S.1360 mark-up postponed

[jlg@cdt.org (Janlori Goldman)]

  Mark-up of Medical Privacy Bill Postponed for May 1
  
  The mark-up of The Medical Records Confidentiality Act (S.1360), originally
  scheduled for April 24, has been postponed by the Senate Labor and Human
  Resources Committee until May 1. The Committee has delayed action on S.1360
  (also known as the Bennett-Leahy bill after its chief sponsors) to give the
  pharmaceutical industry and health data companies an opportunity to express
  their concerns about the privacy provisions in the bill. Following
  recommendations from CDT and other privacy and consumer groups seeking to
  strengthen the bill, a new version of S.1360 was drafted by Senators Nancy
  Kassebaum (R-KA) and Edward Kennedy (D-MA).  The new version was released
  April 10. 
  
  CDT opposes any weakening of the current version of S.1360.  CDT is
  organizing a letter of support for the Bennett-Leahy bill, to be signed by
  a wide variety of consumer, privacy and patient advocates, as well as
  health care providers, researchers, employers, and information technology
  companies.
  
  CDT believes that the new version is significantly stronger.The revised
  Bennett-Leahy bill incorporates many of the key changes 
  recommended by CDT  and members of a 
  CDT-led coalition, including AIDS Action Council, the Legal Action Center, 
  the Center for Patients' Rights, IBM, AARP, the American Hospital 
  Association, and the Association of Academic Health Centers. In addition, the
  bill includes revisions suggested by Public Citizen, the Coalition for 
  Patient's Rights, the ACLU, and EPIC.
  
  In its current form, CDT believes that S.1360 is an extremely strong and 
  enforceable medical privacy bill, which would give people the right to see
  their own records, prohibit disclosures of most personal medical data without
  the patient's consent, and bring heavy criminal and civil penalties to bear 
  on those who violate the law. The revised S.1360, like its predecessor, is 
  more stringent than any medical records privacy law currently on the books at
  either the state or federal level. If passed, the Bennett-Leahy bill will 
  give people the greatest degree of control over the use and disclosure of 
  their personal medical data. CDT hopes that the Senate Labor Committee will 
  unanimously approve the amended S.1360.
  
  Significant changes to S. 1360 include:
  
   o  A new section has been added to S.1360 that lays out the principles 
  underlying the bill, including that people have a right of confidentiality 
  in their medical records that is being eroded, and that such erosion may 
  jeopardize the quality of health care by reducing peoples' willingness to 
  confide in their doctors.
  
   o  The revised S.1360 narrows instances under which protected health 
  information may be disclosed without the individual's consent. Under S.1360 
  as introduced, a number of disclosures of personal health information were 
  allowed without the individual's consent, such as to researchers and for 
  the purpose of creating nonidentifiable data. Both of these exceptions to 
  consent have been eliminated. S.1360 now requires researchers who want 
  access to identifiable data to get the record subject's consent, unless 
  they can meet a waiver standard already in place for federally funded 
  researchers.  
  
   o  The revised S.1360 removes "health information services" from being 
  treated as trustees, and now only allows them to receive personal health 
  information with an individual's consent. Now, trustees, such as doctors, 
  hospitals, and insurance companies, must anonymize personal health 
  information prior to disclosing it to health information services, such as 
  EDS or Equifax. A health information service may only strip the identifiers 
  if they are under the control of a trustee as an employee or contractor. 
  This change is a major improvement in the bill, which will significantly 
  limit the number of people who get access to sensitive medical data. 
  Overall, the bill creates a big incentive to use health data in 
  nonidentifiable form. 
  
   o  S.1360 now includes a higher "clear and convincing evidence" standard 
  that law enforcement must meet before a warrant can be issued for access to 
  personal medical information.
  
   o  S.1360 has now been narrowed by clarifying that insider access to medical 
  records must be limited. The bill now states explicitly that internal 
  disclosures of personal health information must be compatible with and 
  directly related to the purposes for which the information was collected.
  
  
  Janlori Goldman, Deputy Director, Center for Democracy and Technology 
  1634 Eye Street, Suite 1100, Washington, D.C. 20006  
  jlg@cdt.org, phone (202) 637-9800, fax (202) 637-0968