Lobbyists Go Full Tilt in Bid to Ease Patient Privacy Rules

A broad coalition of hospitals, HMOs, insurers and pharmaceutical companies has launched an intensive campaign to persuade the Bush administration to scale back a landmark patient privacy regulation approved by former President Clinton.

The lobbying effort appears to be one of the largest ever undertaken to block implementation of a federal health care regulation. It reflects the strength of private-sector opposition to the new rule, as well as the vulnerability of Clinton-era initiatives to reconsideration or reversal by the Bush team.

The regulation, finalized in December, would set strict limits on disclosure and distribution of patients’ medical information, prohibiting its use for purposes other than treatment, payment or administration. It was scheduled to take effect April 14, but Health and Human Services Secretary Tommy G. Thompson of the Bush administration has asked for additional public comment and has the authority to prevent the regulation’s implementation in its current form.

With just a week to go before the comment period ends, industry groups are working overtime to file written objections to the rule and make their case to Congress and the public. They argue that the regulation is excessively complicated and that compliance would cost billions of dollars over the next 10 years. In addition, they say many patients would find it more difficult to get the health care they need.

“This regulation is not ready for prime time,” said Alissa Fox, chief lobbyist for the Blue Cross Blue Shield Assn. “Every law firm in town has a unit working on this--I don’t mean a person, I mean a unit. It’s full employment for lawyers.”

Indeed, a flotilla of press releases and studies about the rule is flooding news organizations and congressional offices. In downtown Washington, many major law firms have created “practice groups” specializing in health care privacy. The lawyers, many of whom were retained originally to help health care organizations comply with the new regulation, are now helping prepare analyses they hope will convince the administration to water it down.

Consumer advocates, doctors and nurses who support the proposed restrictions are mounting a counter-effort to preserve the rule with modifications. But they are far from united: Some think the rule does not go far enough, while others say that even a flawed rule is better than having no protections at all.

“We vigorously oppose any effort to roll back the law. . . . It is essential that we not be swayed by distortions and exaggerations that we fear are part of a strategy to not only delay but also to undermine the regulation,” said Jan Lori Goldman, director of the Health Privacy Project at Georgetown University.

If No Regulations Now, Perhaps Maybe Never

At this point, there appears to be little middle ground on the issue. Congress worked for more than two years to craft medical privacy legislation, but the effort ultimately stalled. Congress then directed the Department of Health and Human Services to address the issue through regulation and spent nearly a year gathering facts about the use and disclosure of health information.

If the rule is “reopened” and substantially rewritten, it may never be completed, some health care experts fear.

“We all know that Congress spent a lot of years not being able to reach a consensus, and we have already had extended public comment on this regulation. Everybody got something, and nobody got everything,” said Sam Karp, chief information officer at the California HealthCare Foundation, which has conducted national surveys on the privacy issue. “We don’t have any federal law that protects the privacy of our health care information, so the question is, if the administration delays the regulation, will they ever reach an agreement?”

If overturned, the change would be the latest example of the Bush administration reversing Clinton-era regulations such as costly ergonomic rules and strict standards on arsenic levels in drinking water.

Surveys show most Americans believe medical information should be kept confidential and worry about maintaining privacy in a health care system that increasingly relies on electronic record-keeping. Nearly 1 in 5 people polled by the California HealthCare Foundation said they sometimes withhold information from doctors or pay out-of-pocket for medical services in an effort to limit outside disclosure.

But keeping information secret is increasingly difficult. Patient records are no longer confined to a doctor’s locked file cabinet; instead, medical data are routinely distributed, both electronically and on paper, in the form of insurance claims, hospital records, pharmaceutical prescriptions and physician monitoring systems.

There is no federal law barring health care organizations from sharing, selling or trading most categories of patient information. While some patients may not fear disclosure, the prospect is worrisome to others, such as those suffering from a sexually transmitted disease, genetic ailment, mental illness or chronic or terminal disease.

And mistakes do happen. An inadvertent or intentional disclosure, for example, could allow an employer to learn about a terminal disease and dismiss the worker. And several times in recent years, patient medical records have been unintentionally posted on the Internet.

Industry Says Rules Could Hamper Care

Hospitals, insurers and pharmacies argue that the free flow of information is essential to good patient treatment as well as prompt payment. HMOs in particular worry that doctors, who have long resented outside oversight of their treatment protocols, may use the rule to justify withholding patient medical records.

The Health and Human Services rule would apply to a wide range of health care providers, including doctors, nurses, hospitals and pharmacists, as well as health insurers, HMOs and other claim-payers. It would require them to set up administrative systems to safeguard patient information, including the appointment of a privacy officer responsible for ensuring that information is used only for treatment, payment or administration.

It would direct providers, whenever possible, to share only the minimum necessary amount of information. Wider distribution would be allowed only if providers obtained specific authorization.

Because providers and insurers routinely share health care information with “business associates,” such as computer system operators, auditors and pharmacy benefit managers, the rule would require them to execute contracts binding the third-party firms to the same restrictions.

While the rule’s provisions seem reasonably straightforward, its critics say that making them work could prove difficult. When a doctor calls in a prescription, for example, the pharmacy could not fill the prescription and process the insurance claim unless it already had the patient’s consent on file. Pharmacies say they would have to set up systems for obtaining and storing consent forms for customers.

“We operate mail-order pharmacies, and we would need to have that individual’s consent on file in order to fill a prescription,” said Daniel Walden, chief privacy officer for Merck-Medco Managed Care, which helps fill prescriptions for 65 million people and ranks as the nation’s largest pharmacy benefit manager. “You’d hate to be in a situation where a patient calls in and expects to be able to have the prescription filled and can’t because there’s no consent on file.”

Even privacy advocates concede that some changes are needed to make implementation of the rule less troublesome for pharmacies but note that Thompson has the authority to make revisions without reopening the rule-making process. Health care groups want to change far more than just that one requirement, according to privacy advocates.

Interviews with industry officials confirm that few of the rule’s provisions are acceptable to health care providers.

The influential Healthcare Leadership Council, which represents many of the largest pharmaceutical companies and insurers, issued a report describing many of the regulation’s key elements as “unnecessary.”

The council leads the Confidentiality Coalition, which was organized five years ago when Congress started working on patient privacy. It hosts regular meetings to share information about the rule’s potential effects.

Asked what provisions of the rule should be preserved, council President Mary Grealy cited only two: the right of patients to review and correct their medical data, and the mandatory patient authorization for any disclosure other than for treatment, payment and health care operations.

“It’s far more important to handle this correctly than to do it swiftly,” Grealy said.

So far, Thompson has been circumspect about his plans, but he has left the door open to rewriting the rule entirely. “There was a lot of confusion about some of the provisions of the privacy thing,” he said in a recent congressional hearing.

“We’re going to either make changes or leave it the way it is,” he said, adding that “if we make major changes, that may delay it somewhat.”