Health Information Compliance Alert

Wildly differing views on proposed changes to the Health Insurance Portability and Accountability Act's privacy rule were on display at an April 16 hearing of the Senate Health, Education, Labor and Pensions Committee.

The most contentious issue of the day was the Department of Health and Human Services' proposal to eliminate the requirement that doctors, hospitals and other healthcare providers obtain a patient's written consent before using or disclosing that individual's health information for treatment or payment purposes. The proposed changes eliminate that requirement; obtaining prior consent would instead be optional.

HHS deputy secretary Claude Allen defended the proposed changes on grounds that the previous mandatory requirement was unfair to patients and would have restricted access to medical sevices.

"We view the mandatory consent as coercive and a fundamental hurdle to healthcare for patients and the doctors, hospitals and pharmacists that serve them," Allen explained. "Under the previous proposal, if a patient wanted or needed to receive care from a doctor, he had to choose between signing a consent form prior to seeing his doctor and not receiving care.

"In support of his position, Allen argued that the consent requirement complicated treatment by requiring patients to provide separate prior written consents at every step in the treatment process.

Sen. Judd Gregg (R-NH), the ranking minority member of the senate committee, was sympathetic to Allen's reasoning. "These changes will prevent the unnecessary harmful interruption of a patient's care that would have occurred under the existing rules," Gregg said. "By changing the rule we have avoided a consumer backlash of major proportions."

The argument that requiring consent would hamper treatment, however, failed to convince many of the hearing's attendees.

Sen. Christopher Dodd (D-CT) called the argument "phony."

Similarly, while agreeing that covered entities sometimes needed to use protected health information prior to obtaining consent, American Psychiatric Association president Richard Harding argued that the Bush administration has overreacted to the difficulties posed by such situations.

"HHS has overcorrected a problem by a proposed elimination of the traditional patient right of affirmative consent altogether. This is truly a sea change event in American medicine."

Harding recommended instead that HHS "retain the privacy rule's prior consent requirement with targeted modifications."

Hearing participants also clashed sharply on proposed changes to the privacy rule's marketing provisions. While the changes now require covered entitities to obtain an individual's specific authorization before sending them any marketing materials, they also exclude a number of practices from the definition of marketing.

"The proposal would permit doctors, hospitals and health plans to communicate freely with patients about individual treatment options and other health related informatation including disease management, case management and care coordination," explained Allen.

Those exclusions, however, worry many who feel that the excluded practices are so broadly defined that marketers can bypass the privacy rule's marketing consent requirement by simply crafting their messages to be vaguely "health-related."

Harding, for example, fretted that "there's [now] no real effective privacy safety net against commercial usage [since] the exclusions to the term 'marketing' swallow the rule."

Committee chairman Sen. Edward Kennedy (D-MA) similarly charged that the exclusions "provide a new backdoor loophole that allows companies to use private medical records to market their products."

The strongest words on the marketing related changes came from Georgetown University's Health Privacy Project director Janlori Goldman, who said she was "bewildered and disturbed" by Allen's testimony on the issue.

"What used to be in this box called marketing, where people had an opportunity to opt out, after getting a communication, where people were told that there was a financial conflict of interest, that is now gone from the administration's proposal," fumed Goldman. "Any communication from anybody, not just a doctor, anybody, a pharmacy, that is health related, no matter whether there's a financial conflict of interest, does not require an authorization, does not give an opt out, does not require up-front consent. That is very disturbing."

Goldman also took issue with HHS's claim that eliminating the consent requirement would save the health care system $100 million, pointing out that by HHS' own estimate, implementing HIPAA would produce $12 billion in long-term health-care savings. Given these savings, Goldman opined, wanting to save and additional $100 million by eliminating the consent requirement seems "greedy."