[ Sunday, April 25, 2021 ]


 Chapter 5: Bush v. Gore, and the Dynamics of Regulatory Timing.

You’re not going to believe this, but at the end of 2000, most Americans thought we had just seen the craziest, most ridiculous election we were ever going to see.  What could get crazier than this? 

It started election night.  I was very much a political junkie then, and was only mildly surprised when the networks called Florida for Gore pretty much as soon as the polls closed in the eastern time zone; the Republican-leaning panhandle counties in the central time zone were still voting, and Bush was leading in early returns, but the networks still called it for Gore.  Exit polling was pretty trusted at that point in time, and early returns tended to count places where conservatives would do better.  But as the Bush lead persisted, the networks began to report that the Bush team was livid that the networks were calling it (especially before the Panhandle counties had closed their polls. 

Eventually the networks put Florida back in the undecided column, as state by state fell aside and it became clear that the election was a dead heat, and Florida’s electoral votes would be the tiebreaker.  Tim Russert’s whiteboard ended up with just one word: “Florida.”  Al Gore conceded, then un-conceded. I went to bed around 4 am; my wife woke up, asked who won, and I said, “we don’t know.” 

You know how it turned out: Bush won the vote, Gore challenged, a recount occurred, Bush still won, Gore sued to force a re-recount, and Bush won at the Supreme Court, thus confirming that a Republican would be replacing a Democrat in the White House.  Thus, the Clinton Administration spent its last month knowing that there would be a change in the administrative agencies, not a continuation of the same policies.

That’s important, because the Clinton Administration went all in to push through any regulations that were in the work, not matter how half-baked, in order to try to tie up the conservative administration with enforcing liberal rules, at least until they could change them back.  Other administrations had done similar things, but nothing nearly at this scale.  One of those regulations was the Privacy Rule.

The Privacy Rule had been proposed already on November 3, 1999 (the Security Rule was originally proposed in 1998), and tens of thousands of comments had been received.  On December 28, 2000, with just over 3 weeks left in the Clinton Administration, probably about the time some staffers started thinking about prying the “w” key off of the keyboards in the White House, the Privacy Rule was published in final form.

What do you expect a new administration to do, entering office in such hostility and faced with this avalanche of regulations?  They did what subsequent administrations have done: put all recently-passed regulations on hold for further 60 days to allow for further regulatory review.  In February of 2001 the regulations were re-opened for comments, and in March and August of 2002 they were re-issued, with the April 2003 effective date remaining in place.

The result was a slightly-revised Privacy Rule; the only major change was removal of the requirement to obtain signed consent prior to using PHI for permitted purposes (treatment, payment, and health care operations).

This was greeted with predictable, and predictably dumb, howls from the likes of Ted Kennedy and Hillary Clinton, decrying how this would weaken patient privacy.  Actually, it does nothing of the sort, and in fact eliminates a pretty dumb requirement that would do absolutely no good but would hinder effective healthcare.  But it’s a useful reference: when you hear complaints from extreme partisans, take them with a grain of salt.

As drafted in the Clinton regulations, no healthcare provider could use PHI until it had the consent of the patient.  Seems reasonable, until you think about how healthcare providers use PHI.  This seems reasonable: you go to your primary care doctor and sign a consent before he sees you; okay, that is reasonable.  But let’s say your PCP determines that you have a very serious condition, and urgently need a particular prescription drug, and need to see a specialist that afternoon.  He sends a prescription to a pharmacy, and sends your medical record to the specialist he’s referring you to.  So far, so good.  You drive to the pharmacy to pick up the drug, but it’s not ready.  Why not?  The pharmacist could not even look at the prescription and begin filling it until you arrive and sign an authorization.  Why?  Reading and working on your prescription is a “use” of your PHI, and he can’t get started until you sign a consent.  You get to the specialist, but he hasn’t even LOOKED at your medical records yet.  Why?  Reading your chart and thinking about what you need would be a “use” of your PHI, and can’t be done until you sign a consent.  Under the revised rules, your prescription is ready and your specialist is prepared to treat you immediately. 

And the provider (i) is STILL prohibited from using or disclosing PHI other than for permitted purposes, and (ii) must give the patient a Notice of Privacy Practices (“NoPP”) that outlines what the provider may and may not do; if it’s a use or disclosure that is permitted under HIPAA but not described in the NoPP, the provider needs consent; if it’s a use or disclosure not permitted under HIPAA, the provider needs an authorization.

One other unintended consequence unseen by Ted and Hillary: under the original rule, the provider could refuse to treat the patient unless the patient signed the consent; under the revised rule, the provider must give the NoPP to the patient as soon as possible and try to get a signature, but if the patient refuses to sign the NoPP, the provider cannot refuse to provide the patient with care.  Thus, under the old rules, the provider could add provisions into the consent to provide additional protections to the provider (and to the detriment of the patient), making the consent a contract of adhesion: if you want my services, you have to give me what I want.  Bush’s rules are a real improvement for patients, as well as for providers. 

The pushing of the regulations, the retraction of them, and the reaction to the revisions all highlight the torturous path the Privacy Rule took to get where it is. Yes, it’s somewhat of a Frankenstein’s monster, cobbled together from parts.  But 20 years on, it’s actually a very workable bit of regulatory machinery.

For a long time after I started giving lectures and presenting at seminars about HIPAA, I always tried to explain the machinations surrounding the issuance of the Privacy Rule by asking attendees to “harken back to December 2000; remember what was going on then?”  Seems kinda quaint now, doesn’t it?

Jeff [1:40 PM]

Comments: Post a Comment
http://www.blogger.com/template-edit.g?blogID=3380636 Blogger: HIPAA Blog - Edit your Template