The recommendations are far better than the most recent legislative privacy effort, the Bennett-Leahy Medical Records Confidentiality Act that was introduced in October 1995. Even as far as Shalala goes, we can expect a number of strong protections. Medical information cannot be used for activities outside treatment and payment, such as for use in direct marketing to patients. Everyone in the chain of health care providers, health insurance companies, and related services are covered by the same rules. Employers are prevented from misusing medical data for decisions on hiring and promotion.
Patients can see their own records and demand corrections.
Patients must be told when when information is released, and to whom. Unauthorized disclosures are punished with both civil and criminal penalties. Health providers must provide written policies explaining patients' privacy rights, models for which Shalala's agency will draw up. Records of disclosures must be preserved along with the medical information for the life of the information. Yet the recommendations leave too many loopholes.