in trials without consent (such as
those permitted under FDA regulations), the covered entity could deny
access to information during the course of the trial even without
advance subject consent. However, access during the trial would be
appropriate if a participant has a severe adverse reaction and
disclosure of information during the clinical trial would give the
participant adequate information for proper treatment decisions. In all
cases, the subject would have the right to see the record after the
trial is completed. We agree with these provisions.
Access to current records within thirty days is reasonable for
active patients. Medical records of patients last seen more than two
years previously, however, may have been moved to off-site storage,
which necessitates a longer recovery period (perhaps 60 days), and
incurs additional cost. We suggest that a structured extension
procedure should be included in the final rule. We do not support
requiring an acknowledgment procedure.
Accounting of Disclosures
While we support in principle the requirement for an accounting of
disclosures, we have several concerns about the proposal in its current
form. First, covered entities would be required to provide an
accounting of all instances where PHI is disclosed for purposes other
than treatment, payment and health care operations. However, as
currently drafted, PHI may be disclosed without individual
authorization for those purposes. Thus, patients could learn who has
had access to their PHI only when such information is disclosed with
their consent, but they do not have such a right when consent has not
been given. It would seem that it would be more important to provide an
accounting for disclosures where an individual has not given prior
authorization.
Second, we are concerned about the administrative burden and cost
of complying with the accounting requirements. We agree that accounting
should not be required for payment, treatment and most health care
operations, but, as discussed earlier, we recommend that individual
authorization should be required prior to the disclosure or use of PHI
for such purposes.
Finally, we suggest amending section 164.515(c)(1)(v) to clarify
that ``copies of all requests for disclosure'' refers only to
individual-initiated requests.
Amendment or Correction
We support the right of patients to review the information in their
medical records and to propose corrections. At the same time, however,
it is critical to keep in mind that medical records provide working
documentation for physicians and are often referred to in support of
actions taken on the patient's behalf. The integrity of the medical
record is critical. Therefore, medical histories should not be re-
written or deleted. Physicians are liable to health plans for providing
supporting documentation for all information submitted and requests for
payment. If this information is later determined to be inaccurate,
corrections can be made and submitted as appropriate. The original
documentation, however, is still necessary.
Training
Many health care providers' employee training programs or employee
handbooks currently incorporate confidentiality policies, so the
additional burden imposed by the initial training requirement would be
negligible. Re-certification, however, would impose a new
administrative burden and is of questionable value when privacy
policies remain unchanged. Re-certification should be required only
when a provider's privacy policy significantly changes.
Safeguards
The proposal would require that a covered entity have appropriate
technical and physical safeguards to protect the privacy of PHI.
Medical records intermingle electronically transmitted data, non-
electronically transmitted data, and data that is referenced in both
formats. Therefore, providers most likely will have to presume that all
records must be considered PHI and treated as such. Many small
practices keep records in central areas easily accessible to all staff;
such areas are not easily adaptable to ``locked storage'' areas.
Replacement of an open medical chart storage cabinet with a lockable
unit costs approximately $800 and provides little benefit. A typical
physician has between three and ten units. A small business should be
required instead to provide physical barriers (e.g., walls or counters)
to limit the access of non-authorized personnel to record storage
areas.
The proposal also would require a covered entity to verify the
identity and/or authority of persons requesting PHI. This places an
unusual burden on health care providers to verify requests that are
normally received verbally or via fax. Moreover, ascertaining whether a
requestor has the appropriate legal authority is beyond the scope of
the training or expertise of most employees in a physician's office.
Health care providers must be able to reasonably rely on the authority
of the requestor.
Sanctions
We support the flexibility in the proposal that would allow covered
entities to develop the sanctions policies appropriate to their
businesses and operations. The ACP-ASIM supports holding users of
electronic medical data accountable for protecting patient privacy. We
are concerned, however, that a provider would be held liable for
violations by a business partner and its subcontractors. As discussed
earlier, we think that there are fundamental fairness issues in holding
providers accountable for the actions of another entity that they do
not control.
Small Business Impact
The NPRM does not propose a specific definition for small
businesses, but incorporates the U.S. Small Business Administration's
(SBA) baseline revenue definition for small businesses, which is $5
million in annual revenue. We do not believe that this proposed
guideline, as currently defined, will include the projected 90% of
health care providers. The Medical Group Management Association's Cost
Survey Report for 1998 indicated that only 52.01% of group practices
would not exceed the $5M revenue threshold. In addition, the SBA has
proposed adjusting the revenue requirement for Doctors of Medicine (SIC
8011), as well as certain other health care-related providers, to $7.5
million. SBA has proposed this increase to reflect the disadvantage
that health care providers face in a highly competitive market, even
though their revenue has increased. We would encourage HHS to reflect
this amended revenue standard in the final rule.
Additionally, we encourage HHS to consider establishing an
alternative test for small businesses, based upon number of employees.
Health care providers in particular areas of medicine, such as
cardiology or oncology, would exceed the revenue requirements in a
practice of four to five physicians. To achieve parity across
specialties with widely divergent average revenues, we encourage HHS to
consider extending the definition of small business to any health care
provider employing less than twenty employees. This definition is
supported by the report, ``Employer Firms, Employment, and Estimated
Receipts by Firm Size and Industry, 1996,'' issued by the SBA's Office
of Advocacy, which indicates that 92% of Doctors of Medicine worked in
firms with fewer than 20 employees.
Conclusion
The proposed rule is an important first step in ensuring federal
protections for the privacy of medical records. The ACP-ASIM
appreciates your consideration of our comments and looks forward to
working with you as the rulemaking process continues. If you have any
questions, please do not hesitate to contact Debra Cohn, Legislative
Counsel (202/261-4541) or Jack Ginsburg, Director of Policy Analysis
and Research (202/261-4542).
Sincerely,
Whitney W. Addington, M.D., FACP
President
American College of Surgeons
Washington, DC 20007
February 16, 2000
The Honorable Bill Thomas
Chair, Subcommittee on Health
Committee on Ways and Means
U.S. House of Representatives
1136 Longworth House of Building
Washington, DC 20515
Dear Chairman Thomas:
As you and members of your Subcommittee prepare to examine the
extraordinarily complex issue of medical records confidentiality, the
enclosed copy of the College's response to the Department of Health and
Human Services (HHS) proposal on this issue may be useful.
In its comments, the College recognizes the enormously difficult
task the HHS Secretary faced when drafting this proposed rule, and we
commended the Department for its effort to generate regulations that
are consistent with sensible health information confidentiality
principles. However, we believe strongly that the proposed rule
overreaches its mandate in some areas, fails to take into account
important private-sector activities that contribute to high-quality
patient care, and imposes unreasonable burdens on physicians and their
staff. Therefore, the College still believes that strong federal
legislation is needed to provide a more tightly drawn blueprint for
federal regulations.
Some of our key concerns with the proposed rule, described in more
detail in the enclosed text, can be summarized as follows:
The list of covered entities included in the proposal does
not adequately account for the wide range of those that contribute to
the modern, integrated health care system. As an example, it is
impossible to determine how the College's own centralized cancer
registry, the National Cancer Data Base, would be treated and what
requirements it would need to meet.
Improvements can be made in the definitions that were
developed for ``treatment,'' ``payment,'' and ``health care
operations.'' In particular, we question how much patient identifiable
information is necessary for fraud and abuse detection and compliance
programs, or for general evaluation of provider performance.
The mandate that covered entities adhere to a ``minimally
necessary'' requirement when disclosing protected health information
should be modified to provide more explicit guidance. Further, we
suggest that entities requesting protected information should bear
greater responsibility for determining the minimum amount necessary to
complete their efforts.
The College vigorously objects to provisions that would
essentially require covered entities to be knowledgeable about and
adhere to the information policies adopted by the whole assortment of
businesses with which they are partners. We believe that HHS has
greatly overstepped its statutory authority in this provision, and
recommend that the standards be modified to require only that
physicians and other covered entities make reasonable efforts to
enforce their contracts; they should not be held responsible for their
business partners' transgressions.
The list of data elements that would need to be stripped
from the medical record to be considered ``de-identified'' is far too
sweeping and, if implemented, will render the record unusable for many
types of medical research and disease surveillance registries.
The definition of health oversight agencies allowed access
to patient information appears to include only those that are
government-based. Other key, private sector organizations, such as the
Joint Commission on Accreditation of Healthcare Organizations, are not
granted equal privileges. Indeed, the College conducts programs that
rely on patient data to assess and approve hospital-based cancer,
trauma, and burn programs--these programs simply could not operate
under the restrictions being proposed by HHS.
To increase the odds of patients understanding of the
notices they receive about a provider's information practices, HHS
should reconsider its decision to abstain from developing a uniform
format. The more patients see similar documents, the less likely they
are to become disoriented when examining a new notice, particularly
when presented with multiple notices for an episode of care that
involves more than one provider.
Finally, as we note in our comments, many of the problems
encountered with current patient information management practices
result from the patchwork of state laws that complicate our
increasingly interstate health care delivery and financing systems. We
urge Congress to enact legislation preempting all state laws and
establish a single, national standard for the care and management of
patient medical records.
The College welcomes the Subcommittee's interest in addressing this
remarkably complicated and important issue. We hope that you will call
on us to assist in your efforts to develop reasonable, workable
legislation to resolve the many difficult issues involved, including
those problems that arise from the Secretary's limited regulatory
authority in this area. Please do not hesitate to contact Christian
Shalgian in our Washington Office, at (202) 337-2701, if we can be
helpful.
Sincerely,
Thomas R. Russell, MD, FACS
Executive Director
[An attachment is being retained in the Committee files.]
Statement of the American Council of Life Insurers
I. INTRODUCTION
The American Council of Life Insurers (ACLI) is a national
trade association whose 435 member companies represent 73
percent of the life insurance and 86.9 percent of the long term
care insurance in force in the United States. The ACLI also
represents 71 percent of the companies that provide disability
income insurance. The ACLI is please to submit a summary of its
comments on the proposed Standards for Privacy of Individually
Identifiable Health Information, 45 CFR Parts 160 through 164,
(the proposed rule) promulgated by the Department of Health and
Human Services (Department). The entire text of the ACLI's
comments can be found on our public web site at ACLI.com.
The ACLI supports the goal of the Department of Health and
Human Services (Department) to protect the privacy of
individually identifiable health information and supports
implementation of the privacy requirements of the
Administrative Simplification subtitle of the Health Insurance
Portability and Accountability Act of 1996 (P.L. 104 -191)
(HIPAA). Life, disability income, and long term care insurers
understand their responsibility to protect individually
identifiable health information. ACLI member companies are
strongly committed to the principle that individuals have a
legitimate interest in the proper collection and handling of
their medical information and that insurers have an obligation
to assure individuals of the confidentiality of that
information.
Two years ago, the ACLI Board of Directors adopted the
``Confidentiality of Medical Information Principles of
Support.'' The ACLI has just amended these Principles to
strengthen them even further to provide for support for
prohibitions on the sharing of medical information for
marketing and for determining eligibility for credit. A copy of
the Principles is attached to this statement. Life, disability
income, and long term care insurers have a long history of
handling individually identifiable health information in a
confidential and appropriate manner and are proud of their
record as responsible custodians of that information.
The ACLI strongly supports the Department's fundamental
goal of protecting individually identifiable health
information. We believe that the Department can pursue this
goal in a manner consistent with the public interest in
maintaining life, disability income, and long term care
insurance markets which meet the private insurance needs of
American consumers. By their very nature, the businesses of
life, disability income, and long term care insurance involve
personal and confidential relationships. However, insurers
selling these lines of coverage must be able to obtain and use
their customers' individually identifiable health information
to perform legitimate insurance business functions, essential
to insurers' ability to serve and fulfill their contractual
obligations to their existing and prospective customers. We
have analyzed the proposed rule with a view to balancing the
goal of protecting the confidentiality of individuals'
individually identifiable health information with life,
disability income, and long term care insurers' need to obtain
and use that information in order to issue, service, and
administer insurance policies sought by individuals.
We were pleased that Secretary Donna Shalala, as the
Keynote Speaker at the ACLI's Annual Meeting in November of
1997, acknowledged the importance of access to individually
identifiable health information to the ability of insurance
companies to provide the essential protection that only private
insurance affords. Secretary Shalala stated: ``I know that you
support confidentiality legislation as long as it doesn't
jeopardize your ability to underwrite in a fair and fiscally
prudent manner and to evaluate claims.'' This statement by the
Secretary is a trenchant declaration of the fundamental point
of this letter.
It is important that the Department understand and consider
all of the possible results of the proposed rule on covered
entities and other entities that will be impacted by it. We are
concerned that the proposed rule fails to take into account its
impact on entities that are not covered entities, but which
would be significantly impacted by the rule, particularly life
and disability income insurers. We are also concerned that the
proposed rule does not adequately take into account its impact
on insurers which sell long term care insurance which are
currently directly subject to the proposed rule.
Appropriately, insurers selling life insurance are not
covered entities subject to direct regulation under the
proposed rule. However, life insurers must obtain protected
health information, essential to underwriting and claims
evaluation, from doctors, hospitals, and others who may only
disclose protected health information as permitted under the
rule.
While it appears that disability income insurance policies
are not intended to be health plans and that insurers which
sell disability income insurance policies are not intended to
be covered entities, this is not entirely clear. We believe
that disability income insurance policies are not health plans,
that disability income insurers are not covered entities, and
that the proposed rule should make this clear. Also, as with
life insurers, we are concerned with the proposed rule's impact
on disability income insurers' ability to obtain from covered
entities health information essential to underwriting and
claims evaluation activities.
We are concerned by the proposed rule's inconsistency with
HIPAA by virtue of its inclusion of a number of HIPAA
``excepted benefits'' within the definition of health plan,
making insurers which sell these lines of coverage ``covered
entities.'' This appears to be contrary to Congressional intent
to have the rule address comprehensive medical coverages only.
It also appears contrary to the Department's intent as
expressed in the preamble section ``Definitions,'' in
connection with the definition of health plan.
We are particularly concerned by the proposed rule's
characterization of long term care insurance policies as health
plans, making long term care insurers covered entities. For the
reasons explained below, we strongly believe that this is
inappropriate. Long term care insurance policies should be
deleted from the list of coverages defined as health plans. If
insurers which sell long term care insurance continue to be
covered entities in the final rule, we would be very much
concerned by the proposed rule's impact on their activities, as
explained below.
There is also troublesome ambiguity in the proposed rule
with respect to the obligations of an entity which is a covered
entity for purposes of some of its activities and not a covered
entity for purposes of other activities. A life insurer is not
subject to the proposed rule as a covered entity. As the rule
is currently drafted, a long term care insurer would be a
covered entity. In fact, many life insurers are also long term
care insurers. It does not appear to be the intent of the
proposed rule to make the insurer a covered entity with respect
to its use of protected health information in connection with
life insurance, nor is there statutory authority to extend the
rule in this manner. However, neither the rule nor the
explanation in the preamble make this clear. The rule and the
preamble should make clear that an entity involved in several
lines of business, one of which is subject to the rule, will
not be subject to the rule with regard to its other businesses.
II. INSURANCE AND THE ROLE OF INDIVIDUALLY IDENTIFIABLE HEALTH
INFORMATION
The system of classifying proposed insureds by level of
risk is called risk classification. It enables insurers to
group together people with similar characteristics and to
calculate a premium based on that group's level of risk. Those
with similar risk pay the same premiums. The process of risk
classification provides the fundamental framework for the
current private insurance system in the United States. It is
essential to insurers' ability to determine premiums which are:
(1) adequate to pay their customers' future claims; and (2)
fair relative to the risk posed by proposed insureds.
The price of life, disability income and long term care
insurance is generally based on the proposed insured's gender,
age, present and past state of health, possibly his or her job
or hobby, and the type and amount of coverage sought. Much of
this information is provided directly by the proposed insured.
Depending on the proposed insured's age, medical history,
and the amount of insurance applied for, the insurer may also
need information from the individual's medical records. In this
event, when the insurer's sales representative takes the
consumer's application for insurance, he will request that the
applicant sign an authorization, provided by the insurer,
authorizing the insurance company to: (1) obtain his health
information from his doctor or from a hospital where he has
been treated; and (2) use that information to, among other
things, underwrite that individual's application for coverage.
Based on this information, the insurer groups insureds into
pools so that they can share the financial risk presented by
dying prematurely, becoming disabled, or needing long term
care.
If a company is unable to gather accurate information or
have access to information already known to the proposed
insured, an individual with a serious health condition, with a
greater than average risk, could knowingly purchase a policy
for standard premium rates. This is known as ``adverse
selection.'' While a few cases of adverse selection might not
have a significant negative impact on the life, disability
income, or long term care insurance markets, multiple cases
industry-wide would likely have such an effect. This would be
particularly true if individuals were to be legally permitted
to withhold or restrict access to medical information
significant to their likelihood of dying prematurely, becoming
disabled or requiring long term care. The major negative
consequence of adverse selection would be to drive up costs for
future customers which could price many American families out
of the life, disability income, and long term care insurance
markets.
Most life and long term care insurance and much disability
income insurance is individually underwritten. As part of the
underwriting process, insurers selling life, disability income,
and long term care insurance rely on an applicant's
individually identifiable health information to determine the
risk that he or she represents. Therefore, medical information
is a key and essential component in the process of risk
classification.
Once a life, disability income, or long term care insurer
has an individual's health information, the insurer controls
and limits who sees it. At the same time, insurers must use and
disclose individually identifiable health information to
perform legitimate, core insurance business functions.
Insurers that sell life, disability income, and long term
care insurance must use individually identifiable health
information to perform essential functions associated with an
insurance contract. These basic functions include, in addition
to underwriting, key activities such as claims evaluation and
policy administration. In addition, insurers must also use
individually identifiable health information to perform
important business functions not necessarily directly related
to a particular insurance contract, but essential to the
administration or servicing of insurance policies generally,
such as, for example, development and maintenance of computer
systems.
Also, life, disability income, and long term care insurers
must disclose individually identifiable health information in
order to comply with various regulatory/legal mandates and in
furtherance of certain public policy goals such as the
detection and deterrence of fraud. Activities in connection
with ordinary proposed and consummated business transactions,
such as reinsurance treaties and mergers and acquisitions, also
necessitate insurers' use and disclosure of such information.
Life, disability income, and long term care insurers must
disclose individually identifiable health to: (1) state
insurance departments in connection with general regulatory
oversight of insurers (including regular market conduct and
financial examinations of insurers); (2) self-regulatory
organizations, such as the Insurance Marketplace Standards
Association (IMSA), concerned with insurers' market conduct;
and (3) state insurance guaranty funds, which seek to satisfy
policyholder claims in the event of impairment or insolvency of
an insurer or to facilitate rehabilitations or liquidations.
Limitations on these disclosures would operate counter to the
consumer protection purpose of these disclosure requirements.
Life, disability income, and long term care insurers need
to (and, in fact, in some states are required to) disclose
individually identifiable health information in order to
protect against or to prevent actual or potential fraud. Such
disclosures are made to law enforcement agencies, state
insurance departments, the Medical Information Bureau (MIB), or
outside attorneys or investigators who work for the insurer.
Again, any limitation on an insurer's ability to make these
disclosures would undermine the public policy goal of reducing
fraud, the costs of which are ultimately borne by consumers.
III. SUMMARY OF ACLI COMMENTS ON THE PROPOSED RULE
A. Comments Concerning Life and Disability Income Insurers
The impact of the proposed rule on insurers selling life
insurance and on insurers selling disability income insurance
would be significant and adverse. The proposed rule generally
encourages and, in many cases, requires limitation on
disclosure of individually identifiable health information. As
discussed above, such information is essential to the business
of insurance. We are concerned that in an effort to protect
confidentiality, the rule will jeopardize insurers' ability to
issue, administer and service life and disability income
insurance policies.
It appears that the Department does not intend disability
income insurance policies to be health plans under the rule. We
strongly believe that this is appropriate. However, the
proposed rule is not clear on this point. We urge the
Department to amend the rule to specify that disability income
insurance policies are not health plans.
Section 164.508 requires either an authorization requested
by the individual or by a covered entity. The authorization
forms submitted by life and disability income insurers to
covered entities on behalf of or as authorized by applicants
apparently fall within the scope of Section 164.508(a),
authorizations requested by individuals. Given the critical
importance of protected health information to life and
disability income insurers' ability to serve their customers,
we believe that this section requires clarification. Section
164.508(a)(1) should provide for the release of protected
health information requested by the individual or authorized by
the individual.
Subject to limited exceptions, the proposed rule requires
that a covered entity must make all reasonable efforts not to
use or disclose more than the minimum amount of protected
health information necessary to accomplish the purpose of the
use or disclosure. If Section 164.508(a)(1) is not amended to
accommodate authorizations submitted as authorized by the
individual, covered entities--third parties such as doctors and
hospitals--will be charged with determining how much protected
health information is the ``minimum necessary'' for an insurer
to underwrite or pay a claim. This result would appear to be
contrary to the Department's intent as set forth in the
preamble. It would also be inappropriate because it is the
insurer, not the covered entity, which will bear the financial
risk of the insurance transaction.
We are very much concerned by the standard articulated in
Section 164.506(c)(i) giving individuals the right to enter
into agreements with health care provider covered entities to
restrict the use or disclosure of specified health information.
Although this subsection clearly provides that ``a covered
entity that is a health care provider must permit individuals
to request that uses or disclosures of protected health
information for treatment, payment, or health care operations
be restricted'' (emphasis added), the reference to this
standard in Section 164.506(c)(2) does not similarly make it
clear that: (1) only health care provider covered entities are
subject to this standard; and (2) the right to restrict only
extends to use or disclosure of protected health information
for treatment, payment, or health care operations. We are
gravely concerned that if Section164.506(c)(2) is not
clarified, it may be read to permit agreements to restrict
disclosure of information which could cause material
information to be withheld from an insurer underwriting an
application or evaluating a claim under a life or disability
income insurance policy, without the insurer even knowing that
information existed at all. This could result in serious
adverse selection, jeopardizing the current private systems of
life and disability income insurance. It would legalize actions
which constitute fraud and material misrepresentation under
current law.
We suggest more reasonable treatment of psychotherapy notes
and research information unrelated to treatment. We believe
that all individually identifiable health information should be
treated confidentially and in the same manner. We are concerned
by discussion in the preamble that seems to sanction
segregation of psychotherapy notes. We are concerned by the
definition of psychotherapy notes as currently proposed which
may bar legitimate access to anything more than ``summaries
of'' diagnosis, functional status, etc.
The level of specificity required in the authorization form
and the requirement of multiple authorizations are
impracticable. Furthermore, we are concerned that giving
individuals an opportunity to revoke their authorization for
disclosure of protected health information could jeopardize
life and disability income insurers' ability to investigate
material misrepresentation, fraud, and claims. We have provided
the Department with specific recommendations for amendments to
these sections.
B. Comments Concerning Long Term Care Insurance
We believe strongly that long term insurance policies are
inappropriately characterized as health plans, making long term
care insurers covered entities. We believe that long term care
insurance policies should be stricken from the list of
coverages defined as health plans. Whether or not long term
care insurance policies are health plans, we have the same
concerns, as we have with respect to life and disability income
insurers, about the proposed rule's impact on long term care
insurers' ability to obtain from other covered entities
protected health information essential to underwrite and pay
claims.
We believe Section 164.508(a) should be amended to clarify
that authorizations may be submitted on behalf of or authorized
by an individual. If Section 164.508(a) is not amended in this
manner, covered entities inappropriately will be charged with
determining the minimum amount of protected information
necessary for long term care insurers to underwrite
applications for long term care insurance coverage and to pay
claims.
We are particularly concerned about the impact on long term
care insurers of the right to restrict use and disclosure of
certain protected health information granted under Section
164.506(c)(1). This provision could have a devastating effect
on long term care insurers by virtue of the fact that it would
permit an agreement to restrict disclosure of information
material to ``payment'' of a long term care insurance claim
without a long term care insurer even knowing any information
is being withheld. Moreover, the failure of Sections
164.506(c)(2) and 164.512(d)(ii)(B) to clarify that the right
to restrict use and disclosure of protected health information
is only applicable to treatment, payment, and health care
operations could result in interpretation of these subsections
to permit agreements to withhold information material to the
underwriting of long term care insurance policies. On a
widespread basis, this could jeopardize the process of risk
classification in relation to long term care insurance.
The special treatment of psychotherapy notes and research
information unrelated to treatment, as well as the definition
of psychotherapy notes also give rise to concern as they relate
to long term care insurance. Again, we believe that all
individually identifiable health information should be treated
confidentially and in the same manner. We are concerned by
discussion in the preamble that seems to sanction segregation
of psychotherapy notes. We are concerned by the definition of
psychotherapy notes as currently proposed which may bar
legitimate access to anything more than ``summaries of''
diagnosis, functional status, etc.
The requirements for authorizations are particularly
troublesome as applied to long term care insurer covered
entities. This is especially true with respect to the right to
revoke. Given the fact that the definitions of health care
operations and payment fail to include a number of essential
ordinary insurance business functions of long term care
insurers, individuals are given the right to revoke long term
care insurers' right to use protected health information for
some activities which are critical to the issuance, servicing
and administration of long term care insurance policies. The
level of specificity required in the authorizations is also
problematic as applied to long term care insurers.
If long term care insurers continue to be covered entities
in the final rule, we suggest a number of amendments to
accommodate the administrative needs of long term care insurer
covered entities, just as an apparent attempt was made to
accommodate the administrative needs of other covered entities.
If long term care insurers are to be covered entities, they
should not be treated as ``second class'' covered entities.
As mentioned above, we are very concerned that the proposed
definitions of health care operations and payment do not
adequately address key activities of long term care insurers
necessary for support of payment. As a result, Section
164.506(a)(1)(i) does not permit long term care insurers to use
and disclose protected health information without authorization
to perform functions which are ``compatible with and directly
related to . . . payment'' of claims submitted under long term
care insurance policies. This would seem to be counter to the
stated intent of the proposed rule'' to make the exchange of
protected health information relatively easy for health care
purposes.''
We oppose the extension of the proposed rule to business
partners of covered entity long term care insurers. We are
particularly concerned that long term care insurers are made
liable for violations of the proposed rule by their business
partners. We are also opposed to the creation of a private
right of action by making subjects of protected health
information third party beneficiaries of contracts between long
term care insurers and their business partners.
We have a number of important technical concerns with the
provisions in Section 164.510 providing for disclosures without
an individual's authorization. We include suggestions as to how
these matters can be resolved.
While the ACLI supports providing individuals rights of
notice, access, accounting for disclosures, and the opportunity
to request amendment/correction of inaccurate information, we
are very concerned by the burdensome nature of several of these
requirements. For example, required and permissible disclosures
must be distinguished in the proposed notice. This is in
addition to a separate requirement that the notice contain a
description of the types of disclosures that may occur.
Moreover, the authorization section contains similar disclosure
requirements. We suggest several ways in which these
overlapping requirements can be simplified without compromising
the goal of providing consumers with meaningful information
about how a covered entity handles and protects the consumer's
protected health information.
The ACLI looks forward to working with the Chairman and
members of this committee as Congress addresses the critical
issue of protecting the confidentiality of health information.
Confidentiality of Medical Information
Principles of Support
Life, disability income, and long-term care insurers have a
long history of dealing with highly sensitive personal
information, including medical information, in a professional
and appropriate manner. The life insurance industry is proud of
its record of protecting the confidentiality of this
information. The industry believes that individuals have a
legitimate interest in the proper collection and use of
individually identifiable medical information about them and
that insurers must continue to handle such medical information
in a confidential manner. The industry supports the following
principles:
1. Medical information to be collected from third parties
for underwriting life, disability income and long-term care
insurance coverages should be collected only with the
authorization of the individual.
2. In general, any redisclosure of medical information to
third parties should only be made with the authorization of the
individual.
3. Any redisclosure of medical information made without the
individual's authorization should only be made in limited
circumstances, such as when required by law.
4. Medical information will not be shared for marketing
purposes.
5. Under no circumstances will an insurance company share
an individual's medical information with a financial company,
such as a bank, in determining eligibility for a loan or other
credit--even if the insurance company and the financial company
are commonly owned.
6. Upon request, individuals should be entitled to learn of
any redisclosures of medical information pertaining to them
which may have been made to third parties.
7. All permissible redisclosures should contain only such
medical information as was authorized by the individual to be
disclosed or which was otherwise permitted or required by law
to be disclosed. Similarly, the recipient of the medical
information should generally be prohibited from making further
redisclosures without the authorization of the individual.
8. Upon request, individuals should be entitled to have
access and correction rights regarding medical information
collected about them from third parties in connection with any
application they make for life, disability income or long-term
care insurance coverage.
9. Individuals should be entitled to receive, upon request,
a notice which describes the insurer's medical information
confidentiality practices.
10. Insurance companies providing life, disability income
and long-term care coverages should document their medical
information confidentiality policies and adopt internal
operating procedures to restrict access to medical information
to only those who are aware of these internal policies and who
have a legitimate business reason to have access to such
information.
11. If an insurer improperly discloses medical information
about an individual, it could be subject to a civil action for
actual damages in a court of law.
12. State legislation seeking to implement these principles
should be uniform. Any federal legislation to implement the
foregoing principles should preempt all other state
requirements.
American Federation of State,
County and Municipal Employees, AFL-CIO
Washington, DC 20036-5687
February 16, 2000
The Honorable William Thomas
Ways and Means Committee
Health Subcommittee
U.S. House of Representatives
Washington, DC 20515
Dear Chairman Thomas:
The American Federation of State, County and Municipal Employees
(AFSCME) appreciates the opportunity to submit a statement for the
record for the February 17, 2000 hearing on the confidentiality of
patient records. AFSCME represents over 1.3 million workers. Among
these are 360,000 health care workers including registered and licensed
nurses, pharmacists, physicians and nursing assistants. Therefore, we
approach privacy regulations from the perspective of consumers of
health care services as well as workers in the health care system.
We commend the Department of Health and Human Services for
addressing the crucial issue of medical record confidentiality in such
a comprehensive proposal. The need to develop regulations that will
serve as standard protections for the users of health care services is
urgently needed in the rapidly changing world of health care delivery.
AFSCME strongly supports the approach in the Health Insurance
Portability Accountability Act (HIPAA) and the Department's proposal
that federal regulations will serve as a floor, rather than a ceiling,
on privacy protections afforded by states. Under this approach, a
minimum federal standard would extend important protections to all
consumers, but state laws providing greater protections would remain in
place or could be enacted in the future to meet new needs.
While the regulations create important new protections, there are
areas where the Department stopped short of fully exercising its
authority under HIPAA or did not provide adequate clarification in the
regulations. We are submitting comments to the Secretary which detail
these issues. Many of these issues are summarized below.
The regulations should apply to both electronic and non-electronic
health information. Consistent treatment of health information provides
a much more workable framework for covered entities. Otherwise, covered
entities would need to keep track of the method of transmittal of
information from all paper records in order to determine which
information in an individual's file is protected. Further, because most
information is not maintained in electronic form, the failure to cover
paper records provides a gaping hole through which much confidential
information can be transmitted despite Congress' desire to protect the
privacy of an individual's health records.
The regulations must clarify that protected health information
obtained by an employer sponsored self-funded or insured plan cannot be
shared with other parts of the employer's organization. If it is not
made clear that private health information cannot be shared, it will be
used improperly by some employers to make such employment decisions as
promotions, job assignments and firings.
The regulations must extend privacy protections to medical records
connected to workers' compensation claims. There is a serious problem
of unlimited access to and misuse by employers and insurers of
individually identifiable health information of workers who have filed
such claims. Medical records have been used to discriminate, harass,
blacklist and deny workers their rights under the law. We do not
believe that Congress intended to exempt workers' compensation insurers
from the scope of coverage and believe that the Department should
address this subject.
Thank you for the opportunity to submit a statement for the record
for this important hearing.
Sincerely,
Charles M. Loveless
Director of Legislation
CML:bcc
cc: Rep. Pete Stark, Ranking Member
Statement of American Healthways, Inc., Nashville, TN
American Healthways, Inc. (``AMHC''), the successor
corporate name of American Healthcorp, Inc., appreciates the
opportunity to submit the following comments for inclusion in
the record of the House Ways and Means Health Subcommittee
Hearing on Patient Record Confidentiality on February 17, 2000.
Overall AMHC strongly supports the proposed privacy
regulations published at 64 Fed. Reg. 59,918 (Nov. 3, 1998),
particularly the inclusion of disease management in the
definition of treatment. It is imperative to legitimate disease
management organizations that the use and disclosure of
identifiable health information for disease management be
permitted without individual authorizations. This is currently
permitted in the proposed regulations and is essential to the
continued operation and success of disease management programs.
AMHC and similar disease management organizations, however, are
extremely concerned about the lack of a uniform standard.
Accordingly, AMHC believes that complete federal preemption of
all state medical privacy laws is imperative
AMHC, headquartered in Nashville, Tennessee, is the
nation's leading operator of care and disease management
services with 160,000 lives under management. AMHC's Diabetes
HealthwaysSM, Cardiac HealthwaysSM, and
Respiratory HealthwaysSM programs have proved effective at
significantly improving health status and decreasing overall
cost for these disease populations.
The privacy of individually identifiable health information
is of utmost importance to AMHC. AMHC has extensive policies
and procedures to protect patient confidentiality. As a result,
neither AMHC nor its clients have received a single
confidentiality or privacy complaint regarding AMHC's disease
management programs. AMHC provides these comments to the
Subcommittee from this perspective.
DISEASE MANAGEMENT IN THE PROPOSED REGULATIONS
The proposed regulations allow a covered entity to use or
disclose protected health information without individual
authorization ``to carry out treatment, payment, or health care
operations.'' \1\ ``Treatment'' is defined as ``the provision
of health care by, or the coordination of health care
(including health care management of the individual through
risk assessment, case management, and disease management)
among, health care providers; the referral of a patient from
one provider to another; or the coordination of health care or
other services among health care providers and third parties
authorized by the health plan or the individual.'' \2\ Under
this definition, use and disclosure of protected health
information for disease management is permissible without
individual authorization.
---------------------------------------------------------------------------
\1\ 64 Fed. Reg. 59,918, 60,053 (Nov. 3, 1998).
\2\ Id. (emphasis added).
---------------------------------------------------------------------------
It is imperative that this be maintained. The use of
identifiable health information without patient authorization
is essential to the ability of disease managers such as AMHC to
provide and obtain the greatest benefits for patients from its
disease management services.
AMHC has utilized both an enrollment or ``opt-in'' model
and an engagement or ``opt-out'' model for its disease
management programs. Under the enrollment model, individuals
choose whether to participate in the disease management
program. In an engagement model, plan members are automatically
provided the benefit of the disease management program, but may
choose to ``opt-out'' of participation. Although an argument
might be made that the enrollment model provides greater
privacy protection, it unnecessarily intrudes upon the existing
coordination of care, producing vastly inferior health care
outcomes to the engagement or ``opt-out'' model.
By way of direct comparison, AMHC documented that with the
engagement model AMHC's programs achieve 98 percent
participation, compared to less than 30 percent for a typical
enrollment model. Additionally, cost savings are dramatically
less for an enrollment model. For example, annualized diabetes
health care cost savings for an average 100,000 member plan
under the engagement model is $1,738,716 as compared to only
$443,550 for an enrollment model.
The reason for the difference in participation rates and
cost savings is that people with chronic diseases often suffer
from inertia and denial about their disease. The engagement
process circumvents this avoidance tendency. Typically, the
individuals who opt-in are the healthier patients who are
already highly motivated to manage their disease. These people
are less in need of the extensive disease management programs
and, therefore, the clinical improvements in these patients
(with their concomitant cost savings), while still present, are
less significant.
An engagement model strikes the right balance between the
competing interests of individual privacy rights on the one
hand and the tremendous clinical and financial benefits of
disease management on the other. Allowing individuals to opt-
out still provides individuals a choice and yet retains the
tremendous clinical and financial benefits of disease
management for the largest number of individuals. Moreover,
because disease managers are business partners, confidentiality
of protected health information remains protected from
secondary use or disclosure. Accordingly, disease management
programs must be allowed to continue to use and receive
protected health information for disease management without
patient authorization.
COMPLETE FEDERAL PREEMPTION
In the proposed regulations, HHS states ``HIPAA provides
that the rule promulgated by [HHS] may not preempt state laws
that are in conflict with the regulatory requirements and that
provide greater privacy protections.'' \3\ Although HHS may
lack the authority to preempt state privacy laws, complete
preemption of state laws is imperative. AMHC thus far has
managed to operate in compliance with all applicable state
laws. However, maneuvering around the varying and often
incompatible requirements of so many state laws has been
difficult. Soon, the task may be impossible. Since the nation's
attention has been focused on medical records privacy issues,
many states have enacted new privacy laws and almost all states
have significant privacy legislation pending.
---------------------------------------------------------------------------
\3\ Id. at 59,926.
---------------------------------------------------------------------------
California recently enacted a new privacy statute which
only allows disclosure of identifiable health information for
disease management if the services are approved by the
patient's primary care provider.\4\ The health plans, more
often than providers, contract with AMHC for the provision of
disease management services. Individuals, therefore, are
entitled to disease management services by virtue of their
membership in the plan, not as a function of their relationship
with a physician. Individuals should be able to decide whether
to ``opt-out'' of participation in the disease management
program offered. Physicians should not be permitted to impede
the provision of these services to their patients. The
requirement that the physician authorize disease management
services imposes an additional administrative burden that will
substantially diminish the number of Californians who may
benefit from disease management services.
---------------------------------------------------------------------------
\4\ See Cal. Civil Code Sec. 56.10(17) (West 1999).
---------------------------------------------------------------------------
Some state privacy laws directly conflict with others,
making it impossible to provide the same, consistent services
to residents of different states. Health plans that contract
with national employers (e.g., Federal Express) want and need
to provide a uniform set of benefits to all their employees.
This is impossible with the varying and often conflicting state
laws and requirements. In addition, a health plan which is
national in scope (e.g., Cigna) needs the ability to sell and
deliver uniform products, again extremely onerous, if not
impossible, without one uniform standard.
Furthermore, disease managers such as AMHC must keep
abreast of all state laws and ensure compliance with each
state's nuances, requirements and prohibitions. This is
becoming extremely difficult and significantly adds to the cost
and burdens on the delivery of health care, generally, and
disease management services, specifically.
Finally, it is often difficult to know which state's laws
apply. It is conceivable that for one transfer of protected
health information, several states' laws could be applicable.
For example, in the disclosure of protected health information
from a health plan to a disease management organization, the
following state laws could apply: (1) the state in which the
health plan (the disclosing entity) is based, (2) the state in
which the business partner (the receiving entity) is based, (3)
the state in which the health care services contained in the
protected health information were rendered, (4) the state in
which the disease management services are provided and (5) the
state in which the individual patient resides. Thus, it is
entirely possible that inconsistent standards and requirements
could apply to one disclosure or use of protected health
information. The uncertainty of which laws apply as well as the
complexity and difficulty in complying with the various state
laws will likely cripple the delivery of health care and
disease management services, especially as states continue to
enact more sophisticated, complicated and extensive health care
privacy legislation.
Accordingly, to preserve the continued provision of high
quality, affordable health care including disease management
services, complete federal preemption of state privacy laws is
imperative. Without preemption, the processes associated with
the delivery of health care could come to a screeching halt as
they did in Maine when that State enacted an over-zealous
privacy law.\5\
---------------------------------------------------------------------------
\5\ The law was swiftly repealed.
---------------------------------------------------------------------------
Congress should either provide HHS with such preemption
authority or themselves exercise congressional authority to
provide complete federal preemption of state medical privacy
laws. One consistent, uniform standard, especially given the
electronic world in which we now find ourselves, is absolutely
imperative and urgently needed. Congress has the authority to
preempt state laws in this area as the electronic exchange of
identifiable health information involves interstate commerce as
it is an interstate activity. Health plans, employers,
providers and disease managers often provide services to
individuals in multiple states. Accordingly, Congress must
exercise its preemption authority to ensure uniformity and
clarity in the use, disclosure and protection of identifiable
health information.
ABOUT AMHC
AMHC uses identifiable health information provided by its
contractors--typically health insurance companies--in its
Diabetes HealthwaysSM, Cardiac
HealthwaysSM and Respiratory HealthwaysSM
programs to identify individuals with the targeted disease,
determine what level of intervention is required, and monitor,
coordinate, and integrate the care of those individuals.
Release of identifiable health information to AMHC without
individual authorization is essential to the continued
operation of AMHC's disease management programs. If
authorizations were required before each use or disclosure,
disease management programs would be impeded, if not halted,
and their tremendous clinical and financial benefits
diminished.\6\
---------------------------------------------------------------------------
\6\ See Robert J. Rubin et al., Clinical and Economic Impact of
Implementing a Comprehensive Diabetes Management Program in Managed
Care, 83 J. Clin. Endocrinol. and Metab. 2635, 2640 (1998) for a
discussion of the benefits of disease management.
---------------------------------------------------------------------------
AMHC's population management programs are comprehensive
health management systems driven by proactive interventions to
identify, manage and coordinate the care of populations
affected by cardiac or respiratory disease or diabetes. AMHC
works with physicians, inpatient caretakers and other medical
professionals to develop the best possible care plans for
patients. AMHC's services are in the direct chain of care,
providing extensive patient services, including health risk
assessment, education, care plan development and management,
concurrent care review, one-on-one self-care counseling, and
primary care physician support and education.
Population-based disease management programs produce
significant clinical improvements and financial savings. AMHC's
programs are a primary example. A peer-reviewed study of
Diabetes Healthways' Diabetes NetCareSM program
concluded that the program ``generated substantial gross cost
savings'' and resulted in ``substantial improvement in all of
the clinical measures collected.'' \7\ Specifically,
``[m]embers were more likely to receive HbA1c tests, foot
exams, eye exams, and cholesterol screenings while enrolled in
the program . . . [and h]ospital utilization decreased
dramatically for each plan's diabetic population.'' \8\
Hemoglobin A1c testing, a signal measure of health status among
people with diabetes, increased 127 percent during the first
year of the program. Cardiac HealthwaysSM also
produces impressive clinical improvements. The ACE inhibitor,
cholesterol testing, and beta blocker compliance, the benchmark
cardiac care protocols, improved 23 percent, 61 percent, and 62
percent, respectively, during year one for AMHC's cardiac
populations.
---------------------------------------------------------------------------
\7\ Id. at 2640.
\8\ Id. at 2640-41.
---------------------------------------------------------------------------
AMHC's programs also produce significant financial
benefits. The Diabetes HealthwaysSM program resulted
in a 12.3 percent gross financial savings during the first
year, and increased savings each year thereafter. ``Hospital
costs decreased by $47 per diabetic plan member per month, or
$564 per year.'' \9\ Patients in the Cardiac
HealthwaysSM program achieve even more dramatic
first-year savings, an average of 62 percent for patients
suffering from congestive heart failure. These savings also
increase year after year as a result of AMHC's aggressive
preventative measures for less severely ill patients that delay
or prevent the otherwise inevitable onset of complications
associated with diabetes and cardiac disease. Other disease
management programs have achieved noticeable results as well.
---------------------------------------------------------------------------
\9\ Id. at 2641.
---------------------------------------------------------------------------
AMHC contracts with and provides disease management
services on behalf of health plans and obtains identifiable
health information directly from the plans. AMHC runs the
information through an AMHC developed algorithm to determine
which individuals likely have diabetes, cardiac or respiratory
disease and what level of intervention is required. AMHC
attempts to extract all individuals with diabetes, coronary or
respiratory disease. AMHC's population management approach is
unique in that it manages the health care of the entire
population with certain chronic conditions, regardless of the
severity of the illness, historical cost, co-morbid
complications or preexisting conditions.
The algorithm does result in some false positives. To
ensure that an individual is not falsely identified as having
diabetes or cardiac disease, AMHC contacts the individual's
physician to verify the diagnosis. Any false positives are
removed from the population and some unidentified individuals,
missed by the algorithm, are added. If the false positives are
not caught through this method, individuals still have the
opportunity to opt-out of the program if they do not have the
targeted disease (or for any reason). In addition, under the
proposed regulations, individuals are always afforded the
opportunity to amend any incorrect health information in their
records. Regardless, AMHC never discloses identifiable health
information other than to its employees or agents implementing
the disease management program or to individuals' physicians.
Once AMHC has the targeted disease population extracted,
identified individuals are sent a letter, on health plan
letterhead, describing the program. Individuals have the
opportunity to opt-out of participation. As discussed more
fully, infra, Diabetes HealthwaysSM has used both an
engagement (opt-out) and enrollment (opt-in) model of
participation. The engagement model achieves a 98 percent
participation rate while an enrollment model results in less
than 30 percent participation.
Once an individual is part of the disease management
program, AMHC assumes responsibility for all the health care of
affected populations, whether or not related to the named
chronic disease, and coordinates the care wherever it is
delivered: at home, in the hospital, in the physician's office,
or in any other outpatient or inpatient setting. Both Diabetes
HealthwaysSM and Cardiac HealthwaysSM do,
and Respiratory HealthwaysSM will, provide disease
management for all individuals in the targeted disease
population and monitor and coordinate all their health care in
all health care settings. These comprehensive programs have
achieved great success.
Overall, AMHC strongly supports the proposed privacy
regulations as drafted. AMHC appreciates the Department of
Health and Human Services' (``HHS'') recognition of the
importance of legitimate disease management through its
inclusion in the definition of treatment. Disease management
programs such as AMHC's Diabetes HealthwaysSM,
Cardiac HealthwaysSM and Respiratory HealthwaysSM
produce tremendous clinical benefits to the patient public (not
to mention concomitant financial savings) and, therefore,
should be encouraged, not hindered by the privacy regulations.
Statement of American Psychoanalytic Association, New York, NY
The Health Information Privacy Regulations proposed by the
Administration on November 3, 1999 represent one of the most
thoughtful efforts to date to address the growing threat to the
privacy of identifiable health information. The preamble to the
regulations sets forth the most thorough analysis of the
importance of medical information privacy to quality health
care and the public's confidence in the health delivery system.
With the exception of the protection for ``psychotherapy
notes,'' however, the privacy protections in the proposed
regulations do not fulfill the promise of the preamble.
As the preamble notes, the preservation of health
information privacy is a ``major concern'' of citizens. Health
information privacy is also essential for quality health care
because without an assurance of privacy, individuals will not
make the disclosures to physicians and other caregivers
necessary for treatment and diagnosis, caregivers will not
accurately record information in the medical record and
individuals will refrain from seeking the care they need.
The preamble correctly notes that an assurance of ``strict
confidentiality'' is essential for patients to receive
effective psychotherapy. That conclusion is supported by the
``reason and experience'' reflected in the therapist-patient
privilege which is recognized by the statutory laws in all 50
states and the District of Columbia, both federal and state
common law, the ethical standards of every mental health
professional association, and the recently released Surgeon
General's Report on Mental Health. The common thread of all of
these laws and standards is that therapist-patient
communications cannot be disclosed beyond the therapist without
the patient's consent.
The underlying statute directs the Secretary to issue
regulations that address at least the rights that individuals
``should have'' with respect to their identifiable health
information. The preamble notes that privacy is a fundamental
right which is an element of the constitutional right to
liberty, but the regulations make no mention of an individual's
right to privacy for identifiable health information.
The regulations also eliminate the traditional requirement
of obtaining patient consent before disclosing identifiable
health information except for marketing and certain other
``non-health'' related uses. Accordingly, these regulations
would permit disclosure of most identifiable health information
for most uses without patient notice or consent.
In an exception to the general rule, the regulations
require consent for the disclosure of ``psychotherapy notes''
for the purposes of treatment, payment and health care
operations. The regulations, however, permit the disclosure of
psychotherapy communications that do not come within the narrow
definition of ``psychotherapy notes'' and do not recognize even
that narrow exception for 13 other uses characterized as
``national priorities.'' Accordingly, the regulations do not
afford the protection for psychotherapy communications that is
generally accepted as being essential for effective
psychotherapy services.
The preamble to the regulations recognizes that statutory
authority has not been granted to permit effective enforcement
of the privacy protections contained in the regulations.
Further, the protections in the regulations are unenforceable
because, in the absence of notice of specific disclosures or
consent, individuals will have no way of knowing when, where
and to whom their information was disclosed. Two of the
principal privacy protections in the regulations--the
limitation on disclosures to the minimum information necessary
for the intended use and the ``right to restrict'' disclosures
that are otherwise allowable--are particularly unenforceable.
The information necessary for an intended use varies with the
size and technical capability of the disclosing entity, and
providers have a right to refuse any request to restrict
disclosures.
The regulations appropriately do not preempt state privacy
laws, including state common laws, which furnish ``more
stringent'' privacy protections. The recognition of state
common laws is particularly appropriate because most privacy
protections are found in state common laws, and those court
rulings reflect the history of ``reason and experience'' in
those states.
The American Psychoanalytic Association believes that the
following changes must be made in the regulations if the
public's confidence in the health delivery system is to be
preserved:
1. Individuals' right to privacy for identifiable health
information should be expressly recognized.
2. The right of patients to give or withhold consent for
most disclosures should be preserved.
3. The regulations should establish ``strict
confidentiality'' protections for mental health information and
specify the information that may be disclosed with patient
consent to third party payors. This approach is consistent with
federal and state common law and has been in effect for 15-20
years in New Jersey and the District of Columbia.
4. The privilege recognized for psychotherapist-patient
communications in the 1996 Supreme Court decision in Jaffee v.
Redmond should be recognized in the regulations. They also
should provide that any disclosure for a purpose under the
regulations will not constitute a waiver of the federal or
state privilege.
5. Patients should be permitted to preserve the privacy of
their health information by paying for services with their own
funds.
Privacy is essential for quality health care, but it is
also an indispensable element of the right to liberty--one of
the core principles of our Constitution. These principles have
been forged and preserved through the sacrifices of prior
generations. With the consideration of the right to medical
privacy, we reach one of those critical points in our nation's
history when we must decide whether we remain committed to
those principles.
Statement of William C. McGinly, Ph.D., CAE, President, Association for
Healthcare Philanthropy, Falls Church, VA
The Association for Healthcare Philanthropy (AHP) is
pleased to present its comments for the written record on the
proposed rules concerning the standards for privacy of
individually identifiable health information. (At your request,
please be advised that our comments also are submitted on an
IBM compatible 3.5-inch diskette in MS Word format.)
Summary and Introduction
Established in 1967, the Association for Healthcare
Philanthropy (AHP) is a not-for-profit organization whose 2,850
members manage philanthropic programs in 1,700 of the nation's
3,400 not-for-profit health care providers. As AHP's president
and chief executive officer, I can tell you that an estimated
75% to 80% of the U.S. population resides in the areas served
by these providers, which include community hospitals and
medical centers (59%), multihospital systems (14%), specialty
institutions (8%), academic institutions (5%), long-term care
facilities (5%), and other not-for-profit facilities (9%).
AHP's members raised more than $5.7 billion in FY1998-$1.92
billion more than was raised by all of United Way of America
during the same time period.
Funds raised by AHP's members directly support health care
programs and services that are unfunded or underfunded by other
sources. These include:
programs to promote healthy behaviors;
a vast array of community wellness programs, from
mobile health vans to mammography screenings and hearing and
eye exams; and
much needed facility improvements and essential
equipment upgrades.
Such programs are central to the not-for-profit mission of
AHP members' institutions and organizations. They are an
integral part of their business. For such programs to continue,
AHP's members must have access to their health care provider's
database. The reason: More than 60% of funds raised each year
come from individuals-most of whom are grateful patients.
In approaching prospective patient donors, AHP members are
sworn to respect the confidentiality of patient information
through the AHP Statement of Professional Standards and Conduct
and its companion Bill of Donor Rights. Further, AHP members
are committed to upholding the spirit and intent of state and
federal laws governing use of patient information. The way in
which AHP members' institutions and organizations handle
confidential information might be likened to how colleges
handle student records. That is, academic records are not
released without authorization, even to tuition-paying parents,
yet demographic data routinely is given to the alumni office
for fund-raising efforts that ensure the support of the
college's long-range educational mission.
AHP respectfully requests that the proposed regulations be
amended so that they neither block nor reduce our members'
ability to raise funds for not-for-profit public health care
programs.
More specific comments and related amendatory language
follow.
Background: Need for Privacy Standards
AHP fully supports the development of standards that
protect the confidentiality of individually identifiable health
information. However, those standards should be moderated so
that they also protect the public health care benefits
generated by philanthropic gifts to not-for-profit providers.
This balance of private need and public good is the essence
of an underlying tenet of a democratic society, and it is one
that AHP believes should be written into these regulations.
Statutory Background
AHP contends that the regulations as proposed would not
meet the statutory requirements for the privacy standards,
which require that any privacy standard adopted to implement
the Health Insurance Portability and Accountability Act of 1996
(HIPAA) ``shall be consistent with the objective of reducing
the administrative costs of providing and paying for health
care [emphasis added].''
By restricting AHP members' access to patient databases,
the proposed regulations threaten to destroy a major funding
source for public health care, that is, grateful patients. More
than 60% of all philanthropic gifts to not-for-profit health
care providers come from individuals, most of whom are grateful
patients. If access to grateful patients had been restricted in
FY1998, when AHP members raised more than $5.7 billion for
public health care programs, those programs might have lost as
much as $3.42 billion.
Thus, the proposed regulations include a substantial hidden
cost.
Consultations
AHP appreciates the opportunity to increase awareness of
health care philanthropy and its role in paying for health
care, and to propose alternate language in a number of sections
in the proposed regulations.
Summary and Purpose of the Proposed Rule
AHP supports the Secretary's recommendation for
comprehensive rules that would, among other goals, ``(a)llow
for the smooth flow of identifiable health information for
treatment, payment, and related operations, and for specified
additional purposes related to health care that are in the
public interest [emphasis added].''
AHP proposes that the final regulations can only meet this
goal if they specify that not-for-profit health care providers'
fund-raising programs are operated in the public's interest as
an integral part of the providers' business operations;
therefore, these programs should be included in the smooth flow
of identifiable health information.
Specifically, in Paragraph 5, AHP would have the fund-
raising
activities of not-for-profit health care providers included
under ``health care operations'' that do not require individual
authorization.
Applicability
AHP endorses the applicability of the privacy standards to
the entities that include the health care providers that employ
AHP members, but again urges the Secretary to make philanthropy
programs a permissible use of individually identifiable health
information, without authorization, as part of a provider's
``health care operations.''
Definitions
Health information: AHP generally supports the definition
of ``health information'' and the applicability of the privacy
standards to health information. However, a minimum amount of
health information is often helpful to the professional
development officer-if only to exclude certain constituent
groups from messages likely to be deemed offensive. For
instance, the following tenets usually guide AHP members when
they handle sensitive health information:
``Donor acquisition'' mailings that go to former
patients or their families simply do not refer to patients'
recent hospitalizations or their illnesses.
In cases where a patient has freely shared
personal information regarding medical conditions, or has
expressed an interest or made previous donations to a specified
program or department, segmented appeals for related medical
causes may occur, but these, too, do not expressly refer to
patients' illnesses.
Patients hospitalized or treated for psychiatric
and substance abuse treatment are routinely omitted from donor
acquisition approaches because of the heightened sensitivity
commonly associated with these diagnostic groups. Also excluded
are all minors.
In general, philanthropy programs give careful
thought to the audience and message of all fund-raising
appeals, and where appropriate eliminate any constituent groups
and/or messages deemed likely to be offensive to recipients.
T3Business partner: AHP supports the definition of
``business partner,'' but would like to establish an
understanding about how the definition relates to the ways that
health care philanthropy programs are structured.
Nearly 70% of AHP members work not for the health
care provider but for separately incorporated foundations,
which are recognized as charitable entities under 501(c)(3) of
the federal tax code. It is imperative that the proposed
privacy standards not inadvertently close the door to
charitable gifts that support public health programs-and
provide donors with a valued income tax deduction.
About 25% of AHP members work for stand-alone
departments within the health care provider institution.
The other 5% work in offices with some other
structure. Whether the privacy standards apply to these various
structures as ``covered entities'' or ``business partners,'' it
is critical that the standards not limit the effectiveness of
health care philanthropy programs to raise money from the
people most likely to give, that is, grateful patients.
Individually identifiable health information: A minimum of
patient demographic information is essential so that health
care philanthropy programs can carry out their not-for-profit
mission. Age is needed to exclude minors from appeals.
Introduction to General Rules
The health care philanthropy programs managed by AHP
members would not appear in conflict with this broadly stated
intent, if ``health care'' is broadly construed to include
public health.
Use and Disclosure for Treatment, Payment, and Health Care
Operations
AHP supports the uses and disclosures permitted without
authorization in this section, but adamantly opposes the
exclusion of certain activities from the definition of ``health
care operations.'' The very ability of not-for-profit health
care providers to fulfill their altruistic mission is
threatened by the proposed requirement that advance
authorization is necessary for the following activities:
marketing of health . . . services;
marketing by a non-health related division of the
same corporation; and
fund raising.
With buy-outs by for-profit health care providers
threatening the existence of not-for-profits, marketing is
critical to the future viability of these altruistic providers.
Much of what is marketed by AHP members-from departments or
divisions within a provider's corporation or from its related
foundation (see ``definitions'' above)-has tremendous benefit
for community health. Wellness programs, mammography screening,
ear and eye exams, etc., are marketed by AHP members. Many of
these programs are funded by the philanthropic programs that
AHP members manage.
One only need look at the hospital wings donated by
grateful patients, or the donor recognition plaques that line
hospital corridors, to realize that patients are grateful for
hospital services and do not mind showing their appreciation
with tangible gifts. AHP contends that these gifts are
willingly made because they are asked for after services have
been received. To ask for them in advance-which would be the
effect of the proposed privacy standards-would easily alienate
the largest prospect pool for philanthropic gifts to not-for-
profit health care providers.
Finally, the kind of marketing carried out by AHP members
is not the kind of marketing of commercial products that seems
to be the real target of this regulation's restriction. It is
important that the final version of the privacy standards
distinguish between for-profit and not-for-profit ventures.
In short, AHP would strike these activities from the list
of activities that require prior authorization:
marketing of health . . . services;
marketing by a non-health related division of the
same corporation; and
fund raising.
Further, AHP would expressly permit not-for-profit health
care providers and their business partners to use and disclose
protected information without authorization for the following
activities that are central to their altruistic mission:
marketing programs that promote the health of the
community; and
raising funds that support charitable,
educational, or research purposes and capital improvements.
Minimum Necessary Use and Disclosure
AHP members already adhere to the practice of minimal use
and disclosure. On becoming members, they pledge to uphold the
AHP Statement of Professional Standards and Conduct, which
requires that an individual's right to privacy be respected and
that information gained in the pursuit of professional duties
remain confidential. A copy of the AHP Standards is enclosed.
To manage effective philanthropic programs, AHP members
minimally need the names of patients and relatives, their
addresses and telephone numbers, and their age (to eliminate
minors). A minimum of health information is helpful (to
eliminate patients with sensitive diagnoses).
Right to Restrict Uses and Disclosures
AHP members already restrict use and disclosure of
information gained in pursuit of their professional duties, as
part of the AHP Statement of Professional Standards and Conduct
(copy enclosed).
Creation of De-Identified Information
AHP supports the use of protected health information for
statistical and analytical reports. In fact, AHP annually
conducts its Survey on Giving, through which members share
information about health care philanthropy. AHP is the only
source of this data in the country, which each year is given to
the American Association for Fund Raising Counsel for its
comprehensive report, Giving USA.
Application to Business Partners
The philanthropy efforts of AHP members are structured in
several ways-as foundations, as stand-alone departments or
divisions, or in other ways. However efforts are structured,
whether they are construed as ``covered entities'' or
``business partners,'' it is paramount that these regulations
permit access to protected data without authorization.
Application to Information About Deceased Persons
AHP supports this regulation's intent to be sensitive to
the families of the deceased. However, AHP respectfully
suggests that providing its members with protected information
is more likely to achieve this goal than the converse. After
all, AHP members cannot exclude families of the deceased from
general appeals for philanthropic gifts if the fact of death is
not known.
Furthermore, when friends or family of the deceased wish to
make a memorial gift, AHP members must have the minimum
demographic information to accommodate this wish.
Adherence to the Notice of Information Practices
AHP supports the intent of this section, which requires
that information uses and disclosures reflect the actual notice
of such use and disclosure. Again, however, AHP urges that the
philanthropic programs managed by its members be included under
``health operations'' that do not require advance authorization
for what is a central component of the mission and business of
not-for-profit providers.
Uses and Disclosures with Individual Authorization
This section contains one phrase that reveals the intent of
its authors: commercial gain. AHP could not agree more that
individuals have the right to refuse the release of protected
information that will result in commercial gain to the
requesting entity. No commercial gain is possible for not-for-
profit health care providers, and privacy standards must
distinguish between for-profit and not-for-profit entities.
The philanthropic programs of AHP members should be
considered an integral part of the provider's ``health
operations'' and thus be exempt from individual authorization.
That is the current practice, and AHP can attest to the fact
that its members hear only rare concerns which are quickly
resolved after they explain the health services, research, and
educational programs that are supported by philanthropy.
Aside from the inappropriateness of applying this standard
to not-for-profit health care providers, the proposed
authorization form is onerous and counterproductive. Picture a
patient in serious condition, being admitted to a hospital,
being handed all the usual forms and one asking for permission
to solicit contributions at a later date. A hospital with a
form like this would be showing very little sensitivity to the
patient and would likely receive no gift at a later date, even
if the patient were grateful for the medical treatment
received.
Introduction to Rights of Individuals
AHP supports the rights of individuals as delineated in the
proposed regulations and assures the Secretary that its members
swear to respect those rights through the AHP Statement of
Professional Standards and Conduct.
Rights and Procedures for a Written Notice of Information
Practices
AHP believes that the health services, research, and
educational programs supported by the philanthropy programs of
not-for-profit health care providers are an integral part of
``health operations'' and should be treated as such in this and
other sections of the final regulations.
Rights and Procedures for Access for Inspection and Copying
AHP believes that the health services, research, and
educational programs supported by the philanthropy programs of
not-for-profit health care providers are an integral part of
``health operations'' and should be treated as such in this and
other sections of the final regulations.
All of AHP's comments are offered with the sincere appeal
that the new regulations should be structured so as to take
into account the professional ethical standards already in
place. These regulations must allow for the continued work of
hospitals and health-related foundations in philanthropic
programs that benefit individuals and communities . . .
benefits which, if lost, would be severely detrimental to the
quality of life. AHP looks forward to working with the
Department in order to preserve the charitable fund-raising
activities of not-for-profit health providers while respecting
an individual's appropriately limited individually identifiable
health information.
We appreciate the opportunity to comment on the proposed
standards. More importantly, we look forward to actively
assisting the Department in developing protective patient
medical record regulations while safeguarding our non-profit
providers' obligation to meet their charitable purposes and
fully serve their patients.
Professional Standards and Conduct from Association for Healthcare
Philanthropy
Association for Healthcare Philanthropy members represent
to the public, by personal example and conduct, both their
employer and their profession. They have, therefore, a duty to
faithfully adhere to the highest standards and conduct in:
I. Their promotion of the merits of their institutions and
of excellence in health care generally, providing community
leadership in cooperation with health, educational, cultural,
and other organizations;
II. Their words and actions, embodying respect for truth,
honesty, fairness, free inquiry, and the opinions of others,
treating all with equality and dignity;
III. Their respect for all individuals without regard to
race, color, sex, creed, ethnic or national identity, handicap,
or age;
IV. Their commitment to strive to increase professional and
personal skills for improved service to their donors and
institutions, to encourage and actively participate in career
development for themselves and others whose roles include
support for resource development functions, and to share freely
their knowledge and experience with others as appropriate;
V. Their continuing effort and energy to pursue new ideas
and modifications to improve conditions for, and benefits to,
donors and their institution;
VI. Their avoidance of activities that might damage the
reputation of any donor, their institution, any other resource
development professional or the profession as a whole, or
themselves, and to give full credit for the ideas, words, or
images originated by others;
VII. Their respect for the rights of privacy of others and
the confidentiality of information gained in the pursuit of
their professional duties;
VIII. Their acceptance of a compensation method freely
agreed upon and based on their institution's usual and
customary compensation guidelines which have been established
and approved for general institutional use while always
remembering that: any compensation agreement should fully
reflect the standards of professional conduct; and, antitrust
laws in the United States prohibit limitation on compensation
methods;
IX. Their respect for the law and professional ethics as a
standard of personal conduct, with full adherence to the
policies and procedures of their institution;
X. Their pledge to adhere to this Statement of Professional
Standards and Conduct, and to encourage others to join them in
observance of its guidelines.
A Donor Bill of Rights
Philanthropy is based on voluntary action for the common
good. It is a tradition of giving and sharing that is primary
to the quality of life. To assure that philanthropy merits the
respect and trust of the general public, and that donors and
prospective donors can have full confidence in the not-for-
profit organizations and causes they are asked to support, we
declare that all donors have these rights:
I. To be informed of the organization's mission, of the way
the organization intends to use donated resources, and of its
capacity to use donations effectively for their intended
purposes.
II. To be informed of the identify of those serving on the
organization's governing board, and to expect the board to
exercise prudent judgment in its stewardship responsibilities.
III. To have access to the organization's most recent
financial statements.
IV. To be assured their gifts will be used for the purposes
for which they were given.
V. To receive appropriate acknowledgment and recognition.
VI. To be assured that information about their donations is
handled with respect and with confidentiality to the extent
provided by law.
VII. To expect that all relationships with individuals
representing organizations of interest to the donor will be
professional in nature.
VIII. To be informed whether those seeking donations are
volunteers, employees of the organization or hired solicitors.
IX. To have the opportunity for their names to be deleted
from mailing lists that an organization may intend to share.
X. To feel free to ask questions when making a donation and
to receive prompt, truthful and forthright answers.
Developed by American Association of Fund Raising Counsel
(AAFRC) Association for Healthcare Philanthropy (AHP) Council
for Advancement and Support of Education (CASE) National
Society of Fund Raising Executives (NSFRE). Endorsed by (in
formation) Independent Sector National Catholic Development
Conference (NCDC) National Committee on Planned Giving (NCPG)
National Council for Resource Development (NCRD) United Way of
America
Statement of Association of American Medical Colleges
The Association of American Medical Colleges (AAMC) is
pleased to submit its views on the Department of Health and
Human Services Notice of Proposed Rulemaking (NPRM) ``Standards
for Privacy of Individually Identifiable Health Information.''
The AAMC represents this nation's 125 accredited medical
schools, approximately 400 major teaching hospitals and health
care systems, and 91 academic and professional societies
representing over 75,000 faculty members. Our members and
institutions provide basic and specialized healthcare services,
conduct research leading to the discovery of medical knowledge
and the development of innovative treatments and therapies, and
educate and prepare physicians to meet evolving health care
needs. Whether in utilizing health information in treating
patients, educating future physicians, or conducting clinical
research ranging from the etiopathogenesis of disease,
translation and clinical trials to studies in epidemiology,
prevention and health services, the AAMC is keenly aware of the
need to protect the privacy of individuals and the
confidentiality of individually identifiable health
information.
The AAMC strongly believes that the only comprehensive and
nationally coherent solution to the complex and emotionally
charged problems of ``medical information privacy'' lies in
federal legislation, and we have steadfastly supported the
enactment of such to strengthen the protection of individuals'
personally identifiable health information from inappropriate
disclosure and harmful misuse. Any legislation will require a
balancing between protecting individuals' health information
and allowing health care entities and providers reasonable
access to information that can be shared for purposes of
treatment, research, and education.
The NPRM's preamble articulates the department's concern
with its limited authority under the Health Insurance
Portability and Accountability Act (HIPAA) of 1996 and the
rationale for the stratagems it devised to craft regulations
with the broadest possible reach in the face of those
limitations, and it is punctuated with repeated calls for
federal legislation as the much preferred approach. These
points are important to understanding the structure, complexity
and potential impact of the regulations that have been
proposed. The preamble seeks frequent refuge in the principles
articulated in Secretary Shalala's thoughtful report to the
Congress in September 1997, entitled ``Confidentiality of
Individually Identifiable Health Information.'' At the time,
the AAMC expressed its strong general support of the
principles, while noting their ultimate acceptability would
turn on the details of their implementation, which the report
did not address. Given the complexity of the proposed
regulations, their substantial financial and administrative
costs, and the profound operational and behavioral changes that
they would impose at every level of the health care delivery
system, it is ironic to note that the relevant HIPAA authority
derives from the Administrative Simplification provisions of
the Act (Sections 261-264).
Although the AAMC appreciates the work the department has
invested in this NRPM, we have very serious reservations about
certain of the approaches and implementation steps. We fear
that they would impose unreasonable burdens and unwise
constraints on the day-to-day functioning of the health care
delivery system and the conduct of medical research. While
fully supporting the individual's right to privacy and
respecting the need for effective, systemic protections of the
confidentiality of individually identifiable health
information, we believe that some of the standards,
implementation requirements, and procedures imposed by this
NPRM would have real costs that far outweigh their theoretical
benefits. We believe that the NPRM requires major changes so
that it will reasonably protect the privacy of individually
identifiable health information without impeding the flows of
health information required for the care of patients, the
operations of the health care delivery system, or the conduct
of health research. In particular, the AAMC draws attention to
the following salient concerns:
Impact on Delivery of Health Care: The enactment
and implementation of any standards for medical information
privacy will impose enormous costs and administrative burdens
on the U.S. health care system. In this regard, any federal
regulations must be crafted with precision and with
understanding of and sensitivity to the complexity and
magnitude of the flows of individually identifiable health
information involved in the health care of patients.
Unfortunately, the AAMC finds that many of the proposed
provisions in the NPRM impose unreasonable burdens and unwise
constraints on the day to day functioning of the health care
delivery system. In particular, the AAMC believes the concepts
and applications of ``business partners,'' ``minimum
necessary,'' and ``de-identified protected health information''
are poorly devised and ill-conceived. In addition, the language
establishing a ``code of fair information practices'' with
respect to individual access, amendment, and correction of
protected health information (PHI) needs to be more carefully
tailored to the realities of the complex patterns and enormous
volumes of continuous health information traffic that are
necessary for the health care delivery system to function. We
urge the department to reconsider the proposed regulations in
the NPRM, which would unjustifiably and unnecessarily impede
the critical functions of the day-to-day operations of the
entire U.S. health care system.
Intrusion on Research: The AAMC strongly opposes
the approach taken in the NPRM to divide medical research
information into two broad classes, one ``related,'' the other
``unrelated,'' to treatment. HIPAA gives the HHS no authority
to regulate researchers. However, the NPRM attempts to do so by
regulating covered health care providers who are also
researchers. The AAMC finds this approach unnecessary and
poorly conceived. The distinction of research information
categories as described by the NPRM, in fact, would serve to
weaken the protections of confidentiality of research data that
are currently available, while imposing heavy burdens on
medical researchers, and would be of little or no benefit to
the safeguarding of individually identifiable health
information. Rather than separating research information that
is ``related or unrelated to treatment,'' the AAMC believes
that information obtained from research that is clinically
relevant to the care of the subject should be entered into the
individual's medical record. Thereby, the formal ``research
record'' would remain separate from the medical record. It is
the Association's strong position that research information and
clinical information can and should be maintained separately,
primarily to afford the research information a much higher
degree of security than can be afforded to clinical information
and medical records.
Impact on Common Rule: The attempt by the
department to regulate issues related to ``protected health
information'' (PHI) in research is problematic. In the NPRM's
preamble, the department notes that HIPAA gives HHS no
authority to regulate health researchers. Research involving
human subjects is already subject to the Common Rule. However,
the NPRM attempts to amend the Common Rule by adding four new
criteria to those already required of IRBs in consideration of
waiver of individual authorization. The AAMC strongly opposes
this effort at piece-meal modification of the Common Rule. The
Association is unaware of any credible evidence indicating that
protection of the confidentiality of PHI used in research is
not being adequately respected and protected by IRBs and
researchers working under the requirements of the existing
Common Rule. Moreover, with the imminent relocation and
reorganization of the OPRR in the Office of the Secretary and
formation of a new National Advisory Council for the new
Office, the scrutiny of human research subjects protections
underway by the NBAC, and similar studies being conducted by
the IOM, the department's approach is particularly untimely.
The AAMC strongly urges the department to abandon this ill-
advised approach and continue to regulate all research and
researchers identically under the provisions of the Common
Rule.
Preemption of State Law: The AAMC strongly
believes, and has consistently argued, that the workings of the
contemporary health care delivery system, the mobility of
American citizens, and the needs of medical research,
especially population-based research, all call for federal
legislation that would strongly preempt state law (with only
few limited exceptions for such things as public health
reporting) and establish a single, uniform national standard of
medical information privacy protection. The department does not
favor such ``strong'' preemption, and in any event asserts
correctly that it does not have authority under HIPAA to impose
it by regulation. The NPRM would establish a federal floor of
protections and would preempt only contrary provisions of state
laws that are less stringent than those imposed by the
regulation. It would thereby permit what is often described as
a patchwork of discordant state privacy laws of variable
effectiveness to remain in place. The NPRM's lengthy
disquisition on the interpretations of ``contrary to,'' ``less
stringent'' and ``more stringent'' underscores the confusion
and significant burdens that the lack of a single, preemptive
federal standard will place on covered entities whose
professional activities and business transactions increasingly
span state lines. The entities would have to comply not only
with the federal rule but with the more stringent provisions of
state law in every state in which they operated. The AAMC is
deeply concerned about the chaotic business climate and
extraordinary legal expenses that would result from the
imposition of this regulation, and fears that as it is
proposed, it will be unworkable. The AAMC would urge the
Secretary to conduct a state-by-state examination and certify
those state laws that she deems ``contary and more stringent
than'' the federal rules. All other state laws bearing on
medical information privacy would thereby be deemed to be
preempted by the new rule.
Although the AAMC appreciates the effort that the HHS has
invested in developing this proposal, the AAMC feels that many
of the standards in the NPRM would not in actual practice serve
to enhance protections of the privacy and confidentiality of
individuals proportionately to the burdens and complications
that they would impose on critical functions of the affected
entities. In several instances, the department has exceeded the
authority granted to it under HIPAA, a fact that underscores
the need for Congress to revisit this complex issue to ensure
that a system of protection of individually identifiable health
information is logical, coherent and nationally uniform, not
needlessly burdensome and costly, and will neither impede
health care delivery nor vital health research. While fully
supporting the individual's right to privacy and respecting the
need for effective, systemic protections of the confidentiality
of individually identifiable health information, the
implementation of the standards and procedures imposed by this
NPRM would have real costs that far outweigh their theoretical
benefits and would serve to deter legitimate and useful sharing
of information that may be vital for treatment, research and
medical education.
Statement of Jane M. Orient, M.D., Association of American Physicians
and Surgeons, Inc., Tucson, AZ
The Association of American Physicians and Surgeons (AAPS),
founded in 1943 to protect private medicine and the patient-
physician relationship, represents physicians in all
specialties nationwide.
Both Congress and the White House have expressed well-
founded concerns about the privacy of medical records. However,
proposed legislation, as well as the standards on ``the privacy
of individually identifiable health information'' recently
promulgated by the Department of Health and Human Services as
mandated by the Health Insurance Portability and Accountability
Act, would have an effect opposite to the stated intention of
protecting patient confidentiality. Both the proposed
regulations and various legislative proposals establish
procedures permitting and facilitating the disclosure of
information for which disclosure is now either prohibited or
practically impossible.
The objective of writing standards for the electronic
transmission of data has been subverted into a pretext for
changing the fundamental ethics of the patient-physician
relationship and the purpose of medical records.
In the tradition of Hippocrates, the physician serves the
patient, who trusts him to abide by the precept that ``All that
may come to my knowledge in the exercise of my profession or
outside of my profession or in daily commerce with men, which
ought not to be spread abroad, I will keep secret and never
reveal.'' The traditional medical record consists of the
physicians' notes and other data, such as laboratory reports,
related to the specific, narrow purpose of providing optimal
care to the individual patient. The actual information in the
record belongs to the patient, who traditionally has had
control over the dissemination of that information.
The proposed regulations overturn these basic principles.
The patient's right to refuse consent to release his records is
abrogated. All patients (or at least those who have any medical
records in electronic format) are thus required to serve
administratively determined societal objectives: ``health
services research'' as well as medical research; the detection
and prosecution of violations of any law, rule, or regulation;
monitoring physician compliance with practice ``guidelines--and
central allocation of resources. All of these are generally
irrelevant to and may actually be contrary to the best
interests of the patient. ``National priorities,'' undefined or
vaguely defined, are held, at the discretion of an
administrative agency, to override the individual's right to
liberty (as the liberty to seek care from a physician who
guards patients' privacy). Individual Fourth Amendment rights
are easily swept aside by assertion of a collective ``need.''
Vastly expanded administrative powers trump the requirement for
judicial procedure to obtain a search warrant.
While medical professionals will be placed in the dilemma
of violating their professional ethics or committing a federal
crime by not releasing data, they will also be held
responsible, under pain of prison and enormous fines, for
monitoring behavior of other entities with which they contract
but over which they have little control. Additionally, they
will be required to implement costly and onerous notification
and other paperwork requirements that actually provide no
meaningful patient protection.
In short, proposed rules and laws serve the interest of
expanded use rather than real protections. The expanded use may
serve some narrow special interests as well as regulators and
prosecutors but will be of very questionable medical or
scientific value, especially since accuracy will be compromised
by the withholding of sensitive information.
We recommend the following:
1. A moratorium on the proposed regulations. (Comments
submitted to HHS are appended.)
2. Legislation that embodies the following basic
principles:
a. The right of all Americans to seek medical treatment
outside of any medical insurance plan in which they may be
enrolled should be explicitly guaranteed especially (but not
exclusively) if the plan requires electronic data storage or
transmission as a condition of coverage.
2. Electronic data storage or transmission should require
the patient's explicit, fully informed consent before the data
are entered.
3. No medical professional may be required to perform any
act that violates his conscience as a condition of being
permitted to practice his profession or specialty.
4. Patients should have a cause of civil action against any
individual, including an agent of the government, who causes
him harm by the misuse of computerized data. To this end, any
electronic data processing system established under this Act
should include a mechanism for tracking all individuals who
access identifiable records.
Congress of the United States
House of Representatives
February 14, 2000
The Honorable Donna E. Shalala
Secretary of Health and Human Services
200 Independence Ave. SW
Washington, D.C. 20201
Dear Secretary Shalala:
We are writing to comment on the proposed rule on standards for
privacy of individually identifiable health information that was
published in the Federal Register on November 3, 1999.
We commend you for moving forward swiftly with this effort and for
the thorough and thoughtful discussion contained in the proposed rule.
Because Congress did not meet its self-imposed August 21, 1999,
deadline for passing medical privacy legislation, the proposed rule is
an important and necessary step toward addressing the pressing need for
health information privacy protections.
We believe that the proposed rule as a whole provides a solid
foundation of privacy protections that will improve our health care
system. It establishes strong privacy requirements while ensuring
access to health information for important public interest purposes
such as health research. However, several significant gaps in privacy
protection remain. Some gaps relate to statutory constraints on your
authority to regulate, including the lack of privacy restrictions
applicable to entities that receive individually identifiable health
information but are not covered by the rule and the lack of a private
right of action that would enable individuals to seek redress for
privacy violations. Other gaps include the exclusion from coverage of
certain entities that provide insurance coverage for health care
services, and the lack of sufficient restrictions on law enforcement
access to individuals' health information.
Congress should work to pass legislation that builds on the
proposed rule and addresses issues the proposed rule does not cover. We
have sponsored comprehensive medical privacy legislation that we
believe would accomplish these goals. We hope to continue to work with
you and other interested parties to promote the passage of meaningful
medical privacy legislation. In the meantime, we urge you to issue
final medical privacy regulations expeditiously, so that the public's
medical records are protected as soon as possible.
The following are our comments on specific aspects of the proposed
rule.
I. SCOPE
We agree with the approach discussed in the proposed rule's
``Applicability'' section to apply privacy protections to individually
identifiable health information that has been transmitted or maintained
electronically regardless of whether the information remains in
electronic form. One of the goals of Congress in enacting the 1996
Health Insurance Portability and Accountability Act (HIPAA) was to
provide for the establishment of an effective privacy protection system
for health information. A privacy protection policy that would deny
access to health information when it is on a computer, but allow access
once the information is printed off the computer onto paper or
discussed orally by those viewing the computer screen would leave
gaping holes in protection. To ensure a meaningful system of privacy
protection that is consistent with congressional intent, it is
appropriate and necessary to protect health information that has been
transmitted or maintained in electronic form even where the information
does not remain in electronic form.
Nevertheless, we are concerned that the protections set forth in
the proposed rule do not apply to health information that has never
been maintained or transmitted electronically. We agree with your
analysis that a primary concern of HIPAA was that computerization of
the health care system was increasing apprehension about electronic
dissemination of health information. Any comprehensive medical privacy
protection system, however, should ensure that individuals'
identifiable health information in any form will receive appropriate
privacy protections. It should not be legal to sell an individual's
health record for marketing purposes just because the record happens to
have been maintained only in paper form. We have reviewed your analysis
concluding that you have authority to apply your proposed rule to
records maintained solely in paper form and agree that you do have such
authority. We urge you to exercise your full authority and apply the
proposed rule to records maintained solely in paper form.
With respect to the scope of entities covered by the proposed rule,
we are concerned that, in the ``Definitions'' section, the proposed
rule excludes certain insurance entities such as auto insurers from the
definition of ``health plan'' (referencing 29 U.S.C. 1186(c), which has
been renumbered 29 U.S.C. 1191b(c)). Under the proposed rule, an auto
insurer that pays health care costs associated with an individual's
broken arm would not be subject to federal privacy restrictions
regarding the health records used in the payment transaction. At the
same time, a health plan that pays for treating the broken arm would be
subject to federal privacy restrictions regarding the records used in
the payment transaction. It does not make sense to make such a
distinction among insurers who are paying for health care, and we do
not believe that HIPAA mandates this distinction between insurers with
respect to medical privacy regulations. We urge you not to exclude the
types of insurance coverage listed in 29 U.S.C. 1191b(c) from the rule
when such coverage pays the cost of medical care.
Further, any comprehensive medical privacy law should apply privacy
protection requirements to all entities that obtain protected health
information. As you know, because statutory constraints limited the
proposed rule's applicability only to health plans, health care
providers, and health care clearinghouses, the proposed rule does not
reach a number of entities that obtain individuals' health information.
This means that, under the proposed rule, a health researcher could
obtain health information from a health care provider for health
research, and then disclose it to marketers or the individual's
employer with no restrictions. We will continue to press for the
passage of legislation which applies privacy protection requirements to
all appropriate entities.
II. GENERAL RULES
The proposed rule's sections entitled ``Introduction to General
Rules'' and ``Minimum Necessary'' set forth basic rules that are
essential to medical privacy protection. Any comprehensive medical
privacy law should prohibit the use or disclosure of individually
identifiable health information without the individual's authorization
or specific authorization by law. Medical privacy law should also
ensure that, where use or disclosure of such information is authorized,
entities take all reasonable steps to use non-identifiable (or de-
identified) health information instead of identifiable health
information. Further, medical privacy law should require that
identifiable information will be used and disclosed only to the minimum
extent necessary to accomplish the legitimate purpose for which it was
obtained. These ground rules establish clear presumptions that use and
disclosure of individually identifiable health information will be
limited and narrowly tailored to legitimate purposes. We are pleased
that the proposed rule includes provisions that reflect these
principles.
III. CONTENT OF AUTHORIZATION FORM
The proposed rule's section entitled ``Individual Authorization''
establishes necessary requirements for the content of authorization
forms. Authorization forms should contain sufficient information to
ensure that individuals can make informed authorization decisions. We
are concerned that individuals seeking health treatment are vulnerable
to requests from health care providers and others to authorize uses and
disclosures of their health information for purposes beyond treatment,
payment, and health care operations. Individuals in such a situation
should have a clear understanding that their treatment and payment are
not conditioned on providing authorizations to allow their health
information to be used for marketing, by their employers, or for other
purposes. Individuals also should be informed to the maximum extent
practicable about how their information would be used and disclosed
under the authorization.
It would be insufficient, for example, to seek an authorization
from an individual but to only describe to the individual generally
what uses and disclosures are legal. Rather, individuals should be
informed of the purposes for which the information is sought as well as
the proposed uses and disclosures of the information. In addition, the
authorization form itself should state that treatment and payment are
not conditioned on agreeing to the authorization. The proposed rule
includes such content requirements, and therefore we believe that the
authorization content required by the proposed rule will facilitate
informed consent.
IV. INDIVIDUAL RIGHTS
The proposed rule provides individuals with rights that are
integral to ensuring that they have appropriate information about and
involvement with their own health records. In the sections entitled
``Access for Inspection or Copying'' and ``Amendment or Correction,''
the proposed rule providesimportant rights that enable individuals to
access, copy, and correct their own records, so that individuals can
have a remedy when inaccurate information in their records is being
used in transactions that affect them. Further, the requirements in the
``Accounting of Disclosures'' and ``Notice of Information Practices''
sections that covered entities must provide individuals with a notice
of their information practices and the opportunity to review accounting
of certain disclosures are necessary to ensure that individuals have
appropriate information about the uses and disclosures that occur
regarding their own health records.
We request, however, that you review your decision not to include a
requirement that covered entities obtain a signed acknowledgment from
individuals stating that the individuals have received the notice and
been informed of their rights. Such a requirement, which is included in
H.R. 1941, legislation introduced by Mr. Condit, would enhance the
right to notice set forth in the proposed rule by encouraging
individuals to consider carefully their rights and the information
practices that affect them before providing their health information to
a covered entity. An alternative approach to encouraging individuals to
review and reflect on their medical privacy rights is to require that
individuals sign an authorization form before a covered entity may
disclose their health information for any purpose. This approach is
taken in H.R. 1057, legislation introduced by Mr. Markey.
We recognize the logistical questions you have raised regarding
exactly how signed acknowledgments should be provided, and the concerns
you discuss regarding requiring authorizations for treatment, payment,
and health care operations purposes. We are interested in and look
forward to reviewing the comments of relevant parties on these issues.
We urge you to continue to work to create optimal conditions for
ensuring that individuals engage in meaningful review of their privacy
rights and the information practices of covered entities, without
imposing inappropriate burdens on covered entities.
With respect to the section entitled ``Accounting of Disclosures,''
we believe that it is important to provide individuals with a means of
learning about disclosures that an entity has made of their health
information without imposing unnecessarily burdensome accounting
requirements on the entity. As you know, the proposed rule attempts to
balance these concerns by excluding treatment, payment, and health care
operations disclosures from the accounting requirements. The rationale
behind the proposed rule's effort to balance these concerns is
reasonable. We agree with the proposed rule's analysis that individuals
generally have the most interest in disclosures that they cannot easily
anticipate will be made with their health information.
However, the definitions of treatment, payment, and health care
operations cover a broad range of activities, from determination of
coverage, to billing, to utilization review, to disease management, to
reviewing the competence of health care professionals, among many other
activities. Given this breadth, individuals will not necessarily easily
anticipate that their health information will be shared for each type
of treatment, payment, and health care operations activity. Therefore,
we are concerned that the proposed rule may not provide individuals
with adequate means to learn about the disclosures that have been made
with their health information. Accordingly, we request that you
carefully review whether exclusion of all treatment, payment, and
health care operations disclosures from accounting requirements is
appropriate.
V. UNDERWRITING
It is our understanding that under current practice, insurers that
seek an individual's identifiable health information to conduct
underwriting generally first obtain an authorization from the
individual that delineates the uses and disclosures that the insurer
may make with the information, unless the underwriting activity
concerns an existing insurance contract. Several congressional medical
privacy proposals, however, contain broad language that would allow
insurers to obtain an individual's health information for
``underwriting'' without obtaining an individual's authorization. We
are aware of no good policy reason to encourage in a federal law a
change in current practice by allowing underwriting without the
patient's permission.
We therefore are pleased that the proposed rule makes clear, in the
section entitled ``Definitions,'' that insurers may obtain and use an
individual's identifiable health information for underwriting
activities without the individual's permission only> when the
individual is enrolled in the plan conducting the activities and the
activities concern an existing contract. We ask that you provide
clarification, however, on whether under the proposed rule,
authorization from the individual is required for underwriting activity
relating to a change in contract within the same health plan, and
whether the proposed rule diverges from current practice on this
specific issue.
VI. DISCLOSURES FOR HEALTH RESEARCH PURPOSES
Health research is critical to the effective operation of our
health care system. Medical privacy law should ensure both access to
data necessary for conducting health research and patient confidence in
the confidentiality of their health information. Accordingly, we
believe that, before individually identifiable health information is
disclosed for health research, a board independent from the entities
seeking or disclosing individually identifiable health information for
health research should review the research and determine that
appropriate privacy protections are in place. At the same time, there
should be a means of ensuring expedited review where research poses
minimal privacy threats. In the section entitled ``Research,'' the
proposed rule takes a significant step forward toward accomplishing
these goals by including requirements that incorporate elements of the
``Common Rule'' standards that currently apply to review of federally
funded research conducted by institutional review boards (IRBs).
With increased federal restrictions on access to medical records,
more and more entities seeking medical records are likely to claim that
they are engaged in research. Therefore, review committees internal to
such entities would likely face pressures to authorize disclosures that
will advance the entity's financial interests. The proposed rule's
requirements that no individual on the board reviewing the research can
have a conflict of interest with the research and that at least one
member of the board cannot be affiliated with the institution
conducting the research help address this concern. We believe, however,
that the proposed rule would be improved by also including a
requirement that the Secretary certify that such boards meet the rule's
criteria. This requirement, which is contained in H.R. 1941,
establishes a third party mechanism to ensure that board are capable of
exercising independent judgment. We urge you to incorporate this
requirement into the final rule.
It is worth noting that applying Common Rule standards to review of
privately funded research is consistent with the approach advocated in
recent testimony before the House Subcommittee on Health and
Environment of the Committee on Commerce by both members and chairs of
IRBs and representatives of individuals with serious health conditions
who have a tremendous personal stake in health research, such as the
National Breast Cancer Coalition and the National Organization for Rare
Disorders. These witnesses underscored that extending Common Rule
protections to all health research not only would be practicable but
would benefit health research. For example, Dr. Greg Koski, Director of
Human Research Affairs for Partners Health Care System in Boston, who
has served over 15 years as a member and chair of an IRB, stated that
applying Common Rule protections to privately funded research would
improve health research because ``by protecting human subjects and by
letting them know that we are putting their interests in the
appropriate priority, there will be a greater willingness to
participate in research.'' He also noted that additional guidance
regarding specific mechanisms for confidentiality protection should be
set forth for IRBs.
VII. LAW ENFORCEMENT
The provisions in the proposed rule's section entitled ``Law
Enforcement'' do not establish sufficient privacy assurances to
individuals. We believe that, except in emergency circumstances,
disclosure of an individual's health records to law enforcement
officials should only occur pursuant to a warrant, or if the individual
has received notice of the proposed disclosure and has had an
opportunity to challenge the disclosure. Such an approach, which is set
forth in H.R. 1941, ensures that law enforcement officials do not have
unchecked discretion to determine the necessity of obtaining
individuals' health records. The proposed rule does not meet this
standard, as it allows for disclosure of an individual's personal
information to law enforcement officials pursuant to a range of
procedures, including a grand jury subpoena, without any neutral third
party review or notice to the individual.
VIII. JUDICIAL AND ADMINISTRATIVE PROCEEDINGS
We are concerned that the proposed rule, in the provisions entitled
``Judicial and Administrative Proceedings,'' would allow the disclosure
of an individual's health information for a judicial or administrative
proceeding simply on the basis of a request from an agency or a counsel
representing a party in the proceeding, if the individual's health is
at issue in the proceeding. Individuals whose information is the
subject of such a request should have notice of the request and an
opportunity to challenge the request. We ask that you revise the
proposed rule to include this requirement.
IX. ENFORCEMENT
No matter how strong federal privacy protections may be, they will
be difficult to enforce unless individuals have the right to seek
redress for privacy violations. A private right of action is an
essential enforcement tool because the government is not likely to
pursue civil sanctions for individual violations. Enforcement through
criminal sanctions is also insufficient since prosecutions are brought
selectively and face a high standard of proof. Every major privacy bill
Congress has enacted, including the Fair Credit Reporting Act, the
Cable Communications Policy Act, the Electronic Communications Privacy
Act, the Video Privacy Protection Act, and the Right to Financial
Privacy Act, has contained a private right of action. We understand
that you did not have the authority to provide for a private right of
action, and we will continue to press to ensure that Congress passes
medical privacy legislation that contains this crucial enforcement
tool.
X. PREEMPTION
We are pleased that, consistent with the framework set forth in
HIPAA, the proposed rule would not preempt state laws that provide
greater privacy protections than those in the proposed rule. Setting a
federal floor is important because it gives states the ability to enact
stronger state privacy laws in those circumstances where they want to
address issues of particular concern to their citizens. For example,
some states have enacted privacy laws to encourage individuals to get
tested or treated for communicable diseases, alcohol and drug abuse,
and other conditions. The ``floor'' approach also allows states the
flexibility to protect their citizens regarding specific health crises
or concerns that we cannot predict at this time. We will continue to
work to ensure that any medical privacy legislation enacted by Congress
establishes a federal floor.
We recognize that there may be questions in some instances as to
whether an individual state law is more protective than the federal
law. H.R. 1941 provides a mechanism for addressing such questions by
requiring the Secretary to give advisory opinions as to whether a state
law is more protective. We are pleased that, in the section entitled
``Relationship to State Laws,'' the proposed rule provides a similar
mechanism by allowing states to request an advisory opinion. We
believe, however, that any person, not just states, should be able to
seek such an opinion, and urge you to revise the proposed advisory
opinion process to allow for such requests.
We strongly believe that state laws that provide greater
protections than the proposed rule should not be preempted. We are
concerned, however, about the provision in the proposed rule which
states that the Secretary may determine that the proposed rule will not
preempt a state law if that state law is necessary for ``the efficiency
and effectiveness of the health care system.'' Depending on how it is
interpreted, this vaguely worded provision could allow a broad range of
state laws that are less protective than the proposed rule to stand. We
request that you revise this provision to ensure that it does not
become a wide loophole for avoiding the proposed rule's requirements.
XI. CESSATION OF OPERATIONS
We are concerned that the proposed rule does not clearly address
whether privacy protections would apply to health records maintained by
a covered entity once that entity has ceased to do business. We urge
you to ensure that health records have appropriate protections in such
circumstances, as suggested in H.R. 1941 and as envisioned in H.R. 307,
legislation introduced by Mr. Towns.
XII. CONCLUSION
The proposed rule not only establishes a strong foundation of
privacy protections, but it presents ideas and arguments that enhance
the debate among parties interested in medical privacy policy. We look
forward to reviewing the comments of others on the proposed rule and
your response to our comments. We will work to ensure that Congress
acts to pass legislation that incorporates the important privacy
protections included in the proposed rule and addresses areas that
require further protection.
Sincerely,
Members of Congress
Gary A. Condit
Henry A. Waxman
Edward J. Markey
John D. Dingell
Sherrod Brown
Edolphus Towns
David E. Bonior
Major R. Owens
Patsy T. Mink
Gene Green
Barney Frank
Lucille Roybal-Allard
Paul E. Kanjorski
Albert Russell Wynn
Fortney Pete Stark
Lynn C. Woolsey
William D. Delahunt
Mike Thompson
John F. Tierney
Carlos A. Romero-Barcelo
Jim McDermott
Janice D. Schakowsky
Neil Abercrombie
Eleanor Holmes Norton
Carolyn B. Maloney
Harold E. Ford, Jr.
John Joseph Moakley
James P. McGovern
Dennis J. Kucinich
Ellen O. Tauscher
Sam Farr
Benard Sanders
cc: U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attention: Privacy-P, Room G-322A
Hubert Humphrey Building
200 Independence Avenue, SW
Washington, DC 20201
February 16, 2000
The Honorable Secretary Donna E. Shalala
Secretary of Health and Human Services
200 Independence Avenue, SW
Washington, D.C. 20201
Dear Secretary Shalala:
We are writing regarding the proposed rule on standards for privacy
of individually identifiable health information that was published in
the Federal Register on November 3, 1999. We want to associate
ourselves with the comments on the proposed rule that were set forth in
the February 14, 2000 letter to you from Representatives Gary A.
Condit, Henry A. Waxman, Edward J. Markey, John D. Dingell, and 28
other colleagues.
Protecting the privacy of medical records is integral to the
effective operation of our health care system. We appreciate your
efforts on this important issue and we look forward to continuing to
work with you, our colleagues, and others to advance appropriate and
comprehensive medical privacy protections.
Sincerely,
Members of Congress
Gerald D. Kleczka
Donna Christian-Christensen
Tom Lantos
Louise Slaughter
cc: U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attention: Privacy-P, Room G-322A
Hubert Humphrey Building
200 Independence Avenue, SW
Washington, DC 20201
Statement of the Consortium for Citizens with Disabilities
I. General Privacy Concerns
The Consortium for Citizens with Disabilities (CCD) is a
Washington-based coalition of approximately 100 national
disability, consumer, advocacy, provider and professional
organizations that advocate on behalf of 54 million children
and adults with disabilities and their families in the United
States. As advocates for people with disabilities, CCD supports
strong privacy protections that give health care consumers
confidence that their information will be used appropriately
and that permit the continued viability of medical research and
delivery of quality health care.
All persons who receive health care services have reason to
be concerned with the inappropriate use of highly personal
information that is collected about them within the health care
system. As a coalition representing people living with
disabilities, however, CCD's views on this issue are somewhat
unique. Because people with disabilities have extensive medical
records and sometimes stigmatizing conditions, such individuals
feel a particular urgency to ensure that proper privacy
protections are in place. At the same time, many people with
disabilities interact almost daily with the medical
establishment and thus benefit from a well-run, effective
health care system. Such individuals do not want privacy
protection to reduce the effectiveness of the health care
system they must navigate.
CCD has been actively involved in the medical privacy
debate, and believes that the desire for medical privacy and
the desire for an effective health care system are neither in
conflict with each other, nor do they require ``balancing'' of
one interest against another. Rather, establishing privacy
protection can enhance the operation of the health care system,
by increasing individuals' trust and confidence in that system.
A national survey released in January 1999 found that one in
six Americans engages in some form of ``privacy protective
behavior'' because he or she is afraid of confidentiality
breaches regarding sensitive medical information. These
activities include withholding information from health care
providers, providing inaccurate information, doctor-hopping to
avoid a consolidated medical record, paying out of pocket for
care that is covered by insurance, and-in some cases-avoiding
care altogether.\1\ None of this is good for either consumers
or the health care system.
---------------------------------------------------------------------------
1 California Healthcare Foundation, National Survey:
Confidentiality of Medical Records (January 1999). The survey was
conducted by Princeton Survey Research Associates. Results are
available at www.chcf.org/conference/survey.crfm.
II. General Approach of the Proposed Regulations
CCD applauded the President and the Secretary's action to
release the proposed rule. After reviewing the proposal, we
continue to believe that the Department of Health and Human
Services' efforts hold the potential to significantly increase
privacy protections, and equally important, provide people new
assurances that their deeply personal medical information will
be used appropriately. We also believe that the proposal
provides an important foundation for Congress to build upon in
protecting privacy and maintaining quality health care. We are
particularly pleased that the proposed rule would not pre-empt
more protective state laws and acknowledges that people with
disabilities and other sensitive conditions may need special
protections (such as through the handling of psychotherapy
notes). We are also pleased that the proposed rule requires
covered entities to contract with business partners and name as
third party beneficiaries individuals whose protected health
information is used or disclosed. We commend the Secretary for
proposing that individuals be permitted to access and copy
their health information. We are also pleased that the
Secretary acknowledges the continued need for federal
legislation to fill gaps the Secretary did not have authority
to cover under the Health Insurance Portability and
Accountability Act of 1996 (HIPAA).
While we acknowledge the leadership of the President and
Secretary in moving the process forward, we have found areas in
the proposed rule that we find unworkable or that need
bolstering.
III. The Secretary's Authority Under HIPAA
The delegation under HIPAA limited the Secretary's
authority in three important areas. The Secretary only had
authority to cover health plans, health clearinghouses and
certain health care providers, and information transmitted or
maintained electronically. HIPAA also did not provide a private
right of action for individuals whose health information has
been improperly used or disclosed. We encourage Congress to
enact legislation to fill these gaps.
A. Covered Entities
While the Secretary covered entities permitted under HIPAA,
unfortunately, many entities (such as life insurers, employers
and marketing firms) that receive, use and disclose protected
health information are not required to comply with the
regulations. We believe that directly covering these entities
is necessary to adequately protect patient privacy. While we
believe that entities who receive information should be
directly covered at the federal level, we commend the Secretary
for acting within the limits of HIPAA and constructing the
business partner rules to cover entities who regularly use and
disclose protected health information.
B. Covered Information
As part of administrative simplification, HIPAA limited the
Secretary's authority to protect only information transmitted
or maintained electronically. While the Secretary discusses her
authority at length, we are concerned that people with
disabilities may be reluctant to seek care or to honestly
discuss sensitive health conditions if all of their health
information is not confidential. Privacy is especially
important to people with disabilities because they may have
stigmatizing conditions which, if disclosed, could result in
discrimination and embarrassment. Because of the complexity of
the health care system, most patients will never know what
information, if any, is stored electronically. Even if patients
are able to determine what information is maintained
electronically, they will likely fear that some portion is in
paper format. Without privacy protection for all health
information, people with disabilities will be reluctant to
discuss their condition. We know that this leads to bad health
outcomes and, in some cases, would cause people to forego
medical care entirely. The only way to ensure patient
confidence in the health care system is to make the proposed
rule applicable to all information.
C. Private Right of Action
Under the proposed rule, individuals whose protected health
information has been improperly used or disclosed will have no
recourse. While we recognize that the Secretary did not have
authority under HIPAA to create a private right of action, we
strongly believe that Congress should enact legislation to fill
this important gap. Many federal privacy statutes have private
right of action provisions including the Privacy Act of 1974 (5
U.S.C. 552a), Electronic Communications Privacy Act (18 U.S.C.
2701 et seq.), Right to Financial Privacy Act (12 U.S.C. 3401
et seq.), Fair Credit Reporting Act (15 U.S.C. 1681 et seq.),
Cable Communications Act (47 U.S.C. 551), Videotape Privacy
Protection Act (18 U.S.C. 2710) and the Driver's Privacy
Protection Act (18 U.S.C. 2721 et seq.).
IV. Important Areas Where the Regulation Could Be Improved
While we have many concerns with the proposed rule, we
believe that the rule provides greater protections than exist
today and is an important foundation upon which to build. While
we have submitted comprehensive comments to the Secretary, we
have highlighted five important areas for people with
disabilities, and believe, at a minimum, the following changes
are necessary: (1) require covered entities to obtain a written
authorization prior to using or disclosing protected health
information for treatment, payment and health care operations,
(2) require entities to obtain authorization prior to
communicating with the individual about sensitive health
conditions, (3) require covered entities to first determine
whether de-identified information can be used to accomplish the
purpose of the use or disclosure, (4) prohibit disclosure of
protected health information for law enforcement purposes
without a warrant from a neutral judicial officer, and (5)
extend protections of the regulations to all individually
identifiable health information.
A. Signed Authorization for Treatment, Payment and Health
Care Operations
(Section 164.506 Uses and disclosures of protected health
information: general rules)
The proposed rule permits covered entities to use and
disclose protected health information for treatment, payment
and health care operations without individual authorization. A
signed authorization from the individual is extremely
important. This issue was addressed at length by the Health
Privacy Working Group, a panel comprised of diverse
stakeholders including disability and mental health advocates,
health plans, providers, employers, standards and accreditation
representatives, and experts in public health, medical ethics,
information systems and health policy. See Best Principles for
Health Privacy, a Report of the Health Privacy Working Group
(July 1999). This diverse group noted that, as a general rule,
requiring patient authorization prior to disclosure can:
bolster patient trust in providers and health care
organizations by acknowledging the patient's role in health
care decisions;
serve as recognition that notice was given and the
patient was aware of the risks and benefits of disclosure; and
define an ``initial moment'' in which patients can
raise questions about privacy concerns and learn more about
options available to them.
We find the Secretary's proposed rule extremely troublesome
because it does not require patient authorization, and in fact,
prohibits covered entities from obtaining authorizations unless
required by State law. Unless the current regulatory
authorization for treatment, payment and health care operations
is modified, CCD would oppose implementation of this rule. In a
world of managed care, the Administration and many health and
consumer interests have been dedicated to shifting popular
culture to embrace the concept of the ``empowered patient.''
Many observers believe that the best way to make managed care
work is for patients to become self-advocates, active in
working the system so they get the care they need. Dismantling
the current authorization system runs counter to this approach.
The Secretary's approach disempowers patients by taking away
their ability to actively control access to their own protected
health information.
Patients should be encouraged to be active participants in
their own health care-and the authorization process should be
an integral piece of that picture. A signed authorization
provides a unique opportunity for the individual to understand
the uses and disclosures of her health information. This
process will increase individual awareness of the risks and
benefits of such uses and disclosures. While the Secretary
states that individuals are not likely to know ``all the
possible uses, disclosures, and re-disclosures to which their
information will be subject,'' individuals should be informed,
to the extent practicable, of how information will be used and
to whom it may be disclosed. See 64 Fed. Reg. 59918, 59940
(Nov. 3, 1999). A signed authorization will give individuals an
opportunity to review the authorization and create an ``initial
moment'' in which the patient can address her privacy concerns.
When discrepancies between an individual's privacy concerns and
the covered entity's use and disclosure of information arise,
the signed authorization will provide an opportunity for the
individual to ask questions about how her information will be
used and disclosed.
The Secretary states three reasons for not adopting a
signed authorization approach: (1) authorizations provide
individuals with little actual control over their health
information, (2) consent is often not voluntary because the
individual must sign the form as a condition of treatment or
payment, and (3) individuals are often asked to sign broad
authorizations but are provided little or no information about
how their health information will be used. 64 Fed. Reg. 59918,
59940 (1999).
We find the Secretary's rationale troubling. The Secretary
has the authority to improve the current authorization process
but states current problems as the reason not to empower
patients. Even if the Secretary chooses not to empower
patients, her rationale that authorizations provide individuals
with little actual control and consent is often not voluntary
does not consider the importance of the ``initial moment.'' As
discussed above, this moment gives individuals the chance to
learn about the use and disclosure of her information and ask
questions, voice concerns or negotiate, if possible. The
Secretary's rationale also fails to consider the reality of
receiving medical treatment for sensitive conditions. We know
that for stigmatizing conditions, such as HIV or sexually
transmitted diseases, individuals exercise control by foregoing
treatment or choosing to self-pay for specific services under
an assumed name. Authorizations would help these individuals
learn more about the use and disclosure of their information so
they can feel comfortable receiving treatment and providing
accurate information to providers.
Because many covered entities currently obtain signed
authorizations, there would be little, if any, additional
administrative burden. See 64 Fed. Reg. 59918, 59940 (1999). We
see no reason to reduce current protections afforded to
consumers. As covered entities increase communications with
individuals, provide individuals with opportunities to
understand how their information is being used and disclosed,
and allow individuals to negotiate, individuals will feel that
they have more control over their health care decisions. These
simple but important changes will likely improve the public's
perception of the health care system.
B. Individual Authorization for Sensitive Health Conditions
(Section 164.508 Uses and disclosures for which individual
authorization is required)
Requiring entities to obtain authorization from an
individual before communicating with the individual about
sensitive health conditions is also very important. People with
disabilities who seek sensitive health care services have
heightened concern that their medical condition or treatment
may be inadvertently disclosed to others such as roommates,
house mates, family members, neighbors, employers or others who
may want to cause harm.
Covered entities should be required to protect against
inadvertent disclosures of protected health information
concerning sensitive health care services [defined as services
relating to reproductive health, sexually transmissible
diseases (whether or not transmitted in any particular case),
substance abuse, or mental health] by obtaining the
individual's authorization prior to communicating with the
individual (or the policyholder).
Sensitive health care services often involve the most
personal health care decisions. Individuals with sensitive
health conditions face unique confidentiality concerns because
they are the most likely to suffer discrimination or
stigmatization associated with such conditions. It is very
important that people with disabilities who have sensitive
conditions be able to control where and how information about
sensitive conditions is communicated to them. For example, a
person living with HIV may want to ensure that a covered entity
does not send any information about health services to her work
address because she fears her employer or co-worker may
discriminate against her.
We believe that covered entities should be required to
obtain authorization from the individual prior to all
communications with the individual regarding sensitive health
care services. All communications with the individual should be
protected because it is very difficult to determine exactly
where in the chain of communication an individual's information
could result in stigmatization, discrimination, retaliation or
other harm.
The Secretary acknowledged in her prefatory language that
covered entities already have the ability to implement and
track patient authorizations. 64 Fed. Reg. 59918, 59946 (1999).
Furthermore, the regulations require authorizations for (1)
uses and disclosures other than treatment, payment and health
care operations, (2) uses and disclosures of psychotherapy
notes, and (3) uses and disclosures for research unrelated to
treatment. Because an authorization framework is in place, we
do not believe that an authorization for sensitive health
conditions would be a significant burden.
C. De-identified Information
(Section 164.506(b)(1) Standard: minimum necessary)
We strongly believe that entities should first be required
to determine whether de-identified information can be used or
disclosed to accomplish the intended purpose. While we agree
with the Secretary's general approach that entities use or
disclose only the minimum amount necessary, we believe that a
clear statement that entities must first consider de-identified
information is the only way to ensure that the minimum amount
standard is adequately implemented.
Requiring entities to use and disclose de-identified
information will help ensure that only the minimum amount will
be used. Presumably, de-identified information is part of the
minimum amount necessary evaluation. While proposed section
164.506(d) defines de-identified protected health information,
it is unclear when, if at all, an entity must use de-identified
information.
We believe that a de-identified requirement is consistent
with the Secretary's proposed minimum amount requirement. In
fact, in the prefatory language to the minimum amount
requirement, the Secretary notes that stripping individually
indentifiable information of identifiers is currently used for
analytical, statistical and research purposes. 64 Fed. Reg.
59918, 59946 (1999).
While the Secretary states that section 164.506(d) is
intended to permit important research to continue, certainly
there are benefits to requiring all covered entities to
consider de-identified information. Requiring entities to
consider de-identified information will limit the ability of
all recipients to link the information to individuals.
D. Law Enforcement
(Section 164.510(f) Disclosures for law enforcement
purposes)
We are also very concerned about the Secretary's proposed
section 164.510(f). Under the proposed rule, people with
disabilities may have their health information disclosed to law
enforcement officials without any legal process. We urge the
final regulation require law enforcement to obtain legal
process-such as a warrant or court order-that is judicially-
approved after application for a Fourth Amendment probable
cause standard.
These same requirements exist in other federal privacy
statutes protecting peoples' communications, cable subscriber
records and even video rental lists. None of these laws are
absolute bars to law enforcement access. The procedural
safeguards ensure that accountability and oversight prevent
unwarranted and unjustified abuse of authority.
E. Paper Records
(Section 164.502 Applicability)
As discussed above, as part of administrative
simplification, the Secretary's authority was limited to
information electronically maintained or transmitted. We are
concerned that people with disabilities may be reluctant to
seek care or honestly discuss their health condition if all of
their health information is not confidential. Privacy is
especially important to those with disabilities because if
information about their disability or condition is disclosed
they may suffer discrimination, embarrassment or
stigmatization. Because of the complexity of the health care
system, most patients will never know what information, if any,
is stored electronically. Even if patients are able to
determine what information is maintained electronically, they
will likely fear that some portion is in paper format. Without
privacy protection for all health information, persons with
disabilities may not disclose their health condition. The only
way to ensure patient confidence in the health care system is
to make the proposed rule applicable to all information.
IV. Conclusion
We believe that the proposed rule provides an important
foundation to protect patient privacy and maintain quality
health care. We commend the Secretary for not preempting more
protective state laws, acknowledging that sensitive information
needs special protection, constructing business partner rules
and permitting individuals to inspect and copy their health
information. We encourage Congress to enact legislation to
build upon these important regulations and to fill gaps left by
HIPAA.
Statement of the Family Violence Prevention Fund, San Francisco, CA
I. General Privacy Concerns
The Family Violence Prevention Fund (FVPF) is a leading
national organization that advocates on behalf of the millions
of women and children who are victims of domestic violence each
year. The FVPF runs several major programs that deal
specifically with health care and its response to domestic
violence, including the national resource center on health care
and domestic violence. As advocates for domestic violence
victims, the FVPF supports strong privacy protections that will
give victims confidence that their personal information will be
used appropriately.
Almost onethird of American women report being a victim of
domestic violence at some point in their lives. The health care
system is playing an increasingly important role in responding
to battered women by identifying and documenting abuse and
connecting victims with domestic violence advocates and
services. Privacy of health information is critical to the
safety and wellbeing of millions of women and children who
suffer harm from domestic violence and abuse each year. Strong
privacy protections that take into consideration the concerns
of domestic violence victims will encourage victims to discuss
their injuries and feel safe knowing that their information
will remain confidential.
A victim is often concerned about privacy because she fears
that her perpetrator will discover that she has discussed the
abuse with her provider. A perpetrator who learns that his
victim has told her provider about the domestic violence could
resort to further abuse. Because victims fear that their health
information will not remain confidential, many may be reluctant
to discuss the violence openly and honestly.
In order to protect victims, many providers do not document
domestic violence because they also fear the perpetrator could
access the victim's health information and cause additional
harm. Providers who discover but do not document domestic
violence run the risk that later treating providers will not
know the history of violence and misdiagnose the victim.
Providers who do not document violence could also reduce the
victim's chance of success in legal proceedings against her
perpetrator. A complete medical record that fully documents
injuries and subsequent health complications from the abuse can
be introduced as compelling evidence to corroborate the
victim's testimony. Without this corroborative evidence,
victims would need to introduce other, less persuasive evidence
which could hinder the victim's chance of success. Providers
who know that information will remain confidential are more
likely to engage the patient, encourage the patient to discuss
violence openly and feel comfortable providing a complete
record.
For a victim who chooses to be open and honest, privacy
concerns only begin when she discusses the violence with her
provider. Any communication with the victim at home, including
a bill, email or telephone call to confirm an appointment,
increases the likelihood that the perpetrator will intercept
the information. Individuals who are concerned about their
safety should be permitted to give providers a telephone number
and address where the victim feels comfortable that the
perpetrator will not discover that she has sought treatment.
While the Secretary's proposed regulations are an important
foundation and include some measures of protection for victims
of domestic violence they fall short of providing the level of
privacy safeguards that are necessary to protect victims. We
have submitted comprehensive recommendations to the Secretary
which we believe are essential for improving the health care,
safety and well-being of domestic violence victims. Without
these protections, victims of domestic violence will receive
inadequate health care services, be less able to pursue
effective legal recourse, and potentially be exposed to further
violence.
II. The Proposed Regulations
The FVPF believes that the Secretary's proposed regulations
have the potential to improve the quality of care for victims
of domestic violence by establishing an important foundation
that personal medical information will remain confidential.
This assurance of confidentiality will likely encourage victims
to seek treatment and promote open and honest communication
between doctor and patient.
We are particularly pleased that the proposed regulations
provide individuals access to their own health information,
require notice to patients of confidentiality practices and do
not preempt more protective state laws. We commend the
Secretary for constructing business partner rules which require
covered entities to contract with business partners to whom
protected health information is disclosed. We also commend the
Secretary for acknowledging the continuing need and importance
of comprehensive federal legislation.
III. The Secretary's Authority Under HIPAA
Under HIPAA, the Secretary only had authority to cover
health plans, health clearinghouses and certain health
providers. The Secretary's authority as part of administrative
simplification was also arguably limited to electronically
stored or transmitted information and did not include the
authority to establish a private right of action. While we
believe that the regulations provide an important foundation
for privacy protections, we strongly encourage Congress to fill
the gaps left by HIPAA.
A. Covered Entities
Acting under the delegation in HIPAA, the Secretary's
regulations fall short of covering all entities that receive,
use and disclose protected health information. Legislation is
needed to protect information received by all entities such as
insurance companies, marketing firms and employers. Without
covering these entities, victims of domestic violence could be
subject to discrimination if an insurance company or employer
were to use the information improperly.
B. Covered Information
While administrative simplification under HIPAA arguably
limited the Secretary's authority to cover only electronic
information, we believe that privacy protections should include
all protected health information. By protecting only electronic
information, the same concerns about patient confidence that
exist today will continue, and many patients will remain
reluctant to discuss sensitive health information, even for
treatment. Because of the complexity of the health care system,
most patients will never know what information if any, is
stored electronically. We are especially concerned that many
domestic violence victims will continue to hide the real cause
of their injuries because they fear for their safety. Even if
patients are able to determine what information is maintained
electronically, they will likely fear that some portion of the
information is in paper format.
C. Enforcement and Private Right of Action
HIPAA only permitted the Secretary to impose civil and
criminal penalties for violating privacy standards. In order to
provide basic privacy protections afforded to individuals under
other federal privacy statutes, Congress should enact
legislation that permits individuals to bring a private right
of action.
The civil and criminal penalties in HIPAA are not
sufficient to ensure that those who inappropriately use or
disclose information or fail to adopt adequate safeguards
comply with the regulation. We are concerned that Congress has
not recognized the need for a private right of action with
regard to medical information. Many other federal privacy laws
have private right of action provisions such as the Privacy Act
of 1974 (5 U.S.C. 552a), Electronic Communications Privacy Act
(18 U.S.C. 2701 et seq.), Fair Credit Reporting Act (15 U.S.C.
1681 et seq.), Cable Communications Act (47 U.S.C. 551),
Videotape Privacy Protection Act (18 U.S.C. 2710) and the
Driver's Privacy Protection Act (18 U.S.C 2721 et seq.).
Certainly, highly personal health information deserves the same
protections afforded to other information.
IV. Brief Summary of Recommended Changes to the Proposed Rule
Although we have many concerns with the proposed rule, we
believe that the rule provides greater protections than exist
toady and provides an important foundation upon which to build.
While we have submitted comprehensive comments to the
Secretary, the following is a brief summary of our recommended
changes to the proposed rule.
A. Applicability
We believe that the regulation should apply to health
information in both electronic and paper format. By only
covering electronic information, the same concerns about
patient confidence that exist today will continue, and many
patients will remain reluctant to discuss, even for treatment,
sensitive health information. Because of the complexity of the
health care system, most patients will never know what
information, if any, is stored electronically. We are
especially concerned that many domestic violence victims will
continue to hide the real cause of their injuries because they
fear for their safety. Even if patients are able to determine
what information is maintained electronically, they will likely
fear that some portion of the information is in paper format.
The only way to ensure patient confidence in the health care
system is to make the proposed rules applicable to all
information.
B. Definitions
We agree with the Secretary's proposed rule that a minor
who lawfully obtains health care services on his or her own
exercises the rights of an individual under the proposed rule.
For victims of domestic violence or abuse who are minors, this
provision would guarantee that family members who are
perpetrators could not access information (see also comments
for Directory Information and Next of Kin). We are also
concerned about minors who may suffer due to well-meaning but
inappropriate parental intervention. For example, a daughter
who is abused by her boyfriend may fear that if her parents
discover the abuse, they will confront her abusive boyfriend in
a cursory or inappropriate manner. As a result, the boyfriend
could resort to retaliation and further violence.
C. Treatment, Payment and Health Care Operations
We strongly believe that covered entities should be
required to get individual authorization in order to use or
disclose protected health information for treatment, payment
and health care operations. While the Secretary states that
such an authorization is meaningless because individuals must
sign the authorization in order to receive treatment,
authorizations themselves are very important because they are
an ``initial moment'' in which patients can raise questions
about privacy concerns and learn more about options available
to them. For many domestic violence victims who are concerned
about further violence, this initial moment will help create
confidence that their information will be used only for
specified purposes.
Providers disclosing information for consultation or
referral should be required to verify who is requesting
protected health information. We are concerned that victims of
domestic violence who receive specialized care (such as
reproductive or mental health services) may have their
information improperly disclosed to the perpetrator. Under the
proposed regulations, a provider who renders specialized
services would not be required to consult the patient before
disclosing information or even verify who has requested the
information. We are concerned that perpetrators could
successfully obtain information by using the proposed rule
under false pretenses.
The regulations should require a covered entity to protect
against inadvertent disclosures of protected health information
concerning sensitive health care services (defined as services
relating to reproductive health, sexually transmitted diseases,
substance abuse, and mental health) by obtaining an
individual's authorization prior to communicating with the
individual at the individual's home (whether by phone or mail).
Individuals seeking sensitive health care services have a
heightened concern that information about their medical
condition or treatment may be inadvertently disclosed to others
in their household, such as roommates, housemates, or family
members. The authorization should specifically ask whether the
provider or plan can call the individual at home, send
communications via email to the individual's home, or send
bills to the individual's home. If the individual does not
authorize these communications, the individual should provide
on the authorization form a phone number or an address for such
communications and must indicate how payment will be arranged
if payment is due.
D. Minimum Necessary
We strongly believe that entities should first be required
to determine whether de-identified information can be used or
disclosed to accomplish the intended purpose. While the
proposed rule requires that entities use only the minimum
amount of information necessary, the rule does not require the
use of de-identified information. We believe that a clear
statement that entities must first consider de-identified
information is the only way to ensure that the minimum amount
necessary standard is adequately implemented.
We also strongly believe that when an entity discloses
information at the individual's request, only the minimum
amount necessary should be disclosed, unless the individual has
indicated otherwise. A victim may authorize a provider to
disclose information to a friend or family member in order to
discuss her present course of treatment. Under the proposed
rule, a provider could disclose the victim's entire medical
history including information about domestic violence the
victim may have intended to remain confidential.
Where disclosure is not pursuant to a court order, we
strongly recommend that only the minimum amount of information
necessary to respond to the request be disclosed in judicial
and administrative proceedings. While we recognize that
litigants may need to access information, we are concerned that
covered entities who disclose information would prefer to
disclose all information rather than redact sensitive
information. Unnecessary disclosure could occur under a number
of scenarios, including a subpoena in a personal injury lawsuit
where the victim gave a history of prior abuse at the
provider's request. While some providers, plans or parties may
choose to redact the information, some may not--thereby
disclosing sensitive personal information. If the holder of
information is unclear what information is being requested, the
entity should request clarification and should only disclose
that information which is necessary. While the Secretary's
preamble raises practical concerns about applying the minimum
amount necessary standard requirement in judicial and
administrative proceedings, we believe that, at a minimum, only
information reasonably necessary to respond to a subpoena
should be disclosed (see Judicial and Administrative
Proceedings).
We also strongly believe that law enforcement access to
protected health information about victims of crime or abuse
should be limited to the minimum amount necessary requirement.
Providers who disclose too much information to law enforcement
without adequate consideration of the victim's safety increases
the likelihood that a perpetrator will discover that the victim
was treated for her injuries (see Law Enforcement). We are also
concerned about victims in small communities who can be easily
linked to the information even if the victim's name or address
is not disclosed. We believe that the minimum necessary
requirement would help prevent these types of inappropriate and
unnecessary disclosures.
E. Right to Request Restrictions
An individual should have a true right to restrict the use
and disclosure of information that could jeopardize the
individual's safety. Women who know that they will suffer
further violence from a perpetrator must be able to access
health care without fearing such communications will reach him.
A victim of domestic violence needs to be able to place
restrictions on the use and disclosure of their information
even for treatment, payment and health care operations. A
victim also needs to know that a perpetrator who requests
information will not be able to locate her. It is essential
that a victim who has fled a perpetrator not be found because a
provider or insurer gave the perpetrator the victim's new
address, either directly or through mailing of an explanation
of benefits form. A victim's right to restrict the disclosure
of her protected health information should not be dependent on
an agreement of a health care provider, who may underestimate
the severity of danger. Failing to give a victim of abuse a
true right to limit disclosures of such information where the
disclosure would endanger her safety will undermine the efforts
of the health care community to serve victims and deprive them
of necessary care and assistance.
We also believe that third parties who provide health care
services or issue bills independent of the primary provider,
insurer, or institution should comply with use and disclosure
restrictions requested by an individual. If an individual
restricts the use and disclosure of information, a provider who
agrees to or is aware of a restriction must inform third
parties that the information can only be used and disclosed for
purposes that do not violate the restrictions. For example, an
individual who is referred to an out-of-plan radiologist may be
billed separately for the radiology treatment. So, even if the
primary provider's bill goes to an alternate address, the
radiologist's bill could be sent to the victim's house,
inadvertently notifying the perpetrator and endangering her. If
an individual has requested that the original, referring
provider only communicate with the individual at an address
other than the individual's home, the radiologist should also
be required to comply with the restrictions originally
requested by the individual. It should always be the primary
provider/institution's responsibility to communicate the
restriction to all third parties as a patient often does not
know which referrals are billed separately.
F. Component Entities
We strongly believe that the Secretary should expressly
state that personnel and benefit administration employees
responsible for benefits or managing the day-to-day operation
of the health plan are covered by the regulation. The
Secretary's preamble appears to cover these employees but we
believe this should be made clear in the regulation. We also
recommend that the Secretary require personnel departments and
employees who handle health care administration to have
safeguards to ensure that information is not disclosed to the
larger organization. We are very concerned about employers who
may improperly obtain information from benefit administrators
and use the information inappropriately to make employment
decisions (such as promotions, job assignments, and even
firing). Victims of domestic violence would be likely targets
even when they perform well on the job. Employees who work
within the health care component must be empowered to deny
release of the information to corporate executives and managers
outside the health care component unless disclosure is required
for health plan administration.
G. Judicial and Administrative Proceedings
We strongly believe that the regulations should specify
minimum information that must be included in court and
administrative orders in order to guide those disclosing
protected health information and to notify those receiving
information that the information cannot be used or disclosed
for other purposes. At a minimum, court and administrative
orders should: (1) provide that the protected health
information is subject to court protection; (2) state the
nature of the information to be disclosed, and to the extent
practicable, identify specific information to be disclosed; (3)
specify to whom the information may be disclosed; (4) specify
that such information may not otherwise be used or disclosed;
and (5) meet any other requirements that the court or tribunal
determines are needed to protect confidentiality. These
requirements are necessary to ensure that sensitive information
is not released outside of the proceedings in a way that could
jeopardize the safety of the victim.
We believe that only the minimum amount of information
necessary to respond to a subpoena should be disclosed. If the
holder of information is unclear what information is being
requested, the entity should request clarification and should
only disclose that information which is necessary. While the
Secretary's preamble raises practical concerns about applying
the minimum amount necessary requirement in judicial and
administrative proceedings, we believe that, at a minimum, the
Secretary should require that only information reasonably
necessary to respond to a subpoena should be disclosed. While
we recognize that it may sometimes be difficult for parties
responding to requests to determine exactly what information
the requesting party seeks, the holder of the protected health
information should not have blanket authority to disclose all
protected health information--only information that is directly
responsive to a subpoena should be disclosed. While a victim
may have a long history of domestic violence and other
conditions, if the information is not directly responsive then
it should not be disclosed.
We also strongly believe that the Secretary should include
a provision prohibiting disclosure of protected health
information unless the individual who is the subject of the
information has had (1) reasonable notice of the subpoena and
(2) reasonable opportunity to move the court, or other
presiding official, to quash the subpoena on the basis that the
individual's privacy interest outweighs the interest of the
person seeking the information. Under the proposed rule, a
domestic violence victim may not know about a request for
disclosure of her personal information that could seriously
endanger her. A notice requirement would ensure that a victim
could take the necessary precautions to make sure that domestic
violence information does not reach the perpetrator.
H. Law Enforcement
We are very concerned that domestic violence information
may be disclosed to law enforcement officials without any
consideration or notice about safety concerns of domestic
violence victims. The only way to safeguard the privacy of
domestic violence victims is to require a warrant from a
neutral judicial officer prior to every law enforcement
disclosure. A warrant requirement is a familiar standard in
other federal privacy laws and has not been shown to interfere
with legitimate law enforcement activity. We are also concerned
that without a warrant requirement a victim could be deterred
from reporting violence if she knows that the police could
access all of her medical records.
A covered entity should be required to provide notice to a
victim about any requests or disclosures of information to law
enforcement officials. Information released to law enforcement
officials will likely be used to make an arrest or conduct
follow up investigation. We are concerned that during this
process a perpetrator may discover, either directly through
police interrogation or indirectly from witnesses who have been
contacted, that the victim has discussed the abuse with law
enforcement officials or her provider. Providing notice to the
victim will allow the victim to take necessary safety
precautions. Because providers are already required to account
for disclosures we believe that any administrative burden would
be insignificant.
When a victim has requested restrictions on uses and
disclosures of her health information, the covered entity
should communicate those restrictions to law enforcement
officials. Informing law enforcement of the restrictions would
help investigators understand a victim's safety concerns. Law
enforcement officials would then be better prepared to help the
victim seek protection during the investigation.
I. Directory Information
Because directory information includes the name, location
and condition of the patient, a perpetrator could easily locate
a victim to commit further violent acts. While individuals who
are not incapacitated would have an opportunity to opt out or
limit the amount of information to be disclosed, incapacitated
individuals would have no protection. A provider who reasonably
believes that the injuries of an incapacitated individual could
be the result of domestic violence should be prohibited from
disclosing the location of the individual. We believe that such
a limitation is essential for the safety of domestic violence
victims. Providers should be given discretion to disclose the
location of the individual to immediate family members who
qualify as next of kin and when the provider does not believe
the injuries could be a result of domestic violence.
J. Notice of Information Practices
We encourage the Secretary to require entities to make
reasonable efforts to obtain a signed acknowledgment that the
individual has received and read the notice of information
practices. While we believe that a signed authorization is the
best policy, we also believe that a signed acknowledgment could
also serve as an ``initial moment.'' (See Treatment, Payment
and Health Care Operations)
K. Next of Kin
We are very concerned about situations where a perpetrator
who is a next of kin attempts to obtain information about his
victim's treatment for her injuries. If the perpetrator
discovers that the victim discussed her injuries and identified
the perpetrator by name, he could confront the victim. This
confrontation may be another violent episode. We strongly
believe that where verbal agreement cannot be obtained any
disclosure must take into consideration whether the information
could jeopardize the safety of the victim.
We are also concerned that the proposed rule does not have
adequate verification procedures to identify those who are
requesting information. If verbal agreement is not possible,
the perpetrator could easily obtain domestic violence
information. In the Secretary's preamble (p. 59972), she states
that when there is no verbal agreement, a verbal inquiry into
the identity of the person requesting the information is
sufficient. We strongly disagree and believe that an entity
should verify the identity of the next of kin who has requested
the information. A perpetrator could attempt to obtain
information as next of kin while the victim is unconscious in
order to find out whether she previously identified him as the
perpetrator. By verifying the identity of the person requesting
the information, a provider could then make an informed
decision as to whether the safety of the victim may be
jeopardized.
L. Right to Restrict
We recommend that the Secretary's proposed right to request
restrictions on all information be retained. However, a mere
right to request restrictions does not adequately address the
safety concerns of victims of domestic violence or the
discrimination and safety concerns of others with sensitive
health conditions. Victims of domestic violence have immediate
safety concerns when information about their treatment is
disclosed to the perpetrator. Often perpetrators are angered if
they find out that their victims have told a provider about the
abuse. As a result, the victim may be in more serious danger of
personal harm. There are many ways for perpetrators to discover
that the victim has had or is seeking medical attention, or
discover the whereabouts of the victim (i.e. by finding a bill
or explanation of benefits or notice of appointment in the
mail, answering medical history questions posed by an attending
health care worker or an insurer, directly asking a provider or
insurer, or by false pretenses). The victim should be able to
request that, to the extent possible, covered entities not use
or disclose protected health information in ways that would
alert the perpetrator. Thus, the victim should be able to
request that a bill be sent to a different address, or that the
perpetrator (if identified) not be given particular health
information about the victim, or that only specified persons be
given full access to the patient's health information. Not
requiring that entities restrict use of information has broad
effects. If victims of domestic violence are not adequately
assured of the confidentiality of their information, they will
be less likely to seek medical attention and counseling.
Failing to give victims a true right to limit disclosures of
their health information where the disclosure would endanger
their safety undermines the efforts of the health care
community to serve victims and deprives victims of necessary
care and assistance.
We appreciate the Secretary's concern about the
unworkability of an absolute right to restrict, but when
restrictions concern information that could jeopardize the
patient's safety, the safety of the individual outweighs any
administrative burden. While restrictions may be ignored or
overlooked because the person handling the information is
unaware of the restrictions, we believe that entities could
minimize any oversight by flagging restricted information in a
noticeable place and manner on the information itself. All
entities who receive sensitive information subject to
restrictions by the individual should be informed of and comply
with the restrictions.
We are very concerned that the Secretary's proposed rule
does not permit individuals to request restrictions on the use
and disclosure of information in emergency situations. We
strongly believe that the right to restrict should apply in
emergency situations. A victim who has been harmed by violence
may first turn to emergency services for aid, and the victim
should be able to request that the perpetrator not be told of
her condition or whereabouts.
M. Inspection and Copying
We recommend that the rule grant covered entities broader
discretion to deny access to protected health information in
certain circumstances where necessary to protect minors and
other vulnerable people (elders, or those who are incapacitated
or incompetent) from abuse by their parents, guardians, persons
acting in loco parentis, or legal representatives who seek
information under section 164.514. Extra protection is
necessary for vulnerable people who depend on others to
exercise their rights under the regulations, but who must be
shielded from those empowered to act in their stead. Health
care professionals who treat victims of child abuse, elder
abuse, and other forms of domestic violence should have the
discretion to withhold information about their patients from
those whom the professional reasonably believes may harm the
patient. Such discretion is critical when the patient has
revealed the abuse and physical or emotional retaliation by the
abuser is a real possibility.
V. Conclusion
While we have many concerns with the proposed regulation,
we believe that the rule provides greater privacy protections
than exist today. We strongly encourage Congress to take the
important next step by filling the gaps left by HIPAA.
Statement of Health Industry Manufacturers Association
This testimony is submitted on behalf of the Health
Industry Manufacturers Association (HIMA) and its 800 member
companies. HIMA is the largest medical technology trade
association in the world, representing manufacturers of medical
devices, in vitro diagnostic products and health information
systems. HIMA member companies supply nearly 90 percent of the
$68 billion of health care technology products purchased
annually in the United States and more than 50 percent of the
$159 billion purchased annually worldwide. We welcome the
opportunity to submit testimony for the record on issues
surrounding the privacy of individually identifiable health
information.
Comments on the Proposed Privacy Regulation
Medical technology encompasses thousands of life-saving and
life-enhancing products used by more than 50 medical
specialties in numerous procedures and applications. Through
advances in medical technology, more lives are saved, illnesses
are prevented and recovery times are shorter.
Medical device innovation differs significantly from
pharmaceutical development in that most devices on the market
today result from a series of incremental improvements to
preexisting devices. These improvements result from continued
vigilance by the manufacturer and substantial input from the
provider community. Although well-designed research plays a
significant role, formal research projects must be complemented
by one-to-one interaction between the researchers tasked with
developing and improving a technology and the clinical
personnel who use it in their therapeutic and diagnostic
interactions with patients. Continuity and perseverance in
research and the ability to communicate freely with caregivers
and patients are key drivers of innovation.
HIMA strongly supports the development of reasonable
patient confidentiality standards. We recognize the
difficulties associated with developing privacy standards as
highlighted by the Department of Health and Human Services
(HHS) in the Background section of the preamble to the proposed
rule. HHS has made a considerable effort toward ensuring that
patient safety, the quality of care and medical research are
not adversely affected by this regulation. Nevertheless, we
believe the proposed rule still has many shortcomings. There
are numerous requirements that are unrealistic and will not
meet the needs of a health care system that is far more complex
than that contemplated by the proposed regulation or the
statute. Many items are ambiguous or require much more
explanation and clarification.
Taken together, these factors create concern from our
perspective about the safety and quality of patient care, and
our ability to collect data to support medical research. We
believe these problems must be addressed in a satisfactory
manner before any final regulatory framework is implemented.
We are pleased to share with the Subcommittee our concerns
about the proposed HHS privacy regulation. These are:
The Definition of Covered Entity Should Exclude Most Device
Manufacturers
We are extremely troubled that the proposed rule does not
clarify that the vast majority of device manufacturers are not
covered entities. As currently drafted, the definition of
covered entity includes device manufacturers who act as
Medicare suppliers. These types of companies comprise a very
small portion of the medical device industry. Because the
definition of a covered entity does not distinguish between the
majority of device manufacturers and the ``supplier
manufacturers,'' it has the potential to be misinterpreted by
implying that device manufacturers, in general, are covered
entities.
The rule is also vague in cases where a ``supplier
manufacturer'' has only one part of its business that acts as
the ``supplier.'' Thus, in addition to urging HHS to clarify
that the vast majority of device manufacturers are not intended
to be covered entities under the rule, we have urged more
detail regarding the scope of the supplier component and its
relationship to the rest of the company's business.
Requirements to ``Deidentify'' Individual Health
Information are Unworkable
We believe the rule's requirement that 19 identifiers be
removed before protected health information can be considered
``deidentified'' is unworkable and will yield information which
in most cases is useless for research purposes. Additionally,
the proposed rule deviates from the ``reasonable basis''
standard promulgated by the Health Insurance Portability and
Accountability Act (HIPAA) and instead adopts a standard which
will be very difficult to meet, where one must, in effect,
demonstrate that there is ``no reason to believe'' that a
recipient of protected health information could ``reidentify''
the recipient.
In light of HIPAA's civil and criminal provisions, it is
likely these requirements, if adopted, will severely impede
medical research by creating an atmosphere of extreme
uncertainty surrounding what data can be legitimately released
by a covered entity. We have urged HHS to adopt the HIPAA
standard regarding individually identifiable health
information. This will allow health information to be used
unless there is a reasonable basis to believe that the
information can be used to identify the individual.
The Definition of Public Health Authority Must Be Expanded
The proposed rule has a severely limited definition of
public health authority. Medical device manufacturers operate
in a global environment. As such, device manufacturers must
provide protected health information not only to U.S.
government entities, but also to government entities in other
countries as well as private organizations. It is critical,
therefore, that the definition of public health authority be
expanded to allow disclosures to foreign governments and
private sector organizations.
Device Manufacturers Should Be Permitted to Support
Treatment and Diagnosis
The proposed rule does not permit manufacturers to support
providers with treatment or diagnosis where protected health
information may be disclosed. As a result, patient care may be
jeopardized and access to life-saving and life-enhancing
technologies may be seriously delayed.
Device manufacturers frequently assist providers with the
operation and use of a particular device or customize devices
for particular patients. In many cases, the Food and Drug
Administration (FDA) requires these activities and thus would
be permitted by the proposed rule. Occasionally, however, a
provider may ask a manufacturer for support that is not
required by FDA, an activity not permitted by the proposed
rule. In these instances, and in order to assure appropriate
patient care or speedy patient access to needed devices, the
regulation should allow a provider to disclose protected health
information without individual authorization to the
manufacturer.
Device Manufacturers Should Be Permitted to Train Providers
Frequently, device manufacturers are the only entities with
the knowledge and experience to train providers on the use of a
device. In addition to written instructional materials, such
training frequently includes one-on-one tutorials in which the
needs of individual patients are necessarily addressed. As
currently written, the proposed regulation prohibits this type
of provider training unless patient authorization is obtained,
although the rule permits similar types of training if it is
provided by health care professionals.
To ensure the continued safe and proper use of medical
devices, we have urged HHS to change the proposed rule to
reflect that effective medical education results from a variety
of sources including medical device companies and that this
type of training should be permissible without patient
authorization.
The Proposed Rule Will Discourage the Collection of Needed
Public Health Information
The proposed rule permits disclosure of protected health
information to device manufacturers when the information is
needed to comply with rules or other directions of a
governmental authority. However, the proposed rule lists only
one requirement, device tracking, as an example. The device
industry must comply with hundreds of FDA requirements that
require the disclosure of protected health information.
Given the severe civil and criminal penalties which will
apply to entities violating the confidentiality standards
established by the rule, we are gravely concerned that an
atmosphere may develop where hospitals and other providers who
now freely provide needed information to device manufacturers,
will be reluctant to provide that same information in the
future.
To ensure that medical device manufacturers can carry out
the activities mandated by FDA and other government agencies
that require protected health information without individual
authorization, it is essential that the final rule enumerate
the many requirements with which device manufacturers must
comply.
Device Manufacturers Should Be Permitted to Support Data
Collection Activities of Governmental and Private Entities
The proposed rule permits disclosure of protected health
information to a government health data system used to collect
data for analysis in support of policy, planning, regulatory or
management functions authorized by law. Government
(specifically the Health Care Financing Administration (HCFA))
as well as private payers often rely on device manufacturers to
supply this information specifically to support reimbursement
and coverage policies.
We believe the rule should allow device manufacturers to
collect protected health information that will be used to
support HFCA's reimbursement policies and other related
decisions. The rule should also allow device manufacturers to
collect the same information for third party payers who, in
turn, must supply device reimbursement information to HCFA.
The Proposed Requirements for Research Invalidate the
Common Rule
Finally, the proposed rule establishes new criteria to be
included in patient consent forms for participation in medical
research which conflict with current law governing human
participation in clinical trials and which are inappropriate
for medical device trials.
Currently, the form and content of patient authorizations
to participate in medical device trials are established by
Institutional Review Boards acting in accord with the federal
regulatory framework for the protection of human subjects
(known as the Common Rule). The proposed rule invalidates a
number of the elements required by the Common Rule.
Additionally, a number of the elements in the proposed form are
confusing and inappropriate for medical device clinical trials
and the volunteers who participate in them.
Conclusion
In conclusion, HIMA strongly supports measures that will
ensure that individual health information is appropriately
protected while maintaining the safety and quality of care
through necessary communications and procedures. We believe the
proposed privacy rule has a number of shortcomings that will
impede important research needed to support device innovation
and patient access to new and improved medical technologies. We
look forward to workable solutions that will guarantee safe
patient access to innovative technologies through mechanisms
that promote medical research and quality of care.
Statement of Daniel V. Yager, LPA, Inc.
Mr. Chairman and Members of the Subcommittee:
Thank you for allowing us to present our views to your
Subcommittee regarding the proposed medical privacy regulations
issued by the Department of Health and Human Services on
November 3, 1999, ``Standards for Privacy of Individually
Identifiable Health Information.'' LPA, is a public policy
advocacy organization representing senior human resource
executives of more than 250 of the largest corporations doing
business in the United States. LPA's purpose is to ensure that
U.S. employment policy supports the competitive goals of its
member companies and their employees. Collectively, LPA member
companies employ more than 12 million employees, or 12 percent
of the private sector workforce.
Although perhaps not intended by the Department of Health
and Human Services (HHS), LPA believes that the proposed
medical privacy regulations could arguably prevent employers
from conducting drug testing and fitness for duty testing and
from requiring employees to provide Family and Medical Leave
Act certifications as permitted under current law. On February
15, 2000, LPA filed comments with HHS detailing our concerns,
based upon based upon extensive discussions with LPA member
companies.
LPA's comments underscore the critical role played by drug
testing in promoting workplace safety and reducing medical and
workers' compensation costs. The comments note that 70% of all
employers conduct drug testing. Even HHS conducts drug testing
before hiring its criminal investigators. LPA believes that it
is important that the final medical records confidentiality
regulations encourage, rather than discourage, employers to
engage in drug testing, even if the testing is not required by
federal law.
The comments also point out that fitness for duty tests are
already subjected to extensive restrictions under the Americans
with Disabilities Act (ADA), which requires employers to keep
all employee medical records confidential. The ADA also
regulates when an employer may require an employee or
prospective employee to take a fitness for duty test and which
supervisors may view the results of the test. Because such
tests confirm whether an employee is physically and mentally
capable of handling dangerous tasks, they have the added
benefit of ensuring that employers are providing a workplace
free from recognized hazards under the Occupational Safety and
Health Act. LPA believes that the regulations should clearly
exclude fitness for duty tests.
Similarly, employers may require employees to provide
medical certifications under the Family and Medical Leave Act
(FMLA) to ensure that the employees use the federally-mandated
leave for proper purposes. Although the regulations may impact
an employer's administration of the FMLA less severely than
drug testing programs and fitness-for-duty testing under the
ADA, LPA has urged the Department of Health and Human Services
to clarify that these certifications would not be impacted by
the final regulations.
Mr. Chairman, LPA believes that medical records used for
human resources purposes are already substantially protected by
employment laws. We urge the subcommittee to voice its strong
opposition to the additional restrictions in the regulations
that would only serve to make an employer's compliance with
existing laws more difficult without bolstering employee
protection. A complete copy of our comments is attached for
your information.
February 15, 2000
U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attn: Privacy-P, Room G-322A
Hubert H. Humphrey Building
200 Independence Ave., SW
Washington, DC 20201
RE: Standards for Privacy of Individually Identifiable Health
Information
To Whom It May Concern:
We are writing to express our strong concerns regarding the
application of the medical privacy regulations proposed on November 3,
1999,\1\ to the ability of employers to maintain mandatory drug testing
programs and to make critical employment decisions which are currently
already subject to restrictions under numerous federal and state laws,
including the Americans with Disabilities Act, the Family and Medical
Leave Act, and the Occupational Safety and Health Act.
---------------------------------------------------------------------------
\1\ Standard for Privacy of Individually Identifiable Health
Information, 64 Fed. Reg. 59,918 (proposed Nov. 3, 1999).
---------------------------------------------------------------------------
LPA, Inc. is a public policy advocacy organization representing
senior human resource executives of more than 250 of the largest
corporations doing business in the United States. LPA's purpose is to
ensure that U.S. employment policy supports the competitive goals of
its member companies and their employees. LPA member companies employ
more than 12 million employees, or 12 percent of the private sector
workforce. Because of the broad scope of the regulations as discussed
below, we believe every LPA member company would be affected in a
significant manner.
LPA's member companies have numerous concerns with regard to the
regulations which will be expressed through their own individual
comments as well as those of other organizations to which they belong.
LPA does not believe the agency intended the regulations to cover an
employer's use of employment-related medical information within the
bounds of current law. However, the regulations are sufficiently vague
that it is possible that they cover drug testing and other areas
involving critical employment decisions where Congress and various
state legislatures have already chosen to regulate the disclosure of
health information.\2\
---------------------------------------------------------------------------
\2\ LPA agrees with the statement in the Preamble that the
Secretary does not have the authority under the Health Insurance
Portability and Accountability Act to regulate the use of protected
health information once it is disclosed to employers. See id. at
59,923. As is detailed in this letter, employer use of such information
is already substantially regulated by existing law.
---------------------------------------------------------------------------
Our concern centers upon the broad definition of ``health
information'' in Sec. 160.103 to include ``any information . . . that
(1) Is created or received by a health provider . . . [or] . . .
employer . . .; and (2) Relates to the past, present, or future
physical or mental health or condition of an individual. . ..'' This
definition arguably could be broad enough to include:
data compiled pursuant to a mandatory drug testing
program maintained by an employer as a condition of employment for its
employees;
data compiled pursuant to a fitness for duty test
conducted in accordance with the Americans with Disabilities Act to
provide a reasonable accommodation or to ensure that an individual is
capable of performing strenuous or difficult work; and
information contained in a certification provided by an
employee as a condition to his or her entitlement to medical leave
pursuant to the Family and Medical Leave Act.
LPA does not believe the agency intended to limit these activities.
However, because the proposed regulations cover ``protected health
information,'' which essentially means electronically transmitted
health information that identifies a particular individual, the
regulations would appear to govern electronically transmitted
information used for the purposes listed above. LPA believes that the
final regulations should clearly exempt these uses from their scope,
both for compelling public policy reasons and because they are
adequately regulated by existing employment laws. Each of these
concerns will be discussed separately below.
I. Mandatory Drug Testing Programs
Many employers implement drug testing of prospective and current
employees to ensure that their employees do not pose a threat to
themselves, their co-employees, or the public at large. Indeed, federal
agencies are required to test applicants and employees in sensitive
positions for drugs under Executive Order 12,564,\3\ which implements a
drug-free federal workplace. A review of federal agency web site job
postings reveals that drug testing is a prerequisite for individuals
seeking certain federal jobs, such as those who apply as criminal
investigators in the Department of Health and Human Services \4\ and
communications equipment specialists for the Federal Aviation
Administration.\5\
---------------------------------------------------------------------------
\3\ Exec. Order No. 12,564, 51 Fed. Reg. 32,889 (Sept. 15, 1986)
reprinted in 5 U.S.C.A Sec. 7301 (note) at 166-70 (1996).
\4\ Department of Health and Human Services, Job Announcement for a
Supervisory Criminal Investigator, announcement number OIG-00-001,
available at http://www.psc.gov/spo/oig0001.shtm1.
\5\ Department of Transportation, Federal Available Administration,
Airway Transportation System Specialist announcement, available at
http://jobs.faa.gov/anndetail.sap?vac__id=47575.
---------------------------------------------------------------------------
Likewise, private sector employers have used drug testing programs
for years to enhance workplace safety, particularly when the jobs
involve hazardous activities such as manufacturing or transportation.
The most recent statistics indicate that 70 percent of all employers
test their employees for drugs.\6\ Employers have implemented workplace
drug testing for a variety of reasons, including to enhance workplace
safety, maintain product quality, productivity and employee morale, and
reduce medical and workers' compensation costs.\7\
---------------------------------------------------------------------------
\6\ American Management Association, 1999 AMA Survey on Workplace
Testing, at 2.
\7\ See e.g., G. John Tysse and Garen E. Dodge, WINNING THE WAR ON
DRUGS: THE ROLE OF WORKPLACE TESTING, 147(1989)
---------------------------------------------------------------------------
Overall, workplace drug use is estimated to cost employers over
$100 million annually.\8\ The anecdotal evidence of the effectiveness
of workplace drug testing programs is ``compelling'' according to the
U.S. Department of Labor's Internet site. For example:
---------------------------------------------------------------------------
\8\ Department of Labor Internet Site: ``Working Partners for an
Alcohol and Drug-free Workplace, Background Information: Workplace
Substance Abuse,'' available at http://www.dol.gov/dol/asp/public/
problems/drugs/backgrnd.htm.
---------------------------------------------------------------------------
drug-using employees at GM average 40 days sick leave each
year compared with 4.5 days for non-users;
employees testing positive on pre-employment drug tests at
Utah Power & Light were 5 times more likely to be involved with a
workplace accident than those who tested negative;
in Ohio, the establishment of drug-testing and treatment
programs reduced on-the-job injuries by 97 percent;
Southern Pacific Railroad experienced a 71 percent
decrease in injuries;
a manufacturer with 560 employees reduced industrial
accidents over thirty percent.\9\
---------------------------------------------------------------------------
\9\ Id.
---------------------------------------------------------------------------
Thus, there is ample evidence that drug testing helps achieve vital
workplace goals.
Because of the success of programs like these, testing in some
industries is now even required by law, such as the mandatory drug
testing programs for commercial drivers required by the Omnibus
Transportation Employee Testing Act of 1991.\10\ Even where drug
testing is not required, it is often encouraged. Thus, the Drug-Free
Workplace Act of 1988 \11\ requires all federal contractors with
contracts of at least $25,000 to certify that they are providing a
drug-free workplace, at the risk of contract debarment if they fail to
do so. Many contractors are able to provide this certification as a
result of their drug testing programs.
---------------------------------------------------------------------------
\10\ 49 U.S.C.A. Sec. 20103.
\11\ 41 U.S.C.A. Sec. et seq. (West 1987 & Supp. 1999).
---------------------------------------------------------------------------
The regulations effectively appear to encompass information
generated by mandatory drug testing. The medical profession holds a
longstanding belief that drug dependency is a disease to be treated,
rather than a disability to be accommodated.\12\ However, if that is
the case, then workplace drug testing, despite an employer's desire to
maintain a safe workplace, is covered under the proposed regulations'
definition of health care, which includes ``preventive, diagnostic . .
. rehabilitative . . . care, counseling, service or procedure with
respect to the physical or mental condition, or functional status of a
patient.'' \13\
---------------------------------------------------------------------------
\12\ See, e.g., American Medical Assn., Drug Dependencies As
Diseases, House of Delegates Resolution H-95.983 (Jan. 1998) available
at http://www.ama-assn.org/apps/pf__online/pf__online.
\13\ 64 Fed Reg. 60,049 (to be codified at 45 C.F.R. Sec. 160.103).
---------------------------------------------------------------------------
Because it is important that employers be able to continue to
maintain mandatory drug testing programs, Congress excluded them
altogether from the strict requirements of the Americans with
Disabilities Act governing medical examinations.\14\ The exclusion of
mandatory drug testing programs from the ADA requirements made sound
policy sense--to encourage workplace drug testing. However, the
exclusion also logically flowed from the fact that such programs seek
to obtain information about the deliberate illegal activities of
individuals that could have serious work consequences, even if those
activities were the result of a disease that is beyond their control.
---------------------------------------------------------------------------
\14\ ``For purpose of this subchapter, a test to determine the
illegal use of drugs shall not be considered a medical examination.''
29 U.S.C.A. Sec. 12114(d)(1) (West 1999).
---------------------------------------------------------------------------
The same considerations that led Congress to exclude testing for
the illegal use of drugs from the strict regulation of medical
examinations under the Americans with Disabilities Act should lead to
the same exclusion from the proposed regulations.
II. Fitness for Duty Testing
Many jobs require certain levels of physical and/or mental
competencies. Fitness for duty examinations allow employers to
determine whether an individual can perform the essential functions of
the job and, if they are not able to because of a disability, whether a
reasonable accommodation can be made to enable them to perform those
functions. Likewise, fitness tests for safety purposes confirm that an
employee is physically and mentally capable of handing dangerous tasks.
Each of these similar but distinct situations is dealt with below.
The Equal Employment Opportunity Commission, in its January 1992
``Technical Assistance Manual on the Employment Provisions (Title I) of
the Americans With Disabilities Act,'' provides several examples of
fitness tests, all of which are consistent with the ADA's protections:
ensuring that ``prospective construction crane operators
do not have disabilities such as uncontrolled seizures that would pose
a significant risk to other workers;'' \15\
---------------------------------------------------------------------------
\15\ U.S. Equal Employment Opportunity Commission, Technical
Assistance Man., Title I, Americans with Disabilities Act, reprinted in
Americans With Disabilities Act Man. 90:0556 (BNA)(1992).
---------------------------------------------------------------------------
testing of workers in certain health care jobs ``to ensure
they do not have a current contagious disease or infection that would
pose a significant risk of transmission to others;'' \16\ and
---------------------------------------------------------------------------
\16\ Id.
---------------------------------------------------------------------------
ensuring that an individual considered for a position
operating power saws or other dangerous equipment is not someone
``disabled by narcolepsy who frequently and unexpectedly loses
consciousness.'' \17\
---------------------------------------------------------------------------
\17\ Id. at 90:0543.
---------------------------------------------------------------------------
Under the Americans with Disabilities Act, employers are already
substantially regulated as to when they can require medical exams of,
or request medical information from individuals; what they can examine
or ask them for; and what employment decisions are permissible once
medical information concerning the individual is acquired. An employer
is generally prohibited from discriminating against a ``qualified
individual with a disability,'' which means a disabled individual who
can perform the ``essential functions of the job'' with or without a
``reasonable accommodation.''
The ADA correctly recognizes that the employer must have access to
a certain amount of medical information about employees and prospective
employees to comply with the law. Under Section 102 of the ADA,
employers have the right to require a medical examination after an
offer of employment has been made and prior to the commencement of
employment.\18\ If, during the medical examination, the doctor
discovers a condition that may affect the person's ability to do the
job, the employer still must go through the ``reasonable accommodation
process'' to determine whether the individual could do the essential
functions of the job with a reasonable accommodation.\19\ Once the
individual has been hired, the employer may not require medical
examinations unless they are ``job-related and consistent with business
necessity.'' \20\
---------------------------------------------------------------------------
\18\ 42 U.S.C.A. Sec. 12112(d).
\19\ 42 U.S.C.A. Sec. 12111(9).
\20\ 42 U.S.C.A. Sec. 12112(d)(4)(A).
---------------------------------------------------------------------------
Meanwhile, the ADA limits the amount of medical information that
can be obtained during employment to that information which is job-
related and consistent with business necessity. Strict confidentiality
requirements apply to the information, and several courts have held,
with agreement from the Equal Employment Opportunity Commission, that
these requirements apply regardless of whether an individual has a
disability.\21\ During the hiring process, the employer may share
medical information only with decision-makers with a ``need to know''
the information. Even an employee's supervisor and manager are not
entitled to any medical information beyond what limitations the
employee has to do the particular job. Thus, the ADA already protects
against any improper use of critical medical data by the employer.
---------------------------------------------------------------------------
\21\ See Roe v. Cheyenne Mt. Conf. Resort, 124 F.3d 1221 (10th Cir.
1997), cert. denied--U.S.--, 119 S. Ct. 1455 (1999); Criffen v.
Steeltek, Inc., 160 F.3d 591 (10th Cir. 1998); Cossette v. Minnesota
Power & Light, 188 F.3d 964 (8th Cir. 1999); Fredenberg v. Contra Costa
County Dept. of Health Services, 172 F.3d 1176 (9th Cir. 1999).
---------------------------------------------------------------------------
Yet, the data obtained consistent with ADA requirements would
appear to constitute ``health information'' under the proposed
regulations, even though HHS probably did not intend this result. Thus,
even though the employer would have a narrow right to access the data
under the ADA, a new authorization requirement would be superimposed by
the proposed regulations. As a result, employers could be forbidden
from viewing the results of medical exams taken to detect or confirm
the existence of a disability that could affect the ability of an
employee to do his or her job competently and safely.
This restriction has implications beyond the ADA. Results of
fitness for duty tests performed in accordance with the ADA may also be
used to ensure an employer is complying with the Occupational Safety
and Health Act (OSH Act). Although fitness for duty tests are not
required by the OSH Act,\22\ employers may reduce unnecessary workplace
accidents by implementing these tests because they will identify
employees who are impaired, physically incapable, or not properly
trained and ensure that they are not placed in jobs involving hazardous
work.\23\ However, the medical regulations are probably sufficiently
vague that the information gathered under these tests would not be
exempted under them, even though fitness testing is consistent with the
purpose of the OSH Act.
---------------------------------------------------------------------------
\22\ The OSH Act requires employers to provide employees
``employment and a place of employment that is free from recognized
hazards which. . .are likely to cause death or serious physical harm to
his employees.'' 29 U.S.
\23\ Although hazard avoidance is often employer-driven ``[i]n many
workplace situations, avoidance of hazards depends on proper employee
conduct. Many citations have been issued under the general duty clause
either because actions of employees created hazards or because
employees did not take precautions to avoid hazards.'' Stephen A. Bokat
and Horace A. Thompson III, Eds., OCCUPATIONAL SAFETY AND HEALTH LAW,
136 (1988).C.A. Sec. 654(a) (West 1999).
---------------------------------------------------------------------------
In addition, the OSH Act specifically requires employers to provide
voluntary medical testing for its employees. An employer could use the
information received to comply with its general obligation under OSHA
to provide a place of employment that is free from hazards. However, it
would appear that the information gathered under these tests would not
be exempt from the medical privacy regulations and therefore it could
be subjected to numerous restrictions that would prevent the use of the
data for the very purpose that it was intended.
For the foregoing reasons, we recommend that the final regulations
make clear that they will not apply to information regarding fitness
tests that an employer or its agents may lawfully obtain, use or
disclose under the ADA, state and local laws relating to discrimination
on the basis of disability, the OSH Act, and state safety and health
laws. Use of such information is already adequately protected under the
ADA, and additional consent and disclosure requirements would serve to
impede the administration of federal antidiscrimination policy.
III. Family and Medical Leave Act
Under the Family and Medical Leave Act (FMLA), employees are
guaranteed a right to up to twelve weeks of leave annually for a
serious medical condition. Under Section 103 of the FMLA, employees who
wish to use FMLA medical leave can be required by their employer to
provide a certification issued by a health care provider that
discloses, in part:
the date on which the employee's ``serious medical
condition'' began;
the probable duration of the condition;
the ``appropriate medical facts within the knowledge of
the health care provider'' regarding the condition; and
a statement that the employee is unable to ``perform the
functions of the position.'' \24\
---------------------------------------------------------------------------
\24\ 29 U.S.C.A. Sec. 2613(b)(1-4) (West 1999).
---------------------------------------------------------------------------
Medical certifications provided by employees returning from leave
under the Family and Medical Leave Act allow employers to ensure that
the employee is ready to undertake the duties required in the
employee's position. Similar issues exist with respect to the
information included in the opinion of a second health care provider
requested by an employer who doubts the validity of the employee's
initial certification \25\ or in the opinion of a third health care
provider called upon to resolve a conflict between the opinions of the
first and second health care providers.\26\
---------------------------------------------------------------------------
\25\ Id. at Sec. 2613(c) & (d).
\26\ Id. at Sec. 2613(e).
---------------------------------------------------------------------------
Much of the information contained in the medical certification
would appear to meet the definition of protected health information
under all the proposed bills, and would therefore be covered by the
requirements of those bills. However, under the FMLA, the employer may
require the employee to provide a medical certification before
returning the employee to his or her job. Thus, there is an implicit
requirement that the employee provide consent for the employer to see
the medical certification.
To avoid any inadvertent conflicts between employment law and the
medical privacy regulations, we recommend that the final regulations
exclude protected health information contained in certifications that
an employer or its agents may use or disclose when exercising their
rights or responsibilities under the FMLA.
IV. Consequences of an Employee's Refusal to Provide Authorization
In addition to recognizing that an employee authorization is not
required where employers are currently permitted to use protected
health information, the regulations should state that an employer is
permitted to make an employment decision based on an employee's refusal
to provide the results of a drug or a fitness-for-duty test under the
ADA, FMLA, and similar laws. This would make the regulations consistent
with the existing application of these laws and eliminate potential
confusion regarding application of the exclusion.
A few examples illustrate the need for such a provision. The ADA
acknowledges that an employer is not obligated to hire an employee with
or without a disability who is not able to perform the essential
functions of the job. If an employee refuses to submit to a post-offer
fitness for duty test, or refuses to disclose the results of such a
test, the ADA allows the employer to refuse to hire the employee
because the employer cannot assess whether the employee can perform the
job's essential functions.
An employer faced with the potential that an unskilled or untrained
employee could be placed in a safety sensitive position and could cause
substantial safety problems, must determine the employee's fitness
before they are assigned such a position. Thus, an employer should be
allowed to take appropriate action against an employee who refuses to
take or disclose the results of a drug or fitness test that could
result in safety implications.
Similar reasoning applies under the FMLA and more generous
employer-provided leave policies. As noted above, an employer may
require an employee to provide a medical certification and is not
required to restore the employee to his or her position until the
certification is provided. Thus, if an employee refused to provide the
disclosure, the employer could refuse to reinstate the employee.
Moreover, employers often provide benefits beyond those required by
the federal employment law. For example, in addition to providing
unpaid leave under the FMLA, many employers also provide sick leave for
short absences and temporary disability benefits for longer-term
medical absences. For this reason, LPA also recommends that the
regulations should permit employers to require employees to provide
certifications of their conditions to demonstrate eligibility for these
employer-provided benefits. The same rationale applies to both
situations--in order to receive the protection of the law or voluntary
benefits provided by the employer, the employee must demonstrate that
he or she had a bona fide condition that triggered the protection or
the benefits.
By acknowledging that employers may make employment decisions based
on an employee's refusal to take or disclose the results of a mandatory
drug or fitness for duty test, a certification for FMLA or employer-
provided paid leave, the regulations would protect the ability of
employers to comply with existing labor and employment laws, maintain
the safety of their workplaces, and offer generous leave packages.
V. Limitation to Electronic Data
As proposed, the medical privacy regulations only apply to
electronically transmitted protected health information. However, the
Secretary argues in the Preamble that she has the authority to regulate
paper records under several authorities.\27\ LPA takes exception to
this statement. The Health Insurance Portability and Accountability Act
(HIPAA), which authorized the regulations, clearly does not authorize
the Secretary to regulate anything but electronically transmitted
information. This is made clear in the legislative history as well.\28\
LPA opposes the Secretary's stretched attempt to expand her authority
beyond that which she is expressly granted in HIPAA.
---------------------------------------------------------------------------
\27\ Although we are concerned that extending our regulatory
coverage to all records might be inconsistent wit the intent of the
provisions of HIPAA, we believe that we do have the authority to do so
and that there are sound rationale for providing a consistent level of
protection to all individually identifiable health information held by
covered entities.'' Id. at 59,924.
\28\ U.S.C.A. Sec. 1320d-2 (West Supp. 1999), ``The Committee
recognizes the role of the private sector in establishing innovative
data transactions systems relating to electronic exchange. . .privacy
standards, and electronic signatures. The standards adopted would
protect the privacy and confidentiality of health information. Health
information is considered relatively `safe' today, and because it is
secure, but because it is difficult to access. These standards improve
access and establish strict privacy protections.'' Conference Report on
the Health Insurance Portability and Accountability Act of 1996, H.
Rep. No. 104-406 at 99 (1996), reprinted in 5 U.S.C.C.A.N. 1,900
(1996).
---------------------------------------------------------------------------
Thank you for this opportunity to submit our views.
Sincerely yours,
Daniel V. Yager
Senior Vice President and General Counsel
Statement of Medical Group Management Association
Medical Group Management Association (MGMA) urges the
Department of Health and Human Services (HHS) to re-issue the
proposed privacy rule. ``MGMA appreciates the enormous
complexities that HHS was confronted with in drafting the
proposed rule to protect the confidentiality of medical
information. In light of the extensive revisions that HHS
should incorporate into a final rule, MGMA urges HHS to issue a
new proposed rule reflecting the revisions before it drafts a
final rule. Due to the importance and overarching impact of
this issue, all interested parties should have an adequate
opportunity to review and comment on the changes to the
original proposed rule,'' according to MGMA President and CEO
William F. Jessee, M.D.
The privacy of an individual's personal health information
should never be inappropriately compromised. However, MGMA
contends that protecting the privacy of medical information
must be balanced against the unnecessary burdens privacy
protections place upon group practice administrators and all
health care providers. Furthermore, it is essential that
privacy protections do not interfere with vital activities such
as medical treatment and research.
``MGMA commends the efforts of HHS to protect the
confidentiality of medical information. MGMA believes HHS took
several positive steps in addressing a very difficult issue.
However, we also believe there are several significant flaws in
the proposed rule, which would place tremendous burdens on
medical group practices and interfere with the delivery of
efficient and high quality health care,'' said Jessee.
In light of the limited applicability of the proposed rule
mandated by the Health Insurance Portability and Accountability
Act of 1996 (HIPAA), MGMA maintains that the best avenue for
protecting health information is through comprehensive
legislation. MGMA is concerned that the proposed rule would not
apply to many entities that use and disclose medical
information on a daily basis (e.g., life insurance issuers,
third-party administrators, and employers). Furthermore, the
protections provided in the proposed rule would not cover
purely paper records.
In its formal submission to HHS, MGMA emphasized the
following:
Provided HHS has the authority, MGMA urges HHS to
expand the rule to cover all information, even information that
has never been electronically maintained or transmitted. There
are many medical organizations, especially small physician
practices, that still maintain and transmit information in
paper form. In order to protect fully the confidentiality of
health information, HHS should apply its standards to all
information, regardless of how it is stored or transmitted. In
addition, the proposed approach would create an undesirable and
confusing scenario involving ``mixed'' records with certain
records potentially containing both protected and unprotected
information. This would place administrative burdens upon
providers and administrators to ensure that protected health
information is handled appropriately.
MGMA supports the approach adopted by HHS in the
proposed rule that would not require a patient's authorization
to use or disclose protected health information (PHI) for
treatment, payment, and ``health care operations.'' Patients
expect that their health information will be used for treatment
and payment when they seek medical care. Requiring an
authorization would be a mere formality and not serve a
legitimate purpose, since an authorization often is obtained
prior to a patient receiving medical care. MGMA strongly
believes that a separate authorization should not be required
for health care operations, since these activities are directly
related to and often times inseparable from treatment and
payment.
HHS proposes that a covered entity must make all
reasonable efforts not to use or disclose more than the minimum
amount of protected health information necessary to accomplish
the intended purpose of the use or disclosure. While the intent
behind ``minimum necessary'' is commendable, MGMA believes this
standard places an unfair burden on the entity making a
disclosure and may interfere with patient care as well as
patient safety initiatives.
While MGMA recognizes the importance of protecting
the privacy of health information in all hands, we strongly
object to the ``business partner'' proposal and recommend that
HHS completely remove the liability provision of the proposed
rule. It is impractical and unrealistic to expect a covered
entity to monitor and determine if a business partner is
complying with the requirements of the regulation. In addition,
as outlined in the rule, an individual could sue a covered
entity if a business partner inappropriately discloses
information. However, HIPAA does not extend to HHS the
authority to include a ``private right of action,'' and MGMA
believes HHS is attempting to circumvent the statute through
the business partner proposal.
MGMA strongly supports the principle of
``scalability,'' which provides practices flexibility in
complying with the proposed rule's requirements. MGMA applauds
HHS for recognizing the fact that the magnitude and complexity
of the proposed rule will create significant monetary and
administrative burdens.
The full text of MGMA's formal comments on the proposed
rule is posted on the Public Policy section of MGMA's website
at ``http://www.mgma.com/legislation/. For specific questions
regarding MGMA's comments, please contact Aaron N. Krupp, MGMA
Government Affairs Representative, at (202) 293-3450.
Founded in 1926, MGMA's membership includes more than 7,100
organizations, representing more than 185,000 physicians. MGMA
executive offices are in Englewood, Colo.
National Association of
Insurance Commissioners
Washington, DC 20001
March 1, 2000
The Honorable William Thomas
Chair
Subcommittee on Health
Committee on Ways and Means
1136 Longworth House Office Building
Washington, DC 20515-6349
Dear Chairman Thomas:
The National Association of Insurance Commissioners (NAIC),
representing the nation's fifty-five chief insurance regulators,
submits the enclosed document and asks that it be included in the
record for the hearing on health information privacy held by your
subcommittee on February 17, 2000.
The enclosed document is the comment letter the NAIC sent to the
United States Department of Health and Human Services regarding its
proposed health information privacy regulation. The letter raises many
concerns including the following:
Limited Applicability and Scope:
The regulation only applies to a limited group of entities (health
plans, health care providers and health care clearinghouses) and only
applies to paper records. While we recognize that HHS is limited in its
authority and jurisdiction to apply the standards established in the
regulation, we think the regulation should apply to a broader group of
entities that use and disclose protected health information and should
apply to all insurers, not just health insurers. We think the
regulation should protect all forms of individually identifiable health
information, both paper and electronic.
Preemption of State Laws:
While we appreciate HHS' intent to create federal minimum
standards, to preserve stronger state laws, and to protect certain
state laws from any preemption, the NAIC membership has serious
reservations about how the preemption standard used in the proposed
regulation is to be implemented. The general rule is that
``provisions'' of state law are preempted to the extent that they are
``contrary'' to the federal statutory and regulatory scheme. We have
found similar standards not to be very helpful in comparing state laws
to federal requirements. A state must examine all its laws relating to
health information privacy to determine whether or not its laws are
contrary to the requirements in the proposed regulation. This in and of
itself is a major project for states to undertake.
We offer a suggestion to help the operation of and to ease the
administrative burden of implementing this standard. We propose that
the states be given the greatest amount of flexibility in determining
what the necessary scope of ``provision'' is when applying the general
rule's contrary standard. In the regulation, HHS has recognized that
states know their laws best and are best informed about how to apply
their laws. The NAIC membership believes that the definition should
preserve to the maximum extent possible state privacy initiatives that
extend beyond the covered subject matter of the proposed regulation.
Determination Process:
There are several serious flaws with this proposed process:
First, the determination process is overly burdensome for
states. Not only do states have to conduct a ``contrary analysis'' for
all of their laws that protect health information and then submit
requests for exceptions to HHS, but they also have to wait for HHS to
make a determination in order for the states to enforce their laws.
Second, the proposed regulation states that the federal
standard applies until a determination is made. Cessation of state
regulation in the interim will essentially leave plans unregulated
until HHS makes a determination. We believe the current assumption in
the proposed regulation that the federal standard applies until a
determination is made should be reversed. State laws should stand until
and unless HHS has determined otherwise.
Third, the proposed regulation does not establish a time
frame or deadline by which HHS has to issue a determination. We suggest
that HHS revise its regulation to include a time period by which HHS
has to make a determination. We also suggest that if HHS does not make
a determination after a specified amount of time, then a default
determination should be issued in favor of the state.
Finally, even if states are granted an exemption from
preemption through the HHS determination process, there is a three-year
time limit on how long a state law is exempt pursuant to this
determination. The process is quite burdensome for the states, so we
question the provision requiring states to ask for a re-determination
on the same laws every three years as a waste of time and resources for
the states and for HHS. The time limit should be eliminated.
Lack of Guidance in Classifying State Insurance Laws:
There is lack of guidance regarding state laws that are contrary to
the proposed regulation but that could fall into more than one category
of state laws that are exempt from preemption. State insurance laws
easily could fall into several of the categories of exceptions. An
example is a state law regulating health insurance plans (category one)
that is more stringent than the federal regulation (category two) and
requires health insurance plans to report information (category 3). We
request that a clarification be included in the regulation stating that
if a state law falls within several different exceptions, the state
chooses which exception shall apply. The presumption should be that the
state has the best knowledge of its laws and it has correctly
classified its laws in the appropriate category of exceptions. We think
this simple clarification statement will avert much litigation and
prevent state insurance departments from having to defend endless
challenges to their classification of their laws.
Lack of Clarity in Classifying State Insurance Department
Activities:
The proposed regulation establishes a list of exceptions to the
authorization requirement, such that protected health information may
be used or disclosed without authorization in certain circumstances.
However, under the HHS proposed regulation, the activities of state
insurance departments fit under any one or more of the following three
exceptions: (1) for disclosure to health oversight agencies for health
oversight activities; (2) for disclosure for law enforcement purposes;
and (3) for use and disclosure for judicial and administrative
proceedings. The regulation is unclear about the role of insurance
departments relative to these exceptions, and each of these exceptions
has its own requirements and processes. We ask HHS to include language
in the text of the proposed regulation stating that if a state
insurance activity falls within several different exceptions, the state
chooses which exception shall apply. In addition, we ask HHS to
recognize the broad scope of legally authorized activities performed by
insurance departments and to reflect those activities in the
regulation.
Permitted Versus Required Disclosure:
Under the proposed regulation covered entities are ``permitted''
but not ``required'' to disclose necessary protected health information
to health oversight and law enforcement agencies. We believe that
covered entities under investigation by a state agency should be
required to provide that state agency with access to necessary health
information when performing its legally mandated duties. This
disclosure should not be optional. By not requiring insurers to provide
state insurance departments with access to records, filings and other
documents that may contain individually identifiable information, state
insurance departments' ability and authority to perform their
regulatory responsibilities is undermined. In addition, obtaining
authorization from all of an insurer's clients for investigation of an
insurer's business practices is not feasible or practical.
In addition to these concerns, the members of the NAIC would
appreciate further discussions with the witnesses regarding the
interaction between the HHS regulation and the privacy requirements
found in the newly enacted Gramm-Leach-Bliley Act.
For insights into the NAIC's position regarding the issues
surrounding proposed federal health information privacy legislation, I
refer you to the testimony the NAIC submitted to your subcommittee on
July 20, 1999. That testimony may be found on our website at http://
www.naic.org/1news/testimonies/index.htm.
If you have any questions please contact Mary Beth Senkewicz at
(202) 624-7790.
Sincerely,
Kathleen Sebelius,
Vice-President NAIC
Chair, Health Insurance Task Force
Commissioner of Insurance, State of Kansas
Enclosure
February 15, 2000
Margaret Ann Hamburg
Assistant Secretary for Planning and Evaluation
United States Department of Health and Human Services
Hubert H. Humphrey Building
Room G-322A
200 Independence Avenue, S.W.
Washington, DC 20201
Attention: Privacy-P
Dear Assistant Secretary Hamburg:
On behalf of the National Association of Insurance Commissioners
(NAIC) Health Insurance Task Force, I hereby submit these comments on
the proposed rules entitled, ``Standards for Privacy of Individually
Identifiable Health Information,'' published in the Federal Register on
November 3, 1999 (64 Fed. Reg. 59918-60065).
The NAIC appreciates the Department of Health and Human Services'
(HHS) efforts to establish standards to protect the privacy of
individually identifiable health information maintained or transmitted
in connection with certain administrative and financial transactions
and to provide a basic level of protection to consumers. We too
understand the necessity of protecting individuals' health information,
and as such, we have adopted stand-alone model privacy legislation \1\
and have incorporated privacy protections in other health-related
models. In general, we appreciate the flexibility afforded the states
in the HHS proposed regulation.
---------------------------------------------------------------------------
\1\ The ``Health Information Privacy Model Act'' and the
``Insurance Information and Privacy Protection Model Act.''
---------------------------------------------------------------------------
Drafting standards that protect the privacy rights of individuals
with respect to highly personal health information is a difficult task.
Like you, the members of the NAIC sought to write standards that would
not cripple the flow of useful information, that would not impose
prohibitive costs on entities affected by the legislation, and that
would not prove impossible to implement in a world that is rapidly
changing from paper to electronic records. At the same time, the
members of the NAIC recognized the need to assure consumers that their
health information is used only for the legitimate purposes for which
it was obtained, and that this information is not disclosed without the
consumer's consent or knowledge for purposes that are likely to harm or
offend the individual.
While there are many similarities between the NAIC Health
Information Privacy Model Act and the proposed regulation, the members
of the NAIC have serious concerns about the proposed regulation's
impact on the ability of state insurance departments to perform their
jobs and handle their responsibilities, which include protecting
consumers and eliminating fraud.
I. NAIC Model in Relation to the Proposed Regulation
A. Background
The NAIC adopted its ``Health Information Privacy Model Act''
(``NAIC Model Act'') in September 1998 (Attachment A). This model has a
more narrow focus than the NAIC's ``Insurance Information and Privacy
Protection Model Act,'' which was adopted in 1980. The model act
adopted in 1980 addresses the privacy of all individually identifiable
information, whereas the NAIC Model Act adopted in 1998 establishes
protections for all health information and for protected health
information. The NAIC Model Act was developed with state regulators,
representatives of the insurance and managed care industries, and
representatives from the provider and consumer communities. Our model
was developed to assist the states in drafting uniform standards for
ensuring the privacy of health information.
B. Similarities
The HHS proposed privacy regulation addresses many of the same
issues as the NAIC Model Act. Both the NAIC Model Act and the proposed
regulation establish procedures for the treatment of all health
information and additional specific rules for protected health
information. They are similar in their basic structures and the rights
conveyed to individuals regarding their health information.
In terms of structure, the NAIC Model Act and the regulation
prohibit entities from using or disclosing health information except as
authorized by the patient or as specifically permitted by the Act or
regulation. (HHS Proposed Regulation Sec. 164.506(a); NAIC Model Act
Sec. 10A). When protected health information is used or disclosed, both
limit the amount of information used or disclosed to that amount which
is necessary for the stated purpose. (HHS Sec. 164.506(b)(1); NAIC
Sec. 10). They both establish exceptions to the authorization
requirement, and many of the exceptions to the authorization
requirement in the NAIC Model Act fall under what the HHS proposed
regulation defines as treatment, payment or health care operations.
(HHS Sec. 164.510; NAIC Sec. 11). The NAIC Model Act and the proposed
regulation place administrative requirements on their applicable
entities (HHS Sec. 164.518, 164.520; NAIC Sec. 5), and both establish
civil and criminal penalties for violations (HHS Sec. 164.522; NAIC
Sec. 15).
In terms of individuals' rights regarding their protected health
information, the NAIC Model Act and the proposed regulation guarantee
similar rights. These rights include: (1) the right to inspect and copy
the individual's protected health information (HHS Sec. 164.514; NAIC
Sec. 7); (2) the right to amend and correct the individual's protected
health information (HHS Sec. 164.516; NAIC Sec. 8); (3) the right to
receive notice of an entity's privacy practices (HHS Sec. 164.512; NAIC
Sec. 6); (4) the right to receive an accounting of everyone to whom
protected health information was disclosed (HHS Sec. 164.515; NAIC
Sec. 9); and (5) the right to revoke authorization to use or disclose
protected health information (HHS Sec. 164.508(e); NAIC Sec. 10).
C. Differences
Even though the NAIC Model Act and the proposed regulation have
quite a few similarities, there are significant differences that
concern the state insurance departments and the NAIC. As we witnessed
in the legislative proposals offered by Congress, the smallest details
can have a huge impact on how the privacy standards effect consumers
and the states. Key differences are in scope and in the applicable
entities impacted by the regulation.
HHS has expressed concern that because of its limited jurisdiction,
the proposed regulation only applies to electronic health information
and only applies to certain entities (64 Fed. Reg. 59923). We too are
concerned about the limited reach of the proposed regulation.
1. Scope (``Summary and Purpose'')
Both the NAIC Model Act and the proposed regulation establish
standards to protect the privacy of protected health information.
However, the proposed regulation defines protected health information
to include only individually identifiable health information that is or
has been transmitted electronically (HHS Sec. 164.504). The regulation
does not cover paper records. On the other hand, the NAIC Model Act
does not distinguish between health information in paper format and
health information that is electronically transmitted and maintained.
The NAIC Model Act protects all forms of individually identifiable
health information, both paper and electronic. We believe the NAIC
Model Act's broader scope serves to better protect individuals' health
information. (NAIC Sec. 4).
HHS requested comment on whether it has the authority to extend
protections to paper as well as electronic information, although to
this point, HHS has limited its regulations to electronic information.
(64 Fed. Reg. 59927). We suggest that since HHS believes it has the
authority under HIPAA to extend these regulatory requirements to paper
and electronic records, it should do so. Rather than wait to publish
proposed rules that will govern paper records in the near future, we
suggest that HHS address paper records in this current proposed
regulation. The protections established in the proposed regulation
should extend to both paper and electronic information.
2. Applicable Entities (``Applicability'')
One of the most obvious differences between the NAIC Model Act and
the proposed regulation is in the scope of the entities to which the
respective proposals would apply. The NAIC Model Act only applies to
insurance carriers. The proposed regulation is broader and applies to
health plans, health care clearinghouses, and health care providers who
transmit health information electronically. (HHS Sec. 160.102). These
entities are referred to in the proposed regulation as ``covered
entities.'' (HHS Sec. 160.103).
Although the proposed regulation generally applies to a broader
range of entities than the NAIC Model Act, we are concerned that
``health plan'' is defined in the proposed regulation to exclude
certain insurers. The proposed regulation clarifies the definition of
``health plan'' established under HIPAA to include a health insurance
issuer, a health maintenance organization, a Medicare supplement
policy, and a long term care policy. (HHS Sec. 160.103) As such, the
proposed regulation would not apply to certain types of insurance
entities, even if they provide coverage for health care services or use
information found in an individual's medical record (i.e., life
insurers, workers' compensation insurers, automobile insurers, other
property-casualty insurers, and insurers offering certain limited
benefits) (64 Fed. Reg. 59923, 59932). The NAIC Model Act applies to
all insurers, regardless of the products that they sell.
While we recognize the limited jurisdiction of HHS under HIPAA with
respect to insurers, we recommend the approach of the NAIC Model Act,
which applies to all insurance carriers and is not limited to health
insurers. (NAIC Sec. 4). The NAIC had an extensive public discussion
about whether the NAIC Model Act should apply only to health insurance
carriers, or instead, to all carriers. Health insurance carriers are
not the only types of carriers that use health information to transact
their business. Health information is often essential to life insurers
in issuing policies and to property and casualty insurers in settling
workers' compensation claims and automobile claims involving personal
injury, for example. Reinsurers also use protected health information
to write reinsurance. The NAIC concluded that it was illogical to apply
one set of rules to health insurance carriers but different rules, or
no rules, to other carriers that were using the same type of
information.\2\ Consumers deserve the same protection with respect to
their health information, regardless of the entity using it. Nor is it
equitable to subject health insurance carriers to more stringent rules
than those applied to other insurers. Our model applies to all
insurance carriers and establishes uniform rules to the greatest extent
possible. The NAIC supports privacy protections that apply to
individually identifiable health information wherever it resides.
---------------------------------------------------------------------------
\2\ The NAIC Model Act does allow exceptions from the authorization
requirement for certain insurers to conduct certain activities. These
include: (a) when the protected health information is necessary to the
performance of the carrier's obligations under any workers'
compensation law or contract; and (b) when collecting protected health
information from or disclosing protected health information to a
reinsurer, stop loss or excess loss carrier for the purpose of
underwriting, claims adjudication and conducting claim file audits.
However, these entities are subject to the rest of the model's
provisions.
---------------------------------------------------------------------------
II. Comments on Preemption (``Relationship to State Laws'')
A. General Comments on Preemption
Preemption of state law is a key issue for the states and the NAIC
membership. As we stated in our May 4, 1999 letter to Congress
(Attachment B) and in Congressional testimony (Attachment C) \3\, the
federal government must recognize the impact of any privacy legislation
or regulations on existing state laws. States have enacted many laws
designed to protect an individual's health information in a variety of
areas. These state protections appear in many locations within a
state's statutes and regulations, and many times address programs or
uses of health-related information that are unique to a particular
state. In addition, states have carefully considered when to allow use
and disclosure of health information without authorization, such as in
cases of investigations and audits of health insurers by state
insurance departments. States have enacted legislation and regulations
after balancing the individual's right to keep health information
confidential against the legitimate purposes for disclosure.
---------------------------------------------------------------------------
\3\ Latest testimony dated July 20, 1999, before the House Ways and
Means Committee, Subcommittee on Health is attached (Attachment C). The
NAIC also testified two other times in 1999 on this issue: May 27, 1999
before the House Commerce Committee, Subcommittee on Health and the
Environment; and April 27, 1999 before the Senate Health, Education,
Labor and Pensions Committee.
---------------------------------------------------------------------------
While we oppose the preemption of state law, we understand the
desire to establish a minimum standard in this area due to several
factors. First, the transmission of health information, as opposed to
the delivery of health care services, is not always a local activity.
Health information is transmitted across state and national boundaries.
Second, while the NAIC has developed model legislation for the states
to enact to protect individuals' health information that is collected,
used and disclosed by insurance carriers, the reality is that our
jurisdiction is limited to insurance. Because health information
privacy encompasses more issues than insurance and more entities than
insurers, we understand the desire for broader regulations. As a
result, the members of the NAIC have concluded that the privacy of
health information is an area where it may be appropriate for the
federal government to set a minimum standard.
However, it should be noted that up until this point there has been
no federal standard in place. Rather, states have been the protector of
consumers in this area. Any federal action must recognize this fact and
make allowances for it. The NAIC supports establishing a minimum
federal level of protection for health information, as long as stronger
state laws are preserved. We do not want to see health information that
currently enjoys a high level of protection under state law end up with
less protection under the proposed regulation.
For these reasons, we appreciate HHS' intent to create minimum
standards, to preserve stronger state laws, and to protect certain
state laws from any preemption. However, it is critical that the
proposed regulation not undermine the progress of the states in
implementing legislation that protects health information privacy and
not undermine states' abilities to regulate entities over which they
have jurisdiction. It is also critical that the proposed regulation, in
its attempt to preserve state privacy laws, not make the process for
states to enforce their laws so burdensome that the process only works
in theory and not in reality.
B. Preemption Standard in the Proposed Regulation
In the Health Insurance Portability and Accountability Act of 1996
(HIPAA), Congress directed HHS to implement privacy regulations if
Congress failed to meet the statutory August 21, 1999 deadline to enact
legislation. Congress also directed HHS to implement regulations that
would not supercede a contrary provision of state law if the state law
is more stringent than the regulation (HIPAA Sec. 264). While we
appreciate the expressed intent of HHS in the preamble to preserve
stronger state privacy laws and to protect other specific state privacy
laws from preemption (64 Fed. Reg. 59994-59999), we have concerns about
the language and structure used in the proposed regulation's general
rule and the three categories of exceptions to the general rule. The
preemption analysis used in the regulation is confusing and leaves many
questions unanswered. Although the general rule and the exceptions were
established in HIPAA by Congress, not by HHS, we believe HHS needs to
make some clarifications in the proposed regulation in order to
effectively and efficiently implement these standards.
C. The Proposed Regulation's General Rule and Exceptions (HHS Sec.
160.203, 160.204)
1. General Rule
The NAIC membership has serious reservations about how the
preemption standard used in the proposed regulation is to be
implemented. The general rule established in HIPAA Section 262 and used
in the current proposed regulation states that provisions of state law
are preempted to the extent that they are contrary to the federal
statutory and regulatory scheme. ``Contrary'' is defined in the
proposed regulation such that: (1) complying with both state and
federal requirements would be impossible; or (2) obeying state law
prevents the accomplishment and execution of the full purposes and
objectives of the regulation (HHS Sec. 160.202). HHS has specifically
requested comment on how these proposed criteria would be likely to
operate with respect to particular state privacy laws (64 Fed. Reg.
59997).
While we recognize that HHS, in defining contrary, has used the
standards developed by the courts for conflict preemption (64 Fed. Reg.
59997), we would note that in the past we have found similar
definitions not to be very helpful in comparing state laws to federal
requirements. We encounter a similar difficulty when conducting a
conflict analysis for ERISA preemption using the ``relates to''
standard. Using the conflict analysis, a state must examine all its
laws relating to health information privacy to determine whether or not
its laws are contrary to the requirements in the proposed regulation.
This in and of itself is a major project for states to undertake. Just
identifying all of the laws, let alone comparing them to the federal
regulation, is time-consuming and confusing for states. However, in
response to HHS' request for comment, we offer a suggestion to help the
operation of and to ease the administrative burden of implementing this
standard.
We believe that how the term ``provision'' is defined will effect
the practical implementation of the general rule. We propose that the
states be given the greatest amount of flexibility in determining what
the necessary scope of ``provision'' is when applying the general
rule's contrary standard.\4\ HHS has recognized that states know their
laws best and are best informed about how to apply their laws. (64 Fed.
Reg. 59998). The NAIC membership believes that the definition should
preserve to the maximum extent possible state privacy initiatives that
extend beyond the covered subject matter of the proposed regulation.
---------------------------------------------------------------------------
\4\ Our suggestion addresses HHS' request for comment on how the
term ``provision'' might be defined (64 Fed. Reg. 59995).
---------------------------------------------------------------------------
According to the preamble, when applying the general rule, what
will be compared are state and federal requirements that are analogous,
i.e., that address the same subject matter. If there is a state
provision and no analogous provision in federal law, there is nothing
to compare and no issue of a contrary requirement. (64 Fed. Reg.
59995). Consequently, if the state law is not contrary, the state law
stands. If the state law is contrary, the state must go to the next
step in the analysis to see if a contrary state law can still be saved
from preemption by qualifying as one (or more) of the three categories
of exemptions. We believe these are important statements and should be
included as guidance in the regulation itself, not just in the
preamble.
2. Exceptions to Preemption of Contrary State Laws
The exceptions to preemption for state laws that are contrary to
the proposed regulation fall into three categories: (1) those state
laws that require a determination by the Secretary that they are
necessary for certain purposes as set out in HIPAA (HHS
Sec. 160.203(a); (2) those state laws that relate to the privacy of
individually identifiable health information that are contrary to but
more stringent than the federal requirements (HHS Sec. 160.203(b)); and
(3) those state laws that are explicitly carved out or exempted from
the general rule of preemption (HHS Sec. 160.203 (c), (d)).
These exceptions are established in the HIPAA statute, so we
understand that HHS is prevented from adding or deleting any exceptions
and is limited in how these exceptions are used. However, we have
comments and concerns regarding each category of exceptions. Our most
serious concerns lie with the exceptions that require a determination
by the Secretary. We also seek clarification regarding how these
exceptions work on a practical level if a state law falls into more
than one category of exception.
a. Exceptions Requiring a Determination by the Secretary (Category
One)
Under this exception, a state may continue to enforce a contrary
provision of state law that falls into one of five categories,\5\ but
only after obtaining a favorable determination from the Secretary of
HHS. As set forth in the proposed regulation, if a state wants to
continue to enforce a contrary provision of state law that falls under
one of the listed categories, the state must submit a written request
with detailed information to the Secretary seeking an exception to the
preemption. Until the Secretary's determination is made, the federal
requirement remains in effect. The Secretary will deny a request if it
determines that the federal requirement accomplishes the law's purpose
as well as or better than the state law for which the request is made.
If an exception is granted, it is effective for three years or for such
lesser time as is specified in the determination granting the request.
(HHS Sec. 160.204(a)).
---------------------------------------------------------------------------
\5\ The five categories are: (1) the provision of state law is
necessary to prevent fraud and abuse (emphasis added); (2) the
provision of state law is necessary to ensure appropriate state
regulation of insurance health plans (emphasis added); (3) the
provision of state law is necessary for state reporting on health care
delivery or costs; (4) the provision of state law is necessary for
other purposes related to improving the Medicare program, the Medicaid
program, or the efficiency and effectiveness of the health care system;
and (5) the provision of state law addresses controlled substances. The
italicized exceptions are of particular interest to the state insurance
departments as the regulators of the insurance industry. (HHS Sec.
160.203(a)).
---------------------------------------------------------------------------
We believe there are several serious flaws with this proposed
process. Our primary concern is that the determination process is
overly burdensome for states. Not only do states have to conduct a
``contrary analysis'' for all of their laws that protect health
information and then submit requests for exceptions to HHS, but they
also have to wait for HHS to make a determination in order for the
states to enforce their laws.
We are very concerned about the provision in the proposed
regulation that states that the federal standard applies until a
determination is made (the statute is silent on this issue) (HHS Sec.
160.204(a)(2)). This provision is unacceptable for insurance
departments that are charged with protecting the citizens of the state
and enforcing state laws regulating health plans. Cessation of state
regulation in the interim will essentially leave plans unregulated
until HHS makes a determination. The NAIC membership does not believe
that the states should be hampered in their legal duties by having
their laws preempted until they can prove to HHS that their laws are
``necessary'' for their states. States have passed privacy laws after
careful consideration and debate, and they should not have to ask HHS
for permission to enforce their own laws.
We offer a simple solution to this problem that would work within
the confines of HIPAA and HHS' jurisdiction. The current assumption in
the proposed regulation that the federal standard applies until a
determination is made should be reversed. We believe there is enough
latitude in the statute (i.e. the statute is silent) to reverse the
presumption, so that a state law stands until and unless HHS has
determined otherwise. The presumption should be in favor of the state's
interpretation of its law. This reversal is necessary to avoid a
regulatory vacuum, especially considering that the regulation does not
establish a time frame within which the Secretary must make a decision.
As a result, we believe state law should stand while HHS is making a
determination.
On a related note, the NAIC membership questions whether HHS is
prepared to conduct determinations for all 50 states' laws. After
states complete their ``contrary analysis,'' they will submit their
state laws to HHS to make a determination. State privacy laws are found
in many different areas of a state's statutes and regulations, so the
Secretary may receive a number of requests per state. Without an
increase in funding for HHS and the development of HHS' infrastructure,
HHS will not be able to handle the volume of preemption determination
requests from the states.
Another problem with the proposed regulation is the lack of details
about the determination process. The proposed regulation does not
establish a time frame or deadline by which HHS has to issue a
determination. States could be waiting for years or indefinitely to
find out whether HHS will grant an exemption. Such indecision could
have a dampening effect on a state's ability to pass further legitimate
legislation. We suggest that HHS revise its regulation to include a
time period by which HHS has to make a determination. We also suggest
that if HHS does not make a determination after a specified amount of
time, then a default determination should be issued in favor of the
state.
We also are bothered by the fact that even if states are granted an
exemption from preemption through the HHS determination process, there
is a time limit on how long a state law is exempt pursuant to this
determination (HHS Sec. 160.203(a)(4). The process is quite burdensome
for the states, so we question the provision requiring states to ask
for a re-determination on the same laws every three years as a waste of
time and resources for the states and for HHS. HHS should eliminate the
three-year limit on how long the exemption is effective.
We are also concerned that there is no requirement in the
regulation regarding giving notice to the states and others that HHS
has made a determination, other than an annual publication in the
Federal Register of all determinations made by HHS. (HHS
Sec. 160.203(a)(8). More frequent notices, such as quarterly, should be
made. We also suggest that HHS provide more details in the proposed
regulation about the factors it will consider in its determination
process and if there is a formula HHS will use to decide whether a
state will be granted an exemption.
b. Exception for State Laws that are More Stringent than the
Regulation (Category Two)
The second exception allows a state to continue to enforce a
contrary provision of state law that relates to the privacy of health
information if it is more stringent than a standard, requirement, or
implementation specification adopted under the proposed regulation.
More stringent is broadly defined in the proposed regulation as
providing greater privacy protections for the individual. A state is
not required to obtain a determination about whether a provision of its
law meets this exception. However, the Secretary on her own, or at the
request of a state, may issue an advisory opinion as to whether a
provision of state law meets this exception. (HHS Sec. 160.204(b)).
In the NAIC's Congressional testimony (see attached), we supported
the establishment of minimum standards in the area of health
information privacy, and we urged Congress to outline a way in its
legislation for the states to measure their laws against any federal
standard. We appreciate that HHS has chosen to establish minimum
federal standards and has included guidelines for states to measure
their laws against the proposed regulation (i.e., less disclosure to
others; greater right of access to health information by the
individual; greater penalties; narrower scope of authorization; longer
record-keeping requirements and accounting requirements.). States need
to be able to judge whether their state laws are stronger than any
federal standard in order to determine whether they need to take
further action to revise their laws. By defining ``more stringent'' in
the proposed regulation, HHS has offered several different examples of
what qualifies as more stringent as guidance to the states, with the
overriding principle of more protection to the individual whose
information is being used or disclosed. (HHS Sec. 160.202).
Additionally, we support HHS' decision to limit the parties who may
request advisory opinions to the states and the Secretary of HHS. (HHS
Sec. 160.204(b)(1); 64 Fed. Reg. 59998). We do not believe that
insurers should be allowed to request an advisory opinion and open
every state law up to challenge and to review by HHS.
We do have one concern regarding this exception that we believe
could be resolved with explicit clarification. Since the federal
regulation only applies to individually identifiable health information
that is electronically maintained and transferred and it only applies
to health insurers, not all insurers, we would like assurance that the
NAIC Model Act and similar state laws, which have a much broader scope
(apply to all forms of transmission and to all insurers), would be
viewed as more stringent and would be allowed to stand under the
proposed regulation. We believe that these broader state laws would
fall under the category of ``providing greater privacy protection for
the individual,'' but explicit clarification in the preamble or text or
even inclusion in the list of examples would be appreciated. The
regulation should preserve state laws to the maximum extent possible
and allow states to enforce their laws as they apply to entities and
situations that are beyond the scope of the regulation.
Overall, we are supportive of this exception and how HHS has
addressed the issue in the regulation. This federal floor exception
will still require the states to analyze their laws regarding whether
the laws are contrary and more stringent than the proposed regulation.
However, the states will not have to go through the burdensome process
as required by the category one exceptions, and they will not be
prevented from enforcing their laws waiting for a determination. In
addition, this exception allows states to enact stronger laws where and
when they are needed and to enact laws in the future to address changes
in technology and in the use of health information and to address
state-specific issues.
c. Exceptions that are State Law Carve-Outs (Category Three)
Under the third category of exceptions, a state may continue to
enforce a contrary provision of state law that the meets one of the two
specified exceptions: (1) provisions of state law requiring the
reporting of disease or injury, child abuse, birth or death, or for the
conduct of public health surveillance, investigation or intervention;
and (2) provisions of state law requiring a health plan to report, or
to provide access to, information for the purpose of management audits,
financial audits, program monitoring and evaluation, facility licensure
or certification, or individual licensure or certification (emphasis
added). (HHS Sec. 160.203(c), (d)). No mechanism is required or
available under the proposed regulation for determining whether a state
law meets one of these complete carve out exceptions. It appears to be
left up to the discretion of the states, although the NAIC membership
requests that HHS affirmatively state this fact.
The second carve out above is of interest to us. Although state
insurance laws would qualify for this exception, we are concerned with
the scope of the exemption regarding oversight of health plans. We
realize this list of activities related to state insurance department
oversight is set forth in HIPAA Sec. 262 (Social Security Act
Sec. 1178); however, the preamble of the proposed regulation explains
that Sec. 1178 carves out an area which the states traditionally have
regulated and which the statute intends to preserve for the states (64
Fed. Reg. 59999). We are concerned because the list has omitted some
very important activities that are traditionally regulated by the
states in the area of health care, specifically such activities as
market conduct examinations, enforcement investigations or consumer
complaint handling. While it is possible that these functions may be
included within other categories that are itemized, it is certainly not
clear that these functions would fall within the exemption. The NAIC
membership thinks that the proposed regulation should recognize that
these and other state insurance department activities are covered under
this exception. The stated intent is to preserve an area of law
traditionally regulated by the states, therefore we request that the
regulation clarify, either in the preamble or the text, that a broad
scope of state insurance department activities fall within this carve
out.
3. Interaction Among the Three Categories of Exceptions
We request a clarification regarding state laws that are contrary
to the proposed regulation but that could fall into more than one
category of exception. Clearly the proposed regulation contemplates a
state law falling into more than one exception (HHS Sec. 160.203),
especially since the three categories of exceptions are drawn broadly.
We believe state insurance laws easily could fall into several
categories of exceptions. An example is state laws regulating health
insurance plans (category one) that are more stringent than the federal
regulation (category two) and require health insurance plans to report
information (category 3). However, this language raises several
questions: (1) If a state law falls into more than one exception, do
states get to choose which category of exception applies? (2) Will
insurers, consumers or others be allowed to sue state insurance
departments if they do not agree with the departments' classifications
of the laws? (3) Will this issue result in litigation in order to
resolve which category of exception any particular state law falls
into? We think a simple clarification statement in the regulation will
answer these questions.
We ask HHS to include language in the text of the proposed
regulation stating that if a state law falls within several different
exceptions, the state chooses which exception shall apply. Clearly, the
states would prefer a category three exception (complete carve-out)
over a category two exception (optional advisory opinion), and a
category two exception over a category one exception (required prior
determination). The presumption should be that the state has the best
knowledge of its laws and it has correctly classified its laws in the
appropriate category of exceptions. HHS even recognized in the preamble
that states are the most knowledgeable about their own laws. (64 Fed.
Reg. 59998). We think this simple clarification statement will avert
much litigation and prevent state insurance departments from having to
defend endless challenges to their classification of their laws.
III. Comments on Exceptions from the Authorization Requirement for
Disclosure to Health Oversight Agencies for Health Oversight Activities
(HHS Sec. 164.510(c)); for Disclosure for Law Enforcement Purposes (HHS
Sec. 164.510(f)); and for Use and Disclosure for Judicial and
Administrative Proceedings (HHS Sec. 164.510(d)). (``Health
Oversight,'' ``Law Enforcement,'' and ``Judicial and Administrative
Proceedings'')
A. Classification of State Insurance Departments
Similar to the NAIC Model Act, the proposed regulation establishes
a list of exceptions to the authorization requirement, such that
protected health information may be used or disclosed without
authorization in certain circumstances. However, under the HHS proposed
regulation, the activities of state insurance departments fit under any
one or more of the following three exceptions: (1) for disclosure to
health oversight agencies for health oversight activities; (2) for
disclosure for law enforcement purposes; and (3) for use and disclosure
for judicial and administrative proceedings. The regulation is unclear
about the role of insurance departments relative to these exceptions.
1. Health Oversight Agencies and Their Activities (HHS
Sec. 164.510(c))
The definition of ``health oversight agency'' \6\ most clearly
encompasses and applies to state insurance departments. Although the
preamble specifically lists state insurance departments as included in
this category, we suggest including this statement in the text of the
regulation, not just the preamble (64 Fed. Reg. 59958).
---------------------------------------------------------------------------
\6\ ``Health oversight agency'' is defined as an agency, person or
entity, including the employees or agents, that is a public agency (or
acting under a grant of authority from or contract with a public
agency) and which performs or oversees the performance of any audit;
investigation; inspection; licensure or discipline; civil or criminal
or administrative proceeding or action; or other activity necessary for
appropriate oversight the health care system. (HHS Sec. 164.504).
---------------------------------------------------------------------------
The proposed regulation provides an exception to the authorization
requirement for disclosure to health oversight agencies for conducting
health oversight activities. According to the proposed regulation,
these health oversight activities authorized by law include audits;
investigations; inspections; civil, criminal or administrative
proceedings or actions; and other activities necessary for appropriate
oversight of: i) the health care system; ii) government benefit
programs for which health information is relevant to beneficiary
eligibility; or iii) government regulatory programs for which health
information is necessary for determining compliance with program
standards (HHS Sec. 164.510(c)(1)).
We are particularly concerned about the scope of the exemption in
terms of the listed activities that are included for state oversight of
health plans. While the list includes a large catch-all category for
``other activities necessary for appropriate oversight of the health
care system, government benefit programs, or of government regulatory
programs,'' the list fails to include other oversight activities that
are of such importance to state insurance departments that they should
be specifically listed. Some of these oversight activities that are
traditionally conducted by the states are: market conduct examinations;
consumer complaint handling; solvency and financial examinations;
rehabilitation and liquidation; investigations; audits; fraud
activities; establishing and enforcing legal or fiscal standards
relating to the regulation of the business of insurance, including
claims, underwriting, sales, and managed care; assessments,
evaluations, determinations; initiation of administrative, civil or
criminal proceedings; compliance and enforcement of laws or
regulations.
While it could be argued that some of these functions are included
within other categories that are itemized, it is certainly not clear
that these functions would fall within the exemption. In order to
ensure that every insurance department can fulfill its obligations to
the citizens in its state, we request that HHS add these additional
oversight activities to the list of specific examples. We also request
that HHS clarify that the catch-all exemption to the authorization
requirement for activities necessary for the appropriate oversight of
the health care system is intended to include all legally authorized
activities performed by insurance departments.
2. Health Oversight Activities by Two or More Agencies.
On a related note, the preamble states that in cases where health
oversight agencies are working in tandem with other agencies overseeing
public benefit programs to address compliance, fraud or other integrity
issues that could span across programs, the oversight activities of the
team would be considered health oversight and disclosure to and among
team members would be permitted under the proposed rule to the extent
permitted under other law. (64 Fed. Reg. 59958). We appreciate that
state agencies will be able to work together and share protected health
information among agencies in order to conduct oversight activities and
share information, without being considered as business partners or
needing a contract to share information among state agencies.
However, we would like to see this ability to share information
with other agencies for oversight purposes expanded from just
overseeing public benefit programs (i.e. Medicaid) to overseeing health
programs and activities as a whole. For example, an insurance
department may not be the sole agency in a state that regulates health
insurers and plans. In some states, the Department of Health, the
Department of Corporations or the Department of Managed Care is
responsible for regulating managed care entities. This results in an
overlap in jurisdiction or in delegation of responsibilities among
agencies for regulating the health insurance entities. Sharing of
information among agencies for these oversight activities is just as
important as oversight of public benefit programs. Consequently, we
would like to see the regulation recognize the need for information-
sharing among agencies for the oversight of health programs and
activities as a whole.
3. Law Enforcement and Judicial and Administrative Proceedings (HHS
Sec. 164.510(f), (d))
In addition to falling into the health oversight exception, it
could be argued that certain state insurance department activities fall
under the law enforcement and judicial and administrative proceeding
exceptions. The definition of ``law enforcement official'' is very
broad and includes an officer of an agency or authority of a state who
is empowered by law to conduct: 1) an investigation into a violation
of, or failure to comply with any law; or 2) a criminal, civil or
administrative proceeding arising from a violation of, or failure to
comply with, any law. (HHS Sec. 164.510(f)(1)(ii); 64 Fed. Reg.
59937). Because of their job responsibilities, state insurance
commissioners would fall into this definition. As drafted, state
insurance department efforts to combat health care fraud could be
considered law enforcement activity.
Judicial and administrative proceedings are not defined in the
proposed regulation but are considered an exception to the
authorization requirement. Under this exception, persons are permitted
to disclose information in the course of any judicial or administrative
proceeding, but only in response to an order of a court or
administrative tribunal, or where the individual is a party to the
proceeding and his or her medical condition or history is at issue and
the disclosure is pursuant to lawful process or otherwise authorized by
law. (HHS Sec. 164.510(d)(1)). State insurance departments conduct
administrative proceedings and are often involved in judicial and
administrative proceedings.
Potentially, one single activity could be construed as falling into
all three exceptions. An example could be a joint investigation by an
insurance department's investigation team, which is investigating a
licensee for purposes of determine if administrative action should be
taken against the licensee, and the department's fraud unit, which may
prosecute the individual for insurance fraud. This issue raises
procedural questions, especially if one exception requires a court
order (judicial and administrative proceedings), one does not (health
care oversight), and another exception may require a court order in
certain situations (law enforcement, although not for health care
fraud). The preamble states that agencies that conduct both oversight
and law enforcement activities would be subject to the provision on use
and disclosure for health oversight activities when conducting
oversight activities (64 Fed. Reg. 59958). However, what standards
apply when conducting other activities. It is difficult to have several
different applicable rules based on the activities the states are
performing. This is especially true if states are conducting activities
that fall into more than one category of exception and the activities
are not so easily divided into parts that need authorization and those
that do not.
The regulation should state that either insurance departments
decide which exception applies, or that all insurance department
activities are health oversight activities. Otherwise, state insurance
departments may face endless litigation over their classifications. We
ask HHS to include language in the text of the proposed regulation
stating that if a state insurance activity falls within several
different exceptions, the state chooses which exception shall apply.
The presumption should be that the state has the best knowledge of its
laws and activities and has correctly classified them in the
appropriate category of exceptions. HHS even recognized in the preamble
that states are the most knowledgeable about their own laws (64 Fed.
Reg. 59998). We think this simple clarification statement will avert
much litigation and prevent a state insurance department from having to
defend endless challenges to its classification of the exception that
applies.
B. Permitted Disclosures Versus Required Disclosures to State
Insurance Departments
We are concerned that under the proposed regulation covered
entities are ``permitted'' but not ``required'' to disclose necessary
protected health information to health oversight and law enforcement
agencies (HHS Sec. 164.510(c), (f); 64 Fed. Reg. 59955). Under the
proposed regulation, disclosure is required in only two instances--to
permit an individual to inspect or copy their information, or when
required by the Secretary. (HHS Sec. 164.506)
We believe that covered entities under investigation by a state
agency should be required to provide that state agency with access to
necessary health information when performing its legally mandated
duties. This disclosure should not be optional. By not requiring
insurers to provide state insurance departments with access to records,
filings and other documents that may contain individually identifiable
information, state insurance departments' ability and authority to
perform their regulatory responsibilities is undermined. In addition,
obtaining authorization from all of an insurer's clients for
investigation of an insurer's business practices is not feasible or
practical.
The NAIC requests that disclosure be required under the proposed
regulation in additional instances, including disclosure to health
oversight agencies for health oversight activities consistent with
state law. The NAIC Model Act lists circumstances where an insurer is
required to disclose protected health information without an
authorization. Three of these situations are: (1) disclosure to
federal, state or local authorities to the extent the carrier is
required by law to report protected health information or for fraud
reporting purposes; (2) disclosure to a state insurance department
performing an examination, investigation, audit; or (3) pursuant to a
court order. (NAIC Model Act Sec. 11). By not requiring insurers to
disclose needed records that may contain individually identifiable
health information, state insurance departments will be forced to
obtain court orders for every request of information needed for a
legitimate and lawful purpose.
However, even court orders will not remedy the problem, since under
the proposed regulation's judicial and administrative proceeding
exception, covered entities are permitted to disclose protected health
information in a judicial or administrative proceeding if the request
for such protected health information is made through or pursuant to an
order by the court or administrative tribunal. (HHS Sec. 164.510(d)).
This use of ``permitted'' in the proposed regulation instead of
``required'' will severely hamper state insurance departments from
doing their jobs.
The preamble states that protected health information is often
needed as part of an administrative or judicial proceeding, and it even
lists examples. The preamble states that these ``uses of health
information are clearly necessary to allow the smooth functioning of
the legal system.'' (64 Fed. Reg. 59958-59959). If the uses are
necessary, it logically follows that the language in the text of the
proposed regulation should use the word ``required'' instead of
``permitted.''
IV. Comments on Accounting for Disclosures Requirement (HHS
Sec. 164.515)
Both the proposed regulation and the NAIC Model Act grant
individuals the right to an accounting of the disclosures of their
protected health information from covered entities (HHS Sec. 164.515;
NAIC Sec. 9), and both establish exceptions to this right. The proposed
regulation establishes an exception so that accounting for disclosure
to an oversight agency or law enforcement agency is not required to be
given to an individual if the agency provides a written request stating
that the exclusion is necessary for a specified period of time. (HHS
Sec. 164.515(a)(2)). The NAIC Model Act's exception states that the
carrier is not required to include in the accounting any disclosures of
protected health information that were compiled in preparation for
litigation, law enforcement or fraud investigation. There is no date-
specific deadline on this exception.
Both the proposed regulation and the NAIC Model Act create
exceptions to the accounting requirement for oversight agencies and law
enforcement agencies conducting investigations. The problem with the
proposed regulation is that it is nearly impossible to accurately
project the length of an investigation, especially during its early
stages. Rather than designating a specific date or a specific amount of
time for no accounting of disclosures to oversight or law enforcement
agencies, the NAIC suggests a deadline based on the end of an event,
such as conclusion of an investigation. This ensures that an individual
will receive a full accounting of disclosures at a certain point but
also allows an oversight or law enforcement agency to complete its
investigation without having to set some arbitrary date of disclosure.
V. Comments on Banking Activities and Financial Services Modernization
(HHS Sec. 164.510(i)) (``Banking and Payment Processes'')
HHS attempts to address banks and banking activities within the
scope of the proposed regulation. We believe this is a very important
issue in light of the passage of financial services modernization
legislation, The Gramm-Leach-Bliley Act, Public Law 106-102 (the ``GLB
Act''), and with the changes in the entities that are considered
``payers.'' However, we have some concerns about how banks and their
activities are handled under the proposed regulation.
A. Payment Activities Versus Non-Payment Activities
The first issue concerns the exception for banking and payment
processes (HHS Sec. 164.510(i)). This exception is confusing because
HHS attempts to address two separate issues within the context of this
one exception--payment activities and non-payment banking activities.
We believe these two issues should be handled separately.
Under the statute (Sec. 1179 of the Social Security Act/Sec. 262 of
HIPAA), banks can use or disclose protected health information for
certain listed purposes (all involving payment), and HHS repeats these
approved activities in the regulation.\7\ billing, transferring,
reconciling or collecting payments'' for health care or health plan
premiums.
---------------------------------------------------------------------------
\7\ These activities are ``authorizing, processing, clearing,
settling, billing, transferring, reconciling or collecting payments''
for health care or health plan premiums.
---------------------------------------------------------------------------
Under Sec. 164.510(i), ``disclosure for banking and payment
processes,'' covered entities are allowed to disclose protected health
information to financial institutions without an individual's
authorization for processing payment for health care and health care
premiums, including the processing of checks or credit card
transactions as payment for health care services.\8\ However, covered
entities would not be allowed under the proposed regulation to include
any diagnostic or treatment information in the data transmitted to
financial institutions. (64 Fed. Reg. 59966).
---------------------------------------------------------------------------
\8\ We question the need for the exception for disclosure for
banking and payment processes. Under the general rule, authorization is
not required for payment purposes. Presumably a covered entity would
not need an authorization to disclose protected health information to a
bank for payment purposes. However, one of the additional listed
exceptions is for disclosure for banking and payment processes. This
exception appears to be duplicative of the general rule, which raises
the question of why this is an exception. It appears HHS wants to limit
the amount of information that a bank can receive to process a payment,
specifically a check or a credit card transaction. This is less of an
exception to the general rule and more of a clarification of the rule,
since the rule already excepts payment activities.
---------------------------------------------------------------------------
We agree with HHS' assessment of a bank's role in payment
activities. We too recognize that a certain amount of information is
needed to process payments, but we agree that a bank would not need
diagnostic or treatment information in order to process a payment and
that in most cases, if not all, only the specified information would be
necessary for a bank to conduct payment activities.\9\ (64 Fed. Reg.
59966).
---------------------------------------------------------------------------
\9\ Limited list would include only: (1) the name and address of
the account holder; (2) the name and address of the payer or provider;
(3) the amount of the charge for health services; (4) the date on which
health services were rendered; (5) the expiration date for the payment
mechanism, if applicable (i.e., credit card expiration date); and (6)
the individual's signature.
---------------------------------------------------------------------------
HHS also raises the issue of non-payment banking activities in the
preamble of this exception (not in the text of the proposed
regulation). HHS theorizes about activities banks may be providing now
and in the future for plans and providers, and HHS recognizes that
banks, in addition to offering traditional banking services, may be
interested in offering additional services to covered entities such as
tracking services, and diagnostic and treatment information, claims
management and billing support. (64 Fed. Reg. 59966). With the passage
of the GLB Act, this is a very real scenario.
Currently, banks are not considered covered entities under this
proposed regulation. HHS tries to address its lack of jurisdiction over
banks by classifying banks as ``business partners'' of covered entities
when receiving protected health information for non-payment
activities.\10\ (64 Fed. Reg. 59966). For example, if a bank offers an
integrated package of traditional banking services and health claims
and billing services, it could do so through a business partner
arrangement that meets the proposed requirements. (64 Fed. Reg. 59966-
59967).
---------------------------------------------------------------------------
\10\ A covered entity may disclose protected health information to
persons it hires to perform functions on its behalf (``business
partners''), where such information is needed for that function.
However, a covered entity and its business partners would be required
to enter into a contract that establish the permitted and required uses
and disclosures of such information by the partners.
---------------------------------------------------------------------------
We agree with HHS' assessment that nothing in the regulation would
prohibit banks from becoming business partners of covered entities
under the conditions established in the proposed regulation (HHS
Sec. 164.506(e)), and that any services offered by a bank that are not
on the list of exempt services in the statute (Social Security Act
Sec. 1179) should be subject to the business partner rule. We also
agree that disclosing protected health information to a financial
institution for non-payment activities without authorization or without
a business partner contract would violate the provisions of the
proposed regulation. (64 Fed. Reg. 59966).
As demonstrated by our comments, our concerns do not involve how
HHS has addressed payment activities or non-payment activities of
banks, but rather that HHS has addressed these two issues together as
if there were no differences in the need for protected health
information in these two sets of activities. We think that bank
activities that do not involve processing payments should be handled
separately from payment activities. The exception (HHS Sec.
164.510(i)) should be narrowed to be just ``payment processes'' and
should not be ``payment and banking processes'' or any other activities
outside the scope of payment. All other non-payment activities should
be governed by the business partners rule.
In addition, there are discrepancies between the preamble and the
actual text of the regulation setting forth this exception (HHS Sec.
164.510(i)). Notwithstanding the discussion on banks as business
partners, the intent of the preamble seems fairly focused and is
narrower in scope than the actual text. The text of the regulation as
it is currently written is overly broad and could lead to unintended
consequences. The preamble addresses payment processes, but the text of
the regulation addresses ``routine banking activities or payment.'' (64
Fed. Reg. 59966; Sec. 164.510(i). ``Routine banking activities'' is
very broad and could include approving loans and offering mortgages--
activities that do not necessitate disclosure of protected health
information for payment, but would be allowed under the text of the
regulation. Banks should not have access to individuals' protected
health information in deciding whether to offer a loan or mortgage. We
suggest that the text of the regulation be re-drafted to reflect the
narrower scope and intent of the preamble.
In short, if covered entities disclose protected health information
to banks strictly for payment processing, we agree that no
authorization is needed, but the information banks receive should be
minimal. If protected health information is used for any other reason,
authorization from the individual would be required or a business
contract with a covered entity would be required.
B. Banks as ``Covered Entities''
Currently banks are not included under the definition of ``covered
entities'' in the HHS proposed regulation; however, with the enactment
of the GLB Act, banks are able to form holding companies that will
include insurance companies (covered entities) and their
activities.\11\ As a result, banks may soon have access to protected
health information once the GLB Act is implemented and banks start
buying insurance companies. When (not if) this happens, we believe
banks should be classified as covered entities under the proposed
regulation. Banks should be held to the requirements of the HHS
proposed regulation and should be required to obtain authorization from
an individual to conduct non-payment activities. As listed in the
preamble, these activities requiring authorization would include: use
for marketing of health and non-health items and services; and use and
disclosure to non-health related divisions of the covered entity (e.g.,
for use in marketing life or casualty insurance or banking services).
(64 Fed. Reg. 59941-59942). HHS should clarify that if financial
institutions act as payers, they should be governed by the HHS privacy
regulation as covered entities.
---------------------------------------------------------------------------
\11\ We are concerned about the relationship between the GLB Act
and its proposed privacy regulations and HHS' proposed health
information privacy regulation. Under the GLB Act, a bank holding
company has affiliates that may be insurance companies, securities
firms, or thrifts. These affiliates are allowed to exchange personally
identifiable financial information with each other and with the bank
holding company without authorization from the individual. The only
restrictions on sharing this information under the GLB Act is with non-
affiliated third parties. Under the HHS proposed regulation, an
insurance company could not share protected health information with an
affiliate without a business partner contract. Clearly, the GLB Act is
less restrictive in the use and disclosure of protected health
information and is less protective of individuals' rights than the HHS
proposed regulation.
Consideration needs to be given to the interaction between the HHS
proposed privacy regulation, the financial services modernization
legislation and proposed regulations, and state laws. In addition to
the impact on state laws, we are concerned about the interaction and
potential conflict between the two federal laws and their regulations.
In general, the relationship between the preemption standards of HIPAA
and the GLB Act, as they relate to financial institutions, is not clear
and is still being analyzed and interpreted by many interested parties
including the NAIC. We ask that HHS work with the federal agencies
(Federal Reserve, Treasury, Office Thrift Supervision, etc.) that are
involved in promulgating regulations to implement the GLB Act to
discuss the potential conflicts between the competing privacy
regulations.
---------------------------------------------------------------------------
VI. Conclusion
In summary, we support HHS' efforts to implement privacy
regulations that leave intact as many state laws as possible. However,
we do have serious concerns about the scope, the applicable entities
effected by the proposed regulation, the preemption of state law, the
determination process for preemption exceptions, and how state
insurance departments and the broad scope of activities for which they
are responsible are classified. We believe that the regulation in its
current form has the potential to significantly impair the states'
ability to regulate the health insurance industry. We do believe that
the proposed regulation may be workable if HHS implements our suggested
changes.
The NAIC appreciates the opportunity to offer these comments
regarding the proposed regulation. The NAIC intends to continue working
closely with HHS on these and other issues. If HHS has any questions
with respect to these comments or any other element of the proposed
regulation, it should feel free to contact myself or Mary Beth
Senkewicz at (202) 624-7790.
Sincerely,
Kathleen Sebelius
Vice President,
Chair, Health Insurance Task Force
Commissioner of Insurance, Kansas
Attachments
National Association of Insurance Commissioners
Federal and International Relations Office
Hall of the States
444 N. Capitol Street, N.W.
Suite 701
Washington, D.C. 20001
(202) 624-7790
National Breast Cancer Coalition
Washington, DC 20036
February 15, 2000
U.S. Department of Health and Human Services
Assistant Secretary for Planning and Evaluation
Attention: Privacy-P, Room G-322A
Hubert Humphrey Building
200 Independence Avenue, SW
Washington, D.C. 20201
Dear Assistant Secretary for Planning and Evaluation:
I am writing to you on behalf of the National Breast Cancer
Coalition (NBCC), and the 2.6 million women living with breast cancer.
NBCC, a grassroots advocacy organization made up of over 500
organizations and tens of thousands of individuals, has been working
since l99l to eradicate breast cancer through increased funding and new
strategies for breast cancer research, access to quality health care
for all women, and expanded influence of breast cancer activists at
every table where decisions regarding breast cancer are made.
NBCC strongly believes that we must establish a national policy
that ensures an individual's right to privacy with respect to
individually identifiable health information. Individuals own their
health information. The issue here is under what circumstances other
people should be able to use an individual's health information. As
breast cancer survivors, we believe that our illness, diagnosis,
treatment and prognosis is very personal information. We also know that
the misuse of our health information can harm us and our families. For
example, unauthorized or inadvertent disclosure of our health status,
genetic or family history can make it difficult if not impossible for
some women and their daughters to obtain health insurance. This danger
becomes an increasing reality as the number of entities maintaining and
transmitting individually identifiable health information and the use
of integrated health information systems generally continues to grow.
Without any national privacy standards to protect consumer's rights,
consumers risk misuse of health information within an uneven system of
state protection.
At the same time, NBCC believes that federal standards for
protecting privacy rights should not impede the progress of biomedical,
behavioral, epidemiological and health services research. Research
offers women diagnosed with breast cancer the best hope for finding a
cure and improving treatment, and someday preventing breast cancer.
NBCC believes that a federal standard should protect the privacy of
individuals and enhance public trust in medical research, and
simultaneously protect the ability of researchers to conduct vital
biomedical research.
The following comments are in response to the Department of Health
and Human Services' (HHS) proposed rule (45 CFR Parts 160 through 164).
NBCC commends HHS for developing significant regulatory standards that
aim to fill the gap in federal health privacy protection. While the
draft regulations properly address several of NBCC's key concerns--such
as access to medical records; notice of information policies; informed
consent; minimum necessary use; and the use and disclosure of personal
health information with regard to research--we remain concerned about
the areas that HHS did not have the authority to cover. It is for that
reason that we continue to urge Congress to enact comprehensive federal
privacy legislation.
We appreciate the opportunity to comment on the health privacy
regulations, and look forward to working with HHS and Congress to
improve health information privacy.
The Regulations are not sufficiently broad in scope.
1. The Regulations cover a limited number of entities.
(Section 164.502)
NBCC recognizes that HIPPA specifically limited the
entities that HHS could cover--so that the regulations could
only apply to health plans, health care providers and health
care clearinghouses. These three categories exclude a number of
entities that receive health information, such as contractors,
third party-administrators, researchers, public health
officials, life insurance insurers, employers and marketing
firms. The regulation's limited coverage of entities is a
serious flaw. Congress must continue to work towards enacting a
comprehensive federal privacy law that would apply to all of
those who generate, maintain or receive protected health
information.
2. The Regulations only cover protected health information
that is electronically transmitted. (Section 164.504)
Another limitation of the draft regulations is that they
only apply to ``protected health information'' which is defined
as individually identifiable health information that has been
transmitted or maintained electronically by a covered entity.
This means that all private health information that remains in
paper form would be unprotected.
Privacy standards must apply to all individually
identifiable health information in any form maintained or
transmitted by a covered entity. It does not make any sense to
draw a distinction based on form rather than content. A covered
entity should be required to treat all information it maintains
or transmits in the same fashion. Covered entities currently
maintain and transmit health information in both electronic and
paper form. In fact, many health care providers maintain solely
paper systems and a majority of health information remains in
paper form. If the regulations do not apply to this information
in any form, they will not accomplish the goal of protecting
individuals' medical privacy. People or organizations that hold
health information that would otherwise be protected could
escape compliance with privacy protections by maintaining the
records on paper. Additionally, for enforcement purposes, it
may prove difficult, if not impossible, to establish that
specific health information at some point in its existence has
been transmitted or maintained electronically and, therefore,
is subject to the regulations. The best way to reduce these
implementation and enforcement ambiguities is to make the
privacy standards applicable to all individually identifiable
health information transmitted or maintained by a covered
entity regardless of its form.
3. The Regulations should explicitly include genetic
information in the definition of individually identifiable
health information. (Section 164.504)
NBCC strongly believes that the definition of individually
identifiable health information is also flawed. While
``individually identifiable health information'' is defined as
information that ``relates to the past, present or future
physical or mental health or condition of an individual,'' this
definition does not explicitly include genetic information.
NBCC urges the Secretary to amend the definition of
individually identifiable health information so that genetic
information is afforded the same protection as other medical
information.
Individuals must have rights
regarding their health information.
1. Individuals must have the right to access, amend and
correct protected health information. (Sections 164.514,
164.516)
NBCC strongly believes that individuals should have certain
rights with regard to their medical records and information in
order to understand how they are being used and maintained.
Individuals should have reasonable access to their records to
inspect, copy, supplement or amend their medical records so
that they can make informed health care decisions and correct
errors where appropriate. The regulations appropriately provide
for these individual rights. Any exceptions that would deny an
individual's access must be extremely limited and narrowly
construed.
2. Individuals must have the right to restrict uses and
disclosures of their health information. (Section 164.506(c))
NBCC also believes that individuals should have the right
to restrict a covered entity from continuing to use and
disclose protected health information. Patients have legitimate
concerns that ongoing disclosures could result in personal harm
or discrimination. Individuals should be able to seek special
protection for certain sensitive information that they do not
wish to be disclosed. For example, many women may wish to
prevent a health care provider from disclosing BRCA1 and BRCA2
test results. Accordingly, NBCC supports the general idea
behind the regulations' granting individuals the right to
request restrictions on the uses and disclosures of protected
health information. However, the regulations must provide
stronger protections by binding all covered entities to any
restriction requested by an individual (except in emergency
situations or when it would harm the individual) and requiring
them to comply or face consequences.
Individuals must be given notice of
information practices. (Sections 164.512, 164.520)
It is important that individuals understand how their
medical records are to be used and when and under what
circumstances that information will be disclosed to a third
party. Individuals should be given easy-to-understand written
notice of how their health information will be used and by
whom. Only with such notice can people make informed,
meaningful choices about uses and disclosures of their health
information. Adequate notice can also help to build trust
between patients and health care provider organizations in so
far as it removes any element of surprise about the use and
disclosure of health information. NBCC believes that the
proposed regulation properly gives individuals the right to
adequate notice of the disclosure policies of covered plans and
providers.
Individuals' informed consent should
be obtained in most instances.
1. Informed consent must be obtained for uses and
disclosures unrelated to health care. (Section 164.508)
NBCC believes that a covered entity must obtain an
individual's specific authorization if it intends to use or
disclose protected health information for any purpose other
than treatment, payment or health care operations. Consumers
regularly sign a general authorization that allows providers
and plans to use their personal health information for
treatment, payment or health care operations. However, there
are many other uses that they might not anticipate and would
want to know about. For example, breast cancer patients do not
expect that information concerning their individual treatment
will be released for targeted marketing of new products based
on their health status. Nor would they necessarily want non-
health related divisions of an employer who provides health
insurance to obtain protected health information for
eligibility or enrollment determinations, underwriting risk
determinations, or employment determinations. Another
unforeseen use is research unrelated to health care, for which
there is insufficient scientific and medical evidence regarding
the validity or utility of the information. Such research might
utilize their health information to discover genetic markers
that could later be used to discriminate against women with a
genetic predisposition for breast cancer. For uses such as
these that are not directly related to treatment, payment, or
health care operations, NBCC encourages the Secretary to retain
provisions of the proposed regulations that require covered
entities to obtain separate and specific authorization from
individuals.
Requiring individuals' explicit authorization for these
uses would enhance individuals' control over their protected
health information, if and only if, the authorizations are
specific about the information to be disclosed and where the
information will go. Furthermore, in order for individuals to
voluntarily authorize such disclosures, their authorization
must not be coerced, as a condition of payment. NBCC suggests
that the regulations be revised to expressly provide that a
covered entity and its business partners may use or disclose
protected health information only for the purpose specified in
the authorization. This would help ensure that the information
does not fall into the hands of non-covered entities that are
not subject to the protections afforded by the regulations.
2. Circumstances under which informed consent is not
required should be strictly limited.
Federal privacy standards should strictly limit the
circumstances under which individuals' identifiable health
information can be used without their informed consent. The
Secretary has proposed that covered entities could use and
disclose protected health information without authorization
for: (1) treatment, payment, and health care operations; and
(2) national priority activities.
(a) Informed consent is not necessary for uses and
disclosures related to treatment, payment and health care
operations if the meaning of these terms is narrowly
interpreted. (Section 164.506)
Uses and disclosures related to treatment, payment and
health care operations include purposes such as quality
assurance, utilization review, credentialing, and other
activities that are part of ensuring appropriate treatment and
payment. While NBCC generally agrees that informed consent is
not necessary for these purposes, the provisions addressing the
meaning of treatment, payment, and health care operations
should be amended. For example, the terms ``treatment'' and
``payment'' should be narrowly interpreted as applying to the
individual who is the subject of the information. In addition,
the definition of ``treatment'' should be amended to ensure
that disease management programs are only conducted with the
authorization of the treating physician. The regulation should
also expressly state that the term ``health care operations''
includes only disclosures made to the covered entity (or a
business partner of such entity) on whose behalf the operation
is being performed. Furthermore, the regulations should limit
the definition of health care operations to include only those
operations that cannot be carried on with reasonable
effectiveness and efficiency without protected health
information.
(b) Generally, informed consent is not necessary for uses
and disclosures related to national priority activities.
(Section 164.510 (b) through (n)
The regulations also provide that individually identifiable
information could be disclosed without informed consent for the
following national priority activities: health care oversight,
public health, emergency purposes, research, judicial and
administrative proceedings, law enforcement, and to provide
information to next-of-kin. While NBCC notes the importance of
these activities, we urge that the final regulation include
certain safeguards to protect individuals against arbitrary
disclosures for law enforcement purposes.
Law enforcement should not have unfettered access to
medical records. (Section 164.510(f))
We believe that the federal law protecting the privacy of
health information should be just as strong, if not stronger,
than the protections for cable and video records. Medical
records contain personal and sensitive information, and the
misuse of peoples' medical information can lead to loss of jobs
and benefits, discrimination, embarrassment, and other harms.
However, under the regulations, medical records are not
afforded the same protections with regard to disclosures for
law enforcement purposes. In light of the importance of medical
records, we recommend that law enforcement be required to
obtain legal process--such as a warrant or court order--that is
judicially-approved after application of a Fourth Amendment
probable cause standard.
Privacy Standards Should not Impedede Medical Research.
1. All research information related to health care should
be reviewed under privacy standards before waiver of individual
authorization can occur. (Section 164.510(j))
There has been much debate about what are appropriate
safeguards for personally identifiable information with regard
to research. Increasingly, health services, epidemiological,
biological and statistical research utilizes medical or health
records and does not involve any interaction between the
researcher and the patients. Researchers have legitimately
raised serious questions about the feasibility of seeking
authorizations from thousands or possibly millions of
individuals. Other research such as retrospective or secondary
research also utilizes archival patient materials, including
medical records and tissue specimens, and does not involve
direct interaction with individuals. While the data can be
encrypted, researchers and epidemiologists need to link this
data back to individuals in order to generate meaningful
conclusions regarding the benefits and adverse outcomes of
particular treatments, as well as medical effectiveness. The
question for breast cancer advocates is under what situations
would it be appropriate to allow the disclosure of health
information for research purposes without patient
authorization.
Currently, under the Common Rule, research organizations
conducting federally funded or regulated research projects must
establish and operate institutional review boards (IRBs), which
are responsible for reviewing research protocols and for
implementing federal requirements designed to protect the
rights and safety of human subjects. No human-subjects research
may be initiated, and no ongoing research may continue, in the
absence of IRB approval. Integral to conducting research under
the Common Rule is a requirement that there is proper informed
consent and documentation of that consent. There are, however,
circumstances when the IRB can waive informed consent (the
Common Rule). These circumstances are when the IRB finds and
documents that the research: (1) involves no more than minimal
risk to subject; (2) won't adversely affect the rights and
welfare of subjects; (3) research can't be carried out without
the waiver; and (4) whenever appropriate, subjects will be
given more information after participation. Much of the
research relying on medical records would meet this test. In
fact, research that relies solely on medical records databases
or pathology specimens may be reviewed in an expedited fashion
by the IRB.
While the IRBs are not without problems and the informed
consent process is far from perfect, NBCC believes this is an
appropriate paradigm to build upon. IRBs have also been given
the responsibility to ensure there are adequate provisions to
protect the privacy of subjects and to maintain the
confidentiality of data and ensure protections for individuals
involved in research. We believe that it would be appropriate
to disclose protected health information for health research
without obtaining authorization if the Secretary requires that
all health research be reviewed by an IRB or an IRB-like entity
(``internal privacy board''). In addition, we would like to see
that all internal privacy boards meet current requirements for
an IRB with respect to information protection, use, and
disclosure, and are determined to be qualified to assess and
protect the confidentiality of protected health information.
Also, the regulations should provide that there be equal
oversight and accountability for both IRBs and privacy boards.
Only under these circumstances would it be appropriate to
waive authorization. NBCC acknowledges that internal privacy
boards have drawbacks -but they appear to be an acceptable
alternative to an IRB.
Generally, we support the intention with regard to research
in the draft regulation. The regulation reflects NBCC's
position that there should be uniform rules for researchers
regardless of the source of funding. We also support the four
proposed additional waiver criteria that IRBs and privacy
boards must consider: (1) the research would be impracticable
to conduct without the individually identifiable health
information; (2) the research project is of sufficient
importance to outweigh the intrusion into the privacy of the
individual whose information would be disclosed; (3) there is
an adequate plan to protect the identifiers from improper use
and disclosure; and (4) there is an adequate plan to destroy
the identifies at the earliest opportunity consistent with the
conduct if the research, unless there is a health or research
justification for retaining identifiers. These additional
criteria emphasize the need for protecting privacy.
While NBCC believes that the Secretary's proposed rules
attempt to create a balance between privacy and research, there
are certain limitations with regard to researchers. Mainly, the
draft regulation only addresses the use and disclosure of
``protected health information'' by covered entities.
Researchers who generate their own health information fall
outside the scope of the regulations if they are not based
within a covered entity, and do not provide health care. We
understand that this reflects the legal constraint imposed on
HHS by the HIPAA. Since a great deal of research will continue
to fall outside the scope of federal regulation, we believe
that there is still an important role to be played by Congress
to fill this gap.
2. Individually identifiable health information must be
afforded greater privacy protection when it is used or
disclosed for research that is unrelated to health care.
(Section 164.508 (a) (3) (iv) (B))
NBCC recognizes the importance of allowing researchers to
conduct vital biomedical research. The proposed regulations
draw a distinction between research information that is related
to the delivery of care, such as information handled in
therapeutic clinical trials, and that which is not related to
treatment, such as early gene sequence analysis. Research
information that is unrelated to health care is: (1) received
or created by a covered entity in the course of conducting
research; (2) information for which there is insufficient
scientific and medical evidence regarding the validity or
utility of the information such that it should not be used for
the purpose of providing health care; and (3) payment is not,
or has not, been requested from a health plan. The distinction
has been drawn so that individually identifiable health
information is afforded greater privacy protection when it is
used or disclosed for purposes that are unrelated to health
care. Under the proposed rule, research information unrelated
to health care generally may only be used or disclosed with
authorization.
We believe that the Secretary has properly drawn this
distinction. However, the definition of ``research information
unrelated to treatment'' should be revised to ensure that once
information is classified as such, it cannot be re-classified
as something else at a later date. We believe that without
qualifying language this information would be vulnerable to
disclosure in the future, if the information were later to
become of scientific validity. The regulation should be clear
that once information is considered ``research information
unrelated to treatment'' it remains that way. This is
especially important given that ``research information
unrelated to treatment'' is afforded a higher degree of
protection under the proposed regulation. Individuals may rely
on this higher degree of confidentiality when consenting to the
collection of the information in the first instance. This
confidentiality should not be betrayed in the future just
because the utility of the information has changed.
The regulations should preempt state privacy laws
that provide less stringent protections and
should not preempt strong state privacy laws. (Section 160.203)
NBCC supports preemption if it sets a floor for the states
and not a ceiling. We should not force states that have
established strong privacy laws to adopt a lower standard. The
proposed regulations reflect this position. The rule will
preempt state laws that are in conflict with the regulatory
requirements and that provide less stringent privacy
protections, but will not preempt state laws that are more
stringent.
Enforcement of Medical Privacy Standards must include
a private right of action for individuals.
Most importantly, we believe that there should be strong
criminal and civil penalties for intentionally or negligently
using individually identifiable health information. While HIPPA
granted the Secretary the authority to impose civil monetary
penalties and criminal penalties pursuant to the proposed
regulations, it did not provide for a private right of action
for individuals. NBCC's position is that the key to
enforceability is a meaningful private right of action -
individuals must have the right to sue if their privacy rights
are violated. Only strong enforcement will give people
confidence that their health information is protected and
ensure that those holding health information take their
responsibilities seriously.
Appropriate safeguards against misuse are necessary to help
build public trust. Only if women trust that their individual
health information will be kept private, will they be willing
to participate in research efforts. At a time when new advances
in science depend heavily on participation in clinical
research, we cannot let the opportunity to build public trust
go by. Knowledge about how to prevent and cure breast cancer
will only come if real federal standards for medical privacy
are enacted.
We respectfully request that HHS reexamine and redefine its
current proposal, and hope to have the opportunity to work with
HHS and Congress on improving federal medical privacy
standards.
Sincerely,
Fran Visco
President
Statement of Judith L. Lichtman, President, National Partnership for
Women & Families
The National Partnership for Women & Families is a national
advocacy organization dedicated to improving the lives of women
and families. Improving access to high quality health care is
an integral part of our mission. Privacy of medical information
is an essential component of high quality care. Medical privacy
is especially important to women because they are the greatest
users of health care services and because of their need for
sensitive services like reproductive health and mental health
services. Medical privacy is also especially important to women
who are victims of domestic violence because inappropriate
disclosures can threaten their personal safety and that of
their children.
Without confidence that private information will remain
just that--private--women are reluctant to share information
with their health care professionals--to the detriment of their
own health. Fear that medical information is not kept
confidential also keeps women from obtaining health care
services in the first place or forces them to go outside their
health plan and incur significant out-of-pocket expenses.
In recognition of our leadership on women's health issues
and keen interest in medical privacy, the National Partnership
was asked to become a member of the steering committee of the
Georgetown University Medical Center, Health Privacy Project's
Consumer Coalition. As an active member of the steering
committee, we helped develop the coalition's privacy
principles. We applied these principles in our analysis of the
proposed rule on medical privacy issued by the Department of
Health and Human Services on November 3, 1999.
Strong and enforceable privacy protections are needed now
more than ever thanks to the recent changes in our health care
system. The rise of managed care means that more people have
access to a person's medical information. The computer
revolution makes immediate transfer and disclosure of such
information possible, but also brings with it the possibility
of strong safeguards against inappropriate use and disclosure
(e.g., the need for passwords to access files).
We had hoped that Congress would meet its own self-imposed
deadline of August, 21, 1999, and enact comprehensive privacy
legislation. Unfortunately, Congress failed to meet that
deadline.
We applaud the Department of Health and Human Services
(HHS) for stepping up to the plate and promulgating this
proposed rule. The promulgation of this proposed rule
represents an extremely important step in restoring confidence
in the privacy of health information. There are many positive
features of this proposed rule that we discuss in our formal
comments to HHS, as well as areas where we urge the Department
to revise its approach. But even if the Department adopted all
of our recommendations, Congress would still need to act. For
example, the proposed rule cannot, and does not, reach all of
the people or entities that use or transfer medical
information. Nor does it provide meaningful enough remedies for
people whose privacy rights are violated. These holes can only
be fixed by Congress, and we call upon Congress to enact
legislation to fill in these holes.
Some of the features of the proposed rule that we believe
are especially important are the following:
that individuals will have the right to see and
copy (and supplement) their own health information;
that individual authorization will be required for
many uses and disclosures of protected health information;
that psychotherapy notes will get the benefit of
special protections;
that only the ``minimum necessary'' to accomplish
the intended purpose of the use or disclosure will be used or
disclosed;
that individuals will be considered ``intended
third party beneficiaries'' of any contract between a covered
entity and its business partners, thus able to enforce their
own privacy rights if this contract is breached;
that the Department has attempted to establish
uniform rules for researchers, regardless of the source of the
funding for the research; and
that, in most instances, the federal rules will
operate as a ``floor,'' not a ``ceiling,'' leaving states with
the authority to provide greater protection for privacy.
There are many areas where we believe the Department can,
and should, more fully protect privacy. One primary improvement
would be to clarify the responsibilities of employers that
sponsor covered health plans. Since most women and families get
their insurance through employment, they fear that employers
know more than they should about their private medical
information and may use that information inappropriately to
make employment decisions. Unless the Department's rule reaches
employers to the fullest extent possible, America's women and
families will not believe their privacy has truly been
protected. In addition, a few of our other recommendations
include the following:
requiring individual authorization for treatment,
payment, and health care operations purposes;
creating a special authorization process for
certain disclosures about sensitive services;
better protecting the personal safety of victims
of domestic violence, including children who are victims of
abuse; and
improving the way the proposed rule handles the
rights of minors.
We look forward to working with the Administration and
Congress to improve the quality of health care and to protect
the privacy of medical information.
Statement of Hon. Ron Paul, a Representative in Congress from the State
of Texas
Mr. Chairman, I wish to thank you for having this timely
hearing on the Department of Health and Human Services' medical
privacy proposal. I also appreciate the opportunity to share my
reasons for opposing HHS' proposal with the Committee.
While I have several serious objections to certain parts of
HHS' proposal, Mr. Chairman, my main objection to these rules
is with the underlying principle of allowing a federal agency
to establish one uniform medial privacy rule for all Americans.
Protecting medical privacy is a noble goal, however, the
federal government is not constitutionally authorized to
mandate a uniform standard of privacy protections for every
citizen in the nation. Rather, the question of who should have
access to a person's medical records should be determined by
private contracts between that person and their health care
provider.
Unfortunately, government policies encouraging citizens to
rely on third-party payors for even routine heath care expenses
has undermined the individual's ability to control any aspect
of their own health care, including questions regarding access
to their medical records. All too often, third-party payors use
their control over the health care dollar to gain access to
even the most personal details of an individual's health care,
using the justification that because they are paying for the
treatments they must have access to the patient's medical
records to protect against fraud or other malfeasance. Because
most of the concerns about medical privacy are rooted in the
loss of individual control over the health care dollar, the
solution to the loss of medical privacy is to empower the
individual by giving them back control of their health care
dollar. The best way to do this is through means such as
Medical Savings Accounts and individual tax credits for health
care. When the individual has control over their health care
dollar, they can control all aspects of their health care--
including who should have access to their medical records.
Rather than support efforts to place the individual back in
control of health care, this administration and many in
Congress have pursued an agenda that would enhance the power of
the federal government over health care. HHS' proposed medical
privacy regulations continue in that sad tradition.
In the name of protecting privacy, HHS has reduced the
individual's control over their medical records. HHS' proposal,
if enacted, would deny, as a matter of federal law, individuals
the ability to contract with the providers or payors to
establish limitations on who should have access to their
medical records. Instead, every American will be forced to
accept the privacy standard decided upon by Washington-based
bureaucrats and politicians.
Individual citizens would not only have to accept the
privacy standards dictated to them by Washington bureaucrats,
they would even be deprived the ability to hold those who
violated their privacy accountable in a court of law. Instead,
the regulations give the Federal Government the power to punish
those who violate these federal standards. Thus, in a
remarkable example of government paternalism, individuals are
forced to rely on the good graces of government bureaucrats for
protection of their medical privacy. These regulations also
create yet another unconstitutional federal crime, at a time
when voices from across the political spectrum are decrying the
nationalization of law enforcement.
HHS appears to believe that the American people should
accept the privacy protections designed by the ``experts'' in
Washington. There is no other explanation for the obstacles
placed in the path of those seeking to comment on this
regulation. For example, HHS is refusing to accept faxed
comments. Furthermore, the web site that HHS has established to
accept comments is very difficult to use and does not even let
the user know whether or not HHS has received his comments! Mr.
Chairman, should we trust an agency that shows such a
reluctance to hear the voice of the people with the power to
determine medical privacy rules for all Americans?
These so-called ``privacy protection'' regulations not only
strip individuals of any ability to determine for themselves
how best to protect their medical privacy, they also create a
privileged class of people with a federally-guaranteed right to
see an individual's medical records without the individual's
consent. For example, medical researchers may access a person's
private medical records even if an individual does not want
their private records used for medical research. Although
individuals will be told that their identity will be protected
the fact is that no system is fail-safe. I am aware of at least
one incident where a man had his medical records used without
his consent and the records inadvertently revealed his
identity. As a result, many people in his community discovered
details of his medical history that he wished to keep private!
Forcing individuals to divulge medical information without
their consent also runs afoul of the Fifth Amendment's
prohibition on taking private property for public use without
just compensation. After all, people do have a legitimate
property interest in their private information; therefore
restrictions on an individuals ability to control the
dissemination of their private information represents a massive
regulatory taking. The takings clause is designed to prevent
this type of sacrifice of individual property rights for the
``greater good.''
In a free society such as the one envisioned by those who
drafted the Constitution, the federal government should never
force a citizen to divulge personal information to advance
``important social goals.'' Rather, it should be up to the
individuals, not the government, to determine what social goals
are important enough to warrant allowing others access to their
personal property, including their personal information. To the
extent these regulations sacrifice individual rights in the
name of a bureaucratically-determined ``common good,'' they are
incompatible with a free society and a constitutional
government.
HHS' ``medical privacy'' proposals also endangers the
privacy of Americans by allowing law enforcement and other
government officials access to a citizen's private medical
record without having to obtain a search warrant. This is a
blatant violation of the Fourth Amendment to the United States
Constitution, which protects American citizens from warrantless
searches by government officials. The requirement that law
enforcement officials obtain a warrant from a judge before
searching private documents is one of the fundamental
protections against abuse of the government's power to seize an
individual's private documents. While the fourth amendment has
been interpreted to allow warrantless searches in emergency
situations, it is hard to conceive of a situation where law
enforcement officials would be unable to obtain a warrant
before electronic medical records would be destroyed.
The proposal's requirement that law enforcement officials
submit a written request to doctors, hospital and insurance
companies before they can access private medical records is a
poor substitute for a judicially-issued warrant. Private
citizens are more likely to want to cooperate with law
enforcement officials than are members of the judiciary, if for
no other reason than because hospital administrators, insurance
company personnel, and health care providers will lack the time
and expertise to properly determine if a government officials'
request is legitimate. Furthermore, private citizens are more
likely to succumb to pressure to ``do their civic duty'' and
cooperate with law enforcement--no matter how unjustified the
request--than members of the judiciary.
I also object to the fact that these proposed regulations
``permit'' health care providers (many of whom are beholden to
government funding) to give medical records to the government
for inclusion in a federal health care data system. Such a
system would contain all citizens' personal health care
information. History shows that when the government collects
this type of personal information the inevitable result is the
abuse of citizens' privacy and liberty by unscrupulous
government officials. The only fail-safe privacy protection is
for the government not to collect and store this type of
personal information.
The collection and storing of personal medical information
authorized by these regulations may also revive an effort to
establish a ``unique health identifier'' for all Americans. As
you are no doubt aware, Mr. Chairman, a moratorium on funds for
developing such an identifier was included in the HHS' budget
for fiscal years 1998 and 1999. This was because of a massive
public outcry against having one's medical records easily
accessible to anyone who knows their ``unique health
identifier.'' The American people do not want their health
information recorded on a database and they do not wish to be
assigned a unique health identifier. Congress must head the
wishes of the American people and repeal the statutory
authority for HHS to establish a ``unique health identifier''
for all Americans.
As an OB-GYN with more than 30 years experience in private
practice, I am very concerned by the threat to good medical
practice posed by these regulations. The confidential
physician-patient relationship is the basis of good health
care; oftentimes effective treatment depends on patients'
ability to place absolute trust in his or her doctor. The legal
system has acknowledged the importance of maintaining
physician-patient confidentiality by granting physicians a
privilege not to divulge information confided to them by their
patients.
Before implementing these rules or passing any legislation
related to medical privacy, HHS and Congress should consider
what will happen to that trust between patients and physicians
when patients know that any and all information given their
doctor may be placed in a government database or seen by
medical researchers or handed over to government agents without
a warrant?
Questions of who should or should not have access to one's
medical privacy are best settled via contract between a
patients and a provider. However, the government-insurance
company complex that governs today's health care industry has
deprived the individual patients of control over their health
care records, as well as over numerous other aspects of their
health care. Rather then put the individual back in charge of
his or her medical records, the Department of Health and Human
Services proposed privacy regulations give the federal
government the authority to decide who will have access to
individual medical records. These regulations thus reduce
individuals' ability to protect their own medical privacy.
These regulations violate the fundamental principles of a
free society by placing the perceived ``societal'' need to
advance medical research over the individuals right to privacy.
They also violate the Fourth and Fifth Amendments by allowing
law enforcement officials and government -favored special
interests to seize medical records without an individual's
consent or a warrant and could facilitate the creation of a
federal database containing the health care data of every
American citizen. These developments could undermine the
doctor-patient relationship and thus worsen the health care of
millions of Americans.
In conclusion, Mr. Chairman, I recommend that Congress
embrace meaningful protection for medical privacy by empowering
individuals to protect their medical records by repealing the
statutory authorization for the Department of Health and Human
Services to impose a one-size-fits all ``privacy''standard on
all Americans and passing legislation placing patients back in
control of the health care system.
Statement of the Physician Insurers Association of America, Rockville,
MD
Thank you for the opportunity to comment on the proposed
regulations to implement standards governing the privacy of
individually identifiable health information as directed under
section 262 of the Health Insurance Portability and
Accountability Act of 1996 (``HIPAA'' or the ``Act''). The
proposed rule appears to be drafted to address considerations
involving health care providers and other ``covered entities''
that are the primary repositories of individually identifiable
health information. However, the proposed rule would also
impact professional liability insurers primarily due to the
contractual restrictions placed on ``business partners.''
Interest of the Physician Insurers Association of America
(PIAA)
The PIAA is a trade association of more than 55
professional liability insurance companies owned and/or
operated by doctors and dentists. Collectively, these companies
insure approximately 60 percent of America's practicing
physicians, as well as dentists, hospitals, and other health
care providers. As such, PIAA member insurance companies
routinely receive reports from providers when adverse outcomes
occur where no claim for recompense has yet been made. These
``event or incident reports,'' as they are known, usually
contain individually identifiable health information. Such
important information is treated with the strictest
confidentiality, and is rarely transmitted to anyone outside of
the insurance company.
While the PIAA and its members strongly support appropriate
privacy protections for individually identifiable health
information, we have several significant concerns regarding the
scope of the proposed rule, its liability implications and the
significant costs and burdens of complying with the proposed
regulations.
Application to Business Partners
The provisions contained at section 164.506(e) of the
proposed rule governing the rule's application to business
partners of covered entities are the source of concern for the
PIAA in two significant respects.\1\ First, this section of the
proposed rule purports to regulate indirectly business partners
that the agency has acknowledged it lacks the authority to
regulate directly. Second, section 164.506(e)(2)(ii)(A)'s
requirement that these contracts designate ``individuals whose
protected health information is disclosed'' pursuant to the
contract as explicit third party beneficiaries, thereby creates
potential liability under state law.
---------------------------------------------------------------------------
\1\ Section 164.504 defines ``business partner'' as ``a person to
whom the covered entity discloses protected health information so that
the person can carry out, assist with the performance of, or perform on
behalf of, a function or activity for the covered entity.'' The
proposed rule identifies ``lawyers, auditors, consultants, third-party
administrators, health care clearinghouses, data processing firms,
billing firms, and other covered entities'' as examples of business
partners for purposes of the proposed rule. Although not specifically
mentioned, the PIAA believes that professional liability insurers would
meet the definition of ``business partner'' for purposes of the rule,
and assumes that professional liability insurers are so classified for
purposes of these comments.
---------------------------------------------------------------------------
Turning to the first concern, Congress expressly set forth
those entities to be covered by the regulation in section
1172(a)(1) of the Act. Indeed, the preamble to the proposed
rule acknowledges that ``we do not have the authority to apply
these standards directly to any entity that is not a covered
entity...[w]e would attempt to fill this gap in our legislative
authority in part by requiring covered entities to apply many
of the provisions of the rule to the entities with whom they
contract for administrative and other services.'' \2\ Using
mandated contractual arrangements to extend the reach of the
regulation to parties not contemplated by Congress exceeds the
authority delegated to the agency by statute. The PIAA believes
that the agency should reconsider this course and allow covered
entities to determine for themselves how best to fulfill their
responsibilities under the Act in their relations with business
partners and others. The agency should not attempt to usurp
Congressional authority through the use of the contractual
artifice included in the proposed rule.
---------------------------------------------------------------------------
\2\ See 64 Fed. Reg. p.59924, (Nov. 3, 1999)
---------------------------------------------------------------------------
For instance, section 164.506(e)(2)(i)(H) of the proposed
rule would specify that, ``At the termination of the contract,
the business partner must return or destroy all protected
health information received from the covered entity.'' \3\ This
proposed requirement fails to recognize that many professional
liability contracts terminate every 12 months at which time a
new contract may be offered to a provider. A decision to offer
the provider a new insurance contract would certainly involve a
review of past claims and adverse event experience beyond the
previous 12 months. Likewise, a claim may be filed against that
provider long after the contract has terminated. In this case,
information about the provider's claims history or the adverse
event in question may be impossible to recreate, yet would be
extremely important to a prompt resolution of the claim. Under
a ``claims-made'' policy, the notice of an event often triggers
the attachment of insurance coverage for the claim should it be
reported in the future. For this reason and others, covered
entities and their business partners should define the terms
and conditions of their contracts instead of having them
dictated in regulations.
---------------------------------------------------------------------------
3 See 64 Fed. Reg. p.59924, (Nov. 3, 1999)
---------------------------------------------------------------------------
Additionally, the PIAA is concerned that the proposed rule
contains a requirement that covered entities and their business
partners designate individuals whose protected health
information is disclosed as express third party beneficiaries
by contract. While the agency proffers no reason for the
inclusion of this requirement in its discussion of the proposed
rule, several experts in the area of health law have suggested
that this provision creates the potential for private rights of
action utilizing a third party beneficiary theory under state
law.
As the agency has itself acknowledged, HIPAA (passed by the
104th Congress) makes no provision for a private right of
action by individuals for violations of the statute.\4\ This
should be regarded as an affirmation that civil and criminal
penalties are the sole remedy for the unauthorized release of a
patient's confidential health information. Moreover, the
question of whether to include such a private right of action
has been bitterly contested in deliberations by the 106th
Congress over legislation that would provide broader privacy
protections of individually identifiable health information.
Given the absence of any congressional establishment of a
federal cause of action for the violation of rights created
under the statute, the Agency should not attempt to create a
potential private right of action. The PIAA is gravely
concerned that the agency would see fit to require the
inclusion of provisions creating liability under state law in
these contracts, particularly without any discussion of the
potential liability ramifications of the third party
beneficiary designation.
---------------------------------------------------------------------------
4 See 64 Fed. Reg. p.59918, p.59923 (Nov. 3, 1999) [``In HIPAA,
Congress did not provide such enforcement authority. There is no
private right of action for individuals to enforce their rights. . .'']
---------------------------------------------------------------------------
In addition to these specific concerns, we believe that the
application of this rule to business partners will result in
expenditures of significant resources for marginal additional
improvements in privacy protection. This would occur at a time
when health care expenditures continue to rise and there is a
serious interest in decreasing the incidence of medical errors
and improving patient care. Devoting resources to the
establishment of appropriate privacy protections for
individually identifiable health information must not be
considered in isolation, but rather as one element in improving
the current health care system.
We are similarly concerned with the prospect of an
increasingly confusing and possibly conflicting array of
responsibilities for liability insurers in the area of privacy.
Has the Agency considered in detail the interaction of the
``business partner'' rule with privacy obligations that may
arise under other proposed regulations and recently enacted
legislation such as the Financial Services Modernization Act.
We believe that minimizing cost and confusion, as well as
eliminating any potentially conflicting obligations is central
to effectively protecting patient privacy.
The PIAA urges the agency not to utilize mandated
contractual arrangements to improperly enlarge on the narrower
authority granted by Congress, and in particular to withdraw
the requirement that the third party beneficiary designation be
included in such contracts.
Customary Business Relationships in the Health Care Industry
During our review of the proposed rule, PIAA members raised
concern regarding the potential impact of the proposed rule on
liability insurers' access to individual health information
related to the activities of their insureds. The preamble to
the rule indicates that the Agency intends ``to allow customary
business relationships in the health care industry to
continue.'' As part of current normal business practice,
professional liability insurers typically receive individually
identifiable health information related to adverse incidents
that may give rise to claims against an insured. Indeed,
reporting requirements are typically stipulated as part of the
claims made policy in an insurance contract. Sharing of such
information also allows the liability insurer to conduct
underwriting reviews to determine insurability. Finally, such
an open business relationship promotes consideration of how
health care systems can be improved to prevent recurrent
adverse events. Under the proposed rule, it is unclear under
what conditions this transfer of information could take place
without individual authorization.
Under section 164.506(a) as proposed, a covered entity
would be permitted to use or disclose protected health
information without individual authorization for treatment,
payment or health care operations. ``Health care operations''
as defined under proposed section 164.504 includes:
``(3) Insurance rating and other insurance activities
relating to the renewal of a contract for insurance including
underwriting, experience rating and reinsurance, but only when
the individuals are already enrolled in the health plan
conducting such activities and the use or disclosures of the
protected health information relates to an existing contract of
insurance (including the renewal of such contract);
(5) Compiling and analyzing information in anticipation of
or for use in a civil or criminal legal proceeding.''
The PIAA is concerned that the proposed definition of
``health care operations'' fails to include the sharing of
information with professional liability insurers that is both
current business practice and necessary for risk management,
error prevention, improving patient care, underwriting and
other insurance purposes. The discussion of insurance under the
proposed definition (above) appears to be limited to insurance
provided by health plans and does not expressly contemplate
other types of insurance, such as professional liability
insurance.
The aspect of the definition including information compiled
``in anticipation of litigation,'' similarly provides little
comfort as it fails to embrace the full array of situations in
which individual health information must be exchanged between
an insured and a professional liability insurer. This exchange
of information often occurs long before a civil or criminal
action is indicated, and indeed is necessary to allow the
insurer to investigate the incident and determine whether
compensation should be paid before any demand letter is
received or civil action initiated. This exchange of
information is additionally necessary even when no claim is
made to aid in underwriting and risk management/evaluation
activities.
Moreover, the ``in anticipation of or for use in a civil or
criminal proceeding'' standard is quite similar to, and equally
as vague as, the ``anticipation of litigation'' standard for
the work product rule under Federal Rule of Civil Procedure
26(b)(3) which has spawned reams of case law attempting to
define under what circumstances this standard has been met.
The ramifications of failing to clarify the definition of
``health care operations'' to include information shared with
professional liability insurers are serious as it would appear
that professional liability insurers would then be relegated to
the exception for protected health information obtained for
judicial and administrative proceedings. As proposed, the rule
would impose the burdensome requirement that any transfer of
protected health information could only occur pursuant to court
order or by request from legal counsel in litigation. This
result would be counterproductive for all concerned, including
patients, as it would essentially require litigation in order
for the claim to be evaluated. The current practice of sharing
information with the professional liability insurer as soon as
an adverse incident occurs facilitates compensation without
litigation in many instances and results in lower costs per
claim.
In light of the foregoing, the PIAA would respectfully
request that the agency modify the definition of ``health care
operations'' to make clear that protected health information
could be shared with a provider or other covered entity's
professional liability insurer without prior authorization.
Finally, we would like to commend the Agency for a well-
detailed and thoughtful approach to creating protections in a
new and difficult area. We hope that our comments will be
addressed in any further actions the Agency takes regarding
this matter.
Statement of Jim Ramstad, a Representative in Congress from the State
of Minnesota
Mr. Chairman, thank you for calling this important hearing
to review the Administration's proposal to protect the
confidentiality of medical records.
Given the sensitive nature of personal health records, I am
very aware of the importance of crafting appropriate rules and
regulations, as well as the complexities that surround this
task.
I applaud the efforts of the Secretary to tackle this
important issue with a comprehensive framework to protect
patient information without inhibiting the use of data to
continue research into life-saving and life-enhancing
treatments, drugs, technologies and procedures. Ensuring
regulations are balanced and do not stifle research, while
protecting privacy, is one of my top priorities.
Given the vast expanse of the regulations and the number of
health care providers impacted by them, this hearing is
important to closely examine the rules and determine if changes
are necessary or more work needs to be done legislatively.
I welcome this opportunity to learn more from today's
witnesses on this significant health care issue, and I thank
you again, Mr. Chairman, for calling this important hearing.
Testimony of the Hon. Louise McIntosh Slaughter, a Representative in
Congress from the State of New York
I thank you, Chairman Thomas and Representative Stark, for
this opportunity to testify on one of the most critical issues
in Congress: medical records privacy. I cannot tell you how
pleased I am that Congress is finally taking up this matter in
earnest.
It is truly gratifying for me to see a national consensus
emerging on the need to protect the privacy of medical records.
Privacy is one of the bedrock principles of our Constitution
and a pillar of our democracy. Our Founders considered privacy
so important that they included it in the Constitution in
several different forms. The First Amendment protects our right
to express our private thoughts, and our right to associate in
private or public with whomever we choose. It protects the
privacy of one's home, possessions and person against
unreasonable search and seizure. It therefore seems natural
that the privacy of medical records--which contain the most
personal of information about an individual--should also be
protected.
Unfortunately, Americans' medical records are anything but
private. While many people believe their medical records are
closed to everyone except their health care provider and
insurer, the truth is very different. On February 4, 1997, a
New York Times article recounted how one doctor started
investigating how many people had access to his patients'
records after being confronted with one patient's fear of
disclosure. He said, and I quote, ``I stopped counting at 75.''
This incident happened a decade ago. The situation is even more
extreme today.
Doctors, nurses, therapists, and secretaries are only a few
of the people who have access to an individual's medical
charts. Today our medical records may also be viewed by
consultants, billing clerks, insurance ``coders,'' and many
others. An employer may have free access to workers' records,
especially if the company is self-insured. Medicare sees the
records of elderly and disabled patients, while Medicaid
workers may view medical charts for the poor. The potential for
genetic discrimination and other misuse of this information is
staggering.
The computerization of medical records has exacerbated this
situation. Many insurers pool medical information in the
Medical Information Bureau, which may distribute it to any
number of sources. Marketers buy sophisticated lists of health
and demographic information to help them target their products.
Lawyers look at records in the context of rape, domestic
violence, and medical injury cases. Equifax and other credit
reporting services can also get access. The list goes on and
on.
The computerization of medical records has added a new
urgency to the need for regulations to protect consumers. In
the past, the practical limitations of paper records made
access more difficult. Computerization of records means that
large numbers of medical records can be screened, collated, and
distributed in the blink of an eye. Information can be made
available to almost unlimited numbers of people via the
Internet. The market for medical records information is
booming, and there is reputed to be a vigorous black market for
it as well.
With the advent of computerized records, the potential for
malicious misuse of this information is truly appalling. In a
widely publicized case, a Florida public health official was
fired after allegedly mailing computer disks with the names of
thousands of Florida patients with HIV and AIDS anonymously to
Tampa-area newspapers. This individual also reputedly took a
list of the patients into a local bar and offered to help
friends screen potential dates. In 1996, the Baltimore Sun
reported that in Maryland there had been examples of state
employees accepting bribes from HMOs for information on
Medicaid recipients. One Delaware banker obtained a list of
cancer patients, cross-referenced it with loan customers at his
bank and called in those loans.
There is a clear and pressing need for federal legislation
to protect the privacy of our medical records. In a 1997 review
of state medical privacy and confidentiality laws prepared for
the Centers for Disease Control and Prevention, the Electronic
Privacy and Information Center (EPIC) called federal privacy
laws ``fragmented and uncertain.'' As long ago as 1994, the
Institute of Medicine endorsed passage of comprehensive federal
legislation to replace the patchwork of laws that cover medical
records. According to the EPIC report,
Thirty-seven states impose on physicians the duty to
maintain the confidentiality of medical records. Twenty-six
extend this duty to other health care providers. Thirty-three
states and territories require health care institutions to
maintain the confidentiality of medical records they hold. The
survey found that only four states have specific legislation
imposing this duty on insurers, despite the vast amount of
information held by insurance companies. Nine states impose a
similar duty on employers or other non-health care
institutions.
Only twenty-two states have legislative provisions that
protect computerized or electronically transferred data. Forty-
two states protect information received during the course of a
physician-patient relationship from disclosure in court
proceedings, with certain exceptions. Twenty-eight states
provide statutory penalties for unauthorized disclosure of
health care information. Twelve impose criminal penalties,
nineteen create civil penalties and three allow for both civil
and criminal penalties. Legislative Survey of State
Confidentiality Laws, with Specific Emphasis on HIV and
Immunization, EPIC, February 1997.
The report concludes by endorsing passage of federal
privacy legislation, stating, ``Uniform standards nationwide
will result in more effective protection of health information
privacy.''
The situation has changed little since that 1997 report.
State laws are fragmented and inconsistent. People living on
opposite sides of a state line have widely divergent privacy
protections and recourse against violations.
In attempting to fulfill the Health Insurance Portability
and Accountability Act of 1996's (HIPAA) requirement that
Congress pass medical records privacy legislation, we all
learned a difficult lesson about the many competing interests
on this issue. The medical records privacy debate draws in
virtually every fact of the health care industry -doctors,
nurses, hospitals, nursing homes, insurance companies, blood
banks, tissue banks, laboratories, information processing
firms, pharmaceutical companies, private and university-based
researchers, disease advocacy groups, medical schools, and
more. Many of these entities have very different ideas about
the appropriate level of privacy that should be afforded to
medical records. And first and foremost, we must consider the
concerns of individual Americans.
Today's hearing seeks to examine the recent regulations
promulgated by the Department of Health and Human Services on
the privacy of computerized medical records. In the broadest
sense, these regulations are a major step forward. They
represent the first concerted federal effort to ensure that
Americans' medical information is not treated lightly. I
commend Secretary Shalala and the HHS officials responsible for
producing these regulations for their extremely hard work. I
would like to highlight three concerns raised on the
regulations:
Research Must Not Be Inhibited. As a former microbiologist,
I am keenly aware of the challenges faced by researchers in
obtaining, analyzing, and interpreting medical information.
Legitimate scientific studies should not be hampered by overly
burdensome requirements or regulations. It is my firm belief
that the majority of research can and should be conducted with
medical information that is not individually identifiable.
Further, I am deeply concerned that some industries may attempt
to obtain medical records for marketing purposes under the
guise of ``research.'' The regulations must ensure that science
can move forward without compromising the privacy of
individuals.
Authorization and Consent Forms Must Be Meaningful. Today,
most insurance forms contain a blanket consent paragraph that
the individual must sign or risk being denied coverage for
treatment. I am pleased that the regulations are designed to
end these meaningless, coercive authorizations and replace them
with a more targeted, informative system. The authorization
form content requirements in the HHS regulations are a major
step in the right direction. We must, however, ensure that
consumers are not presented with endless paperwork, printed in
small type and written in bureaucratic jargon. Such a case
would only result again in consumers signing forms without
reading them or reviewing their private rights in a meaningful
fashion.
Effectiveness of the Regulations Should Be Studied. I would
strongly encourage HHS to include explicitly with the
regulations one or more studies of their effectiveness. Which
consent forms are the most useful for consumers? Are
individuals indeed reading authorizations and considering their
privacy rights? Are entities which hold medical records
complying with the spirit as well as the letter of the law?
Where are the remaining loopholes that may not have been
anticipated? Is research being impacted adversely? Are certain
requirements too burdensome? These regulations are complex; we
cannot allow them to be issued without thoughtful oversight of
their impact.
Finally, I would like to raise a related issue that must
not be ignored. While medical records privacy is critically
important, it is only one side of the coin. The other side of
the coin is nondiscrimination. Individuals' private medical
information, and in particular their genetic information,
should not be used to harm them. Without nondiscrimination
laws, privacy is an empty protection. Without privacy
protection, nondiscrimination laws are unenforceable.
I am proud to be a leader in Congress in the effort to ban
genetic discrimination. In 1995, I introduced legislation to
ban genetic discrimination when few Members were even aware of
the Human Genome Project. Today genetic research and
discoveries are the subject of seemingly daily press reports. A
``rough draft'' of the entire human genome will be completed
this spring. Over the past five years, I have worked
consistently to keep these issue before Members of Congress,
educating them and their staffs about the many ethical, legal
and social implications of genetic research.
H.R. 306, the Genetic Information Nondiscrimination in
Health Insurance Act, would prohibit insurers from denying,
canceling, refusing to renew, or changing the rates, terms, or
conditions of coverage based on genetic information. This bill
has the overwhelming support of 212 bipartisan cosponsors and
over 100 health-related organizations. I am proud to count as
cosponsors all of the Health Subcommittee Democrats, as well as
Rep. Nancy Johnson.
More recently, I have introduced H.R. 2457, the Genetic
Nondiscrimination in Health Insurance and Employment Act. As
its title suggests, this bill would ban discrimination in both
health insurance and employment. Just last week, President
Clinton endorsed this legislation in a major Administration
event and signed an executive order banning genetic
discrimination in federal employment.
Unfortunately, the new HHS medical records privacy
regulations do not ban genetic discrimination. Doing so would
have exceeded the scope of the HIPAA mandate. It is therefore
up to Congress to act on this critical issue.
We owe it to the American people to ban genetic
discrimination. Throughout the course of my work on this issue,
I have received heartbreaking letters from people who want to
take a genetic test, but have decided not to do so because they
are afraid the results might be obtained by their health
insurer or employer. Whenever I speak to groups about genetics,
I am inevitably approached by people afterwards who describe
their own family history of illness and their fears that this
information will be used against them. It is absolutely
reproachable that Congress is allowing this situation to
persist for millions of Americans simply because the leadership
will not act upon this issue.
Medical records privacy is long overdue. Again, I commend
Secretary Shalala and her staff for producing excellent draft
regulations. With some changes, these regulations will provide
a solid basis for protecting the privacy of medical information
in this nation. The next step must be to protect Americans
against genetic discrimination. Unless we ensure that this
information cannot be used to undermine individuals' best
interests, the public will rightly stop supporting genetic
research. The enormous promise of genetic technology will then
go unfulfilled.
I appreciate having this opportunity to offer my comments
on medical records privacy issues, and I look forward to
working with the members of the subcommittee to ban genetic
discrimination.
Statement of VHA Inc.
On behalf of the membership of VHA, we submit these
comments on the Administration's proposed regulations regarding
privacy of individually identifiable health information. VHA
supports the idea that an individual's medical information
should remain confidential. However, this confidentiality
should not operate as a barrier to quality and efficient care.
With this goal in mind, VHA offers the following comments on
the proposed regulations that will have an enormous impact on
all of America's hospitals.
VHA is a nationwide network of community-owned health care
systems and physicians. Through shared knowledge and
commitment, we build strength to improve community health and
achieve market success. VHA has more than 1,800 members,
representing many of America's leading community-owed health
care providers, in forty-eight states and the District of
Columbia. That number represents twenty-four percent of the
nation's community-owned hospitals.
Patients and consumers must be assured that any use of
their medical information will be appropriate and maintained as
strictly confidential in the course of providing care,
performing essential quality assurance activities, conducting
bona fide research, complying with legal requirements, and
performing specific public health activities.
VHA believes that any regulation should avoid imposing
undue administrative burdens and costs on health care providers
and others, or unnecessarily impeding the exchange of
information used in patient care, quality, and payment. Neither
should any regulation adversely impact clinical research or
prudent access to research databases essential for the
advancement of patient care.
It is important for health care organizations operating in
multiple states to have a consistent guide for maintaining the
confidentiality of patient medical information. Therefore, any
federal regulation should preempt existing state laws to ensure
a unified law for multi-state operating health care
organizations.
Patient-identifiable health information is currently used
in a variety of activities to improve health care quality.
These activities include health promotion and disease
prevention, disease management, outcomes research, and
utilization management. Computers, electronic communication and
the rapidly increasing knowledge about human genetics are
vastly improving quality of care. However, the widespread use
of electronic technology to store, transmit, and use health
record information has raised questions about the safety and
security of confidential health information. It is important
that patients and consumers be assured that any use of their
personal medical information is appropriately maintained as
confidential.
VHA aids its members in the development of sound
operational efficiencies that result in both clinical and
economic benefits. The federal government has long recognized
the need for such efficiencies and has exhibited its commitment
to encouraging them through the implementation of various
prospective payment systems in the Medicare program. VHA's
activities are consistent with the federal priority to require
operational efficiencies at all levels in the health care
industry.
To achieve its goals, VHA believes that HHS should clarify
the definition of ``health care operations'' and include a
definition of ``marketing.''
First, the definition of ``health care operations'' needs
to be expanded. Under the proposed regulations, covered
entities, such as VHA members, would not need to seek
authorizations for uses or disclosures of protected health
information (``PHI'') that relate to ``health care
operations.'' As currently written, the definition of ``health
care operations'' includes specific activities ``for the
purpose of carrying out the management functions of [covered
entities] necessary for the support of treatment or payment.''
VHA applauds HHS for its recognition that uses of PHI for
purposes that are ``compatible with and directly related to''
treatment and payment should be exempt from a general
authorization requirement. While the definition of ``health
care operations'' acknowledges this fact, some activities have
been overlooked, creating ambiguities that could inhibit the
nation's hospitals' ability to provide high-quality patient
care and hospital efficiency.
VHA is concerned about the status of activities related to
sound clinical and operational efficiencies under these
regulations. One critical aspect of patient care is the ability
of hospital clinicians to work together to ensure that each
physician has met the hospital's goal of clinical and
operational efficiency. One aspect of this team approach
involves the review of the provisions of medical drugs and
devices by providers. These reviews require that other members
of the hospital staff have access to medical records, which
include PHI. The staff members must work together with
physicians to review relevant medical records to determine the
most efficacious and economic drug or device for patients.
The definition of ``health care operations'' needs to be
clarified to ensure that these types of reviews come within the
tier of activities for which patient authorizations are not
required.
While these reviews most likely fall within ``health care
operations'' as one aspect of ``evaluating practitioner and
provider performance'' or as part of internal quality
oversight, the fit is not absolutely clear from the text of the
proposed regulations. As the preamble notes, the intent of the
regulations is ``to make the exchange of [PHI] relatively easy
for health care purposes.'' These reviews are an important
health care purpose.
While VHA does not believe HHS intended to exclude these
types of reviews from the definition of ``health care
operations,'' we seek clarification as to their status.
Therefore, we suggest that HHS augment the definition of
``health care operations'' by including in the text of the
regulation itself ``engaging in activities related to achieving
clinical and operational efficiencies'' in subparagraph two of
the definition. This clarification should be extended to the
preamble as well.
The financial gain notice requirement should be narrowed.
Under the proposed regulations, a covered entity must include a
statement regarding the financial gain associated with a use or
disclosure of PHI when the covered entity requests an
authorization for the use or disclosure that will result in
financial gain to the entity. In the preamble, HHS clearly
describes its concerns about financial gains resulting from
marketing activities.
VHA understands the concerns regarding the use of PHI for
inappropriate marketing activities, but the proposed language
of the regulation is too broad and restricts other necessary
activities that may also result in financial gain to a covered
entity. For example, when a hospital reviews a physician's
prescription of drugs or use of devices for his/her patients to
achieve sound clinical and operational efficiencies, the
hospital, as well as the patient, the community, the federal
government in its role as a payer for health care, and indeed
the entire health care system receive economic gain. This goal
of providing high quality clinical care that is also
operationally sound is the same as that embraced by the
Congress and the Administration through its creation of the
prospective payment systems.
VHA does not believe HHS intended to create such an
impediment to the use of sound operational efficiencies. Thus,
VHA suggests that the financial gain statement requirement at
45 C.F.R. Sec. 164.508(d)(iv) be narrowed to read: ``(iv) Where
use or disclosure of the requested information will result in
financial gain to the entity that is unrelated to the care of
the individual or the sound clinical or operational
efficiencies of the covered entity, a statement that such gain
will result.'' The preamble should also be modified to reflect
this modification.
The ``minimum necessary'' standard must be tightened so as
not to divert necessary resources from patients and to address,
in a practical manner, the uses and disclosures of PHI in day-
to-day patient care.VHA is concerned that, as currently
described, the ``minimum necessary'' standard will inhibit the
delivery of high quality, cost-effective health care. While it
is clear that some uses or disclosures of PHI may not require
all of the PHI located in a medical record, other uses will
require this complete set of information. Because a vast number
of medical records remain on paper, abstracting can be an
enormous impediment to accomplishing the minimum necessary
goal. Although well-intentioned, this standard will divert even
more scarce resources from patient care to administrative
functions.
Secondly, it is unreasonable to expect that an appointed
person or group will always be able to discern the ``correct''
amount of information necessary for a particular purpose,
especially as related to treatment and certain aspects of
health care operations. For example, what might not seem
important to the appointed person may become vitally important
at a later date in the patient's treatment. If the information
is missing, the patient's medical needs would not be met. The
provider might not even realize until too late that the record
he/she had received had been redacted.
VHA members involved in reviewing the provision of drugs
and devices by providers could also be severely hampered. On
the surface the individual determining the ``minimum
necessary'' amount might believe that only the diagnosis and
medicine prescribed is required reviewing a provider's
prescription practices. For the review to meet its goals of
improving clinical and operational efficiencies, however, it is
often necessary to know the patients' entire histories so that
reviewers can determine why a physician might have selected
certain drugs or devices. Redacting records, even with the best
of intentions, may make quality reviews inefficient or
completely impossible.
Thus, VHA suggests that the standard be tightened. First,
it should be clear that in the case of treatment and health
care operations, the minimum necessary standard should be
modified. In the case of uses or disclosures for treatment, the
minimum necessary standard should apply only to the number of
individuals who obtain the PHI, not the amount of information
because the vast majority of cases will need a full record. To
do otherwise threatens patient care. For health care
operations, the text already creates an exception for ``audits
and related purposes.'' This exception should be clarified so
that important health management reviews of provider practices
are also not subject to the standard in terms of amounts of
data, but only in terms of the number of people with access to
the information.
Second, the explanation of the standards describing the
factors that the Secretary expects to be used in making the
minimum necessary determinations should be made part of the
text of the regulation. Otherwise, the standard is too vague to
be workable and creates the risk that the courts who will
ultimately determine the meaning of ``reasonable,'' will rely
on a different analysis.
Whistleblowers should be held to a ``reasonableness''
standard or not be exempt from the ``minimum necessary''
requirement entirely. As HHS recognizes, the role of
whistleblowers has been etched into efforts to curb fraudulent
behavior. VHA understands the need to allow these individuals
to report abuses to health oversight agencies, law enforcement
officials, or attorneys. The broad protection afforded
whistleblowers in these regulations, however, erodes the
protection of an individual's confidentiality, which
constitutes the heart of the regulations.
VHA is troubled by this provision generally. At a minimum,
we suggest that addressing three basic problems with the
provision would aid in ameliorating these concerns. First, the
provision currently permits an individual to disclose PHI on a
``belief.'' This standard is too broad and unenforceable. Other
areas of law traditionally focus on a ``reasonableness''
standard, which is stronger than that of a ``belief.'' Under a
reasonableness standard, a whistleblower would not be liable
for the disclosure if a reasonable person would have evaluated
the particular act as a violation of the laws. Thus, he/she is
held to a societal standard that can be objectively evaluated
and provides some level of protection for those whose
information is disclosed. A ``belief'' standard, however, is
subjective, making it almost impossible to find that the
whistleblower erred. As noted in the preamble, a balance must
be achieved so that whistleblowers are not completely
discouraged from playing their vital role. This provision is
not balanced, but rather lopsided and provides no check on
disclosures of this type. Thus, HHS should adopt the widely
accepted reasonableness standard of tort law, as the standard
which provides protection for both individuals and
whistleblowers, by which to judge these disclosures.
Secondly, the provision provides whistleblowers with carte
blanche to disclose any amount of PHI they desire. This
allowance rips away the very protection at the center of the
regulations. Thus, while covered entities work diligently to
protect each individual's confidentiality, their employees,
without any limitations, can breach that confidentiality in the
name of a ``believed'' abuse. VHA suggests that this provision
be limited by requiring whistleblowers to apply the ``minimum
necessary'' standard applicable to covered entities and their
business partners. Whistleblowers will not be deterred because
the reasonableness standard will protect them. If their
calculation of the amount of PHI they disclosed was reasonable,
they will not be subject to sanctions. If not, however, the
employee can be reprimanded. This approach strikes the right
balance that permits good faith attempts to report abuses and
creates an incentive not to disclose PHI maliciously or without
reason.
Third, as drafted the provision allows whistleblowers to
disclose PHI to any attorney for the purpose of determining
whether a violation of law has occurred. Permitting disclosures
to any is extremely problematic. In addition to vastly
increasing the number of individuals to whom PHI can be
disclosed, it establishes no restrictions on how these
attorneys can further use or disclose the PHI in the future
because they are neither covered entities nor business partners
and, therefore, not subject to the regulations. Thus, the
protection of patient confidentiality, which is the point of
this entire regulatory scheme, is severely hampered by this
aspect of the whistleblower provision. VHA suggests that HHS
clarify this provision to limit the entities to whom PHI can be
disclosed for purposes of whistleblower activities to law
enforcement officials and oversight agencies or individuals
designated by the covered entity to deal with such concerns.
Taken together, these broad, subjective aspects of the
whistleblower provision work to destroy the right to
confidentiality HHS has attempted to craft. Thus, if
maintained, this provision should be significantly revised.
Conclusion
VHA appreciates the opportunity to present its views on
this important issue. We agree that ``a clear and consistent
set of privacy standards'' are needed ``to improve the
effectiveness and the efficiency of the health care system.''
Because of the vast nature of the proposed regulations, the
final regulations must present both the health care community
and the individual whose PHI is being used and disclosed with a
clear picture of what is required. However, these requirements
should not sacrifice America's high standard of health care.
Thus, VHA offers these comments as an important step in the
national conversation about this issue.
-