White House Issues Rules on Patient Privacy

The Bush administration released final medical privacy regulations Friday that will require doctors, HMOs and hospitals to tell patients how they use their medical records.

But unlike privacy rules approved by the Clinton administration, the Bush rules do not require health-care providers to obtain patients’ consent before sharing their medical records with insurance companies, drug manufacturers and pharmacies.

The Bush regulations also allow health-care providers, pharmacies and drug companies to profit from the use of patient records, giving them broad leeway to use medical information to market their health-care products.

When the 443-page rule, ordered by Congress six years ago, finally takes effect in April, it will for the first time provide all Americans with basic privacy protections for their medical records.

But privacy advocates argued that the rules fall woefully short of what is needed, and it was clear that the debate over patient consent, the use of medical records for marketing purposes and the effect of confidentiality on patient care would continue in Congress, state legislatures and political campaigns.

“The good news,” said Janlori Goldman, director of Georgetown University’s Health Privacy Project, who was highly critical of many of the regulations’ specific provisions, “is that they did allow the rule to go into effect.”

Bush administration officials said some sharing of medical information--when a doctor orders a prescription or refers a patient to a specialist, for example--is necessary, and the new rules strike just the right balance.

In providing basic privacy protections, Health and Human Services Secretary Tommy G. Thompson said the administration worked to avoid “creating greater hardships or more health-care bureaucracy for patients as they seek to get prompt and effective care.”

The American Assn. of Health Plans, a trade group representing more than 1,000 HMOs, and the Federation of American Hospitals applauded the administration for issuing balanced, workable rules. The Health Insurance Assn. of America said the regulations were less onerous than the Clinton administration rules but would “inevitably increase the cost of health care.”

But some of Congress’ strongest defenders of patient privacy, comparing the new rules to the Clinton administration regulations they replace, said Americans had actually lost confidentiality protections.

Sen. Edward M. Kennedy (D-Mass.) called the Bush regulations a “serious setback for medical privacy.” Referring to the intense lobbying by the health-care industry, he said they were “yet another example of the Bush administration favoring the interests of powerful corporations over those of ordinary Americans.”

Rep. Henry A. Waxman (D-Los Angeles) said, “The Bush administration is going backwards in privacy protection by creating huge loopholes that will significantly undermine privacy for most Americans.”

The American Psychiatric Assn., perhaps the strongest defender of patient confidentiality among health-care providers, expressed deep disappointment and said the regulations could actually lower the quality of health care.

With few guarantees on the privacy of their medical records, some patients “may simply decide not to come for certain kinds of care or they may withhold information that would be very important in treating their condition,” said Dr. Paul Applebaum, president of the association.

Some patients, afraid that information about their medical condition could lead to the loss of a job or insurance, already hop from doctor to doctor, pay for medical bills out of pocket and refuse to seek care.

Under the Bush administration’s rules, a physician or hospital can send a patient’s medical information to an insurance company even if the patient paid the bill in cash to prevent that.

Such practice will “play havoc with patient confidentiality” and further erode the quality of care for some patients, said Richard Sobel, senior research associate at Harvard Medical School.

Some privacy experts found the marketing provisions of the new regulations the most troubling of all.

The new rules prohibit a doctor or pharmacy from selling patient names and health-care information to a third party--a drug company, for example. However, the rules allow the physician or pharmacy to accept payment from the drug company to send all their patients taking one drug for heartburn a letter recommending that they switch to one manufactured by the company paying for the solicitation.

In effect, Goldman said, “the administration is legalizing one of the more reprehensible practices: the selling of people’s medical records.”

The Clinton administration’s regulations would have allowed similar marketing practices but with two key conditions, Goldman said. First, physicians or pharmacies sending such letters would have had to acknowledge they were being paid to do so. Second, they would have been required to give patients the opportunity to opt out of receiving similar letters or phone calls in the future.

“Now both of those safeguards are gone,” Goldman said. Under the Bush regulations, a marketing tactic used in Florida recently would be allowed.

In that case, a Walgreens drugstore, Eli Lilly & Co., three doctors and a hospital used patient information to market the antidepressant Prozac. A 59-year-old woman who received from Walgreens a free one-month trial of the drug has filed a class-action lawsuit.

Friday’s release of the final rule, which will be published Wednesday in the Federal Register, appears to bring to a close Congress’ years-long effort to establish basic privacy rights for patients. The process began in 1996 with the passage of the Health Insurance and Portability Act, which was intended to make health insurance more accessible and transferable by standardizing and streamlining the record-keeping practices of health-care providers.

The law also called for action to protect the privacy of medical records and said that if Congress failed to pass such legislation by 1999, the secretary of Health and Human Services should draft privacy regulations. After congressional efforts stalled amid disagreements over how to handle teenagers’ reproductive health information and consumers’ rights to sue health-care entities that violated the privacy rules, the Clinton administration took up the task.

The Clinton administration released its privacy rules just one month before President Bush took office, and the new administration initially said it would let the Clinton rules stand. Bush had promised during the 2000 campaign to increase medical privacy protections.

But health insurance companies, hospitals and HMOs lobbied hard to scuttle the rules, arguing that they would be too costly and would interfere with patient care. The Bush administration agreed, and in March it released its proposed rules. Most significantly, the Bush rules no longer required patients’ consent for the release of their medical information, and they allowed greater use of patient information for marketing purposes.

Bush administration officials noted that some Clinton provisions would have had unintended consequences, possibly delaying the release of information to a referred specialist or preventing a husband from picking up his wife’s prescription if the pharmacy did not have her consent form on file.

Privacy advocates said those problems could have been corrected with minor adjustments to the regulations. But the Bush administration, appearing at times to suggest that confidentiality and access to care were incompatible, made dramatic changes to those provisions.