[ Sunday, April 25, 2021 ]
Chapter 5: Bush v. Gore, and
the Dynamics of Regulatory Timing.
You’re not going to believe
this, but at the end of 2000, most Americans thought we had just seen the craziest, most
ridiculous election we were ever going to see.
What could get crazier than this?
It started election night. I was very much a political junkie then, and
was only mildly surprised when the networks called Florida for Gore pretty much
as soon as the polls closed in the eastern time zone; the Republican-leaning
panhandle counties in the central time zone were still voting, and Bush was
leading in early returns, but the networks still called it for Gore. Exit polling was pretty trusted at that point
in time, and early returns tended to count places where conservatives would do
better. But as the Bush lead persisted,
the networks began to report that the Bush team was livid that the networks
were calling it (especially before the Panhandle counties had closed their
polls.
Eventually the networks put
Florida back in the undecided column, as state by state fell aside and it
became clear that the election was a dead heat, and Florida’s electoral votes
would be the tiebreaker. Tim Russert’s
whiteboard ended up with just one word: “Florida.” Al Gore conceded, then un-conceded. I went to
bed around 4 am; my wife woke up, asked who won, and I said, “we don’t know.”
You know how it turned out:
Bush won the vote, Gore challenged, a recount occurred, Bush still won, Gore sued
to force a re-recount, and Bush won at the Supreme Court, thus confirming that
a Republican would be replacing a Democrat in the White House. Thus, the Clinton Administration spent its
last month knowing that there would be a change in the administrative agencies,
not a continuation of the same policies.
That’s important, because the
Clinton Administration went all in to push through any regulations that were in
the work, not matter how half-baked, in order to try to tie up the conservative
administration with enforcing liberal rules, at least until they could change
them back. Other administrations had
done similar things, but nothing nearly at this scale. One of those regulations was the Privacy Rule.
The Privacy Rule had been
proposed already on November 3, 1999 (the Security Rule was originally proposed
in 1998), and tens of thousands of comments had been received. On December 28, 2000, with just over 3 weeks
left in the Clinton Administration, probably about the time some staffers
started thinking about prying the “w” key off of the keyboards in the White House,
the Privacy Rule was published in final form.
What do you expect a new
administration to do, entering office in such hostility and faced with this
avalanche of regulations? They did what
subsequent administrations have done: put all recently-passed regulations on
hold for further 60 days to allow for further regulatory review. In February of 2001 the regulations were
re-opened for comments, and in March and August of 2002 they were re-issued,
with the April 2003 effective date remaining in place.
The result was a
slightly-revised Privacy Rule; the only major change was removal of the
requirement to obtain signed consent prior to using PHI for permitted purposes
(treatment, payment, and health care operations).
This was greeted with
predictable, and predictably dumb, howls from the likes of Ted Kennedy and
Hillary Clinton, decrying how this would weaken patient privacy. Actually, it does nothing of the sort, and in
fact eliminates a pretty dumb requirement that would do absolutely no good but
would hinder effective healthcare. But it’s
a useful reference: when you hear complaints from extreme partisans, take them
with a grain of salt.
As drafted in the Clinton
regulations, no healthcare provider could use PHI until it had the consent of
the patient. Seems reasonable, until you
think about how healthcare providers use PHI.
This seems reasonable: you go to your primary care doctor and sign a
consent before he sees you; okay, that is reasonable. But let’s say your PCP determines that you have
a very serious condition, and urgently need a particular prescription drug, and
need to see a specialist that afternoon.
He sends a prescription to a pharmacy, and sends your medical record to
the specialist he’s referring you to. So
far, so good. You drive to the pharmacy
to pick up the drug, but it’s not ready.
Why not? The pharmacist could not
even look at the prescription and begin filling it until you arrive and sign an
authorization. Why? Reading and working on your prescription is a “use”
of your PHI, and he can’t get started until you sign a consent. You get to the specialist, but he hasn’t even
LOOKED at your medical records yet.
Why? Reading your chart and
thinking about what you need would be a “use” of your PHI, and can’t be done
until you sign a consent. Under the
revised rules, your prescription is ready and your specialist is prepared to
treat you immediately.
And the provider (i) is STILL
prohibited from using or disclosing PHI other than for permitted purposes, and
(ii) must give the patient a Notice of Privacy Practices (“NoPP”) that outlines
what the provider may and may not do; if it’s a use or disclosure that is
permitted under HIPAA but not described in the NoPP, the provider needs consent;
if it’s a use or disclosure not permitted under HIPAA, the provider needs an
authorization.
One other unintended
consequence unseen by Ted and Hillary: under the original rule, the provider
could refuse to treat the patient unless the patient signed the consent; under
the revised rule, the provider must give the NoPP to the patient as soon as
possible and try to get a signature, but if the patient refuses to sign the
NoPP, the provider cannot refuse to provide the patient with care. Thus, under the old rules, the provider could
add provisions into the consent to provide additional protections to the
provider (and to the detriment of the patient), making the consent a contract
of adhesion: if you want my services, you have to give me what I want. Bush’s rules are a real improvement for
patients, as well as for providers.
The pushing of the regulations,
the retraction of them, and the reaction to the revisions all highlight the
torturous path the Privacy Rule took to get where it is. Yes, it’s somewhat of
a Frankenstein’s monster, cobbled together from parts. But 20 years on, it’s actually a very
workable bit of regulatory machinery.
For a long time after I started
giving lectures and presenting at seminars about HIPAA, I always tried to
explain the machinations surrounding the issuance of the Privacy Rule by asking
attendees to “harken back to December 2000; remember what was going on
then?” Seems kinda quaint now, doesn’t
it?
Jeff [1:40 PM]
http://www.blogger.com/template-edit.g?blogID=3380636
Blogger: HIPAA Blog - Edit your Template
