Deadline is now for federal HIPAA regulations: Confusing debut for privacy rule

Physician practices are supposed to be following federal standards for patient privacy, but experts warn them not to go overboard.

By Joel B. Finkelstein, amednews staff. April 14, 2003.

Washington -- The national privacy regulations have finally gone into effect, but for many physicians, the real trials and tribulations of the rule have only just begun.

While physicians continue to scramble to meet the requirements of the privacy rule, experts worry that the regulations may unintentionally interrupt the flow of patient data within the medical community.

Ready ... or not
See related content
Topic: HIPAA

A lack of accurate information about the privacy standards is creating a potentially dangerous environment of overprotective practices. There is still much confusion about the rule, and that confusion may very well stifle or slow information sharing, said Mark A. Rothstein, director of the Institute for Bioethics, Health Policy and Law at Kentucky's University of Louisville.

Exaggerations and misinformation from those attempting to profit from physicians' confusion are also proving to be a problem.

"A lot of providers think they have to get an authorization to write a prescription or need authorization to get hospital records," said Antonio W. Felices, RN, a HIPAA consultant with the Practice Management Institute in San Antonio. "I have even spoken with physicians who are reluctant to release records to other physicians because they think it's a violation of HIPAA."

Physicians and public health workers are already experiencing difficulty obtaining patient health information that used to be no problem to get.

April 14 is the deadline for HIPAA compliance.

"There is confusion about what physicians can and cannot report," said Rothstein.

The Red Cross, which informs military personnel when a family member is seriously ill, has been increasingly running into a brick wall when trying to confirm patients' health status with physicians. The organization now regularly sends out letters to physicians detailing the provisions of the privacy rule that allow doctors to share protected health information when it is in their patients' best interest.

Rothstein said that inaccurate perceptions of the privacy rule's requirements is his major concern during the implementation process.

One physician who has struggled with the privacy rule pondered whether the complications in implementation will ultimately be the regulations' undoing.

"My guess is that implementation problems are going to be widespread enough that there is not going to be effective enforcement," said Michael D. Fine, MD, of Hillside Avenue Family and Community Medicine, Pawtucket, R.I. "When enforcement goes away, universal adherence to the standards and concepts will go away, as well."

Time, effort, money face the test

With eight physicians, Hillside is the largest family practice in Rhode Island. The group has an office administrator who doubles as a compliance officer. She has spent more than 100 hours learning the privacy rule, developing forms and making sure the office meets the requirements of the Health Insurance Portability and Accountability Act of 1996.

"It's been a fairly expensive and time-consuming process," said Dr. Fine, the senior managing partner.

Two-thirds of practices expected to be ready for HIPAA.

"We haven't had [to change the way we practice] much at all, but then again, we tend to be at the front of the curve vis-à-vis electronics," said Dr. Fine, whose office started using computerized record-keeping 12 years ago.

But many physicians, especially those in small practices, are still struggling with requirements that are sometimes cumbersome and often confusing.

Dr. Fine predicted that his group was well ahead in compliance compared with other Rhode Island practices, which tend to be offices of only one or two physicians.

"Few smaller practices have the resources, time and energy to do this work," he testified at a meeting of the National Committee on Vital and Health Statistics subcommittee on privacy and confidentiality. The NCVHS provides advice and recommendations to the Dept. of Health and Human Services.

That was a sentiment repeated by many physicians from small practices across the country, said Rothstein, who as the subcommittee's chair has heard the testimony of more than 70 witnesses.

A recent survey showed about two-thirds of practices expected to be ready by the compliance deadline.

Getting beyond the hype

Despite the hype and worry, the privacy rule is not meant to, in any way, interfere with the practice of medicine or the treatment of patients, HHS officials stress. In fact, the final rule was designed to eliminate burdens on doctor-patient interactions and the sharing of patient data between physicians and allied health professionals, they said.

HHS officials and others who understand the regulation are trying to convey the message to physicians that they should not feel overwhelmed by the rule and they don't need to make sweeping changes to their practices.

Doctors can share protected health information when it is in their patients' best interest.

"If providers are spending an exorbitant amount of money, if they're losing sleep over this, if they are unable to keep their practices open, then they're doing something wrong," said Felices.

But HHS' message seems to be getting lost.

In two letters Rothstein described as uncharacteristic in their bluntness and call for immediate action, the NCVHS' privacy subcommittee recommended HHS invest significantly more energy and money on educating the medical community and public about the privacy regulations.

Rothstein said he was disappointed by what he considered a token response from HHS Secretary Tommy Thompson assuring him of the adequacy of current educational initiatives.

The department has been holding local and national meetings to answer questions about the privacy rule. High attendance at those events suggests many people in the medical community are eager to comply with the rule. A recent teleconference hosted 4,000 callers. However, only about a dozen got to ask their questions.

Rothstein's group has recommended that physicians be offered more conferences and that the meetings be more focused on their needs.

Felices has noted a similar craving for knowledge about the rule.

He described a recent class during which he held the studious attention of 250 physicians, who, in the past, had been known to boo anyone who even mentioned HIPAA.

Felices said that he has had a lot of success in teaching physicians about the rule by keeping it simple and emphasizing the idea that compliance is relative and based on measures that they can reasonably take.

"At the bank, they make you stand behind the red line, because they are trying to protect your privacy," said Felices. "It's not foolproof, but it's a good-faith effort."