Proposed amendments to federal privacy regulations were backed and attacked in Washington last week as either necessary to implement privacy protection in the healthcare setting or certain to strip patients of control over their sensitive personal information.
Meanwhile, the chairman of a Bush administration panel looking into the obstacles to complying with the privacy regulations said it was time to stop peddling "misinformation and hysteria" about the privacy rules' requirements and modifications.
HHS published the proposed modifications in the March 27 Federal Register after providers warned that the original privacy regulations, published in April 2001, would create unintended obstacles to patient care, inhibiting the legitimate exchange of information among caregivers.
The original regulations, for example, required providers to obtain patients' written consent at any first encounter with the provider to use the patients' personal healthcare information for various purposes. The consent form included a notice of the providers' privacy practices and possible uses of patient information, such as for billing.
The modified regulations would make the consent form optional when obtaining it would interfere with "treatment, payment or healthcare operations." Providers still would be required to notify patients of their privacy policies and make a good faith effort to obtain written acknowledgment of the notification. Without that option, providers argued, the regulations appear to prohibit specialists, hospitals or other providers from acting on a referral until the patient signs an additional consent form.
At an oversight hearing on medical privacy held by the Senate Committee on Health, Education, Labor and Pensions, committee Chairman Edward Kennedy (D-Mass.) said requiring consent "is the only real way to assure that patients-and only patients-control sensitive information."
But those who criticize the proposed changes either have "a lack of appreciation for the rule's unintended consequences of blocking the delivery of healthcare" or "another agenda that has nothing to do with the rule," said Jack Rovner, who chaired hearings last week in Pittsburgh on the complexities of the privacy regulations. The hearings were called by the recently formed HHS Advisory Committee on Regulatory Reform (Jan. 7, p. 4).
Rovner, a Chicago healthcare lawyer, produced a two-page form for consent and a six-page listing of privacy practices for the average family practice clinic. Patients in need of care, he said, likely would not read through all the information in an acute situation or would delay their care if they did. "What it comes down to is a sacred signature ritual," he said.
Providers, health plans and claims clearinghouses must comply with the privacy regulations by April 2003. A 30-day comment period on the proposed changes ends April 26.