U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Printing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2250 Mail: Stop SSOP, Washington, DC 20402–0001

78–950 PDF 2003

S. HRG. 107–421

OVERSIGHT ON MEDICAL PRIVACY

HEARING

BEFORE THE

COMMITTEE ON HEALTH, EDUCATION,

LABOR, AND PENSIONS

UNITED STATES SENATE

ONE HUNDRED SEVENTH CONGRESS

SECOND SESSION

ON

EXAMINING MEDICAL PRIVACY ISSUES, FOCUSING ON THE STANDARDS

FOR PRIVACY OF INDIVIDUALLY IDENTIFIABLE HEALTH INFORMATION (PRIVATE RULE), AND THE PROPOSED MODIFICATION TO THOSE

STANDARDS, PUBLISHED BY THE DEPARTMENT OF HEALTH AND

HUMAN SERVICES

APRIL 16, 2002

Printed for the use of the Committee on Health, Education, Labor, and Pensions

(

(II)

COMMITTEE ON HEALTH, EDUCATION, LABOR, AND PENSIONS

EDWARD M. KENNEDY, Massachusetts, Chairman

CHRISTOPHER J. DODD, Connecticut

TOM HARKIN, Iowa

BARBARA A. MIKULSKI, Maryland

JAMES M. JEFFORDS (I), Vermont

JEFF BINGAMAN, New Mexico

PAUL D. WELLSTONE, Minnesota

PATTY MURRAY, Washington

JACK REED, Rhode Island

JOHN EDWARDS, North Carolina

HILLARY RODHAM CLINTON, New York

JUDD GREGG, New Hampshire

BILL FRIST, Tennessee

MICHAEL B. ENZI, Wyoming

TIM HUTCHINSON, Arkansas

JOHN W. WARNER, Virginia

CHRISTOPHER S. BOND, Missouri

PAT ROBERTS, Kansas

SUSAN M. COLLINS, Maine

JEFF SESSIONS, Alabama

MIKE DEWINE, Ohio

J. MICHAEL MYERS, Staff Director and Chief Counsel

TOWNSEND LANGE MCNITT, Minority Staff Director

(III)

CONTENTS

STATEMENTS

TUESDAY, APRIL 16, 2002

Page

Kennedy, Hon. Edward M., Chairman, Committee on Health, Education,

Labor, and Pensions, opening statement ........................................................... 1

Gregg, Hon. Judd, a U.S. Senator from the State of New Hampshire, opening

statement .............................................................................................................. 2

Dodd, Hon. Christopher J., a U.S. Senator from the State of Connecticut,

opening statement ................................................................................................ 6

Harkin, Hon. Tom, a U.S. Senator from the State of Iowa, prepared statement ...................................................................................................................... 9

Frist, Hon. Bill, a U.S. Senator from the State of Tennessee, opening statement ...................................................................................................................... 9

Reed, Hon. Jack, a U.S. Senator from the State of Rhode Island, opening

statement .............................................................................................................. 11

Warner, Hon. John W. a U.S Senator for the State of Virginia, opening

statement .............................................................................................................. 11

Murray, Hon. Patty, a U.S. Senator from the State of Washington, opening

statement .............................................................................................................. 12

Enzi, Hon. Michael B., a U.S. Senator from the State of Wyoming, opening

statement .............................................................................................................. 31

Allen, Claude, Deputy Secretary, Department of Health and Human Services,

prepared statement .............................................................................................. 36

Karp, Sam, Chief Information Officer, California Healthcare Foundation, prepared statement ................................................................................................... 42

DeWine, Hon. Mike, a U.S. Senator from the State of Ohio, opening statement ...................................................................................................................... 46

Goldman, Janlori, Director, Health Privacy Project, Georgetown University,

prepared statement .............................................................................................. 48

Harding, Richard, M.D., President, American Psychiatric Association, prepared statement ................................................................................................... 61

Clough, John C., M.D., Director, Health Affairs, Cleveland Clinic Foundation,

prepared statement .............................................................................................. 64

ADDITIONAL MATERIAL

Articles, publications, letters, etc.:

Letters signed by physician groups and a consumer organization ............... 4

Questions of Senator Murray for Panel I ....................................................... 14

American Hospital Assocation ......................................................................... 69

The Alliance of Medical Societies .................................................................... 71

Blevins, Sue A., President, Institute for Health Freedom ............................ 72

(1)

OVERSIGHT ON MEDICAL PRIVACY

TUESDAY, APRIL 16, 2002

UNITED STATES SENATE, COMMITTEE ON HEALTH, EDUCATION, LABOR, AND PENSIONS, Washington, D.C.

The committee met, pursuant to notice, at 10:05 a.m. in Room

206, Hart Senate Office Building, Hon. Edward M. Kennedy (chairman of the committee) presiding.

Present: Senators Kennedy, Dodd, Wellstone, Murray, Reed,

Clinton, Gregg, Frist, Enzi, Warner, and DeWine.

OPENING STATEMENT OF HON. EDWARD M. KENNEDY, A U.S.

SENATOR FROM THE STATE OF MASSACHUSETTS

The CHAIRMAN. We will come to order. I am pleased to hold this

very important hearing on what is happening with patients’ medical records. The blessing of high technology can also be a curse to

personal privacy. With the click of a mouse our most personal information can be launched into cyberspace for millions to see. If we

do not take steps forward to protect privacy in the information age,

our most personal information will be available to every employer,

every health insurance company, and every high-tech peeping Tom

in America.

This is not only unfair to patients; it is bad for their health. A

recent study found that one out of every six patients withdraws

from full participation in their own health care because they worry

their medical information will be used.

We have worked hard to strengthen privacy protection for America’s patients. In the Health Insurance Portability and Accountability Act of 1996 we said privacy protections were so important that

if Congress did not pass legislation to strengthen privacy the administration should put in place real protections. The Clinton administration did just that when it adopted a comprehensive set of

protections to give all Americans control of their private medical

records. However, the new rule recently proposed by the Bush administration would rescind these protections and would make private medical records an open book.

This is a serious step backwards. Each time patients see a doctor

or fill out a prescription they are at greater risk that their most

personal medical information will be available to prying eyes. The

administration has proposed new rules that say health providers do

not have to get consent to determine how your medical records are

used. Requiring consent assures that the patient plays a role in

how their health information is used. It is the only real way to asVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00005 Fmt 6633 Sfmt 6633 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
2

sure that patients and only patients control sensitive information.

It restores faith in the health care system.

Of course, certain narrow and common sense exceptions are

needed. For example, your personal physician should be allowed to

phone in your prescription to your pharmacist. There is no reason

that you should have to make a separate trip to the hospital before

surgery just to consent. We can address these practical challenges

without undermining the core protections in privacy.

The Bush administration’s proposals say patients simply have to

be notified, not asked, about what is going to happen with their

medical information. We should not throw the baby out with the

bathwater. All Americans should be assured that their personal

medical information is theirs and theirs alone.

The administration’s plan also provides for a new back-door loophole that allows companies to use private medical records to market their products. This means, for example, that patients seeking

treatment for mental illness would have that information shared

with companies selling anti-depressants and other therapies. Those

companies would be free to send open mailings to your work or to

your home. The administration claims the new regulation grants

new protections against abuse. They argue that a new authorization is required before a health provider or business can market to

a patient. But the same proposal allows doctors and pharmacists

to provide, without permission, the health information of their patients to businesses that will try to sell them new drugs, therapies,

nursing home placements, and other care. This loophole is a telemarketer’s dream and a patient’s nightmare and it must be closed.

I look forward to working with my colleagues on legislation to assure Americans that their medical records will be kept private and

I welcome our distinguished witnesses to today’s hearing.

Senator Gregg.

OPENING STATEMENT OF HON. JUDD GREGG, A U.S. SENATOR

FROM THE STATE OF NEW HAMPSHIRE

Senator GREGG. Thank you, Mr. Chairman.

Medical privacy is an issue that affects every American, and yet

prior to the passage of HIPAA in 1996, there was no Federal structure or law in place that would ensure that our medical information remains private. HHS has been working for several years to

develop comprehensive rules that govern the use and disclosure of

protected health information. This is no easy task, given the complexity and fragmentation of our health care system, including the

fact that our private health care insurance system is employmentbased and dependent upon a system of third party payers.

I would like to commend the administration for proposing significant improvements to the rules. These changes provide important

clarifications that will aid in implementation and compliance.

Moreover, these changes will prevent the unnecessary and harmful

disruption of a patient’s care that would have occurred under the

existing rules, a very important point.

Although the proposed rule would clarify or improve several different provisions, the most important proposed modification pertains to the consent and notice requirements on direct treatment

providers. Under the existing rules, a patient would have to give

3

prior written notice, prior written notice, to each and every provider that the patient sees or even schedules an appointment with.

Not only would this requirement disrupt and delay care but the

protection it would have provided is merely illusory because a provider could withhold care if the patient does not provide the consent.

There are numerous examples of how, if unchanged, this requirement will harm or delay patient care. For instance, a patient referred to a specialist by his or her physician may not even be able

to schedule an appointment without first going to the specialist’s

office and completing a form. Because only patients can give consent, a sick or elderly person could not have a friend or a family

member pick up their prescription unless they first go and sign a

consent form with the pharmacy, resulting in serious delays in

starting medication.

Ordinary physician practices, such as arranging out-patient surgery or calling in prescriptions, would be in jeopardy. One hospital

stay might result in a sick patient having to fill out multiple new

forms, new consent forms, in addition to all the forms already required for treatment—one for the hospital, one for each nurse, one

for each doctor, one for each medical technician that the patient

sees under this proposal.

There are numerous examples of disruption in patient care that

would occur as a result of the prior consent requirement, and there

are likely many more that have not been contemplated. Thus, the

suggestion to keep this requirement in place but create exceptions

for all the various situations in which prior consent would disrupt

care is simply unworkable.

By changing this provision we avoid a consumer backlash of

major proportions. While consumers rightly seek the strongest possible privacy protection, they have little tolerance for bureaucracies

and hoops that make it even more difficult to navigate our complex

health care system, especially if the additional bureaucracy does

not provide meaningful protection or enhance the quality of care.

Consumers and physicians support the changes in the consent requirement, and this is an important point. A letter dated April 10

from a broad range of physician groups, including the American

Academy of Family Physicians, the American College of Obstetricians and Gynecologists, and the American Medical Group Association, strongly support the administration’s proposed changes in the

consent requirements. These organizations represent over 400,000

physicians.

In an earlier letter dated December 20, 2001, the National Partnership for Women and Families Consumer Organization and

United Health Care co-signed a letter to Secretary Thompson raising serious concerns that the existing consent provisions will seriously jeopardize quality of care, I would like to submit all those letters for the record.

Senator DODD. [presiding]. Without objection, so ordered.

[The letters follow.]

4

April 10, 2002

The Honorable Edward M. Kennedy,

Chairman Health, Education, Labor and Pensions Committee,

Washington, DC.

DEAR CHAIRMAN KENNEDY: The Department of Health and Human Services

(HHS) recently issued proposed changes to the medical privacy rule ‘‘Standards for

Privacy of Individually Identifiable Health Information.’’ The undersigned national

health and medical organizations and specialty societies strongly support the proposed rule’s approach in making prior consent discretionary. Unfortunately, various

press articles and commentary have seemed to suggest that physicians do not support the proposed change. It is important for Members of Congress to know that

many physician and provider organizations do support the proposed modification to

make prior consent discretionary rather than mandatory.

Physicians and practitioners strongly support meaningful Federal privacy protections for patients’ medical information. Under the proposed rule, covered entities

would not be required to obtain written consent from patients before using or disclosing protected health information for such routine purposes as treatment, payment, and health care operations. However, unlike the proposed regulation issued

under the Clinton Administration, covered entities would not be prohibited from obtaining written consent if they choose. We believe this approach strikes the proper

balance of protecting the rights and autonomy of patients, while removing unnecessary barriers that interfere with patient care and the efficient delivery of health

care.

It is important to note that eliminating the prior consent requirement does not

detrimentally affect patients’ privacy rights in any meaningful fashion. Even privacy

advocates called the consent requirement meaningless because the regulation permitted providers to deny treatment to individuals who refused to sign the consent

form. Furthermore, we believe that the written notice requirement is the true backbone behind patients’ privacy rights. The written notice, not the consent form, is the

means by which patients are informed of their rights under the regulation and how

and to whom their medical information may be used or disclosed. The proposed rule

actually strengthens the notice requirement, which we fully support.

Not only would the prior consent requirement add yet another mandatory form

to the already unmanageable paperwork burden that physicians and practitioners

face on a daily basis, it could pose serious problems for patient care. HHS outlined

many of the potential problems in the proposed rule.

The prior consent requirement could confuse patients and increase patient waiting

times. Physicians and practitioners would be prohibited from treating patients or

providing other services for them, until the form is actually signed. For example,

physicians who have privileges at a number of hospitals would need either to establish multiple organized health care arrangements or ask each patient in the hospital

to sign a physician consent form in addition to the consent form provided for the

hospital. If a patient were required to sign multiple consent forms to receive care

at a hospital, this would hinder and delay patient care.

Additionally, the prior consent requirement would potentially interfere with the

ability of physicians and practitioners to continue many daily practices such as referring patients for treatment, arranging outpatient surgery, and calling-in prescriptions. Furthermore, physicians and practitioners might not be able to use patients’

information to send important reminders regarding patient treatment (i.e., child immunization and mammography reminders).

HHS faced the difficult challenge of protecting patients’ privacy rights, while at

the same time removing unnecessary barriers that interfere with patient care and

the delivery of health care. We strongly believe that HHS met this challenge in the

proposed rule, and we oppose any efforts to change it.

Sincerely, American Academy of Dermatology Association; American Academy of

Family Physicians; American Academy of Nurse Practitioners; American Academy

of Physician Assistants; American Association of Neurological Surgeons/Congress of

Neurological Surgeons; American Association of Orthopaedic Surgeons; American

College of Cardiology; American College of Nurse-Midwives; American College of Obstetricians and Gynecologists; American Medical Group Association; American

Podiatric Medical Association; American Society of Cataract and Refractive Surgery;

American Urological Association Medical Group Management Association

April 12, 2002

DEAR MEMBER OF CONGRESS: As you may know, the Department of Health and

Human Services (HHS) recently issued a Notice of Proposed Rulemaking (NPRM)

5

proposing modifications to the final privacy rule. The undersigned organizations are

writing to let you know of our strong support for the proposed modification in the

NPRM giving health care providers the option of obtaining the prior consent of patients to use or disclose identifiable health information for treatment, payment and

healthcare operations. The Department’s proposal to make obtaining consent optional for providers strikes a workable compromise between the original proposed

regulation from 1999 that prohibited providers from obtaining written consent and

the final regulation from 2000 which mandated it.

We strongly support meaningful Federal privacy protections for patients’ medical

records. An essential part of that commitment is ensuring that patients understand

their rights and how their medical information will be used. However, adding yet

another mandatory form to the burden that physicians, practitioners, pharmacists,

hospitals and other health care providers already face on a daily basis does not effectively achieve the balance of providing privacy protections and assuring timely,

efficient access to health care. We support the Department’s proposed modification

to make consent optional.

The NPRM documented numerous disruptions and delays in receiving medical

care that patients—particularly the elderly and those in rural areas—would face if

the mandatory prior written consent requirement were not modified to make it optional for health care providers. For example, patients could experience significant

delays in obtaining prescriptions because pharmacists could not fill the prescription

until the patient were present to sign the consent. Friends and family picking up

prescriptions for a sick individual would not have legal authority to sign the consent, and thus could not pick up the prescription.

The NPRM described how patients referred to a hospital for outpatient surgery

might have to make an extra trip to sign a consent form because the hospital could

not use information about the patient to schedule and prepare for surgery. Nurses

who staff telephone centers that provide health care assessment and advice, but

never see patients, would be unable to counsel patients because they would be prohibited from using identifiable information for treatment and would be unable to obtain prior written consent. The NPRM also cites emergency medical providers who

were concerned that even if a situation was urgent that they would have to try to

obtain consent, even if inconsistent with best medical practices. There were also

troubling questions about whether physicians who had privileges at several hospitals would have to obtain separate consent from patients at those facilities, even

if patients had already signed consents for the hospital.

These are just some examples of the potentially serious consequences of the mandatory prior written consent requirement. The Department wisely chose to correct

the underlying problem with the proposed provision to make consent optional, rather than trying to address each adverse consequence of a mandatory consent requirement as it presented itself.

Sincerely, ACA International; Academy of Managed Care Pharmacy Advance PCS;

Advanced Medical Technology Association (AdvaMed); Aetna Inc.; American Academy of Dermatology Association; American Academy of Family Physicians; American Academy of Physician Assistants; American Association of Health Plans; American Association of Neurological Surgeons/Congress of Neurological Surgeons; American Association of Orthopaedic Surgeons; American Benefits Council; American

Clinical Laboratory Association; American College of Nurse-Midwives; American

Health Care Association; American Managed Behavioral Healthcare Association;

American Medical Group Association; American Pharmaceutical Association; American Society of Cataract and Refractive Surgery; American Society of Consultant

Pharmacists Association of; American Medical Colleges Biotechnology Industry Organization (BIO); Blue Cross and Blue Shield Association; Cardinal Health; Cleveland Clinic Foundation; The ERISA Industry Committee; Express Scripts; Federation of American Hospitals; Food Marketing Institute; Genzyme Corporation;

GlaxoSmithKline; Health Insurance Association of America; Healthcare Leadership

Council; Intermountain Health Care; Kaiser Permanente; Lahey Clinic; Marshfield

Clinic; Mayo Foundation; Medical Group Management Association; Merck-Medco;

National Association of Chain Drug Stores; National Association of Health Underwriters; National Association of Manufacturers; National Retail Federation; Pharmaceutical Care Management Association; Premier, Inc.; Quest Diagnostics;

UnitedHealth Group; US Chamber of Commerce; Vanderbilt University Medical

Center; VHA Inc.; WellPoint Health Networks

Senator GREGG. Some have suggested that the proposed change

was driven by large corporate medical interests and thus is not in

6

the best interest of consumers and patients. This is not the case.

While nearly every sector of the health care system supports the

proposed changes, the modifications in the consent requirement

only apply, only apply, and this is an important point, to direct

care providers.

Moreover, the proposed rule does not affect the requirements

governing use and disclosure of protected health information. Authorization would still be required for any other use of the protected health information.

The proposed change to the consent requirement strikes the right

balance. The original rule issued by the Clinton administration

would have actually prohibited prior consent. I think that is an important point we have to stress here. President Clinton originally

proposed that there would be no prior consent. And that change,

the reason they changed it then was because the American Medical

Association, allegedly on behalf of its constituency, and I cannot believe it, but that is the allegation, wanted the prior consent to be

in place. I am tempted, quite honestly, very much tempted to say

if the American Medical Association wants prior consent, we will

give it to them, just for them, but we have not heard from the

American Medical Association recently on this point and maybe

their position has been modified.

Many providers objected to the ban on prior consent and rightly

so. The final Clinton rule would have mandated prior consent before any kind of interaction with the health care provider. This is

far too disruptive. The proposed rule before us would not mandate

prior consent. Instead, it would require providers to give notice of

their privacy practices. This would allow patients to be fully informed of how their information will be used and would allow them

to act accordingly. It is preferable to the coerced consent provisions

contained in the existing rule.

Finally, I would like to thank the administration for other proposed modifications of the rule, including the clarification to the

marketing, parental consent, parental access, business associations,

and the plan sponsors’ enrollment provisions. I look forward obviously to hearing from the administration on this point. Thank you.

Senator DODD. Thank you, Senator.

Senator Kennedy has temporarily been called away from the

committee and will return shortly. We will get to Mr. Allen briefly

but let me make a brief—I am going to ask unanimous consent to

include the full text of my opening remarks and that will apply, by

the way, for every member of the committee, those who are here

and those who have not shown up yet, to share their views.

OPENING STATEMENT OF HON. CHRISTOPHER J. DODD, A U.S.

SENATOR FROM THE STATE OF CONNECTICUT

Senator DODD. First of all, let me commend our chairman, Senator Kennedy, for convening this hearing on relatively short notice

but in light of the decisions made just prior to the departure of the

Congress for the Easter-Passover break when the news came out

about the change in policy here, we thought it was appropriate to

try and gather together as quickly as we could to express ourselves

on this issue.

7

I do not know of another issue that provokes as quick or as

strong a response from the public as the issue of privacy does, particularly in light of how the world has changed in the last decade.

I often tell audiences at home in Connecticut that on the day that

President Clinton was sworn into office on January 20, 1993 there

were 55 pages on the World Wide Web. To give you some idea how

the world has changed in a decade, today someone suggested I

think the number is maybe almost a million pages an hour get

added to the World Wide Web, or some number like that.

The point is today the use of the Internet and technology to expand information and sources of it, as well as people’s access to information has grown exponentially and there is a growing body of

concern within the public about how much information people

have, what they do with that information, and to the extent people

are able to pry into the private lives and private information.

We would not allow anyone to come rummaging through our

house, to go through our waste baskets, to go through our medical

cabinets and cases. We would not tolerate that, let anyone in our

homes to do it. In a sense, if you can, in effect, do that today by

rummaging through people’s private, most privately held information, then you can begin to get some sense of the concerns people

have.

So the ability to control very personal information is an issue

that is deeply felt by people and it crosses all your traditional ideological and political lines. This is as strongly held feeling among

Democrats, Republicans, liberals, moderates, conservatives as any

issue I am aware of, the issue of privacy.

Since 1996 when the Health Insurance Portability and Accountability Act was passed many of us here have worked to develop legislation to try to protect medical records, and that is what we are

talking about here today, in a meaningful and comprehensive fashion. Unfortunately, we have not yet developed a bipartisan legislative response. Senator Richard Shelby, my colleague from Alabama,

and I chair the Privacy Caucus, co-chair it with colleagues in the

House and the Senate, to give you some idea of the bipartisanship

in trying to work on these issues.

But these are complicated questions. None of us are going to suggest that dealing with this is a simple matter. We have tried ideas

in the past and there are always some unintended consequences

when you deal with this issue, but we have worked on it.

Let me, in response to my friend from New Hampshire, point out

that the Clinton Administration did, in my view, a tremendously

admirable job in developing some very important privacy protections in the medical area. For the very first time patients were

given the right to access their own medical records. I know that is

a radical idea. It is hard to imagine, but for a long time you did

not have any right to see your own information at all and these

rights seem so basic, as I said, that it is hard to imagine they did

not exist before. Imagine the frustration of being denied a request

to see your own medical information or having a telemarketer contact you at home based on targeting data derived from those

records, and that is rather commonplace today. In a very real way,

this is a personal violation in the minds of many, many Americans.

8

The final medical privacy rule was an immense undertaking.

Upon announcing the regulations in late 2000, the Department of

HHS received over 50,000 comments from health care providers, insurance companies, doctors, and patients across the country. The

final rule that took effect did so in April of 2001. It was not thrown

together haphazardly. It was created with an understanding of the

difficulties and costs associated with its implementation. But the

determination was made, correctly in my mind, that medical privacy should not be compromised.

Yet now the Bush Administration has announced its intention to

do exactly that in the views of many of us up here, Democrats and

Republicans. Their proposals would undermine, in our minds, some

of the most important protections that we have worked to establish

over the last 5 years. The administration, as we understand it,

wants to allow health care providers enormous discretion in how

they use your medical records, your most personal and private information, something that in my view you, as a citizen, and you

alone should be the one to make a decision about.

The Bush Administration proposes to remove the provision in the

medical privacy regulations that requires a health care provider to

obtain a patient’s consent in order to share his or her records for ‘‘treatment, payment, and other routine health care operations,’’ and that is a quotation. Those are not my words. Instead, they

want to make it mandatory for providers to inform patients that

their records have been shared. This can be done before or after the

fact, according to the proposal. That is very generous. It is like a

neighbor calling you to tell you that he has read your mail and

gone through your medicine cabinet, except, of course, in the example, in that case you have some legal recourse. Here you would

have none.

The administration claims to be proposing these changes because

privacy threatens the quality and timeliness of care. This, I think,

is unacceptable. There should be no trade-off between quality,

timeliness, and privacy, in my view. All are necessary and all are

obtainable.

I understand that there are instances where obtaining prior consent is not possible, such as emergency care, phoned-in prescriptions to a pharmacy. In those cases the law should allow the provider some leeway. But in general, privacy should not be compromised. It is not necessary. It is a phony argument to suggest it

needs to be done. And I believe that we should be here trying to

protect those rights when at all possible.

Now let me turn to my colleague from Tennessee, who I know

has a deep interest in the subject matter, as well, and my other

colleagues, and then we will get to you, Mr. Allen.

Let me just say, as well, on the issue here, I understand the importance of how sharing information for clinical trials and other

areas can be tremendously important, but the idea that you could

do that after the fact or not letting the patient know about it, that

does not make any sense to me and I think any effort to do that

is going to find a wall of opposition up here in terms of that effort.

At this time I would like to submit a statement from Senator

Harkin.

[The prepared statement of Senator Tom Harkin follows:]

9

PREPARED STATEMENT OF SENATOR TOM HARKIN

I want to thank Chairman Kennedy for scheduling this important hearing.

As health care practices have evolved over the past several years,

and technology has allowed for the rapid mass transit of information, it has become critical to protect individual privacy—especially

as it relates to personal medical information.

If we are not strong on the protection, and vigilant on the enforcement, we will be putting ourselves and our loved ones at risk.

Wouldn’t it be ironic, and certainly tragic, if Americans are actually harmed when they go to a medical provider because their medical records were inappropriately used or shared?

Plain and simple, your private medical records should be just

that—private.

Time and time again, I’ve heard from Iowans who are concerned

about the misuse of their private medical information. Sadly, this

Administration has failed to listen to the voices of the people.

I have worked hard to pass strong medical privacy protections

that make clear that a patient’s medical records are not for sale.

Patients must have a ‘right to know’ how their medical information

is used and they should have the right to say ’no’ by controlling

who has access to this most private of information.

When I talk to the reasonable patients and providers throughout

Iowa, they all share the same advice. Create a system that is not

overly burdensome but appropriately protects individual’s medical

records.

If there were problems with the existing medical privacy regulations, then the Administration should work with the Congress and

the health care industry to fix those problems.

But that is not what was done. This reversal by the Administration sacrifices patient privacy to the alter of special interests.

Again, I thank the Chairman for scheduling this important oversight hearing and I look forward to working with him to find a reasonable and manageable solution that above all else, protects patients.

Senator DODD. With that, Senator Frist?

OPENING STATEMENT OF HON. BILL FRIST, A U.S. SENATOR

FROM THE STATE OF TENNESSEE

Senator FRIST. Thank you. And I want to thank the chairman

and Senator Gregg for the opportunity to hold a hearing today on

an issue that is contentious, as we have seen in some of the opening statements, and almost deservedly so because we all struggle,

really struggle with this balance with information that is among

the most intimate information known to mankind, the information

about oneself, one’s health, one’s past, one’s physical, one’s emotional being, how much that information should be shared.

There are certain advantages of the sharing, there are certain

necessities of the sharing, but how we can build appropriate protections where the ultimate confidentiality, which is critical—it is critical to the doctor and the patient and that doctor-patient relationship and it is critical to delivering the sort of care which really has

made American care the best in the world.

10

But it does boil down to trust, to confidentiality, to security, and

that much influences openness and how much a patient tells a doctor and how much a doctor puts into a record. And ultimately other

people have to access that particular record and it might not be the

same doctor. In fact, it might not be the same doctor. In fact, in

all likelihood, given the mobility of society today, it will not be that

same doctor. Yet to demand the standards that are implied with

continuity of care and seamlessness, something that we all want,

we have to have an accurate recording of that doctor-patient relationship, but in such a way that it is not to be abused.

I have only been involved in this discussion at a policy level for

the last 7 years, 6 years formally, and that balance is tough and

we are seeing it play out before our eyes.

I do appreciate the opportunity for all of us to examine in as objective way as possible the impact on health information confidentiality regulations that were initially introduced in the shape that

we are debating them and talking about them and discussing them

by the Clinton Administration in the closing days, as well as looking at this administration’s proposed modifications to those rules.

I do applaud Secretary Thompson, his staff at the Department of

Health and Human Services, for carefully reviewing these regulations and for proposing adjustments that, I believe, will go a long

way in safeguarding privacy while, at the same time, ensuring that

patients continue to enjoy access to quality health care.

Secretary Allen, I appreciate you being here today to discuss

these proposed modifications in more detail and laying them out in

such a way that we can further discuss them in the following

panel.

The protection of the confidentiality of patient information is critical, but we also need to be extremely careful in this area so that

we do not allow overly, unnecessarily restrictive rules that might

threaten quality of care or the safety of care that patients receive.

This, as I said a few moments ago, is not an easy balance to

achieve.

We have seen the effect of State legislation in certain cases. We

will all be pointing to certain anecdotes and certain case studies,

but we have seen cases where State legislation has gone too far.

In Maine, for example, legislation requiring that patients give consent before identifiable information could be used by providers was

repealed after only 12 days following reports that it interfered with

patient access to prescription drugs and prevented hospitals from

helping clergy and family members even locate their loved ones.

During the past year, as physicians, nurses, scientists and consumers have received the Federal regulations proposed by the previous administration, it became clear that these rules would impose

similar barriers to health care access and quality.

There have been serious concerns raised in other areas, as well.

Over 140 academic research institutions, medical specialty doctors,

hospitals and others wrote to the Department of Health and

Human Services to warn of potential problems caused by the original regulations’ research provisions. They wrote that the rule, if

implemented, ‘‘will seriously impair our ability to conduct clinical

trials, clinico-pathological studies of the natural history and theraVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00014 Fmt 6633 Sfmt 6601 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
11

peutic responsiveness of disease, epidemiological and health outcome studies, and genetic research.’’ While the administration’s notice of proposed rulemaking does

acknowledge that the rule’s deidentification standard raises serious

concerns, I strongly urge the administration to fully address the

concerns raised by the research community in its final rule.

Finally, I would strongly encourage the administration to carefully review all areas of the rule to make sure that it does not unintentionally impede the efforts of our public health officials, as

well as our private health professionals, to respond to bioterrorist

threats and attacks. The original rule’s prohibition on the sharing

of aggregate information could have made it impossible to effectively track and monitor disease outbreaks. I am pleased that some

changes have been proposed in these areas, but because of the importance to quickly respond in these situations, I am hopeful that

the administration will carefully review the entire regulation along

these new lines in this new light.

Again, Mr. Chairman and Senator Gregg, thanks for holding the

hearing today and I look forward to hearing from our witnesses.

Senator DODD. Thank you very much, Senator.

Senator Reed.

OPENING STATEMENT OF HON. JACK REED, A U.S. SENATOR

FROM THE STATE OF RHODE ISLAND

Senator REED. Thank you, Mr. Chairman. Just very briefly,

thank you, Secretary Allen, for joining us today.

These are vitally important regulations. There is no issue in

America that is of more concern to individual Americans from

every region of the country, every sector—everyone is concerned

about the protection of the privacy of their health records and there

are two particular concerns that these regulations raise. One is

whether or not there really will be an effective at least one-time

written consent for the release of health care information and second, whether or not the marketing aspects of these regulations invite the commercial exploitation of medical information, which I

think most Americans would be horrified about. Think of the world

of telemarketing with your health care records in hand and that’s

a frightening thought.

Robert Frost, the New England poet, wrote that ‘‘Good fences

make good neighbors’’ and the real question is whether these regulations are good fences so that we can be good neighbors. I will look

closely and listen closely to the hearing today to see if we have

made progress in that regard, but frankly, this is one of those

issues that you do not have to be an expert to be concerned. You

just have to be an American citizen. Thank you.

Senator DODD. Senator Warner, do you want to make any opening comments?

OPENING STATEMENT OF HON. JOHN W. WARNER, A U.S.

SENATOR FROM THE STATE OF VIRGINIA

Senator WARNER. Very briefly. I just wish to welcome Secretary

Allen, who served the Commonwealth of Virginia with great distinction as our Secretary of Health and Human Resources. Now

12

you have come to Washington to get one of the toughest issues that

anybody has to solve. I wish you luck.

Mr. Chairman, I want to commend my colleague Senator Frist

for all the hard work that he does in this and so many areas related to health care. Thank you, Mr. Chairman.

Senator DODD. With that encouraging note we turn to Senator

Murray.

OPENING STATEMENT OF HON. PATTY MURRAY, A U.S.

SENATOR FROM THE STATE OF WASHINGTON

Senator MURRAY. Thank you very much, Mr. Chairman. I just

ask unanimous consent that my full statement be put into the

record.

Senator DODD. Without objection.

Senator MURRAY. I will just say that this is an extremely complex issue that this committee has been considering for some time

and I think it is very important that we have these hearings today

and further hearings before the administration’s rules take effect

to truly understand this because, as Senator Reed said, this affects

every single American and we had better know what we are doing

and the outcome of that before these rules are finalized because the

impacts could be considerable.

For me, the most important thing is that people do go to their

doctor feeling confident. Otherwise, we may create a situation

where individuals would fear seeking health care and that is absolutely the wrong thing that we should be doing.

So I really look forward to this hearing and further hearings as

we clarify what these rules would mean to general, average people.

Thank you very much.

[The prepared statement of Senator Patty Murray follows:]

PREPARED STATEMENT OF SENATOR PATTY MURRAY

Mr. Chairman, the Administration’s decision—announced on

March 23rd—to revise the regulations implementing medical

records privacy has generated a great deal of concern.

I think this hearing is an important step in better understanding

the implications of these changes and an opportunity for this Committee to again focus on the urgent need to ensure greater medical

records privacy.

As we learned in 1999, the issue of medical records privacy is a

complex and emotional one. There are no easy solutions.

In addition, because of our fragmented health care delivery system, there are often numerous individuals who have—and in many

cases need—access to medical records.

These aren’t just health care providers, and the ability to protect

medical records privacy becomes further complicated by the number of individuals with access.

In 1999, this Committee attempted several times to report out

legislation implementing HIPAA privacy regulations.

Unfortunately, we were not successful and had to default to the

regulatory process to implement privacy standards. Clearly, this

has created many of the problems and concerns.

13

Because of the complexity and expense to providers of implementing these regulations, I supported additional relief for health

care providers, especially smaller hospitals or physician practices.

I supported an extension of implementation because I recognized

the difficulty implementing these regulations.

I also wanted to be sure that providers were able to implement

them correctly and that patient privacy was the focus.

Because there are limited private actions that an individual can

take if his or her privacy is violated, it is critical that implementation is accurate.

In reviewing the Administration’s revised regulations, I have several concerns that I hope can be addressed or corrected legislatively.

I am troubled that the Administration’s changes in the consent

requirements will gut any real protections for patients.

Simply notifying a patient that their information will be reviewed or released is not adequate. Patients must have the right

to consent to this release.

While there are some cases that can be exempt from this requirement, I think that weakening the entire consent requirement does

little to ensure patients that their medical records will be kept confidential.

I also have some real concerns with the ability of parents to have

access to a minor’s entire health care record.

This is one of the issues that derailed legislation in 1999 and is

nothing more than an attempt to impose a national parental consent or notification on all States.

It also serves to jeopardize efforts to improve access to STD or

reproductive health care and mental health care for minors.

The language in the regulation does appear to give providers the

‘‘discretion’’ at releasing information to parents or making it available for review by parents.

If a minor has any concerns or doubts the confidentiality of their

records, they will NOT seek care. The guarantee of confidentiality

has to be explicit, not up to a physician’s or provider’s discretion.

It is also not clear how this provision impacts the language on

State preemption.

For example, Washington State guarantees a minor access to

confidential reproductive health care and mental health services.

This is not a tougher standard than the Federal regulation, so

there is some concern that this regulation could preempt State

laws and protections provided to minors in Washington State.

I hope this Committee will have additional hearings on this

issue. If legislative measures are needed to clarify or correct these

regulations, I hope we’ll take the necessary action.

The failure to implement a national medical records privacy

along with a prohibition on genetic discrimination has created a

situation where individuals fear seeking health care and are not

providing comprehensive background to their health care provider.

The implications of this are staggering and jeopardize access to

new break-through screening and prevention.

14

QUESTIONS FROM SENATOR PATTY MURRAY FOR PANEL I:

Question 1. In developing privacy regulations, the previous administration did not

attempt to impose any new parental rights.

The original regulations simply deferred to the States on parental consent or limitations on parental consent and notification.

There was an effort in this Committee to impose this new national parental review or consent of the entire minor’s health care records. However, as I mentioned

earlier, it was one of the reasons legislative action stalled in the Senate.

• Why did this administration attempt to modify or expand parental consent or

review rights?

• How does this new revision impact States that have not been silent but have

acted to ensure a minor’s access to confidential health care services?

• Does this provider discretion extend beyond the physician’s office?

Question 2. One of the major gaps in the current oversight is the fact that IRB

requirements apply only to federally-funded research.

Private research and some off-shore research are exempt. However, the FDA approval process does provide some mechanism for ensuring the safety of human subjects in clinical trials.

• Can we expand this authority to improve safety or should we expand the jurisdiction of the Office of Human Research Protections at HHS?

Question 3. It is difficult in today’s market-driven research arena to ensure informed consent.

Patients are often facing life threatening illnesses. Parents may have a child who

is facing a devastating diagnosis.

Often, patients are almost begging to get into a clinical trial. They will sign anything or agree to anything. They may not pay close attention to any financial link

the researcher may have to the treatment.

• How can a research institution ensure that patients are fully aware of the risks

associated with the trial as well as the risk associated with the established treatments?

• How can researchers ensure that patients understand the financial link that

the researcher or institution may have to the treatment?

Question 4. I have found that many patients and families are often surprised

when they learn that there is a financial link between researcher and treatment.

They’re surprised when the learn that some physicians or doctors may be receiving some future financial benefit from a drug manufacturer or royalty payments for

a patent.

Of course, in a market-driven economy, it’s difficult to separate what was justifiable compensation and what was provided as way of inducing a bias on the part

of the research.

Many outstanding physicians and researchers receive financial compensation for

their discoveries or their developments—yet this never impacts their hope at finding

the cure or treatment.

To assume that any financial link presents an inherit bias will jeopardize how research is conducted and eliminate incentives for furthering science.

• Would more detailed disclosure requirements be enough to remove any conflict

of interests doubts or allegations?

• How do we provide compensation to those conducting researcher or evaluating

clinical trials?

• Is there a way to totally remove any bias on the part of researchers?

Question 5. We place a great deal of oversight responsibility into the hands of the

Institutional Review Board (IRB). But it appears there is limited oversight over the

IRB or even the selection process for a local IRB.

We know of cases of IRB shopping—where a researcher will simply apply through

different IRBs despite being rejected or limited by another IRB.

Once a researcher receives the approval of the IRB, the issue of monitoring becomes questionable.

• Would further accreditation of IRBs serve to standardize and improve the process?

• Would established criteria for all IRBs, including the scope and timing of research review ensure greater safety?

• How can we work to guarantee that IRBs have pediatric expertise or pediatric

knowledge?

Question 6. Recent press accounts of safety problems and violations in clinical

trials have generated a great deal of concern.

• Has the public lost confidence in clinical trials?

15

• Is the lack of confidence or the issue of safety to blame for low participation

rates in clinical trials?

• Will addressing some of the safety gaps restore confidence?

Clinical trials are a vital part of our health care structure. If we are forced to wait

until we eliminate any and all risks, we will lose too many patients and too many

children. Greater access to clinical trials can mean the different between life and

death, especially for pediatric cancer cases.

Senator DODD. Thank you very much, Senator.

With that, Mr. Allen, we welcome you to the hearing on behalf

of all of us here. Claude Allen is the Deputy Secretary of Health

and Human Services. He is testifying today on the issue of medical

privacy. He is now taking a leading role at HHS on a number of

critical issues, including medical privacy.

As the former Secretary of Health and Human Services for the

State of Virginia, as has already been pointed out by Senator Warner, Mr. Allen has a great deal of experience working with health

care plans, State welfare, and access to care issues. So we are delighted to have you here with us, Mr. Allen. We are looking forward to your testimony.

We will include any materials, by the way, and supporting documents that you think are worthwhile for us to have as we go forward. So consider any additional information that you would like

to have part of the record to be included. With that, we will accept

your testimony.

STATEMENT OF CLAUDE ALLEN, DEPUTY SECRETARY,

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Mr. ALLEN. Thank you. Good morning, Mr. Chairman, Senator

Gregg and the Members of the committee. Mr. Chairman, thank

you for your leadership and devotion to health issues. Senator Kennedy has given much attention to these issues over the years and

it has been a privilege to work with him over the course of this last

year on this and many other issues that affect the health care of

all Americans. We both share a passion for ensuring the confidence

of every American to know his or her medical records remain private, and on behalf of Secretary Thompson and myself, I want to

thank Senator Kennedy for his friendship, his support, and his

counsel during this last year.

Senator Gregg, I also wanted to extend the Secretary’s and my

thanks for his wise counsel, his friendship and his support during

this last year, as well. I also want to thank Senator Gregg for his

leadership on this committee and in the United States Senate on

behalf of the people of New Hampshire and America.

Senator Frist, your service to this country as the Senate’s only

physician is invaluable to all of us and we thank you for that. It

has been a real privilege to work with you, not only in the areas

focussing on health care, but also in terms of looking beyond the

shores of this country, to Africa and your work there on the Foreign Relations Committee and looking at health issues globally, not

just domestically. So thank you for your leadership in that regard.

Members of the committee, I am here this morning to describe

and discuss our changes to strengthen the proposed privacy rule.

I welcome the opportunity to appear before you and the committee

today to discuss this important issue.

16

Last April, President Bush stated his desire to provide for the

first time strong patient privacy protections at the Federal level.

Prior to implementation of the proposed privacy rule, the President

directed Secretary Thompson to review the rule and to recommend

modifications to it that would identify and correct unanticipated

consequences that might impede a patient’s access to care or harm

the quality of that care while, at the same time, ensuring strong

privacy protections. The proposed rule achieved this goal.

I am pleased to say that beginning next April, for the first time

all Americans will have the right to require written authorization

before their personal medical records are shared with employers for

employment decisions or given to life, disability or other insurers

or for marketing purposes. They will have the right up front, the

first time they see a doctor or a health care provider or enroll in

a health plan, to be notified of their privacy rights and how their

information may be used or disclosed by the provider or the plan

so they may understand and discuss any concerns with their providers and plans and get care that is consistent with their own personal preference.

Additionally, they will have access to their own medical record

and the right to correct it if it contains incorrect or incomplete information.

Mr. Chairman, since the release of the proposed modifications to

the rule, most of the attention has focussed on the issue of what

is referred to as consent and notice, so I will begin with these provisions. We put ourselves in the shoes of the patient and we discovered the rule was not practical for patients, their doctors or pharmacists. Therefore, we tried to make changes that made the most

sense from the patient’s perspective. Our proposal gives patients

more control over where their information goes and gives them fair

notice of how their information is used while, at the same time,

providing the patient with what matters most—unimpeded access

to quality care.

The new rule enhances the obligation that covered entities give

notice of their privacy practices to their patients by requiring a

good faith effort to get patients to acknowledge receipt of their privacy practices. The practitioner can still seek voluntary consent

from their patients. Nothing in this proposed rule prohibits consent

to normal treatment documents that doctors and hospitals use

today. Patient authorization is still required before doctors, hospitals and other direct treatment providers could share personal

medical records for non-routine purposes, such as disclosures to

employers for employment purposes and marketing.

However, patients would expect that their doctor, their hospital

or other direct treatment provider could share medical information

for those core activities that are essential elements to providing

health care to the patient. Patients would continue to have the

right to request restrictions on uses and disclosures of their health

information.

Real life examples provide the best illustration of why we made

this change. Under the previous proposal, if a patient wanted or

needed to receive care from a doctor he had to choose between signing a consent form prior to seeing his doctor and not receiving care.

This requirement was the same for all providers. Mandating conVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00020 Fmt 6633 Sfmt 6602 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
17

sent is coercive in nature and does not provide meaningful control

for the patient.

Now imagine that you have a twisted knee or a sore back that

limits your mobility. You sign the form. The doctor sees you and

recommends that you see a specialist and writes you a prescription

for pain. The consent you signed only allows that doctor to treat

you, but does not allow the specialist and pharmacist to look at

your record or to provide your health care services.

Therefore, before you can get that prescription filled you have to

hobble to the pharmacist to sign another consent form. It is the

same routine for the specialist. You have to go to the office to sign

another consent form before you can make an appointment. And

forget about doing it over the phone.

Now, after seeing the specialist a few days later, she determines

that you need surgery. First, she wants to take an MRI. This requires another trip to sign a consent form before the appointment

is made and then you have to do the same for the MRI, and it goes

on with each step.

This is the impractical reality that we faced as we looked at how

to implement the December 2000 rule. We viewed the mandatory

consent as coercive and a fundamental hurdle to health care for patients and the doctors, hospitals and pharmacists that serve them.

In addition, the previous consent form did not contain any information about what the patient’s rights were and the privacy practices of the provider. That was an additional form. So we combined

these into one form that would provide patients with all the information they needed to exercise and understand their privacy rights

and protections.

Now, Mr. Chairman, I would like to describe briefly other important changes. From the comments we received, the area of marketing seemed to satisfy no one due to its complicated nature. Therefore we simplified it while strengthening it at the same time. The

proposal prohibits explicitly using or disclosing a patient’s information for marketing without the individual’s expressed authorization. At the same time, the proposal would permit doctors, hospitals, pharmacists and health plans to communicate freely with

patients about individual treatment options and other health-related information, including disease management, case management,

and care coordination. We did not to interfere with valuable communications between patients and doctors over new treatments

they feel their patients need to know about. Nor should we interfere with programs that provide important information to those

who suffer from chronic diseases, such as diabetes. Nor should we

stop pharmacists from sending refill reminders to those customers

who are on maintenance medications, such as blood pressure or

cholesterol-lowering drugs.

Our goal is to expand the definition of what marketing is in the

old rule, defining more communications as marketing and thus requiring authorization and limiting direct communication to those

things affecting a patient’s immediate health care needs. We believe we have accomplished this goal. However, we recognize that

others may see opportunities to expand further the definition and

we welcome their input.

18

We also found an unintended consequence in the areas of parents

and minors. In order to provide clarity to the proposal, we made

limited changes to clarify that State law governs disclosures of a

minor’s health information to a parent or guardian. The intent of

the current rule was never to override State law. Over the years,

States have developed a rich and broad legislative and legal history

in this area and we wanted to preserve it rather than confuse it.

In cases where State law is silent or unclear, the revisions would

preserve State and professional practice by permitting a health

care provider to use the discretion afforded by State or other law

to provide or deny a parent access to such records.

Just as State law now determines when a minor may be treated

without parental consent, so too would the revisions effectively

defer to State law on access to and control of the minor’s information that results from such treatment.

In the area of research, we simplify the provisions, removing the

burdens on research and covered entities alike so the Nation’s wellrenown medical research can continue at a vigorous pace, but with

renewed confidence in patients that their personal medical information will be protected. The proposal would permit researchers to

use a single combined form instead of having multiple consent

forms. The single form would contain informed consent and privacy

rights information. The proposal would also simplify provisions on

obtaining a waiver of individual permission to access records for research purposes so as to follow more closely the requirement of the

common rule which governs federally-funded research.

We also are seeking comment on the feasibility of making health

information that does not identify directly the patients, but is important for research more readily available for researchers. To accomplish this, the department is seeking a consensus as to the type

of information that would identify directly an individual and continue to be excluded from the proposed limited data set. To protect

privacy further, we propose to condition the disclosure of this limited data set on a covered entity’s obtaining from the recipient an

agreement in which the recipient would agree to limit the use of

the data set for the purposes for which it was given, to not reidentify the information or use it to contact any individual.

Other changes that I would be happy——

Senator WELLSTONE [presiding]. Mr. Allen, I do not want to interrupt you and thank you so much for being here. If you can, I

know there are many questions and a whole other panel and I

might ask you to eventually summarize. It is very important testimony and I apologize for being impolite. I just want to make sure

my colleagues have a chance for questions.

Mr. ALLEN. Senator Wellstone, I am about to finish up right now.

Senator WELLSTONE. Thank you. Then I apologize.

Mr. ALLEN. Other changes that I would be happy to discuss in

further detail during questioning include the clarifying and encouraging of public health reporting of adverse events and other postmarket surveillance of the FDA, clarifying that a doctor can discuss

a patient’s treatment with other doctors, nurses, and health care

professionals without fear of violating the rule if they are overheard inadvertently, providing model business associate contracts

provisions and allowing up to an additional year for most covered

19

entities to make their business associate contracts compliant with

the rule, and permitting the sharing of information among health

care providers and health plans for each other’s treatment payment

and quality-related health care operations.

I want to assure you that Secretary Thompson and I are committed to working with this committee and Congress on a bipartisan

basis to strengthen the privacy protections while preserving access

to quality of health care. The need to get strong privacy protections

in place now is a commonly held goal that transcends partisan politics. We owe the American people a privacy rule that works and

they deserve no less.

I want to thank you again for the opportunity to be here today

and I appreciate your interest and commitment and I am happy to

answer any questions that you have at this time.

Senator WELLSTONE. Thank you very much. I guess what we

ought to do is maybe go 7 minutes each. Is that okay, Senator Warner?

I want to thank you again for your testimony. Mr. Allen, I want

to ask you about the administration’s decision to eliminate the patient consent from the privacy rule. That is obviously, I think, for

people in the country a great concern. To me, consent is the centerpiece of patient privacy. It is what gives the patient a real say in

health care and I also think helps restore confidence in the health

care system.

Now we know that there are glitches in the privacy rules that

need to be fixed and I accept that. For example, pharmacists

should be able to receive prescription refills over the phone and a

patient should be referred to a specialist before consent is given.

But why did not the administration address these problems in a

more narrow manner instead of throwing out the underlying consent provision? I want to ask a question that I think goes to the

heart of what I think will be the debate in the Senate and I think

the debate in the country.

Mr. ALLEN. Let me start out by first of all saying that we have

not thrown out consent altogether. The modifications to the rule

simply removes the requirement for mandatory consent at the initial meeting. We have allowed that providers can continue to seek

consent and we would encourage that providers seek consent from

their patients.

The primary reason why we have moved from a mandatory consent to require a mandatory notice regime is because of the interference that consent would provide for the patient receiving care.

It was very clear under the rule that you had an option. If you

were a patient and you presented to the physician, if you did not

sign the consent form a provider could refuse you care. It is that

plain and simple. A provider could refuse you care because you did

not sign a consent form.

So therefore, consent was not the issue that we were trying to

fully address here. We are trying to fully address ensuring that patients had adequate access, access to quality care but, at the same

time, had their privacy rights respected. Therefore, what we did is

after receiving an outpouring of comments—during the 30-day comment period we received approximately 11,000 comments—we

20

began to focus on the issues that were being raised and the issues

went far beyond simply the pharmacist example.

For example, it also impacted emergency care providers that required an emergency care provider to, once they deliver you to the

emergency room, they are off going to follow on the next emergency, but they still had to somehow double back to try to locate

you to get you to sign a written consent form and that simply was

unworkable.

The issue with specialists, again that is an area that raised considerable concerns. We also had issues of those who did not even

have direct personal contact with you—in this area we are talking

about advancing technology, in the area of telemedicine—that we

would require someone who you would have contact over the telephone before they can engage you would have to get a written consent. These were all items that were unworkable and therefore we

sought a mechanism that allowed us to go further by requiring notice on your first visit of that practitioner’s policies in terms of how

they would treat your information and give you a meaningful opportunity to engage them on providing restrictions to the use of

that information.

Senator WELLSTONE. I want to ask one other question for the

record to begin to cover some of what I think are the concerns. Let

me just say I thank you for your answer. In some ways I think

what you did was sort of speak to the question I raised in that

again I think some of the problems you raised could be addressed

in a more narrow manner. But again I think the problem is you

just basically eliminate the underlying consent provision and I

think that what you are going to hear from some of us in the Senate is yes, you are right; it is more than just pharmacists, but there

is a way of addressing these concerns—for the record I want to say

this—without undermining the entire consent provision, and I

think that is going to be the nub of the debate.

Now one other issue before I run out of my time. It has to do

with the marketing of people’s private medical information. We

have all heard stories where a pharmaceutical company gets information that a patient has been seeing a counselor and then starts

marketing antidepressants.

In this regulation you have changed what counts as non-marketing and what is therefore not subject to the protections in the rule

and they include, and I quote, ‘‘recommending alternative treatment therapies, health providers or settings of care to that individual.’’ This is not counted as marketing.

So basically that means that any communication that encourages

a patient to use a product or a service related to health is not marketing, even if they are paid to make that communication. Now if

that is not marketing, I do not know what it is and I am concerned

that we have created a major loophole here that allows people to

have their private records used for marketing purposes. And I wonder whether you could help me understand this change.

Mr. ALLEN. I would be glad to try to do that, Senator.

What we did in the rule, under the prior rule it prohibited the

sale of personal health information without authorization or consent and required that it was a much—we thought that we have

broadened the restriction or strengthened the privacy rights of inVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00024 Fmt 6633 Sfmt 6602 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
21

dividuals because what we did is that we more narrowly determined what was going to be marketing and then required a direct

authorization from the individual for marketing purposes.

Under the prior rule what would happen is that there was a

broader definition of marketing, but what had to happen is there

had to be a disclosure of whether you receive remuneration or not

from that purpose. In doing that, you had a situation that we were

concerned about and heard about from the comments and that was

if you had, for example, a provider that gets reimbursed for participation in continuing medical education conferences—let us say they

get travel reimbursement—to continue their medical education, if

they then later had a client or patient that had a condition and

they thought that that treatment regimen, that pharmaceutical

product or that device might benefit them, they would have to go

through an issue of determining whether they would be marketing

to their client and to their patient.

We have great concerns about again interfering with the treatment decisions that would be important to that patient-physician

encounter. So therefore we broadened it and said that what was

not marketing were issues that dealt with care coordination, issues

that dealt with treatment, issues that dealt with disease management. These sort of items were not determined to be marketing.

What we did do, though, is that we also limited marketing in the

sense that where—if it was not related to treatment of the patient,

that that patient would have to give prior authorization for someone to send information to them in terms of marketing.

So we think that we have approached this in a very balanced

way that once again gives considerable weight to patients having

access to information that affects their health and their determination of what is in their best interest and their physician’s best interest of their health care outcomes.

Senator WELLSTONE. Well, I am going to turn to Senator Frist.

I mean, we want patients to have access to information that affects

their health, but what we do not want is the sort of indiscriminate

marketing of people’s private medical information.

Mr. ALLEN. Certainly, and we think that we have narrowed this

down sufficiently enough that in this regard we will defer in many

cases to that patient and that physician, first of all, in that initial

encounter, determine what those practices are, particularly as it relates to marketing, particularly as it relates to that patient’s treatment decision-making. But we then narrow the scope and require

affirmative disclosure and seeking authorization for further marketing of materials that might be unrelated to the treatment of

that patient.

Senator WELLSTONE. I thank you. I think we have too much of

a loophole here and I do not think you have narrowed it down the

way we need to, but I certainly appreciate your thorough answer,

and thank you.

Senator Frist.

Senator FRIST. Thank you, Mr. Chairman. Both of those issues

that were just talked about, consent and care and the marketing

provisions, are very important and I think in the second panel we

will be coming back to the marketing provisions in the testimony

that was sent to us because it is important, I think, to make sure

22

that in this narrowing process that the net effect is not to weaken

the privacy rule itself.

But let me move to another topic, Secretary Allen, and that is

on the research and public health and deidentification, issues that

I mentioned in my opening statement. I very much agree and applaud the proposed change that would reduce that burden, that

overly restrictive burden on scientists and research entities by requiring a single combined consent form rather than the multiple

consent forms that were initially proposed by the previous administration.

I note that the department is also considering changes to the proposed rule’s so-called deidentification standard so that information

could be used for research or public health purposes if it is facially

deidentified, but still maintains or retains the important information for environmental health studies, infectious disease tracking.

That would include things like zip code, date of service.

I am very concerned that the previous administration’s

deidentification standard is much too stringent and could significantly slow down, hinder or impede efforts to track infectious disease outbreaks or to conduct public health investigations that

again I mentioned in my opening statement that are important to

surveillance, detection and response. It could also significantly

skew the results of epidemiological research studies, which routinely use admission dates and discharge dates and dates of death

to track and help us more fully understand disease.

In this area why is the administration seeking additional comment rather than proposing a rule up front, as it has with other

areas in this proposed rulemaking process?

Mr. ALLEN. We believe that research in the United States is by

far the very best in the world. We believe that we want to make

sure that that research is able to continue and exactly for what you

have cited, Senator, and that is that we not only need to be able

to track infectious diseases and gather population-based information so that we can plan; for example, trying to address chronic disease. We are working very aggressively within the department,

working with the National Institutes of Health and with the universities around the country who are looking into these issues and

we were very concerned that by, up front, us proposing what we

do not have all the answers to, and that is how significant and

what is the best method of deidentifying data so that you protect

the privacy rights of the individual, but we do not impede the advancement of research. So those were the balancing issues that we

had to look at.

Under the proposal we have laid out as an option for

deidentification two alternative methods. One was to use what is

known as basically an appropriate person who has knowledge and

experience in statistical data and being able to say whether they

thought that there was a greater risk or less risk of identifying the

individual based upon the release of that information. You can get

basically somewhat of a certification that that individual has made

that decision or you had an alternative method where covered entities would have to remove all 18 identifiers.

23

We were concerned about both of those and therefore we felt it

probably was best to allow the research community to offer comment on that, rather than us try to— Senator FRIST. Have you gotten feedback from the research community? Their initial letters we have shared with each other and

shared with you from the research community. Has it been long

enough to get a feel for their response?

Mr. ALLEN. We have gotten a few and because the comment period is still open I cannot close out the options for more coming in,

but yes, we have begun to hear from the research community and

we think that we are getting information to assist us in terms of

how best to approach creating a limited data set, and that is really

what the ultimate goal is, is what is the limited data set? That is,

what are the limited number of identifiers that would be necessary

to one, provide the information that we need for epidemiological research, et cetera, but, at the same time, to maximize the privacy

protections of the individual so that their identity is not disclosed

inadvertently or intentionally.

Senator FRIST. Let me return to this whole concept of consent

and care, because as a physician, the previous administration’s proposed consent rules would have placed me as a physician or physicians generally in a very difficult position with respect to their patients in terms of care delivery, but also from an ethical standpoint.

It seems to me that it would have required me not only to provide notice of my privacy practices, the standards and the guidelines that would govern my own practice, but also would expressly

allow me—in fact, it would have required me to withhold or deny

treatment to those patients who failed or refused to provide me

with a written consent. That is my interpretation just from reading

it. It also seems to place patients in a difficult and an untenable

position of signing a consent form or not receiving that care.

You said in response to Senator Wellstone’s questions that this

is one of the key areas in which the administration is making

modifications to the rule. And again I know we are in this comment

period. Are patients and physicians responding to that objection

and to the proposals that have been made?

Mr. ALLEN. That is certainly what precipitated us making the

proposed change initially, is that we had heard from patients, physicians and practitioners, all within the health care continuum.

That would be providers, hospitals, plans, and patients.

The problem with it was, as we have identified, it was unworkable because what you were putting the patient in the position of

having to do is having to choose between signing a form that you

may or may not understand or agree with and getting care that

you need immediately. It put you in that conundrum, but also it

put the practitioner in an even more difficult position in that if you

see that client more than once, you were almost put in the position

of requiring a consent form be signed every time that patient came

in because of the revocation requirement. You would have to track

whether that patient revoked his or her consent.

So it was very difficult to do that and from an administration position it was very difficult for us to be able to address it because

we can only address these issues once a year, so we would be put

in a very difficult position that if there were a problem identified,

24

if we had made changes already that year, we could not take action

to make another change in that area, whether it was consent or

somewhere else, for another year, and that raises serious concerns

for health and safety.

Senator FRIST. I see my time has expired. Let me just add that

physicians and patients and others would ask me about emergency

rooms in response to acute care, as well as the problems with pharmacies themselves.

Thank you, Mr. Chairman. My time has expired.

The CHAIRMAN. Thank you very much.

Mr. Allen, thank you again. I know that you are very much

aware that these consent requirements were not part of the original Clinton proposal and then after they had a great many hearings, public hearings, really the American people spoke and they

spoke with such a sense of urgency about the importance of medical privacy that they made these alterations and changes.

Now you have made a different recommendation on the way to

proceed on this. When you were considering what other changes

should be there did you consider maintaining the proposal on consent and trying to deal with some of the principal areas—for example, the prescription drugs, the scheduling of doctors visits, which

were really the primary kinds of areas, as I understand on the

basis of public hearings, where they would have to be altered or

changed?

My question is why not maintain the consent form and adjust it

to take in to consideration some of the legitimate issues and questions, rather than going in a different direction, instead of going to

a situation where they will be notified and they will be then on sufficient notice about what is happening to their medical records?

Mr. ALLEN. Mr. Chairman, I think it is very important, as you

point out, that with the prior administration they went from one

position to a totally opposite position and we were—

The CHAIRMAN. Granting greater privacy. You would not question that.

Mr. ALLEN. I think what we would question is whether that effected greater privacy in reality for the patient, from the patient’s

perspective.

The CHAIRMAN. Wait a minute now. You do not think an individual having control over their medical records is greater privacy for

that individual than the recommendation that you made?

Mr. ALLEN. I think certainly an individual having greater control

over the information about them is significant, balanced against

them making sure—their primary reason for going to a physician

is not privacy. Their primary reason for going to a physician is

care. And if we put paperwork in the way of them accessing care,

period, regardless of whether it is quality of care, the first idea is

getting care. And the consent provisions as they were proposed,

from the pendulum swinging from no consent provision under the

prior administration to an absolutely mandatory written response,

that pendulum swinging created the conundrum of putting patients

at risk of not receiving any care at all.

The CHAIRMAN. This is the committee that wrote that requirement in, Mr. Allen. It is because this committee was concerned

about the issues of privacy that we put it in. So we do not have

25

to be reminded about the requirements because we said that unless

we were going to take action, that the administration was going to

because it was such a sense of urgency.

And what you are talking about now is the question of the privacy of the records versus care. Of course, we probably have a difference on this. We have taken notice of what has happened in the

types of discrimination against individuals on the basis of genetic

information and how that can be abused by insurance companies.

Mr. ALLEN. Certainly.

The CHAIRMAN. And we have taken notice, as well, in terms of

particularly in the areas of mental health, as well as the marketing

of various prescription drugs.

Now I know, as I understand, you have made a response, I believe to Senator Wellstone, about the kind of protections that you

believe are going to be adequate to effectively protect patients from

the abuses that can take place from marketing private information.

Am I basically correct, that you believe that the provisions that you

have, the new regulations, are going to protect people’s privacy

from the marketing of sensitive information—for example, the

needs that a person would have with regard to mental health or

whether someone is an AIDS patient?

Mr. ALLEN. We believe that we have, under this proposed rule,

we have strengthened the marketing provisions to protect patients

from the nonhealth disclosures of information that they would reasonably expect not to occur, whether it be in the case of HIV–AIDS

status or the other inadvertent or intentional uses and misuses of

that information. So we believe these proposed changes do effectuate that.

In terms of what you cited, Mr. Chairman, you talked about genetics and mental health. I think it is important to note that as

Senator Warner has already pointed out, as the secretary of Health

and Human Resources of Virginia, Virginia is a State that protects

its information, genetic information, from being used to discriminate in employment. We think that that also is an area of high importance at the Federal level, that this rule does not deal specifically with genetic information except for in terms of it prohibits an

employer from using health-related information for employment decisions, period. It puts it as a prohibition with two very minor exceptions that we have to recognize, and that is in the case of

ERISA, where an employer is a group plan. But that employer

must also take precautions not to use that information inappropriately for employment-related decisions.

So we believe that we have struck the appropriate balance, which

would weigh in favor of the patient getting care, and weigh also in

favor of strengthening and giving the patient the maximum protection of privacy of their information, but also not preclude them

from having the ability to authorize, if they choose to, that information going other places, whether it is for marketing or other purposes.

The CHAIRMAN. Well, I like what you say. The question is whether this language does exactly what you say. Now I have the regulations right here and this, as I understand, will still make permissible recommended alternative treatments—this is one of the exVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00029 Fmt 6633 Sfmt 6602 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
26

ceptions—therapies, health care providers, or settings of care to

that individual. This is on page 14,790.

Now that seems to me, you say that this is not marketing, even

if someone actually is involved in those kinds of activities, as I understand it.

Mr. ALLEN. Senator, I do not have that paper in front of me.

The CHAIRMAN. I apologize.

Mr. ALLEN. If I understand what your question is——

The CHAIRMAN. Because this is not an enormously new section.

As you are very much aware, there have been questions about the

administration’s proposal and there have been serious questions

about the rule about how sensitive information could be used and

those that have been critical have referred to this language that

says, in the particular regulations, the basic definition. The point

is that the definition means any communication that encourages a

patient to use a product or a service related to health is not marketing, even if they are paid to make that communication. If that

is not marketing, I am not sure what is and I am concerned that

we have created a major loophole here that allows people——

Mr. ALLEN. Not at all, Senator. We do not believe that this is a

loophole. Again we approached this from the perspective of the patient. If a patient has a particular condition, whether it be hypertension or allergies, for example, and the provider who is working

with that patient has access to the latest and greatest information

and product that that patient should know about, that that physician believes that it is in the best interest of that patient to have

an opportunity to choose to change from, we have made this language allow for that to occur. It does not interfere with the patientphysician encounter.

What it does narrow it to is it has to be related to treatment for

that individual and therefore that is what we have said is not marketing. We believe a patient should have access to that information.

The CHAIRMAN. The fact remains that under this language, as I

understand it, individuals may very well receive a publication from

a drug company about alternative AIDS treatments or alternative

AIDS care centers or alternative mental health advertising and it

could be received in their home or in their place of business.

Mr. ALLEN. First of all, I think I need to approach it that the patient, stepping back, the patient has an opportunity to determine

where that information will be received if it is going to be received.

The CHAIRMAN. If they have gotten notice.

Mr. ALLEN. Let me walk through it if I may, Senator.

The CHAIRMAN. If they have gotten notice.

Mr. ALLEN. Mr. Chairman, let me walk through if I can. At the

very first encounter with that patient’s physician, that patient will

have discussed or have the opportunity to know what those practices are of that provider in terms of how they will use that information. Once that is determined and they agree with that—if they

do not agree with it they can negotiate with that provider that that

information not be used at all. If the provider says ‘‘No, we will use

this information,’’ the patient has the choice to say ‘‘I will seek

other care elsewhere.’’

27

Once that is done, that information that you have described is

information, if it is consistent with treatment, it can only be approved for being sent to that patient by the covered entity, by the

entity that has a relationship with that patient in terms of his or

her treatment.

Therefore, the idea that some unrelated company out there is

willy-nilly getting access to that patient’s information, we believe

that we have addressed that in this rule, that it would be inappropriate, it would be a violation for information to end up in the

hands of a third party that has no connection whatsoever either to

the patient or to the patient’s provider and thereby we believe that

we have narrowed and limited that type of unsolicited or unrelated

solicitations to that patient.

Where it can occur that a covered entity—let us assume it is a

pharmacy that is working with a patient and in the case of disease

management or in terms of a prescription being refilled—that pharmacist, the covered entity, can have a business association with a

company that they have relegated or delegated that responsibility

for notifying that patient that your prescription has come due and

we think that that is an appropriate use of the information to serve

the patient in terms of his or her treatment.

The CHAIRMAN. Well, I think we need strong language that

makes very clear the protections of the privacy of the patient in

this area and we will have an opportunity to consider that. Thank

you very much. My time is up.

Mr. ALLEN. Thank you, Mr. Chairman.

The CHAIRMAN. Senator Warner?

Senator WARNER. Thank you, Mr. Chairman. I think we have

had a very constructive hearing this morning. It is not over yet, but

the point I wish to make is that Congress really has not been able

to resolve these tough issues since 1996 and basically we have just

forfeited this to the successive administrations of two Presidents to

try to solve it.

I have to assume that this administration, as did the previous,

in a very conscientious and nonpolitical way—there should not be

any politics, in my judgment, involved in this thing if we can avoid

it—is trying to do what is best for the health care industry and patients. But these issues are at the very heart of our health care system and as I sat and listened I have one question and then one

observation.

The second panel will come forward hopefully with good constructive viewpoints on how things can be changed. You still have

an open mind, do you not?

Mr. ALLEN. We are required to by law.

Senator WARNER. Well, what about just following the law to the

T? Keep that open mind because I think a lot of conscientious people are working on this. And I guess my question would be many

have stated that a much more targeted modification could have

been made that would have improved access to care while maintaining stronger privacy protections. Did you consider a less restrictive alternative in your deliberations?

Mr. ALLEN. Senator Warner, yes, we did. We went through this

and tried to find ways to make the consent provision work, but the

bottom line, as we have already stated again, is that the issue was

28

not—the consent did not give a patient control over the information. It actually took control out of that patient’s hands and put it

into the hands of the provider, who was forced to make a determination of whether you sign a piece of paper or not and determine

whether you got treatment.

When we looked at it we tried to address the issues of the pharmacist. We tried to address the issue relating to specialists. We

tried to address the issues related to emergency care. And we went

down the list and again and again it came to a place where we either were going to have a rule that applied broadly or we would

have a narrow exception that addressed every specialty group that

existed out there.

I think the goal that we were trying to achieve was one that had

a flexible approach, but a consistent approach across the board,

that took into consideration that we want to maximize two things.

We wanted to maximize the patient’s ability to get care, but also

wanted to maximize the patient’s ability to control their ability to

have their public health information shared outside of treatment,

payment and operations that reasonably a patient would assume

that their information would be used for.

Senator WARNER. If all the best intentions that you and your colleagues have manifested thus far simply prove in practice not to be

workable, particularly the enormous costs that the hospitals and

other health care deliverers, physicians are going to have to bear,

you would be willing in the future to reopen this thing under the

process prescribed by law?

Mr. ALLEN. Yes, Senator. Under the law we would be allowed to

revisit this issue once a year and that is why, that one point, under

the rule, under the statute, we were only allowed one time a year

to make changes. We were concerned that we would be put into a

position that we would have made a change and then have other

issues, unanticipated issues arise that were a detriment to the furtherance of either access to care or took away from the privacy

rights of the individual and would not be allowed to address them,

and that was an issue that we felt very strongly that we needed

to weigh in on the side of maximum flexibility so that we can work

it throughout the year without having to use that one-time-a-year

exercise to try to address every problem that arose in the interim.

Senator WARNER. Well, I think you have delivered the administration’s care very professionally and quite well.

Mr. ALLEN. Thank you, Senator.

Senator WARNER. Time will tell. Thank you very much. Thank

you, Mr. Chairman.

The CHAIRMAN. Senator Clinton?

Senator CLINTON. Thank you, Mr. Chairman. I very much appreciate Senator Warner’s comments because I think all of us are looking for an appropriate way to handle this new world of information

that is out there and to protect people’s right to privacy, especially

the most personal and intimate information and details about

them. So I am grateful for the recognition that this is probably a

moving target to some extent that we will evolve a response to because I feel very strongly about the right to privacy and I also understand the need for health-related organizations to have access

to good information.

29

But I must confess, Mr. Allen, I am confused and it may be that

this is such a complicated, difficult area that it is hard to follow,

but I just wanted to run through a couple of issues.

As I understand what the administration is proposing, we no

longer will require affirmative consent, but instead, an acknowledgement that information about privacy rights has been provided.

Is that correct?

Mr. ALLEN. It is correct in the sense that we do not require that

a written consent be given.

Senator CLINTON. Right.

Mr. ALLEN. It does not preclude an entity from seeking consent.

Senator CLINTON. Well, that is what is interesting to me because

as I study what you are proposing, on the one hand we no longer

have an affirmative consent process, but you do permit entities to

go ahead and voluntarily seek consent.

Mr. ALLEN. And there is a good reason for that. The reason is

this, that in some cases you may have, for example, a hospital that

already has consent for treatment, which is what we call informed

consent. They may want to go ahead and still have consent for

using that information that will be consistent with treatment.

Therefore some entities may choose to seek a written consent from

a patient, but what we have not done is we have not required everyone to do that.

Senator CLINTON. But what you have done is when an entity

does choose to require consent you have eliminated many of the

consent requirements that would apply to the voluntary request for

consent.

Mr. ALLEN. And again the reason for that is because we are trying to maintain flexibility—— Senator CLINTON. But you are trying to have it both ways.

Mr. ALLEN. If you would let me answer my question?

Senator CLINTON. Mr. Allen, let me finish because I am trying

to——

Mr. ALLEN. You asked me a question and let me answer the

question.

Senator CLINTON. No, but let me pose the question.

Mr. ALLEN. I thought you already did.

Senator CLINTON. No, I did not, Mr. Allen.

Mr. ALLEN. Well, go for it.

Senator CLINTON. Thank you, dear.

Now if you are on the one hand not requiring consent and then

on the other hand when someone voluntarily pursues consent, you

eliminate what the original rule had in for the provisions of consent, it seems to me you are going after consent from both ends.

Either you offer it or you do not offer it, but when it is voluntarily

chosen you undermine it. And I think if you look at what you have

done to eliminate that in the name of flexibility, you have essentially vitiated consent even if someone voluntarily chooses to pursue consent.

Mr. ALLEN. And your question is?

Senator CLINTON. Why have you done that?

Mr. ALLEN. First of all, I would beg the question that we have

not done that. I think what we have done is we have strengthened

the process by one, when we remove mandatory written consent in

30

terms of the rule we have now enabled a patient to get care, plain

and simple. But, at the same time, we have enabled a patient for

the very first time under this rule to have information about the

practices of the provider, to have opportunity to review those practices and engage in a discussion about those practices and seek to

restrict the uses of that information. That is all essential for protecting and providing protections for an individual in terms of how

that information is used. That does not happen. That will now happen under this proposed rule that did not happen under the former

rule.

Beyond that, we have also provided again—we have not precluded entities from seeking to get a written consent and that written consent, we are not dictating the confines of that because again

it is voluntary. It is something that some providers may seek; others may not. But what we can guarantee is that that patient will

get information and notice of the practices and procedures of that

entity, and that is what we think is essential to the decision-making of the patient, but also to the continuity of the care that that

patient will receive from that provider.

Senator CLINTON. But you are also eliminating the requirements

that the covered entity inform the patient it is receiving remuneration for making the communication, you are eliminating the much

more restrictive definition of marketing so that very often a poor

patient will receive information and will not know that there is a

financial interest in the entity providing it.

Mr. ALLEN. What we have done is a couple of things, again, Senator. One, in terms of consent, it only relates to what we have

eliminated the consent for, is for treatment, payment and operations. Anything beyond that, you must get the patient’s consent

for the use of that information.

In terms of remuneration, what you are discussing is how we address the issue of practices that, for example, I cited the example

earlier. What we were concerned with is we have circumstances in

which providers participate in continuing medical education conferences. Those conferences may be paid for by X company. What

we do not want to have happen is having to have providers having

to toil over whether or not they receive remuneration from a company simply because later on they prescribe a product that they

think is in the best interest of their patient, but because they had

been given the opportunity to participate in this conference we did

not want that to have to be considered as marketing because that

is consistent with that provider’s treatment of the individual.

So therefore we have broadened what we look for in terms of the

definition of marketing, but we have limited it to that which is outside of the treatment-payment continuum.

Senator CLINTON. Well, Mr. Allen, I have to confess that I am

very disturbed by some of these changes because I think the practical effect is to substantially weaken the privacy rule. I appreciate

some of the difficulties that were brought to our attention in a

hearing that we held last year and I certainly believe we should

have targeted effective measures for dealing with some of those

issues, like the ones that the pharmacists raise, but you have

thrown the baby out with the bath, the best I can tell, and opened

up a huge loophole for nearly any use of information without any

31

effective check on it because we will not have any proof that the

patient has ever been adequately informed.

I think it is unrealistic to believe that many patients are going

to be that well skilled in the nuance of these rules to even know

the questions that they are supposed to be asking and I think we

have an obligation to err on the side of privacy. And I think that

this rule, the recommended changes to the rule really go in the opposite direction.

So I will be very interested in following what you are proposing

on this, but I think that the witnesses who will be coming to appear before us in the next panel have some very specific issues and

I hope that you and your colleagues will listen very carefully because I think it would be quite useful to take another stab at trying to figure out how to do what you are trying to do in the name

of flexibility without undermining privacy.

Mr. ALLEN. Senator, I take your point very seriously. We are

here to listen. We are in a comment period and we expect to get

many comments. In fact, we probably will get, particularly after

this hearing, a lot more comments and we welcome that. But I

think from the perspective that we have taken, we tried to approach this from the patient’s perspective. While you may think

privacy rights are the most overriding issue, we stepped back and

thought that it was far more important that in seeking to maximize an individual’s right of privacy that it was far more important

that we ensure that we do nothing, that we do absolutely nothing

to impede their access to care because having a right to privacy

means very little to a person who is desperately needing care,

whether it be the mother who is——

Senator CLINTON. You are not going to get any argument from

any of us about that, Mr. Allen. We are all in favor of care. It is

just that we are concerned that in the name of care, profit has a

very big role in a lot of the efforts to use information available to

health entities. There has to be a line drawn and you have ended

up on one side of the line, and I think some of us are more comfortable on the other side of the line, but that is to be worked out

and discussed and I appreciate your willingness to listen to the

comments that will be coming to you. Thank you.

Mr. ALLEN. Certainly.

The CHAIRMAN. Senator Enzi.

OPENING STATEMENT OF HON. MICHAEL E. ENZI, U.S.

SENATOR FROM THE STATE OF WYOMING

Senator ENZI. Thank you, Mr. Chairman. I would ask consent

that a statement that I prepared be placed in the record.

The CHAIRMAN. Without objection.

Senator ENZI. Thank you. I appreciate your holding this hearing.

This is an issue of tremendous concern to everyone that I know. I

know that we as a committee deferred to the agency to go ahead

and do the rules. They did those; they occurred at the end of the

last administration and from comments that I am receiving, I am

quite sure that that administration would have reviewed these, as

well, and I so pleased that they have been reviewed and revised by

the current administration.

32

Now I know that privacy is of extreme importance to everybody.

I saw a survey when we were doing banking privacy and it said

that 94 percent of the people in the United States were concerned

about their privacy—and I was wondering what was the matter

with the other 6 percent.

But on the medical privacy rule I have had a lot of comments

when I’ve been in Wyoming. My prime concerns with the rule that

we had, I heard from pharmacists. They are very concerned about

elderly people having to come in and sign a form so that somebody

can pick up their prescriptions for them, yet they are not even able

to come in and sign the darn form.

But we have some areas of Wyoming that have even bigger problems than that and I suspect that we are not alone in the country,

although we may be. Cell phones have not gotten to all of Wyoming

yet. I have people that rely not on telephones that are party lines,

but on radios that are very definitely party lines because anybody

can pick up the transmission. In fact, they rely on that feature. Everybody leaves their radio on and if somebody in that vast area of

the back country is headed to town, they put out the word that

they have a couple of things they need them to pick up when they

are in town. They have relied on that for years and it creates a tremendous sense of community.

But the privacy rule does not allow that sense of community.

They are not even sure whether they are violating the law by letting somebody know that they need a prescription picked up.

I hear from the doctors, as well. When the final rule first came

out I had a number of them that said, ‘‘to me it looks like I have

to violate the law,’’ again, because of our distances and our communication, so ‘‘Senator, what can you do to protect me when I violate

this rule that you allowed to go into place?’’ When they put it that

way I have a lot of sympathy for them.

I also understand what the people are talking about when they

talk to me and it has primarily been pharmacists and some doctors

and hospitals.

I appreciate very much your comments about the comment period not being up. One of the difficulties I have had with agencies

has been when they have obviously failed to read the information

that they were presented with and had already closed their mind—

before they wrote their rule—about how the rule was going to come

out. So however it comes out, I commend you on your openness on

the rulemaking process.

[The prepared statement of Senator Michael Enzi follows:]

PREPARED STATEMENT OF SENATOR MICHAEL B. ENZI

Mr. Chairman. I want to thank you for promptly holding this

hearing on the new proposed rule to protect the privacy of medical

records.

This Committee mounted a serious bipartisan effort in the last

Congress to advance privacy legislation. While we were not able to

come to agreement on a handful of provisions, there was significant

agreement on the details of the right policy for protecting people’s

medical information. I believe such protection is achievable while

also allowing the appropriate use of medical information to improve

33

the health status of all Americans through research and the development of better medical management protocols.

The Clinton Administration took our legislative draft and used it

as a foundation for a rule-making on medical records privacy. Having been issued in the final days of that Administration, President

Bush was placed in the position of having to review the rule when

he took office.

Under Secretary Thompson’s leadership, the rule underwent additional modifications. Which brings us to today. With that, I’d like

to welcome Deputy Secretary Claude Allen, who will be explaining

the latest iteration of the rule. I also welcome the other witnesses

whose expertise in medical privacy has helped shape this policy

over the last 4 years.

I will comment very briefly on the new proposed rule. First, let

me say that I support the new rule and believe it will afford strong

privacy protections for medical information. I applaud the Administration’s effort to carefully balance ‘‘protections’’ with ‘‘progress’’ in

medicine. I look forward to the comments solicited in the preamble

with respect to de-identified health information.

The new rule was modified to correct the old rule’s unintended

consequence of threatening access to care and reducing the quality

of care patients enjoy today. The goal of a privacy rule should be

to enhance access and quality, not undermine these basics of good

health care.

Several other important modifications to the rule can be summarized by the phrase ‘‘administrative simplification.’’ Changes to

make the privacy rule patient-friendly by making it user-friendly

should be supported by this Committee. After all, the statutory

mandate to develop a medical records privacy rule was included in

the Health Insurance Portability and Accountability Act (HIPAA).

HIPAA also included requirements on both the private health care

market and certain public programs to administratively simplify

health care transactions. Since HIPAA was drafted by this Committee, it’s only logical that we should support all efforts to make

the privacy rule consistent with the our intent to simplify administrative burdens within the health care system.

Mr. Chairman. I look forward to the testimony and again thank

you for calling this hearing.

Senator ENZI. Could you give me some of the factors that were

motivating factors behind the changes that you made to the privacy

rules and the more general comments you may not have been able

to make?

Mr. ALLEN. Certainly. When we received the comments—we received over 11,000 comments in about a 30-day period when we put

these particular sections of the rule back out for additional comment and we had various—we have addressed somewhat earlier

some of the issues that we are addressing. The one example that

continued to come up was pharmacists not being able to fill prescriptions without having the patient to come in prior to the information being transmitted to the pharmacy and signing a consent

form. That clearly was an impediment to care, to access to care.

We then heard from specialists who were concerned about their

practices and being impeded in providing care to the patient. Those

were the sorts of examples that we had, also. Then we went down

34

the list from there. We had emergency care providers who not only

would have the burden of having to get a consent form, but the nature of their work precludes them from getting the consent when

they first pick up the patient, but then would require them to disrupt their normal practices by having to double back to try to seek

that access.

The area that we heard a lot of comments about was in this area

that we all have great concerns about, and that is marketing, particularly when the marketing is using your health-related information for nonhealth purposes. Nobody wants to receive an unsolicited

advertisement or offer that discloses your public health condition or

your health condition when you did not consent to that or were not

aware that that was going to occur. So we began to look at ways

of strengthening the marketing rule and we did that.

We also had concerns raised about the role and the rights of minors vis-a-vis their parents in terms of access to information. In

that area what we did there is that we made very clear that the

Federal law defers to what the State law is. So whatever the State

law is in this area, we defer to that. If there is no law in that regard or if the law is unclear, we defer to the practice of that State

that looks to the health professional in exercising his or her discretion and access. But we also made sure, just as most States, to provide that, in cases of emergencies, physicians, and providers can

provide information on a minor in the case of an emergency and

we wanted to reflect that.

So we tried to approach all of these issues. Research was another

area where there were comments that came in and in that area we

saw that we did not have all the answers. So what we have done

is we have made an approach to how to address the issue of research so that we do not impede research going forward but, at the

same time, finding out how do we get the information that is needed for the research to go forward, but also protecting the privacy

rights of the individual so that they are not identified and their information is not disclosed.

Senator ENZI. I certainly appreciate the thorough job that you

are doing on it, particularly on revisiting things that you revised

before it all becomes final. It is a breath of fresh air and will help

take care of some of the people in our State. Your explanations

today have been clear enough that people will understand this conflict between privacy and getting care and I know in all those cases

they would opt for the care. Thank you.

Mr. ALLEN. Thank you, Senator.

The CHAIRMAN. Senator Gregg.

Senator GREGG. Mr. Chairman, thank you.

Mr. Allen, I unfortunately had to depart for a while, but I did

have a chance at my other meeting to listen to you and I thought

your presentation was excellent.

Going back to this consent issue, I just wanted to talk about the

unintended consequences of this mandatory consent language. It

seems to me that I can think of three instances which would create

really inappropriate events as a result of mandatory consent. One

would be my situation, where if I went to a doctor, the only time

I would ever go to a doctor is if I really had to go to the doctor.

I cannot think of anything worse than sitting, other than maybe

35

going to BWI and waiting to get through security. But when I walk

into that doctor’s office I have one thing on my mind and that is

getting better. And the odds are he could put anything in front of

me if it’s reasonable. He could even ask that I sign off that the Red

Sox would never win the World Series ever and I would probably

sign it.

I think that therefore the relevance of a mandatory consent is

probably limited because your reason for going to a doctor is not

to sign a form; but to get better.

Second, I am concerned about the position it puts the doctor in.

You have alluded to this, but it seems to me that there are certain

laws that say a doctor must treat you, starting with his Hippocratic

Oath, but also specific Federal laws in the area of emergency care,

for example, and State laws. The doctors could find themselves in

the untenable position of having a patient come in who may be one

of these Wyoming types, you know, independent, who just refused

to sign anything. The patient needs to be treated, and the doctor

treats because they are a good doctor and they have to treat under

the law if it is an emergency and they have to treat under their

oath if it is not. What then does the doctor do? What does the doctor do with the information? He may not even be able to send the

patients’ information to a lab.

Mr. ALLEN. That is right.

Senator GREGG. And physicians certainly have opened themselves up to all sorts of liability in these situations.

So this mandatory consent creates the unintended consequence of

putting the doctor in an improbable and inappropriate position.

And third, I am concerned that it may create an atmosphere

where people could use the mandatory consent to harm the patient’s rights. I mean, mandatory consent could end up with language in it, although there are limitations on this, but it could end

up with language in it which contractually would significantly proscribe what a patient’s rights are and what they are permitted to

do. And, as I said, if you are going in to get care, you are going

to sign that consent unless it is truly outrageous on its face, or unless you happen to be an attorney.

So I see those three instances as examples of why mandatory

consent probably makes no sense and why your approach is much

more logical to this effort. But we do have the anomaly, I think,

of the American Medical Association having been the ones who, I

think, forced the Clinton Administration to back off from its original proposal, which was no mandatory consent, which was probably

a more logical position.

So I’m wondering if it would be appropriate for this committee

to pass a regulation or rule or law, if the Chairman brings this forward, that says that if you are a member of the American Medical

Association, then you shall be subjected to mandatory consent. Is

that reasonable?

Mr. ALLEN. I would say for those individuals who are members

of the American Medical Association who might otherwise have

commented or maybe members of other associations that support

the notice provisions that we have, if we could exclude them you

might want to find those members who would solely want to—— Senator GREGG. My question was fairly rhetorical.

36

Mr. ALLEN. Mine was, as well, my comment.

I think the issue there, Senator, if I may, in all seriousness, I

think the issue there is I believe that with proper education, understanding of the rule and the way the rule works and brings an appropriate levity to the issue of privacy, but also the significant importance of access to care, I think that we can work with the American Medical Association and other organizations by educating

them on how this rule ultimately will work to the benefit of the patient in both areas and making sure that they have the ability to

have the prior consent, prior notification, prior authorization for

use of their information when it is not related to treatment, payment or operations but, at the same time, to not be precluded from

getting that care when it does relate to those areas.

So I think in all seriousness I think we have an opportunity to

educate, as well.

Senator GREGG. I appreciate your presentation. I think it was a

very effective representation of the administration’s position.

Thank you.

Mr. ALLEN. Thank you, Senator.

The CHAIRMAN. Thank you very much.

[The prepared statement of Claude Allen follows:]

PREPARED STATEMENT OF CLAUDE A. ALLEN

Chairman Kennedy, Senator Gregg, distinguished Members of the Committee, it’s a pleasure to be with you. I welcome the opportunity of appearing before you to talk

about what we’re doing at the Department of Health and Human Services to fulfill

President Bush’s goals of protecting both vital health care services and the confidence of every American to know that his or her personal medical records will remain private. Today, I’m going to discuss the Standards for Privacy of Individually

Identifiable Health Information (the Privacy Rule) and the proposed modifications

to those standards that the Department published in the Federal Register for public

comment on March 27, 2002.

President Bush, Secretary Thompson and I believe strongly in the need for workable and effective federal protections to ensure patients’ privacy. Americans have become increasingly concerned about the privacy of their health care information. Fear

of misuse or abuse of sensitive medical information has deterred some patients from

fully utilizing the necessary health care services available to them. When the Privacy Rule is fully implemented, we will have successfully completed our goal of giving American patients what they want: confidence that the privacy of their medical

records will be protected and that our providers and health system will be able to

deliver them the most advanced, and efficient quality care available. Because of the

Privacy Rule, all Americans will, for the first time:

• Have the right up front the first time they see a doctor or health care provider

or enroll in a health plan to be notified of their privacy rights and how their information may be used or disclosed by the provider or the plan, so they may understand and discuss concerns with these providers and plans and get care that is consistent with their own personal preferences;

• Have the right to access their own medical record and to have their record corrected, if it contains incorrect or incomplete information; and

• Have control over most non-routine uses or disclosures of their information, including requiring written permission before their information is shared with employers for employment decisions, shared with life, disability or other insurers, or

used for marketing.

In April 2001, President Bush acted boldly to put into place these strong patient

privacy protections. With laws already in effect to protect personal information contained in bank, credit card, and other financial records, and to require notification

of Americans about how their electronic data are used for providing these financial

services, the American public should not be made to wait any longer for protection

of the most personal of all information—their health records. At the same time, legitimate concerns were raised about whether parts of the Privacy Rule would compromise patients’ access to care or the quality of that care. To address these concerns, the President directed Secretary Thompson to recommend appropriate modiVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00040 Fmt 6633 Sfmt 6621 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
37

fications to the Rule that would identify and correct any unanticipated consequences

that might harm patients’ access to care or the quality of that care while still protecting patient confidentiality.

The notice of proposed rulemaking published on March 27, 2002 represents the

results of the Department’s review of thousands of public comments, recommendations from public hearings on the Privacy Rule, as well as the letters and input from

a broad and diverse group of lawmakers, interest groups, health care leaders, and

individual citizens regarding the Rule. The changes that we have proposed will

allow us to ensure strong protections for personal medical information without negatively affecting access to care. These recommendations were decided upon only after

seriously examining the feasibility of all possible options. They are common-sense

revisions that are intended to eliminate serious obstacles to patients getting needed

care while, for the first time, providing federal privacy protections for patients’ medical records.

I would like to review briefly the major areas of the Privacy Rule where changes

are being proposed and explain the Department’s reasons for proposing these actions. At the end, I will be happy to answer any questions from the Committee

Members on these or any other of the proposed changes.

Consent and Notice

First, the Department has proposed a workable solution to the consent and notice

provision that achieves strong privacy protections and ensures access to care. The

original regulatory proposal published in November 1999, prohibiting a covered

health care provider from obtaining consent for uses and disclosures for treatment,

payment and health care operations, lacked a workable process to engage the patient to consider the providers’ privacy practices, an essential part of adequately

protecting privacy. The final regulation published in December 2000, mandating

consent for these routine uses and disclosures created barriers to timely access to

care.

The Department’s proposal is two-fold: it would enhance the obligation that covered entities give notice of their privacy practices to their patients, by requiring a

good faith effort to get patients to acknowledge, in writing, receipt of the notice of

privacy practices, and it would allow providers to obtain consent for these routine

uses. This change means only that under the Privacy Rule, patients are no longer

required to provide consent for their doctors, hospitals, and other direct treatment

providers to use and disclose information for those core activities that are essential

elements of providing health care. Patient authorization is still required for most

other purposes, such as marketing and disclosures to employers for employment

purposes. Patients also would continue to have the right to request restrictions on

uses and disclosures of their health information and would be able to enter into

agreements with providers and health plans to further protect the privacy of their

health information or to further limit the use of that information.

We believe this approach provides new, meaningful patient privacy protection

without impeding the delivery of high-quality care that patients need. The President

and Secretary Thompson are dedicated to improving the delivery of quality care to

patients, and the December 2000 privacy rule posed serious problems for patient access to care. Indeed, the comments received in March 2001 revealed a multitude of

unintended consequences threatening patient safety and quality care. We also heard

from many of you on this committee, Mr. Chairman, and other Members of Congress, all asking that we address these unintended consequences. Most importantly,

we heard from health professionals that the proposed regulations would have serious consequences for the quality of patient care.

I believe it was widely recognized that the consent requirements interfered with

patients getting prescriptions filled in a timely manner; the ability of hospitals, specialists, or other practitioners to act timely to start care for patients referred from

other providers; the ability to provide treatment over the telephone; and emergency

medical providers.

Potentially, the Department would have to repeatedly modify the privacy rule as

each new barrier was identified. As many of you may recall, HIPAA allows modifications to the privacy rule standards only once yearly, thus the Department would be

in the untenable position of knowing of serious problems that threatened patient

care, but being unable under the law to correct these threats to patient care on a

timely basis.

Ultimately, we tried to put ourselves in the shoes of the patient and do what

made the most sense from his or her perspective. And, we believe that the patient

most values unimpeded access to quality care, generally limiting the use of his or

her information to what is necessary to provide quality care, fair notice of how his

38

or her information will be used, and more control over where other than to his

health care providers and health plans his information goes.

Indeed, requiring individual written consent for the routine uses necessary to provide care give the patient little actual control over that information. When coupled

with the provider’s ability—and even necessity—to condition treatment on the signing of a general consent form, the patient is forced to choose between signing the

consent form and not receiving care. In the end, we determined that the risk of compromising patient care and safety outweighed any benefit of a mandatory consent

process. We believe the backbone of patient privacy rights is preserved and

strengthened and the spirit and intent of the mandatory consent is fulfilled by the

written notice requirement. During each patient’s first meeting with a provider,

they will receive a notice of their privacy rights, as well as the providers’ privacy

policies, and how their information will be used. This notice requirement creates for

the first time, a formalized process where the patient will pause and reflect on the

value of the privacy of their medical records and be able to discuss any concerns

that they have with the provider.

Health Care Communications and Practices

Second, the proposal ensures the strong protections for all forms of health information, including oral communications. Plans and providers will be obligated to

make reasonable efforts to limit the use and disclosure of protected health information to the appropriate minimum necessary to accomplish the intended purpose. We

have, however, made clear that a doctor could discuss a patient’s treatment with

other doctors and health care professionals without fear of violating the rule if they

are overheard if reasonable safeguards are in place. As long as a covered entity met

the minimum necessary standards and made an effort to protect personal health information, incidental disclosures—such as another patient overhearing a fragment

of conversation—would not be an impermissible disclosure. This proposed change

does not in any way permits gossiping or other careless use of patient information.

Research

Third, the proposals would simplify the research provisions, removing many of the

burdens on research and covered entities alike, thereby continuing to promote the

highest quality of care that Americans have come to expect and have a right to demand and so that the nation’s world-renowned medical research can continue at a

vigorous pace, but with renewed confidence in patients that their personal medical

information will be protected. The proposal would make it easier for patients who

participate in research to understand all dimensions of the study, including privacy

dimensions, through the use of a single combined form, instead of having multiple

consent forms—one for informed consent to the research and one or more related

to information privacy rights. It streamlines requirements for obtaining a waiver of

individual permission to access records for research purposes, so as to more closely

follow the requirements of the ‘‘Common Rule,’’ which governs federally funded research. These simplified provisions would, nonetheless, continue to include privacyspecific criteria and would apply equally to publicly- and privately-funded research.

The Department is also seeking comment on the feasibility of making health information that does not directly identify the patient more readily available for research and limited other purposes. For example, many researchers and others who

study the quality or accessibility of care have indicated a need for information that

does not facially identify the patient, but nonetheless contains certain identifiers

such as zip code or dates of admission and discharge. Under the Privacy Rule, the

information would not be ‘‘de-identified.’’ In environmental cancer studies, zipcodes

are often important for environmental health research. Duration of illness is important for infectious disease studies. Through the comment process, the Department

is seeking a consensus as to how to construct a ‘‘limited data set’’ that could be disclosed for such purposes, and as to what type of information should continue to be

excluded from the proposed ‘‘limited data set’’ because it would directly identify an

individual. In addition, to further protect privacy, we propose to condition the disclosure of the limited data set on a covered entity’s obtaining from the recipient a data

use or similar agreement, in which the recipient would agree to limit the use of the

data set for the purposes for which it was given, as well as not to re-identify the

information or use it to contact any individual.

Parents and Minors

Fourth, we have made limited changes to clarify that State law governs disclosures of a minor’s health information to a parent or guardian. The rule and the proposed modification only address the rights related to a minor’s medical records; neither has any impact on a minor’s ability to obtain certain medical services under

State law without parental consent. The intent of the current rule was never to

39

override State laws that set standards for parental access to their children’s medical

records. In cases where State law is silent or unclear, the revisions would preserve

physician flexibility and standards of professional practice by permitting a health

care provider to use the discretion afforded by the State or other law to provide or

deny a parent access to such records. Just as State law now determines when a

minor may be treated without parental consent, so too would the revisions effectively defer to State law on access to and control of the minor’s information that

results from such treatment.

Marketing

Fifth, the proposal explicitly prohibits using or disclosing a patient’s information

for any marketing purposes without the individual’s express authorization. At the

same time, the proposal would ensure that doctors and other covered entities could

continue to communicate freely with patients about treatment options and other

health-related information, related to their treatment, including disease-management programs sponsored by the entity. The doctor may or may not receive remuneration. This proposal would strengthen the marketing provisions by requiring an

individual to specifically authorize certain disclosures of health information that

otherwise would be permitted without such authorization under the privacy rule.

For example, a health plan would be prohibited from giving a pharmaceutical company its list of all enrollees for the company to send all patients information about

their products without obtaining each individual’s authorization even if that company is a business associate of the health plan. However, the proposal would continue to allow use of information for the health plan to send enrollees with diabetes

information about a diabetes disease management program that may help them

manage their illness. Patients want information about their treatment and treatment alternatives and the benefits and services offered by their plans and health

care providers. Patients do not want their personal information used for unsolicited

marketing pitches that have nothing to do with their care. This is the same common

sense approach that governs all other revisions to the Rule: patients should have

the right to get the best care possible, and to have their sensitive medical information protected while doing so. Other Provisions

We have also proposed changes that would:

• Clarify and encourage public health reporting of adverse events and other postmarketing surveillance of FDA-regulated products or services;

• Provide model business associate contract provisions and allow up to one additional year for most covered entities to make their business associate contracts compliant with the Rule; and

• Permit the sharing of information among health care providers and health

plans for each others’ treatment, payment, and quality-related health care operations.

Conclusion

I want to assure you that Secretary Thompson and I are committed to working

with this Committee and Congress, and with experts and the public, to provide the

strongest possible protections for medical information while preserving access to and

quality of health care. We look forward to specific comments on the proposed modifications to the Privacy Rule and we remain open to additional ideas for strengthening privacy protections while encouraging high quality care. But it is past time to

move forward. Privacy rules have been drafted for many years, and inaction prevents needed medical privacy protections from being put into place. The need to get

strong privacy protections in place now is a commonly held goal that transcends

partisan politics. We owe the American people a privacy rule that works to allow

them to continue to get the high-quality care that they expect they deserve no less.

Thank you again for the opportunity to be here today. I appreciate your interest and

commitment and I am happy to answer any questions.

The CHAIRMAN. We have a panel now that we will hear from.

Janlori Goldman devoted her career to privacy and civil liberties

issues, founder and director of Health Policy Project, Georgetown

University Institute of Health Care Research, also cofounded Center for Democracy and Technology, a civil liberties organization

committed to preserving free speech and privacy on the Internet.

Janlori has been a leader on the privacy regulations since day one

and we look forward to the testimony.

40

Sam Karp, chief information officer, California Health Care

Foundation, coordinates the foundation’s initiatives in health care

privacy, worked on new business models, technology-based approaches for sharing health information. Mr. Karp is working to

understand how providers are working to implement this regulation.

John Clough currently is the chairman of the Division of Health

Affairs, Cleveland Clinic Foundation. Previously the doctor served

as chairman of the Department of Rheumatic and Immunologic

Disease and we are pleased to get his input on this important

issue. Senator DeWine will be here just momentarily to give us an

additional introduction.

Dr. Richard Harding, president of the American Psychiatric Association. Serves on the Subcommittee on Privacy, Confidentiality

and the National Committee on Vital Health Statistics in the Department of Health and Human Services and he will be sharing his

thoughts on the impact of privacy on health care providers.

Mr. Karp.

STATEMENT OF SAM KARP, CHIEF INFORMATION OFFICER,

CALIFORNIA HEALTHCARE FOUNDATION

Mr. KARP. Good morning, Mr. Chairman, Senator Gregg and

Members of the committee. My name is Sam Karp. I am the chief

information officer of the California Healthcare Foundation. The

foundation is an independent philanthropy committed to improving

California’s health care delivery and financing systems. Thank you

for the opportunity to testify today on an issue we believe is fundamental to improving the quality of health care.

Over the past 5 years, the California Healthcare Foundation has

supported a range of activities to heighten awareness and understanding of the need to establish strong rules to safeguard the confidentiality and security of personal health information both on and

off-line.

In December of last year the foundation commissioned an independent survey of health care organizations operating in California

to see how implementation efforts are proceeding under the HIPAA

privacy rule. The survey was intended to distinguish between the

real and perceived barriers to compliance and to use the results to

inform policy-makers and the general public debate. While I have

submitted written testimony that details the survey findings, I

would like to highlight two of the key findings here this morning.

First a few words about the survey. The survey was conducted

for the foundation by the National Committee for Quality Assurance, NCQA, and the Georgetown University Health Privacy

Project. It was fielded in January and February of this year just

prior to the March 27 proposed rule modifications issued by HHS.

The survey represents the views of 100 health care organizations

that do business in California, including 29 hospitals, 19 physician

organizations, 26 health plans, and 26 other organizations, including disease management, behavioral health organizations, medical

management groups, clearinghouses and large research organizations. The organizations that took part in the survey are fairly representative of entities covered by the privacy rule and some of the

organizations operate in States other than California.

41

With respect to implementation progress, if you refer to Table 1

in my testimony or the chart to your right, you will see the

progress being made in implementing the privacy rule in California. Ten months into the 2-year compliance period, when asked

about specific actions taken toward implementation, 81 percent of

the respondents reported having developed a strategic plan. Sixtyseven percent indicated they have already conducted a gap analysis. Fifty-two percent have developed a readiness initiative and 12

percent of the respondents reported already completing their readiness activities.

As the chart indicates, hospitals report having made the most

progress to date, with 96 percent having developed strategic plans,

75 percent having conducted gap analyses, and 67 percent developing readiness initiatives. Physician groups report having made the

least progress.

Also with respect to implementation progress, 77 percent of the

respondents to the survey indicated that they had designated a privacy official, as defined by the rule. Eighty-seven percent of those

that had designated a privacy official also report they had identified the human resources within their organizations needed to prepare for HIPAA compliance.

Now let me turn for a moment to the consent requirement. If you

will refer to Figure 1 in the testimony, which is also in the chart

on your right, this chart indicates that a majority of respondents,

51 percent, report that the consent requirements are somewhat

workable. Another 29 percent reported that they were either workable or very workable, while 20 percent reported that they were

less than workable or not workable at all. Hospitals and physician

groups, those organizations directly affected by the consent requirements, were more likely than their counterparts to report that the

requirements were somewhat to very workable, 90 percent and 79

percent respectively.

If you refer now to Figure 3, also on the chart to your right, the

survey found that those respondents that report having developed

a strategic plan, conducted a gap assessment or completed their

readiness initiative—in other words, those organizations that were

further along in their compliance effort—were also more likely than

their counterparts to report that the consent requirements were

workable.

There were a variety of open-ended comments about the consent

requirements. Let me just mention a couple. Although the final

rule required consent to be obtained only one time, many respondents expressed confusion and concern about their ability to track

revocations and limitations of consent. There was also concern as

a result that some covered entities would require patients to sign

a consent form every time they sought treatment and that patients

would be overwhelmed and confused as a result.

There was also confusion expressed about whether one covered

entity could share quality assessment information with another

covered entity, but HHS provided modifications that have now

made that clear, that as long as those two entities have an individual relationship with the patient, they can share that information.

There are two take-aways from this survey. First, there is still

considerable work to be done, as we have heard this morning, to

42

address areas of confusion, misinterpretation, and to make the

rules generally more workable. On the other hand, the survey provides clear evidence, some 14 months before the compliance date,

that progress is being made in implementation. In fact, those organizations that I mentioned a moment ago that are further along in

their compliance efforts are finding the rules more workable.

The CHAIRMAN. I will give you another minute or two.

Mr. KARP. So to remove a key provision of the rule at this time

does not seem justified.

Again, thank you for this opportunity to testify today. I am

happy to answer any questions you may have.

The CHAIRMAN. Enormously interesting study.

[The prepared statement of Mr. Sam Karp follows:]

PREPARED STATEMENT OF SAM KARP, CHIEF INFORMATION OFFICER

Good morning. Mr. Chairman, Senator Gregg, and members of the committee, my

name is Sam Karp. I am the Chief Information Officer of the California HealthCare

Foundation. The Foundation is an independent philanthropy, committed to improving California’s health care delivery and financing systems. Thank you for the opportunity to testify today on an issue we believe is fundamental to improving the

quality of health care.

Over the past 5 years the Foundation has supported a range of activities—from

research studies, surveys, educational publications, guides, workshops and conferences—to heighten awareness and understanding of the need to establish strong

safeguards to protect the confidentiality and security of personal health information,

both on- and offline. Our work is motivated by the belief that unless patients, and

consumers generally, have confidence that the confidentiality of their health information is guaranteed, progress being made to develop better information systems

to improve care and monitor and assess the quality of care will be thwarted. [The

Foundation’s work on health privacy can be found on our Web site at www.chcf.org.]

California HIPAA Privacy Implementation Survey

In December 2001, the Foundation commissioned the National Committee for

Quality Assurance (NCQA) and the Georgetown University Health Privacy Project

to survey health care organizations operating in California to see how implementation efforts are proceeding under the HIPAA Privacy Rule. The survey was intended

to distinguish between the real and perceived barriers to compliance and to use the

results of the survey to inform policymakers and the public debate.

The survey represents the views of 100 health care organizations that do business

in California, including 29 hospitals, 19 physician groups, 26 health plans, and 26

other organizations, such as disease management organizations, clearinghouses,

medical management groups, behavior health care organizations and researchers.

The organizations that took part in this survey are fairly representative of entities

potentially affected by the Privacy Rule. Some of the organizations surveyed also operate in states other than California.

The survey was conducted in January and February 2002, prior to the March 27,

2002 release by Department of Health and Human Service (HHS) of the proposed

rule modifications (NPRM).

When reviewing the findings of the survey it is important to note that the State

of California has a history of strong patient confidentiality laws. Health care organizations operating in California generally have more experience operationalizing privacy protections than most of the rest of the nation.

The Survey Findings

The survey identified the following key findings:

1. Planning is proceeding; implementation progress varies.

2. The consent requirements are somewhat workable.

3. Minimum necessary requirements are somewhat workable.

4. Information needed for quality assessment thought to be limited by the consent

and minimum necessary requirements.

5. The business associate requirements are viewed as burdensome.

6. Resources are needed to assist preemption analysis.

7. Compliance efforts are not fully funded.

8. There is a general need for clarifications and/or modifications.

43

1. Planning Is Proceeding; Implementation Progress Varies

Ten months into a 2-year compliance period, when asked about specific actions

taken toward implementation, 81 percent of respondents have developed a strategic

plan, 67 percent indicated they have conducted a gap assessment, and 52 percent

have started to develop and implement readiness initiatives. Twelve percent of respondents reported completion of their readiness initiatives. Hospitals report having

made the most progress to date, with Physician Groups having made the least

progress. (See Table 1.) Payors with a Medicaid product were less likely than Payors

with commercial products to have developed a strategic plan (64 percent to 92 percent), conducted a gap assessment (50 percent to 92 percent), or developed a readiness initiative (29 percent to 67 percent).

Seventy-seven percent of respondents indicated they had designated a Privacy Official, as defined by HIPAA. Eighty-seven percent of those that had designated a

Privacy Official also report they had identified the human resources within their organization needed to prepare for HIPAA compliance. Again, Payors with a Medicaid

product were less likely (50 percent to 92 percent) than Payors with commercial

products to have designated a Privacy Official and also less likely (63 percent to 91

percent) to have identified the human resources needed to prepare for HIPAA.

Organizational challenges frequently identified by respondents included implementation, staff education, cost, time, and information technology.

2. The Consent Requirements Are Somewhat Workable

Overall, 51 percent of total respondents felt that the consent requirements were

somewhat workable. Twenty-nine percent felt they were either workable (19 percent) or very workable (10 percent), while 20 percent felt they were less than workable (13 percent) or not workable at all (7 percent). (See Figure 1.)

Hospitals, Others and Physician Groups were more likely to feel the consent requirements were somewhat to very workable (90 percent, 81 percent, and 79 percent

respectively) than Payors (68 percent). Respondents who had developed/completed a

readiness initiative, developed a strategic plan or conducted a gap assessment were

more likely than their counterparts to feel that the consent requirements were

workable.

Forty-six percent of survey respondents believe that the Privacy Rule will be useful in assuring patient confidentiality rights and achieving consistent national

standards for confidentiality, however, 47 percent of respondents expressed concern

about the paperwork burden.

Although the final rule required consent to be obtained only one time, many respondents expressed confusion or concern about the practicability of tracking revocations and limitations on consent. There was concern that as a result, some covered

entities would require patients to sign a consent form every time they sought treatment and that patients would be overwhelmed and confused as a result.

Many respondents expressed concern that the burden of implementing consent

would take time and money away from patient care. Respondents also expressed

concern that covered entities would err on the side of caution and refuse to release

information for fear of violating HIPAA.

All respondents were asked to indicate what they deemed useful about the consent requirements, and what areas of the consent requirements caused them concern. Regarding aspects of the consent requirements that were useful:

• 30 percent said that the requirements were useful in assuring patient rights.

• 16 percent felt the requirements would provide national standards and increase

consistency among providers.

• 16 percent said that there was nothing useful about the requirements.

Regarding areas of concern related to the consent requirements:

• 19 percent of respondents cited continuity of care.

• 14 percent cited confusion about consent among patients, employees, and physicians.

• 9 percent cited cost.

Payors were more likely to cite confusion about consent as an area of concern.

Respondents were asked whether available tools and technologies could be used

to implement four areas: 1) initial consent, 2) revocations of consent, 3) limitations

on consent, and 4) accounting of disclosures. Implementing initial consent was

thought to be the easiest and tracking limitations to consent the most difficult. It

should be noted that between 17 and 25 percent of respondents did not know how

to respond and were excluded from the results.

Physician Groups were more likely than Hospitals, Payors, and Others to feel that

available technologies could not be used for tracking initial consent. Of those who

did know, 53 percent of respondents felt that initial consent could definitely be

tracked.

44

For revocations of consent, more than a quarter (28 percent) of respondents felt

that they could not be tracked with available tools and technologies. Forty-five percent thought they could be tracked with available tools and technologies.

Overall 37 percent of respondents thought that limitations on consent could be

tracked, while 35 percent of respondents thought they could not be tracked with existing tools. Only 30 percent of Hospitals and 32 percent of Payors felt that limitations on consent could be tracked with existing tools.

Twenty-nine percent of respondents thought that accounting of disclosure could

not be tracked with existing tools, while 43 percent thought that they could be

tracked. Physician Groups (33 percent) and Payors (33 percent) were more likely to

say that they could not be tracked.

3. Minimum Necessary Requirements Are Somewhat Workable

Overall, 58 percent of respondents felt that the minimum necessary requirements

are somewhat workable. Twenty-three percent felt they were workable (18 percent)

or very workable (5 percent), while 19 percent felt they were either less than workable (15 percent) or not workable at all (4 percent). Physician Groups were slightly

more likely to see the minimum necessary requirements as workable, with Payors

and Others slightly less likely to see them as workable. As with the consent requirements, respondents who had developed a readiness initiative or strategic plan or

had conducted a gap assessment were more likely than their counterparts to feel

that the minimum necessary requirements were workable.

4. Information Needed For Quality Assessment Thought To Be Limited By The Consent And Minimum-Necessary Requirements

When asked if they thought the consent requirements would enhance or limit the

flow of information needed to assess health care quality, 58 percent of respondents

thought that the consent requirements would somewhat limit (51 percent) or greatly

limit (7 percent) the flow of information needed to assess quality of care. Thirty-two

percent of respondents felt the consent requirements would have no affect on the

flow of information, while 10 percent percent felt the consent requirements would

enhance (9 percent) or greatly enhance (1 percent) the flow of information. Sixtyfive percent of Hospitals and 65 percent of Others felt that the consent requirements

would somewhat or greatly limit the flow of information, while 42 percent of Physician Groups and 44 percent of Payors felt that the consent requirements would have

no effect on the flow of information.

Those respondents that felt the consent requirements would somewhat or greatly

impact the flow of information needed to assess health care quality were asked to

indicate in what way the consent requirements would impact assessment of health

care quality. There were 60 open-ended responses to this question:

• 30 percent of respondents answering the questions felt that there would be

process complications or additional burden associated with paperwork.

• 17 percent felt there would be confusion over requirements; 15 percent felt patient factors, such as revoking consent, would limit the flow of information and interrupt the continuity of care.

• 6 percent felt that there would be inadequate transfer/flow of information needed for patient assessment.

Inadequate time was a common theme in the responses. Hospitals were more likely to cite process complications, paperwork burden, and patient factors as limiting

the flow of information, while Payors tended to cite confusion over requirements as

limiting the flow of information.

With respect to the minimum necessary requirements, the findings were less

clear. While 45 percent of respondents’ thought this requirement would greatly limit

or somewhat limit the flow of information needed to assess the quality of health

care, another 45 percent thought that the minimum necessary requirements would

have no impact. Ten percent of respondents thought the requirements would somewhat enhance (9 percent) or greatly enhance (1 percent) the flow of information.

Physicians and Payors expressed similar concerns that the minimum necessary

requirement would negatively affect the flow of information for payment, delivery,

and assessment of care. It appears that the belief that quality would be affected is

related to the fact that the consent requirements in the final rule would not permit

providers to share Personal Health Information (PHI) with health plans for the

plans’ quality assurance activities.

There was generally a lack of clarity about the permissibility of disclosures for

quality assessment purposes. Respondents did not seem to understand the permitted uses and limitations of PHI within and between covered entities.

45

5. The Business Associate Requirements Are Viewed As Burdensome

The time and cost associated with contracting with business associates was a significant issue for respondents. Seventy-two percent felt there would be a substantial

to large time burden to implement the business associate requirements; more than

half of respondents said the cost of implementing these requirements was substantial to large.

When asked if they believe that the regulations clearly define who constitutes a

business associate, 65 percent of all respondents thought the regulations were clear.

While 81 percent of Physician Groups thought the regulations were clear, only 50

percent of Payors agreed. While most respondents likely have existing contractual

relations, the initial burden of recontracting is believed to be high. There is also disagreement and lack of understanding about the level of oversight and due diligence

required by covered entities over their business associates.

6. Resources Are Needed To Assist Preemption Analysis

Fourteen percent of respondents did not know whether they had conducted any

preemption analysis. Of those who did know, more than half have not identified the

laws in the states in which they do business that either are or are not preempted

by HIPAA. When asked how they were planning to identify and track these laws,

most respondents indicated that they hoped outside sources would develop and track

preemption issues or that they were expending significant resources hiring outside

legal assistance. Assistance provided by HHS with regard to preemption analyses

would ease the burden on covered entities.

7. Compliance Efforts Are Not Fully Funded

With respect to funding, only 21 percent of respondents said that their compliance

efforts were fully funded. More than half of respondents indicated that their HIPAA

compliance efforts were only partially funded or not funded at all. When asked

whether they think the anticipated costs of complying with the Privacy Rule will

eventually be offset by savings expected from implementing other components of

HIPAA (e.g., the Transaction and Code Set regulations), 31 percent to 32 percent

of respondents said they did not know. Of those that said they did know, 48 percent

expect no savings, 22 percent expect some savings but not within the next 5 years,

and 26 percent expect some savings within 3 to 5 years.

While 51 percent of respondents reported a lack of funding, it is also important

to keep in mind that many respondents have not developed a strategy or conducted

a gap analysis of their organizations and this may have an impact on their knowledge of the funding requirements. The survey results also indicated there is a great

deal of money being spent on redundant legal and outside consultant analysis of the

regulations and compliance efforts.

8. There Is A General Need for Modifications And/Or Clarifications

Seventy-eight percent of respondents felt that HHS needed to provide clarifications or make modifications to the final Privacy Rule. Many responders requested

clarifications with respect to consent, minimum necessary, the definition and rules

concerning business associates, the rules concerning communications, marketing

and funding, and preemption. Others wanted clarification around research rules and

how the regulations apply to disease management organizations.

Conclusion

The clear message from this survey is that there is a lot of work still to be done

to address areas of confusion, misinterpretation and to make the rules generally

more workable.

1. If you are a supporter of the Privacy Rule, the survey suggests it cannot be

fully or successfully implemented, without clarifications and possible modifications.

2. On the other hand, there is substantial evidence that progress is being made

in implementation, so that removing key provisions of the rule does not seem justified.

Today, nearly 20 percent of Americans practice some form of privacy-protective

behavior that puts their own health at risk or creates financial hardships. These behaviors include: paying out-of-pocket when insured to avoid disclosure; not seeking

care to avoid disclosure to an employer; giving inaccurate or incomplete information

on a medical history; asking a doctor to not write down the health problem or to

record a less serious or embarrassing condition; or, simply not seeking care at all.

It is in everyone’s best interest to see that these rules are implemented.

Again, thank you for this opportunity to testify today. I am happy to answer any

questions you may have.

46

The CHAIRMAN. I see my friend Senator DeWine here and I know

that he wanted to——

OPENING STATEMENT OF HON. MIKE DeWINE, U.S. SENATOR

FROM THE STATE OF OHIO

Senator DEWINE. Thank you, Mr. Chairman. I am just delighted

to welcome Dr. John Clough, who is from the Cleveland Clinic

Foundation in my home State of Ohio. Doctor, we welcome you

here and we look forward to your testimony.

He will shed some light, Mr. Chairman, on really the complexities involved with the implementation of these rules and the burdens that could fall on health care institutions. He has been with

the Cleveland Clinic for a total of nearly 35 years and is currently

chairman of the Division of Health Affairs at the Cleveland Clinic.

In this capacity the doctor oversees the Departments of Government Affairs, Community Relations, and the Ambassador’s Program.

Last month he testified on the House side regarding the issue of

medical privacy rights and has spent considerable time studying

the impact of the proposed rules.

Dr. Clough, we welcome you to the committee. We thank you

very much for being here and look forward to your testimony.

Thank you, Mr. Chairman.

The CHAIRMAN. Thank you very much.

Ms. Goldman.

STATEMENT OF JANLORI GOLDMAN, DIRECTOR, HEALTH

PRIVACY PROJECT, GEORGETOWN UNIVERSITY

Ms. GOLDMAN. Thank you. Thank you, Mr. Chairman and Senator DeWine for inviting me to testify and thank you also for holding this oversight hearing and for your commitment to privacy.

The mission of the Health Privacy Project is also to broaden access to care and to ensure that people get the quality of care that

they need, but we know that people are afraid. People are afraid

to go to the doctor. They are afraid to be honest with their doctor.

They are afraid to fully share with their doctor because of what

could happen to them, and their fears are real. We hear stories

every day and we collect these stories about how people are hurt

in the workplace; their benefits are denied. We know that, for instance, 40 percent of all people diagnosed with multiple sclerosis

are afraid to tell colleagues and friends because of what could happen to them. People are afraid to get genetic tests. The number one

barrier to people getting genetic testing and counseling is fear that

their privacy will be violated.

So in response to these concerns, the administration issued this

landmark regulation in December of 2000, the privacy regulation,

and the Bush Administration did allow it to go into effect. We realize that it has limits and weaknesses, but the truth is it is the

most comprehensive privacy law that we have at the Federal level.

My testimony is extensive. I want to keep it brief in my oral

statement and I want to focus on two of the proposed modifications

that the administration has made—in the area of consent and the

area of marketing. And when I talk about marketing I am also

going to mention an FDA provision.

47

Signing onto our recommendations here, the National Multiple

Sclerosis Society has also endorsed our position, our recommendation on consent, as has the Epilepsy Foundation, the National Association of Social Workers Legal Action Center, and a list of other

groups, which we have included in our testimony.

Let me just focus on why notice is not the same as consent. The

administration comes here today and says that asking someone to

sign a notice—not requiring, but asking them to sign a notice is the

same as consent. That is just not accurate. Asking someone to sign

a consent form is a significant and meaningful moment in the process of getting care and the process of enrolling in a health plan.

It is asking someone to give their permission. It is not mandating

the consent. A doctor could decide to condition consent on giving

certain benefits, but the regulation does not require that the consent be mandated.

In terms of paperwork burden, we know today that many, many

hospitals, the vast majority of hospitals, and this was included in

the preamble to the final regulation, do require people to consent

to have their information used for payment. Most doctors do, as

well, and for treatment.

State laws in this area are different from what the Federal regulation is requiring. In State laws there are specific consent provisions related to certain kinds of conditions people might have— maybe in the mental health area or communicable disease or abuse

and neglect, alcoholism—where specific consent is authorized, is required. But in the areas of treatment and payment, they are much

more narrow than what the administration is proposing today,

much more limited. Treatment is defined much more narrowly and

directly related to the treatment of the individual. Most doctors

and hospitals will tell you they have an ethical duty to seek consent of their patients before treating them and before having their

information provided for payment.

Marketing? I am very bewildered and disturbed by the administration’s testimony today on marketing. They have contended that

they have strengthened the marketing provision. They have done

exactly the opposite. They have expanded what is now considered

to be marketing and now called it treatment. They have called it

health-related communication. What used to be in this box called

marketing, where people had an opportunity to opt out after getting a communication, where people were told that there was a financial conflict of interest, that is now gone from the administration’s proposal.

Any communication from anybody, not just a doctor, anybody, a

pharmacy, that is health-related, no matter whether there is a financial conflict of interest, does not require an authorization, does

not give an opt-out, does not require up-front consent. That is very

disturbing. A pharmacy can now sell your information under HHS’s

proposed modification to a drug company, to a travel agency, even

to a tobacco advertiser under the FDA provision, and they would

not have to get your consent and not have to give you notice. You

have no control and there are no limits.

I want to just focus for a moment on the cost issue. The cost

issue comes up time and again, but the administration itself, in a

recent report issued from the Office of Management and Budget,

48

has shown that the privacy regulation, over the long term, will

save $12 billion in our health care system when it is implemented

along with the other regulations in HIPAA.

So $12 billion of savings when privacy is implemented together

with the other transaction regulations. How can we talk about then

wanting to save an additional $100 by eliminating consent? It

seems to me greedy and the wrong way to go.

I want to just conclude by saying that President Bush campaigned on a number of pledges around medical privacy. He had

very strong position statements during the campaign. And when he

allowed the privacy regulation to go into effect last year he said he

believed very strongly that medical privacy should be protected and

people should not put themselves at risk when they get care. In

fact, in a column in the New York Times shortly after President

Bush allowed the regulation to go into effect, William Safire

dubbed him ‘‘the privacy President.’’

What we are concerned about today is that if HHS’s proposed

rollbacks become law, if the consent and marketing provisions are

weakened and if they become law, then they will legalize the most

disturbing and unnerving practices in the health care system today

and the kinds of practices that made consumers angry and caused

them to send in 35,000 comments asking the administration to include consent, asking them to limit some of the marketing activities. Now they will become legal.

I urge not only the administration not to roll back these provisions, but I urge the Congress to act. I know that you have struggled with this for over a decade, but to act to create a statute that

then is not susceptible to these political back-and-forths.

I very much appreciate being here today and I will be available

to answer any questions.

[The prepared statement of Ms. Janlori Goldman follows:]

PREPARED STATEMENT OF JANLORI GOLDMAN

Committee Chairman Kennedy, Senator Gregg and Members of the Committee:

On behalf of the Health Privacy Project, I am very appreciative for the invitation

to testify before you today at this oversight hearing on medical privacy. The Project,

which is part of the Institute for Health Care Research and Policy at Georgetown

University, is dedicated to broadening access to health care, and improving the quality of care by ensuring that the privacy of people’s medical information is protected

in the health care arena. The Health Privacy Project also coordinates the Consumer

Coalition for Health Privacy, comprised of over 100 major groups representing consumers, health care providers, and labor, disability rights, and disease groups. The

Coalition’s Steering Committee includes MRP, American Nurses Association,

Bazelon Center for Mental Health Law, National Association of People with AIDS,

Genetic Alliance, National Multiple Sclerosis Society, and National Partnership for

Women & Families.

The Health Privacy Project conducts research and analysis on a wide range of

health privacy issues. Recent Project publications include: Best Principles for Health

Privacy (1999), which reflects the common ground achieved by a working group of

diverse health care stakeholders; The State of Health Privacy(1999), the only comprehensive compilation of State health privacy statutes, which we are currently in

the process of updating; Implementing the Federal Health Privacy Regulation in

California (2002); Privacy and Confidentiality in Health Research (2001), commissioned by the National Bioethics Advisory Commission; Report on the Privacy Policies and Practices of Health Web Sites (2000), which found that the privacy policies

and practices of 19 out of 21 sites were inadequate and misleading; ‘‘Virtually Exposed: Privacy and E-Health’’ (2000), published in Health Affairs; and Exposed Online: Why the New Federal Health Privacy Regulation Doesn’t Offer Much ProtecVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00052 Fmt 6633 Sfmt 6621 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
49

1The Privacy Rule is contained in title 45 of the Code of Federal Regulations. All citations

in this testimony are to the pertinent section of, or proposed amendment to, 45 C.F.R. unless

otherwise noted.

tion to Internet Users (2001). All of our work is available to the public at our Web

site, www.healthprivacy.org.

The Health Privacy Project’s mission is to foster greater public trust and confidence in the health care system, thereby enabling people to more fully participate

in their own care and in research without putting themselves at risk for unwanted—and unwarranted—intrusions. It is wrong to force people to choose between seeking health care and safeguarding their jobs, benefits, and reputations.

People should not have to worry when taking a genetic test for breast cancer, or

filling a prescription for an anti-depressant, that this most sensitive health information will be used outside the core health care setting, but they do worry and with

good reason.

The new medical Privacy Rule,1 issued by the Department of Health and Human

Services (the Department) in December 2000 and in effect since April 2001, is a

landmark regulation, setting in place the first comprehensive Federal safeguards for

people’s medical records. With still a year to go before health care organizations

must fully comply, the centerpieces of this new privacy law are in jeopardy. We appreciate the opportunity to share our concerns with this Committee about the Bush

Administration’s proposal to substantially weaken the medical Privacy Rule. We express particular concern about the Department’s proposal to eliminate the patient

consent requirement, and to severely weaken the limits on the marketing of people’s

medical records. Joining with us in opposition to these two proposed changes, are

the following organizations:

• AIDS Action Council

• American Association for Geriatric Psychiatry

• American Counseling Association

• American Mental Health Counselors Association

• American Nurses Association

• American Psychoanalytic Association

• Bazelon Center for Mental Health Law

• Consumers Union

• CWA Local 1 168 Nurses United

• Electronic Privacy Information Center

• Family Violence Prevention Fund

• Genetic Alliance

• Hadassah

• National Association of People With AIDS

• National Mental Health Association

• National Organization for Rare Disorders

• NYC Chapter, National Association of Social Workers

• Title II Community AIDS Action Network

• Westchester Progressive Forum

We expect that many other organizations and individuals will voice their opposition to these proposals before the comment period closes.

Our testimony today will summarize both our concerns with and support for the

Department’s proposed modifications to the Privacy Rule. Our statement also includes a brief history of the Privacy Rule, and the urgent need within the public

and the health care system for strong, enforceable medical privacy safeguards. In

addition, we correct the misperception that the long-term cost of implementing the

Privacy Rule—along with its companion HIPAA standards—will outweigh the benefits. In fact, the Office of Management and Budget (OMB) released a report last

month documenting that protecting privacy, when done hand-in-hand with the related HIPM rules, will actually result in substantial cost savings.

I. URGENT PUBLIC NEED FOR MEDICAL PRIVACY

The lack of a national health privacy law has had a negative impact on health

care, both on an individual as well as a community level. One out of every six people

withdraws from full participation in their own care out of fear that their medical

information will be used without their knowledge or permission, as documented by

a 1999 survey conducted for the California HealthCare Foundation. (Available at

www.chcf.org.) These privacy-protective behaviors include patients providing inaccurate or incomplete information to doctors, doctors inaccurately coding files or leaving certain things out of a patient’s record, people paying out of pocket to avoid a

claim being submitted, or in the worst cases, people avoiding care altogether.

50

More specifically, a 1997 survey documenting people’s fears about genetic discrimination showed that 63 percent of people would not take genetic tests if health

insurers or employers could obtain the results. (Genetic Information and the Workplace, issued on January 20, 1998 by the U.S. Departments of Labor, Health and

Human Services, and Justice, and the U.S. Equal Employment Opportunity Commission). And, a recent study involving genetic counselors documents that fear of

discrimination is a significant factor affecting willingness to undergo testing and to

seek reimbursement from health insurers. (Hall, Mark A. and Stephen S. Rich, Genetic Privacy Laws and Patients’ Fear of Discrimination by Health Insurers: The

View from Genetic Counselors, 28 Journal of Law, Medicine & Ethics 245–57

(2000).)

An April 2001 Harris survey documents that nearly four out of ten (40 percent)

people with multiple sclerosis said they have lied or failed to disclose their diagnosis

to colleagues, co-workers, friends or even family members out of fear of job loss and

stigma.

These survey figures come to life in the daily media reports of people being

harmed by the use of their health information outside the core health care arena.

To highlight just a few:

• Eckerd’s Drug Stores in Florida is being investigated by the State Attorney

General for its marketing practices. When Eckerd customers pick up their prescriptions, they sign a log indicating they do not want counseling from a pharmacist.

Eckerd’s has been using that signature as an authorization to use the customer’s

prescription drug records for mailing promotions and discounts financed by drug

companies.

• Terri Seargent, a North Carolina resident, was fired from her job after being

diagnosed with a genetic disorder that required expensive treatment. Three weeks

before being fired, Terri was given a positive review and a raise. As such, she suspected that her employer, who is self-insured, found out about her condition, and

fired her to avoid the projected expenses.

• The medical records of an Illinois woman were posted on the Internet without

her knowledge or consent a few days after she was treated at St. Elizabeth’s Medical Center following complications from an abortion at the Hope Clinic for Women.

The woman has sued the hospital, alleging St. Elizabeth’s released her medical

records without her authorization to anti-abortion activists, who then posted the

records online along with a photograph they had taken of her being transferred from

the clinic to the hospital. The woman is also suing the anti-abortion activists for invading her privacy.

• Several thousand patient records at the University of Michigan Medical Center

inadvertently lingered on public Internet sites for 2 months. The problem was discovered when a student searching for information about a doctor was linked to files

containing private patient records with numbers, job status, treatment for medical

conditions and other data.

• Joan Kelly, an employee of Motorola, was automatically enrolled in a ‘‘depression program’’ by her employer after her prescription drugs management company

reported that she was taking anti-depressants.

• Eli Lilly and Co. inadvertently revealed 600 patient e-mail addresses when it

sent a message to every individual registered to receive reminders about taking

Prozac. In the past, the e-mail messages were addressed to individuals. The message announcing the end of the reminder service, however, was addressed to all of

the participants.

• A few months ago, a hacker downloaded medical records, health information,

and social security numbers on more than 5,000 patients at the University of Washington Medical Center. The University conceded that its privacy and security safeguards were not adequate.

In the absence of a Federal health privacy law, these people suffered job loss, loss

of dignity, discrimination, and stigma. Had they acted on their fears and withdrawn

from full participation in their own care—as many people do to protect their privacy—they would have put themselves at risk for undiagnosed and untreated conditions. In the absence of a law, people have faced the untenable choice of shielding

themselves from unwanted exposure or sharing openly with their health care providers.

II. THE GENESIS OF THE PRIVACY RULE

The current Federal health Privacy Rule is a major victory for all health care consumers, and takes a significant step toward restoring public trust and confidence

in our nation’s health care system. The regulation promises to fill the most troubling

gap in Federal privacy law, setting in place an essential framework and baseline

51

on which to build. Each one of us stands to benefit from the Privacy Rule in critical

ways, including greater participation in the health care system, improved diagnosis

and treatment, more reliable data for research and outcomes analysis, and greater

uniformity and certainty for health care institutions as they develop privacy safeguards and modernize their information systems.

Most notably, the current Privacy Rule grants people the right to see and copy

their own medical records; requires health care providers to obtain patient consent

before using their records for treatment, payment and health care operations; imposes limits on using medical records for marketing; imposes safeguards on publicly

and privately funded research use of patient data; somewhat limits law enforcement

access to medical 4 records; and allows for civil and criminal penalties to be imposed

if the Rule is violated.

The Privacy Rule was issued by the Department in December 2000 in response

to a mandate from Congress included in the 1996 Health Insurance Portability and

Accountability Act (HIPAA), which required that if Congress did not enact a medical

privacy statute by August 1999, then the Department was required to promulgate

regulations. This rule has been the subject of a lengthy, thorough, and robust rulemaking process—both before and since its December 2000 release in final form.

Despite intense pressure from some in the health care industry, the Bush Administration allowed this important regulation to go into effect in April 2001. The first

implementation guidance issued by the Department on July 6, 2001, addresses the

many misstatements and exaggerations that some in the industry have been spreading about the Privacy Rule. On its face, the guidance was aimed at calming industry

fears, and we hoped it would lead to greater acceptance of the regulation and foster

compliance with the regulation. The guidance also indicated the changes the Department intended to propose to make to the regulation.

We acknowledge that the Privacy Rule—as finalized—has serious gaps and weaknesses, some of which can only be remedied by Congress, and some of which are

within the Department’s authority to regulate. One shortcoming is that the rule

only directly regulates providers, plans and clearinghouses, and does not directly

regulate employers, pharmaceutical companies, workers’ compensation insurers, and

many researchers. The rule also lacks a private right of action that would give people the right to sue if their privacy was violated. Under HIPAA, only Congress and

the states are empowered to address these limits. However, where the Department

does have the power to strengthen the Rule, it has chosen instead to dilute it.

III. SUMMARY OF THE HEALTH PRIVACY PROJECT’S COMMENTS ON THE DEPARTMENT’S

PROPOSED MODIFICATIONS TO CONSENT AND MARKETING

A. Consent for Treatment, Payment, and Health Care Operations—Sec.

164.506

Proposed Modification:

The Department proposes to eliminate the requirement that health care providers

obtain an individual’s consent prior to using or disclosing protected health information for treatment, payment, and health care operations.

Health Privacy Project Recommendation:

The Health Privacy Project recommends that the Department retain the Privacy

Rule’s prior consent requirement, and make targeted modifications to address the

unintended consequences that result from the consent requirement in some circumstances.

Rationale:

The Privacy Rule requires that health care providers obtain an individual’s consent prior to using or disclosing protected health information for treatment, payment, and health care operations. At the core of the Department’s proposed modifications to the Privacy Rule is the elimination of this prior consent requirement.

In its place, the Department substitutes a requirement that direct treatment providers make a ‘‘good faith effort’’ to obtain the individual’s written acknowledgment

that he or she received the provider’s privacy notice. (Section 164.520 of the Privacy

Rule requires covered entities to provide this notice of privacy practices.) This proposal to eliminate the consent requirement strikes at the very heart of the Privacy

Rule and takes away a core privacy protection for consumers. The Privacy Rule’s

consent requirement is intended to bolster patient trust and confidence in providers

and in health care organizations by respecting the patient’s central role in making

health care decisions. The Department’s proposal to eliminate the consent requirement represents a huge step backwards for consumers—and one that will undermine trust in the health care system.

52

This debate is about much more than the label on the piece of paper that a patient signs, or about whether a patient is given two pieces of paper (a notice and

consent form) or just one (a notice). There are fundamental differences between a

consent process and acknowledgement of a receipt of a notice. Seeking advance permission from a patient before using or disclosing health information acknowledges

first and foremost that it is the patient’s decision whether to entrust others with

his or her private medical information and under what circumstances. The Privacy

Rule’s consent requirement gives individuals some control over how their health information is used and disclosed. Patients would certainly have more control if consent could be withheld without the provider refusing to provide treatment. However,

it is by no means clear that providers will withhold treatment even though permitted to do so, particularly when the individual consents to some uses/disclosures

(treatment and payment uses/disclosures), but withholds consent for others (some

of the relatively vast number of ‘‘health care operations’’ permitted by the Privacy

Rule). It is clear that without a prior consent requirement, patients will have no

control over how their health care information is used or disclosed beyond the right

to request a restriction. Asking an individual to acknowledge receiving a privacy notice reinforces that the individual patient has absolutely no say in the matter.

The Privacy Rule’s consent requirement is the best way to ensure that patients

actually know how their health care information will be used or disclosed and know

what their privacy rights are. The process of obtaining consent defines an ‘‘initial

moment’’—as the Department acknowledges—in which patients can raise questions

about privacy concerns and learn more about options available to them. Patients are

more likely to read the notice, or at least ask questions about how their information

will be used or disclosed, when they are being asked to give their consent. Asking

a patient to acknowledge receipt of a notice does not provide a comparable ‘‘initial

moment’’—especially when the individual is only asked to acknowledge receipt of a

piece of paper, not whether they have read the paper or understood it or have questions about it.

From a practical perspective, the consent form required in the Privacy Rule focuses attention on a new right that is central to the consent process—the right to

request a restriction. By all accounts, the consent form is much shorter than the

notice of privacy practices. Thus, information that is repeated in the relatively short

consent form will be highlighted for patients. The Privacy Rule requires the consent

form to State that the individual has the right to request a restriction. See

§ 164.506(c)(4)(i). Including this information in the consent form, as well as in the

notice, makes it even more likely that patients will be aware of this important right.

That the Department has chosen radical surgery—total elimination of the consent

requirement—when much more targeted, privacy-protective interventions would

have sufficed is especially troublesome.

The Department not only proposes to eliminate the consent requirement, it also

proposes to delete several provisions that apply when providers or plans choose to

require consent. The Privacy Rule includes various provisions that govern the content of the consent form (e.g., it must State that the individual has the right to review the privacy notice before signing the consent form) and the right to revoke. See

§ 164.506(b) and (c).

Under the Privacy Rule, these provisions apply when consent is required and

when it is optional. The Department proposes to delete all of these provisions in

order to ‘‘enhance the flexibility of the consent process for those covered entities that

choose to obtain consent.’’ See 67 Fed. Reg. 14780. In addition, the Department proposes to delete provisions governing conflicting consents and authorizations; under

the Privacy Rule, covered entities must follow the most restrictive. See § 164.506(e).

The Department also proposes to delete the provisions that govern joint consents

by organized health care arrangements. See § 164.506(f). By eliminating all of these

provisions, the Department takes away important safeguards that should, at the

very least, apply when consent is obtained voluntarily.

B. Marketing—Secs. 164.501 and 164.508(a)(3)

Proposed Modifications:

The Department proposes to reduce the Privacy Rule’s privacy protections that

apply to communications that many consumers consider to be ‘‘marketing.’’ Under

the Privacy Rule, a covered entity that is paid by a third party to encourage patients to purchase or use a product or service that is health related must adhere

to certain conditions. In its first communication, the covered entity must give the

patient an opportunity to refuse further marketing materials. The covered entity

must inform the patient that it is receiving remuneration for making the communication. Additionally, the marketing materials must identify the covered entity as

the party making the communication. The Department proposes to eliminate these

53

requirements by removing from the definition of ‘‘marketing’’ all communications

that encourage patients to purchase or use products or services that are health related, including communications that a covered entity is paid to make.

The Department does propose to retain the Privacy Rule’s requirement that a covered entity obtain an individual’s authorization prior to using or disclosing health

information for ‘‘marketing.’’ However, because the Department proposes to contract

the definition of ‘‘marketing,’’ the prior authorization requirement will apply only to

a narrow range of communications—those that encourage the purchase or use of a

product or service that is not health related. The prior authorization requirement

will not apply to communications that encourage the use or purchase of a health

related product or service because such communications are excluded from the definition of marketing, even if the covered entity is paid to make the communication.

The net effect of these proposed changes is to substantially weaken the Privacy

Rule.

Health Privacy Project Recommendations:

The Health Privacy Project recommends that the Department:

• Revise the definition of ‘‘marketing’’ to include communications encouraging the

purchase or use of a health-related product or service where a covered entity receives direct or indirect remuneration from a third party for making the communication.

• Revise the Privacy Rule so that a covered entity must obtain an individual’s authorization prior to using or disclosing protected health information for all marketing purposes, including communications encouraging the purchase or use of health

related products or services where the covered entity has received or will receive direct or indirect remuneration for making the communication.

• Retain the requirement that the authorization notify the individual if the marketing is intended to result in remuneration to the covered entity from a third

party.

• Further modify the provisions to require that an authorization for marketing

specify w whether the protected health information is to be used or disclosed for the

marketing of health care related services or products or for products and services

not related to health care.

Rationale:

The Privacy Rule classifies communications that encourage patients to purchase

or use products and services in three categories: 1) Communications that are clearly

treatment oriented and for which the covered entity does not receive remuneration

from a third party (such as a doctor recommending a particular medicine to a patient because it is medically indicated); 2) Communications that are related to

health but are at least partially financially motivated (such as a pharmacy being

paid by a drug company to send a patient a letter encouraging her to switch her

medication to the drug company’s brand; and 3) communications that are clearly

marketing because they do not relate to health (such as sending vacation advertisements.) See Appendix A at 1. Because the first category of communications is clearly

treatment related, there is no requirement for prior authorization to use health information to make these communications. At the opposite end of the continuum, because the covered entity is being paid to use health information to market a product

or service that is totally unrelated to health, the covered entity must obtain patients’ prior authorization before it can use their health information for these marketing purposes. The treatment of these two categories of health information remains relatively unchanged under the proposed modifications to the Privacy Rule.

See Appendix A at 2.

With respect to the second category of communications, those that encourage the

use or purchase of a health related product or service and for which the covered entity receives remuneration, the Department initially recognized that covered entities

face a financial conflict of interest when they are paid to recommend a certain

health related product or service. In light of these conflicts, the current Privacy Rule

treats these communications as ‘‘marketing.’’ The Privacy Rule permits health information to be used without the patient’s prior authorization in these circumstances

only if certain conditions are met. The patient must be given an opportunity to opt

out of receiving further communications. Additionally, the patient must be notified

that the covered entity is the source of the communication and is being paid to

make the recommendation. See Appendix A at 1.

Many consumers believe that the Privacy Rule’s delayed opt-out approach is insufficient to protect privacy. They have urged the Department to modify the rule to

require that covered entities obtain patient authorization prior to engaging in this

54

2The Department’s explanation that it is proposing to ‘‘explicitly require covered entities to

first obtain the individual’s specific authorization before sending them any marketing materials’’ ‘‘based on consumer concerns that the marketing provisions in the current rule does not protect

individuals’ privacy’’ is disingenuous at best, given that they accomplish this by removing an

entire category of communications from the definition of ‘‘marketing.’’ See Department’s Press

Release, March 21, 2002. 3See e.g., Robert O’Harrow, Jr., Prescription Fear, Privacy Sales The Washington Post, February 15, 1998 at Al; Henry 1. Davis, ‘‘More Eckerd Questions,’’ St. Petersburg Times, March

5, 2002 at 1E. 4See Bernard Lo, M.D. and Ann Alpers, M.D., Uses and Abuses of Prescription Drug Information in Pharmacy Benefits Management Programs, 283 JAMA 801 at 809 (February 9, 2000).

type marketing activity (i.e., where the covered entity is paid to encourage the use

or purchase of a health related product or service).

In response to these concerns, the Department essentially proposes to eliminate

the protections (albeit inadequate) that currently exist. The Department accomplishes this by removing paid communications that encourage the use or purchase

of a health related product or service entirely from the definition of ‘‘marketing.’’

This proposed change effectively allows covered entities to make this type of paid

communication without any prior authorization or chance to opt out.2 See Appendix

A at 2.

We oppose this change on a number of grounds. First, we believe that the determination whether prior authorization for a communication is required should not

rest on whether a communication is in some way related to health . The proposed

exclusion of ‘‘health related’’ communications from the definition of ‘‘marketing’’ is

extremely broad. It is hard to conceive of a communication that remotely relates to

health that would be considered to be ‘‘marketing.’’ Many activities that health care

consumers would consider marketing and find objectionable would be excluded from

the definition of marketing under this proposal.

For example, the proposed definition of marketing excludes ‘‘a communication

made to an individual. . . to direct or recommend alternative treatments, therapies,

health care providers, or settings of care.’’ (See § 164.501 (defining ‘‘marketing’’).)

Under this exception, a pharmacy can be paid by a drug company to identify and

select patients based on their health information to send them material encouraging

them to switch their prescriptions to the drug companys particular brand of medicine. This ‘‘recommendation of alternative treatment’’ is primarily motivated by profit and has little to do with what is medically best for the patient. Many patients

believe that this financially motivated use of their health information is a violation

of their privacy.3

Second, because recommending any health related product or service is not considered to be ‘‘marketing’’ there is no requirement that the consumer be informed

that the covered entity is receiving remuneration from a third party to make these

recommendations. In the above example, patients could receive materials from their

pharmacy suggesting that they change their medicine to a different brand without

ever being informed that the pharmacy was paid to make the recommendation. This

approach encourages providers to engage in practices that are ridden with financial

conflicts of interest.4

Third, the proposed modification eliminates any control that an individual may

have over the use of his protected health information for receiving this type of recommendation. Because these communications are not ‘‘marketing’’ there is no requirement that the covered entity obtain prior authorization to use the information

in this manner. Furthermore, there is no mechanism by which an individual can

remove his or her name from the covered entity’s mailing list for these ‘‘recommendations.’’ This approach does not respect health care consumers and leaves

them powerless.

Expanding the definition of marketing can cure these faults. We believe that marketing should include communications about a product or service to encourage recipients of the communication to purchase or use the product or service where the

covered entity receives direct or indirect remuneration for making the communication. We would apply this standard to both health related and non-health related

communications. Using this definition presents a rather bright line test. If a covered

entity receives payment for a communication, the communication is marketing.

In conjunction with this recommendation, we urge the Department to retain the

proposed modification that would require covered entities to obtain an individual’s

authorization prior to using his or her health information for these marketing purposes. Health care consumers should have control over whether their health information is used for profit-making purposes that are only tangentially related to their

health.

55

Appointment Reminders and Prescription Refill Notices

A number of concerns have been raised about communications, such as appointment reminders and prescription refill notices, that may potentially fall in the gray

area of what should be considered to be marketing. We would expect that the vast

majority of covered entities do not receive remuneration for sending their patients

appointment reminders. Therefore, this type of communication would not be marketing. Likewise, where a pharmacy on its own volition sends a prescription refill notice or advises a patient of a potential adverse drug reaction and suggests an alternative it would not be marketing. However, where a pharmacy receives payment for

encouraging patients to refill prescriptions or switch medicine brands, the communication would be marketing.

We recognize that at times this definition may encompass some communications

that provide useful information to health care consumers. However, if a covered entity is receiving payment from a third party for making the communication, it is

pursuing activity that is at least partially in its self-interest, as opposed to the interest of the patient. In such a circumstance, the individual should be informed in

advance that the covered entity receives remuneration for its communications and

should have control over whether his or her health information is used in this manner.

IV. SUMMARY OF HEALTH PRIVACY PROJECT COMMENTS ON OTHER PROPOSED

MODIFICATIONS

1. Hybrid Entities—Sec. 164.504

Proposed Modification:

The Department proposes to modify the hybrid entity provisions in order to allow

any covered entity that performs a mixture of covered and non-covered functions to

have the option of being designated a hybrid entity or having the entire organization treated as a covered entity. Additionally, the Department would require that

a covered entity that elects hybrid status include in its designated health care component(s) any component that would meet the definition of covered entity if it were

a separate legal entity.

The modifications would permit, but not require, the hybrid entity to designate

a component that performs: (1) covered functions; and (2) activities that would make

such a component a business associate of a component that performs covered functions if the two components were separate legal entities.

Health Privacy Project Recommendations:

• Reject the proposal that any covered entity can elect to be a hybrid entity, and

require those covered entities whose primary functions are not covered functions to

be hybrid entities and to erect firewalls between their health care components and

other components. Permit (as conditioned below) covered entities whose primary

functions are health care to be hybrid entities. • Modify the implementation specifications of the proposed modified hybrid provisions to require that, at a minimum, a hybrid entity must designate a component

that performs covered functions as a health care component. • Clarify that a health care provider (including a component of a hybrid entity

that provides health care) cannot avoid being deemed a ‘‘covered entity’’ if it relies

on a third party to conduct its standard electronic transactions. Clarify that with

respect to hybrid entities, a health care provider cannot avoid having its treatment

component considered a health care component by relying on a billing department

to conduct its standard electronic transactions.

2. Disclosures of Protected Health Information Related to FDA-regulated

Products or Activities—Sec. 164.512(b)

Proposed Modifications:

The Department proposes to create an extremely broad exception to the general

requirement to obtain authorization prior to the disclosure of protected health information. The proposed modification would allow disclosures of protected health information to private entities as part of any data-gathering activity that can be termed

‘‘related to the quality, safety, or effectiveness of such FDA-regulated product or activity.’’ Under this proposed modification, disclosures would no longer be required

by, or at the direction of, the FDA.

HPP Recommendations:

The Health Privacy Project strongly opposes the Department’s proposal and urges

the Department to retain the current provisions of the Privacy Rule. The Privacy

Rule provides a specific series of public health related exceptions to the authorizaVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00059 Fmt 6633 Sfmt 6621 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
56

tion requirement. The proposed modifications, however, would create a vague and

general standard, under the rubric of ‘‘public health,’’ that would open the door to

the release of protected health information to pharmaceutical companies and arguably to tobacco companies as well. We do not see a genuine public health need that

justifies such a significant expansion in the Privacy Rule.

3. De-Identification—Sec. 164.514

Proposed Modification:

The Department is not proposing any substantive modifications to the de-identification provisions of the Privacy Rule at this time, but is considering the creation

of a limited data set that would not include ’’facially identifiable health information.

This data set would be available for research, public health, and health care operations purposes presumably without authorization. In addition, the Department is

considering the requirement that covered entities obtain data use or similar agreements from recipients that limit the use and disclosure of the data set and prohibit

the recipients from re-identifying or contacting individuals.

Health Privacy Project Recommendations:

The Health Privacy Project supports the Department’s decision to maintain the

de-identification provisions. Before proposing an approach for the use or disclosure

of a limited data set, the Department must carefully consider what identifiers can

safely be included and the adequacy of privacy protections for the data set. We have

specific concerns about the ease with which identifiable information that does not

include direct identifiers can be combined with other data to directly identify an individual, as well as concerns about the enforceability of data use agreements.

4. Research—Secs. 164.512(i),164.508(0, 164.508(c)(1), 164.532

Proposed Modifications:

he Department proposes to:

(1) modify the waiver of authorization provisions.

(2) clarify that the Privacy Rule’s provisions for IRBs and privacy boards would

encompass a partial waiver of authorization for purposes of recruiting research participants.

(3) maintain an individual’s right to revoke an authorization.

(4) permit research authorizations to be combined with other legal permission to

participate in a research study.

(5) permit an authorization to use or disclose protected health information for the

creation and maintenance of a research data base without an expiration date or

event, but limit it to the purpose of creating or maintaining that data base.

(6) permit the use of individually identifiable health information after the compliance date for research protocols that received a waiver of authorization from an IRB

prior to the compliance date.

Health Privacy Project Recommendations:

The Health Privacy Project:

(1) is pleased that research protocols will still be required to meet waiver criteria

that are more narrowly focused on the privacy interests of the research participants.

(2) is pleased that the Department is not proposing modifications to the provisions

on reviews preparatory to research so that researchers could remove protected

health information from a covered entity’s premises for recruitment purposes.

(3) commends the Department for retaining an individual’s right to revoke a research authorization, but recommends further guidance on how to implement the

revocation requirement.

(4) urges the Department not to permit research authorizations to be combined

with an informed consent to participate in a study.

(5) strongly agrees with the Department that the expiration date exception for the

creation and maintenance of data bases should not be extended to authorizations

for further research or any other purpose.

(6) recommends that a research study that receives a waiver of authorization from

an IRB prior to the compliance date, but begins after the compliance date, be reevaluated to ensure that adequate privacy protections are in place.

5. Individual Authorization—Sec. 164.508

Proposed Modifications:

The Department proposes to:

(1) streamline the authorization process by consolidating the different authorizations in the Privacy Rule under a single set of criteria and removing some core elements from the authorization requirement.

57

(2) tighten provisions on the use and disclosure of psychotherapy notes so that

psychotherapy notes cannot be used or disclosed without individual authorization

for another entity’s treatment, payment, and health care operations purposes.

(3) add clarifying language so that an individual who initiates an authorization

would not be required to reveal the purpose of his or her request.

(4) maintain the individual’s right to revoke an authorization.

Health Privacy Project Recommendation:

The Health Privacy Project applauds the Department’s proposal under numbers

(2), (3) and (4) above. However, while we support the Department’s effort to simplify

the authorization provisions, we strongly urge the Department to: (a) retain the core

elements required for research authorizations involving treatment of an individual

under the Privacy Rule; (b) require remuneration disclosures in all authorizations,

not only in authorizations for marketing; and (c) retain the plain language requirement as a core element of a valid authorization. It is critical that an individual

knows how his or her information will and will not be used or disclosed so that s/

he can make an informed decision about giving authorization. Furthermore, any request 11 for individual authorization to use or disclose information must be communicated in a manner that can be understood by the average reader so that people

know what they are authorizing.

6. Accounting of Disclosures—Sec. 164.528

Proposed Modification:

The Department proposes to expand the list of exceptions to the accounting of disclosures requirement so that it no longer requires covered entities to account for any

disclosures made pursuant to an individual authorization.

Health Privacy Project Recommendation:

The Health Privacy Project opposes the Department’s proposal and urges the Department to retain the requirement that disclosures of protected health information

made pursuant to an authorization be included in an accounting of disclosures. Removing authorized disclosures from the accounting takes away the individual’s

means of verifying that his or her information was disclosed as specified in the authorization. Such a modification would also hinder an individual’s ability to detect

authorizations that have been fraudulently submitted or altered.

7. Balancing the Rights of Minors and Parents—Sec. 164.502(9)(3)

Proposed Modification:

The Department proposes to modify the Privacy Rule’s approach to balancing the

rights of minors and parents by permitting covered entities to decide when to disclose protected health information about a minor to a parent in cases where State

or other applicable law is silent or unclear.

Health Privacy Project Recommendations:

The Health Privacy Project opposes the proposed modifications because they

would deter minors from obtaining critical health services, such as mental health

care, substance abuse treatment, and testing and treatment for sexually transmitted

diseases. We recommend that the Department retain the approach in the current

Privacy Rule, except its approach to non-preemption of State laws that are less protective of a minor’s privacy. Specifically, we recommend that the Department apply

the same preemption rules to State laws pertaining to minors and disclosures to

parents that the Department applies to other State laws, as HIPAA requires.

8. Disclosures for Treatment, Payment, or Health Care Operations of Another Entity—Proposed Sec. 164.506(c)

Proposed Modification:

The Department proposes several modifications to clarify how covered entities

may use or disclose protected health information for treatment, payment, or health

care operations, and to permit covered entities to disclose protected health information to other entities (including non-covered entities) for the second entity’s treatment, payment, or health care operations activities.

Health Privacy Project Recommendation:

Most troubling is the Department’s proposal to permit covered entities to disclose

protected health information to other covered entities for the recipient’s health care

operations. This constitutes a significant alteration of the structure of the Privacy

Rule, and the Department is proposing it without adequate justification. The Health

Privacy Project recommends that the Department reconsider the necessity for such

58

a change and assess whether the concept of ‘‘organized health care arrangement,’’

which already is part of the Privacy Rule, addresses the quality assurance issues

raised in the preamble. If the Department pursues modifications along these lines,

the Department should craft narrow language that addresses actual problems—and

only the problems identified in the preamble.

9. Definition of Protected Health Information and Proposed Exclusion of

‘‘Employment Records’’—Sec. 164.501

Proposed Modification:

The Department proposes to amend the definition of ‘‘protected health information’’ in section 164.501 to explicitly exclude ‘‘employment records,’’ referred to in

the preamble as ‘‘individually identifiable health information . . . held by a covered

entity in its role as employer.’’ 67 Fed. Reg. 14804.

Health Privacy Project Recommendation:

The Health Privacy Project opposes this proposal because it threatens to undermine important safeguards in the Privacy Rule. The plain language of the proposed

text appears to move outside of the Privacy Rule any use or disclosure of employees’

health plan records, as well as information shared with an employer’s on-site clinic

where that clinic is a covered provider under the current Privacy Rule. Thus,

through a sweeping ‘‘technical correction’’ in the applicable definition, this proposal

takes health information that is protected by the Privacy Rule and renders it unprotected. This is especially dangerous because of the legitimate concern people have

that employers will use protected health information, including genetic information,

inappropriately to make employment-related decisions (such as deciding which employees to promote or fire).

10. Disclosure of Enrollment and Disenrollment Information to Sponsors of

Group Health Plans—Proposed Sec. 164.504(f)(1)(iii)

Proposed Modification:

The Department proposes to permit group health plans (as well as HMOs and

issuers) to disclose to the sponsor of the group health plan (usually an employer)

information on whether an individual is participating in the group health plan (or

is enrolled in, or has disenrolled from, the HMO or issuer).

Health Privacy Project Recommendation:

The Health Privacy Project supports this proposed modification because it is limited to information about whether the individual is participating in or enrolled in

the plan and does not permit the disclosure of any other protected health information.

11. Minimum Necessary and Oral Communications—Secs. 164.502(a) and

§ 164.530(c)

Proposed Modification:

The Department proposes to:

• modify the Privacy Rule to add a new provision which would explicitly permit

certain ‘‘incidental’’ uses and disclosures that occur as a result of an otherwise permitted use or disclosure under the Privacy Rule; and

• modify the administrative requirements to expressly require covered entities to

reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

Health Privacy Project Recommendation:

The Health Privacy Project does not believe a modification expressly permitting

incidental uses is necessary, but understands that the Department wishes to calm

the fears of some of those in the health care industry. We commend the Department

for including a related modification that expressly requires covered entities to reasonably safeguard protected health information to limit incidental uses or disclosures made pursuant to an otherwise permitted or required use or disclosure.

12. Business Associate Transition Provisions—Sec.164.532 (d) & (e)

Proposed Modification:

The Department proposes new transition provisions to allow most covered entities

to continue to operate under certain existing business contracts with business associates for up to 1 year beyond the current compliance date for the Privacy Rule.

59

Health Privacy Project Recommendation:

The Health Privacy Project recommends that the Department retain the existing

compliance date for all aspects of the Privacy Rule. The Department has provided

covered entities with a model business associate contract which should ease compliance efforts.

V. COST: OMB REPORTS PRIVACY REGULATION WILL SAVE MONEY

According to a March 2002 report just issued by OMB’s Office of Information and

Regulatory Affairs (OIRA), the Department estimates that the cost associated with

implementing the Privacy Rule (approximately $17 billion over 10 years) will be

greatly offset by the cost savings associated with implementing HlPAA’s transactions standards (approximately $29 billion saved over 10 years). See Appendix B

for excerpt of report. The cost of implementing the Privacy Rule must not be viewed

in isolation. The Privacy Rule is an integral—and necessary—part of a package of

Administrative Simplification rules. The goal of standardizing electronic health care

transactions is to create efficiencies and save money. When the Privacy Rule is implemented together with the transactions standards and other Administrative Simplification rules, as contemplated by Congress, a net savings will be achieved. Finally, we must also acknowledge the benefits reaped by increased patient participation in health care and research, as well as the qualitative benefits that are

achieved by furthering this important societal value.

CONCLUSION

When President Bush allowed the Privacy Rule to go into effect last April, he

issued a strong statement about the need to protect patient privacy and foster confidence that people’s ‘‘personal medical records will remain private.’’ The President

also pledged during his campaign to support a law requiring that a ‘‘company cannot use my information without my permission to do so,’’and expressed support for

strong laws protecting medical and genetic privacy. In fact, William Safire dubbed

him the ‘‘privacy President’’ in a New York Times column shortly after the Privacy

Rule went into effect. But, if the Department’s proposed changes become final, the

Privacy Rule will legalize many of the practices that caused public outcry for a law.

We urge the Bush Administration not to roll back the important gains our country

has made in protecting the privacy of people’s medical records. We urge policymakers to look at the substantial progress being made by doctors, hospitals, and

health plans in complying with the Rule. And finally, we urge that glitches in the

regulation be addressed through narrowly tailored fixes that preserve the integrity

of the final Rule.

The CHAIRMAN. I think if someone heard you and heard Mr.

Allen both describing the same piece of legislation, they would wonder how they could. We are grateful for your testimony.

Dr. Harding.

STATEMENT OF RICHARD HARDING, M.D., PRESIDENT,

AMERICAN PSYCHIATRIC ASSOCIATION

Dr. HARDING. Thank you, Mr. Chairman and Senator DeWine. I

am Richard Harding, President of the APA, American Psychiatric

Association, and Professor of Psychiatry and Pediatrics at the University of South Carolina. I am also proud to be a member of the

National Committee on Vital and Health Statistics, as you mentioned, but I am here speaking for myself and for the American

Psychiatric Association.

I want to express my appreciation for being here and for your

committee’s commitment to protecting medical records. I would also

like to compliment you on your efficient and professional staff, who

have been most helpful to all of us coming up to this hearing.

Medical privacy and medical record confidentiality are issues

about which all Americans are deeply concerned, at least 94 percent, as the Senator was saying. Recently the Department of

Health and Human Services has proposed regulations which will

60

probably reduce administrative burdens on physicians and covered

entities, probably. And, as such, this is appreciated as a physician

speaking, but it is important to recognize that they are inadequate

to protect patients.

The APA objects to the elimination of consent by citizens because

the citizens own the consent, and the substitution of a regulatory

permission by Health and Human Services. We strongly believe patients should be able to choose who will see their medical records

and to be fair, in the proposed changes a privacy notice is substituted for the written consent, but this is not privacy. Nor is protection of the patient’s information. We found that out last week

when a company was selling postal addresses and telephone numbers because citizens did not notice in the long privacy notice that

only email addresses would not be released.

It concerns me that the patients, under the proposed rule, do not

have authority over their medical record, even if the patient pays

out of their pocket, which is a rapidly growing trend because of the

issue of privacy.

The APA understands that there are previously described circumstances where a covered entity needs to use or disclose personal health information prior to the initial face-to-face encounter

with a patient and therefore to obtaining consent. It would seem

to me that the remedy for this is to modify the consent requirement

in the privacy rule. The Department of HHS has overcorrected a

problem, by a proposed elimination of the traditional patient right

of affirmative consent altogether. This is a truly sea change event

in American medicine, to go to this way of handling consent.

The APA recommends Health and Human Services retain the

privacy rule’s prior consent requirement with targeted modifications, as mentioned in previous testimony.

Briefly on marketing, marketing is defined, and I think it is important to define it, as ‘‘to make a communication about a product

or service to encourage recipients of the communication to purchase

or use the product or service.’’ The HSS proposed changes to the

marketing provisions appear to require authorization before the patient receives marketing materials. In so doing, that is well intended, but it is flawed. There is no real effective privacy safety net

against commercial usage. The real problem is the exclusions to the

term ‘‘marketing’’ swallow the rule.

Under the proposed changes, a long list of programs is not considered marketing. Marketers can use things such as disease management, as mentioned before, wellness programs, case management, prescription refills and so forth to send marketing materials.

The regulations do not clearly restrict these marketing loopholes

from abuses, and I will not get into the examples of that, which

have already been stated.

It is my experience as a practicing physician that patients have

never dreamed of their personal health information being used for

marketing. That just does not enter their minds. This is especially

critical for marketing to minors.

I strongly urge the committee to join us in requesting HHS require a patient’s consent and their authorization for marketing before medical information is released under HIPAA.

61

We thank you for this opportunity to testify and respond to your

questions and continuing to work with the committee on these important issues. Thank you.

[The prepared statement of Richard Harding, M.D. follows:]

PREPARED STATEMENT OF RICHARD HARDING, M.D.

Mr. Chairman, and members of the Committee, I am Richard Harding, M.D., testifying on behalf of the American Psychiatric Association (APA), a medical specialty

society, representing more than 40,000 psychiatric physicians nationwide. I serve

the APA as its President and am currently Professor of Clinical Psychiatry and Pediatrics at the University of South Carolina School of Medicine. In addition, I serve

as Vice-Chairman for Clinical Affairs of the Department of Psychiatry and maintain

a busy outpatient practice.

While I also serve on the Subcommittee on Privacy and Confidentiality of the National Committee on Vital and Health Statistics within the Department of Health

and Human Services (HHS), the views I am presenting today are my views and the

views of the American Psychiatric Association.

First, I would like to thank Chairman Kennedy and the members of the Committee for the opportunity to testify today. My oral comments will be limited to two

major concerns: consent and marketing. My written testimony is significantly more

expansive as it reflects APA’s comments on all of the NPRM privacy regulation

changes, that we will formally submit to HHS, and I ask that it be made part of

the hearing record.

Mr. Chairman we greatly appreciate your commitment to protecting medical

records privacy. Privacy and particularly medical records privacy is an issue that

not only affects all Americans but also one that they are deeply concerned about.

On behalf of our profession and our patients I thank you for holding this hearing

on the recent changes HHS made to the Medical Privacy Regulation.

While the Department of Health and Human Services (HHS) proposed HIPM privacy regulation changes will reduce the burden on physicians and other healthcare

providers, it is important to recognize they are inadequate to protect patients. The

APA objects to the proposed elimination of the consent requirement that patients

give written consent before their records are disclosed to physicians, hospitals or insurance companies. Under the proposed changes, consent is optional for direct treatment providers. HHS now gives their ‘‘regulatory permission’’ to allow a patient’s

information to be freely disclosed to health plans, providers, and clearing houses

without the patient’s consent. The APA strongly believes patients should be able to

choose who will see their medical records. The elimination of the consent requirement is a significant change not only to the historic doctor-patient treatment relationship but also an impediment to physicians’ efforts to provide the best possible

medical care. The consent requirement gave the physician the opportunity to discuss

where their medical information would be released. We need to take steps to ensure

that doctor-patient confidentiality is preserved and strengthened.

It is troubling to me as a practicing psychiatrist that a patient, under this rule,

does not have consent authority over their medical records even if the patient pays

out of pocket for their treatment. The proposed changes to the rule eliminate patient

protection in a private payment situation with their provider by allowing information to be released without the patient’s consent. For example, celebrities who seek

help from a substance abuse center and pay in cash to be anonymous should be allowed to do so without their health information being released. Similarly, Medicare

patients who elect to personally pay for treatment should not be at risk from the

prying eyes of government.

Under the proposed changes, a privacy notice is substituted for consent. A privacy

notice serves as a long and cumbersome notice that the records will be released.

This is not privacy nor is a protection of the patient’s information. Furthermore,

why must an ill patient have to look in the required privacy notice, which could be

ten pages long as stated by the American Hospital Association. Buried within this

lengthy notice is where a patient’s medical information will be sent. As we have

found out last week internet companies are selling a person’s postal address and

telephone number because the consumer did not notice in the long privacy notice

that only e-mail addresses would not be released.

The APA recommends HHS retain the privacy rule’s prior consent requirement,

with targeted modifications to address the unintended implementation hurdles that

result from the consent requirement in a couple of circumstances.

While the HHS proposed changes to the marketing provision appear to require an

authorization from a patient before the patient receives marketing materials is well

62

intentioned, the devil is truly in the details. The APA is concerned about the loopholes in the definitions of marketing through the enumerated exclusions from the

appearance of protection by the so called marketing definition. There is no real effective privacy protection safety net against commercial usage of private patient information. Under HHS’s changes, marketeers can use disease management,

wellness programs, prescription refill reminders, case management and other related communications to send their marketing materials. These programs are not considered marketing. The regulations do not clearly restrict these marketing loopholes

from abuses. It clearly is not in the best interest of the patient for a drug store to

send a prescription refill reminder without the patient’s authorization after the

pharmacist was compensated by a pharmaceutical company. Recall not to long ago

drug stores admitted to making patient prescription information available for use

by a direct mail company and pharmaceutical companies. Now a pharmacy not only

would be able to legally sell to a pharmaceutical company a list of patients that

have been prescribed certain drugs in order to promote alternative drugs, but also

the pharmacy could now in its own self financial interest in a medication’s more profitable cost to them be suggesting a change in medication refill. The marketing

communication would no longer need to identify the covered entity as the one making the communication, or need to State compensation was received.

Moreover, the fund raising provisions despite overwhelming testimony to the

NCVHS urging that there be an ‘‘opt in’’ (prior consent) not ‘‘opt out’’ after the fact,

using without permission an individual patient’s name for the fund raising purposes

of the covered entity. Can you imagine sending out millions of letters telling you

the names of persons served in your substance abuse treatment program—without

their consent or authorization, and only thereafter, if the fund raiser wishes to do

it again, then have to ask for the individual’s permission to use her or his name

in the fundraising endeavor. Does this sound reasonable to anyone.

I strongly urge the Committee to join us in requesting HHS require a patients

consent and their authorization for marketing before their medical information is

released under the Health Insurance Portability and Accountability Act (HIPAA).

Also, in closing let me just briefly summarize our comments on parental rights to

a minor’s medical records, to wit: there should be no changes to these provisions

which have the effect of reducing access to health care by adolescent patients.

We thank you for this opportunity to testify, respond to your questions and continuing to work with the Committee on these important issues.

The CHAIRMAN. Dr. Clough.

STATEMENT OF JOHN C. CLOUGH, M.D., DIRECTOR, HEALTH

AFFAIRS, CLEVELAND CLINIC FOUNDATION

Dr. CLOUGH. Good morning, Mr. Chairman, Senator DeWine. I

am Dr. John Clough, Director of Health Affairs at the Cleveland

Clinic Foundation and I have also been a practicing

Rheumatologist there for over 30 years.

The Cleveland Clinic Foundation supports Federal privacy protections for identifiable patient information. The privacy rule would

give patients their first-ever Federal protection of identifiable

health information and proposed modifications would improve it

significantly. For the first time, Federal standards prohibit the use

and disclosure of patient information for purposes other than treatment, payment, and health care operations without patient authorization. This morning I will focus on the proposed modification to

the consent provision, as well as an important modification that

the department is considering with respect to how patient information is deidentified.

We support the proposed modification to the consent requirement

for the following six reasons. First, this modification would remove

barriers to patient access to care while strengthening patient privacy protections. The Cleveland Clinic, with 1.6 million patient visits annually and over 50,000 admissions annually, routinely receives information from patients, from referring physicians around

the world, and uses this information to schedule and prepare for

63

examinations and procedures before the patients arrive. Prior consent, perhaps requiring an extra trip, would have to be obtained

before any use of this patient information.

Other inevitable problems include patients being unable to discuss their care over the telephone with covering physicians because

these providers may not have signed consent forms. The same

problem would preclude nurses staffing telephone call centers, such

as the Cleveland Clinic’s nurse-on-call service, from advising patients in many cases.

The proposed modification eliminates these barriers to care without weakening privacy protections. It would strengthen the notice

requirement by requiring that providers give patients a notice of

their rights and obtain acknowledgement that they signed it.

Second, the suggestion that the department make exceptions for

every problem that arises as a result of the consent requirement,

as opposed to fixing the underlying problem, makes little sense and

is unworkable. Furthermore, the fact that HIPAA allows modifications to the privacy rule only once annually would produce long

delays in getting problems fixed.

Third, some have claimed that many States already have similar

consent requirements. In fact, no State has a similarly broad prior

consent requirement. Maine did attempt it in 1999, but had to suspend their law after only 12 days because of severe disruption of

patient care.

Fourth, the modification making consent optional is a workable

compromise of two diametrically opposed approaches taken in the

Clinton proposed regulation and the Clinton final regulation. In

November 1999 the Clinton Administration’s proposed privacy regulation prohibited providers from obtaining prior consent. They argued that such authorizations could not provide meaningful privacy

protections or individual control and, in fact, could culminate an individual’s erroneous understandings of their rights and predications and could impair care.

In response to objections to this approach, the Clinton Administration reversed itself and mandated prior consent in the final rule.

The proposed modifications strike the right balance between these

two extremes.

Fifth, even advocates for the most stringent privacy regulations

testified last year that the prior consent requirement was meaningful and coerced because if the patients refused to sign the consent,

the provider could deny treatment.

Six, various press articles have suggested that physicians do not

support the modification to the consent provision. It is important

for Members of Congress to realize that many, if not most physicians organizations support the modification. In an April 10 letter

to Congress, which is attached to my statement, organizations representing family physicians, surgeons, cardiologists, OB-GYNs and

others, over 400,000 physicians in all, express support for making

consent optional. I might add that many of those are members of

the AMA.

With respect to research and deidentification of patient information, the modifications proposed by the department make several

key improvements that will eliminate unnecessary barriers to the

64

conduct of research while protecting patient confidentiality. The

modifications simplify the procedures and paperwork involved.

In addition, however, we believe that the regulations should permit a limited set of facially deidentified data to be disclosed for research purposes. The department has said it is considering such a

change. Under the final rule some 18 characteristics would need to

be removed to deidentify data. However, the 18 include such items

as zip code, admission and discharge dates, dates of death and age

that do not facially identify individuals and they are often important in epidemiological research, as well as in hospital disease surveillance activities, particularly important in detecting bioterrorism.

Mr. Chairman, that concludes my statement. Thank you again

for giving me this opportunity to testify this morning and I would

be happy to answer your questions.

[The prepared statement of John Clough, M.D. follows:]

PREPARED STATEMENT OF JOHN C. CLOUGH, M.D.

Good morning. I am Dr. John D. Clough, Director of Health Affairs for the Cleveland Clinic Foundation. I am also a practicing rheumatologist.

The Cleveland Clinic Foundation strongly supports meaningful Federal privacy

protections for identifiable patient information. The privacy rule is intended to give

patients the first-ever Federal protection of their identifiable health information. We

believe the recently proposed modifications would make major and necessary improvements to the final rule that will help achieve privacy goals without erecting

barriers to high quality and timely health care for patients.

What has been missed in much of the reporting and debate about the modifications is that they retain, and actually strengthen, the most important new protections for patients. For the first time, Federal standards prohibit the use and disclosure of patient information for purposes other than treatment, payment, and health

care operations without patient authorization. Thus, disclosing a patient’s name and

diagnosis to a newspaper, a bank, an employer, a marketer, without the prior, specific, written authorization of the patient is prohibited. The rule also gives patients

new rights under Federal law to receive notice of their rights, to be informed as to

how their information can and cannot be used, and to access their own medical

record.

In spite of the fact that the proposed modifications keep intact these protections

and actually strengthened many of them, virtually all of the attention of late has

focused on the ‘‘prior consent’’ requirement. This morning I will focus on the modification to the consent provision, as well as an important modification that the Department is considering with respect to how patient information is ‘‘de-identified.’’

Consent

We strongly support the proposed modification which would make it optional,

rather than required, for providers to obtained a signed, written consent form before

using or disclosing identifiable information for treatment, payment, and health care

operations.

First: This modification would remove barriers to timely patient access to care created by the requirement in the final rule. while retaining and even strengthening

strong patient privacy protections.

The following are a few of the many examples from the Cleveland Clinic’s vantage

point of how the requirement, without the proposed modifications, would create significant barriers to patient access to care.

• The Cleveland Clinic and other hospitals routinely receive information about a

patient from referring physicians and use this information to schedule and prepare

for procedures prior to the patient presenting themselves at the hospital. Prior consent would have to be obtained before any use of the patient’s information for treatment. Thus, we could not use information to schedule procedures or begin intake

procedures until we had such consents.

• This would be problem enough for the Cleveland Clinic, where 1.6 million visits

are on an outpatient basis each year. But, the disruption and delay for patients

should be viewed in the totality of their care from beginning to end.

65

• For the patient, the consent requirement would mean multiple trips to sign a

new consent form before receiving care at every point. It would mean signing one

consent form before visiting their physician, another before referral to a specialist,

another before getting an MRI, one more before scheduling surgery at the hospital,

another for the ambulance ride to the nursing home, another before sending someone to pick up a prescription, and on and on. • Other inevitable problems included patients being unable to discuss their care

over the telephone with physicians, nurses and others covering for their colleagues

during non-business hours because these providers may not have a signed consent

form. Also, nurses staffing telephone call centers would be prohibited from advising

patients in many cases because there is not opportunity to obtain prior written consent from the patient.

The proposed modification eliminates these barriers to care without eliminating

privacy protections. It is the written notice, not the consent form, that is the means

by which patients are informed of their rights and how and with whom their information may and may not be used. The modification retains and strengthens the notice requirement in the final rule by requiring that providers give patients the notice and obtain an acknowledgment that the patient has received it.

Second: The suggestion by some that the Department make exceptions for every problem that arises as a result of the consent requirement, as opposed to fixing the underlying problem, is unworkable.

The Department cannot possibly anticipate every problem that could arise, as dozens have become apparent since issuance of the final rule a year and a half ago.

More will arise after the rule takes effect. Because the Health Insurance Portability

and Accountability Act (HIPAA) allows modifications to the privacy rule only once

each year to address such problems, patients would have to suffer through disruptions and delays in care for over a year before such problems could be fixed.

Third: Some have claimed that many States already have similar consent requirements. In fact, today NO State has a similarly broad prohibition on use and disclosure of information for treatment, payment and health care operations without

prior consent.

One State—Maine—did attempt such a broad prior consent requirement in 1999.

The Maine law was suspended in an emergency session of the legislature after only

12 days because of severe disruptions in patient care.

Fourth: The modification making consent optional is a workable compromise of two

diametrically opposed approaches taken in the Clinton proposed regulation and the

Clinton final regulation.

In November 1999, the Clinton administration’s proposed privacy regulation not

only rejected the idea of mandating that providers obtain consent, it went so far as

to prohibit them from obtaining it. In doing so, the Clinton administration argued

that ‘‘(s)uch authorizations could not provide meaningful privacy protections or individual control and could in fact cultivate in individuals erroneous understandings

of their rights and protections.’’ In addition, they maintained that separate authorization for routine referrals ‘‘could impair care.’’ Many physician and other groups objected to the prohibition on obtaining consent.

In response, the administration went to the other extreme and mandated prior consent in the final rule. The recently announced modifications strike the right balance

between these two extremes. Providers may obtain consent if they wish to do so.

However, a provider will not have to delay treatment.

Fifth: Even advocates for the most stringent privacy regulations testified last year

that the prior consent requirement was ‘‘meaningless’’ and ‘‘coerced’’ because if the

patient refused to sign the consent, the provider could deny treatment.

If the patient refuses to sign, there are many situations in which laws, regulations, practice guidelines, and our code of ethics requires physicians to treat the patient. The physician following the code of ethics would then be in violation of the

privacy regulation and subject to civil and even criminal penalties.

Sixth: Various press articles have suggested that physicians do not support the modification to the consent provision. It is important for Members of Congress to know

that many, if not most, physician organizations support the modification.

In an April 10 letter to Congress which is attached to my statement, organizations

representing family physicians, surgeons, cardiologists, OB/GYNs, and others—over

400,000 physicians in all—expressed support for making consent optional.

Research and ‘‘De-identification’’ of Patient Information

The modifications proposed by the Department with respect to research make several key improvements that will eliminate unnecessary barriers to the conduct of

66

life-saving research, while maintaining important protections for patient confidentiality. In particular, the modifications simplify, for patients and researchers, the

procedures and paperwork involved.

However, one additional revision to the privacy regulation is needed. We believe

the regulations should permit a limited set of data which has been ‘‘facially de-identified’’ to 4 be disclosed for research purposes. The Department is considering such

a revision, but has invited further comment before making a final decision to make

the change.

The stringency of the final rule’s requirements for de-identifying information

prompts concerns that the standard would render data useless for much research.

Under the final rule, some 18 characteristics would need to be removed from data

to render it ‘‘de-identified.’’ Most of the characteristics make sense, such as names

and addresses, which could directly identify an individual. However, some do not.

For example, zip codes, admission and discharge dates, date of death, and age do

not directly identify an individual. However, such information is often critical to

conducting research. Epidemiological studies routinely use hospital admission and

discharge dates, date of death to track and understand diseases. Such studies have

taken on new importance with the threat of bioterrorism. Hospitals need to be able

to share de-identified information for such purposes, as well as for improving the

quality of care for patients, and improving community health services. Under the

final rule, sharing this information is not permitted.

There may be no other issue that has so united those in health care; the change

is supported by virtually every corner of the health care community. This includes

groups ranging from the Association of American Medical Colleges, the American

Medical Association, State hospital associations, patient and consumer groups. Attached to my statement are two letters from these groups.

Mr. Chairman, that concludes my statement. Thank you, again, for giving me this

opportunity to testify this morning. I will be happy to answer your questions.

The CHAIRMAN. Thank you very much for your very interesting

statement, which I think with the other statements puts this in

some perspective.

I would like to ask Ms. Goldman, the difference between notification and consent and how you respond to points which were raised

recently by Dr. Clough and others about these areas of treatment

which are necessary and really in the interest of the patient, and

by failing to do sort of a more comprehensive, like the administration is doing, that we really can be perceived as putting the patient

at risk. These are some of the balances. Your response?

Ms. GOLDMAN. I think it is important to keep in mind that we

put the patient at risk today by not protecting privacy and we have

data that shows that, that people are putting their own care at

risk. They are withholding information and they are afraid to seek

care. So people are at risk.

Protecting privacy does not put them at risk, particularly if there

are doctors who want to get the consent to their patients before

using their information to treat them or to pay for their care.

Someone may decide to pay out-of-pocket and the consent form

gives them the opportunity to say to their doctor, ‘‘I am going to

pay out-of-pocket, so I do not want to consent to have the information shared for payment purposes.’’ Many doctors, I think, including Dr. Harding and others, would say that they would want to use

the consent. It is optional certainly for them to decide they want

to mandate it, but they do not have to do that.

And asking someone to consent to having their information used

is certainly different than asking them to sign a notice just telling

them how their information is going to be used. It is a dramatically

different kind of piece of paper and not one I think which is just

about paperwork burden, but which is involving the patient in decisions about his or her care.

67

The CHAIRMAN. Well, how do you respond to these points that

have been raised that by not taking—we have had the example of

the pharmacist and we have had doctors mention these others

kinds of areas. Are you suggesting that we have the right to privacy or the consent form and then have exceptions for these particulars? And can you ever get enough on the list? Your answer?

Ms. GOLDMAN. Well, the Health Privacy Project has been saying

for a year that certain glitches and certain unintended consequences in the privacy regulation should be fixed. We think they

should have been fixed a year ago. So we think that what the secretary of HHS should have done was to make targeted modifications to the privacy regulation to address the consent problems.

Pharmacies should have—this problem should be fixed. Making

referrals, exactly the same problem, that information occasionally

needs to be received before a prescription is filled or a referral is

made. Those are glitches that should have been fixed and we say

in our testimony very specifically, we make recommendations that

those problems should be fixed. But there is no need, and I think

it is unjustified to use those examples to eliminate the consent requirement completely.

The CHAIRMAN. Dr. Clough.

Dr. CLOUGH. The problem, I think, is that glitches as they occur

under the current rule would interfere with treatment and would

interfere with it until they get corrected. Glitches under the other

approach would not interfere with treatment and could be corrected

later with less disruption of care.

And with respect to prior consent, I would say that if you think

about what happens in a physician-patient encounter, when I first

see a patient, I have never seen them before, they have never seen

me before and I am asking them to sign a blanket agreement that

what I do is okay, I think that is less meaningful than getting

some information on the table, deciding what it is that needs to be

consented to, and then get the consent for treatment because I

think that is where the important consent really is.

Patients can tell me that they do not want their information released and I respect that and I do not release it if they do not want

it released, and I think every physician does that.

So I would say that these modifications improve the functionality

of the rule without diluting it and give a chance to change the rule

in the direction of greater privacy if that is necessary, but without

interfering with patient care in the process.

Ms. GOLDMAN. Mr. Chairman, can I respond to what Dr. Cough

has said?

The CHAIRMAN. Go ahead.

Ms. GOLDMAN. It is an interesting point that when a patient asks

him to maintain confidentiality and not to share information, that

he respects that and the consent form that is in the final regulation

gives his patients the opportunity to have that conversation with

him. It is exactly that initial moment that triggers that kind of a

conversation.

A notice is much less likely to ever trigger that conversation and

ever allow for that to happen between Dr. Clough and his patients.

The CHAIRMAN. I am going to have to submit the other questions,

but I thank you. This is an enormously important area. As I said,

68

there are few values that we have that are really more important

than privacy as a country and a society and I think in the medical

area it is right at the top.

We have heard a lot of good testimony today, conflicting testimony, but it does not lessen the importance that I think we have

as a committee and as a Senate to do what is necessary in terms

of both giving the assurance of good treatment, but also in terms

of protecting the privacy, and we are committed to trying to do

that.

I thank our panel very much. We will submit some questions for

you.

The hearing stands in recess.

69

ADDITIONAL MATERIAL

PREPARED STATEMENT OF THE AMERICAN HOSPITAL ASSOCIATION

The American Hospital Association (AHA) and its nearly 5,000-member hospitals,

health systems, networks, and other providers are committed to safeguarding patients’ medical information and ensuring that patients understand and have appropriate access to their medical information. We believe Congress shared these goals

when it enacted the Health Insurance Portability and Accountability Act (HIPAA)

in 1996. Unfortunately, the final regulations implementing that vision elevated bureaucracy above common sense in a number of crucial respects.

Before the Administration proposed changes last month, the rule’s most alarming

provision for hospitals and our patients was the requirement that patients read, review and return a 10-page privacy notice and a separate consent form before they

could be cared for. Hospitals were deeply distressed by visions of parents with sick

or injured children being met at the hospital door not with care and compassion,

but with a lengthy privacy notice that had to be read, and a consent form that had

to be signed, before care could be provided for the child. Yet, that is precisely what

the medical privacy regulations required hospitals to do.

Make no mistake—hospitals are genuinely committed to ensuring that patients

know how their medical information is being used, what their rights are and how

they can exercise them. That is not up for debate. What is up for debate is whether

the current medical privacy regulations enhance medical privacy or frustrate it by

delaying care for patients. The current privacy rule prohibits patients and their physicians from scheduling any testing procedures, outpatient surgery or other care the

government determines isn’t an emergency until the patient (1) receives and reads

their privacy notice, and (2) signs and returns the consent form to the hospital. For

hospitals, the answer is clear: the written consent requirement will frustrate patients and providers to no necessary end.

To test consumer reaction to these written consent requirements, the AHA commissioned an independent research firm, Market Strategies, to poll more than 900

consumers this month about their reaction to the way hospitals were required to

implement the consent requirement under the medical privacy regulation. Here’s

what consumers told them:

• 86 percent think asking a sick person to sign a legal document that could be

10 pages when they see a doctor, nurse or pick up a prescription at the pharmacy

is an unnecessary burden.

• 85 percent agree that elderly Americans will be hurt the most because they see

many different physicians and often have someone else pick up prescriptions for

them.

• 84 percent believe that time spent in a doctor’s office should be spent on patient

care, not filling out more paperwork.

• 77 percent agree that the government should not make hospitals wait to schedule tests until the patient reads the privacy notice and signs and returns a consent

form to the hospital.

The April poll confirms what the AHA had learned earlier this year from a series

of four focus groups that Market Strategies conducted in Tampa and St. Lois. When

apprised on the written consent requirements, consumers said:

‘‘This will be a paperwork nightmare.’’

‘‘They should simply require that hospitals and pharmacies post this [privacy notice], but signing a form is

ridiculous.’’

‘‘I’ve waited 2 hours to see the doctor and he’s got to do all this?’’

The recent announcement by the Department of Health and Human Services

(HHS) that it was proposing to replace redundant written consent requirements

with a written acknowledgment came as welcome news. That proposal does not

weaken, much less eliminate, any of a patient’s privacy rights. It does not change

the fact that hospitals are not permitted to use patients’ information for marketing

or research, without their express written permission. Instead, it allows hospitals

to immediately work with patients and their doctors to provide or schedule medical

treatment or tests. Hospitals are still required to try and obtain written acknowledgment from a patient that he or she has received the privacy notice, but they can

do so when it’s convenient for the patient—not the government. Moreover, asking

patients to acknowledge in writing that they have received the hospital’s privacy notice signals to patients that the notice contains important information that they

should read and understand.

70

Hospitals welcome the proposed change because we care for and about patients— we want all of our patients to be met at the hospital door with care and compassion,

not paperwork and delay. Written acknowledgement will let us keep that promise.

Many lawmakers agree. On July 3, 2001, 165 members of the House of Representatives sent a bi-partisan letter to HHS Secretary Tommy Thompson telling him that

‘‘scheduling patients for surgery, x-rays or other vital services should not depend on

patients having to complete an exhaustive privacy and consent form that could be

10-or-more pages long.’’ HHS responded by replacing redundant written consent

with written acknowledgement, which eliminates a barrier to patient care.

Conclusion

A top priority for America’s hospitals is safeguarding patient privacy while ensuring that nothing gets in the way of patient care. HHS’ proposal to replace the redundant written consent requirement with patient acknowledgement removes one of the

privacy rule’s key roadblocks to the delivery of good patient care. It is good for patients and hospitals and does not sacrifice patients’ privacy rights.

WHY WRITTEN ACKNOWLEDGEMENT IS BETTER FOR PATIENTS AND PROVIDERS

As a result of HHS’s proposed changes to the HIPAA privacy rules, the AHA has

prepared a series of Qs & As to help hospitals respond to inquiries from patients

and the public.

Question 1. Will I know what my rights are if I don’t have to sign a written consent form for hospitals to use my health information?

Yes. Hospitals are still required to provide you with a written notice of their privacy practices (called a ‘‘privacy notice’’) that explains how hospitals are permitted

to use your medical information. Hospitals are permitted to use your medical information for only three purposes: (1) treating you; (2) obtaining payment for your

care; and (3) for their own operations, including improving their ability to provide

quality care to you and other patients. Hospitals are not permitted to use your medical information for any other purpose, such as for marketing or research, without

your written permission, except in a medical emergency or other very limited circumstances, such as those permitted or required by Federal and State law.

The privacy notice explains your medical privacy rights, such as your right to see

and copy your information or request to change that information. It also tells you,

for example, where you need to go to see and copy your information or to request

to change it.

Question 2. Doesn’t signing a written consent form make it more likely that I will

learn about or understand my privacy rights?

No. The privacy notice you will receive from the hospital—not the written consent

form—explains your privacy rights. The written consent form didn’t provide any additional information that isn’t already in the privacy notice. Under the changes proposed, hospitals will be required to have you acknowledge in writing that they have

given you their privacy notice. Hospitals want patients to know and understand

their medical privacy rights. And by having you acknowledge that you were given

a copy of their privacy notice, hospitals are letting you know that the privacy notice

has important information that you need to read and understand.

Question 3. Will I be losing any of my privacy rights if I’m not required to sign

a written consent form?

No. None of your privacy rights will be lost. Your rights are guaranteed by the

rule and by the notice, whether or not you sign a consent form. For example, you

will still have the right to request that the hospital not contact you at the office

with any test or medical results, but only call you at your home.

Question 4. Was there something wrong with having patients sign a written consent form?

Yes. Hospitals could not work with you or your doctor to schedule any testing procedures, outpatient surgery or other care the government determined wasn’t an

emergency until you (1) received and read their privacy notice, and (2) signed and

returned the consent form to the hospital. Hospitals were not allowed to make any

exceptions to this rule, even for disabled or elderly Americans or those who lived

in remote rural areas. Hospitals were very concerned that their ability to respond

quickly to the needs of their patients would be hampered by this unnecessary requirement and that patients would be frustrated with them because they were not

allowed to make exceptions to this Federal law.

Question 5. Will the hospital be able to use my health information in ways that

are not approved by the Federal privacy rule if I don’t sign a written consent form

for the use of my information?

No. The rules continue to obligate hospitals to use your health information only

for (1) treating you; (2) obtaining payment for your care, and (3) for their own operVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00074 Fmt 6633 Sfmt 6621 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
71

ations, including improving the quality of care they provide to you and other patients. Hospitals must explain the ways they will use your health information in the

privacy notice they have to give to you. A hospital cannot use or disclose your health

information in other ways, such as for marketing or research, unless the hospital

gets your written permission before doing so.

Question 6. Is a hospital prevented from getting my written consent to use my

health information?

No. Hospitals and doctors are still permitted to ask for your written consent before they use information about you to provide health care services; however, if they

use a written acknowledgement, they won’t have to delay providing care for you

until you (1) received and read their privacy notice, and (2) signed and returned the

consent form to the hospital or doctor.

Question 7. Will hospitals know that I received their privacy notice if I don’t have

to sign a written consent?

Yes. The proposed changes to the privacy rules require hospitals to have you acknowledge, in writing, that you received their privacy notice. At the time you receive the notice, the hospital will ask you to acknowledge in writing that you received the notice.

Question 8. Will this new proposal requiring me to acknowledge that I have received the privacy notice mean that I’m spending more time filling out forms in the

hospital admission office or emergency room?

No. Signing an acknowledgement should not increase the time you have to spend

in the admission process. In an emergency situation, this acknowledgement can

even be delayed to allow you to give it at a less stressful and more convenient time.

Question 9. Why is a written acknowledgement that I received the hospital’s privacy notice better than the requirement that I sign a written consent?

The written acknowledgement allows hospitals to immediately work with you or

your doctor to treat you or to schedule any testing procedures, outpatient surgery

or other care. In an emergency situation, hospitals can even delay getting your written acknowledgement until a less stressful and more convenient time for you. The

acknowledgement does not take away any of your privacy rights. And it is still an

effective way for hospitals to let you know that the privacy notice they give to you

has important information about your privacy rights that they want you to read and

understand.

The written consent requirement, on the other hand, forced hospitals to delay

scheduling any testing procedures, outpatient surgery or other care or giving you

any treatment the government determined wasn’t an emergency until you (1) received and read their privacy notice (which could be as long as 10 pages in order

to meet Federal requirements), and (2) signed and returned the consent form to the

hospital or doctor. Hospitals were not allowed to make any exceptions, even for disabled or elderly Americans or those who lived in remote rural areas. The written

consent requirement increased the paperwork burden for patients and hospitals

without giving you any new privacy rights that the rule and the privacy notice

doesn’t already guarantee or any additional information about your rights that isn’t

already in the privacy notice.

Question 10. Do the proposed changes to the privacy rules affect any of my privacy rights?

No. The proposed changes to the privacy rules do not do away with or weaken

any of your privacy rights. Your rights continued to be guaranteed. The proposed

changes only get rid of a significant roadblock that would have forced hospitals to

delay your treatment until you (1) received and read their privacy notice, and (2)

signed and returned the consent form to the hospital or doctor, and cut the unnecessary paperwork burden for patients and hospitals.

PREPARED STATEMENT OF MEMBERS OF THE ALLIANCE OF MEDICAL SOCIETIES

As you are aware, on March 27, 2002, the Department of Health and Human

Services (HHS) issued a proposed rule to modify the ‘‘Standards for Privacy of Individually Identifiable Health Information.’’ We, the undersigned members of the Alliance of Medical Societies, strongly support the proposed modifications that HHS is

considering with respect to prior consent and research and would also like to comment on the business associates provision.

The Alliance of Medical Societies comprises 12 national medical societies representing more than 150,000 specialty-care physicians. Its mission is to promote

sound Federal health care policies that will enhance the ability of specialty-care

physicians to provide the best possible health care to their patients.

72

Prior Consent

The proposed modifications to the prior consent portion of the rule represents a

workable compromise between the original proposed regulation issued in 1999 that

would have prohibited providers from obtaining consent and the final privacy regulation issued in 2000 that mandated prior consent requirements. These modifications maintain the patient privacy protections required by Congress without disrupting patient access to quality health care.

The Alliance supports meaningful privacy protections for patients’ medical records

and believes that it is important for patients to be notified of their rights. The proposal for regulatory permission as opposed to mandatory written consent would not

change the ethical and professional practice of physicians and most health care providers to obtain patient consent. Not only would the prior consent requirement add

yet another mandatory form to the already unmanageable paperwork burden that

physicians and practitioners face on a daily basis, it could pose serious problems for

patient care. HHS outlined many of the potential problems in the proposed rule. We

strongly believe that HHS chose wisely in proposing to make prior consent discretionary, and we oppose any efforts to change it.

Medical Research

We also thank the Administration for improving the provisions governing medical

research. The proposed modifications alleviate the burdens placed on medical researchers and removes obstacles that would impede important public health research. In particular, the Alliance supports the Administration’s proposal to simplify

the authorization process and to eliminate the inconsistent privacy review criteria

for Institutional Review Boards. Without these critical changes, health care studies

may be abandoned or avoided altogether as the burdens and liability associated with

compliance would deter many medical researchers.

In addition, although HHS did not propose to modify the de-identification standard, we appreciate their call for additional comments on this provision. We urge the

Department to reconsider the Final Rule’s current standard, which requires the removal of 18 characteristics from data in order to render it ‘‘de-identified.’’ Some of

the data that must be removed—specifically, dates of admission or service and device serial numbers—are often needed when evaluating medical records for epidemiological and other health related research.

We believe the regulation could be improved significantly by modifying the deidentification standard to require that information instead be stripped of direct identifiers that would facially identify an individual. Direct identifiers would be defined

as name, address, electronic mail address, telephone number, fax number, social security number, health benefits number, financial account numbers, drivers license

number or other vehicle numbers that are in the public records system.

Business Associates

While the Administration proposes to provide a 1-year window for covered entities

to revise their contracts with business associates, these same covered entities will

be required to comply with the new rule regardless of whether or not a new contract

has been secured. Hence, the 1-year window provides a false sense of flexibility. We

are further concerned that HHS will require business associate contracts between

two covered entities. This seems to defy reason since each covered entity will be required to comply with the regulation independently.

To conclude, we strongly support meaningful and workable privacy protections for

patients’ medical records and appreciate this opportunity to express our views on

the modifications to the privacy regulations proposed by HHS.

Sincerely, American Academy of Dermatology Association; American Assoc. of

Neurological Surgeons/Congress of Neurological Surgeons; American Association of

Orthopaedic Surgeons; American College of Cardiology; American College of Radiology; American Society of Cataract & Refractive Surgery;

PREPARED STATEMENT OF SUE A. BLEVINS

Thank you, Mr. Chairman and Committee members, for holding this timely public

hearing to examine how the proposed revisions to the Federal medical privacy rule

will affect patients’ control over their personal health information. I appreciate the

opportunity to submit written testimony and focus on the concerns raised by thousands of citizens who submitted comments to the U.S. Department of Health and

Human Services (HHS) opposing access to their personal health information without

their consent.

In particular, sections 164.502 and 164.506 of the revised rule give the Federal

Government the regulatory authority to decide for each and every citizen who can

73

1 ‘‘Standards for Privacy of Individually Identifiable Health Information,’’ Federal Register,

Vol. 67, No. 59, March 27, 2002, pp. 14776–14815, [http://www.access.gpo.gov/su—docs/fedreg/

aO20327c.html]. 2 ‘‘ Ibid.

access individuals’ medical information-including genetic information-for most purposes, including medical treatment, payment and health-care operations. The U.S.

Department of Health and Human Services and the medical industry should not be

making these decisions for individuals. In fact, a national Gallup survey shows that

Americans want to be the ones to decide who can see their personal health information with—or without—their consent.

Majority of Americans are Concerned About Medical Privacy According to a National

Gallup Survey

The Institute for Health Freedom commissioned a national Gallup survey to find

out how Americans feel about medical and genetic privacy. We had heard from privacy advocates across the country about their concerns. But we wanted to find out

how ordinary citizens across the Nation—not just privacy advocates—feel about the

issue.

The national Gallup survey was conducted between August 11 and August 26,

2000 and the results are posted at the Institute for Health Freedom’s Web site:

www.ForHealthFreedom.org. (As of April 2, 2002, the survey had not been updated

by the Gallup Organization.) The survey of 1,000 adults nationwide found an overwhelming majority of Americans do not want third parties to have access to their

medical records—including genetic information—without their consent.

• 95 percent say banks should not be allowed to see patients’ medical records

without individuals’ consent;

• 92 percent oppose allowing governmental agencies access to patients’ medical

records without permission;

• 88 percent oppose letting police or lawyers review medical records without explicit consent;

• 84 percent say employers should not be allowed access to patients’ medical

records without permission; and

• 67 percent oppose researchers accessing patients’ medical records without consent.

The national Gallup survey also included two important questions about genetic

privacy. One asked whether doctors should be allowed to test patients for genetic

factors without their consent. Only 14 percent of respondents would permit such

testing; 86 percent oppose it.

The other question asked whether medical and governmental researchers should

be allowed to study individuals’ genetic information without first obtaining their

permission. More than nine in ten adults (93 percent) feel medical and governmental researchers should first obtain permission before studying their genetic information.

What’s more, when asked whether they are aware of a Federal proposal to assign

a medical identification number—similar to a Social Security number—to each

American, only 12 percent said they had heard anything about it. College-educated

adults (16 percent) are more likely than those with less than a college education

(8 percent) to be aware of the proposal. Regardless of their knowledge about it, however, an overwhelming majority (91 percent) oppose the plan.

I strongly encourage this committee to consider how the final and revised Federal

medical privacy rule is going to strip patients of the ability to decide who can access

their personal health information (including genetic information) with—or without—

patients’ consent.

Finally, following is a ‘‘questions and answers’’ summary about the proposed revised Federal medical privacy rule:

Update on the Federal Medical Privacy Rule: Questions and Answers*

Americans are being told they will have stronger medical privacy protections

under the revised Federal medical privacy rule published in the Federal Register

on March 27, 2002.1 However, the following ‘‘questions and answers’’ summary

shows that the revised rule does not provide patients stronger medical privacy.

Rather, it actually weakens individuals’ ability to restrict access to their medical

records.

The following summary is based on a review of the revised Federal medical privacy rule (published March 27, 2002) 2 compared to the final Federal medical priVerDate 11-MAY-2000 09:32 Feb 27, 2003 Jkt 000000 PO 00000 Frm 00077 Fmt 6633 Sfmt 6621 S:\DOCS\78950.TXT SLABOR3 PsN: SLABOR3
74

3 ‘‘Standards for Privacy of Individually Identifiable Health Information,’’ Federal Register,

Vol. 65, No. 250, December 28, 2000, pp. 82462–82829, [http://www.access.gpo.gov/su—docs/

fedreg/aO01228c.html]. 4Federal Register, Vol. 67, No. 59, March 27, 2002, pp. 14780, 14812.

5Federal Register, Vol. 65, No. 250, December 28, 2000, pp. 82798, 82803–82805; Federal Register, Vo1. 67, No. 59, March 27, 2002, pp. 14810–14812. 6Federal Register, Vo1. 67, No. 59, March 27, 2002, p. 14777.

7Federal Register, Vo1. 65, No. 250, December 28, 2000, p. 82802.

8 Ibid., pp. 82811, 82805.

9 Ibid., p. 82826.

10Federal Register, Vol. 64, No. 212, November 3, 1999, p. 59941.

vacy rule (published December 28, 2000).3 Citations to specific key pages are provided to help the public, media, and policymakers understand the serious implications of the rule.

Does the revised Federal medical privacy rule provide consumers greater control over

the flow of their personal health information?

No, under the revised Federal medical privacy rule, patients will not be in control

of deciding whether they want health insurers, doctors, and medical data-processing

companies to share their personal health information—including genetic information—with others. Rather, health insurers, doctors and medical data-processing companies are actually granted ‘‘regulatory permission’’ to share patients’ health information for any activities related to patients’ health care treatment, processing of

their health care claims, or ‘‘health care operations’’—a term which encompasses

many activities unrelated to patients’ direct care (such as permitting FBI officials

to search medical records looking for fraud and abuse activities).4

Also, under the revised Federal medical privacy rule health insurers, doctors, and

medical data-processing companies will not need to get patients’ written, informed

consent before sharing patients’ personal health information—including past medical records and genetic information—with many third parties.

How Does Congress or HHS Define ‘‘Medical Privacy’’ or ‘‘Privacy’’?

They don’t. Ironically, while the Federal medical privacy rule includes many definitions, the terms ‘‘medical privacy’’ or ‘‘privacy’’ are not clearly defined in the rule.5

Instead, a Federal committee composed primarily of fact-gathering experts was

given the legal authority to advise HHS in establishing standards for Americans’

medical privacy.6

Are patients guaranteed the right to sign private contracts with their doctors to withhold personal health information from third parties?

No, patients cannot withhold their personally identifiable health information from

the U.S. Department of Health and Human Services. In fact, the rule creates a massive Federal mandate that requires every doctor and other health care practitioner

to share patients’ records with the Federal Government—specifically the U.S. Department of Health and Human Services (HHS)—without patient consent.7 The Federal Government even has the right to access an individual’s psychotherapy notes

in order to monitor compliance with the rule.8

Will patients be guaranteed the right to an accounting of to whom and when their

personal health information was disclosed for health care services related to

their treatment and processing of health claims?

No, patients will not receive an accounting of to whom and when their records

were disclosed for most health care services, including activities related to treatment, payment, or health care operations (a broad definition encompassing many

uses).9

In just a few years, patients’ personally identifiable health information is going

to be flowing over the Internet—without patients’ permission—for purposes related

to treatment, payment, and health care operations. But patients won’t even know

this is happening because they won’t be able to obtain an accounting of disclosures

for treatment, payment, and health care operations.

Will President Bush’s proposed changes to the Federal medical privacy rule (published March 27, 2002) strengthen or weaken Americans’ medical privacy?

It is important to note that the Clinton Administration initially proposed prohibiting doctors and hospitals from getting patients’ consent before releasing their medical information.10 But after receiving more than 52,000 public comments, the Clinton Administration revised the rule and added a very weak, coercive consent provision.

75

11Federal Register, Vol. 65, No. 250, December 28, 2000, pp. 82525, 82528, 82813–82817. 12 Ibid., pp. 82801–82802. 13 Ibid., p. 82802. 14 ‘‘Health Insurance Reform: Standards for Electronic Transactions; Announcement of Designated Standard Maintenance Organizations; Final Rule and Notice,’’ Federal Register, Volume

65, No. 160, August 17, 2000, pp. 50312–50313. 15 Ibid., p. 50313.

However, the Bush Administration is legally permitting health insurers, doctors

and medical data-processing companies to release patients’ personal health information without asking patients for their permission. Instead, these entities can simply

provide notices of how the information will be shared. This policy takes the active

decisionmaking authority away from patients and shifts it to doctors and hospitals.

This is a major shift away from the precious health care ethics that we have honored for many years in this country: the ethics of consent and confidentiality.

In addition to allowing patients’ medical records to be disclosed for treatment, payment and health care operations, who else can see patients’ records without patients’ consent?

Under the Bush Administration’s revised rule (as under Clinton Administration’s

final rule), Americans’ medical records can be disclosed for many broadly defined

purposes without patient consent, including, but not limited to, the following:

• Oversight of the health care system

• FDA monitoring (including dietary supplements)

• Public health surveillance and activities

• Foreign governments collaborating with U.S. public health officials

• Research (if an IRB or privacy board waives consent)

• Law enforcement activities

• Judicial and administrative proceedings

• Licensure and disciplinary actions.11

Does the Federal medical privacy rule provide patients recourse if their privacy is

breached?

No, patients are not guaranteed any recourse other than the right to complain.12

They can complain to their health care providers or institutions about privacy

breaches. They also can complain to the Secretary of the U.S. Department of Health

and Human Services. However, the HHS Secretary does not have to investigate the

complaint. The final rule reads that the Secretary ‘‘may,’’ not ‘‘shall,’’ investigate

complaints.13

Additionally, individuals do not have a private right of action (they can’t sue) if

their privacy is breached under the final medical privacy rule.

Why was the Federal medical privacy rule created in the first place?

The Federal medical privacy rule was established as dictated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that fosters the development of a national health information network through standardized codes for all

health care services nationwide.14 The HIPAA law requires health plans to use national standardized codes for electronic transactions for payment of medical care.

The HIPAA law additionally requires that unique health identifiers be assigned to

four groups, including every: (1) individual, (2) health care provider, (3) employer,

and (4) health plan.15 Those identifiers will facilitate electronic transactions for all

types of health care, whether services are paid by government or privately. (Note:

the individual identifier has been put on hold temporarily for 1 year.)

The result will be that each patient’s visit to a doctor or hospital will be easily

tracked.

In the next few years, it is going to become increasingly simple to transfer electronic medical records over the Internet. With just a click of a mouse, it will be

much easier to access and share individuals’ records with many third parties. That

is why all Americans should become informed about the Federal medical privacy

rule and demand the right to control their most personal information—their health

information, including genetic information.

* This update analysis on the Federal medical privacy rule was prepared by Sue

Blevins, President, Institute for Health Freedom and Deborah Grady, Research Associate, Institute for Health Freedom. Many of the Federal medical privacy rule provisions remain the same as those analyzed in a previous paper titled ‘‘The Final

Federal Medical Privacy Rule: Myths and Facts’’ by Sue Blevins and Robin Kaigh,

Esq. (February 8, 2001), see [http://www.forhealthfreedom.org/Publications/Privacy/

MedPrivFacts.html].

76

[Whereupon, at 12:10 p.m., the hearing was adjourned.]

Æ