[Med-privacy] Medical Privacy Eliminated by the Bush Administration from SF Medicine

[DPeelMD@aol.com]

--part1_167.229b7533.2c322538_boundary
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit

April 2003, San Francisco Medicine

Medical Privacy Eliminated by the Bush Administration 
Stephen J. Walsh, MD

"I will not divulge patient confidences, as reckoning that all such should be 
kept secret.... All that may come to my knowledge in the exercise of my 
profession...which ought not to be spread abroad, I will keep secret and will never 
reveal." 
-- Hippocrates 

"No provider of health care shall disclose medical information regarding a 
patient of the provider without first obtaining an authorization." 
-- California Civil Code 56.10(a) 

"The identification of a person as a patient must be protected with extreme 
care. A psychiatrist may release confidential information only with the 
authorization of the patient or under proper legal compulsion." 
-- AMA's Principles of Medical Ethics 

Most San Francisco physicians have by now learned more than they wanted to 
know about the HIPAA (Health Insurance Portability and Accountability Act of 
1996) Amended Privacy Rule and its many criminal penalties for "failure to 
comply" with numerous detailed regulations. Not as well known is that the Amended 
Privacy Rule (effective Oct. 15, 2002) strips away patients' fundamental right 
of consent for the use and disclosure of their personal identifiable medical 
information for most uses (treatment, payment, "health care operations" and 
"activities necessary for the appropriate oversight of the health care system"). 

That federal right of the patient to give or withhold consent for the use and 
disclosure of identifiable private medical information had been explicitly 
stated in the Original Privacy Rule in effect since April 2001. However, 
literally hundreds of thousands of "covered entities" (health plans, insurance 
companies, health care clearinghouses, care providers of all kinds, and many others) 
and their "business associates" (data processor analysts, benefit managers, 
lawyers and many others) have now been granted "regulatory permission" for 
access to private medical records without patients' consent. 

Additionally, in the name of "appropriate oversight of the health care 
system" many government agencies now have access to private medical records without 
judicial review or the consent of the patient. This assault on more than 2,000 
years of traditions of medical privacy, confidentiality and patient consent 
for information release is breathtaking in its scope and implications. It is a 
stunning example of legislation by regulation (by the U.S. Department of 
Health and Human Services) and the failure of Congress to grapple with complexity. 
That complexity should have involved preserving the confidentiality and 
patient-consent cornerstones of medical practice while legislating a federal "floor" 
of privacy protections for medical data, transmitted electronically. The 
"administrative simplification" called for in Congress's HIPAA law has become a 
nightmare of criminal penalties and complexity for doctors and patients. 

The Privacy Rule was supposed to improve citizens' medical privacy, but in 
fact did just the opposite regarding the most fundamental right of patients to 
control their personal medical information release for most uses. This damages 
patients' confidence and trust in physicians and in our medical care systems 
at a time when conflicts of interest in many treatment settings already are 
cause for concern. The Amended Privacy Rule benefits government, health care 
corporations, other organizations and business interests at the expense of 
precious individual privacy rights. Not even the privacy of private pay patients is 
protected from "regulatory permission" to access private records. 

The preamble to the Amended Privacy Rule tacitly acknowledges that the rule 
is out of step with medical ethics standards and many state laws. It states 
that the amendments "do not interfere with such laws and ethical standards." 
However, the failure to retain the right of consent in federal privacy protections 
will lead to confusion and more loss of trust by patients who will need to 
determine their rights under 50 state laws with medical information moving 
electronically around the country. Of further concern is genetic testing and other 
genetic information being included in medical records on a large and growing 
scale. Genetic and medical records stored in massive data banks are already 
being accessed to make business, credit, insurance, educational and employment 
decisions without knowledge or consent by patients. The HIPAA Privacy Rule 
amendments provide retroactive access to genetic and medical data from past records 
as well as from now forward.
Lack of privacy and confidentiality drives many patients away from getting 
the care they need. It also leads to less information disclosure by patients, 
leading to more difficulty with accurate diagnosis and quality care. Especially 
with psychiatric issues, people with thinking and feeling disorders, addictive 
disorders, abuse histories and the like know that disclosure of these beyond 
the doctor's office can cause job loss, financial ruin, intense shame, 
humiliation and other damage. Psychiatrists especially need the patient's trust so 
that private fantasies, thoughts, feelings and behaviors may be disclosed for 
effective diagnosis, psychotherapeutic work and medical treatments.

The Amended Privacy Act also gives "regulatory permission" for the release of 
medical information without patient consent for judicial and administrative 
proceedings, law enforcement criminal investigations, certain types of 
research, certain "specialized government functions" and several public health and 
safety reasons.

HHS's Original Privacy Rule recognized the right of consent with findings 
that were detailed, numerous and based on fundamental human rights and medical 
ethics throughout the history of this country. The Original Privacy Rule stated 
that "Privacy is a fundamental right. . .All 50 states today recognize in tort 
law a common law or statutory right to privacy. . .Few experiences are as 
fundamental to liberty and autonomy as maintaining control over when, how, to 
whom and where you disclose personal material. . .Many of the most basic 
protections in the Constitution of the United States are imbued with an attempt to 
protect individual privacy. . .The Supreme Court has upheld the constitutional 
protection of personal health information" (65 Fed. Reg. at 82, 464-65). And 
further, "Medical privacy . . . is also necessary for the effective delivery of 
health care, both to individuals and to populations . . . The entire health 
care system is built upon the willingness of individuals to share the most 
intimate details of their lives with their health care providers . . . Privacy is 
necessary to secure effective, high-quality treatment . . . Privacy violations 
reduce consumers' trust in the health care system and institutions that serve 
them.." (65 Fed. Reg. at 82, 467-68).

The American Medical Association's Code of Medical Ethics states that 
"Conflicts between a patient's right to privacy and a third party's need to know 
should be resolved in favor of the patient, except where that would result in 
serious health hazard or harm to the patient or others." 

Our California Medical Association also has an extensive body of policy 
directed toward protecting patient confidentiality and the privacy of medical 
records. In 1999, the CMA House of Delegates reaffirmed that "the patient's right 
to medical privacy and confidentiality in the treatment relationship are 
cornerstones of the patient's trust, successful medical information-gathering for 
accurate diagnosis and treatment, an effective physician-patient relationship, 
good medicine and quality care."

The Bush administration's Health and Human Services (HHS) Secretary Tommy 
Thompson's action to amend the Original Privacy Rule by stripping away patients' 
right of consent for use and disclosure of their medical information for most 
purposes is a sweeping abrogation of privacy rights. It reverses federal 
privacy law, eliminates the ability of individuals to limit or withhold their 
consent for the use and disclosure of personal medical information for most 
purposes, authorizes "covered entities" to use and disclose information even over the 
individual's objections, and erodes and undermines the privacy and trust 
necessary in the physician-patient relationship for quality health care to be 
provided. 

The Association of American Physicians and Surgeons has filed suit against 
HHS over these privacy rules on several grounds. The American Psychoanalytic 
Association is preparing a lawsuit to enjoin the implementation of provisions of 
HHS's privacy amendments that eliminate or jeopardize patients' right of 
consent and confer "regulatory permission" for covered entities to use and disclose 
identifiable health information without individuals' consent. 

CMA's House of Delegates in late March of this year will consider a 
resolution asking CMA to encourage federal legislation and to lobby with California's 
congressional delegation to restore legislatively patients' right of consent. 
The CMA House of Delegates will also consider whether or not to support legal 
challenges to HHS's amended Privacy Rule aimed at restoring patients' right of 
consent for medical information release. The issue is momentous for the future 
of our profession and the quality of care we can offer.

Although psychiatrists may be most immediately stunned and outraged by the 
Bush administration's amendments to the Privacy Rule, many other physicians will 
likely respond similarly when the full significance of these amendments is 
understood.
Dr. Walsh is a practicing psychiatrist in San Francisco and Mill Valley, a 
past president of the San Francisco Medical Society and current member of the 
delegation, editorial board and psychiatric services committee.
 

San Francisco Medicine is the award-winning publication of the San Francisco 
Medical Society.
http://www.sfms.org/sfm/sfm403k.htm
 

--part1_167.229b7533.2c322538_boundary
Content-Type: text/html; charset="US-ASCII"
Content-Transfer-Encoding: quoted-printable

<HTML><FONT FACE=3Darial,helvetica><FONT  SIZE=3D3 FAMILY=3D"SANSSERIF" FACE=
=3D"Arial" LANG=3D"0"><B>April 2003, San Francisco Medicine<BR>
</FONT><FONT  COLOR=3D"#000000" style=3D"BACKGROUND-COLOR: #ffffff" SIZE=3D2=
 FAMILY=3D"SANSSERIF" FACE=3D"Arial" LANG=3D"0"></B><BR>
</FONT><FONT  COLOR=3D"#000000" style=3D"BACKGROUND-COLOR: #ffffff" SIZE=3D4=
 FAMILY=3D"SANSSERIF" FACE=3D"Arial" LANG=3D"0"><B>Medical Privacy Eliminate=
d by the Bush Administration </B><BR>
<B>Stephen J. Walsh, MD</FONT><FONT  COLOR=3D"#000000" style=3D"BACKGROUND-C=
OLOR: #ffffff" SIZE=3D2 FAMILY=3D"SANSSERIF" FACE=3D"Arial" LANG=3D"0"></B><=
BR>
<BR>
</FONT><FONT  COLOR=3D"#000000" style=3D"BACKGROUND-COLOR: #ffffff" SIZE=3D3=
 FAMILY=3D"SANSSERIF" FACE=3D"Arial" LANG=3D"0">"I will not divulge patient=20=
confidences, as reckoning that all such should be kept secret.... All that m=
ay come to my knowledge in the exercise of my profession...which ought not t=
o be spread abroad, I will keep secret and will never reveal." <BR>
-- Hippocrates <BR>
<BR>
"No provider of health care shall disclose medical information regarding a p=
atient of the provider without first obtaining an authorization." <BR>
-- California Civil Code 56.10(a) <BR>
<BR>
"The identification of a person as a patient must be protected with extreme=20=
care. A psychiatrist may release confidential information only with the auth=
orization of the patient or under proper legal compulsion." <BR>
-- AMA's Principles of Medical Ethics <BR>
<BR>
Most San Francisco physicians have by now learned more than they wanted to k=
now about the HIPAA (Health Insurance Portability and Accountability Act of=20=
1996) Amended Privacy Rule and its many criminal penalties for "failure to c=
omply" with numerous detailed regulations. Not as well known is that the Ame=
nded Privacy Rule (effective Oct. 15, 2002) strips away patients' fundamenta=
l right of consent for the use and disclosure of their personal identifiable=
 medical information for most uses (treatment, payment, "health care operati=
ons" and "activities necessary for the appropriate oversight of the health c=
are system"). <BR>
<BR>
That federal right of the patient to give or withhold consent for the use an=
d disclosure of identifiable private medical information had been explicitly=
 stated in the Original Privacy Rule in effect since April 2001. However, li=
terally hundreds of thousands of "covered entities" (health plans, insurance=
 companies, health care clearinghouses, care providers of all kinds, and man=
y others) and their "business associates" (data processor analysts, benefit=20=
managers, lawyers and many others) have now been granted "regulatory permiss=
ion" for access to private medical records without patients' consent. <BR>
<BR>
Additionally, in the name of "appropriate oversight of the health care syste=
m" many government agencies now have access to private medical records witho=
ut judicial review or the consent of the patient. This assault on more than=20=
2,000 years of traditions of medical privacy, confidentiality and patient co=
nsent for information release is breathtaking in its scope and implications.=
 It is a stunning example of legislation by regulation (by the U.S. Departme=
nt of Health and Human Services) and the failure of Congress to grapple with=
 complexity. That complexity should have involved preserving the confidentia=
lity and patient-consent cornerstones of medical practice while legislating=20=
a federal "floor" of privacy protections for medical data, transmitted elect=
ronically. The "administrative simplification" called for in Congress's HIPA=
A law has become a nightmare of criminal penalties and complexity for doctor=
s and patients. <BR>
<BR>
The Privacy Rule was supposed to improve citizens' medical privacy, but in f=
act did just the opposite regarding the most fundamental right of patients t=
o control their personal medical information release for most uses. This dam=
ages patients' confidence and trust in physicians and in our medical care sy=
stems at a time when conflicts of interest in many treatment settings alread=
y are cause for concern. The Amended Privacy Rule benefits government, healt=
h care corporations, other organizations and business interests at the expen=
se of precious individual privacy rights. Not even the privacy of private pa=
y patients is protected from "regulatory permission" to access private recor=
ds. <BR>
<BR>
The preamble to the Amended Privacy Rule tacitly acknowledges that the rule=20=
is out of step with medical ethics standards and many state laws. It states=20=
that the amendments "do not interfere with such laws and ethical standards."=
 However, the failure to retain the right of consent in federal privacy prot=
ections will lead to confusion and more loss of trust by patients who will n=
eed to determine their rights under 50 state laws with medical information m=
oving electronically around the country. Of further concern is genetic testi=
ng and other genetic information being included in medical records on a larg=
e and growing scale. Genetic and medical records stored in massive data bank=
s are already being accessed to make business, credit, insurance, educationa=
l and employment decisions without knowledge or consent by patients. The HIP=
AA Privacy Rule amendments provide retroactive access to genetic and medical=
 data from past records as well as from now forward.<BR>
Lack of privacy and confidentiality drives many patients away from getting t=
he care they need. It also leads to less information disclosure by patients,=
 leading to more difficulty with accurate diagnosis and quality care. Especi=
ally with psychiatric issues, people with thinking and feeling disorders, ad=
dictive disorders, abuse histories and the like know that disclosure of thes=
e beyond the doctor's office can cause job loss, financial ruin, intense sha=
me, humiliation and other damage. Psychiatrists especially need the patient'=
s trust so that private fantasies, thoughts, feelings and behaviors may be d=
isclosed for effective diagnosis, psychotherapeutic work and medical treatme=
nts.<BR>
<BR>
The Amended Privacy Act also gives "regulatory permission" for the release o=
f medical information without patient consent for judicial and administrativ=
e proceedings, law enforcement criminal investigations, certain types of res=
earch, certain "specialized government functions" and several public health=20=
and safety reasons.<BR>
<BR>
HHS's Original Privacy Rule recognized the right of consent with findings th=
at were detailed, numerous and based on fundamental human rights and medical=
 ethics throughout the history of this country. The Original Privacy Rule st=
ated that "Privacy is a fundamental right. . .All 50 states today recognize=20=
in tort law a common law or statutory right to privacy. . .Few experiences a=
re as fundamental to liberty and autonomy as maintaining control over when,=20=
how, to whom and where you disclose personal material. . .Many of the most b=
asic protections in the Constitution of the United States are imbued with an=
 attempt to protect individual privacy. . .The Supreme Court has upheld the=20=
constitutional protection of personal health information" (65 Fed. Reg. at 8=
2, 464-65). And further, "Medical privacy . . . is also necessary for the ef=
fective delivery of health care, both to individuals and to populations . .=20=
. The entire health care system is built upon the willingness of individuals=
 to share the most intimate details of their lives with their health care pr=
oviders . . . Privacy is necessary to secure effective, high-quality treatme=
nt . . . Privacy violations reduce consumers' trust in the health care syste=
m and institutions that serve them.." (65 Fed. Reg. at 82, 467-68).<BR>
<BR>
The American Medical Association's Code of Medical Ethics states that "Confl=
icts between a patient's right to privacy and a third party's need to know s=
hould be resolved in favor of the patient, except where that would result in=
 serious health hazard or harm to the patient or others." <BR>
<BR>
Our California Medical Association also has an extensive body of policy dire=
cted toward protecting patient confidentiality and the privacy of medical re=
cords. In 1999, the CMA House of Delegates reaffirmed that "the patient's ri=
ght to medical privacy and confidentiality in the treatment relationship are=
 cornerstones of the patient's trust, successful medical information-gatheri=
ng for accurate diagnosis and treatment, an effective physician-patient rela=
tionship, good medicine and quality care."<BR>
<BR>
The Bush administration's Health and Human Services (HHS) Secretary Tommy Th=
ompson's action to amend the Original Privacy Rule by stripping away patient=
s' right of consent for use and disclosure of their medical information for=20=
most purposes is a sweeping abrogation of privacy rights. It reverses federa=
l privacy law, eliminates the ability of individuals to limit or withhold th=
eir consent for the use and disclosure of personal medical information for m=
ost purposes, authorizes "covered entities" to use and disclose information=20=
even over the individual's objections, and erodes and undermines the privacy=
 and trust necessary in the physician-patient relationship for quality healt=
h care to be provided. <BR>
<BR>
The Association of American Physicians and Surgeons has filed suit against H=
HS over these privacy rules on several grounds. The American Psychoanalytic=20=
Association is preparing a lawsuit to enjoin the implementation of provision=
s of HHS's privacy amendments that eliminate or jeopardize patients' right o=
f consent and confer "regulatory permission" for covered entities to use and=
 disclose identifiable health information without individuals' consent. <BR>
<BR>
CMA's House of Delegates in late March of this year will consider a resoluti=
on asking CMA to encourage federal legislation and to lobby with California'=
s congressional delegation to restore legislatively patients' right of conse=
nt. The CMA House of Delegates will also consider whether or not to support=20=
legal challenges to HHS's amended Privacy Rule aimed at restoring patients'=20=
right of consent for medical information release. The issue is momentous for=
 the future of our profession and the quality of care we can offer.<BR>
<BR>
Although psychiatrists may be most immediately stunned and outraged by the B=
ush administration's amendments to the Privacy Rule, many other physicians w=
ill likely respond similarly when the full significance of these amendments=20=
is understood.<BR>
Dr. Walsh is a practicing psychiatrist in San Francisco and Mill Valley, a p=
ast president of the San Francisco Medical Society and current member of the=
 delegation, editorial board and psychiatric services committee.<BR>
 <BR>
<BR>
<B><U>San Francisco Medicine</B></U> is the award-winning publication of the=
 San Francisco Medical Society.<BR>
http://www.sfms.org/sfm/sfm403k.htm<BR>
 <BR>
</FONT></HTML>
--part1_167.229b7533.2c322538_boundary--