Oversight, renewed opposition halt new medical-privacy rules
Steve Key has seen the future of medical-records privacy, and he isn’t so sure he likes it.
It was only a few years ago that Indiana Emergency Management officials persuaded state lawmakers that paramedics and ambulance drivers should fall under the definition of “medical providers” in a state privacy law, and journalists suddenly saw another information source dry up.
What had long been routine newsgathering — examining ambulance and firefighting dispatch logs — was halted. The records were now considered personal medical information because they might contain a patient’s home address. And in some cases, officials would only reveal the emergency vehicle’s final destination by releasing the first three digits of the zip code.
“Our journalists were going into fire departments and hospitals hearing, ‘We can’t give you the information we’ve always given you,’ ” said Key, counsel for government affairs for the Hoosier Press Association.
Key said journalists hoped to iron out the kinks with state health officials, but new federal regulations — the Health Insurance Portability and Accountability Act — stymied the discussion. Hospital officials in Indiana slid back from the table, saying they would wait to see how the new laws affected the records.
The U.S. Department of Health and Human Services unveiled the final version of HIPAA last December. The sweeping new rules were designed to protect patients’ privacy by improving patients’ access to their medical records; narrowing instances where such information may be released to other physicians, health care providers or researchers; and requiring written authorization for use and disclosure of health information for other purposes.
But now the new regulations appear to be on hiatus, a victim of oversight and, perhaps, renewed debate.
The Clinton administration apparently failed to formally submit the new regulations to Congress as is required by law when they were finalized Dec. 28. The regulations, which were to go into effect in Feb. 26, have been delayed for at least two months.
Although the rules were submitted to Congress last month, the Bush administration hasn’t embraced them as fervently as the previous one. Health Secretary Tommy Thompson recently reopened the rule-making process, allowing public comment to continue through March 30.
In the meantime, some Republican leaders have attacked the regulations, saying they might cause more harm than good to medical-privacy rights.
“It is not entirely clear to me how the new rules will actually address real medical privacy harms currently suffered by patients not already covered by tort law or other remedies,” House Majority Leader Dick Armey, R-Texas, wrote to Thompson recently. “The proposed HIPAA regulations, however, may actually have the opposite effect, putting private personally identifiable information at greater risk than exists today.”
In the past, health officials defended the rules saying the absence of a national standard concerning the confidentiality of health information has caused both patients and the health care industry great anxiety concerning the handling of such records.
The final regulations provide privacy protection for all personal medical information, whether collected in oral, paper or electronic form. They also require patients’ consent for release of any of their medical records, even for routine purposes.
Penalties for the unauthorized release of such information can reach as high as $250,000 and 10 years in jail for each violation. The regulations offer some waivers for law enforcement officials conducting investigations.
Groups such as the Health Privacy Project and the American Civil Liberties Union hailed the new rules as a major advance in assuring confidentiality to those receiving medical care.
But press advocates fear the new rules would stifle investigative reporting, blocking the release of even such routine information as the condition of patients. Presumably, the rules would hinder medical reporters who routinely visit hospitals and clinics to follow doctors and nurses on their rounds or who use health records to reveal the workings of the medical profession.
And while they were cheered by delays in the implementation of HIPAA, journalists know they remain alone in their arguments. Opposition to the rules has surfaced on privacy — not free-speech — grounds.
Of the 52,000 comments supplied during the previous public-commenting period, only a handful, mostly from groups such as the Society of Professional Journalists and the Reporters Committee for Freedom of the Press, noted problems with access.
Ian Marquand, chair of SPJ’s Freedom of Information committee, said the new rules would open the door “for hospitals and medical establishments to withhold what we consider routine information on patients.”
He said that in times of crisis, such as the recent school shooting near San Diego, the public needs to know the extent of the tragedy.
“Whenever something like that happens, the public’s first questions are, ‘How many people are hurt? How bad are they hurt?’ ” Marquand said. “As human beings, we want to know that.”
Jane Kirtley, a professor at the University of Minnesota’s School of Journalism and Mass Communication, noted that if Vice-President Dick Cheney hadn’t been forthright about his recent hospital visit, officials at George Washington hospital in Washington, D.C., probably wouldn’t have revealed his admission or his condition.
“Under these rules, the impulse would be not to say anything,” Kirtley said.
And Rebecca Daugherty of the Reporters Committee said the fallout might even be greater as individual states address privacy concerns outlined in the new rules. She said observers need only look at the wake of the federal Drivers Privacy Protection Act to see how state officials often went above and beyond the minimum guidelines to protect information collected by state motor-vehicle departments.
Key of the Hoosier Press Association agrees, noting he’s seen Indiana officials attempt to close records in the name of privacy.
“We were getting quite a few complaints when information began getting shut off even before HIPAA,” he said. “I’m not sure the real impact is hitting yet as far as newspapers are concerned. But I know it’s a terrible one.”