Patients Can Rest Easier When It Comes to Medical Privacy Issues

Whether it’s a sexual problem, a nervous breakdown or something less glamorous, most of us have a secret or two in our medical resume that we don’t want buzzing around in some database--at work, say, or a drug company--where it doesn’t belong.

That’s why consumer advocates practically swooned at the Bush administration’s recent decision to implement sweeping new rules to protect the privacy of medical records. Health industry groups such as insurers and hospitals had strongly challenged the rules as costly and restrictive, and the White House had been signaling it might reconsider them.

Created under the Clinton administration and approved by Congress in 1996, the new regulations took effect April 14 and allow two years for full compliance. Among other things, the rules require that doctors and other health-care providers get written consent from patients whenever health information is shared even for routine purposes, such as claims payment; allow patients to see and propose corrections to their own files; and make an effort to tell patients how their health information could be used. Violators are subject to fines of up to $250,000.

“This is absolutely a breakthrough for privacy protection of consumers,” says Janlori Goldman, of the Health Privacy Project at Georgetown University Medical Center in Washington, D.C. “Many state laws are inadequate, and this gives us a baseline that fills in a lot of cracks and holes.”

California has fewer cracks and holes than most states. An array of laws already affords Californians most of the protections contained in the new federal law, health-care lawyers say. Yet those who have studied the new federal rules say that, if faithfully implemented, they should bring several noticeable changes in how we direct our own health care. For example:

* True informed consent. As it is, many of us rush through our doctor appointments, sign whatever forms are thrown in front of us, and we’re out the door. The new federal rules will require that doctors’ offices all but hit us over the head with the importance of written consent. “The regulation is very clear on that,” says Joy Pritts, senior counsel at the Health Privacy Project, who has analyzed how the federal law will impact California. To be in compliance, she says, providers “will have to give you a piece of paper announcing in bold letters, IMPORTANT--READ THIS, which will explain how your medical information could be used,” as well as your right to consent under the new laws.

* The right to amend one’s own record. Under current state law, consumers in California can demand to see their medical records but not alter them, lawyers say. The new federal rules allow patients to submit written amendments to their records which doctors are required to consider: a note naming supplements the patient takes but didn’t mention to the doctor, for example, or even a rebuttal of the doctor’s judgment about lifestyle. “You can’t go back and erase anything,” says Pritts, “but you do have the right [under the new federal rules] to request that it be amended.”

* More protection of therapists’ notes. Currently, insurers may demand virtually anything from therapists when a claim is submitted for payment, says psychotherapist Ruth Clifford, president of the California Coalition for Ethical Mental Health Care, an organization of professionals and consumers based in the Bay Area. The new federal regulations should help restrict the amount of detailed personal information that flows out of mental health practitioners’ offices, says Donald Pogoloff, a professor of public health and Cal State Fresno who advises practitioners on privacy issues.

The costs of implementing these reforms are hard to estimate, but health insurers put the number in the billions of dollars--which will only add to already ballooning health-care expenses, they say. The rules may also limit the free flow of medical records information to health-care professionals who need it, insurers say.

The Bush administration has said that the new privacy rules are not etched in stone, that they could be amended or clarified at a later date to accommodate the concerns of hospitals, insurers and providers.

But for now, advocates say, consumers can have more confidence in the system. Even under California’s relatively strong protections, about 20% of adults say they have taken precautions to protect their privacy, such as occasionally paying for care out of pocket even when they have insurance, according to surveys commission by the California HealthCare Foundation, a health-care charity based in Oakland.

“Twenty percent is a whole lot of people,” says Sam Karp, chief information officer at the Foundation, “and some of them said they actually avoided seeking care because of privacy concerns.”

Breaches in confidentiality are more often the result of carelessness than cunning, says Beth Givens, director of the Privacy Rights Clearinghouse, a nonprofit advocacy group based in San Diego, who estimates that she has heard more than 20,000 privacy complaints from consumers over the last decade. “People working in health facilities get a request for information and they just send it out without thinking much about what’s in there.”

*

Ask David Sylvian, 35, of Sacramento. While still in college, and working for the state part time, Sylvian injured his back. To file an insurance claim, he had to request that his college medical records be sent to claims processors. “The request specifically said to send my physical health history; it was very clear about that,” he says. Instead, the university’s records department forwarded virtually everything it had--including a sheaf of notes from numerous counseling sessions at which Sylvian was working through childhood traumas and his own sexual orientation. “Incredible,” Sylvian says. “Those notes from counseling are now bundled together in my medical record. If anyone requests the record, they get the whole thing.”

The most immediate effect of the new federal rules may be to spare others the same fate. “I think the new rules will bring a strong culture of confidentiality to the workplace and to health-care facilities,” says Givens, of the Privacy Rights Clearinghouse. “People will have a heightened awareness about this stuff,” and they’ll think before sharing the information.

*

For more complete discussion of the new rules, visit the U.S. Department of Health and Human Services site at https://www.os.dhhs.gov/news/press/2000pres/00fsprivacy.html or the Health Privacy Projects site at https://www.healthprivacy.org.