Medical Privacy Regulation: Questions Remain About Implementing  
the New Consent Requirement (06-APR-01, GAO-01-584).		 
								 
The Department of Health and Human Services issued a final	 
regulation in December 2000 that established rights for patients 
with respect to the use of their medical records. The regulation 
requires that most providers obtain patient consent to use or	 
disclose health information before engaging in treatment,	 
payment, or health care operations. The privacy regulation's	 
consent requirement will be more of a departure from current	 
practice for some providers than for others. Most health care	 
providers, with the exception of pharmacists, obtain some type of
consent from patients to release information to insurers for	 
payment purposes. The new requirement obligates most providers to
obtain consent before they can use and disclose patient 	 
information. It also broadens the scope of consent to include	 
treatment and a range of health care management activities.	 
Supporters of the requirement believe that the process of signing
a consent form provides an opportunity to inform and focus	 
patients on their privacy rights. Others, however, are skeptical 
and assert that most patients will simply sign the form with	 
little thought. In addition, provider and other organizations	 
interviewed are concerned that the new consent requirement poses 
implementation difficulties. They contend that it could cause	 
delays in filling prescriptions for patients who do not have	 
written consents on file with their pharmacies, impede the	 
ability of hospitals to obtain patient information prior to	 
admission, hamper efforts to assess health care quality by	 
precluding the use of patient records from years past, and	 
increase administrative burdens on providers.			 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-01-584 					        
    ACCNO:   A00735						        
    TITLE:   Medical Privacy Regulation: Questions Remain About       
             Implementing the New Consent Requirement                         
     DATE:   04/06/2001 
  SUBJECT:   Confidential communication 			 
	     Informed consent (medical law)			 
	     Medical records					 
	     Privacy law					 
	     Right of privacy					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Testimony.                                               **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-01-584

Report to the Chairman, Committee on Foreign Relations, U. S. Senate

United States General Accounting Office

GAO

April 2001 FOREIGN AFFAIRS Changes to Germany's Implementation of the Hague
Child Abduction Convention

GAO- 01- 423

Page i GAO- 01- 423 Parental Child Abduction Letter 1

Appendix I Consular Assistance to Left- Behind Parents 11

Appendix II Scope and Methodology 13

Appendix III GAO Contact and Staff Acknowledgments 14

Tables

Table 1: German Initiatives to Improve Handling of Hague Convention Cases 4
Table 2: Consular Assistance to Left- Behind Parents (FY 1999- 2000) 12
Contents

Page 1 GAO- 01- 423 Parental Child Abduction

April 10, 2001 The Honorable Jesse A. Helms Chairman, Committee on Foreign
Relations United States Senate

Dear Mr. Chairman: Over the past several years, the United States has been
critical of Germany's handling of international parental child abduction
cases that have been filed by U. S. parents. 1 Both the executive and
legislative branches of the U. S. government have criticized Germany for not
fully and consistently following the criteria and procedures established
under the 1980 Hague Convention on the Civil Aspects of International Child
Abduction, 2 which governs such cases. The primary criticisms include the

inappropriate use by German courts of certain provisions of the Hague
Convention to justify retaining an abducted child in Germany, the length of
time it has taken to adjudicate cases, and the failure to enforce left-
behind parents' visitation rights. In September 2000, in response to your
concerns about the rights of left- behind parents, we reported on the status
and outcome of cases that U. S. parents have filed with Germany. 3 This
second report identifies actions that Germany has taken or plans it has
under way to reform its handling of international parental child abduction
cases and how these actions may affect U. S. cases. We also obtained
information about what State Department officers stationed in Germany are
doing to assist left- behind parents. This information is contained in
appendix I.

To identify German actions and plans and how they may affect U. S. cases, we
met with German government officials, judges, and lawyers in seven cities in
Germany during November 2000. We also interviewed Department of State
officials in headquarters and in Germany. In addition, we reviewed the
status and outcome of the 43 U. S. cases that had been opened after German
authorities began changing their handling of Hague Convention

1 International parental child abduction occurs when a parent removes a
child from the United States or retains a child outside the United States,
with the intent to obstruct the parental rights (including visitation
rights) of the left- behind parent. 18 U. S. C. 1204.

2 29 ILM 1501 (1980). 3 Foreign Affairs: Status of U. S. Parental Child
Abductions to Germany, Sweden, and Austria (GAO/ NSIAD- 00- 226BR, Sept. 8,
2000).

United States General Accounting Office Washington, DC 20548

Page 2 GAO- 01- 423 Parental Child Abduction

cases in July 1999. More details about our scope and methodology can be
found in appendix II.

In response to U. S. and other countries' concerns, German authorities have
pledged their commitment to take steps to improve the handling of Hague
Convention cases, and Germany has taken actions to address two of the three
primary criticisms. Germany has established a task force to monitor German
reforms and active cases, initiated efforts to build expertise among judges
deciding Hague Convention cases, and changed its processes to accelerate
case handling. Our analysis of information obtained in Germany and case data
in Washington, D. C., indicates that changes are under way that may
positively affect case handling. However, because many of these reforms are
recent, we believe it will take time for case outcomes to fully reflect
their effect. Despite these reforms, Germany has not acted to improve
enforcement of visitation rights granted by German courts. The German
courts' reluctance to enforce visitation orders is hampering Germany's
efforts to improve its handling of Hague Convention cases.

The 1980 Hague Convention on the Civil Aspects of International Child
Abduction governs how international parental child abduction disputes are
adjudicated. It requires that party states identify a lead government agency
(called a “central authority”) to serve as a central point of
contact and to initiate or facilitate judicial or administrative
proceedings. The State Department's Office of Children's Issues, 4 Bureau of
Consular Affairs, is the central authority for the United States. Germany
has identified the Federal Prosecutor General 5 as its central authority.

The United States and other countries, especially France and the United
Kingdom, have expressed concerns about German authorities' handling of Hague
Convention cases. In May 1999, State reported to Congress that the German
administrative and judicial processing of abduction cases took 18 months or
longer, a period State considered unacceptable. 6 In October

4 State Department's Office of Children's Issues formulates, develops, and
coordinates policies and programs on international parental child
abductions. 5 The German Federal Prosecutor General's office has no
counterpart in the United States.

6 Report on Compliance With the Hague Convention on the Civil Aspects of
International Child Abduction (Washington, D. C.: Department of State, May
1999). Results in Brief

Background

Page 3 GAO- 01- 423 Parental Child Abduction

2000, State further reported that the systemic failure of German courts to
enforce contempt 7 sanctions allowed abducting parents to resist enforcement
of visitation orders indefinitely. 8 In addition, a May 2000 congressional
resolution cited Germany, along with other countries, for not meeting their
commitments under the Hague Convention. 9 Also, media in both the United
States and Germany have actively reported on this issue, focusing on a
number of high- profile, controversial cases. We reported that between
January 1, 1995, and May 15, 2000, there were 257 cases where U. S. parents
sought the return of, or visitation with, their children in Germany.
According to the State Department, there were 17 cases pending German
judicial action as of March 1, 2001.

In June 2000, for the first time since both countries signed (and became
states party to) the Hague Convention, discussion of specific cases was
elevated to the presidential level. At that time, President Clinton and
Chancellor Schroeder, the German head of Government, met in Berlin and,
according to the State Department, discussed a number of high- profile
abduction cases among other bilateral issues. Their meeting resulted in the
establishment of a U. S.- German working group on international parental
child abductions. The working group met on June 27, July 24 and 25,
September 25 and 26, 2000, and January 8 and 9, 2001, to discuss the
concerns of each country and to seek solutions.

Since July 1999, Germany has taken steps designed to improve its handling of
parental child abduction cases under the 1980 Hague Convention. The most
significant actions are summarized in table 1. Our analysis of information
obtained in Germany and case data in Washington, D. C., indicates that these
changes may have a positive effect on current and future cases. Because most
German actions are very recent, however, it will take time for case outcomes
to fully reflect their effect. These changes may not affect cases already
decided by German courts. Although the task force is working to find
acceptable solutions on some closed cases, German authorities said they will
not revisit prior court rulings. State

7 Contempt is the failure to obey a court order issued for another party's
benefit. 8 Report on Compliance With the Hague Convention on the Civil
Aspects of International Child Abduction (Washington, D. C.: Department of
State, Oct. 2000).

9 H. Con. Res. 293. Sweden and Austria were also cited in this resolution.
German Initiatives to

Improve Handling of Hague Convention Cases

Page 4 GAO- 01- 423 Parental Child Abduction

Department officials accepted this position even though they disagreed with
some past decisions.

Table 1: German Initiatives to Improve Handling of Hague Convention Cases
Goal Action Status

Facilitate the resolution of difficult cases and monitor reforms.

Establish 5- member task force within the Ministry of Justice.

Created in October 2000 and funded through September 2003. Enhance expertise
among German judges on Hague Convention provisions and cases.

Reduce the number of courts and judges that hear Hague Convention cases.

Implement judicial training programs sponsored by the Ministry of Justice
nationwide.

Effective July 1999, the number of courts authorized to hear Hague
Convention cases was reduced from 600 to 24.

Courts in Munich and Dusseldorf reduced to two the number of judges that
adjudicate Hague Convention cases in November 2000.

Training seminars conducted in January and February 2001 for 48 family court
judges representing 22 of the 24 German family courts. Additional training
is scheduled for late 2001.

Accelerate case decisions. Reengineer its system for processing cases and
scheduling hearings.

Central Authority implemented reforms in October 2000. Source: GAO synthesis
of information provided by German officials.

Germany established a special task force in October 2000 to lead German
efforts to improve its handling of Hague Convention cases. The task force
has five members, including a family court judge, a family law specialist,
and two senior- level Ministry of Justice officials who joined the task
force for bilateral discussions on parental child abduction cases with the
United States. Based on our discussions with members of the task force, they
appear to understand Germany's obligations under the Hague Convention and
the areas in which German reforms may be needed. The task force has been
funded for 3 years, until September 2003. The task force director explained
that improvements in Germany's handling of these cases should increase over
the life of the task force and that, as a result, there should be no need to
extend the task force beyond that time. The task force has two primary
responsibilities: assisting in the resolution of difficult cases and
facilitating and monitoring reforms in German institutions.

The task force's influence over difficult cases is limited because German
courts, which enjoy substantial independence under Germany's constitution,
make the final decisions on abduction cases. Nevertheless, the director said
that there were a number of actions that the task force planned to take to
help facilitate consistent case outcomes. For example, the task force plans
to provide information to the German youth authority Facilitating the
Resolution

of Difficult Cases and Monitoring Reforms

Page 5 GAO- 01- 423 Parental Child Abduction

on Hague Convention provisions and to left- behind parents and their lawyers
regarding German legal processes and institutions. The task force director
indicated that it also plans to promote out- of- court, nonjudicial
mediation, especially for long- standing, difficult cases, including cases
in which a court has ruled against a left- behind parent. Because the German
task force had been active for only a few months without having concluded
any of its initiatives, we could not determine whether it could affect the
outcome of U. S. cases. As of March 1, 2001, the task force told us that
they were actively involved with six high- profile cases already decided by
German courts.

Regarding the reform process, the task force is monitoring court proceedings
and decisions and collecting data on observations by other governments and
left- behind parents regarding how German authorities are handling these
cases. Using this information, the task force will determine whether and to
what extent it needs to get involved to facilitate the resolution of
specific cases or encourage systemic change. The task force also serves as a
facilitator for the German reforms discussed below.

According to the Permanent Bureau of the Hague Secretariat, which monitors
treaties on private international law, a well- trained and experienced
judiciary is key to effectively implementing the Hague Convention. German
government officials and judges told us that lack of judicial familiarity
with the application of Hague Convention provisions has been a major problem
affecting case decisions. German judges told us that a judge might not be
familiar with the Hague Convention because he or she may not have previously
presided over a Convention case.

The Hague Convention requires that, barring extreme circumstances, children
be returned to their country of habitual residence. Once returned, a court
in that country will decide custody. However, German officials and lawyers
indicated that because of limited experience with Hague Convention
requirements, some German judges may view their role differently. In these
cases, German judges may believe that they are expected to decide the
child's custody, applying German family law, rather than applying Hague
Convention provisions. This could result in a judge ruling in favor of the
abducting parent and denying return. To enhance Hague Convention expertise,
German authorities have limited the number of courts and judges hearing such
cases and have begun training them on the Hague Convention provisions.
Enhancing Hague

Convention Expertise Among German Judges

Page 6 GAO- 01- 423 Parental Child Abduction

To promote judicial expertise in handling Hague Convention cases, the German
parliament enacted legislation in July 1999, limiting the number of courts
with jurisdiction to hear Hague Convention cases from 600 to 24. This
resulted in a reduction in the number of judges with jurisdiction to hear
such cases from approximately 2,000 to 200 judges. This legislative
initiative, supported by the United States, was largely in response to
criticism and pressure from France and the United Kingdom, two Hague
Convention party states with long- standing concerns about German courts'
decisions on Hague Convention cases.

In September 2000, in addition to the nationwide reductions, the German
State Secretary encouraged further reductions in the number of judges
hearing Hague Convention cases. According to a judge with the task force,
the Ministry of Justice cannot order a reduction; it can only be reached and
made effective by the judges themselves. Family courts in Munich and
Dusseldorf have decided to reduce the number of judges hearing such cases to
two- a primary and secondary judge. Other family courts in Germany have
expressed interest in following the Munich and Dusseldorf courts but have
not yet acted.

According to German lawyers handling Hague Convention cases, the
concentration of Hague cases among fewer judges should improve case
handling. For example, they said that the reduction in the number of judges
hearing cases should result in fewer applications of the Article 13b
exception to the Hague Convention. Under this exception, a party state can
deny the return of a child if the return, in the court's opinion, would pose
a grave risk to the child's mental or physical well- being. According to
officials from the Hague Secretariat and the U. S. and German governments,
this exception should be narrowly applied and not liberally used as a
vehicle for denying a child's return. However, according to the State
Department, some German judges have interpreted the exception too liberally
and made “unconscionably broad” use of the Hague Convention
exception in a number of cases. The German task force acknowledged that
German judges used this exception too liberally in some past cases.

In our September 2000 report on the status of U. S. parental child
abductions to Germany, we reported that, for the 172 closed cases where the
child was not returned to the United States, German courts used the Article
13b exception 14 times (or 8 percent). Since September, German courts under
the new 24- court system used the Article 13b exception once. That is, for
cases handled under the new court structure, German courts used the Article
13b exception once in 30 (3 percent) cases, compared with 14 instances in
172 (8 percent) decided cases under the old structure. Limiting the Number
of Courts

and Judges That Adjudicate Hague Convention Cases

Page 7 GAO- 01- 423 Parental Child Abduction

To further familiarize judges with Hague Convention standards and
procedures, the Ministry of Justice coordinated two 3- day training
conferences in January and February 2001. 10 The training conferences were
an effort to enhance common knowledge and expertise about the goals of the
Hague Convention among German judges with jurisdiction over these cases.
These conferences focused on the (1) creation and goals of the Hague
Convention, (2) legal jurisdiction and provisions under the Convention, and
(3) return and access rights and their enforcement under the Convention.
Ministry of Justice officials told us that their role was limited to
facilitating and coordinating the conferences while knowledgeable and
experienced judges and lawyers conducted conference sessions for
participating judges. 11

In addition, Germany, the United States, and the Hague Secretariat have
discussed plans to convene a conference among a number of Hague Convention
party states in late 2001 to promote consistency in Convention
interpretation and foster closer relationships. This conference would cover
such topics as the intent of the Hague Convention, restricted use of
Convention exception provisions, and enforcement of return and access
decisions.

According to the Permanent Bureau of the Hague Secretariat, prompt access to
the courts is a key factor to the effective implementation of the Hague
Convention. The longer a child remains in his environment, and bonds with
the abducting parent, the less willing a court may be to order the child's
return. In its May 1999 report, State cited Germany for lengthy case
processing. We reported in September 2000 that German authorities took a
median of 288 days to process Hague Convention abduction and access cases.
Although Germany has not established a specific time limit for case
adjudication, the German task force acknowledged that German courts have
taken too long to adjudicate abduction cases in the past.

10 The January training conference was conducted in Recklinghausen, Germany,
for 25 family court judges, and the February conference was conducted in Bad
Nauheim, Germany, for 23 family court judges.

11 The U. S. embassy has proposed to support German judicial training by
sponsoring child custody seminars for German family judges. These seminars
would consist of three 1- day events throughout Germany and feature U. S.
and German speakers on Hague Convention implementation issues. Through
State's International Visitor Program, the U. S. embassy plans to sponsor
visits in fiscal years 2001 and 2002 by German judges to the United States
to meet with their U. S. counterparts. Implementing Judicial Training

Programs Nationwide Accelerating Case Decisions Through Reengineered Case
Application Filing Procedures and Court Notification

Page 8 GAO- 01- 423 Parental Child Abduction

Officials from the central authority in Bonn told us that they have changed
their administrative procedures to expedite case application filing and
court notification. In October 2000, the central authority established a
policy to fully process and forward applications to the competent court
within 7 days of receipt of a complete application. Before October 2000, the
central authority took about 30 days. Only one of the cases we reviewed was
opened after October 2000, when the new administrative procedures were put
in place. This case was originally sent to the German central authority,
which promptly transferred the case to French authorities upon learning from
the U. S. left- behind parent that the abducting parent had fled to France.

In addition to lengthy administrative procedures, German Ministry of Justice
officials conceded that German proceedings can be too lengthy, citing some
judges' desire to hear the child's opinion and to request lengthy
psychological reports from German youth authorities. Obtaining a child's
testimony and youth reports are standard practices for deciding domestic
custody cases. Collecting and analyzing all of this evidence before making a
decision takes considerable time. According to one Ministry official, judges
will depend less on psychological reports, which are geared more for
domestic child custody cases, as they become more knowledgeable of Hague
Convention procedures and requirements, which do not require such evidence.
According to U. S. and German central authority officials, Hague Convention
cases in Germany are being processed more expeditiously than before. Of the
43 U. S. cases opened since July 1999, when the number of courts and judges
was reduced, 30 were closed by January 31, 2001. The median duration of
cases was 147 days. For cases closed from January 1, 1995, through June 30,
1999, the median duration case was 304 days.

Despite international criticism, some German courts are still reluctant to
enforce court- ordered visitation rights of left- behind parents. German
Ministry of Justice officials conceded that enforcement remains a problem
and acknowledged that their ministry needs to work with the courts to change
existing practices. The State Department indicated that it is seeking
comprehensive information about German judicial enforcement practices and
exploring options to encourage reforms. State officials told us that failure
to enforce court- ordered visitation undermines the Hague Convention. We
believe that, if this problem persists, the impact of the reforms being
implemented could be undermined. German Courts

Reluctant to Enforce Visitation Orders

Page 9 GAO- 01- 423 Parental Child Abduction

In its October 6, 2000, compliance report to Congress, the State Department
reported that German courts systematically fail to enforce court- ordered
visitation, thus allowing abducting parents to resist enforcement of orders
indefinitely. We identified two cases where leftbehind parents in the United
States were seeking the enforcement of their German court- ordered
visitation rights. In both cases, German judges failed to enforce the orders
when the abducting parent refused to cooperate. According to German judges,
domestic law does not permit the use of physical force 12 to enforce
visitation orders. In addition, they told us that they are reluctant to
employ existing sanctions because they fear that such actions would have a
detrimental affect on the child. For example, incarcerating an abducting
parent, which is one of the enforcement tools available to German judges,
will separate the child from the parent. According to German judges, this
could impact the child psychologically.

State officials are seeking detailed information about Germany's judicial
enforcement mechanisms and exploring ways to encourage German courts to
change existing practices. They indicated that they have raised this issue
at each of the working group meetings since June 2000. Although enforcement
of visitation orders was not on the agenda for Secretary of State Colin
Powell's February 20, 2001, meeting in the United States with Germany's
Foreign Minister Joschka Fischer, the topic was discussed during a U. S.-
German bilateral meeting in the Netherlands on March 29, 2001. State
indicated that it plans to continue raising the issue at all future meetings
with German officials on the task force and at the central authority. State
also plans to reserve positions in the International Visitor Program for
German judges to discuss enforcement of visitation orders, among other
issues. According to State, although the United States can attempt to
influence German actions, only German authorities can make the decision to
act.

Germany's initiatives to enhance judicial expertise and accelerate case
processing are steps that have potential to (1) positively affect German
application of the provisions of the Hague Convention and (2) reduce the
time taken to adjudicate cases. Because the reforms are recent, there are
only a limited number of cases to demonstrate the actual effect of the
initiatives. Germany has not acted, however, to improve its enforcement of
visitation orders. This is a key concern of the State Department. Moreover,

12 Such force would include physically separating a child from the abducting
parent. Conclusions

Page 10 GAO- 01- 423 Parental Child Abduction

we believe that the failure to address the German courts' reluctance to
enforce visitation orders could undermine Germany's efforts to improve its
handling of Hague Convention cases.

We obtained oral comments on a draft of this report from the Department of
State's Office of Children's Issues, Bureau of Consular Affairs, which
agreed with the report's conclusion and provided us with technical comments
that we incorporated as appropriate.

We are sending copies of this report to the Honorable Colin L. Powell, the
Secretary of State, and interested congressional committees. We will make
copies available to others upon request.

Please contact me on (202) 512- 4128 if you or your staff have any questions
about this report. Another GAO contact and staff acknowledgments are listed
in appendix III.

Sincerely yours, Jess T. Ford, Director International Affairs and Trade
Agency Comments

and Our Response

Appendix I: Consular Assistance to LeftBehind Parents

Page 11 GAO- 01- 423 Parental Child Abduction

The State Department's consulate offices can provide a variety of incountry
assistance to left- behind parents involved in child custody conflicts. The
State Department's Office of Children's Issues 1 in Washington, D. C., can
request consular officers to locate and report on the child's welfare,
conduct home visits, and assist in obtaining case status information. In
addition, the U. S. embassy and consulate offices can provide left- behind
parents with information on attorneys who handle Hague Convention cases and
can contact or refer a left- behind parent to German agencies that can
provide assistance.

According to U. S. consular officials in Germany, a common request from
left- behind parents is to obtain the telephone number where the child can
be reached. In more complicated cases where a left- behind parent has had no
contact with the child, consular officials may be asked to write letters to
various registration offices in Germany to locate the child's relatives.
Consular officials can also perform home visits with the child when
requested by a left- behind parent and consented to by the foreign parent.
According to State, consular officers conduct most home visits unless (1)
the foreign parent refuses a visit, (2) a child lives a great distance from
the consular office, or (3) the workload of the consular official prohibits
a personal visit. In addition, U. S. consular officials can obtain from
German authorities information about the status of cases and report this
information to both parents. They can also seek clarification as to how a
particular aspect of a case is proceeding.

According to U. S. consular officials in Germany, 97 inquiries about child
welfare and location and 23 home visits were conducted in fiscal years 1999
and 2000 (see table 2).

1 State Department's Office of Children's Issues provides direction to
foreign service posts on assistance to left- behind parents. Appendix I:
Consular Assistance to LeftBehind

Parents

Appendix I: Consular Assistance to LeftBehind Parents

Page 12 GAO- 01- 423 Parental Child Abduction

Table 2: Consular Assistance to Left- Behind Parents (FY 1999- 2000)
Instances Assistance FY 1999 FY

2000

Inquiries conducted about abducted child's welfare and location 42 55 Visits
requested by Office of Children's Issues on behalf of leftbehind parent 18
28

Residential welfare visits of abducted child conducted 9 14 Visits attempted
but denied by abducting parent a 3 7 Visits not attempted b 6 7 Inquiries
made into case status c 13 17 a German Youth Authority officials may visit
abducted U. S. children when the abducting parent does not permit visits by
consular officials. Also, if an abducting parent denies a consular visit,
then German courts can intervene. However, as explained earlier in this
report, German courts may not intervene; they have been reluctant to enforce
visitation orders for left- behind parents in U. S. cases. b U. S. consular
officers explained that they could not perform requested visits where the
child lived a

great distance from the consular office or when the workload of the consular
official prohibited a personal visit. c U. S. consular officers made
specific inquiries for left- behind parents into the status of their cases.

Source: Information reported by the U. S. consulates in Berlin, Dusseldorf,
Frankfurt, Hamburg, and Munich, Germany.

In addition to citing specific services they provide to left- behind
parents, U. S. consular officials told us that they have been more closely
involved in helping the Office of Children's Issues to monitor the
resolution of U. S. Hague Convention cases since U. S. government attention
on U. S. children abducted to Germany heightened in 2000. During our
fieldwork in November 2000, we found that these officials were involved in
organizing meetings and maintaining communication with the German central
authority and Ministry of Justice on the status of U. S. cases. For example,
consular officials in Berlin provided logistical support for U. S.- German
working group meetings held in July and September 2000.

Appendix II: Scope and Methodology Page 13 GAO- 01- 423 Parental Child
Abduction

Our review focused on congressional concerns about Germany's handling of U.
S. parental child abduction cases under the Hague Convention. To gather
information for our analysis, we interviewed more than 40 key officials and
representatives from the State Department, the German government, the Hague
Secretariat in the Netherlands, and organizations dedicated to researching
and understanding issues associated with international parental child
abduction.

To identify what actions Germany has taken or plans it has under way to
address U. S. concerns about Germany's handling of parental child abduction
cases, we reviewed State Department reports from May 1999 to January 2001
that documented systemic problems with Germany's implementation of the Hague
Convention and identified German actions taken or planned. These reports
also identified State's goals and timetables for Germany to take remedial
measures. To confirm and expand our understanding of information in these
reports, we conducted fieldwork in Berlin, Bonn, Cologne, Dusseldorf,
Frankfurt, Munich, and Potsdam, Germany. We interviewed senior German
justice ministry officials, local family court judges, social workers, and
private attorneys in those cities. We also interviewed officials from the
German central authority, U. S. officials in Germany supporting State
Department efforts to resolve abduction cases, and a French judge, seconded
to the German Ministry of Justice to work on difficult German- French Hague
Convention cases.

To determine how Germany's actions have affected the handling and outcome of
U. S. cases, we reviewed the status, outcome, and other characteristics of
cases adjudicated after German authorities began taking actions. We reviewed
files that State's Office of Children's Issues maintains on cases initiated
by left- behind parents from July 1999, when Germany began to concentrate
the number of family courts hearing international abduction cases under the
Hague Convention, through January 2001. These files included administrative,
judicial, and communicative information related to each case.

We recorded the results of our analysis of State's files in a database and
subsequently performed independent checks to ensure that data for each case
were accurate. We compared the outcomes of cases opened and closed from July
1999 through January 2001 with those outcomes from cases opened and closed
from January 1995 through June 1999.

We performed our work from October 2000 through March 2001 in accordance
with generally accepted government auditing standards. Appendix II: Scope
and Methodology

Appendix III: GAO Contact and Staff Acknowledgments

Page 14 GAO- 01- 423 Parental Child Abduction

John Brummet, (202) 512- 5260 In addition to the contact named above,
Michael Zola, Janice Villar Morrison, and Mark Dowling made key
contributions to this report. Appendix III: GAO Contact and Staff

Acknowledgments GAO Contact Acknowledgments

(711569)

The first copy of each GAO report is free. Additional copies of reports are
$2 each. A check or money order should be made out to the Superintendent of
Documents. VISA and MasterCard credit cards are also accepted.

Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.

Orders by mail:

U. S. General Accounting Office P. O. Box 37050 Washington, DC 20013

Orders by visiting:

Room 1100 700 4 th St., NW (corner of 4 th and G Sts. NW) Washington, DC
20013

Orders by phone:

(202) 512- 6000 fax: (202) 512- 6061 TDD (202) 512- 2537

Each day, GAO issues a list of newly available reports and testimony. To
receive facsimile copies of the daily list or any list from the past 30
days, please call (202) 512- 6000 using a touchtone phone. A recorded menu
will provide information on how to obtain these lists.

Orders by Internet

For information on how to access GAO reports on the Internet, send an email
message with “info” in the body to:

Info@ www. gao. gov or visit GAO's World Wide Web home page at: http:// www.
gao. gov

Contact one:

? Web site: http:// www. gao. gov/ fraudnet/ fraudnet. htm

? E- mail: fraudnet@ gao. gov

? 1- 800- 424- 5454 (automated answering system) Ordering Information

To Report Fraud, Waste, and Abuse in Federal Programs

GAO United States General Accounting Office

Report to the Chairman, Committee on Health, Education, Labor, and Pensions,
U. S. Senate

April 2001 MEDICAL PRIVACY REGULATION

Questions Remain About Implementing the New Consent Requirement

GAO- 01- 584

Page i GAO- 01- 584 Patient Consent Letter 1

Appendix I Selected State Statutes on Consent 10

Appendix II Organizations Interviewed 12 Abbreviations AHA American Hospital
Association AMA American Medical Association HHS Department of Health and
Human Services HPP Health Privacy Project MGMA Medical Group Management
Association Contents

Page 1 GAO- 01- 584 Patient Consent

April 6, 2001 The Honorable James M. Jeffords Chairman, Committee on Health,
Education,

Labor, and Pensions United States Senate

Dear Mr. Chairman: Although there is a strong consensus supporting the
protection of patient confidentiality, views differ as to the best ways in
practice to achieve that goal. Pressures are increasing from insurers,
providers, and researchers to draw on medical records to study treatment
outcomes and monitor expenditures, activities that are becoming increasingly
common as medical records are computerized and large databases compiled. In
recognition of these trends, the Health Insurance Portability and
Accountability Act of 1996 called for the development of comprehensive
privacy standards that would establish rights for patients with respect to
their medical records and define the conditions for using and disclosing
personally identifiable health information. 1 On December 28, 2000, the
Department of Health and Human Services (HHS) issued the final regulation on
privacy, and it is now under review by the Congress and the new Secretary of
HHS. 2

One prominent point of disagreement is whether the federal government should
require health providers to obtain patient consent prior to their use or
disclosure of personal medical information for purposes of treatment,
payment, and routine health care management activities. You asked us to
examine the consent requirement in the federal privacy regulation and assess
(1) how it differs from the types of consent providers currently obtain from
patients and (2) its potential consequences for patients and providers. You
also asked us to review how states that have passed health privacy laws
addressed the patient consent issue, and we have included

1 P. L. 104- 191, sec. 264, 110 Stat. 1936, 2033. 2 65 Fed. Reg. 82,462
(2000). The final regulation was originally set to become effective February
26, 2001, with most entities required to comply no later than February 26,
2003. To comply with the requirements of the Congressional Review Act,
however, HHS changed the effective date to April 14, 2001, with most
entities required to comply no later than April 14, 2003. 66 Fed. Reg.
12,434 (2001). Subsequently, HHS published notice that it would accept
comments on the regulation through March 30, 2001. 66 Fed. Reg. 12, 738
(2001).

United States General Accounting Office Washington, DC 20548

Page 2 GAO- 01- 584 Patient Consent

this information in appendix I. To meet your request, we contacted 18
organizations, including groups representing patients, providers, and health
plans as well as a group practice, an integrated health care system, a large
chain pharmacy, and a regional health plan. (See app. II.) In addition, we
reviewed the regulation and spoke with HHS representatives responsible for
its development. We performed our work in March 2001 in accordance with
generally accepted government auditing standards.

The privacy regulation's consent requirement will be more of a departure
from current practice for some providers than for others. Most health care
providers, with the exception of pharmacists, obtain consent from patients
to release information to insurers for payment purposes. The new requirement
adds pharmacists to those providers obligated to obtain written consent
before they can use or disclose patient information for routine health care
purposes. These purposes now include treatment and a range of health care
management activities as well as payment. Supporters of the requirement
believe that the process of signing a consent form provides an opportunity
to inform and focus patients on their privacy rights. Others, however, are
skeptical and assert that most patients will simply sign the form with
little thought. In addition, provider and other organizations interviewed
are concerned that the new consent requirement poses implementation
difficulties. They contend that it could cause delays in filling
prescriptions for patients who do not have written consents on file with
their pharmacies, impede the ability of hospitals to obtain patient
information prior to admission, hamper efforts to assess health care quality
by precluding the use of patient records from years past, and increase
administrative burdens on providers.

The final medical privacy regulation requires that most providers obtain
patient consent to use or disclose health information before engaging in
treatment, payment, or health care operations. 3 As defined in the
regulation, health care operations include a variety of activities such as
undertaking quality assessments and improvement initiatives, training future
health care professionals, conducting medical reviews, and case

3 The regulation uses the term “consent” when referring to
written permission sought prior to use or disclosure of personal health
information for these purposes. It uses the term “authorization”
when referring to written permission required for nonroutine uses and
disclosures of information, such as releases to a patient's attorney or to
an employer for personnel decisions. Results in Brief

Background

Page 3 GAO- 01- 584 Patient Consent

management and care coordination programs. The consent form must alert
patients to the provider's notice of privacy practices (described in a
separate document) and notify them of their right to request restrictions on
the use and disclosure of their information for routine health care
purposes. Providers are not required to treat patients who refuse to sign a
consent form, nor are they required to agree to requested restrictions. The
consent provision applies to all covered providers that have a direct
treatment relationship with patients. 4 The regulation also specifies
several circumstances where such prior patient consent is not required. 5
The privacy regulation does not require health plans to obtain written
patient consent. 6

This approach to patient consent for information disclosures differs from
that in HHS' proposed privacy regulation, issued for public comment November
3, 1999. The proposed regulation would have permitted providers to use and
disclose information for treatment, payment, and health care operations
without written consent. At the time, HHS stated that the existing consent
process had not adequately informed patients of how their medical records
could be used. Comments HHS received on this provision were mixed. Some
groups approved of this approach, saying it would ensure that covered
entities could share information to provide effective clinical care and
operate efficiently, while not creating administrative requirements that
would add little to individual privacy. However, others wrote that
individuals should be able to control to whom, and under what circumstances,
their individually identifiable health

4 For example, primary care physicians and surgeons have a direct treatment
relationship with patients. In addition, outpatient pharmacists are
generally considered to have such a relationship. They fill prescriptions
written by other providers, but they furnish the prescription and advice
about the prescription directly to the patient, not through another treating
provider. On the other hand, radiologists and pathologists generally have
indirect treatment relationships with patients because they deliver
diagnostic services based on the orders of other providers and the results
of those services are furnished to the patient through the direct treating
provider. Consequently, for these providers, medical records could be used
for management reviews of their performance without patient consent.

5 These include (1) in emergency treatment situations, if the provider
attempts to obtain such consent as soon as reasonably practicable after the
delivery of treatment, (2) if the provider is required by law to treat the
individual, and attempts to obtain consent but is unable to do so, and (3)
if a provider attempts to obtain consent from the individual but is unable
to do so because of communication barriers, and he or she determines that
the individual's consent to receive treatment is clearly implied from the
circumstances.

6 Industry representatives told us that health plans often obtain patient
consent. Plans may ask new enrollees to sign a form that allows access to
their medical records for payment and, sometimes, health care operations.

Page 4 GAO- 01- 584 Patient Consent

information would be disclosed, even for routine treatment, payment, or
health care operations.

The extent to which the privacy regulation's consent requirement will be a
departure from business as usual varies by type of provider. Under current
practices, physicians and hospitals generally obtain consent to use patient
data for processing insurance claims, but they obtain consent substantially
less often for treatment or health care operations. 7 Pharmacists, however,
typically do not have consent procedures in place for any of the routine
purposes included in the regulation. Specifically:

? Most, but not all, physicians get signed written consent to use patient
data for health insurance payment. Exceptions to this practice include
emergency situations and patients who choose to pay for their treatment

“out of pocket” to avoid sharing sensitive information with an
insurer. However, physicians do not typically seek approval to use patient
data to carry out treatment or health care operations.

? Nearly all hospitals routinely obtain written consent at the time of
admission, at least for release of information to insurance companies for
payment purposes. 8 A 1998 study of large hospitals found that 97 percent of
patient consent forms sought release of information for payment, 50 percent
addressed disclosure of records to other providers, and 45 percent requested
consent for utilization review, peer review, quality assurance, or
prospective review- the types of health care management activities
considered health care operations in the federal privacy regulation. 9

? Pharmacies do not routinely obtain patient consent related to treatment
(i. e., before filling a prescription), payment, or health care operations.
However, industry representatives told us that pharmacies conducting disease
management programs (specialized efforts to ensure appropriate
pharmaceutical use by patients with certain chronic conditions) typically

7 It is also common for patients to sign consent forms before undergoing an
invasive procedure. However, these consents have to do with informing the
patient about possible risks and benefits of the treatment, not disclosure
and use of the data.

8 Similar to physician practices, hospital exceptions include patients who
choose to “selfpay”

for treatment, and emergency situations, such as when a patient arrives
unconscious at the emergency room with no one to act on his or her behalf.

9 J. F. Merz, P. Sankar, S. S. Yoo, “Hospital Consent for Disclosure
of Medical Records,” Journal of Law, Medicine and Ethics (Fall 1998),
p. 241. Most Providers

Obtain Consent to Disclose Patient Data for Insurance Payment

Page 5 GAO- 01- 584 Patient Consent

seek consent to share information with physicians about the patients'
condition, medical regimen, and progress.

The new consent requirement makes several important changes to current
practices that have implications for patients and providers. For patients,
they will be made aware that their personal health information may be used
or disclosed for a broad range of purposes including health care operations.
Other provisions of the privacy regulation grant patients additional
protections, including the right to access their records, to request that
their records be amended, to obtain a history of disclosures, and to request
restrictions on how their information is used. For providers directly
treating patients, they will have a legal obligation to obtain prior written
consent and to use a form that meets specific content requirements.

Supporters of the consent requirement argue that the provision gives
patients an opportunity to be actively involved in decisions about the use
of their data. Yet, many groups recognize that signing a provider's consent
form does not, per se, better inform patients of how their information will
be used or disclosed. In addition, most provider organizations we
interviewed told us that the privacy regulation's consent requirement will
be a challenge to implement and may impede some health care operations.

The American Medical Association (AMA), the Bazelon Center for Mental Health
Law, and the Health Privacy Project (HPP) indicated that the consent process
offers important benefits to patients. These groups view the process of
signing a consent form as a critical tool in focusing patient attention on
how personal health information is being used. They assert that only
providing patients with a notice of privacy practices is not sufficient
because most patients are not likely to understand its importance, much less
read it. The patient advocacy groups told us that the act of signing the
consent can help make patients aware of their ability to affect how their
information is used. This heightened awareness, in turn, may make patients
more likely to read the notice of privacy practices or to discuss privacy
issues with their health care provider. HPP cited the process of signing
consent as offering an “initial moment” in which patients have
an opportunity to raise questions about privacy concerns and learn more
about the options available to them. This opportunity may be especially
valuable to patients seeking mental health and other sensitive health care
services. Perceived Benefits for

Patients and Implementation Concerns Among Industry Groups

Consent Requirement Intended to Raise Privacy Awareness

Page 6 GAO- 01- 584 Patient Consent

In contrast, many groups we interviewed question the value of the consent
form for patients. For example, the Medical Group Management Association
(MGMA) and the American Hospital Association (AHA) assert that the process
of signing a consent form may be perfunctory, at best, and confusing, at
worst. To some extent, patient advocacy groups we spoke with agree. They say
that patients will be under pressure to sign the form without reading the
notice, as providers can condition treatment upon obtaining consent. They
contend that many patients may not find the consent process meaningful. They
maintain that nevertheless it should be required for the benefit it offers
patients who may be particularly interested in having a say about how their
health information will be used.

Health plan and provider organizations we interviewed told us that the
consent requirement poses implementation difficulties for patients and
providers both during the regulation's initial implementation and beyond.
The extent of these challenges and their potential implications vary by type
of provider. In general, these organizations do not favor written consents
for routine uses of patient information, although they support the
regulation's requirement to provide patients with privacy notices.

The consent requirement would require pharmacists to change their current
practices. Under the regulation, a patient must sign a consent form before a
pharmacist can begin filling the prescription. According to the American
Pharmaceutical Association and the National Association of Chain Drug
Stores, this requirement would result in delays and inconvenience for
patients when they use a pharmacy for the first time. 10 Also, pharmacies
would not be able to use patient information currently in their systems to
refill prescriptions or send out refill reminders before receiving patient
consent to do so. In addition, patients who spent time in different parts of
the country and were accustomed to transferring their prescriptions to out-
of- state pharmacies would have to provide consent to one or more pharmacies
before their prescriptions could be filled. Pharmacy and other organizations
have suggested that the privacy regulation should recognize a physician-
signed prescription as indicative of patient consent or that pharmacies
could be considered indirect providers and thus not subject to the consent
requirement.

10 These organizations believe that a consent form obtained by one retailer
could serve for others in a chain within the same state. Industry
Representatives

Anticipate Difficulties in Implementing the Consent Requirement

Page 7 GAO- 01- 584 Patient Consent

Hospital organizations also raised concern about disruption of current
practice and some loss of efficiency. AHA and Allina Health System
representatives stated that the consent requirement could impede the ability
of hospitals to collect patient information prior to admission, thus
creating administrative delays for hospitals and inconvenience for some
patients. In advance of nonemergency admissions, hospitals often gather
personal data needed for scheduling patient time in operating rooms,
surgical staff assignments, and other hospital resources. If the regulation
is interpreted to include such activities as part of treatment or health
care operations, hospitals would be required to get the patient's signed
consent before setting the preadmissions process in motion. Either a form
would have to be mailed or faxed to the patient and sent back, or the
patient would have to travel to the hospital to sign it.

Physician and hospital groups expressed concern that the requirement would
hinder their ability to conduct health care management reviews using
archived records. For example, AMA and AHA told us that the regulation will
not permit them to use much of the patient data gathered under previous
consent forms. While the regulation has a transition provision that allows
providers to rely on consents acquired before the regulation takes effect,
the continuing validity of those preexisting consents would be limited to
the purposes specified on the consent form. In most cases, the purposes
specified were either treatment or billing. This means that providers would
not be able to draw on those data for other purposes, including common
health care management functions, such as provider performance evaluations,
outcome analyses, and other types of quality assessments. 11 Moreover, they
said that in many cases it might not be feasible to retroactively obtain
consent from former patients. Some have suggested revising the regulation to
allow providers to use, without consent, all health information created
prior to the regulation's effective date.

All of the organizations representing providers and health plans anticipate
an additional administrative burden associated with implementing the new
consent procedures, but the magnitude of the potential burden is uncertain.
For example, if the use of new forms elicits more questions from patients
about medical records privacy, as the provision's supporters expect will
happen, providers will have to devote more staff time to

11 In commenting on a draft of this report, HHS took issue with this
interpretation of the transition provision. See Agency Comments.

Page 8 GAO- 01- 584 Patient Consent

explaining consent and discussing their information policies. Similarly,
health plan and provider advocates contend that focusing patients' attention
on their right to request restrictions on how their information is used
could result in many more patients seeking to exercise that right. This,
some believe, would require increased staff time for considering,
documenting, and tracking restrictions.

The privacy regulation expands the scope of the consent process to include
the use and disclosure of personal health information for a wide range of
purposes. This may help some patients become aware of how their medical
information may be used. However, in general, provider and health plan
representatives believe that the consent requirement's benefits are
outweighed by its shortcomings, including delays in filling prescriptions,
impediments to hospital preadmission procedures, and difficulty in using
archived patient information. Regardless of the presence of the consent
requirement, providers are obligated under the regulation to protect the
confidentiality of patient information. Moreover, with or without the
consent requirement, patients' rights established by the privacy regulation-
to see and amend their records, to learn of all authorized uses of their
information, and to request restrictions on disclosures- remain unchanged.

HHS provided written technical comments on a draft of this report. In them,
HHS remarked on the consent requirement's applicability to archived patient
medical records. Agency officials explained that a consent for either
treatment, payment, or health care operations acquired before the
regulation's compliance date would be valid for continued use or disclosure
of those data for all three of these purposes after that date. Under this
interpretation, for example, prior consents to disclose patient information
for insurance claims would permit uses for the full range of health care
operations as well, unless specifically excluded in the consent that the
patient signed. In our view, a better understanding of the implications of
this provision may emerge from any revisions to the final regulation.

Referring to material in appendix I, the agency expressed concern that we
overgeneralized current state consent laws, which have complex requirements
and vary significantly from one to another. HHS pointed out that some state
laws require written consent in some circumstances that would be considered
treatment, payment, or health care operations. We recognize that state laws
are complex and vary widely in the type of health Concluding

Observations Agency Comments

Page 9 GAO- 01- 584 Patient Consent

care information that is protected and the stringency of those protections.
While it is difficult to generalize about state laws, we found that the
statutes in the 10 states we examined were fairly consistent in not
requiring written consent for the full range of uses and disclosures of
patient information for treatment, payment, and health care operations.

The agency provided other technical comments that we incorporated where
appropriate.

We are sending copies of this report to the Honorable Tommy G. Thompson,
Secretary of HHS, and others who are interested. We will also make copies
available to others on request.

If your or your staff have any questions, please call me at (312) 220- 7600
or Rosamond Katz, Assistant Director, at (202) 512- 7148. Other key
contributors to this report were Jennifer Grover, Joel Hamilton, Eric
Peterson, and Craig Winslow.

Sincerely yours, Leslie G. Aronovitz, Director Health Care- Program
Administration

and Integrity Issues

Appendix I: Selected State Statutes on Consent

Page 10 GAO- 01- 584 Patient Consent

To examine how state privacy laws address the issue of patient consent to
use health information, we reviewed certain laws in 10 states (Hawaii,
Maine, Maryland, Minnesota, Montana, Rhode Island, Texas, Virginia,
Washington, and Wyoming). 1 We found that none of these state privacy
statutes include a consent requirement as broad as that found in the privacy
regulation. 2 Although they generally prohibit using or disclosing protected
health information without the patient's permission, they include
significant exceptions not present in the federal regulation. Essentially,
none of the state statutes we reviewed requires consent for the full range
of uses and disclosures of patient information for treatment and health care
operations. The Minnesota and Wyoming statutes require consent to use
patient health information for payment purposes. 3

Two states recently attempted to enhance patient control over their personal
health information. In 1996, Minnesota enacted a law that placed stringent
consent requirements on the use of patient data for research. It stipulated
that patient records created since January 1, 1997, not be used for research
without the patient's written authorization. Because such authorization was
not obtained at the start of treatment, researchers had to retroactively
seek permission. They soon found that many patients did not respond to
requests for such authorization, either to approve or to reject the use of
their data. The law was amended to permit the use of records in cases where
the patient had not responded to two requests for

1 These states were suggested to us by privacy law experts. The state laws
reviewed were: Haw. Rev. Stat. sect.sect. 323C- 1 – 323C- 55 (2000); Me. Rev.
Stat. Ann. tit. 22, sect. 1711- C (West 2000); Md. Code Ann., Health- General sect.sect.
4- 301 – 4- 307 (2000); Minn. Stat. sect. 144.335 (2000); Mont. Code Ann.
sect.sect. 50- 16- 501 – 50- 16- 553 (2000); R. I. Code R. sect. 5- 37. 3- 1
– 5- 37. 3- 11; Tex. Health & Safety Code Ann. sect.sect. 241.151 – 241-
156 (West 2000); Va. Code Ann. sect. 32. 1- 127.1: 03 (Michie 2000); Wash. Rev.
Code sect.sect. 70. 02.005 – 70. 02.904 (2000); Wyo. Stat. sect.sect. 35- 2- 605
– 35- 2- 617 (Michie 2000).

2 Some state laws require additional safeguards related to the use or
disclosure of certain types of health care information, such as HIV status
or mental health records. However, none of the laws we examined established
the type of two- tiered system of written permission involving both consent
for treatment, payment, and health care operations and authorization for
most other uses and disclosures. Two recent comprehensive surveys of state
laws related to the protection of health care information are Lisa L. Dahm,
50- State Survey on Patient Health Care Record Confidentiality, Health
Lawyers: Expert Series

(Washington, D. C.: American Health Lawyers Association, June 1999) and Joy
Pritts and others, The State of Health Privacy: An Uneven Terrain
(Washington, D. C.: Health Privacy Project, Institute for Health Care
Research and Policy, Georgetown University, Aug. 1999).

3 The relevant language in the Washington statute is nearly identical to
that in the Wyoming law. According to an official in the Washington attorney
general's office, however, consent is not required to use or disclose health
information for payment purposes in Washington. Appendix I: Selected State
Statutes on

Consent

Appendix I: Selected State Statutes on Consent

Page 11 GAO- 01- 584 Patient Consent

authorization mailed to the patient's last known address. At one major
research institution in Minnesota, the Mayo Clinic, that change decreased
the percentage of patient records that the patient consent requirement made
unavailable for studies from 20.7 percent to 3.2 percent. 4

In late 1998, Maine enacted a comprehensive law requiring specific patient
authorization for many types of disclosures and uses of health information.
The law took effect January 1, 1999, but was soon suspended by the state
legislature in response to numerous complaints from the public. Particularly
problematic was that “hospital directory” information could not
be released without the patient's specific written authorization. Therefore,
until routine paperwork was completed, hospitals could not disclose
patients' room or telephone numbers when friends, family, or clergy tried to
contact or visit them. Based on this experience, the Maine legislature
substantially modified the law, which became effective on February 1, 2000.
Among other changes, the revised law allows a hospital to list current
patients in a publicly available directory unless a patient specifically
requests to be excluded. 5

4 See S. J. Jacobsen and others, “Potential Effect of Authorization
Bias on Medical Record Research,” Mayo Clinic Proceedings, Vol. 74,
No. 3 (April 1999), p. 333. Mayo Clinic researchers remain concerned that
variations in the rate of refusal among different patient groups, for
example, young versus old, may tend to skew the results obtained from these
data.

5 The federal privacy regulation permits hospital directory information to
be disclosed as long as the patient has been given an opportunity to object
to its disclosure and has not done so.

Appendix I: Selected State Statutes on Consent

Page 12 GAO- 01- 584 Patient Consent

Appendix II: Organizations Interviewed Page 12 GAO- 01- 584 Patient Consent

We included the following organizations in our review: Allina Health System
American Association of Health Plans American Cancer Society American
Hospital Association American Medical Association American Pharmaceutical
Association AvMed Health Plan Bazelon Center for Mental Health Law Beaver
Medical Group Blue Cross and Blue Shield Association CVS Pharmacy, Inc.
Health Care Compliance Association Healthcare Leadership Council Health
Privacy Project Margret\ A Consulting, LLC Medical Group Management
Association National Association of Chain Drug Stores National Association
of Public Hospitals and Health Systems Appendix II: Organizations
Interviewed

(290022)

The first copy of each GAO report is free. Additional copies of reports are
$2 each. A check or money order should be made out to the Superintendent of
Documents. VISA and MasterCard credit cards are also accepted.

Orders for 100 or more copies to be mailed to a single address are
discounted 25 percent.

Orders by mail:

U. S. General Accounting Office P. O. Box 37050 Washington, DC 20013

Orders by visiting:

Room 1100 700 4 th St., NW (corner of 4 th and G Sts. NW) Washington, DC
20013

Orders by phone:

(202) 512- 6000 fax: (202) 512- 6061 TDD (202) 512- 2537

Each day, GAO issues a list of newly available reports and testimony. To
receive facsimile copies of the daily list or any list from the past 30
days, please call (202) 512- 6000 using a touchtone phone. A recorded menu
will provide information on how to obtain these lists.

Orders by Internet

For information on how to access GAO reports on the Internet, send an email
message with “info” in the body to:

Info@ www. gao. gov or visit GAO's World Wide Web home page at: http:// www.
gao. gov

Contact one:

? Web site: http:// www. gao. gov/ fraudnet/ fraudnet. htm

? E- mail: fraudnet@ gao. gov

? 1- 800- 424- 5454 (automated answering system) Ordering Information

To Report Fraud, Waste, and Abuse in Federal Programs
*** End of document ***