Medical records and your privacy: Developing federal legislation to protect patient privacy rights

American Journal of Law and Medicine

Volumn 26, Issue 4, 2000, Pages 453-474

  Hussong, Sharon J ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

CONFIDENTIALITY; COURT; DOCTOR PATIENT RELATION; HEALTH INSURANCE; LAW; MEDICAL RECORD; NOTE; PATIENT INFORMATION; PATIENT RIGHT; PRIVACY; PROFESSIONAL SECRECY;

FEDERAL GOVERNMENT; LEGAL APPROACH; PROFESSIONAL PATIENT RELATIONSHIP;

AMERICAN MEDICAL ASSOCIATION; CONFIDENTIALITY; EMPLOYMENT; FEDERAL GOVERNMENT; HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; HUMANS; INFORMED CONSENT; LIABILITY, LEGAL; MEDICAL RECORDS; MEDICAL RECORDS SYSTEMS, COMPUTERIZED; PATIENT ADVOCACY; PHYSICIAN-PATIENT RELATIONS; PREJUDICE; PRIVACY; UNITED STATES; UNITED STATES DEPT. OF HEALTH AND HUMAN SERVICES;

EID: 0034485901     PISSN: 00988588     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Note

References (275)

1. American Political Network, Medical Privacy: Shalala Urges Congressional Action, AM. HEALTH LINE, Sept. 8, 1999, available in WL 9/8/99 APN-HE 4 [hereinafter Shalala Urges Congressional Action].
2. See Karen Gullo, Medical Privacy Rules Debated, ASSOC. PRESS, Feb. 17, 2000, available in 2000 WL 14321242.
3. See id.
4. See id.
5. See id.
6. Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996).
7. See Medical Record Privacy: Hearing on Medical Records Confidentiality in a Changing Health Care Environment, 106th Cong. (1999) (opening statement of James M. Jeffords, sponsor of S. 578), available in 1999 WL 16946790 [hereinafter Changing Health Care].
8. See id.
9. See Jonathan Gardner, Senate to Try Again on Records Privacy, MOD. HEALTHCARE, Sept. 6, 1999, at 6.
10. See Clinton Unveils Limited Privacy Protection for Electronic Medical Records, DOW JONES BUS. NEWS, Oct. 29, 1999, available in WL 10/29/99 DJBN 11:10:00 [hereinafter Clinton Unveils Limited Electronic Protection].
11. See id.
12. See id.; see also Diana Haramboure, An Industry Unready for HIPAA's Proposed Privacy Legislation, HEALTH MGMT. TECH., Aug. 1, 1999, available in 1999 WL 13225143 (describing the patient's dilemma: "I don't want the person across the table from me to have access to my medical information, yet I want it immediately available if I visit an emergency room").
13. See Marcy Gordon, Lawmakers Form New Privacy Groups, ASSOC. PRESS, Feb. 10, 2000, available in 2000 WL 12390090 (explaining that many Americans have raised concern over the issue of privacy as it pertains to their medical records).
14. See id. (stating that the task force is necessary because laws have failed to keep up with increased technology).
15. See id.
16. See id.; see also Keith Perine, The Privacy Police, THE STANDARD, Feb. 14, 2000 (visited Nov. 28, 2000) 〈http://www.thestandard.com/article/display/0,11519729,00.html〉 (noting that the caucus will push for "tough new privacy laws").
17. See Gullo, supra note 2 (reporting that Margaret Hamburg, assistant secretary at the Department of HHS, testified, "[e]mployers should not be able to use information obtained for health purposes to discriminate against individuals when making employment decisions").
18. See id.
19. See Changing Health Care, supra note 7.
20. See Sam Loewenberg, The Politics of Medical Privacy, LEGAL TIMES, Mar. 22, 1999, at 4 (noting that restrictions on insurance and pharmaceutical companies' access to patient medical data impairs their ability "to provide high quality care and to engage in critical research").
21. See id. For example, IMS Corporation collects prescription drug data, such as dosage amounts and the number of drugs that patients are taking, and sells the data to pharmaceutical manufacturers for use in marketing and research. See id. at 4.
22. See id.
23. See id.
24. See id.
25. See Clinton Unveils Limited Electronic Protection, supra note 10 (noting that employers evaluate medical records when hiring new employees); see also American Political Network, Medical Privacy: Nation's Papers Calling for New Law, AM. HEALTH LINE, Nov. 10, 1999, available in WL 11/10/99 APN-HE 21 (noting that "[t]wo-thirds of adults say they don't trust that their medical records will remain confidential") [hereinafter Nation's Papers Calling for New Law].
26. See Clinton Unveils Limited Electronic Protection, supra note 10 (noting that employers evaluate medical records when hiring new employees); see also American Political Network, Medical Privacy: Nation's Papers Calling for New Law, AM. HEALTH LINE, Nov. 10, 1999, available in WL 11/10/99 APN-HE 21 (noting that "[t]wo-thirds of adults say they don't trust that their medical records will remain confidential") [hereinafter Nation's Papers Calling for New Law].
27. Alex Keto, Clinton Announces Electronic Medical Record Privacy Rules, DOW JONES NEWS SERV., Oct. 29, 1999, available in WL 10/29/99 DJNS 09:58:00.
28. See id. When President Clinton announced the HHS regulations, he noted the ease with which a Pennsylvania company obtained detailed information about its employees' prescriptions. See American Political Network, Medical Privacy: 'Sweeping' Regulations Cause Much Debate, AM. HEALTH LINE, Nov. 1, 1999, available in WL 11/1/99 APN-HE 3 [hereinafter 'Sweeping' Regulations Cause Much Debate];
29. see also Sonya Ross, Clinton Proposes Patient Privacy, AP ONLINE, Oct. 29, 1999, available in 1999 WL 28133539 (reporting Clinton's statement, "In 1999, Americans should never have to worry about the nightmare scenarios depicted in George Orwell's '1984.' I am determined to put an end to such violations of privacy").
30. See Keto, supra note 26.
31. See Clinton Backs Medical Privacy: President Announces Patient Privacy Plan, CBS WORLDWIDE INC. (1999) [hereinafter Clinton Backs Medical Privacy]. Janlori Goldman, director of the Health Privacy Project, noted, "People are very concerned that their medical records are being used in ways that could hurt them." Id.
32. See Nation's Papers Calling for New Law, supra note 25; see also Geri Aston, Banking Bill Raises Privacy Concerns, AM. MED. NEWS, Aug. 9, 1999, at 6 [hereinafter Banking Bill Raises Privacy Concerns]. Dr. Donald J. Palmisano, Trustee of the AMA, notes that even the new HHS regulations "could lead to situations in which information from an insurer about a patient's cancer diagnosis could result in the person being turned down for a mortgage." Id.
33. See Nation's Papers Calling for New Law, supra note 25; see also Geri Aston, Banking Bill Raises Privacy Concerns, AM. MED. NEWS, Aug. 9, 1999, at 6 [hereinafter Banking Bill Raises Privacy Concerns]. Dr. Donald J. Palmisano, Trustee of the AMA, notes that even the new HHS regulations "could lead to situations in which information from an insurer about a patient's cancer diagnosis could result in the person being turned down for a mortgage." Id.
34. See American Political Network, Medical Privacy: Clinton Unveils Plan, AM. HEALTH LINE, Oct. 29, 1999, available in WL 10/29/99 APN-HE 4 (noting that the new rules promulgated by HHS bar disclosure of patients' treatment information to banks and credit card companies, since a consumer's credit status may be adversely affected) [hereinafter Clinton Unveils Plan].
35. See Loewenberg, supra note 20, at 5; see also Geri Aston, State Laws Show Mixed Results on Privacy, AM. MED. NEWS, Aug 9, 1999, at 5-6 (noting that consumers fear embarrassment, job loss, and denial of health insurance) [hereinafter State Laws Show Mixed Results on Privacy].
36. See Loewenberg, supra note 20, at 5; see also Geri Aston, State Laws Show Mixed Results on Privacy, AM. MED. NEWS, Aug 9, 1999, at 5-6 (noting that consumers fear embarrassment, job loss, and denial of health insurance) [hereinafter State Laws Show Mixed Results on Privacy].
37. See Lance Chilton et al., Privacy Protection of Health Information: Patient Rights and Pediatrician Responsibilities, 104 PEDIATRICS 973, 973 (1999) (noting that health providers may use electronic records to justify not paying out claims to patients predisposed to costly medical conditions).
38. See Clinton Backs Medical Privacy, supra note 29. Last year, two pharmacy chains provided a marketing company with the prescription information of thousands of customers without their knowledge or consent. The company then sent unsolicited letters to the customers, suggesting that they try a different drug or that they refill their current prescriptions. See id.
39. See Nation's Papers Calling for New Law, supra note 25.
40. See State Laws Show Mixed Results on Privacy, supra note 32, at 6 (noting that patients may avoid medical tests because they fear their health information is not being kept private); see also Changing Health Care, supra note 7; Geri Aston, Delegates Firm up Privacy Policy, AM. MED. NEWS, July 12, 1999, at 1 (describing the AMA's new patient confidentiality policy, which includes preserving the sanctity of the physician-patient relationship) [hereinafter Delegates Firm up Privacy Policy].
41. See State Laws Show Mixed Results on Privacy, supra note 32, at 6 (noting that patients may avoid medical tests because they fear their health information is not being kept private); see also Changing Health Care, supra note 7; Geri Aston, Delegates Firm up Privacy Policy, AM. MED. NEWS, July 12, 1999, at 1 (describing the AMA's new patient confidentiality policy, which includes preserving the sanctity of the physician-patient relationship) [hereinafter Delegates Firm up Privacy Policy].
42. See State Laws Show Mixed Results on Privacy, supra note 32, at 6 (noting that patients may avoid medical tests because they fear their health information is not being kept private); see also Changing Health Care, supra note 7; Geri Aston, Delegates Firm up Privacy Policy, AM. MED. NEWS, July 12, 1999, at 1 (describing the AMA's new patient confidentiality policy, which includes preserving the sanctity of the physician-patient relationship) [hereinafter Delegates Firm up Privacy Policy].
43. Delegates Firm up Privacy Policy, supra note 36, at 1.
44. See Changing Health Care, supra note 7.
45. See State Laws Show Mixed Results on Privacy, supra note 32, at 6.
46. See 'Sweeping' Regulations Cause Much Debate, supra note 27. HHS Secretary Shalala noted, "We have worked very hard to do what common sense and common decency says should have been done a long time ago." Id.
47. See Chilton et al., supra note 33, at 974.
48. See State Laws Show Mixed Results on Privacy, supra note 32, at 6.
49. See id.
50. See Nation's Papers Calling for New Law, supra note 25 (discussing the shortcomings of the regulations).
51. See Delegates Firm up Privacy Policy, supra note 36, at 1; see also Nation's Papers Calling for New Law, supra note 25 (noting that although doctors are "among the strongest supporters" of patient privacy legislation, they acknowledge that "data sharing can improve . . . treatment").
52. See Delegates Firm up Privacy Policy, supra note 36, at 1; see also Nation's Papers Calling for New Law, supra note 25 (noting that although doctors are "among the strongest supporters" of patient privacy legislation, they acknowledge that "data sharing can improve . . . treatment").
53. See Robert Pear, Clinton to Stress Medical Privacy: Regulations on Confidentiality of Records to be Proposed Soon, SAN DIEGO UNION-TRIB., Oct. 27, 1999, at A1.
54. See id.
55. See id. (quoting the vice president of the American Psychiatric Association (APA) as saying that the proposal would "take away some of the power that patients have traditionally had to decide when and if their records are released to third parties"); see also Brian J. Jones et al., A Survey of Fortune 500 Corporate Policies Concerning the Psychiatrically Handicapped, J. OF REHABILITATION, Oct.-Dec. 1991, at 31, 33 (noting that of the 127 Fortune 500 companies responding to the survey, only thirteen companies have a formal written policy "specifically concerning the hiring of the psychiatrically handicapped," while only eleven companies "have a formal policy specifically concerning their promotion and advancement"). Id. Since the HHS rules permit psychotherapists to release a summary of a patient's diagnosis, prognosis, and progress without gaining the patient's consent, it is apparent that employers may still be tempted to use an employee's medical records as a screening method when making hiring and promotion decisions. See 45 C.F.R. § 164.508(3)(i)(A) (2000);
56. See id. (quoting the vice president of the American Psychiatric Association (APA) as saying that the proposal would "take away some of the power that patients have traditionally had to decide when and if their records are released to third parties"); see also Brian J. Jones et al., A Survey of Fortune 500 Corporate Policies Concerning the Psychiatrically Handicapped, J. OF REHABILITATION, Oct.-Dec. 1991, at 31, 33 (noting that of the 127 Fortune 500 companies responding to the survey, only thirteen companies have a formal written policy "specifically concerning the hiring of the psychiatrically handicapped," while only eleven companies "have a formal policy specifically concerning their promotion and advancement"). Id. Since the HHS rules permit psychotherapists to release a summary of a patient's diagnosis, prognosis, and progress without gaining the patient's consent, it is apparent that employers may still be tempted to use an employee's medical records as a screening method when making hiring and promotion decisions. See 45 C.F.R. § 164.508(3)(i)(A) (2000);
57. see also Keto, supra note 26.
58. See 45 C.F.R. § 160.102(a)-(c) (defining a covered entity as "[a] health plan; [a] health care clearinghouse; and [a] health care provider who transmits any health information in electronic form").
59. Id. § 164.508(a)(2)(D)(ii)(A)-(C) (noting that "non-health related divisions of the covered entity [include] . . . use in marketing life or casualty insurance or banking services").
60. Id. § 164.516(a)(1).
61. Pear, supra note 46, at A1.
62. See 45 C.F.R. § 160.203(b).
63. Id. § 164.506(b)(1).
64. Id. § 164.514(d)(3)(iv).
65. See 'Sweeping' Regulations Cause Much Debate, supra note 27.
66. id.
67. See 45 C.F.R. § 164.508(3)(i)(A) (stating that covered entities must obtain authorization for access to psychotherapy notes).
68. Id.
69. Id. § 164.508(3)(iv)(A).
70. Id.
71. See Amy Goldstein, Clinton Issues Shield for Patients' Records, BOSTON GLOBE, Oct. 29, 1999, at A1; see also Keto, supra note 26 (citing the peculiar dangers associated with disseminating electronic records, including an instance where "a medical center inadvertently stored confidential health care records on a public website for two months before realizing the information was being given out");
72. See Amy Goldstein, Clinton Issues Shield for Patients' Records, BOSTON GLOBE, Oct. 29, 1999, at A1; see also Keto, supra note 26 (citing the peculiar dangers associated with disseminating electronic records, including an instance where "a medical center inadvertently stored confidential health care records on a public website for two months before realizing the information was being given out");
73. see also Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, 110 Stat. 1936 (1996).
74. See Goldstein, supra note 62, at A1.
75. See id.
76. Law enforcement officials are defined as "officer[s] of an agency or authority of the United States . . . who [are] empowered by law to conduct [a]n investigation or official proceeding inquiring into a violation of, or failure to comply with, any law; or [a] criminal, civil, or administrative proceeding arising from a violation of, or failure to comply with, any law." 45 C.F.R. § 164.504(2)(ii)(1)-(2).
77. See Pear, supra note 46, at A1 (noting that some law enforcement officials fear that the HHS rules "may go too far").
78. See Goldstein, supra note 62, at A1.
79. See 45 C.F.R. § 164.510(f)(C)(1)-(3);
80. see also Pear, supra note 46, at A1.
81. See Goldstein, supra note 62, at A1.
82. See Pear, supra note 46, at A1. "The information sought [must be] relevant and material to a legitimate law enforcement inquiry; [and] [t]he request [must be] as specific and narrowly drawn as is reasonably practicable." 45 C.F.R. § 164.510(f)(c)(1)-(2).
83. See Pear, supra note 46, at A1.
84. See id. Law enforcement officials also fear that a suspect's "privacy rights" will shield him or her from being brought to justice. See id. Therefore, officials support the right to "ask hospitals to notify them if a fleeing suspect shows up for treatment of a gunshot wound" so they can locate suspects more quickly. Id.
85. See 'Sweeping ' Regulations Cause Much Debate, supra note 27 (noting that many representatives of physicians' groups do not believe the HHS regulations go far enough). William Bruno, an attorney for the APA, notes that "patients stand to lose some of the protections they already have." Id.
86. Pear, supra note 46, at A1.
87. 'Sweeping' Regulations Cause Much Debate, supra note 27.
88. See id. ("The AMA believes that the mere notice of a health plan's intended use is inadequate.").
89. See Patient Records Confidentiality: Identity Crisis, AM. MED. NEWS, Aug. 9, 1999, at 15.
90. 'Sweeping ' Regulations Cause Much Debate, supra note 27.
91. See Patient Records Confidentiality: Identity Crisis, supra note 77.
92. See 'Sweeping' Regulations Cause Much Debate, supra note 27.
93. See id.
94. id.
95. See id.
96. See id. The Clinton administration and the insurance industry vary widely in their cost estimates for implementing the rules. See id. While the Clinton administration estimated costs at $3.8 billion over the next five years, the insurance industry claimed the cost would be "ten times that amount." Id. (noting that some federal officials estimate that the rules will cost physicians, hospitals, and HMOs over $400 million to notify patients of their rights); see also Pear, supra note 46, at A1 (noting that federal officials believe the insurance industry's estimates are "grossly exaggerated"). Patients' requests to have their medical records corrected alone could cost around $2 billion over five years. See 'Sweeping ' Regulations Cause Much Debate, supra note 27.
97. 'Sweeping' Regulations Cause Much Debate, supra note 27.
98. Pear, supra note 46, at A1.
99. See 'Sweeping' Regulations Cause Much Debate, supra note 27.
100. See id. The HHS regulations apply to "health plan[s] . . . health care clearinghouse[s] . . . [and] health care provider[s] who [transmit] any health information in electronic form." 45 C.F.R. § 160.102(a)-(c).
101. 45 C.F.R. § 160.504.
102. See 'Sweeping' Regulations Cause Much Debate, supra note 27.
103. See Shalala Urges Congressional Action, supra note 1 (noting a Las Vegas Sun editorial urging Congress to "take action to preserve the privacy of medical records"); see generally Nation's Papers Calling for New Law, supra note 25 (noting that Congress has to address the "loopholes" in the HHS rules).
104. See Shalala Urges Congressional Action, supra note 1 (noting a Las Vegas Sun editorial urging Congress to "take action to preserve the privacy of medical records"); see generally Nation's Papers Calling for New Law, supra note 25 (noting that Congress has to address the "loopholes" in the HHS rules).
105. See Clinton Unveils Limited Electronic Protection, supra note 10.
106. See Keto, supra note 26. President Clinton stated, "I believe Congress should act. . . . There are still protections . . . we can give our families only if an act of Congress is passed. For example, only through legislation, can we cover all paper records and all employers." Id. HIPAA, the 1996 legislation that permitted HHS to promulgate regulations, limited the rules' scope to electronic records.
107. See Goldstein, supra note 62, at A1.
108. See 'Sweeping' Regulations Cause Much Debate, supra note 27.
109. Id.
110. See id.
111. See Privacy Commission Act, H.R. 4049, 106th Cong. (2000).
112. Id. § 3. Although H.R. 4049 proposes a Commission for further studying privacy issues, rather than specifically proposing privacy legislation for protecting patients' medical records, H.R. 4049 recognizes the need for improved legislation protecting the confidentiality of medical records. The bill states, "There is a growing concern about the confidentiality of medical records, because there are inadequate Federal guidelines and a patchwork of confusing State and local rules regarding privacy protection for individually identifiable patient information." Id. § 2(3).
113. See H.R. 4049, § 5(a)(1)-(5).
114. See id. § 4(a).
115. Id. § 4(a)(3).
116. See id. §§ 4(c)(1), 4(d).
117. Id. § 4(c)(2)(D).
118. For a discussion of the proposed Senate and House bills, see infra Parts III.A.-G.
119. See Health Care Personal Information Nondisclosure Act of 1999, S. 578, 106th Cong. (1999).
120. See Jonathan Gardner, Congress Considers Patient Privacy Bills, MOD. HEALTHCARE, Apr. 12, 1999, at 8 (noting that Senator Jeffords is the chairperson of the Health, Education, Labor, and Pensions Committee, which has jurisdiction over proposed privacy legislation in the Senate); see also Delegates Firm up Privacy Policy, supra note 36, at 30. But see Loewenberg, supra note 20, at 4 (noting that privacy advocates are more supportive of Senator Leahy's bill). For a discussion of Senator Leahy's bill, see infra Part III.C.
121. See Jonathan Gardner, Congress Considers Patient Privacy Bills, MOD. HEALTHCARE, Apr. 12, 1999, at 8 (noting that Senator Jeffords is the chairperson of the Health, Education, Labor, and Pensions Committee, which has jurisdiction over proposed privacy legislation in the Senate); see also Delegates Firm up Privacy Policy, supra note 36, at 30. But see Loewenberg, supra note 20, at 4 (noting that privacy advocates are more supportive of Senator Leahy's bill). For a discussion of Senator Leahy's bill, see infra Part III.C.
122. S. 578, § 101(a).
123. See id. § 102(a).
124. See id. § 103(a)(1).
125. Haramboure, supra note 12; see also S. 578, § 201(b)(1) (emphasis added).
126. See S. 578, § 314(a)-(b). For a discussion of the individual's private right of action, see infra Part IV.B.
127. Id. § 205.
128. See id. §§ 401(a)(1), 402; see also State Laws Show Mixed Results on Privacy, supra note 32, at 6. For a discussion of federal preemption, see infra Part IV.A.
129. See id. §§ 401(a)(1), 402; see also State Laws Show Mixed Results on Privacy, supra note 32, at 6. For a discussion of federal preemption, see infra Part IV.A.
130. See S. 578, § 208(c).
131. Id. § 208(d)(3).
132. See Loewenberg, supra note 20, at 4. The Common Rule also applies to research geared toward winning product approval from the Food and Drug Administration. See id.
133. Id.
134. See id.
135. See Medical Information Privacy and Security Act, S. 573, 106th Cong. (1999).
136. See S. 573, § 201(a)(1) (stating that health care entities are forbidden from "disclos[ing] or us[ing] protected health information except as authorized under this Act").
137. See Haramboure, supra note 12.
138. S. 573, § 101(a)(1).
139. See id. § 101(a)(2). However, the bill further states, "Such fees may not be assessed where such an assessment would have the effect of inhibiting an individual from gaining access to the information." Id. For a discussion of the individual's private right of action, see infra part IV.B.
140. See id. § 323 (a)(2), (b).
141. See id. § 202 (c)(1);
142. see also Haramboure, supra note 12.
143. See Loewenberg, supra note 20, at 4.
144. See S. 573, § 103(b)(1)(A)-(B).
145. See id. § 401(a). For a discussion of federal preemption, see infra Part IV.A.
146. See Medical Information Protection Act of 1999, S. 881, 106th Cong. (1999).
147. See id. § 202(a)(1);
148. see also Delegates Firm up Privacy Policy, supra note 36, at 30. For a discussion of Senator Jeffords' bill, see supra Part III.B.
149. See S. 881, § 101(a)(1).
150. Id. § 101(a)(4).
151. Delegates Firm up Privacy Policy, supra note 36, at 30.
152. See S. 881, § 401(a). For a discussion of federal preemption, see infra Part IV.A.
153. See State Laws Show Mixed Results on Privacy, supra note 32, at 6.
154. See Delegates Firm up Privacy Policy, supra note 36, at 30 ("[T]echnology and efficiency must come second to the patient's best interest, to the patient's right to make a decision, to the patient's right to informed consent.").
155. S. 881, § 208(a)(1).
156. See Medical Information Protection and Research Enhancement Act of 1999, H.R. 2470, 106th Cong. (1999).
157. See Review Boards Provide Confidentiality Safeguard in Rep. Greenwood's Bill, THE BLUE SHEET, July 21, 1999, available in 1999 WL 10783896. For a discussion of Senator Bennett's bill, see supra Part III.D.
158. See Review Boards Provide Confidentiality Safeguard in Rep. Greenwood's Bill, supra note 139; see also H.R. 2470, § 208(a)(1) (noting that health care entities may disclose protected health care information "to a health researcher if the research project has been approved by an IRB pursuant to the requirements of the Common Rule, as implemented by a Federal agency").
159. See Loewenberg, supra note 20, at 4. The Common Rule "governs safety and privacy issues in research that is performed either with government funds or with the purpose of winning Food and Drug Administration approval for a product." Id.
160. Review Boards Provide Confidentiality Safeguard in Rep. Greenwood's Bill, supra note 139.
161. See Loewenberg, supra note 20, at 4-5. R. Alta Charo, a member of the National Bioethics Advisory Committee, describes the current dilemma: "We don't know how much research is going on, how many people are involved, whether there have been any adverse effects on these people, and whether steps are being taken to correct these adverse effects." Id. at 4.
162. See Review Boards Provide Confidentiality Safeguard in Rep. Greenwood's Bill, supra note 139. Representative Edward Markey (D-MA), who co-sponsored Representative Gary A. Condit's (D-CA) privacy bill, Health Information Privacy Act, H.R. 1941, 106th Cong. (1999), claims that Representative Greenwood's bill "has the endorsement of industry and industry alone." Id. For a discussion of Representative Condit's bill, see infra Part III.F.
163. See H.R. 2470, § 401 (a). For a discussion of federal preemption, see infra Part IV.A.
164. See H.R. 2470, § 401 (a).
165. See Review Boards Provide Confidentiality Safeguard in Rep. Greenwood's Bill, supra note 139. For a discussion of Senator Bennett's bill, see supra Part III.D.
166. See Health Information Privacy Act, H.R. 1941, 106th Cong. (1999).
167. See Democrats' Consensus - Medical Privacy Bill Allows HHS Greater Discretion, THE BLUE SHEET, June 2, 1999, available in 1999 WL 10783796.
168. See H.R. 1941, § 203(a) (emphasis added).
169. See id. § 202(a) (emphasis added).
170. See Democrats' Consensus - Medical Privacy Bill Allows HHS Greater Discretion, supra note 149.
171. See id.
172. See. e.g., Medical Information Privacy and Security Act, H.R. 1057, 106th Cong. (1999) (sponsored by Rep. Edward Markey (D-MA)).
173. See id. § 111(c).
174. H.R. 1941, § 103(a) (emphasis added).
175. See id. § 102(c) (noting that "[n]othing in this Act shall be construed as requiring disclosure of protected health information that is not otherwise required to be disclosed by law"). For a discussion of Senator Leahy's bill, see supra Part III.C.
176. See Haramboure, supra note 12.
177. See id.
178. H.R. 1941, § 104(c) (emphasis added).
179. See id. § 405(a)(1).
180. See id. § 405(a)(2).
181. See id. § 405(c); see also Jaffee v. Redmond, 518 U.S. 1 (1996).
182. See Personal Medical Information Protection Act of 1999, H.R. 2404, 106th Cong. (1999).
183. See, e.g., id. § 208(c).
184. See id. § 208(d)(1).
185. See id. § 314(a). Section 314(b) specifies mediation, arbitration and early offers of settlement as the methods of alternative dispute resolution.
186. Id. § 103(b).
187. See H.R. 2404, § 203(f).
188. Id. § 3H(a)(1)-(3). Section 312 describes the "Procedures for Imposition of Penalties."
189. Id. § 208(d)(1).
190. Id. § 111(b).
191. See id. § 211(a)-(b).
192. See id. § 212.
193. See H.R. 2404, § 401 (a). For a discussion of federal preemption, see infra Part IV.A.
194. See H.R. 2404, § 101(a)(1).
195. See id. § 101(a)(2).
196. See Delegates Firm up Privacy Policy, supra note 36, at 1.
197. Id.
198. See id. at 30.
199. See id.
200. See id. ("Of the 3,000 to 5,000 IRBs, approximately 1,200 are under public oversight and subject to the Common Rule.").
201. See id.
202. See id.
203. Id.
204. See id.
205. See id. at 30.
206. See id.
207. See State Laws Show Mixed Results on Privacy, supra note 32, at 6.
208. See id.
209. See id.
210. See id.
211. See id.
212. See S. 578; S. 573; S.881 (all supporting a patient's right to view and correct his/her medical records).
213. See State Laws Show Mixed Results on Privacy, supra note 32, at 5 ("For example, 33 states allow patients to access their hospital records, but only 13 give people the same right regarding their HMO records."); see also Nation's Papers Calling for New Law, supra note 25 (noting that "patient access to their records is denied in 28 states and only 34 have protection laws").
214. See State Laws Show Mixed Results on Privacy, supra note 32, at 5. Proposed bills such as H.R. 2404 would establish civil monetary penalties when law enforcement agencies, health care organizations, employers, health researchers and health care providers use patient data without first obtaining written authorization from the patient. See H.R. 2404, § 311.
215. See State Laws Show Mixed Results on Privacy, supra note 32, at 6.
216. See id.
217. See Rebecca L. Jackson et al., Federal Legislation to Protect Patient Confidentiality Not Expected Before Fall, MET. CORP. COUNSEL, Aug. 1999, available in WL 08/99 METOC 15, (col. 1).
218. See id.; see also R.I. GEN. LAWS ANN. § 23-17.5-14 (1999). "The patient's right to privacy and confidentiality shall extend to all records pertaining to the patient . . . the right to privacy and confidentiality relates to the public dissemination of specific information contained within patient records and to the identification of specific individuals . . . ." R.I. GEN. LAWS ANN. § 23-17.5-14(a)-(b) (1999).
219. See Jackson et al., supra note 199; see also MASS. GEN. LAWS ANN. ch. 111, § 70E(b) (West 2000). "Every patient or resident of a facility shall have the right to confidentiality of all records and communications to the extent provided by law." MASS. GEN. LAWS ANN. ch. 111, § 70E(b) (West 2000).
220. See Jackson et al., supra note 199; see also VA. CODE ANN. § 32.1-127.1:03 (Michie 2000).
221. See Jackson et al., supra note 199. "There is hereby recognized a patient's right of privacy in the content of a patient's medical record. . . . No person . . . shall redisclose or otherwise reveal the records of a patient, beyond the purpose for which such disclosure was made, without first obtaining the patient's specific consent to such redisclosure." VA. CODE ANN. § 32.1-127.1:03(A) (Michie 2000).
222. See N.H. REV. STAT. ANN. § 151:21 (1999). A patient's medical record includes "all information contained in the patient's personal and clinical record, including that stored in an automatic data bank." N.H. REV. STAT. ANN. § 151:21 (1999). For a "reasonable cost," a patient may copy his or her records. Id.
223. CONN. GEN. STAT. ANN. § 19a-550(b)(9) (West 2000).
224. Jackson et al., supra note 199.
225. See Pear, supra note 46, at A1.
226. See HHS to Move Slowly on Privacy Regs: Congress Could Act by December, THE PINK SHEET, Aug. 16, 1999, available in 1999 WL 8676662.
227. See State Laws Show Mixed Results on Privacy, supra note 32, at 6.
228. See id.
229. See id.
230. See id. (noting that Dr. Richard Levinson, Associate Executive Director of Programs and Policy at the American Public Health Association, believes privacy advocates should not rely on state laws to provide patients with privacy protection). Dr. Levinson has stated that "the country needs one national law that is strong enough to give patients the confidence to get tested and doctors the assurance they can pass information on to the public health community." Id.
231. See id.
232. See id.
233. See id. (noting that uniform national legislation could "fill in gaps" in state laws without weakening stronger state privacy laws).
234. See Nation's Papers Calling for New Law, supra note 25 (quoting a Baltimore Sun editorial from November 8, 1999 that states, "Clinton's proposed rules leave Americans with only partial protection. Further protections, in a new law, are required").
235. See Pear, supra note 46, at A1.
236. See Jackson et al., supra note 199 (noting that disagreement over an individual's private right of action has caused "repeated snags" during deliberations within the Senate Health, Education, Labor and Pensions Committee).
237. See id.
238. See id.
239. See S. 573, § 208(a). Furthermore, such provisions are not designed to "limit or restrict the ability of law enforcement authorities to gain information while in hot pursuit of a suspect or if other exigent circumstances exist." Id. § 208(i).
240. Id. §§ 202(c)(3), 204.
241. See id. § 204(b)(1)-(3).
242. Id.
243. See id. § 323(b).
244. See S. 578, § 215.
245. Id.
246. Id. § 202(C)(4).
247. See id. § 314(a)-(b).
248. See Gardner, supra note 9, at 6.
249. See id.
250. See id.
251. See id.
252. See id. (noting that insurance companies, health care providers and employers oppose a private right of action); see also 'Sweeping' Regulations Cause Much Debate, supra note 27 (quoting Senator Jeffords' pledge to draft legislation that would "give patients and their health records the true privacy protection they deserve").
253. See David M. Studdert et al., Expanded Managed Care Liability: What Impact on Employer Coverage?, HEALTH AFF., Nov.-Dec. 1999, at 8, 24 (concluding that "the direct costs of liability are uncertain but . . . the prospect of litigation may have other important effects on coverage decision making, information exchange, risk contracting, and the extent of employers' involvement in health coverage").
254. See id. at 9.
255. 481 U.S. 41 (1987).
256. See id. at 47-48.
257. See Studdert et al., supra note 235, at 9-10.
258. See Geoffrey E. Harris et al., Managed Care At a Crossroads: A Wall Street View of Managed Care's Mistakes and Misfortunes, and a Prognosis for Survival in an Increasingly Hostile Environment, HEALTH AFF , Jan.-Feb. 2000, at 157, 161 (claiming that the threat of litigation will erode the managed care industry's ability to contain costs).
259. Id. at 161.
260. See id. at 157 (noting that "managed care has increased access to the health care delivery system by expanding coverage for pharmaceuticals, alternative medicine, preventive care services such as health screening, and primary care services").
261. See Studdert et al., supra note 235, at 13 (noting that even when the managed care industry learns of recent litigation outcomes, they "show a propensity to respond inefficiently and overreact to the small possibility of having to pay large penalties for certain behavior").
262. See id. Since non-ERISA employee benefit plans, such as governmental and church plans, are not shielded from state tort claims, researchers decided to study the litigation costs incurred by non-ERISA employee benefit plans and approximate what comparable litigation would cost in the ERISA sector. Coopers & Lybrand commissioned a study of two groups of state government employees and one group of local government employees. They discovered that if ERISA employees sued at a similar rate as the non-ERISA employees, the litigation costs would be approximately between three and thirteen cents per enrollee per month. See id. at 14-15.
263. See id. at 17. However, alternative dispute resolution appears to be a double-edged sword for the managed care industry. Although it may reduce litigation expense, it may increase an injured individual's access to monetary compensation. See id.
264. See id. at 8.
265. See State Laws Show Mixed Results on Privacy, supra note 32, at 6.
266. See Health Insurance Portability and Accountability Act of 1996, supra note 6.
267. 'Sweeping' Regulations Cause Much Debate, supra note 27.
268. H.R. 1941, § 203(a).
269. See H.R. 2470, § 101(a)(4).
270. See S. 573, § 101(a)(2).
271. See Jones et al., supra note 48, at 31 (noting that "physically handicapped employees are widely perceived to be more desirable than psychiatrically handicapped employees"). When Fortune 500 respondents were asked to rank the following in terms of their desirability as employees: psychiatrically handicapped, physically handicapped, mentally retarded, ex-offenders, and alcohol/drug problems, the physically handicapped were ranked as the most desirable. The ranking of the psychiatrically handicapped had a response pattern very similar to the ranking of the mentally retarded. Employees with alcohol/drug problems were rated the least desirable. See id. The National Institute of Mental Health relates a story, albeit with names and details changed, chronicling the stigma the psychiatrically impaired face when seeking employment. Six months after she was hired, Nicki Selden revealed to her boss that she had been a mental patient. Since Selden was taking medication that occasionally caused her to feel sick and miss work, she believed she should share this information with her boss. Four days later, Selden was fired. See NATIONAL INSTITUTE OF MENTAL HEALTH, THE FOURTEEN WORST MYTHS ABOUT RECOVERED MENTAL PATIENTS (1988).
272. H.R. 1941, § 104(c) (emphasis added).
273. See id. § 405(a)(1).
274. See S. 578, § 402.
275. Id. § 215.