Proposed Rules on Health Care Records Privacy
On November 3, 1999, the Department of Health and Human Services (HHS) published in the Federal Register proposed new regulations to protect the privacy of health care consumer's electronically stored and transmitted health care records. The regulations were mandated as part of the Health Insurance Portability and Accountability Act (HIPAA), which was enacted in 1996. That law provided for "administrative simplification" for record keeping and also required that Federal privacy standards be promulgated by HHS if Congress failed to act on the issue by August 1999. Since Congressional efforts have stalled, HHS developed the proposed standards.
The proposed rule governs only electronic records and would:
- allow health information to be used and shared easily for the treatment and the payment of health care;
- allow health information to be disclosed without an individual's authorization for certain national priority purposes (such as research, public health, and oversight), but only under defined circumstances;
- require written authorization for use and disclosure of health information for other purposes; and,
- create a set of fair information practices to inform people of how their information for other purposes is used and disclosed, ensure that they have access to information about them, and require health plans and providers to maintain administrative and physical safeguards to protect the confidentiality of health information and protect against unauthorized access.
Since the Administration's authority in this area is limited by statute, it is still important for Congress to continue to work towards a more comprehensive solution to the problem, especially in the areas of enforcement and scope.
ANA submitted extensive comments to HHS generally supporting the direction of the proposed rule but pointed out in the comments the need for Federal legislation to strengthen health records privacy and offered recommendations for improving the privacy rule. Some of the issues addressed in ANA comments included: the need to apply the rule to all health records not just to electronic records; whistle-blower exception for disclosure of information; the need for special protections for sensitive information such as psychiatric notes; and issues related to the rights of minors.