HIPAA rule rapped as breaching privacy

Physician and consumer groups are taking aim at the regulation, which they say paradoxically removes privacy protections.

By Joel B. Finkelstein, amednews staff. May 5, 2003.

Washington -- Less than a month into its implementation, the federal privacy rule is already facing a two-fronted assault.

Lawsuits and legislative efforts are seeking to overturn the rule, part of the Health Insurance Portability and Accountability Act. Its opponents allege that the regulation represents a breach of privacy and of the physician-patient relationship.

Links
See related content

The rule allows physicians, health plans and other "covered entities" to share health information, without obtaining patient consent, for treatment and payment purposes and for health care operations, such as quality assessment and underwriting.

Some physician groups argue that the rule has already had a chilling effect by making patients more wary about what information they give to their doctors. There are also concerns that health plans will begin requesting from doctors more patient health information under the guise of health care operations, but that their real intent will be to cherry-pick patients by pricing unhealthy enrollees out of the market.

In general, the rule's opponents worry about inappropriate access to personal health information.

"I don't want bureaucrats from the Dept. of Health and Human Services looking at my records," said Michael D. Ostrolenk, national coordinator of the Maryland-based Medical Privacy Coalition, a group that advocates for informed consent to protect patients' information from misuse.

Lawsuits and legislation on the HIPAA privacy rule aim to reinstate patient rights of consent.

"The rule puts the Fourth Amendment on hold," he said, referring to constitutional guarantees against unreasonable searches and seizures. Under the rule, public health and law enforcement officials have new rights to access patient records without consent, he said.

The fight over which situations should require patient consent under the privacy regulations is one that has a long history and is not likely to go away any time soon.

Some groups have been fighting HHS since the rule was first drafted, and new groups have taken up the banner as more doctors and patients have become aware of the regulation.

As originally drafted, the privacy rule called for physicians and other covered entities to get written consent from patients to share their information. But the Bush administration did away with that requirement in response to industry complaints that it would be too burdensome and would interfere with patient care.

Some consumer and doctor groups protested the change at the time. And their fight did not stop there.

Lawsuits and legislation

A lawsuit filed against HHS in April charges that the changes created a loophole in the rule that gives health plans and the government inappropriate access to patient information. The lawsuit was brought by a coalition of advocacy groups led by Citizens for Health, a national group based in Washington, D.C. It seeks to reverse the change to the rule and restore the right of consent.

The rule removes patients' right of consent -- the ability to tell physicians whether to share certain information with a health plan or employer, said the coalition's attorney, James C. Pyles. This could put physicians in an awkward position, especially when plans request data with patient-specific information.

An earlier lawsuit, filed by the Assn. of American Physicians and Surgeons, alleges that HHS overstepped its constitutional authority when writing the rule. That suit seeks to throw out the rule altogether.

As these cases are pending, legislation that targets the same issues has been introduced in Congress. One bill would reinstate the mandatory consent requirement and tighten up marketing restrictions. Another would repeal the regulation.

Despite attacks on the rule, HHS is focused on helping physicians and others implement the regulations, according to an agency spokesman.

While the department is allowed to make rule changes once a year, it has no plans to do so now. The regulation strikes a good balance between protecting privacy and enabling the flow of necessary information between health care entities, the spokesman said. "We provided limits for who can share, what can be shared, and how it can be shared."