streamline the flow of information integral to the operation of the health care system while protecting confidential health information from inappropriate access, disclosure, and use. HIPAA required the Secretary of HHS to submit recommendations to the Congress on privacy standards, addressing (1) the rights of the individual who is the subject of the information; (2) procedures for exercising such rights; and (3) authorized and required uses and disclosures of such information. HIPAA further directed that if legislation governing these privacy standards was not enacted within 3 years of the enactment of HIPAA—by August 21, 1999—the Secretary should issue regulations on the matter. HHS submitted recommendations to Congress on September 11, 1997, and when legislation was not enacted by the deadline, issued a draft regulation on November 3, 1999. After receiving over 52,000 comments on the proposed regulation, HHS issued a final regulation on December 28, 2000. Two key provisions in HIPAA defined the framework within which HHS developed the privacy regulation. HIPAA specifically applies the administrative simplification standards to health plans, health care clearinghouses (entities that facilitate the flow of information between providers and payers), and health care providers that maintain and transmit health information electronically. HHS lacks the authority under HIPAA to directly regulate the actions of other entities that have access to personal health information, such as pharmacy benefit management companies acting on behalf of managed care networks. HIPAA does not allow HHS to preempt state privacy laws that are more protective of health information privacy. Also, state laws concerning public health surveillance (such as monitoring the spread of infectious diseases) may not be preempted. HIPAA does not impose limits on the type of health care information to which federal privacy protection would apply. At the time the proposed regulation was issued, HHS sought to protect only health data that had been stored or transmitted electronically, but it asserted its legal authority to cover all personal health care data if it chose to do so. HHS adopted this position in the final regulation and extended privacy protection to personal health information in whatever forms it is stored or exchanged— electronic, written, or oral. The new regulation establishes a minimum level of privacy protection for individually identifiable health information that is applicable nationwide. When it takes full effect, patients will enjoy new privacy rights, and providers, plans, researchers, and others will have new responsibilities.Most groups have until February 26, 2003, to come into compliance with the new regulation, while small health plans were given an additional year. The regulation protecting personal health information provides patients with a common set of rights regarding access to and use of their medical records. For the first time, these rights will apply to all Americans, regardless of the state in which they live or work. Specifically, the regulation provides patients the following: Access to their medical records. Patients will be able to view and copy their information, request that their records be amended, and obtain a history of authorized disclosures. Restrictions on disclosure. Patients may request that restrictions be placed on the disclosure of their health information. (Providers may choose not to accept such requests.) Psychotherapy notes may not be used by, or disclosed to, others without explicit authorization. Education. Patients will receive a written notice of their providers’ and payers’ privacy procedures, including an explanation of patients’ rights and anticipated uses and disclosures of their health information. Remedies. Patients will be able to file a complaint with the HHS Office for Civil Rights (OCR) that a user of their personal health information has not complied with the privacy requirements. Violators will be subject to civil and criminal penalties established under HIPAA. Providers, health plans, and clearinghouses—referred to as covered entities—must meet new requirements and follow various procedures, as follows: Develop policies and procedures for protecting patient privacy. Among other requirements, a covered entity must designate a privacy official, train its employees on the entity’s privacy policies, and develop procedures to receive and address complaints. Obtain patients’ written consent or authorization. Providers directly treating patients must obtain written consent to use or disclose protected health information to carry out routine health care functions. Routine uses include nonemergency treatment, payment, and an entity’s own health care operations. In addition, providers, health plans, and clearinghouses must obtain separate written authorization from the patient to use or disclose information for nonroutine purposes, such as releasing information to lending institutions or life insurers. without explicit authorization from the individual. Furthermore, where staff administering the group health plan work in the same office as staff making hiring and promotion decisions, access to personal health information must be limited to those employees who perform health plan administrative functions. The regulation sets out special requirements for use of personal health information that apply to both federal and privately funded research: Researchers may use and disclose health information without authorization if it does not identify an individual. Information is presumed to be de-identified by removing or concealing all individually identifiable data, including name, addresses, phone numbers, Social Security numbers, health plan beneficiary numbers, dates indicative of age, and other unique identifiers specified in the regulation. Researchers who seek personal health information from covered entities will have two options. They can either obtain patient authorization or obtain a waiver from such authorization by having their research protocol reviewed and approved by an independent body—an institutional review board (IRB) or privacy board. In its review, the independent body must determine that the use of personal health information will not adversely affect the rights or welfare of the individuals involved, and that the benefit of the research is expected to outweigh the risks to the individuals’ privacy. HHS and others within the federal government will have a number of specific responsibilities to perform under the regulations. Although it no longer falls to the states to regulate the privacy of health information, states will still be able to enact more stringent laws. Federal and state public officials may obtain, without patient authorization, personal health information for public health surveillance; abuse, neglect, or domestic violence investigations; health care fraud investigations; and other oversight and law enforcement activities. HHS’ OCR has broad authority to administer the regulation and provide guidance on its implementation. It will decide when to investigate complaints that a covered entity is not complying and perform other enforcement functions directly related to the regulations. HIPAA gives HHS authority to impose civil monetary penalties ($100 per violation up to $25,000 per year) against covered entities for disclosures made in error. It may also make referrals for criminal penalties (for amounts of up to $250,000 and imprisonment for up to 10 years) against covered entities that knowingly and improperly disclose identifiable health information. Among the stakeholder groups we interviewed, there was consensus that HHS had effectively taken into account many of the views expressed during the comment period. Most organizations also agreed that the final regulation improved many provisions published in the proposed regulation. At the same time, many groups voiced concerns about the merit, clarity, and practicality of certain requirements. Overall, considerable uncertainty remains regarding the actions needed to comply with the new privacy requirements. Although the regulation, by definition, is prescriptive, it includes substantial flexibility. For example, in announcing the release of the regulation, HHS noted that “the regulation establishes the privacy safeguard standards that covered entities must meet, but it leaves detailed policies and procedures for meeting these standards to the discretion of each covered entity.” Among the stakeholder groups we interviewed, the topics of concern centered on conditions for consent, authorization, and disclosures; rules pertaining to the business associates of covered entities; limited preemption of state laws; the costs of implementation; and HHS’ capacity to provide technical assistance. in the first place. Another representative commented that public confidence in the protection of their medical information could be eroded as a result of the marketing provisions. One representative also concluded that allowing patients the opportunity to opt out in advance of all marketing contacts would better reflect the public’s chief concern in this area. HHS officials told us that this option exists under the provision granting patients the right to request restrictions on certain disclosures but that providers are not required to accept such patient requests. Several organizations questioned whether the scope of the consent provision was sufficient. For example, American Medical Association (AMA) representatives supported the requirement that providers obtain patient consent to disclose personal health information for all routine uses, but questioned why the requirement did not apply to health plans. Plans use identifiable patient information for quality assurance, quality improvement projects, utilization management, and a variety of other purposes. The association underscored its position that consent should be obtained before personal health information is used for any purpose and that the exclusion of health plans was a significant gap in the protection of this information. AMA suggested that health plans could obtain consent as part of their enrollment processes. The American Association of Health Plans (AAHP) also expressed concerns about the scope of consent, but from a different perspective. AAHP officials believe that the regulation may limit the ability of the plans to obtain the patient data necessary to conduct health care operations if providers’ patient consent agreements are drawn too narrowly to allow such data sharing. They suggested two ways to address this potential problem. First, if the health plans and network providers considered themselves an “organized health care arrangement,” access to the information plans needed could be covered in the consent providers obtained from their patients. Second, plans could include language in their contracts with physicians that would ensure access to patients’ medical record information. pharmacies could obtain written consent prior to treatment—that is, filling a prescription for the first time. The American Health Information Management Association (AHIMA) similarly noted the timing issue for hospitals with respect to getting background medical information from a patient prior to admission. HHS officials told us that they believe the regulation contains sufficient flexibility for providers to develop procedures necessary to address these and similar situations. Research organizations focused on the feasibility of requirements for researchers to obtain identifiable health information. The regulation requires them to obtain patient authorization unless an independent panel reviewing the research waives the authorization requirement. Although this approach is modeled after long-standing procedures that have applied to federally funded or regulated research, the regulation adds several privacy-specific criteria that an institutional review board or privacy board must consider. The Association of American Medical Colleges and the Academy for Health Services Research and Health Policy expressed specific concerns over the subjectivity involved in applying some of the additional criteria. As an example, they highlighted the requirement that an independent panel determine whether the privacy risks to individuals whose protected health information is to be used or disclosed are reasonable in relation to the value of the research involved. Several groups were concerned about the requirement for covered entities to establish a contractual arrangement with their business associates— accountants, attorneys, auditors, data processing firms, among others— that includes assurances for safeguarding the confidentiality of protected information. This arrangement was HHS’ approach to ensure that the regulation’s protections would be extended to information shared with others in the health care system. Some provider groups we spoke with were confused about the circumstances under which their member organizations would be considered covered entities or business associates. questioned the need for two covered entities sharing information to enter into a business associate contract. The regulation addresses one aspect of this concern. It exempts a provider from having to enter into a business associate contract when the only patient information to be shared is for treatment purposes. This exemption reflects the reasoning that neither entity fits the definition of business associate when they are performing services on behalf of the patient and not for one another. An example of such an exemption might include physicians writing prescriptions to be filled by pharmacists. Some groups also commented on the compliance challenges related to the business associate arrangement. For example, the representatives of the Joint Commission on Accreditation of Healthcare Organizations (JCAHO) noted that it would need to enter into contracts for each of the 18,000 facilities (including hospitals, nursing homes, home health agencies, and behavioral health providers) that it surveys for accreditation. However, JCAHO officials hope to standardize agreements to some extent and are working on model language for several different provider types. They explained that, because assessing quality of care varies by setting, JCAHO would need more than one model contract. Most of the groups we interviewed cited as a key issue the HIPAA requirement that the privacy standards preempt some but not all state laws. Although every state has passed legislation to protect medical privacy, most of these laws regulate particular entities on specific medical conditions, such as prohibiting the disclosure of AIDS test results. However, a few states require more comprehensive protection of patient records. The patient advocacy groups we spoke with believe that partial preemption is critically important to prevent the federal rule from weakening existing privacy protections. According to the Health Privacy Project, the federal regulation will substantially enhance the confidentiality of personal health information in most states, while enabling states to enact more far-reaching privacy protection in the future. Despite the limited scope of most state legislation at present, other groups representing insurers and employers consider partial preemption to be operationally cumbersome and argue that the federal government should set a single, uniform standard. Organizations that operate in more than one state, such as large employers and health plans, contend that determining what mix of federal and state requirements applies to their operations in different geographic locations will be costly and complex. Although they currently have to comply with the existing mix of state medical privacy laws, they view the new federal provisions as an additional layer of regulation. A representative of AHIMA remarked that, in addition to state laws, organizations will have to continue to take account of related confidentiality provisions in other federal laws (for example, those pertaining to substance abuse programs) as they develop policies and procedures for notices and other administrative requirements. The final regulation withdrew a provision in the proposed regulation that would have required HHS to respond to requests for advisory opinions regarding state preemption issues. HHS officials concluded that the volume of requests for such opinions was likely to be so great as to overwhelm the Department’s capacity to provide technical assistance in other areas. However, they did not consider it unduly burdensome or unreasonable for entities covered by the regulation to perform this analysis regarding their particular situation, reasoning that any new federal regulation requires those affected by it to examine the interaction of the new regulation with existing state laws and federal requirements. Several groups in our review expressed concern about the potential costs of compliance with the regulation and took issue with HHS’ impact analysis. In that analysis, the Department estimated the covered entities’ cost to comply with the regulation to be $17.6 billion over the first 10 years of implementation. Previously, HHS estimated that implementation of the other administrative simplification standards would save $29.9 billion over 10 years, more than offsetting the expenditures associated with the privacy regulation. HHS therefore contends that the regulation complies with the HIPAA requirement that the administrative simplification standards reduce health care system costs. HHS expects compliance with two provisions—restricting disclosures to the minimum information necessary and establishing a privacy official—to be the most expensive components of the privacy regulation, in both the short and the long term. Table 1 shows HHS’ estimates of the costs to covered entities of complying with the privacy regulation. Health Privacy: Regulation Enhances Protection of Patient Records but Raises Practical Concerns (Millions of Dollars) We did not independently assess the potential cost of implementing the privacy regulation, nor had the groups we interviewed. However, on the basis of issues raised about the regulation, several groups anticipate that the costs associated with compliance will exceed HHS’ estimates. For example, BCBSA representatives contended that its training costs are likely to be substantial, noting that its member plans encompass employees in a wide range of positions who will require specialized training courses. AHA cited concerns about potentially significant new costs associated with developing new contracts under the business associate provision. Other provider groups anticipated spending additional time with patients to explain the new requirements and obtain consent, noting that these activities will compete with time for direct patient care. Several groups, including AHA, AAMC, and AHIMA, expressed concerns about being able to implement the regulation within the 2-year time frame. model forms, policies, and procedures for implementing the regulation. AMA expects to provide guidance to physicians and help with forms and notices on a national level, and noted that the state medical associations are likely to be involved in the ongoing analysis of each state’s laws that will be required. Representatives of some organizations we contacted commented that they were unsure how the Department’s OCR will assist entities with the regulation’s implementation. They anticipate that the office, with its relatively small staff, will experience difficulty handling the large volume of questions related to such a complex regulation. OCR officials informed us that the office will require additional resources to carry out its responsibilities and that it is developing a strategic plan that will specify both its short- and its long-term efforts related to the regulation. To carry out its implementation responsibilities, HHS requested and received an additional $3.3 million in supplemental funding above its fiscal year 2001 budget of approximately $25 million. According to OCR, this amount is being used to increase its staff of 237 to support two key functions: educating the public and those entities covered by the rule about the requirements and responding to related questions. OCR officials told us that its efforts to date include presentations to about 20 organizations whose members are affected by the regulation, a hotline for questions, and plans for public forums. OCR officials said the office had received about 400 questions since the regulation was issued. Most of these inquiries were general questions relating to how copies of the regulation can be obtained, when it goes into effect, and whether it covers a particular entity. Other questions addressed topics such as the language and format to use for consent forms, how to identify organized health care arrangements, whether the regulation applies to deceased patients, and how a patient’s identity should be protected in a physician’s waiting room. According to OCR officials, technical questions that cannot be answered by OCR staff are referred to appropriate experts within HHS. by stakeholder groups reflects the recent issuance of the regulation. With time, everyone will have greater opportunity to examine its provisions in detail and assess their implications for the ongoing operations of all those affected. In addition, on a more fundamental level, the uncertainty stems from HHS’ approach of allowing entities flexibility in complying with its requirements. Although organizations generally applaud this approach, they acknowledge that greater specificity would likely allay some of their compliance concerns. Mr. Chairman and Members of the Committee, this concludes my prepared statement. I will be happy to answer any questions you may have. For future contacts regarding this testimony, please call Leslie G. Aronovitz, Director, Health Care—Program Administration and Integrity Issues, at (312) 220-7600. Other individuals who made contributions to this statement include Hannah Fein, Jennifer Grover, Joel Hamilton, Rosamond Katz, Eric Peterson, Daniel Schwimer, and Craig Winslow. (290019)

Summary: Advances in information technology, along with an increasing number of parties with access to identifiable health information, have created new challenges to maintaining the privacy of medical records. Patients and providers alike have expressed concern that broad access to medical records by insurers, employers, and others may result in inappropriate use of the information. Congress sought to protect the privacy of individuals' medical information as part of the Health Insurance Portability and Accountability Act of 1996 (HIPAA). HIPAA included a timetable for developing comprehensive privacy standards that would establish rights for patients with respect to their medical records and define the conditions for using and disclosing identifiable health information. The final privacy regulation offers all Americans the opportunity to know and, to some extent, control how physicians, hospitals, and health plans use their personal information. At the same time, these entities will face a complex set of privacy requirements that are not well understood at this time. Some of the uncertainty expressed by stakeholder groups reflects the recent issuance of the regulation. With time, everyone will have greater opportunity to examine its provisions and assess their implications for the ongoing operations of everyone affected. In addition, on a more fundamental level, the uncertainty stems from HHS' approach of allowing entities flexibility in complying with its requirements. Although organizations generally applaud this approach, they acknowledge that greater specificity would likely allay some of their compliance concerns.