[Med-privacy] Health Privacy Project comments

Wed, 09 Jul 2003 14:05:53 -0700

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
 <meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1">
 <title></title>
</head>
<body>
On Monday, June 16, 2003 the Health Privacy Project filed comments
on the Interim Final Rule on Civil Monetary Penalties for HIPAA. 
The full text of HPP&#8217;s comments is available at HPP&#8217;s <a class=""
 href="http://www.healthprivacy.org/info-url_nocat2303/info-url_nocat_show.htm?doc_id=177312"
 target="">website</a>. 
 
[....]
The Health Privacy Project&#8217;s comments emphasized two points.&nbsp; First,
HPP is concerned with the Secretary of Health and Human Services'
general approach to enforcement of the privacy rules, which is to
primarily respond to complaints about possible violations of the rules
instead of actively monitoring entities covered by the rules to ensure
compliance.&nbsp; In our comments we are asking for the routine monitoring
of covered entities for compliance, for an annual report by HHS
accounting for enforcement activities and for better education of the
public regarding its rights, if HHS is to rely on the public's
complaints for enforcement.&nbsp; Second, HPP is also very concerned by the
absence in this interim final rule of any role in the enforcement
process for the individual whose privacy was violated by the unlawful
use or disclosure of his or her sensitive medical information.&nbsp; Under
HIPAA, consumers do not have a private right of action; instead the
Secretary of Health and Human Services can initiate an investigation
and enforcement process.&nbsp; We suggest ways in which the role of the
individual harmed can be strengthened in the enforcement proceedings,
including notification of the individual and acceptance of testimony or
written statements by the individual in the proceedings.
</body>
</html>