Privacy Initiative Elicits Praise, Concern

The sweeping new medical privacy protections proposed Friday by President Clinton drew praise from all the players in the health care community but each group had its concerns and said that it would work to persuade the administration to make modifications.

While the administration had tried to strike a balance between protecting the privacy of patients and the needs of doctors and insurers for information, some physicians said they were worried that the proposed rules could permanently undermine a patient’s control over sensitive medical data.

Although the new regulations would limit health care providers and insurers to using a patient’s medical data for only treatment and payment purposes, doctors said that those are broad categories that give patients little control over who in the health care system has access to sensitive information.

Clinton, speaking in an Oval Office ceremony, said that he is determined to end violations of medical privacy.

“We are trying to protect the sanctity of medical records. . . . Every American has a right to know that his or her medical records are protected at all times from falling into the wrong hands,” Clinton said.

Protections are needed, Clinton said, because in the age of information technology, computer medical records can be easily transferred--or sold--without a consumer’s consent, to employers, insurers, drug companies and banks.

The proposed rules were required by a 1996 law directing the president to issue rules to protect electronic medical information if Congress failed to pass comprehensive health privacy legislation by last August. Medical privacy legislation has not come to the floor of either the House or Senate.

The rules cover all medical information that is stored electronically. While that is less than half of all medical data today, the vast majority of medical records is expected to be electronic within a few years.

The massive regulations--which run hundreds of pages--would prohibit doctors, hospitals and insurers from releasing identifiable health information without a patient’s written consent for any purpose other than treating the patient or paying bills. They also require that patients be permitted to copy their medical files and correct them and that they be notified about how their information is being used and to whom it is disclosed.

To ensure that strict privacy standards are followed and the minimum amount of information is released, health plans and providers would have to establish internal procedures and appoint a privacy officer to monitor the group’s practices and ensure that strict protocols are followed.

Consumer groups offered especially warm praise and said that the regulations were long overdue protections for an unwary public.

The regulations will be “the first enforceable federal health privacy rules,” said Janlori Goldman, director of the Health Privacy Project at Georgetown University.

“It’s amazing, wonderful and in fact most people think that they [privacy protections] already exist,” said Chai Feldblum, a professor at Georgetown Law School and an advocate for disability groups.

Critics underscored, however, that in the absence of congressional action there is no way to protect records kept on paper and there is no way for consumers to seek redress if their privacy is violated.

They were most critical of the administration’s treatment of law enforcement officials. Under the new rules, these officials could seek medical records by simply filling out paperwork saying that they need the information. Critics fear, for example, that it would be easy for police in a small town to find out what illness their neighbors have or what prescriptions they get.

“The most important thing from our perspective is that there be judicial review when law enforcement officers seek medical records,” said Ronald Weich, a legislative consultant for the American Civil Liberties Union.

“Under the 4th Amendment, before the police go into your home they have to have a warrant signed by a judge. We think medical records in your doctor’s office are just as much your private property as records you keep in your desk at home,” said Weich.

Doctors, including the American Medical Assn., raised serious concerns about the proposed rules’ blanket license to health care providers and insurers to receive all relevant medical information about a patient without his or her consent as long as it is for treatment or payment.

Psychiatrists are particularly upset about this aspect of the rules.

“For instance, if a patient had an abortion and four weeks later went to a podiatrist, the podiatrist could see her entire medical record with the information about the abortion,” said William Bruno, an attorney with the American Psychiatric Assn.

It would be better, he said, to allow patients to consent to the disclosure of their medical records and have the option of asking that their psychiatric records and other sensitive health information be “electronically partitioned.” Then, when records are sent to other practitioners or insurers, that information would be omitted.

Most insurers, who had been expected to voice strong criticism of the rules, had only mild complaints. The exception was Blue Cross and Blue Shield Assn., which argued strenuously that the rules are too complicated and would be expensive.

“It doesn’t take this much bureaucracy, confusion, vagueness and complexity to do this,” said Bill Pierce, a spokesman for the association.

Overall, however, the rules could have been a lot worse, insurers said.

“We’re glad that the president is trying to find a balance between protecting confidentiality and rights to privacy but is trying to tolerate some capacity for health plans and others to use information for quality and research purposes,” said Walter Zelman, president of the California Assn. of Health Plans.