Recently enacted health insurance reform legislation requires hospitals and other healthcare providers to institute new privacy safeguards within the next four years.
However, those looking for guidance on establishing such safeguards will find none in the legislation.
It calls on the HHS secretary to send Congress recommendations on ways to improve the privacy of health information within the next 12 months. It gives the secretary several areas to address, including "the rights that an individual who is a subject of individually identifiable health information should have" and "the use and disclosure of such information."
After the secretary makes recommendations, Congress has up to two years to pass legislation. However, Congress can act at any time, whether or not it has received HHS' recommendations. Should Congress fail to pass legislation, responsibility falls back on the HHS secretary, who has an additional six months to formulate privacy rules.
One way or another, by February 2000, there will be federal rules designed to ensure privacy of health information.
"The good news is this guarantees that the national debate on privacy is heating up, but it is fair to say that (providers) trying to figure out what they need to do will be disappointed," said Kathleen Frawley, director of the Washington office of the American Health Information Management Association.
The hands-off approach taken by Congress in the health insurance reform legislation is a reflection of the controversy surrounding several privacy-related bills that were introduced since 1994. The leading measure, sponsored by Sen. Robert Bennett (R-Utah), was reworked several times over the past year in an unsuccessful attempt to find a compromise between consumer advocates, who want a strict law, and providers, who are concerned that intrusive rules will stifle the move to integrated delivery systems.
Whether Congress' latest strategy is a good one depends largely on one's view of the Bennett measure, which never came up for a vote.
Heidi Wagner Hayduk, a consultant who works with provider and insurer groups, said the privacy measures in the health insurance legislation are "a positive step. They aren't prescriptive like the Bennett bill. They set up a process for figuring out the best way to proceed."
But Janlori Goldman, deputy director of the Washington-based Center for Democracy and Technology, an offshoot of the American Civil Liberties Union, criticized the time lag for creating the absence of any real protection. "Every day and every month that goes by, people are at risk," Goldman said.
Most observers believe legislators are unlikely to wait for the HHS secretary's recommendations. "A Republican Congress is more likely to be active on its own rather than wait for the secretary," Hayduk said.