[ Wednesday, March 23, 2005 ]
Inquiring Minds (would that there were some): The Philadelphia Inquirer has a mind-numbingly
STUPID editorial on the Citizens for Health case James Pyles has argued before the Third Circuit. In the case, which Jim lost at the district court level, Jim's clients argue that HHS abused its discretion when it took out the consent requirement and allowed uses and disclosures for treatment, payment, and healthcare operations ("TPO") without requiring consent from the individual,
as long as the use or disclosure in question is outlined in the Notice of Privacy Practices ("NoPP") handed out by the provider. As originally drafted in the regulations published around Christmas of 2000 (as one of the "last great acts of regulatory defiance" by the dead-enders of the Clinton administration -- remember December 2000, when the US Supreme Court was deciding Bush v. Gore?), the regulations required either a consent (for TPO uses/disclosures) or an authorization (for other uses/disclosures). But as drafted, a primary care doctor could send your chart to a specialist, but the specialist could not review it, at least not until you went to the specialist and signed a consent for him to view it; actually, I guess the specialist could look at the chart, but couldn't think about what he saw, since that would be a "use" of the PHI in the chart without your consent. Likewise, a hospital could not schedule you for a procedure until you showed up and signed their consent; a pharmacy could not fill your prescription until you went to the pharmacy and signed a consent; you get the idea. You would fall into a "dead zone" where nobody could use your information in a way you'd be expecting until you showed up and checked the box to allow them to start. Very inefficient.
The Bush administration, then a few months old, did revise the regulations before they even became final, much less effective. There are a couple of reasons for that. First, the regulations had to be published for 60 days before they became "final," then they were not going to become effective for 2 years. Secondly, the Clintons were supposed to deliver a copy of the regulations to the Congress before the 60-day clock started ticking; they didn't do so, so the clock didn't even start ticking until the Bush administration delivered them; even then, because the Clinton dead-enders had published thousands of pages of regulations in the final hours (they sure were pr0lific at the end, what with all the last-minute pardons and all; it's surprising they had time to take all that furniture) in an obvious effort to harm and embarrass the incoming administration by saddling it with unworkable regulations, the Bush administration put a hold on all the late regulations until it could review them and determine which ones were keepers and which were bad policies.
The revisions put in place by the Bushies eliminated the dead-zone problem by stating that, if the original primary care doctor informed the patient in his NoPP that we would do so, the primary care doctor could send the information to the pharmacy, a specialist, or a hospital, and those providers could read and fill the prescription, review the chart and prepare for a visit, or prepare for a procedure. In each case, however, the patient would have to be provided with the NoPP from the pharmacy, specialist, or hospital once they arrived.
Now, presumably, a consent would contain the same things the NoPP contains. So what's the difference? Under the revised Bush rules, things happen first and the paperwork gets done when its convenient. Under the rules originally drafted by the Clintons, nothing happens until you sign the consent, so it's hurry up and wait.
Ultimately, I think Jim Pyles will lose again at the Circuit Court level; I suspect he'll appeal to the US Supreme Court, and I think they'll deny cert. And I think that's the right result.
But it doesn't help that the Philadelphia Inquirer publishes such a moronic, uneducated editorial. It does, however, provide me with an opportunity to Fisk it.
The Inquirer asks: "
How can any regulation be called a "privacy rule" when it permits sharing Americans' most personal medical information with 800,000 or so health, business and government entities?" How about "when it doesn't"? Unless each and every one of those 800,000 entities are involved in the treatment of the individual, the privacy rule does not permit sharing it. The privacy rule permits disclosure to other entities for treatment, payment, or "healthcare operations" (about which more later); if the disclosure to the other entity is for payment or healthcare operations purposes, the disclosure must be limited to the minimum necessary to allow the intended payment or healthcare operations. Additionally, the physician or other entity sharing the information must have provided the individual with a listing of expected uses and disclosures in the NoPP, and the use or disclosure must be on the list. So, the only disclosures allowed without an authorization by the patient are disclosures for that person's treatment, disclosures of the minimum amount needed for so the provider can get paid by the patient's insurance, or disclosures of the minimum amount needed to accomplish the healthcare operation. There is no person for whom such disclosures would result in 800,000 recipients.
The Inquirer next asks, "
How can they be open about their medical needs if traditional doctor-patient confidentiality has been eroded?" Their confidentiality hasn't been eroded; confidence in that confidentiality might be eroded by false, misleading, and incendiary editorials like this one, though.
The Inquirer says there's a wild west flea market in medical information out there because of "
the Bush administration rule change two years ago did an about-face on a Clinton-era policy that had required patients' consent before their medical data could be shared." First of all, the Bush Administration changed the rule 4 years ago; it went into effect 2 years ago. Secondly, the Bushies change was a slight change in direction from express consent to implied consent. Under the rule as drafted by the Clintons, your provider would give you a consent to sign that told you how your information was going to be used; if you disagreed with it and didn't sign, your provider would show you the door, and you'd have to find someone else to care for you. Under the revised rule, your provider gives you a NoPP that tells you how your information is going to be used. If you disagree with it, you show yourself the door and find someone else to care for you. There's a little difference in direction there, but certainly not an "about face." Finally, as stated above, there was no "Clinton-era policy." Even though they drafted it, because of when they published it, the earliest it could have possibly become a "policy" was one month into the Bush administration; since they didn't deliver a copy to the Congress (it was the Bushies that did that, by the way; the Clintons were long gone by the time their mistake was uncovered), it wasn't until April of 2001 that it became "final" in that form.
The Inquirer editorialist goes on: "
Trouble is, the rule tips the balance against patients' reasonable expectation that private information won't be shared too widely." Really? Do you not reasonably expect your doctor is going to give your medical information to the specialist she refers you to, or to the insurance company who is paying for your care? Especially after you've seen the NoPP that says exactly that? What is your reasonable expectation, once you've read the NoPP?
Of course, I'm talking about treatment and payment, but what about the dreaded "healthcare operations," which the Inquirer calls the "catch-all"? "
For instance," the Inquirer notes, "
the "health care operations" wording would permit the use of pharmacy mailing lists for certain direct marketing to consumers. Employers and even prospective buyers of a managed-care insurer could gain access to health data, too. Not much private about that." Wrong again. Healthcare operations are specifically defined, and include quality assessment and assurance activities, credentialing of providers, fraud and abuse detection and compliance programs, and internal business planning, development, management, and administration. Marketing is separately defined, and is excluded from "health care operations." Therefore, the definition of "health care operations" would NOT permit using mailing lists for direct marketing or any other use of information for marketing purposes, with very limited exceptions. Employers DO NOT have access to health data under "health care operations" (and obviously don't have access for treatment purposes, and don't have access for payment purposes unless the employer -- and NOT the insurance plan set up by the employer -- is directly paying for the care, and even then the minimum necessary rules apply). Additionally, for all "health care operations" disclosures, the minimum necessary rules apply. Furthermore, any "health care operations" disclosures must be consistent with the NoPP, which is provided to the individual; if the individual doesn't want a particular disclosure outlined in the NoPP to be made, he or she can ask for a restriction on the disclosure, and if the provider refuses, go elsewhere for care (which is
exactly what would happen if consents were still required).
The Inquirer goes on: "
While HIPPA lets patients examine their medical records, it grants them few ways to track how their information is shared." Actually, with its "accounting for disclosures" requirement, it grants them a great many more ways to track how their information is shared than existed before HIPAA. Sure, there are big exceptions to the accounting requirement, which conceptually include any disclosure that the patient knows or should know will be made, such as disclosures to payment sources or to other providers involved in the treatment of the individual. As it is, the American Hospital Association has already noted how great a burden the existing "accounting" requirement is. Increasing it would substantially increase the cost of health care by diverting employee resources to tracking disclosures that the patient should expect.
"
Were the right to consent restored, that would force health-care providers, insurers and others to reveal how medical information would be used in exchange for getting patients' consent." Bull. First, HIPAA already requires providers and insurers to provide individuals with a NoPP which tells them how their medical information would be used. Individuals already get that information. If a consent were required, the same information would be provided to the individuals, and they would get no care and no payment for care until they signed the consent. All that the consent requirement would do is slow down the process and prevent pharmacies and specialists from preparing to provide services to the individual.
"
At a time when some employers are sniffing for tobacco on job candidates' clothing, citizens need to be more concerned - and empowered - about who gets to flip through their medical files. Medical data should be used to treat and track illness, not screen applicants." HIPAA does not allow employers to flip through medical files to screen job applicants. It explicitly prohibits a doctor from providing PHI to an employer for this purpose. This is sheer stupidity on the part of the Inquirer's editorialist.
"
There's even more reason for concern about safeguarding health information, given the recent lapses with computerized databases. Just ask the 145,000 citizens whose financial and personal data was leaked by databank ChoicePoint Inc. to scam artists." ChoicePoint wasn't covered by HIPAA; including a consent requirement would have made absolutely no difference in what happened to ChoicePoint. If the evil Bush administration had not deleted the consent requirement, ChoicePoint would have still happened, and the same personal data would have been leaked out. Want to blame this on Columbine and the NRA, too? It's as much a non sequitur.
Other than that, of course, the editorial was just spot on.
Boy, was that a waste of time, or what?
Jeff [3:14 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
