[ Wednesday, April 17, 2002 ]
Are the proposed revisions to the Privacy Rule a reasonable accomodation to prevent restrictions on access to healthcare, or an invitation to the blatant invasion of the medical record privacy of every American?
The US Senate held hearings yesterday on the proposed revisions, with Democratic senators harshly critical and the administration pointing out that the revisions actually fix portions of the Privacy Rule that would hinder access to care. The New York Times reports on the situation
here.
There was much bloviating in the hearing (hey, Sen. Kennedy chairs the committee), and Kennedy stated that he'd introduce legislation to reinsert the consent requirements. But as the article points out, the gist of the issue is this: Terry McAuliffe, chairman of the DNC and chief Democratic fundraiser/strategist, conducted polls that indicated that privacy would resound with the voting public. The Democrats are jumping on this because they think this will give them an issue to use against Republicans and a popular Bush administration.
The problem addressed by the revisions is this: a covered entity can only
use or
disclose protected health information ("
PHI") for treatment, payment and healthcare operations ("
TPO") if the entity has a consent from the patient. There are some covered entities, such as specialist physicians, pharmacists, and others to whom a patient's physician might refer the patient, who need to use the information before they ever see the patient and have the opportunity to obtain a consent. Example: a primary care physician sees a patient (who signs a consent in the waiting room) and determines that the patient needs to see a cardiologist and needs a prescription. The PCP calls in the prescription to the pharmacy nearest the patient's house, and refers the patient to a cardiologist the PCP knows to be a good doctor. The PCP
used the patient's PHI as part of the treatment of the patient to determine these 2 things. The PCP also
disclosed the patient's PHI by sending the patient's chart to the cardiologist and phoning in the prescription. However, since neither the pharmacist nor the cardiologist has ever seen this patient, neither has had the chance to get a signed consent from the patient. So, the cardiologist can look at the chart, but can't even
think about a diagnosis for this patient or what types of tests he might want done. The pharmacist can't fill the prescription, either. That would be
using the information, and until each gets a consent from the patient, they can't
use or
disclose the information, even for TPO purposes. Stupid, right?
Of course. The proposed revisions to the Privacy Rule, no covered entity is required to get a consent to use PHI for TPO purposes,
but they are required to provide the patient with their Notice of Information Practices as soon as they see the patient and use their best efforts to get the patient to sign an acknowledgement of receipt of the Notice. That would allow the cardiologist and pharmacist to use the information they've received, so long as they provide their Notice to the patient when he arrives for treatment or to pick up the prescription. It's worth noting that this process would give the patient full disclosure of how the covered entity plans on using their information (if they see something they don't like in the notice, they could ask the provider to further restrict the use/disclosure of their PHI and, if the provider refuses, go to another provider), and it only allows the information to be used without consent for TPO purposes, which are the reasonably forseeable uses for the information. The covered entity can't sell the information to the National Enquirer or to Merck. And, the covered entity still must follow the ethical guidelines applicable to it; a physician is already ethically prevented from disclosing medical information about his or her patients to those without a need to know.
Does this "dismantle the medical privacy of American citizens," as Al Gore says? Does it "substantially weaken the privacy rules," as charged by Hillary Clinton? Of course not. Could the administration have fixed the problem with a less-wide-ranging solution? Probably. For example, the Privacy Rule could have been revised to allow a covered entity to use or disclose PHI that was properly provided to it without a consent until the first contact with the patient or until the covered entity had an opportunity otherwise to obtain a consent. Maybe only providers should be covered by this revision, or maybe the revision should only apply to uses and not disclosures (perhaps someone could enlighten me on why either of those would be unworkable).
I'd rather see the revisions pared back like that. But given the choice between the Privacy Rule as drafted in final form and as revised, the revised version is much more workable.
Also, the regulation-writers at HHS have always said that they do not consider providers to be the problem in wrongly disclosing information. They acknowledge that most hospitals and doctors do a fine job of protecting privacy. So if this isn't a big problem, should we shoot for a big solution? Maybe this is a corrolary to
Occam's Razor (Drummond's Razor?): When presented with a small or uncommon problem, go with the least-obtrusive solution.
Just get the government to do that. Sure.
Jeff [1:48 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
