The Privacy Rule addresses the use and disclosure of individuals’ health information and establishes individuals’ rights to obtain and control access to this information. Specifically, the rule covers “protected health information,” defined as individually identifiable health information that is transmitted or maintained in any form. It applies to “covered entities,” defined as health plans, health care clearinghouses, and health care providers that transmit information electronically with respect to certain transactions. The protections under the Privacy Rule extend to all individuals, regardless of the state in which they live or work, but the rule does not preempt state privacy laws that are more stringentthat is, more protective of health information privacy. Under the Privacy Rule, a covered entity may use and disclose an individual’s protected health information without obtaining the individual’s authorization when the information is used for treatment, payment, or health care operations. Protected health information may also be disclosed without an individual’s authorization for such purposes as certain public health and law enforcement activities, and judicial and administrative proceedings, provided certain conditions are met. In addition, an individual’s authorization is not required for disclosures for research purposes if a waiver of authorization, under defined criteria, is obtained from an institutional review board (IRB) or a privacy board. Except where the rule specifically allows or requires a use or disclosure without an authorization, the individual’s written authorization must be obtained; for example, authorization is generally required for disclosures to life insurers or employers. In addition, the rule contains specific provisions that generally require an individual’s authorization for the use or disclosure of psychotherapy notes or of protected health information for marketing purposes. In many circumstances, a provider or health plan can choose not to disclose information, regardless of whether an individual’s authorization is required. The Privacy Rule allows covered entities to use their discretion in deciding whether to disclose protected health information for many types of disclosures, such as those to family and friends, public health authorities, and health researchers. The Privacy Rule provides individuals with a number of rights regarding access to, and use of, their health information. Specifically, the rule provides the following: Access to and amendment of health information. Individuals have the right to inspect and copy their protected health information and to request amendments of their records. Notice of privacy practices. Individuals generally have a right to written notice of the uses and disclosures of their health information that may be made by a covered entity as well as the individual’s rights and the entity’s duties with respect to that information. Accounting for disclosures. Individuals generally have the right to request and receive a listing of disclosures of their protected health information that is shared with others for purposes other than treatment, payment, or health care operations. Complaints. In addition to being able to complain directly to a covered entity, any person who believes a health care provider, health plan, or clearinghouse is not complying with the Privacy Rule may file a complaint with the Secretary of HHS. Covered entities are required to comply with Privacy Rule provisions and follow various procedures. They must do the following: Develop policies and procedures for protecting health information. A covered entity must maintain administrative, technical, and physical safeguards. Among other requirements, a covered entity must also designate a privacy official, train its employees on the entity’s privacy policies, and develop procedures to receive and address complaints. Limit information used and disclosed to the minimum necessary. Covered entities must make reasonable efforts to limit their employees’ access to identifiable health information to the minimum needed to do their jobs. When sharing protected health information with other entities (such as collection agencies and researchers), they must make reasonable efforts to limit the information disclosed to the minimum necessary to accomplish the purpose of the data request. However, providers may share the full medical record when the disclosure is for treatment purposes. Account for disclosures of protected health information. Upon request, covered entities must provide individuals with an accounting of disclosures of their protected health information made in the preceding 6 years. This requirement applies to most disclosures other than those for treatment, payment, or operations purposes, including those that are mandated by lawsuch as certain disclosures to public health entities and law enforcement agencies. The accounting must include the date of each disclosure; the name and, if known, the address of the entity or person who received the information; a description of the information disclosed; and a statement of the purpose of the disclosure. Ensure that “downstream users” protect the privacy of health information by implementing business associate agreements. Covered entities must enter into a contract or other written agreement with any business associates with which they share protected health information for various purposes. A business associate performs certain functions or activities—such as claims processing and benefit management—on behalf of a covered entity involving the use or disclosure of individually identifiable health information. Business associate contracts must establish conditions and safeguards for uses and disclosures of identifiable health information and authorize termination of contracts if the covered entities determine that business associates have violated the agreements. The regulation establishes requirements that apply to both federally and privately funded research that seeks to use protected health information: Researchers may seek to obtain from covered entities health information without authorization if the data do not identify an individual and there is no reasonable basis to believe it could be used to identify an individual. Researchers must use one of three options to gain access to protected health information: obtain patient authorization, obtain a waiver of authorization by having their research protocol reviewed and approved by an IRB or privacy board, or use a limited data set provided by the covered entity. OCR has responsibility for implementing and enforcing the Privacy Rule as follows: Provide guidance. OCR is responsible for communicating policies contained in the Privacy Rule by issuing guidance to answer common questions and clarify certain provisions. Mechanisms by which OCR makes information available to various entities on its Web site include links to guidance documents as well as answers to frequently asked questions (FAQ). In addition, OCR has provided guidance through roundtable discussions, answers to written inquiries, an automated e- mail notification system, a toll-free hotline for questions about the Privacy Rule, as well as presentations and telephone conference calls. Administer a complaint process. OCR is responsible for investigating complaints received from health care consumers. Enforce compliance. OCR may provide covered entities with technical assistance to help them comply voluntarily with the Privacy Rule. OCR investigates complaints and may conduct reviews to determine if covered entities are in compliance and attempts to resolve issues of noncompliance through informal means. Violators are subject to civil and criminal penalties. OCR administers the civil monetary penalties while the Department of Justice administers criminal penalties involving a knowing disclosure or obtaining identifiable health information in violation of HIPAA. Organizations representing providers and health plans stated that implementation of the Privacy Rule was smoother than expected over the past year and that some initial confusion has abated. Although many provider and health plan organizations reported dealing with various ongoing problems, they noted that two provisions were particularly burdensome: the requirement to maintain a record of certain disclosures of patient information and the requirement to create business associate agreements with downstream users of protected health information. Several organizations suggested that OCR could take steps to facilitate compliance with these provisions. Some organizations we interviewed told us that the first year they were required to be compliant with the Privacy Rule was smoother than they had anticipated. The American Medical Association and the American Hospital Association stated that in general, they have heard relatively few negative reactions from their members during the past year. Many provisions were considered straightforward and relatively easy to implement, including developing the notice of privacy practices and limiting disclosures for marketing purposes. In addition, many provider, health plan, and consumer representatives reported that the Privacy Rule has increased provider awareness of, and sensitivity to, patient privacy issues, and new privacy procedures have become routine practice. For example, representatives from the American Health Information Management Association (AHIMA)—which assists providers with their management of protected health information—noted that the Privacy Rule has helped to make staff working for covered entities more aware of the flow of patient information. Organizations we interviewed also reported that some early confusion has subsided. Groups commented that initial confusion stemmed from challenges in understanding and implementing the Privacy Rule. The American Hospital Association, for example, stated that hospitals were initially concerned about the requirement to limit information disclosures to the “minimum necessary” but now understand that they can share the information needed to ensure that appropriate clinical care is provided to their patients. Representatives from the American Pharmacists’ Association (APhA) stated that members faced initial confusion implementing the Privacy Rule, but that pharmacies have since developed new standard procedures to address these issues. Representatives of the American Medical Association noted that after receiving and resolving many calls requesting clarification early in the year, it has since received few calls from its members related to the Privacy Rule. However, organizations also commented that some uncertainties and misunderstandings continue. For example, provider groups stated that some physicians and hospitals remain unclear about what type of information may be disclosed for law enforcement purposes. In addition, health plan representatives reported ongoing difficulties associated with knowing whether state laws prevail over the Privacy Rule. Despite these problems, AHIMA representatives told us that “the number of people talking about the ship sinking” because of the Privacy Rule has decreased. Overall, the organizations had mixed opinions about the extent to which OCR’s guidance facilitated implementation of the Privacy Rule. As of June 29, 2004, OCR has posted 223 FAQs and answers on its Web site. While some provider and health plan representatives reported that the OCR Web site—particularly the FAQs—was very helpful, others stated that the FAQs were not specific enough to explain certain vague or ambiguous Privacy Rule provisions. Furthermore, organizations we interviewed stated that various types of guidance offered by OCRincluding roundtable discussions and guidance on particular provisions—would have been more helpful if they had been offered sooner. For example, representatives from the American Health Care Association (AHCA) stated that if they had received clarification and guidance from OCR earlier, they would have had fewer problems implementing the rule. Although provider and health plan representatives reported dealing with a variety of ongoing problems, we consistently heard from them that two provisions were especially burdensome. These were the provisions that require accounting for disclosures and business associate agreements. Most provider and health plan organizations we interviewed identified the requirement to account for certain disclosures as unnecessarily burdensome. These organizations reported that significant time and resources are needed to establish and maintain systems to track disclosures. For example, in hospitals, various departments keep patient information in separate systems that are not necessarily electronically linked. According to the Health Care Compliance Association, hospitals have had to revise systems to establish electronic links or have had to create manual tracking mechanisms. Similarly, representatives from America’s Health Insurance Plans (AHIP) reported that many health plans or insurers generally keep information related to one patient in multiple systems—for example, separate systems for enrollment, claims payment, and customer service—making it difficult to track all information disclosures for that patient. In addition to difficulties experienced when tracking disclosures of protected health information, provider and health plan representatives also expressed concern about the volume of disclosures that must be tracked. They commented that frequent, diverse disclosures required by law add significantly to the volume of information that must be continually tracked. These include disclosures to public entities to maintain disease registries, vital statistics, and other health databases. For example, the Minnesota Department of Public Health identified over 50 state statutes in which health information may or must be released to specific state or local organizations, such as health departments, health licensing boards, and schools. Blue Cross Blue Shield Association (BCBSA) representatives told us that accounting for the disclosures of births and deaths to state health departments—required by state law—can be burdensome. They noted that some state laws require health plans to report information to the health department quarterly, while others require reporting information monthly. One organization we spoke with indicated that its members expect that complying with the provision to account for disclosures will become increasingly difficult, because they need to track these disclosures for 6 years to meet obligations under the Privacy Rule. Moreover, many organizations we interviewed questioned whether the Privacy Rule’s accounting provision generates much benefit for patients. These organizations reported that their members have received few or no requests from patients for an accounting of the disclosures of their protected health information. To somewhat reduce the burden of the requirement to account for disclosures, several organizations suggested that OCR modify the rule to require covered entities to inform patients in the privacy practices notice that when required by law, their information will be disclosed to public health organizations and law enforcement agencies. This modification would inform patients of disclosures required by law and would obviate the need to track these disclosures as they occur. Provider and health plan representatives reported that significant resources have been required to implement business associate agreements. These organizations commented that some of the burden associated with implementing this provision has stemmed from confusion and variation in determining which relationships with downstream entities require business associate agreements. The Medical Group Management Association (MGMA) stated that there is still uncertainty among its members and that it receives calls weekly about business associate agreements. APhA representatives attributed pharmacists’ difficulties determining which entities were business associates to the provision’s broad language and lack of adequate OCR guidance. Although the Privacy Rule provided for phased-in implementation of business associate agreement requirements to accommodate existing contracts, provider and health plan groups viewed the business associate agreements provision as very burdensome. Organizations we interviewed stated that some of their members have spent substantial amounts of time and money to develop thousands of business associate agreements with downstream users of protected health information, though they did not estimate specific amounts. Provider and health plan representatives reported that high costs have been associated with the need for legal counsel to negotiate and customize agreements with the multiple and various business associates. For example, BCBSA officials stated that some of their business associates have requested specific and sometimes “excessive” details in their agreements. They noted that business associates sometimes regard the agreements as an opportunity to include new provisions in their contracts that are unrelated to health privacy. The Joint Commission on Accreditation of Healthcare Organizations (JCAHO), however, was able to successfully avoid these types of problems by including a standard business associate agreement as an addendum to applications for health care accreditation. As a result, it has had “excellent compliance and cooperation from accredited entities,” according to JCAHO representatives. In contrast, hospitals and other providers negotiating individually with business associates do not have similar leverage to compel the use of their particular agreements. Some organizations representing providers and health plans suggested that OCR provide more guidance to covered entities about when and how to enter into a business associate agreement. These organizations did not consider OCR’s existing guidance specific enough to assist providers and health plans with their agreements. APhA representatives stated that OCR’s guidance on business associate agreements has “led to more questions.” Organizations representing public health agencies, research entities, and patient advocates identified several areas in which efforts to apply the Privacy Rule have created new challenges. State and federal agencies reported having to take explicit action—including outreach efforts and changes in state law—to ensure that providers and health plans continue to report health information for public health activities. Researchers pointed to increased difficulty in obtaining patient data to conduct clinical or health services research. Patient advocates also identified obstacles in obtaining protected health information from providers and plans on behalf of their clients. Many of these challenges have been attributed to misunderstandings or confusion about how to interpret the rule in conjunction with other federal requirements. Most organizations found providers reluctant to share information without patient authorization when the rule permitted providers such discretion. The burden of accounting for disclosures and liability concerns were two reasons often cited for their reluctance. Organizations representing state public health officials told us that the Privacy Rule has hindered access to patient health information because some providers are reluctant to report to public health authorities. They experienced this difficulty despite the fact that under the Privacy Rule, providers and health plans may report to public health authorities without a patient’s authorization. This provision applies both where a law requires that certain health information—such as immunizations—be reported and where a public health agency requests that providers voluntarily report certain information. Public health organizations—such as the Council of State and Territorial Epidemiologists (CSTE) and CDC—reported several cases where obtaining patient health information has become more difficult. For example, a CSTE survey of 40 state and local programs designed to detect early signs of an epidemic found that 3 programs experienced “substantial” problems and 10 experienced “some” problems with obtaining health information from providers because of patient confidentiality concerns. In another example, a CDC representative reported facing obstacles to its surveillance of mental health disabilities. CDC’s efforts to collect data on individuals with certain mental health diagnoses met resistance from a large clinic and an inpatient mental health facility. As a result, CDC redesigned its study and had to approach different providers to participate in its data collection effort. Public health organizations attributed the difficulty in obtaining public health data from providers and plans to several factors. First, organizations we spoke with believed that providers have a disincentive to report data requested by public health agencies because of the provision to account for such disclosures. According to a state public health agency representative, the necessary tracking of disclosures has had a major impact on the state’s public health activities. This is consistent with concerns expressed by representatives of health plans, physicians, hospitals, and long-term care facilities about the burden of accounting for certain disclosures. Second, some providers were confused about the rule in that they believed they were permitted to report to public health agencies only when specifically required by federal or state law. A representative of CDC noted that in some states that did not mandate reporting of birth defect surveillance data, providers were initially unwilling to disclose this information. Third, state officials noted that providers are concerned legal action might be taken against them if they provide health information to public agencies. In CDC’s efforts to monitor mental health disabilities, a provider cited fear of liability associated with improper disclosure of protected health information as the reason it declined to participate. The organizations we interviewed also reported that state and federal health agencies have taken various actions to facilitate public health reporting. These include changes in state law, enhancements to the data collection process, and targeted Privacy Rule education. For example, Kentucky, Massachusetts, and North Dakota revised regulations and laws to clarify the circumstances for reporting to public health agencies without patient authorization, to make state law more consistent with the Privacy Rule, and to make certain public health reporting mandatory. CDC modified its survey procedures for a group of health care provider surveys, known as the National Health Care Survey, to help providers participate in the surveys under the Privacy Rule. The modifications included creating a document that providers can use to account for disclosures. The Minnesota Department of Health developed a series of fact sheets that clarify, for each of several different types of disease reporting, the specific authority in the Privacy Rule that allows reporting of data to the department without patient authorization. Like the health plan and provider groups, organizations representing public health agencies stated their desire that the Privacy Rule be amended to exempt reporting to public health agencies from the accounting provision and announce in the privacy practices notice that this information will be disclosed as required by law. They contended that this approach would significantly reduce burden and remove the incentive that exists for providers to avoid disclosure of protected health data to public health agencies. Organizations representing health services and clinical researchers, such as Academy Health, the Association of American Medical Colleges, the Association of Clinical Research Organizations, and the National Cancer Advisory Board, reported that access to data for research has been delayed due to the varying approaches that some providers are taking to research requests under the Privacy Rule. They reported that research studies involving several sites of care have been delayed because of the different confidentiality requirements at study provider sites. Under the rule, researchers must obtain IRB or privacy board approval for their studies to waive the patient authorization requirement. HHS guidance states that a multisite research study need obtain approval from only one of the provider sites, but researchers’ organizations contend that often each provider institution requires that its IRB approve the waiver request. They noted that meeting the requirements of multiple IRB reviews can add substantial time to completing these studies. Under the Privacy Rule, researchers seeking authorization to use patient information must pursue their requests through the patients’ providers. Organizations reported that smaller providers with more limited administrative resources—such as some group practices and rural community hospitals—are reluctant to facilitate research studies because of misunderstanding of the rule and the added burden of contacting patients. Providers may also decline to participate because of concern about liability and because of the administrative burden of the accounting for disclosures requirement. For example, the Association of American Medical Colleges reported that some physicians no longer contribute data to research registries for cancer because of the additional resources required to track these disclosures. Another issue raised by several organizations we spoke with concerned the perceived conflicts between the Privacy Rule and federal regulation governing the protection of human subjects in research, known as the Common Rule. Research groups noted that differences between Privacy Rule and Common Rule requirements may cause confusion among researchers and covered entities and create unnecessary obstacles to research. For example, they stated that one difference relates to the scope of authority of informed consent or authorization: informed consent by patients under the Common Rule covers the research effort as a whole, including future disclosures from registry and data depositories. In contrast, they noted that a patient’s authorization or an IRB’s waiver of authorization covers only a specific research study and not future unspecified research under the Privacy Rule. Some national organizations expressed concern that providers and health plans may find it too confusing to comply with both the Privacy Rule and Common Rule requirements in responding to research proposals and requests. An AHIMA official reported that in some cases, providers and health plans “just threw up their hands and said they would just not give information to researchers.” CMS—a source of health services utilization data on Medicare beneficiaries—did not approve research requests for approximately 6 months while it developed new criteria and procedures for review of research requests to comply with the Privacy Rule. CMS now requires that researchers, who submit about 1,000 requests each year, provide more information about their study methodology and demonstrate that their research purpose is consistent with CMS’s mission. To comply with the Privacy Rule, CMS established a privacy board to review research requests. The board meets once a month, which lengthens this phase of CMS’s research approval process. The Association of American Medical Colleges, the Association of Clinical Research Organizations, and public health organizations such as the Association of State and Territorial Health Officials and CSTE reported that OCR’s guidance has not addressed some of the key misunderstandings and fundamental problems associated with the Privacy Rule’s impact on research. Ambiguity remains in determining whether a health survey activity is considered health care operations or research and whether a public health entity’s data request is part of its public health activities or is for research. These organizations stated their desire for OCR to address concerns through official revisions to the rule and issuance of federal guidance. They believe that compared with OCR’s efforts to provide information on its Web site, such official actions would “carry more weight” among providers, health plans, and research organizations. Organizations representing patient advocates reported that their members face new obstacles when seeking access to protected health information on behalf of patients. Such access problems, they say, are due to excessive paperwork, misunderstanding of the rule, and reluctance by providers and health plans to share information with legal aid attorneys, state ombudsmen, and others when the rule permits discretion. The rule gives providers and plans some latitude in exercising their professional judgment about when to disclose protected health information to individuals serving as patient advocates who are not “personal representatives” as defined by the Privacy Rule. Factors such as liability concerns and the burden of accounting for disclosures may contribute to their guarded disclosure practices. Representatives for Families USA’s Health Assistance Partnership and the National Health Law Program reported problems when lawyers or other patient advocates sought a client’s medical records. These organizations contend that some providers deny access and other providers delay or restrict access by requiring the use of a provider’s customized authorization form. They asserted that it can be cumbersome if a patient’s signature on multiple unique forms needs to be obtained from each provider. These organizations also noted that state ombudsmen services—telephonic programs that assist consumers, such as the elderly and disabled, with problems accessing health care—have had problems intervening on behalf of consumers over the telephone. Even after a consumer has given verbal approval, providers have declined to share information with the ombudsman in subsequent phone calls if the patient is not also on the telephone. In addition, AHIP, AHCA, and BCBSA reported that families and friends of patients continue to face problems obtaining information to assist in patients’ care. BCBSA reported that some plans are confused about how to implement the Privacy Rule’s provisions for releasing information to families, friends, and others. Where the rule permits discretion, some covered entities have taken a strict approach to patient authorization requirements, requiring any adult calling on behalf of another adult to obtain an authorization form signed by the patient. For example, this approach resulted in one health plan requiring 10,000 patient authorizations during the first year. Similarly, AHCA found that some long-term care facilities have taken a strict approach to disclosing information and do not provide information to nursing home residents’ family members without patient authorization. AHCA also reported that the Privacy Rule does not address a potential conflict with the Omnibus Budget Reconciliation Act of 1987 that requires nursing homes to notify families of incidents or significant changes in health status unless the resident exercises the right to privacy. Under the Privacy Rule, a provider may, in certain situations, determine whether or not to share information with family based on professional judgment. Numerous organizations reported that patients are not aware of their rights under the Privacy Rule, either because they do not understand the notice of privacy practices, or because they have not focused their attention on privacy issues when the notices are presented to them. In the first year after entities were required to be compliant with the Privacy Rule, OCR received over 5,600 privacy complaints and closed about half of the complaint cases filed. Nearly two-thirds of the closed cases were resolved on the basis that they were outside the scope of the Privacy Rule, suggesting that patients may misunderstand their rights. Consumer groups—including AARP, the Bazelon Center for Mental Health Law, the Health Privacy Project, the Health Assistance Partnership, and the National Health Law Programreported that many patients are not aware of their privacy rights. They attribute this, in part, to the use of customized privacy notices. For example, consumer groups reported that typical privacy notices, as drafted by providers and health plans, are often difficult to read and understand. The Health Privacy Project maintained that the privacy notices are written primarily to protect providers and health plans from enforcement actions, rather than as a vehicle to inform the patient. It noted that even basic information about disclosures and the right to access records is often buried in the document. Representatives of providers and health plans also stated that patients are largely unaware of their rights. According to AHIMA, patients are unaware of their privacy rights because the privacy notice is treated as one more piece of paper that they have to sign when they seek care. MGMA noted that some physicians have placed boxes in their offices specifically for the purpose of recycling the notices after patients discard them. Representatives from both provider and consumer groups noted that the public should receive more education about how their rights have changed. MGMA told us that OCR has placed the burden of patient education on private organizations—such as professional associations, providers, and health plans—and that some of these organizations interpret the rule incorrectly. Moreover, provider and consumer groups stated that further OCR attention is needed to address the issue of privacy notices that are difficult for patients to read and understand. Some groups told us that the notice of privacy practices could be made easier to comprehend by highlighting some key patient rights under the Privacy Rule. In the first year that entities were required to be compliant with the Privacy Rule, consumers and others filed 5,648 privacy-related complaints with OCR. The number of complaints received increased steadily from quarter to quarter, with each quarter’s intake totaling 1,068, 1,392, 1,521, and 1,667, respectively. Overall, roughly half of the complaints filed in the rule’s first year were closed as of early May 2004. The database that OCR maintains on these complaints includes information that classifies one or more privacy issues raised in several broad categories. Data on the open and closed cases showed that the most commonly cited category (56 percent of complaints) was “impermissible uses and disclosures.” According to an OCR official, this could include allegations regarding patient billing information sent to the wrong address or FAX number, patient information seen or overheard in a doctor’s office or hospital, or provider employees accessing patient information for their own personal or business benefit. Approximately a third of the complaints cited inadequate safeguards for patient information, and 17 percent reported problems with patients gaining access to their own health information. Patients have filed privacy complaints against many different types of health care entities. The two most commonly cited were private practices—comprising physicians, dentists, chiropractors, and similar licensed health professionals—and hospitals—including general, psychiatric, and specialty hospitals. Together, private practices and hospitals accounted for 41 percent of privacy complaints with information on entity type recorded. For closed cases, the OCR database provides additional information, primarily related to the final disposition of the complaint. The majority of these complaints—79.1 percent—were not germane to the Privacy Rule, lacked sufficient information to process them, or fell into diverse miscellaneous categories. That left 20.9 percent of the closed privacy complaints that OCR concluded fell within the scope of the Privacy Rule (see table 1). About half of the germane complaints (representing 9.4 percent of total closed cases) involved a violation of the Privacy Rule substantiated by OCR’s investigation where the provider or plan agreed to correct its policies or procedures. For the rest of these germane complaints (11.5 percent of total closed cases), OCR determined that no violation had occurred. By May 2004, OCR had not recommended sanctions against any provider or health plan for privacy violations, but this remained a potential outcome for the first-year complaints that were still open at that point. Nearly two-thirds of the privacy complaints closed during the rule’s first year of operation fell outside the scope or time frame of the rule. This included the 35.4 percent of closed privacy complaints that involved alleged actions by providers, health plans, or other entities that OCR determined would not constitute violations of the regulation even if true. In other words, they concerned actions to which the patient might object, but that were not prohibited by the Privacy Rule. An additional 17.7 percent of closed complaints involved entities that were not “covered entities” as defined by the Privacy Rule, and 9.6 percent cited actions that occurred before covered entities were required to be compliant. However, OCR officials stated that the proportion of complaints closed because they were not germane to the Privacy Rule may have been higher in the first year of the rule’s implementation than it will be in later years because OCR can generally complete its processing of such complaints more quickly than complaints that require full-scale investigations. Just over half of the complaints received in the first year remained open in early May 2004. Finally, about 15 percent of closed complaints fell into one of a number of miscellaneous categories or, more commonly, could not be pursued because OCR did not receive, and could not obtain, critical information. For example, some complaints lack addresses or telephone numbers by which the persons filing the complaints could be contacted for more information. Closed complaints involving three major categories of providers—private practices, hospitals, and pharmacies—were more likely to be judged germane under the Privacy Rule by OCR than were complaints about other organizations. Nevertheless, for each of these major provider types, as well as for all other entities cited in privacy complaints, OCR found that a clear majority of the complaints it closed were not germane to the regulation because they either involved accusations of actions that were not prohibited by the regulation, involved entities that were not “covered entities” as defined by the Privacy Rule, or involved actions that occurred before covered entities were required to be compliant (see fig. 1). The similarity of this pattern across different types of entities suggests that patients may misunderstand the scope of the protections provided to them under the Privacy Rule. The pattern is also consistent with consumer advocates’ opinions concerning the limitations of privacy notices in informing patients about their rights under the Privacy Rule. Overall, in its first year, HIPAA’s Privacy Rule has resulted in both positive and negative experiences among covered entities and other users of health information. Health care staff have been sensitized to privacy issues and the procedures required of their organizations to protect patient health information. Providers and health plans have taken steps to develop working environments that are sensitive to patient privacy and to enhance staff understanding of how to handle the complexities of complying with the Privacy Rule. However, some operational issues and misconceptions about the rule continue to raise concerns. A prime example is the requirement to account for disclosures for public health purposes that are mandated by law. This requirement is seen by many to have created a costly and unnecessary demand on providers and health plans and a drag on the flow of information for purposes considered to be in the public interest. Providers and health plans that are uncertain or misinformed about their privacy responsibilities have often responded with an overly guarded approach to disclosing information, resulting in procedures that may be more protective of the organizations than necessary to ensure compliance with the Privacy Rule. At the same time, the job of educating the public about the content and intent of the Privacy Rule has been relegated to providers and health plans and their privacy notices have not consistently provided a clear message to patients. We recommend that to reduce unnecessary burden on covered entities and to improve the effectiveness of the Privacy Rule, the Secretary of HHS take the following two actions: Modify the Privacy Rule to (1) require that patients be informed in the notice of privacy practices that their information will be disclosed to public health authorities when required by law and (2) exempt such public health disclosures from the accounting-for-disclosures provision. Conduct a public information campaign to improve awareness of patients’ rights under the Privacy Rule. In written comments on a draft of this report, HHS agreed with our finding that implementation went more smoothly than expected during the first year, confusion has diminished, and new privacy procedures have become routine practice for staff. They stated that the experience of providers and health plans in implementing the Privacy Rule, as we reported, were generally consistent with what HHS has heard from many covered entities and others. (See app. II.) Regarding our recommendation that mandatory reporting of health information to public health authorities be exempted from the accounting for disclosure requirement, HHS noted that it has considered such a change in the past and continues to monitor the need to modify the Privacy Rule. In August 2002, HHS considered exempting public health disclosures from the accounting provisions whether required by law or not, but decided against such a modification pending further experience with the rule. HHS acknowledged that covered entities continue to report difficulties tracking such disclosures and stated that its guidance documents emphasize flexibility in how covered entities structure their record keeping. Given HHS’s goal of ensuring effective patient privacy protections without imposing unnecessary costs or barriers to quality health care or interfering with other important public benefits, we remain concerned that the accounting for disclosure provision as applied to mandatory public health reporting may not support this goal. Effective privacy notices could be used to inform patients of public health disclosures required by law and, in turn, reduce the need to track these numerous disclosures. Furthermore, public health officials noted that the burden imposed by accounting for legally required disclosures may generate the unintended consequence of reducing the amount of information voluntarily reported to public health authorities. To the extent that covered entities are discouraged in this way, the public interest may be negatively affected. In commenting on our second recommendation, to conduct a public information campaign to improve awareness of patient’s rights under the Privacy Rule, HHS agreed that notices of privacy practices may appear too long and complicated and that consumers may not be closely reading their notices. HHS stated that the complaint data received by OCR may not indicate that consumers are unaware of their rights under the rule, but rather that they may not properly understand them. Regarding its consumer outreach, HHS pointed to two new consumer fact sheets posted to its Web site on August 17, 2004, a toll-free call-in line to respond to questions about the rule, and efforts to encourage covered entities to develop consumer-friendly notices that highlight key information. Evidence from numerous organizations indicated that consumers are largely unaware of their rights under the Privacy Rule, and our analysis of OCR complaint data suggested that consumers may misunderstand the scope of the protections provided. A more diverse approach to consumer outreach may be necessary to effectively communicate the new privacy rights. The information available on the HHS Web site and from the call-in line provide access to a portion of the general public but may not reach the many consumers who do not know of these sources. We believe it is important that, in current and future efforts to educate the public, HHS more effectively disseminate information about protections provided under the Privacy Rule. As agreed with your office, unless you publicly announce its contents earlier, we plan no further distribution of this report until 30 days from its date. At that time, we will send copies of this report to the Secretary of HHS and to other interested parties. In addition, this report will be available at no charge on GAO’s Web site at http://www.gao.gov. We will also make copies available to others upon request. If you or your staff have any questions about this report, please call me at (312) 220-7600. Another contact and key contributors are listed in appendix II. We included the following national organizations and federal agencies in our review. America’s Health Insurance Plans Blue Cross Blue Shield Association Medicare (HHS’s Centers for Medicare & Medicaid Services) In addition to the contact named above, Kelly L. DeMots, Mary F. Giffin, Eric A. Peterson, and Lisa M. Vasquez made key contributions to this report. The Government Accountability Office, the audit, evaluation and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability. The fastest and easiest way to obtain copies of GAO documents at no cost is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts newly released reports, testimony, and correspondence on its Web site. To have GAO e-mail you a list of newly posted products every afternoon, go to www.gao.gov and select “Subscribe to Updates.”

Summary: Issued under the Health Insurance Portability and Accountability Act of 1996, the Privacy Rule provided new protections regarding the confidentiality of health information and established new responsibilities for providers, health plans, and other entities to protect such information. GAO reviewed (1) the experience of providers and health plans in implementation; (2) the experience of public health entities, researchers, and representatives of patients in obtaining access to health information; and (3) the extent to which patients appear to be aware of their rights. Organizations representing providers and health plans told us that implementation of the Privacy Rule went more smoothly than expected during the first year after most entities were required to be compliant. In addition, they reported that new privacy procedures have become routine practice for their members' staff. However, provider and health plan representatives also raised a variety of issues about provisions that continue to be problematic. In particular, many organizations emphasized that two provisions--the requirement to account for certain information disclosures and the requirement to develop agreements with business associates that extend privacy protections "downstream"--are unnecessarily burdensome. Some organizations suggested that difficulties with these provisions could be ameliorated with modification of certain provisions and further guidance from the Department of Health and Human Services' Office for Civil Rights (OCR). Organizations reported a number of challenges faced by entities that rely on access to health information for public health monitoring, research, and patient advocacy. Public health entities noted that some states have had to take concerted action to ensure that providers' concerns about complying with the Privacy Rule do not impede the flow of important information to state health departments and disease registries. Some research groups asserted that the rule has delayed clinical and health services research by reducing access to data. Some consumer advocacy groups told us that patients' families, friends, and other representatives have experienced unnecessary difficulty in assisting patients. These groups perceived that while providers and plans are allowed, in certain cases, to disclose health information without written patient authorization, they are reluctant to do so. Consumer and provider representatives contend that the general public is not well informed about their rights under the Privacy Rule. According to these organizations, patients may not understand the privacy notices they receive, or do not focus their attention on privacy issues when the notices are presented to them. Some evidence of patients' lack of understanding is reflected in the 5,648 complaints filed with OCR in the first year after the Privacy Rule took effect. Of the roughly 2,700 complaint cases OCR closed as of April 13, 2004, nearly two-thirds were found to fall outside the scope of the Privacy Rule because they either involved accusations of actions that were not prohibited by the regulation, involved entities that were not "covered entities" as defined by the Privacy Rule, or involved actions that occurred before covered entities were required to be compliant. Of those cases that were germane to the rule, OCR determined that about half represented cases in which no violation had occurred.