Medical Privacy Regulation: Questions Remain About Implementing the New Consent Requirement
Published: 2001-04-06T00:00:00

Fast Facts:

Highlights:
section_title: What GAO Found
paragraphs: The Department of Health and Human Services issued a final regulation in December 2000 that established rights for patients with respect to the use of their medical records. The regulation requires that most providers obtain patient consent to use or disclose health information before engaging in treatment, payment, or health care operations. The privacy regulation's consent requirement will be more of a departure from current practice for some providers than for others. Most health care providers, with the exception of pharmacists, obtain some type of consent from patients to release information to insurers for payment purposes. The new requirement obligates most providers to obtain consent before they can use and disclose patient information. It also broadens the scope of consent to include treatment and a range of health care management activities. Supporters of the requirement believe that the process of signing a consent form provides an opportunity to inform and focus patients on their privacy rights. Others, however, are skeptical and assert that most patients will simply sign the form with little thought. In addition, provider and other organizations interviewed are concerned that the new consent requirement poses implementation difficulties. They contend that it could cause delays in filling prescriptions for patients who do not have written consents on file with their pharmacies, impede the ability of hospitals to obtain patient information prior to admission, hamper efforts to assess health care quality by precluding the use of patient records from years past, and increase administrative burdens on providers.

section_title: Letter
paragraphs: Although there is a strong consensus supporting the protection of patient confidentiality, views differ as to the best ways in practice to achieve that goal. Pressures are increasing from insurers, providers, and researchers to draw on medical records to study treatment outcomes and monitor expenditures, activities that are becoming increasingly common as medical records are computerized and large databases compiled. In recognition of these trends, the Health Insurance Portability and Accountability Act of 1996 called for the development of comprehensive privacy standards that would establish rights for patients with respect to their medical records and define the conditions for using and disclosing personally identifiable health information. On December 28, 2000, the Department of Health and Human Services (HHS) issued the final regulation on privacy, and it is now under review by the Congress and the new Secretary of HHS.
One prominent point of disagreement is whether the federal government should require health providers to obtain patient consent prior to their use or disclosure of personal medical information for purposes of treatment, payment, and routine health care management activities. You asked us to examine the consent requirement in the federal privacy regulation and assess (1) how it differs from the types of consent providers currently obtain from patients and (2) its potential consequences for patients and providers. You also asked us to review how states that have passed health privacy laws addressed the patient consent issue, and we have included this information in appendix I. To meet your request, we contacted 18 organizations, including groups representing patients, providers, and health plans as well as a group practice, an integrated health care system, a large chain pharmacy, and a regional health plan. (See app. II.) In addition, we reviewed the regulation and spoke with HHS representatives responsible for its development. We performed our work in March 2001 in accordance with generally accepted government auditing standards.
subsections: section_title: Background
paragraphs: The final medical privacy regulation requires that most providers obtain patient consent to use or disclose health information before engaging in treatment, payment, or health care operations. As defined in the regulation, health care operations include a variety of activities such as undertaking quality assessments and improvement initiatives, training future health care professionals, conducting medical reviews, and case management and care coordination programs. The consent form must alert patients to the provider’s notice of privacy practices (described in a separate document) and notify them of their right to request restrictions on the use and disclosure of their information for routine health care purposes. Providers are not required to treat patients who refuse to sign a consent form, nor are they required to agree to requested restrictions. The consent provision applies to all covered providers that have a direct treatment relationship with patients. The regulation also specifies several circumstances where such prior patient consent is not required. The privacy regulation does not require health plans to obtain written patient consent.
This approach to patient consent for information disclosures differs from that in HHS’ proposed privacy regulation, issued for public comment November 3, 1999. The proposed regulation would have permitted providers to use and disclose information for treatment, payment, and health care operations without written consent. At the time, HHS stated that the existing consent process had not adequately informed patients of how their medical records could be used. Comments HHS received on this provision were mixed. Some groups approved of this approach, saying it would ensure that covered entities could share information to provide effective clinical care and operate efficiently, while not creating administrative requirements that would add little to individual privacy. However, others wrote that individuals should be able to control to whom, and under what circumstances, their individually identifiable health information would be disclosed, even for routine treatment, payment, or health care operations.
section_title: Most Providers Obtain Consent to Disclose Patient Data for Insurance Payment
paragraphs: The extent to which the privacy regulation’s consent requirement will be a departure from business as usual varies by type of provider. Under current practices, physicians and hospitals generally obtain consent to use patient data for processing insurance claims, but they obtain consent substantially less often for treatment or health care operations. Pharmacists, however, typically do not have consent procedures in place for any of the routine purposes included in the regulation. Specifically:  Most, but not all, physicians get signed written consent to use patient data for health insurance payment. Exceptions to this practice include emergency situations and patients who choose to pay for their treatment “out of pocket” to avoid sharing sensitive information with an insurer. However, physicians do not typically seek approval to use patient data to carry out treatment or health care operations.
Nearly all hospitals routinely obtain written consent at the time of admission, at least for release of information to insurance companies for payment purposes. A 1998 study of large hospitals found that 97 percent of patient consent forms sought release of information for payment, 50 percent addressed disclosure of records to other providers, and 45 percent requested consent for utilization review, peer review, quality assurance, or prospective review—the types of health care management activities considered health care operations in the federal privacy regulation.
Pharmacies do not routinely obtain patient consent related to treatment (i.e., before filling a prescription), payment, or health care operations. However, industry representatives told us that pharmacies conducting disease management programs (specialized efforts to ensure appropriate pharmaceutical use by patients with certain chronic conditions) typically seek consent to share information with physicians about the patients’ condition, medical regimen, and progress.
The new consent requirement makes several important changes to current practices that have implications for patients and providers. For patients, they will be made aware that their personal health information may be used or disclosed for a broad range of purposes including health care operations. Other provisions of the privacy regulation grant patients additional protections, including the right to access their records, to request that their records be amended, to obtain a history of disclosures, and to request restrictions on how their information is used. For providers directly treating patients, they will have a legal obligation to obtain prior written consent and to use a form that meets specific content requirements.
section_title: Perceived Benefits for Patients and Implementation Concerns Among Industry Groups
paragraphs: Supporters of the consent requirement argue that the provision gives patients an opportunity to be actively involved in decisions about the use of their data. Yet, many groups recognize that signing a provider’s consent form does not, per se, better inform patients of how their information will be used or disclosed. In addition, most provider organizations we interviewed told us that the privacy regulation’s consent requirement will be a challenge to implement and may impede some health care operations.
subsections: section_title: Consent Requirement Intended to Raise Privacy Awareness
paragraphs: The American Medical Association (AMA), the Bazelon Center for Mental Health Law, and the Health Privacy Project (HPP) indicated that the consent process offers important benefits to patients. These groups view the process of signing a consent form as a critical tool in focusing patient attention on how personal health information is being used. They assert that only providing patients with a notice of privacy practices is not sufficient because most patients are not likely to understand its importance, much less read it. The patient advocacy groups told us that the act of signing the consent can help make patients aware of their ability to affect how their information is used. This heightened awareness, in turn, may make patients more likely to read the notice of privacy practices or to discuss privacy issues with their health care provider. HPP cited the process of signing consent as offering an “initial moment” in which patients have an opportunity to raise questions about privacy concerns and learn more about the options available to them. This opportunity may be especially valuable to patients seeking mental health and other sensitive health care services.
In contrast, many groups we interviewed question the value of the consent form for patients. For example, the Medical Group Management Association (MGMA) and the American Hospital Association (AHA) assert that the process of signing a consent form may be perfunctory, at best, and confusing, at worst. To some extent, patient advocacy groups we spoke with agree. They say that patients will be under pressure to sign the form without reading the notice, as providers can condition treatment upon obtaining consent. They contend that many patients may not find the consent process meaningful. They maintain that nevertheless it should be required for the benefit it offers patients who may be particularly interested in having a say about how their health information will be used.
section_title: Industry Representatives Anticipate Difficulties in Implementing the Consent Requirement
paragraphs: Health plan and provider organizations we interviewed told us that the consent requirement poses implementation difficulties for patients and providers both during the regulation’s initial implementation and beyond. The extent of these challenges and their potential implications vary by type of provider. In general, these organizations do not favor written consents for routine uses of patient information, although they support the regulation’s requirement to provide patients with privacy notices.
The consent requirement would require pharmacists to change their current practices. Under the regulation, a patient must sign a consent form before a pharmacist can begin filling the prescription. According to the American Pharmaceutical Association and the National Association of Chain Drug Stores, this requirement would result in delays and inconvenience for patients when they use a pharmacy for the first time.Also, pharmacies would not be able to use patient information currently in their systems to refill prescriptions or send out refill reminders before receiving patient consent to do so. In addition, patients who spent time in different parts of the country and were accustomed to transferring their prescriptions to out-of-state pharmacies would have to provide consent to one or more pharmacies before their prescriptions could be filled. Pharmacy and other organizations have suggested that the privacy regulation should recognize a physician-signed prescription as indicative of patient consent or that pharmacies could be considered indirect providers and thus not subject to the consent requirement.
Hospital organizations also raised concern about disruption of current practice and some loss of efficiency. AHA and Allina Health System representatives stated that the consent requirement could impede the ability of hospitals to collect patient information prior to admission, thus creating administrative delays for hospitals and inconvenience for some patients. In advance of nonemergency admissions, hospitals often gather personal data needed for scheduling patient time in operating rooms, surgical staff assignments, and other hospital resources. If the regulation is interpreted to include such activities as part of treatment or health care operations, hospitals would be required to get the patient’s signed consent before setting the preadmissions process in motion. Either a form would have to be mailed or faxed to the patient and sent back, or the patient would have to travel to the hospital to sign it.
Physician and hospital groups expressed concern that the requirement would hinder their ability to conduct health care management reviews using archived records. For example, AMA and AHA told us that the regulation will not permit them to use much of the patient data gathered under previous consent forms. While the regulation has a transition provision that allows providers to rely on consents acquired before the regulation takes effect, the continuing validity of those preexisting consents would be limited to the purposes specified on the consent form. In most cases, the purposes specified were either treatment or billing. This means that providers would not be able to draw on those data for other purposes, including common health care management functions, such as provider performance evaluations, outcome analyses, and other types of quality assessments. Moreover, they said that in many cases it might not be feasible to retroactively obtain consent from former patients. Some have suggested revising the regulation to allow providers to use, without consent, all health information created prior to the regulation’s effective date.
All of the organizations representing providers and health plans anticipate an additional administrative burden associated with implementing the new consent procedures, but the magnitude of the potential burden is uncertain. For example, if the use of new forms elicits more questions from patients about medical records privacy, as the provision’s supporters expect will happen, providers will have to devote more staff time to explaining consent and discussing their information policies. Similarly, health plan and provider advocates contend that focusing patients’ attention on their right to request restrictions on how their information is used could result in many more patients seeking to exercise that right. This, some believe, would require increased staff time for considering, documenting, and tracking restrictions.
section_title: Concluding Observations
paragraphs: The privacy regulation expands the scope of the consent process to include the use and disclosure of personal health information for a wide range of purposes. This may help some patients become aware of how their medical information may be used. However, in general, provider and health plan representatives believe that the consent requirement’s benefits are outweighed by its shortcomings, including delays in filling prescriptions, impediments to hospital preadmission procedures, and difficulty in using archived patient information. Regardless of the presence of the consent requirement, providers are obligated under the regulation to protect the confidentiality of patient information. Moreover, with or without the consent requirement, patients’ rights established by the privacy regulation—to see and amend their records, to learn of all authorized uses of their information, and to request restrictions on disclosures—remain unchanged.
section_title: Agency Comments
paragraphs: HHS provided written technical comments on a draft of this report. In them, HHS remarked on the consent requirement’s applicability to archived patient medical records. Agency officials explained that a consent for either treatment, payment, or health care operations acquired before the regulation’s compliance date would be valid for continued use or disclosure of those data for all three of these purposes after that date. Under this interpretation, for example, prior consents to disclose patient information for insurance claims would permit uses for the full range of health care operations as well, unless specifically excluded in the consent that the patient signed. In our view, a better understanding of the implications of this provision may emerge from any revisions to the final regulation.
Referring to material in appendix I, the agency expressed concern that we overgeneralized current state consent laws, which have complex requirements and vary significantly from one to another. HHS pointed out that some state laws require written consent in some circumstances that would be considered treatment, payment, or health care operations.  We recognize that state laws are complex and vary widely in the type of health care information that is protected and the stringency of those protections. While it is difficult to generalize about state laws, we found that the statutes in the 10 states we examined were fairly consistent in not requiring written consent for the full range of uses and disclosures of patient information for treatment, payment, and health care operations.
The agency provided other technical comments that we incorporated where appropriate.
We are sending copies of this report to the Honorable Tommy G. Thompson, Secretary of HHS, and others who are interested. We will also make copies available to others on request.
If your or your staff have any questions, please call me at (312) 220-7600 or Rosamond Katz, Assistant Director, at (202) 512-7148. Other key contributors to this report were Jennifer Grover, Joel Hamilton, Eric Peterson, and Craig Winslow.
section_title: Appendix I: Selected State Statutes on Consent
paragraphs: To examine how state privacy laws address the issue of patient consent to use health information, we reviewed certain laws in 10 states (Hawaii, Maine, Maryland, Minnesota, Montana, Rhode Island, Texas, Virginia, Washington, and Wyoming). We found that none of these state privacy statutes include a consent requirement as broad as that found in the privacy regulation. Although they generally prohibit using or disclosing protected health information without the patient’s permission, they include significant exceptions not present in the federal regulation. Essentially, none of the state statutes we reviewed requires consent for the full range of uses and disclosures of patient information for treatment and health care operations. The Minnesota and Wyoming statutes require consent to use patient health information for payment purposes.
Two states recently attempted to enhance patient control over their personal health information. In 1996, Minnesota enacted a law that placed stringent consent requirements on the use of patient data for research. It stipulated that patient records created since January 1, 1997, not be used for research without the patient’s written authorization. Because such authorization was not obtained at the start of treatment, researchers had to retroactively seek permission. They soon found that many patients did not respond to requests for such authorization, either to approve or to reject the use of their data. The law was amended to permit the use of records in cases where the patient had not responded to two requests for authorization mailed to the patient’s last known address. At one major research institution in Minnesota, the Mayo Clinic, that change decreased the percentage of patient records that the patient consent requirement made unavailable for studies from 20.7 percent to 3.2 percent.
In late 1998, Maine enacted a comprehensive law requiring specific patient authorization for many types of disclosures and uses of health information. The law took effect January 1, 1999, but was soon suspended by the state legislature in response to numerous complaints from the public. Particularly problematic was that “hospital directory” information could not be released without the patient’s specific written authorization. Therefore, until routine paperwork was completed, hospitals could not disclose patients’ room or telephone numbers when friends, family, or clergy tried to contact or visit them. Based on this experience, the Maine legislature substantially modified the law, which became effective on February 1, 2000. Among other changes, the revised law allows a hospital to list current patients in a publicly available directory unless a patient specifically requests to be excluded.
section_title: Appendix II: Organizations Interviewed