June 21, 1999

Future Bleak for Bill to Keep Health Records Confidential

---

Related Articles

Issue in Depth: Health Care

Forum

Join a Discussion on Health Care Reform

---

By ROBERT PEAR

ASHINGTON -- Legislation to protect the privacy of medical records is dying under pressure from insurance companies, health care businesses, law-enforcement officials and others lobbying Congress to preserve their access to sensitive information on patients.

As envisioned, the bill was supposed to establish comprehensive federal standards for the confidentiality of medical records. The goal of a uniform medical privacy standard was originally shared by consumer advocates and the health care industry, which now operates under rules that vary from state to state.

But some consumer and privacy advocates now say the bill, which has been changed amid a spirited lobbying blitz, permits health insurers, health care businesses and law enforcement officials to encroach on privacy rather than protect patients' confidentiality.

On four occasions in the last month, a Senate committee has scheduled and then canceled meetings to amend and vote on the legislation, which would affect virtually everyone who receives, provides or pays for health care in the United States: doctors, patients, hospitals, drugstores, employers, insurers, insurance agents and researchers, among others.

With so many competing interests swarming round the bill, it appears to be doomed.

Congress faces a deadline. If it does not act by August, Donna Shalala, the secretary of Health and Human Services, is supposed to issue privacy-protection rules. But Congress could stop her or extend the deadline.

The stated purpose of the bill, drafted over the last three years by Sen. James M. Jeffords, R-Vt., is to "establish strong and effective mechanisms to protect against the unauthorized and inappropriate use of protected health information."

In general, the bill says, health care providers and insurance companies may not disclose information from an individual's medical records unless the person has authorized such disclosure. But then, it says, anyone who wants health insurance must, "as a condition of enrollment in the health plan," authorize the use and disclosure of personal health information, not only for medical treatment and the payment of claims, but also for the vaguely defined purpose of "health care operations."

Critics say the bill would virtually force patients to give consent, on penalty of losing their health insurance. A health plan could deny coverage to people who refused to give consent.

James C. Pyles, an expert on privacy rights who represents the American Psychoanalytic Association and many home health agencies, said: "The bill recognizes a right to confidentiality, but essentially eliminates it by compelling the consent as a condition of obtaining insurance or even treatment in some cases. That's not really consent; it's submission."

George J. Annas, chairman of the health law department at the Boston University School of Public Health, said: "The bill tends to erode confidentiality more than it guarantees confidentiality. More people would be authorized to have access to your medical records than have access under current law. Health plans and researchers would say that's a good thing because it'll make the health care more efficient and speed up gene-based research to look for new drugs."

Under the bill, law-enforcement officials could request and obtain medical records in "exigent circumstances" if they were in hot pursuit of a suspect or a fugitive, or if they were simply trying to locate and identify a material witness. Some health care professionals are particularly queasy about this aspect of the bill, although the Justice Department has endorsed it.

Dr. E. Ratcliffe Anderson Jr., executive vice president of the American Medical Association, contends that the bill "implicitly deputizes physicians as law-enforcement officers," forcing doctors to violate their ethical duty to patients.

"We are alarmed," Anderson said. "The power that would be vested with law enforcement is nothing short of breathtaking."

John T. Bentivoglio, chief privacy officer at the Justice Department, said: "Our intent is not to deputize medical professionals as law-enforcement officers. But there are situations where we need medical information to investigate crimes and protect public safety. In those situations, we feel it's reasonable for law-enforcement officers to have the information we need."

Increasingly, health care is provided by large networks of doctors, hospitals, clinics, nursing homes, pharmacies and insurance companies that want to share certain types of information on patients.

Charles N. Kahn III, president of the Health Insurance Association of America, said: "We don't favor indiscriminate access to medical information. We use it only to enhance the quality of care and to prevent fraud and abuse."

Health plans routinely use the information in their files to contact women who need a mammogram or patients with a particular disease who could benefit from a new drug.

Health maintenance organizations have developed many techniques to detect fraud, to learn which treatments are most effective, to evaluate the work of individual doctors and to identify those who order too many tests and procedures.

Insurers and HMOs say it is totally impractical for them to request permission each time they want to use a patient's medical records. Under Jeffords' bill and similar measures pending in the House, a health insurance company could require a patient to sign one form authorizing all future use of the person's medical records for "treatment, payment and health care operations."

Each of those terms is broadly defined in a way that seems to codify current practices in the health care industry. "Treatment" includes risk assessment, disease management and the "coordination of health care or other services among health care providers and third parties authorized by the health plan." Likewise, "payment" includes all sorts of activities to determine whether a service is medically necessary.

"Health care operations" encompass almost everything for which a health plan might want to use a patient's medical records: "quality assessment and improvement activities," developing clinical guidelines, reviewing the competence of doctors and nurses, tracking variations in medical practice, auditing claims and setting premiums and insurance rates based on the medical history of an individual or a group.

In trying to pass a bill, Congress has come to an impasse on questions like these:

If the federal government sets standards, should states be allowed to go further and pass laws providing even more protection for the privacy of medical records? Insurers say no; they want uniform national standards because they continually send information across state lines. But consumer advocates hope states will pass stronger laws.

Should the government provide extra protection for records on particularly sensitive subjects like mental illness, HIV and AIDS and genetic test results?

Should parents be able to examine the medical records of their children? Opponents of abortion say yes; advocates of abortion rights say young women should not have to open such records to their parents. The bill, as it stands, says that the rights of minor children can be exercised by a parent or by the child, as provided under state law.

Should patients be able to sue anyone who improperly discloses their medical records? Should there be a limit on damages?

The bill would create a limited right to sue for certain intentional violations of a patient's privacy rights, but neither consumer advocates nor insurance companies like the proposed compromise.