New regulations to safeguard privacy of medical records
Clinton plan more far-reaching than rules that were first proposed
Juliet Eilperin - Washington Post
WASHINGTON -- The Clinton administration will issue broad new regulations today to safeguard the confidentiality of Americans' medical records, establishing the first federal protections aimed at limiting what information doctors, hospitals and health plans can divulge without patients' consent.
The rules are significantly more far-reaching than those first proposed by the White House a year ago, covering not only electronic medical records, as was initially outlined, but also paper records and oral communications. They also require patients' written consent for even routine disclosure of information, something not covered in the administration's earlier plan, and close a loophole that would have allowed large self-insured employers access to medical records without patient approval.
They will guarantee patients access to their health files, restrict the release of their personal information without their approval and give them greater say about how the files are being used.
The rules, which will take full effect within two years, are the product of years of often contentious debate among the administration, Congress, the health care industry, and consumer and privacy advocates over the extent to which private medical records should be protected.
In issuing the new protections, the administration is tackling the thorny issue of how to address technological innovations that have made it much easier for companies to analyze and distribute private medical information that once remained a secret between patients and their physicians. While health care officials argue they need the reservoir of information to provide more efficient and affordable services, there has been growing concern among people about their employers and others gaining access to their records.
In addition to setting guidelines on the amount of information that can be released, limiting it to the "minimum necessary," the rules establish new criminal and civil penalties for health care providers and insurers that improperly use or disclose medical information. Intentional disclosure is punishable by a $50,000 fine and a year in prison, and disclosure with the intent to sell is subject to a fine of as much as $250,000 and up to 10 years in prison.
"It's the most sweeping privacy law ever in U.S. history, and it will have a major impact on the entire health care field," said Janlori Goldman, who directs the health privacy project at Georgetown University.
Congress voted in 1996 to adopt privacy standards for medical records within three years, or give the administration the authority to do so after that. The Republican-controlled House and Senate missed their self-imposed deadline of August 1999 and ceded the issue to the Democratic White House.
It is unclear whether President-elect Bush would seek to modify or reverse the new rules; the incoming administration would have to show cause and invite another round of public comment before taking any formal action. One White House official Tuesday described such a scenario as unlikely. "We would be very surprised if he did that," the official said of Bush.
The Clinton administration's move will not come without controversy. Medical industry representatives have argued that limiting how patients' records can be used will boost costs and hamper research that could lead to more advanced treatments.
But several privacy specialists said the problems consumers face under the current system far outweigh any potential costs to private industry. Concerned that employers or marketing firms may discover they have been treated for depression, alcohol abuse or other illnesses, some patients have chosen to hide information from their doctors or have stopped seeking treatment.