[Congressional Record Volume 148, Number 137 (Thursday, October 17, 2002)]
[Extensions of Remarks]
[Pages E1926-E1927]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]


     INTRODUCTION OF THE STOP TAKING OUR HEALTH PRIVACY (STOHP) ACT

                                 ______
                                 

                         HON. EDWARD J. MARKEY

                            of massachusetts

                    in the house of representatives

                      Wednesday, October 16, 2002

  Mr. MARKEY. Mr. Speaker, when you visit your physician, do you know 
where your medical records are kept? Do you know how your private 
health information is being used? Do you know who is disclosing your 
sensitive medical files, to whom, and for what purposes?
  These questions have become increasingly urgent for the majority of 
Americans. According to a recent Gallup Survey, 78 percent of people in 
the United States believe it is very important that their medical 
records be kept confidential. But the time has long passed when 
patients could feel confident that their medical files were locked 
safely in the office of the family doctor, protected from prying eyes 
and unauthorized access. Today, interconnected computer networks link 
your health provider, health plan and various corporate intermediaries 
such as ``health care clearinghouses,'' that methodically translate 
your personal health information into digital bits and bytes to track 
and store your records in databases over which you have little control.
  Consumers are particularly concerned about the unauthorized use of 
their private health information for marketing purposes. That's because 
companies have exploited patients' sensitive medical records in pursuit 
of profits. For example:
  The chain drug store Eckard's used the signatures obtained by 
customers when they picked up their prescriptions as authorization to 
release their information for marketing purposes. Eckard's eventually 
settled with the Florida Attorney General's office and agreed to 
require patients to opt-in before their information can be used for 
marketing.
  Several Florida residents received unsolicited samples of Prozac in 
the mail from a drugstore. A recipient of the Prozac mailing sued her 
doctor, pharmacy and the drug company for violating her privacy. Fear 
of private health information falling into the wrong hands has replaced 
faith in the confidentiality of personal medical records.
  A report by Princeton Survey Research Associates indicates that 1 in 
6 people in the United States has done something out of the ordinary to 
keep personal health information confidential, including withholding 
information from their doctor, providing inaccurate information, or, in 
some cases, avoiding care entirely.
  A ``stress test'' should not refer to your ability to withstand 
anxiety over the vulnerability of your medical records.
  This summer, the Department of Health and Human Services confirmed 
consumers' worst fears about threats to the confidentiality of

[[Page E1927]]

their health information when it stripped away key privacy protections 
established during the Clinton Administration. By modifying the Privacy 
Rule finalized in December 2000, HHS eliminated your right to decide 
whether your medical information can be shared for the purpose of 
health care treatment, payment, and so-called ``health care 
operations.'' These modifications took effect on October 15th.
  In the case of treatment, payment and health care operations, the 
Bush Administration's modifications permit your medical secrets to be 
used and disclosed to doctors, pharmacists, health insurers, and others 
without your prior consent.
  While treatment and payment are terms that consumers understand and 
associate with health care, ``health care operations'' is a category 
tied closely to commerce, not patient care. In fact, the Bush 
Administration modifications make clear that health care operations is 
a vast category that has more to do with business mergers than better 
medicines:
  According to Section 164.501 of the Bush modifications, health care 
operations means: ``The sale, transfer, merger, or consolidation of all 
or part of the covered entity with another covered entity, or an entity 
that following such activity will become a covered entity and due 
diligence related to such activity.''
  It is understood that this category includes business planning, 
underwriting, fundraising, and other activities. This means that your 
private health information can be used without your permission to serve 
the commercial interests of health care companies, including during 
transactions such as the sale of an HMO. The Clinton Administration's 
definition of health care operations not only was narrower, but it also 
required patient consent before personal health information could be 
used and disclosed for this purpose.
  The Stop Taking Our Health Privacy, or ``STOHP'', Act puts patients' 
privacy first by closing massive ``privacy peepholes'' that HHS opened 
in these three key areas:
  1. Consent: The STOHP Act restores the right of patients to decide 
whether or not to permit the use and disclosure of their personal 
health information for purposes of health care treatment, payment and 
``health care operations.'' The STOHP Act includes commonsense 
exceptions to the consent requirement for such purposes as filling a 
prescription and making referrals. In August, HHS eliminated patient 
consent in these three important cases, denying patients the 
fundamental right to decide for themselves whether to share their 
private health information.
  2. Marketing: The STOHP Act ensures that pharmacists do not become 
secret agents for drug companies. When you receive treatment 
recommendations from your pharmacist, you should not have to wonder who 
stands to benefit more: you or the pharmacist or drug company. Our bill 
would reverse the change that HHS made to the marketing definition, 
which allows health providers to send unsolicited health 
recommendations to patients that are paid for by drug companies but do 
not inform patients of the pharmacist's financial incentives or provide 
patients the opportunity to opt-out of receiving such communications in 
the future.
  3. Disclosures to FDA-regulated entities like drug companies: The 
STOHP Act narrows the purposes for which personal medical information 
can be used or disclosed to these entities without patient consent. Our 
bill limits nonconsensual disclosure to these entities for the purpose 
of strict public health priorities such as drug recalls. The August 
modifications created a broader exemption that allows nonconsensual 
disclosure of patient information to drug companies for a wide range of 
activities, which may include marketing campaigns.
  I am pleased to be joined by my colleagues Representatives Dingell, 
Waxman, Berman and Capuano as we introduce the Stop Taking Our Health 
Privacy Act of 2002.
  Today we take steps to apply age-old principles of medical privacy to 
the realities of the information age. Today we seek to restore 
longstanding patient protections, ensure the confidentiality of the 
physician-patient relationship, and rebuild patient trust in the health 
care system, all of which are essential for the delivery of quality, 
thorough health care.

                          ____________________