Clinton Issues New Health Privacy Rules

W A S H I N G T O N, Dec. 20, 2000 -- Congress is expected to scrutinize new rules President Clinton issued today that, for the first time,restrict who can see a person’s medical records.

Donna Shalala, secretary of Health and Human Services, predictedlawmakers will find the regulations balanced.

“It gives Americans the power to find out who’s looking intheir records and for what purpose, what’s in their records, how toget them, how to correct errors,” Shalala told reporters.

Even though technology allows personal medical information tobounce from one computer to the next, no federal law protected aperson’s medical privacy.

Clinton said he was doing the most he could do to protectindividual medical records, and urged Congress to pass even moreprotections.

Restricting Easy Access

“With a click of a mouse, your personal health information canbe accessed without your consent by people you don’t know whoaren’t physicians—for reasons that have nothing to do with yourhealth care,” Clinton said.

“It doesn’t take a doctor to understand that is a prescriptionfor abuse. Employers, for instance, shouldn’t see medical records,except for limited reasons, such as to process insurance claims.Yet, too often they do.”

President-elect Bush could undo the rules with a new regulation,but starting the regulatory review process over would be amonumental task.

“Medical privacy is an important issue, but notone that dominated the recent election campaign. It is certainly tobe an issue for public discussion and debate in the future,” RaySullivan, a spokesman for Bush.

Congress also could overturn the regulations, which take effectin about two years.

“They’ll hold hearings early in the new Congress to review theregulations and determine whether they should be added to orchanged,” said Joe Karpinski, a spokesman for the Senate Healthand Education Committee. “They’ll be looking at what did they do?Did the administration have the authority to go as far as theydid?”

Paper v. Electronic Records

Among the issues the Senate might examine is whether theadministration had the power to include paper as well as electronicrecords. Initially, HHS included just electronic data. But thefinal rule covers all the records of any doctor or hospital thatfiles insurance claims electronically.

Even if Congress objects, it would be hard for opponents tomuster enough votes to pass new legislation. Congress tried forthree years but failed to find a compromise formula that could winpassage. And that was amid widespread agreement that legislationwas needed. Now, with the regulation in place, the urgency might begone.

The rules were issued after Congress in 1966 gave itself threeyears to pass legislation, stipulating that the Department ofHealth and Human Services could write regulations if it failed.

Under the rules, patients could sign a one-time consent form ontheir first visit to a doctor allowing disclosures for routinematters like billing and treatment. But they would have toexplicitly authorize most other uses of their records.

Patients also are gaining the right to inspect and requestcorrections to their records. And employers will be barred fromperusing medical information about their workers unless it’sdirectly related to providing health care.

Violators face civil and criminal fines and, in severe cases,prison.

In a change won by industry, the administration deleted aprovision that could have opened the door for patients to sue iftheir records were improperly released.

Law enforcement agencies could obtain access to records with anadministrative subpoena or summons, but they would not have to goto court as advocates would have liked.

“That’s just not practical, but they’ve got to do somethingthat makes them stop, think that they’ve got a reason for doingthis,” Shalala said. “We don’t believe law enforcement thatshould have unfettered access to our health care records.”

Health Industry Reacts

The American Medical Association reacted with caution to the newrules.

“We will be closely examining the new rules to make sure thereare no dangerous loopholes or unexpected problems,” said Dr.Donald Palmisano, a surgeon from New Orleans who is a trustee onthe AMA board and an expert on patient privacy issues.

The health industry supports the notion of improved medicalprivacy, but worries because the rule allows states to write evenstricter standards.

“Without uniformity, the regulations are going to cause more,not less, confusion,” said Chip Kahn, president of the HealthInsurance Association of America.