Contrary to assertions from its critics, the American Hospital Association says that the law requiring hospitals to notify patients of breaches of their confidential health information does allow hospitals to gauge the level of potential harm to patients before deciding whether to send out notices.
Consumer Watchdog, a Washington consumer advocacy group, says
such an interpretation of the law is flawed and too permissive for hospitals that allow patient information to be breached. The debate comes in response to HHS' 32-page proposed interpretation of Congress' breach notification provisions contained in the American Recovery and Reinvestment Act of 2009.
In comments to an HHS rulemaking board, Consumer Watchdog said the law was being watered-down by allowing hospitals to internally assess how much risk of actual harm such breaches pose to patients before deciding whether to notify them. The Coalition for Patient Privacy sided with the watchdog group in
an Oct. 23 letter to HHS.
“We are dismayed and disappointed with the (interim final rule), particularly with the inclusion of a ‘harm standard.' HHS went far beyond the intent of Congress. This is a real blow to accountability and transparency,” said Ashley Katz, executive director of Patient Privacy Rights, the organization that leads the coalition.
However, AHA Executive Vice President Richard Pollack told the federal rulemaking board in a six-page Oct. 23 letter that Congress' law does indeed allow hospitals to perform a risk analysis, as evidenced by the statutory definition of breach as “the unauthorized acquisition, access, use or disclosure of protected health information which compromises the security or privacy of such information.”
“This language,” Pollack wrote, “contemplates the need for some determination of whether there is a risk of harm. … An acquisition, access, use or disclosure that does not compromise the security or privacy of the information is not a breach.”
The hospital association says notifying patients of every slight breach committed by hospitals, physicians and other “covered entities” and contractors would be an onerous administrative burden for hospitals that could also serve to confuse patients receiving “countless notices of breaches” that do not pose harm.
Please take our Health IT Strategist reader poll on this topic.
