One year later, mixed reviews for privacy rule

Some say there aren't enough protections; others complain of overzealous interpretation.

By Joel B. Finkelstein, AMNews staff. May 3, 2004.

Washington -- One year after implementation, the federal health privacy rules are still generating controversy.

Privacy advocates say the government isn't doing enough to enforce the rule. Some experts argue that the regulation itself is a problem because it doesn't do enough to protect privacy, while still others say that the health care community is occasionally going too far and limiting legitimate access to patient information.

Despite these varying assessments, federal officials and many in the medical community say they are happy with the progress they have made toward full compliance with the rule.

At last count, the Dept. of Health and Human Services' Office of Civil Rights had received 5,350 complaints -- a steady flow of around 100 a week -- alleging infractions of the privacy rule.

Enforcement of the regulation, which was mandated as part of the Health Insurance Portability and Accountability Act, is complaint driven.

The office has managed to close about 47% of those cases, often with little more than a phone call explaining to the physician or other entity what the rule says and what they need to do to comply.

Physician practices top the of list of those named in privacy complaints, followed by hospitals, pharmacies and outpatient facilities, OCR said.

It's no coincidence that the top four are also the groups having "routine and direct contact" with patients, said OCR Director Richard Campanelli.