She eventually found another job and quit the company. Proposed federal rules aimed at protecting the privacy of medical records are murky about whether employers can access workers' files, prompting privacy and physicians' groups to call for tougher regulations that include, among other things, a requirement that health plans, insurers and employers get a patient's permission before disclosing medical information. The Department of Health and Human Services, which wrote the proposed regulations, has received thousands of comments from consumers and interest groups about the rules, the subject of a congressional hearing scheduled for today. The rules call for insurers to notify patients about how their information is used but allows them to use medical records without authorization as long as it's for treatment, payment or operational purposes. HHS officials said their aim was for patients to receive better information about how records are used than they are probably getting now.
Most patients have to sign a broad consent form as a condition of treatment.
But the privacy groups say the proposed regulations, which apply to electronic, not paper, records, are too broad and provide little protection of privacy. They believe that if people are concerned that their medical information could be disclosed, they won't be open with their doctors, which could hurt their medical care. HHS wrote the rules after Congress failed to meet a self-imposed deadline in August to adopt legislation. The rules require health organizations to get patients' written permission to release information that would be used for something other than treatment, payment or operational purposes. Any information they did release would have to be the minimum necessary - not the patient's entire file.