The Bush administration, which has so rarely come to the aid of providers, finally got one right on the issue of patient consent for disclosure of private medical information. We are strongly in favor of keeping patients' medical information private, but the clamor in Washington over the Bush revisions to one piece of the Health Insurance Portability and Accountability Act of 1996 seems more political than substantive. It's time to sort out the reality from the rhetoric.
Earlier this month, key Democrats, including Al Gore, charged that the administration was set to "dismantle the medical privacy of American citizens." It is true that Bush did an about-face on the issue. In the early days of his administration, he endorsed the expansive privacy rules issued by President Clinton in December 2000. However, after hearing the legitimate complaints of healthcare providers, the president changed his mind.
The Clinton regulations required that doctors, hospitals and other healthcare providers get written consent from patients before using personal health information for treatment, reimbursement or any of a long list of "healthcare operations" and administrative activities. Providers argued that this would mean that a patient referred to a specialist or needing to fill a prescription would have to sign a consent form for each episode of care. A patient with limited mobility would have to limp in or be wheeled in to sign a form just to get a prescription filled, then again to get an MRI, again to see a physical therapist and so on.
Claude Allen, a deputy secretary of HHS, told a congressional panel earlier this month that the Clinton rules would impede access to care. "If you did not sign a consent form, a provider could refuse you care. Mandating consent is coercive-a hurdle to healthcare for patients, doctors, hospitals and pharmacists. The primary reason for going to a physician is not privacy. It is care."
Under the Bush plan, providers would have to notify patients of privacy policies and make a good-faith effort to get written acknowledgment. The written form would have to be signed for doctors, hospitals, drugstores and insurers to disclose patient data for the purpose of marketing. But the term "marketing" was redefined so that it would not include literature that recommends alternative treatments, therapies, drugs or referrals to other kinds of providers, for which written consent would not be required.
Even Sen. Chris Dodd (D-Conn.), a fierce opponent of the Bush changes, says that common sense should prevail. "For example, your personal physician should be allowed to phone in your prescription to your pharmacist."
But Dodd goes on to say that the change in the definition of marketing is a "back-door loophole" that allows companies to use private medical records to market their products, making medical records "an open book."
Again, the rhetoric sounds right, but the reality is different. The Bush plan specifies that explicit patient authorization is still required before doctors, hospitals and other direct treatment providers could share personal medical records for "nonroutine" purposes, such as disclosures to employers for employment purposes and to unrelated companies for advertising or other uses. However, patients would expect that their doctor, hospital or other direct treatment provider could share medical information for those core activities that are essential elements to providing healthcare to the patient. Giving a diabetes patient information on nutrition or follow-up care shouldn't be considered a privacy violation.
What isn't needed is more legislation, such as that proposed by Sen. Edward Kennedy (D-Mass.), who wants to roll things back to the Clinton plan. Hasn't HIPAA already been legislated enough?
The Bush plan isn't perfect, but it appears to protect patient privacy in a common-sense way, making medical information available on a need-to-know basis.