The resolutions were fashioned after nearly a decade of debate over how to protect the privacy of medical records. While federal law protects bank, video rental, credit and other records, there have been no federal protections for medical records. That left patients to rely on a patchwork of state rules. There are also new civil penalties for other violations. Law enforcement agencies could obtain access to records with an administrative subpoena or summons, but would not have to go to court, said officials familiar with the regulations.
Rules also allow states to pass stricter laws if they choose.
In addition, they require health providers and insurance companies to alter their contracts with business partners, including attorneys, auditors and consultants, to ensure they adhere to the privacy restrictions. But if outside businesses violate the rules, there are no federal sanctions. Confidentiality not absolute Smith said he was concerned the rules would open the door for litigation by patients. The new rules do not guarantee confidentiality. For example, an employer or insurer can require a patient to waive the right to privacy as a condition of eligibility into an insurance program.