Grealy says, for example, that the consent form alone could run to nine pages. But no doctor or hospital wants to be in that position. Of particular concern to privacy experts is the marketing provision, which they say slipped in after the public-comment period ended. Marketing of health information certainly isn't new. Yet the regulations go beyond current practice to explicitly permit a patient's medical records to be disclosed to pharmaceutical makers and others doing business with healthcare providers.
Patients can ask to be removed from a company's marketing list only after they've been contacted.
Perhaps the largest loophole in the privacy plan is that it won't apply to most health Web sites. Rogue Viagra sites, for example, accept cash payments rather than insurance and therefore fall outside the regulations. That's bad news for consumers, says Janlori Goldman, director of the Health Privacy Project at Georgetown University. This is directly at odds with consumers' expectations of anonymity and security when they go online. Unless President George W. Bush takes action, the rules will become law next month.