[Med-privacy] "Privacy Complaints Reflect Misunderstandings of Rule -- HHS"
pmarshall
pwm@comcast.net
Mon, 29 Sep 2003 11:59:19 +0000
This is a multi-part message in MIME format.
--------------030808010303060803090208
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html;charset=3DUTF-8"=
>
<title></title>
</head>
<body>
<!-- Thin Header 100%width --><!-- HEADER -->
<table width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" border=3D"0">
<tbody>
<tr valign=3D"top">
<td width=3D"1%"><br>
</td>
<td width=3D"98%" bgcolor=3D"#557799"><img
src=3D"cid:part1.04060909.08060803@comcast.net" alt=3D"" width=3D"100"
height=3D"24"></td>
<td width=3D"1%" align=3D"right" nowrap=3D"nowrap"><br>
</td>
</tr>
</tbody>
</table>
<!-- HEADER --><!-- /Thin Header 100%width -->
<div><img src=3D"cid:part1.04060909.08060803@comcast.net" alt=3D"" width=3D=
"1"
height=3D"25"></div>
<table width=3D"100%">
<tbody>
<tr valign=3D"top">
<td>
<hr noshade=3D"noshade" size=3D"1"><br>
<br>
<!-- DISPLAY Image--> <img
src=3D"cid:part3.04030205.04090902@comcast.net" auto-height-width=3D"tru=
e"
alt=3D"Publication Logo" border=3D"0" vspace=3D"3"><!-- /DISPLAY Image -=
->
<div class=3D"title">Privacy Complaints Reflect Misunderstandings
of Rule -- HHS</div>
<br>
<!-- POST TITLE --> =09
<div class=3D"text12"> <!-- If AUTHOR --> <b>Cathy Tokarsk=
i</b>=09
<!-- /If AUTHOR --> =09
<p>Medscape Medical News 2003. =C2=A9 2003 Medscape <br>
</p>
</div>
<p><!-- /POST TITLE --> </p>
<div class=3D"text12"><!-- Main Table -->
<p>Sept. 16, 2003 (Baltimore) =E2=80=94 In the five months since th=
e new
federal rule to protect the privacy of patients' health information
took effect, complaints about suspected violations have centered mostly
on individual interactions between a patient and a healthcare provider,
a high-level government attorney said today. </p>
<p>In addition, reflecting the general confusion surrounding the
implementation of the Health Insurance Portability and Accountability
Act (HIPAA), the sweeping law that includes the privacy rule, many of
the complaints reflect a misunderstanding of how the privacy rule is
intended to work in the day-to-day world of patient care. </p>
<p>The Office of Civil Rights (OCR), an arm of the U.S.
Department of Health and Human Services, has received more than 1,800
complaints of potential violations of the privacy rule since Apr. 14,
2003, said Susan McAndrew, senior advisor for HIPAA privacy policy at
OCR. "It is by and large the provider-patient interaction where most of
the complaints" have originated, she said. McAndrew spoke today at the
Seventh Annual HIPAA Summit.</p>
<p>Nearly 30% of those complaints has already been closed by OCR,
however, because the alleged incident took place before the privacy rule
took effect, she said. Others have been dismissed because the
activities that prompted the complaint did not involve "covered
entities" (physicians, hospitals, health plans or other organizations
that handle patients' personal health information) and are therefore not
bound to comply with the privacy rule. </p>
<p>Another category of complaints that has been closed by OCR
centered on activities that the privacy rule does not prohibit. For
example, McAndrews described one complaint against a hospital that
refused to use its facility directory to tell relatives and friends
whether a patient had been admitted. Because such disclosures are
permitted, but not required, under the privacy rule, failure to
disclose that information does not constitute a violation of the rules,
she said. Such complaints, even those that are quickly closed, are
serving a useful purpose, she noted. "This is one of a number of
sources to find out where the misconceptions are and how we can fix
that problem without having to make thousands of calls to hospitals,"
she said. OCR is updating its "frequently asked questions" section of
its Web site, <a href=3D"http://www.hhs.gov/ocr/hipaa">http://www.hhs.gov=
/ocr/hipaa</a>.</p>
<p>Outside of cases that have been closed by OCR, a "very broad
category" of complaints has been filed by individuals against providers
and health plans over the release of their medical information,
according to McAndrew. Covered entities are permitted under the privacy
law to release relevant portions of a patient's medical information for
payment, treatment, and healthcare operations. But entities that
"knowingly" disclose that information outside of those permitted areas
could face criminal sanctions. </p>
<p>Another category of complaints is suspected violations of the
rule's requirement to provide "reasonable and appropriate" safeguards
of an individual's protected health information. "A lot of this occurs
in the context of doctor's waiting areas [and] pharmacy waiting
areas...where individuals don't feel their information is adequately
protected," she said. </p>
<p>As it has stated in the past, OCR is committed to pursuing a
voluntary compliance approach and will use its staff to provide
technical assistance to help covered entities correct violations. OCR
has the authority to levy civil monetary penalties that range from $100
per violation to up to $25,000 per violation per year. "There is good
incentive to be responsive if you get a phone call from OCR," McAndrews
said. Cases that could be liable for criminal prosecution will be
referred to the Department of Justice. </p>
<p>Despite the complaints, which McAndrew described as "about the
level we were expecting," responses from the covered entities in
question have been satisfactory, she said. "Everyone seems to be
anxious to do the right thing. This is still a new rule, and it's a
complicated rule. Everybody's intent is to help people get this right."<=
/p>
<p>Seventh Annual HIPAA Summit. Presented Sept. 16, 2003.</p>
<p><i>Reviewed by Gary D. Vogin, MD</i></p>
<!-- /Main Table --> </div>
<p> </p>
<hr noshade=3D"noshade" size=3D"1"> </td>
</tr>
</tbody>
</table>
</body>
</html>
--------------030808010303060803090208
Content-Type: image/gif;
name="spacer.gif"
Content-Transfer-Encoding: base64
Content-ID: <part1.04060909.08060803@comcast.net>
Content-Disposition: inline;
filename="spacer.gif"
R0lGODlhAQABAIAAAAAAAAAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==
--------------030808010303060803090208
Content-Type: image/gif;
name="logo-medscape-mednews-3-d.gif"
Content-Transfer-Encoding: base64
Content-ID: <part3.04030205.04090902@comcast.net>
Content-Disposition: inline;
filename="logo-medscape-mednews-3-d.gif"
R0lGODlhhQAoANUAAP///wBtqa+vr8LCwtbW1j+Rvn+21D8/P7/a6X9/f+/2+uvr6w92rubm
5r+/v1+jyc/Pz5/I3y+IuZ+fn8/k7wAAAA8PD0+axK/R5F9fXx9/s2+tzu/v7x8fH29vb9/f
34+Pj4+/2d/t9MPDw76+vrS0tC8vL09PT/Dw8Pr6+tzc3NfX1/X19djY2Lm5ufz8/AAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAAAAAAALAAA
AACFACgAAAb/QIBwSCwaj8ghIhBIOp/Q6HEhqC6kz4hhqzgqtoYI1rhsjs/oYWPEbkOqgmu6
WGAGxMaIvTAHlPuAUCRwcCNwcoF1TA9HF3t9f4GSR4RwK4eTigEMR3YBfHORk6NChnAlH1RW
mQEaTBhFGEx1oGmipJMpLnAkLKpxrAUSAYxEDwEXtEQIFxoMF7BEX8MFGKIKG8MSFwjSIQUM
Eg94ABEX1BsiQxsF6Q/O3EVfdeJdKCWnKpiStCGbRQzuKBOix9OdIQqGeTpmJqFBA0MouPIE
yoDBTRSE0AvoKRoAh54YqLtXaRW/TxSYZBQiK4CCgSIWKVDAUB0Ai8QoIFBohmEI/wQYNnT7
OPEBAgQhIN5kYAAoQ1CaQlDAEJBBFwAbNolBEPCCEJKVEAFS5mrDkGNeBx7TgDBgCCGuaing
qJHYEX8B3hoRcVVIVjM4lfphIkYBE8EFr6YYREhFMKythgQUMzCg2SHKYh48y6RuLSJ12EZp
mRFnXwCuGLW0+ZHJUACLK7lAkegTgJQBMrbsMvAwEYt8yry+2RnA05VDmFxGQiGpAYbdLHIC
bRtnEd9DYldqMNY2gIAQs3oFoKzMxc63BpsRMTGABI/YjVDQ5Cm69yGO+OA8L1jIr1Mp9KGW
e6htVh4TGhSg4ILBFaeEg19wtFl80nC0gTV42feZcdXNwv+gguT4x4slAnrX0m6eCUHhMq79
5uAQEVTVhXJH4ISccMRNh1mHZjzxywKmkFBiLVUhsyMoARUjH2HGvDhES90MIxod9wEAJXEu
EZGalSpB8eMvQ3LGZIocWoVEQHLRRUaXOOlFnQREOBKAfXk9eJBhdvl4CJhzDFSOHX0NVIYE
K2EApxCBKSCCnFleYEBGFAwz3VyHHRWCWX+99YUddDKwlStmchiAAV2IYMB4RPx4iQAlhCkE
nqiSd19BBtkEkh0KRXkRORRIOAsAIviKTIsWSSAsObc+UsQvKuAjAAR9sLMcVtUQIe0ycjJQ
QAh90RSQBlIpmJE5HFVLhAjvtHL/AR4UyKkBROISV8CiTLwnjwEKaWCUEf/tg8u/ANdYZRop
rOAsIdAGrPDCwAGiXSUJz9EAARRXbPHFGGes8cYcd5wxdw1P7PHFQjBGyAjcAWAxbVi0MMDL
MMcs88w012zzzTjT3IK8ALics8wAfHCKvzGLtfDRfTQ8B2MkNOAv0lCPgkAYfcDRwI9RR8FB
xB98kMbWWSMBhy9P9+FBBkWAcMAYDqwtRAIJpNG2ExOcMAQEHvxrNdaSHFBBxABYUAHbbgMy
dxIJVACCEIeTwtgIfAdywAFoC1H34ENwoPbiREyQgQcCFO6AA0R8kEAGcQuhOeocDNH4EQkc
YEHrr+Od/4EArpMOgAMTCPFB70KAgLrX+lSxSxUqLMCC5BNU0DoAJgiAuRAHnOCACakDMIEF
AoBgQeFw321BAgJkD8HtGdjNeOGwJ3BC3o1/MP72uk/gtgmYe5C39hUkAILXuihJ2c5wAAdk
YHEQ6AAApgcBCwhBAAqkHucyAL7sZaByR2jc64wAN/lBoHGnE4L+VOe8D3QgegDoQMJA0IHn
feVglVgBIAroAAWiboGu+94B8DeEAr6tgj3UXec6cELRsY+DcYsdCDswOSYO4QQTAIEHhJfA
zGVgfERggSkIUQKWzcGHHWhe66Z3vSMcAHixG0L4JGiECuBOg0csQvg40AEPgLlvf2k7wQkE
ID8pFsGEnFMDHJK3vBmSbnuVmx4HLNC7rqnxABygIxAtZwFoeU0IFUBbBkzgujgSYY3NK5wA
KgkACLhQfg6EHil9tzUsEsFpyJuEB6DFAR8CgH0QrEAYM+e3PeJxAsAToeAiCIDEdaBxeKNb
MD9HBA8IzgSAu6H21EfJChzgkkNAwQDDxs1uDsEQI/CmOMf5L5GN7JzoTKc618lOAngxCj77
mTznSc962vOeA1DBC7AQBAA7
--------------030808010303060803090208--