Health Information: First-Year Experiences under the Federal Privacy Rule
Published: 2004-09-03T00:00:00

Fast Facts:

Highlights:
section_title: Why GAO Did This Study
paragraphs: Issued under the Health Insurance Portability and Accountability Act of 1996, the Privacy Rule provided new protections regarding the confidentiality of health information and established new responsibilities for providers, health plans, and other entities to protect such information. GAO reviewed (1) the experience of providers and health plans in implementation; (2) the experience of public health entities, researchers, and representatives of patients in obtaining access to health information; and (3) the extent to which patients appear to be aware of their rights.
section_title: What GAO Found
paragraphs: Organizations representing providers and health plans told us that implementation of the Privacy Rule went more smoothly than expected during the first year after most entities were required to be compliant. In addition, they reported that new privacy procedures have become routine practice for their members' staff. However, provider and health plan representatives also raised a variety of issues about provisions that continue to be problematic. In particular, many organizations emphasized that two provisions--the requirement to account for certain information disclosures and the requirement to develop agreements with business associates that extend privacy protections "downstream"--are unnecessarily burdensome. Some organizations suggested that difficulties with these provisions could be ameliorated with modification of certain provisions and further guidance from the Department of Health and Human Services' Office for Civil Rights (OCR). Organizations reported a number of challenges faced by entities that rely on access to health information for public health monitoring, research, and patient advocacy. Public health entities noted that some states have had to take concerted action to ensure that providers' concerns about complying with the Privacy Rule do not impede the flow of important information to state health departments and disease registries. Some research groups asserted that the rule has delayed clinical and health services research by reducing access to data. Some consumer advocacy groups told us that patients' families, friends, and other representatives have experienced unnecessary difficulty in assisting patients. These groups perceived that while providers and plans are allowed, in certain cases, to disclose health information without written patient authorization, they are reluctant to do so. Consumer and provider representatives contend that the general public is not well informed about their rights under the Privacy Rule. According to these organizations, patients may not understand the privacy notices they receive, or do not focus their attention on privacy issues when the notices are presented to them. Some evidence of patients' lack of understanding is reflected in the 5,648 complaints filed with OCR in the first year after the Privacy Rule took effect. Of the roughly 2,700 complaint cases OCR closed as of April 13, 2004, nearly two-thirds were found to fall outside the scope of the Privacy Rule because they either involved accusations of actions that were not prohibited by the regulation, involved entities that were not "covered entities" as defined by the Privacy Rule, or involved actions that occurred before covered entities were required to be compliant. Of those cases that were germane to the rule, OCR determined that about half represented cases in which no violation had occurred.

section_title: Letter
paragraphs: Issued under the Health Insurance Portability and Accountability Act of  1996 (HIPAA), the federal Privacy Rule provided individuals with new  protections regarding the confidentiality of their health information and  established new responsibilities for health care providers, health plans, and  other entities to protect such information.  The rule was implemented as a  result of advances in information technology and an increased number of  parties with access to identifiable health information.  Together, these  trends have created new challenges to maintaining the privacy of an  individual’s medical records.
April 14, 2004, marked the first anniversary of the date that most entities  were required to be compliant with the Privacy Rule.  More than a full year  of experience with the rule offers an important and timely opportunity to  determine how different groups have fared under the new regulation.  This  report focuses on (1) the experience of providers and health plans in  implementing the Privacy Rule; (2) the experience of public health entities,  researchers, and representatives of patients in obtaining access to health  information under the rule; and (3) the extent to which patients appear to  be aware of their rights.
In gathering this information, we interviewed representatives of 23 national  organizations representing health care consumers, health care providers,  health plans, state officials, public health agencies, researchers, privacy  professionals, and a health care accrediting body.  (These organizations are  listed in app. I.)  We supplemented our discussions with these organizations  with a review of information from their Web sites and surveys and reports  issued by them.  We also contacted the Centers for Disease Control and  Prevention (CDC)—a federal public health agency—and the Centers for  Medicare & Medicaid Services (CMS)—the agency that administers the  Medicare program—both in the Department of Health and Human Services  (HHS).  In addition, we spoke with officials at the Office for Civil Rights  (OCR) within HHS—the agency responsible for enforcing the Privacy  Rule—about their procedures for logging in privacy complaints and  analyzed data extracted for us by OCR from the database that it maintains  on these complaints.  We did not independently verify the reliability of the  data compiled by OCR.  However, we determined that these data were  sufficiently reliable for the purposes of our engagement.  In addition, we  reviewed testimony by public health and research organizations delivered  at 2003 and 2004 hearings on the Privacy Rule held by the National  Committee on Vital and Health Statistics (NCVHS) and followed up with  several state officials.  We performed our work from March 2004 through  August 2004 in accordance with generally accepted government auditing  standards.
subsections: section_title: Background
paragraphs: The Privacy Rule addresses the use and disclosure of individuals’ health  information and establishes individuals’ rights to obtain and control access  to this information.  Specifically, the rule covers “protected health  information,” defined as individually identifiable health information that is  transmitted or maintained in any form.  It applies to “covered entities,”  defined as health plans, health care clearinghouses, and health care  providers that transmit information electronically with respect to certain  transactions.  The protections under the Privacy Rule extend to all  individuals, regardless of the state in which they live or work, but the rule  does not preempt state privacy laws that are more stringentthat is, more  protective of health information privacy.
subsections: section_title: Permissible Uses and Disclosures
paragraphs: Under the Privacy Rule, a covered entity may use and disclose an  individual’s protected health information without obtaining the individual’s  authorization when the information is used for treatment, payment, or  health care operations.  Protected health information may also be disclosed  without an individual’s authorization for such purposes as certain public  health and law enforcement activities, and judicial and administrative  proceedings, provided certain conditions are met.  In addition, an  individual’s authorization is not required for disclosures for research  purposes if a waiver of authorization, under defined criteria, is obtained  from an institutional review board (IRB) or a privacy board.
Except where the rule specifically allows or requires a use or disclosure  without an authorization, the individual’s written authorization must be  obtained; for example, authorization is generally required for disclosures to  life insurers or employers.  In addition, the rule contains specific provisions  that generally require an individual’s authorization for the use or disclosure  of psychotherapy notes or of protected health information for marketing  purposes.
In many circumstances, a provider or health plan can choose not to  disclose information, regardless of whether an individual’s authorization is  required. The Privacy Rule allows covered entities to use their discretion in  deciding whether to disclose protected health information for many types  of disclosures, such as those to family and friends, public health  authorities, and health researchers.
section_title: Individual Privacy Rights
paragraphs: The Privacy Rule provides individuals with a number of rights regarding  access to, and use of, their health information.  Specifically, the rule  provides the following:  Access to and amendment of health information.  Individuals have the  right to inspect and copy their protected health information and to  request amendments of their records.
Notice of privacy practices.  Individuals generally have a right to  written notice of the uses and disclosures of their health information  that may be made by a covered entity as well as the individual’s rights  and the entity’s duties with respect to that information.
Accounting for disclosures.  Individuals generally have the right to  request and receive a listing of disclosures of their protected health  information that is shared with others for purposes other than  treatment, payment, or health care operations.
Complaints.  In addition to being able to complain directly to a covered  entity, any person who believes a health care provider, health plan, or  clearinghouse is not complying with the Privacy Rule may file a  complaint with the Secretary of HHS.
section_title: Responsibilities of Health Care Providers, Health Plans, and Clearinghouses
paragraphs: Covered entities are required to comply with Privacy Rule provisions and  follow various procedures.  They must do the following:  Develop policies and procedures for protecting health information.  A  covered entity must maintain administrative, technical, and physical  safeguards.  Among other requirements, a covered entity must also  designate a privacy official, train its employees on the entity’s privacy  policies, and develop procedures to receive and address complaints.
Limit information used and disclosed to the minimum necessary.
Covered entities must make reasonable efforts to limit their employees’  access to identifiable health information to the minimum needed to do  their jobs.  When sharing protected health information with other  entities (such as collection agencies and researchers), they must make  reasonable efforts to limit the information disclosed to the minimum  necessary to accomplish the purpose of the data request.  However,  providers may share the full medical record when the disclosure is for  treatment purposes.
Account for disclosures of protected health information.  Upon request,  covered entities must provide individuals with an accounting of  disclosures of their protected health information made in the preceding  6 years.  This requirement applies to most disclosures other than those  for treatment, payment, or operations purposes, including those that are  mandated by lawsuch as certain disclosures to public health entities  and law enforcement agencies.  The accounting must include the date of  each disclosure; the name and, if known, the address of the entity or  person who received the information; a description of the information  disclosed; and a statement of the purpose of the disclosure.
Ensure that “downstream users” protect the privacy of health  information by implementing business associate agreements.   Covered entities must enter into a contract or other written agreement  with any business associates with which they share protected health  information for various purposes.  A business associate performs  certain functions or activities—such as claims processing and benefit  management—on behalf of a covered entity involving the use or  disclosure of individually identifiable health information. Business  associate contracts must establish conditions and safeguards for uses  and disclosures of identifiable health information and authorize  termination of contracts if the covered entities determine that business  associates have violated the agreements.
section_title: Disclosures to Researchers Seeking Health Information from Covered Entities
paragraphs: The regulation establishes requirements that apply to both federally and  privately funded research that seeks to use protected health information:  Researchers may seek to obtain from covered entities health  information without authorization if the data do not identify an  individual and there is no reasonable basis to believe it could be used to  identify an individual.
Researchers must use one of three options to gain access to protected  health information:  obtain patient authorization, obtain a waiver of  authorization by having their research protocol reviewed and approved  by an IRB or privacy board, or use a limited data set provided by the  covered entity.
section_title: Responsibilities of HHS’s Office for Civil Rights
paragraphs: OCR has responsibility for implementing and enforcing the Privacy Rule as  follows:   Provide guidance. OCR is responsible for communicating policies  contained in the Privacy Rule by issuing guidance to answer common  questions and clarify certain provisions.  Mechanisms by which OCR  makes information available to various entities on its Web site include  links to guidance documents as well as answers to frequently asked  questions (FAQ).  In addition, OCR has provided guidance through  roundtable discussions, answers to written inquiries, an automated e- mail notification system, a toll-free hotline for questions about the  Privacy Rule, as well as presentations and telephone conference calls.
Administer a complaint process. OCR is responsible for investigating  complaints received from health care consumers.
Enforce compliance. OCR may provide covered entities with technical  assistance to help them comply voluntarily with the Privacy Rule.  OCR  investigates complaints and may conduct reviews to determine if  covered entities are in compliance and attempts to resolve issues of  noncompliance through informal means.  Violators are subject to civil  and criminal penalties.  OCR administers the civil monetary penalties  while the Department of Justice administers criminal penalties involving  a knowing disclosure or obtaining identifiable health information in  violation of HIPAA.
section_title: Compliance Difficulties for Providers and Health Plans Have Eased, but Problems Remain
paragraphs: Organizations representing providers and health plans stated that  implementation of the Privacy Rule was smoother than expected over the  past year and that some initial confusion has abated.  Although many  provider and health plan organizations reported dealing with various  ongoing problems, they noted that two provisions were particularly  burdensome:  the requirement to maintain a record of certain disclosures  of patient information and the requirement to create business associate  agreements with downstream users of protected health information.   Several organizations suggested that OCR could take steps to facilitate  compliance with these provisions.
subsections: section_title: Confusion among Providers and Health Plans Has Diminished
paragraphs: Some organizations we interviewed told us that the first year they were  required to be compliant with the Privacy Rule was smoother than they had  anticipated.  The American Medical Association and the American Hospital  Association stated that in general, they have heard relatively few negative  reactions from their members during the past year.  Many provisions were  considered straightforward and relatively easy to implement, including  developing the notice of privacy practices and limiting disclosures for  marketing purposes.  In addition, many provider, health plan, and  consumer representatives reported that the Privacy Rule has increased  provider awareness of, and sensitivity to, patient privacy issues, and new  privacy procedures have become routine practice.  For example,  representatives from the American Health Information Management  Association (AHIMA)—which assists providers with their management of  protected health information—noted that the Privacy Rule has helped to  make staff working for covered entities more aware of the flow of patient  information.
Organizations we interviewed also reported that some early confusion has  subsided.  Groups commented that initial confusion stemmed from  challenges in understanding and implementing the Privacy Rule.  The  American Hospital Association, for example, stated that hospitals were  initially concerned about the requirement to limit information disclosures  to the “minimum necessary” but now understand that they can share the  information needed to ensure that appropriate clinical care is provided to  their patients.  Representatives from the American Pharmacists’  Association (APhA) stated that members faced initial confusion  implementing the Privacy Rule, but that pharmacies have since developed  new standard procedures to address these issues.  Representatives of the  American Medical Association noted that after receiving and resolving  many calls requesting clarification early in the year, it has since received  few calls from its members related to the Privacy Rule.
However, organizations also commented that some uncertainties and  misunderstandings continue.  For example, provider groups stated that  some physicians and hospitals remain unclear about what type of  information may be disclosed for law enforcement purposes.  In addition,  health plan representatives reported ongoing difficulties associated with  knowing whether state laws prevail over the Privacy Rule.  Despite these  problems, AHIMA representatives told us that “the number of people  talking about the ship sinking” because of the Privacy Rule has decreased.
Overall, the organizations had mixed opinions about the extent to which  OCR’s guidance facilitated implementation of the Privacy Rule.  As of   June 29, 2004, OCR has posted 223 FAQs and answers on its Web site.   While some provider and health plan representatives reported that the OCR  Web site—particularly the FAQs—was very helpful, others stated that the  FAQs were not specific enough to explain certain vague or ambiguous  Privacy Rule provisions.  Furthermore, organizations we interviewed stated  that various types of guidance offered by OCRincluding roundtable  discussions and guidance on particular provisions—would have been more  helpful if they had been offered sooner.  For example, representatives from  the American Health Care Association (AHCA) stated that if they had  received clarification and guidance from OCR earlier, they would have had  fewer problems implementing the rule.
section_title: Two Provisions Were Commonly Cited as Particularly Difficult to Implement
paragraphs: Although provider and health plan representatives reported dealing with a  variety of ongoing problems, we consistently heard from them that two  provisions were especially burdensome.  These were the provisions that  require accounting for disclosures and business associate agreements.
subsections: section_title: Accounting for Disclosures
paragraphs: Most provider and health plan organizations we interviewed identified the  requirement to account for certain disclosures as unnecessarily  burdensome.  These organizations reported that significant time and  resources are needed to establish and maintain systems to track  disclosures.  For example, in hospitals, various departments keep patient  information in separate systems that are not necessarily electronically  linked.  According to the Health Care Compliance Association, hospitals  have had to revise systems to establish electronic links or have had to  create manual tracking mechanisms.  Similarly, representatives from  America’s Health Insurance Plans (AHIP) reported that many health plans  or insurers generally keep information related to one patient in multiple  systems—for example, separate systems for enrollment, claims payment,  and customer service—making it difficult to track all information  disclosures for that patient.
In addition to difficulties experienced when tracking disclosures of  protected health information, provider and health plan representatives also  expressed concern about the volume of disclosures that must be tracked.   They commented that frequent, diverse disclosures required by law add  significantly to the volume of information that must be continually tracked.   These include disclosures to public entities to maintain disease registries,  vital statistics, and other health databases.  For example, the Minnesota  Department of Public Health identified over 50 state statutes in which  health information may or must be released to specific state or local  organizations, such as health departments, health licensing boards, and  schools.  Blue Cross Blue Shield Association (BCBSA) representatives told  us that accounting for the disclosures of births and deaths to state health  departments—required by state law—can be burdensome.  They noted that  some state laws require health plans to report information to the health  department quarterly, while others require reporting information monthly.   One organization we spoke with indicated that its members expect that  complying with the provision to account for disclosures will become  increasingly difficult, because they need to track these disclosures for 6  years to meet obligations under the Privacy Rule.
Moreover, many organizations we interviewed questioned whether the  Privacy Rule’s accounting provision generates much benefit for patients.   These organizations reported that their members have received few or no  requests from patients for an accounting of the disclosures of their  protected health information.  To somewhat reduce the burden of the  requirement to account for disclosures, several organizations suggested  that OCR modify the rule to require covered entities to inform patients in  the privacy practices notice that when required by law, their information  will be disclosed to public health organizations and law enforcement  agencies.  This modification would inform patients of disclosures required  by law and would obviate the need to track these disclosures as they  occur.
section_title: Business Associate Agreements
paragraphs: Provider and health plan representatives reported that significant  resources have been required to implement business associate agreements.   These organizations commented that some of the burden associated with  implementing this provision has stemmed from confusion and variation in  determining which relationships with downstream entities require business  associate agreements.  The Medical Group Management Association  (MGMA) stated that there is still uncertainty among its members and that it  receives calls weekly about business associate agreements.  APhA  representatives attributed pharmacists’ difficulties determining which  entities were business associates to the provision’s broad language and  lack of adequate OCR guidance.
Although the Privacy Rule provided for phased-in implementation of  business associate agreement requirements to accommodate existing  contracts, provider and health plan groups viewed the business associate  agreements provision as very burdensome.  Organizations we interviewed  stated that some of their members have spent substantial amounts of time  and money to develop thousands of business associate agreements with  downstream users of protected health information, though they did not  estimate specific amounts.  Provider and health plan representatives  reported that high costs have been associated with the need for legal  counsel to negotiate and customize agreements with the multiple and  various business associates.  For example, BCBSA officials stated that  some of their business associates have requested specific and sometimes  “excessive” details in their agreements.  They noted that business  associates sometimes regard the agreements as an opportunity to include  new provisions in their contracts that are unrelated to health privacy.
The Joint Commission on Accreditation of Healthcare Organizations  (JCAHO), however, was able to successfully avoid these types of problems  by including a standard business associate agreement as an addendum to  applications for health care accreditation.  As a result, it has had “excellent  compliance and cooperation from accredited entities,” according to  JCAHO representatives.  In contrast, hospitals and other providers  negotiating individually with business associates do not have similar  leverage to compel the use of their particular agreements.
Some organizations representing providers and health plans suggested that  OCR provide more guidance to covered entities about when and how to  enter into a business associate agreement.  These organizations did not  consider OCR’s existing guidance specific enough to assist providers and  health plans with their agreements.  APhA representatives stated that  OCR’s guidance on business associate agreements has “led to more  questions.”
section_title: Constraints on Access to Data Have Raised Concerns for Public Health Entities, Researchers, and Patient Advocates
paragraphs: Organizations representing public health agencies, research entities, and  patient advocates identified several areas in which efforts to apply the  Privacy Rule have created new challenges.  State and federal agencies  reported having to take explicit action—including outreach efforts and  changes in state law—to ensure that providers and health plans continue to  report health information for public health activities.  Researchers pointed  to increased difficulty in obtaining patient data to conduct clinical or health  services research.  Patient advocates also identified obstacles in obtaining  protected health information from providers and plans on behalf of their  clients.  Many of these challenges have been attributed to  misunderstandings or confusion about how to interpret the rule in  conjunction with other federal requirements.  Most organizations found  providers reluctant to share information without patient authorization  when the rule permitted providers such discretion.  The burden of  accounting for disclosures and liability concerns were two reasons often  cited for their reluctance.
subsections: section_title: State and Federal Agencies Have Had to Increase Efforts to Obtain Data for Public Health Monitoring
paragraphs: Organizations representing state public health officials told us that the  Privacy Rule has hindered access to patient health information because  some providers are reluctant to report to public health authorities.  They  experienced this difficulty despite the fact that under the Privacy Rule,  providers and health plans may report to public health authorities without  a patient’s authorization.  This provision applies both where a law  requires that certain health information—such as immunizations—be  reported and where a public health agency requests that providers  voluntarily report certain information.
Public health organizations—such as the Council of State and Territorial  Epidemiologists (CSTE) and CDC—reported several cases where obtaining  patient health information has become more difficult.  For example, a  CSTE survey of 40 state and local programs designed to detect early signs  of an epidemic found that 3 programs experienced “substantial” problems  and 10 experienced “some” problems with obtaining health information  from providers because of patient confidentiality concerns.  In another  example, a CDC representative reported facing obstacles to its surveillance  of mental health disabilities.  CDC’s efforts to collect data on individuals  with certain mental health diagnoses met resistance from a large clinic and  an inpatient mental health facility.  As a result, CDC redesigned its study  and had to approach different providers to participate in its data collection  effort.
Public health organizations attributed the difficulty in obtaining public  health data from providers and plans to several factors.  First,  organizations we spoke with believed that providers have a disincentive to  report data requested by public health agencies because of the provision to  account for such disclosures.  According to a state public health agency  representative, the necessary tracking of disclosures has had a major  impact on the state’s public health activities.  This is consistent with  concerns expressed by representatives of health plans, physicians,  hospitals, and long-term care facilities about the burden of accounting for  certain disclosures.  Second, some providers were confused about the rule  in that they believed they were permitted to report to public health  agencies only when specifically required by federal or state law.  A  representative of CDC noted that in some states that did not mandate  reporting of birth defect surveillance data, providers were initially  unwilling to disclose this information.  Third, state officials noted that  providers are concerned legal action might be taken against them if they  provide health information to public agencies.  In CDC’s efforts to monitor  mental health disabilities, a provider cited fear of liability associated with  improper disclosure of protected health information as the reason it  declined to participate.
The organizations we interviewed also reported that state and federal  health agencies have taken various actions to facilitate public health  reporting.  These include changes in state law, enhancements to the data  collection process, and targeted Privacy Rule education.  For example,   Kentucky, Massachusetts, and North Dakota revised regulations and  laws to clarify the circumstances for reporting to public health agencies  without patient authorization, to make state law more consistent with  the Privacy Rule, and to make certain public health reporting  mandatory.
CDC modified its survey procedures for a group of health care provider  surveys, known as the National Health Care Survey, to help providers  participate in the surveys under the Privacy Rule.  The modifications  included creating a document that providers can use to account for  disclosures.
The Minnesota Department of Health developed a series of fact sheets  that clarify, for each of several different types of disease reporting, the  specific authority in the Privacy Rule that allows reporting of data to the  department without patient authorization.
Like the health plan and provider groups, organizations representing public  health agencies stated their desire that the Privacy Rule be amended to  exempt reporting to public health agencies from the accounting provision  and announce in the privacy practices notice that this information will be  disclosed as required by law.  They contended that this approach would  significantly reduce burden and remove the incentive that exists for  providers to avoid disclosure of protected health data to public health  agencies.
section_title: Research Groups Report Unnecessary Delays and Less Access to Health Data
paragraphs: Organizations representing health services and clinical researchers, such  as Academy Health, the Association of American Medical Colleges, the  Association of Clinical Research Organizations, and the National Cancer  Advisory Board, reported that access to data for research has been delayed  due to the varying approaches that some providers are taking to research  requests under the Privacy Rule.   They reported that research studies  involving several sites of care have been delayed because of the different  confidentiality requirements at study provider sites.  Under the rule,  researchers must obtain IRB or privacy board approval for their studies to  waive the patient authorization requirement.  HHS guidance states that a  multisite research study need obtain approval from only one of the  provider sites, but researchers’ organizations contend that often each  provider institution requires that its IRB approve the waiver request.  They  noted that meeting the requirements of multiple IRB reviews can add  substantial time to completing these studies.
Under the Privacy Rule, researchers seeking authorization to use patient  information must pursue their requests through the patients’ providers.   Organizations reported that smaller providers with more limited  administrative resources—such as some group practices and rural  community hospitals—are reluctant to facilitate research studies because  of misunderstanding of the rule and the added burden of contacting  patients.  Providers may also decline to participate because of concern  about liability and because of the administrative burden of the accounting  for disclosures requirement.  For example, the Association of American  Medical Colleges reported that some physicians no longer contribute data  to research registries for cancer because of the additional resources  required to track these disclosures.
Another issue raised by several organizations we spoke with concerned the  perceived conflicts between the Privacy Rule and federal regulation  governing the protection of human subjects in research, known as the  Common Rule.  Research groups noted that differences between Privacy  Rule and Common Rule requirements may cause confusion among  researchers and covered entities and create unnecessary obstacles to  research.  For example, they stated that one difference relates to the scope  of authority of informed consent or authorization:  informed consent by  patients under the Common Rule covers the research effort as a whole,  including future disclosures from registry and data depositories.  In  contrast, they noted that a patient’s authorization or an IRB’s waiver of  authorization covers only a specific research study and not future  unspecified research under the Privacy Rule.  Some national organizations  expressed concern that providers and health plans may find it too  confusing to comply with both the Privacy Rule and Common Rule  requirements in responding to research proposals and requests.  An AHIMA  official reported that in some cases, providers and health plans “just threw  up their hands and said they would just not give information to  researchers.”
CMS—a source of health services utilization data on Medicare  beneficiaries—did not approve research requests for approximately 6  months while it developed new criteria and procedures for review of  research requests to comply with the Privacy Rule.  CMS now requires that  researchers, who submit about 1,000 requests each year, provide more  information about their study methodology and demonstrate that their  research purpose is consistent with CMS’s mission.  To comply with the  Privacy Rule, CMS established a privacy board to review research requests.   The board meets once a month, which lengthens this phase of CMS’s  research approval process.
The Association of American Medical Colleges, the Association of Clinical  Research Organizations, and public health organizations such as the  Association of State and Territorial Health Officials and CSTE reported that  OCR’s guidance has not addressed some of the key misunderstandings and  fundamental problems associated with the Privacy Rule’s impact on  research.  Ambiguity remains in determining whether a health survey  activity is considered health care operations or research and whether a  public health entity’s data request is part of its public health activities or is  for research.  These organizations stated their desire for OCR to address  concerns through official revisions to the rule and issuance of federal  guidance.  They believe that compared with OCR’s efforts to provide  information on its Web site, such official actions would “carry more  weight” among providers, health plans, and research organizations.
section_title: Patient Advocates Report Obstacles to Obtaining Data on Behalf of Patients
paragraphs: Organizations representing patient advocates reported that their members  face new obstacles when seeking access to protected health information on  behalf of patients.  Such access problems, they say, are due to excessive  paperwork, misunderstanding of the rule, and reluctance by providers and  health plans to share information with legal aid attorneys, state  ombudsmen, and others when the rule permits discretion.  The rule gives  providers and plans some latitude in exercising their professional judgment  about when to disclose protected health information to individuals serving  as patient advocates who are not “personal representatives” as defined by  the Privacy Rule.  Factors such as liability concerns and the burden of  accounting for disclosures may contribute to their guarded disclosure  practices.
Representatives for Families USA’s Health Assistance Partnership and the  National Health Law Program reported problems when lawyers or other  patient advocates sought a client’s medical records.  These organizations  contend that some providers deny access and other providers delay or  restrict access by requiring the use of a provider’s customized authorization  form.  They asserted that it can be cumbersome if a patient’s signature on  multiple unique forms needs to be obtained from each provider.  These  organizations also noted that state ombudsmen services—telephonic  programs that assist consumers, such as the elderly and disabled, with  problems accessing health care—have had problems intervening on behalf  of consumers over the telephone.  Even after a consumer has given verbal  approval, providers have declined to share information with the  ombudsman in subsequent phone calls if the patient is not also on the  telephone.
In addition, AHIP, AHCA, and BCBSA reported that families and friends of  patients continue to face problems obtaining information to assist in  patients’ care.  BCBSA reported that some plans are confused about how to  implement the Privacy Rule’s provisions for releasing information to  families, friends, and others.  Where the rule permits discretion, some  covered entities have taken a strict approach to patient authorization  requirements, requiring any adult calling on behalf of another adult to  obtain an authorization form signed by the patient.  For example, this  approach resulted in one health plan requiring 10,000 patient  authorizations during the first year.
Similarly, AHCA found that some long-term care facilities have taken a  strict approach to disclosing information and do not provide information to  nursing home residents’ family members without patient authorization.   AHCA also reported that the Privacy Rule does not address a potential  conflict with the Omnibus Budget Reconciliation Act of 1987 that requires  nursing homes to notify families of incidents or significant changes in  health status unless the resident exercises the right to privacy.  Under the  Privacy Rule, a provider may, in certain situations, determine whether or  not to share information with family based on professional judgment.
section_title: Evidence Suggests Patients Are Not Aware of Privacy Rights or May Misunderstand the Privacy Rule
paragraphs: Numerous organizations reported that patients are not aware of their rights  under the Privacy Rule, either because they do not understand the notice of  privacy practices, or because they have not focused their attention on  privacy issues when the notices are presented to them.  In the first year  after entities were required to be compliant with the Privacy Rule, OCR  received over 5,600 privacy complaints and closed about half of the  complaint cases filed.  Nearly two-thirds of the closed cases were resolved  on the basis that they were outside the scope of the Privacy Rule,  suggesting that patients may misunderstand their rights.
subsections: section_title: Diverse Groups Contend That Patients Are Not Well Informed of Their Rights
paragraphs: Consumer groups—including AARP, the Bazelon Center for Mental Health  Law, the Health Privacy Project, the Health Assistance Partnership, and the  National Health Law Programreported that many patients are not aware  of their privacy rights.  They attribute this, in part, to the use of customized  privacy notices.  For example, consumer groups reported that typical  privacy notices, as drafted by providers and health plans, are often difficult  to read and understand.  The Health Privacy Project maintained that the  privacy notices are written primarily to protect providers and health plans  from enforcement actions, rather than as a vehicle to inform the patient.  It  noted that even basic information about disclosures and the right to access  records is often buried in the document.
Representatives of providers and health plans also stated that patients are  largely unaware of their rights.  According to AHIMA, patients are unaware  of their privacy rights because the privacy notice is treated as one more  piece of paper that they have to sign when they seek care. MGMA noted  that some physicians have placed boxes in their offices specifically for the  purpose of recycling the notices after patients discard them.
Representatives from both provider and consumer groups noted that the  public should receive more education about how their rights have changed.  MGMA told us that OCR has placed the burden of patient education on  private organizations—such as professional associations, providers, and  health plans—and that some of these organizations interpret the rule  incorrectly.  Moreover, provider and consumer groups stated that further  OCR attention is needed to address the issue of privacy notices that are  difficult for patients to read and understand.  Some groups told us that the  notice of privacy practices could be made easier to comprehend by  highlighting some key patient rights under the Privacy Rule.
section_title: Complaints Filed with HHS OCR Indicate That Patients May Misunderstand the Privacy Rule
paragraphs: In the first year that entities were required to be compliant with the Privacy  Rule, consumers and others filed 5,648 privacy-related complaints with  OCR.  The number of complaints received increased steadily from quarter  to quarter, with each quarter’s intake totaling 1,068, 1,392, 1,521, and 1,667,  respectively.  Overall, roughly half of the complaints filed in the rule’s first  year were closed as of early May 2004.
The database that OCR maintains on these complaints includes information  that classifies one or more privacy issues raised in several broad  categories.  Data on the open and closed cases showed that the most  commonly cited category (56 percent of complaints) was “impermissible  uses and disclosures.”  According to an OCR official, this could include  allegations regarding patient billing information sent to the wrong address  or FAX number, patient information seen or overheard in a doctor’s office  or hospital, or provider employees accessing patient information for their  own personal or business benefit.  Approximately a third of the  complaints cited inadequate safeguards for patient information, and 17  percent reported problems with patients gaining access to their own health  information.
Patients have filed privacy complaints against many different types of  health care entities.  The two most commonly cited were private  practices—comprising physicians, dentists, chiropractors, and similar  licensed health professionals—and hospitals—including general,  psychiatric, and specialty hospitals.  Together, private practices and  hospitals accounted for 41 percent of privacy complaints with information  on entity type recorded.
For closed cases, the OCR database provides additional information,  primarily related to the final disposition of the complaint.  The majority of  these complaints—79.1 percent—were not germane to the Privacy Rule,  lacked sufficient information to process them, or fell into diverse  miscellaneous categories.  That left 20.9 percent of the closed privacy  complaints that OCR concluded fell within the scope of the Privacy Rule  (see table 1).
About half of the germane complaints (representing 9.4 percent of total  closed cases) involved a violation of the Privacy Rule substantiated by  OCR’s investigation where the provider or plan agreed to correct its  policies or procedures.  For the rest of these germane complaints (11.5  percent of total closed cases), OCR determined that no violation had  occurred.  By May 2004, OCR had not recommended sanctions against any  provider or health plan for privacy violations, but this remained a potential  outcome for the first-year complaints that were still open at that point.
Nearly two-thirds of the privacy complaints closed during the rule’s first  year of operation fell outside the scope or time frame of the rule.  This  included the 35.4 percent of closed privacy complaints that involved  alleged actions by providers, health plans, or other entities that OCR  determined would not constitute violations of the regulation even if true.   In other words, they concerned actions to which the patient might object,  but that were not prohibited by the Privacy Rule.  An additional 17.7  percent of closed complaints involved entities that were not “covered  entities” as defined by the Privacy Rule, and 9.6 percent cited actions that  occurred before covered entities were required to be compliant.  However,  OCR officials stated that the proportion of complaints closed because they  were not germane to the Privacy Rule may have been higher in the first year  of the rule’s implementation than it will be in later years because OCR can  generally complete its processing of such complaints more quickly than  complaints that require full-scale investigations.  Just over half of the  complaints received in the first year remained open in early May 2004.
Finally, about 15 percent of closed complaints fell into one of a number of  miscellaneous categories or, more commonly, could not be pursued  because OCR did not receive, and could not obtain, critical information.   For example, some complaints lack addresses or telephone numbers by  which the persons filing the complaints could be contacted for more  information.
Closed complaints involving three major categories of providers—private  practices, hospitals, and pharmacies—were more likely to be judged  germane under the Privacy Rule by OCR than were complaints about other  organizations.  Nevertheless, for each of these major provider types, as well  as for all other entities cited in privacy complaints, OCR found that a clear  majority of the complaints it closed were not germane to the regulation  because they either involved accusations of actions that were not  prohibited by the regulation, involved entities that were not “covered  entities” as defined by the Privacy Rule, or involved actions that occurred  before covered entities were required to be compliant (see fig. 1).
The similarity of this pattern across different types of entities suggests that  patients may misunderstand the scope of the protections provided to them  under the Privacy Rule.  The pattern is also consistent with consumer  advocates’ opinions concerning the limitations of privacy notices in  informing patients about their rights under the Privacy Rule.
section_title: Conclusions
paragraphs: Overall, in its first year, HIPAA’s Privacy Rule has resulted in both positive  and negative experiences among covered entities and other users of health  information.  Health care staff have been sensitized to privacy issues and  the procedures required of their organizations to protect patient health  information.  Providers and health plans have taken steps to develop  working environments that are sensitive to patient privacy and to enhance  staff understanding of how to handle the complexities of complying with  the Privacy Rule.
However, some operational issues and misconceptions about the rule  continue to raise concerns.  A prime example is the requirement to account  for disclosures for public health purposes that are mandated by law.  This  requirement is seen by many to have created a costly and unnecessary  demand on providers and health plans and a drag on the flow of  information for purposes considered to be in the public interest.
Providers and health plans that are uncertain or misinformed about their  privacy responsibilities have often responded with an overly guarded  approach to disclosing information, resulting in procedures that may be  more protective of the organizations than necessary to ensure compliance  with the Privacy Rule.  At the same time, the job of educating the public  about the content and intent of the Privacy Rule has been relegated to  providers and health plans and their privacy notices have not consistently  provided a clear message to patients.
section_title: Recommendations for Executive Action
paragraphs: We recommend that to reduce unnecessary burden on covered entities and  to improve the effectiveness of the Privacy Rule, the Secretary of HHS take  the following two actions:   Modify the Privacy Rule to (1) require that patients be informed in the  notice of privacy practices that their information will be disclosed to  public health authorities when required by law and (2) exempt such  public health disclosures from the accounting-for-disclosures provision.
Conduct a public information campaign to improve awareness of  patients’ rights under the Privacy Rule.
section_title: Agency Comments and Our Evaluation
paragraphs: In written comments on a draft of this report, HHS agreed with our finding  that implementation went more smoothly than expected during the first  year, confusion has diminished, and new privacy procedures have become  routine practice for staff.  They stated that the experience of providers and  health plans in implementing the Privacy Rule, as we reported, were  generally consistent with what HHS has heard from many covered entities  and others. (See app. II.)
Regarding our recommendation that mandatory reporting of health  information to public health authorities be exempted from the accounting  for disclosure requirement, HHS noted that it has considered such a change  in the past and continues to monitor the need to modify the Privacy Rule.   In August 2002, HHS considered exempting public health disclosures from  the accounting provisions whether required by law or not, but decided  against such a modification pending further experience with the rule.  HHS  acknowledged that covered entities continue to report difficulties tracking  such disclosures and stated that its guidance documents emphasize  flexibility in how covered entities structure their record keeping.
Given HHS’s goal of ensuring effective patient privacy protections without  imposing unnecessary costs or barriers to quality health care or interfering  with other important public benefits, we remain concerned that the  accounting for disclosure provision as applied to mandatory public health  reporting may not support this goal.  Effective privacy notices could be  used to inform patients of public health disclosures required by law and, in  turn, reduce the need to track these numerous disclosures.  Furthermore,  public health officials noted that the burden imposed by accounting for  legally required disclosures may generate the unintended consequence of  reducing the amount of information voluntarily reported to public health  authorities.  To the extent that covered entities are discouraged in this way,  the public interest may be negatively affected.
In commenting on our second recommendation, to conduct a public  information campaign to improve awareness of patient’s rights under the  Privacy Rule, HHS agreed that notices of privacy practices may appear too  long and complicated and that consumers may not be closely reading their  notices.  HHS stated that the complaint data received by OCR may not  indicate that consumers are unaware of their rights under the rule, but  rather that they may not properly understand them.  Regarding its  consumer outreach, HHS pointed to two new consumer fact sheets posted  to its Web site on August 17, 2004, a toll-free call-in line to respond to  questions about the rule, and efforts to encourage covered entities to  develop consumer-friendly notices that highlight key information.
Evidence from numerous organizations indicated that consumers are  largely unaware of their rights under the Privacy Rule, and our analysis of  OCR complaint data suggested that consumers may misunderstand the  scope of the protections provided.  A more diverse approach to consumer  outreach may be necessary to effectively communicate the new privacy  rights.  The information available on the HHS Web site and from the call-in  line provide access to a portion of the general public but may not reach the  many consumers who do not know of these sources.  We believe it is  important that, in current and future efforts to educate the public, HHS  more effectively disseminate information about protections provided under  the Privacy Rule.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from its  date.  At that time, we will send copies of this report to the Secretary of  HHS and to other interested parties.  In addition, this report will be  available at no charge on GAO’s Web site at http://www.gao.gov.  We will  also make copies available to others upon request.
If you or your staff have any questions about this report, please call me at  (312) 220-7600.  Another contact and key contributors are listed in  appendix II.
section_title: Organizations Interviewed
paragraphs: We included the following national organizations and federal agencies in  our review.
subsections: section_title: Health Care Providers
section_title: Health Plans
paragraphs: America’s Health Insurance Plans  Blue Cross Blue Shield Association  Medicare (HHS’s Centers for Medicare & Medicaid Services)
section_title: Public Health
section_title: Health Care Research
section_title: Patient Advocates
section_title: Other
section_title: Comments from the Department of Health and Human Services
section_title: GAO Contact and Staff Acknowledgments
subsections: section_title: GAO Contact
section_title: Acknowledgments
paragraphs: In addition to the contact named above, Kelly L. DeMots, Mary F. Giffin,   Eric A. Peterson, and Lisa M. Vasquez made key contributions to this  report.
section_title: GAO’s Mission
paragraphs: The Government Accountability Office, the audit, evaluation and  investigative arm of Congress, exists to support Congress in meeting its  constitutional responsibilities and to help improve the performance and  accountability of the federal government for the American people. GAO  examines the use of public funds; evaluates federal programs and policies;  and provides analyses, recommendations, and other assistance to help  Congress make informed oversight, policy, and funding decisions. GAO’s  commitment to good government is reflected in its core values of  accountability, integrity, and reliability.
section_title: Obtaining Copies of GAO Reports and Testimony
paragraphs: The fastest and easiest way to obtain copies of GAO documents at no cost  is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts  newly released reports, testimony, and correspondence on its Web site. To  have GAO e-mail you a list of newly posted products every afternoon, go to  www.gao.gov and select “Subscribe to Updates.”
subsections: section_title: Order by Mail or Phone
section_title: To Report Fraud, Waste, and Abuse in Federal Programs
section_title: Congressional Relations
section_title: Public Affairs