The HIPAA paradox: The privacy rule that's not

Hastings Center Report

Volumn 37, Issue 4, 2007, Pages 40-50

  Sobel, Richard ^a  

^a NONE

Author keywords

[No Author keywords available]

Indexed keywords

ARTICLE; HEALTH INSURANCE; HUMAN; INTERPERSONAL COMMUNICATION; LEGAL ASPECT; MEDICAL ETHICS; PRIVACY; UNITED STATES;

DISCLOSURE; ETHICS, MEDICAL; HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT; HUMANS; PRIVACY; UNITED STATES;

EID: 34547966504     PISSN: 00930334     EISSN: None     Source Type: Journal    
DOI: 10.1353/hcr.2007.0062     Document Type: Review

References (70)

1. The Health Insurance Portability and Accountability Act (Public Law 104-191) sets out standards for the portability of health insurance. Administrative simplification, Section 164, includes the requirements for standards on medical information - the so-called privacy rule.
2. See P. Appelbaum et al., "False Hopes and Best Data: Consent to Research and the Therapeutic Misconception," Hastings Center Report 27', no. 2 (1987): 20-24. The HIPAA misconception may be "therapeutic" in the sense that patients and providers mistakenly think HIPAA provides for privacy as part of the doctor-patient relationship.
3. R. Sobel, "No Privacy for All? Serious Failings in the HHS Medical Records Regulations," Journal of Biolaw and Business 5, no. 2 (2002): 45-48;
4. R. Sobel, "Maintaining Informed Consent for Doctor-Patient Confidentiality: More Serious Failings in the HHS Medical Records Regulations," Journal of Biolaw and Business 6, no. 2 (2003): 61-65;
5. Citizens for Health et al. v. Leavitt, 3rd Circuit, 428 F.3rd 167, October 31, 2005.
6. Public Law 104-191, known as the "Kennedy-Kassebaum" Bill. U.S. Department of Health and Human Services, "Standards for Individually Identifiable Health Information," 45 CFR 160-164, April 14, 2001; October 15, 2002.
7. 64 Federal Register 53,211, August 14, 2002, sec. 164.506a.
8. While patients may request the right to consent before the use or disclosure of their medical information (45 CFR, para. 164.552[a]), institutions do not have to agree to give the patient the opportunity to consent, and many have blanket policies refusing to do so, or refusing treatment unless the patient consents. The original final rule that included a consent provision was approved in 2000, but was amended in August 2002 to drop the consent requirement.
9. Sec. 164.501, 506. The American Medical Association has long argued against using the broad definition of health care operations. See G. Aston, "Pushed by a Looming Legislative Deadline, AMA Delegates Adopted New Policy on Patient Confidentiality Issues Tied to Participation in Medical Research," American Medical News, July 12, 1999.
10. The definition of marketing, which requires written patient authorization (equivalent to traditional consent), was narrowed to exclude forms of promotion such as third-party solicitations and "face-to-face communication," which therefore no longer require authorization. "Contacting of health care providers and patients with information about treatment alternatives" is also considered to be part of health care operations, and therefore does not require authorization. Some educational communications during health encounters, which could be considered marketing and hence require authorization, are defined instead as part of treatment. Fundraising under health care operations may use demographic information and dates of health care without patient consent (but with an opt-out provision afterwards) for outside organizations raising money for "the benefit of the covered entity" (164.501).
11. HIPAA creates rules for confidentiality (limitations of the range of records sharing), not privacy (patients' control of information).
12. For a discussion of the essential nature of confidentiality and consent for quality medical care, see the amicus briefs in Citizens and Althaus v. Cohen of the Program in Psychiatry and the Law at Harvard Medical School, www.pipatl.org/amicus.php.
13. M. Doscher, HIPAA: A Short and Long Term Perspective on Health Care (Chicago, Ill.: American Medical Association Press, 2002), 90.
14. "Eyes on Your Records," Consumer Reports, March 2005, http://www.consumerreports.org/cro/health-fitness/healthcare/ electronic-medical-records-306/eyes-on-your-record/index.htm;
15. see also "The New Threat to Your Medical Privacy," Consumer Reports, March 2006: 39 and 42. An anonymous reviewer of this paper indicated that HIPAA should not be held responsible for the violation of its provision. But by creating paths that permit misuse of information without audit trails, along with DHHS lack of enforcement and penalties, HIPAA itself arguably contributes to the likelihood that the information will be improperly used.
16. Ibid.
17. Galvin v. Stanford Hospitals and Clinics, California Superior Court Case No. 1-04-CV-024690, filed August 9, 2004.
18. See Motion for Summary Judgment to Plaintiffs Second Amended Complaint, August 3, 2005;
19. see also T. Francis, "Spread of Records Stirs Patient Fears Of Privacy Erosion," Wall Street Journal, December 26, 2006.
20. See also the Program in Psychiatry and the Law amicus brief, http://www.pipatl.org/amicus.php, for discussion of the conflict between HIPAA and the Nuremberg principle that "the voluntary consent of the human subject is absolutely essential." See Directive for Human Experimentation, Nuremburg Code, http://ohsr.od.
21. nih.gov/guidelines/nuremberg.html. Some find HIPAA constitutes an unconsented experiment about the effects on patient care of unconsented disclosure of confidential medical information (see H. Bursztajn and A. Brodsky, "Captive Patients, Captive Doctors: Clinical Dilemmas and Intervention in Caring for Patients in Managed Health Care," General Hospital Psychiatry 21 [1999]: 239-48). For pre-HIPAA practice concerning patient consent, see 65 CFR 82771. For further details, see note 22 below.
22. 45 CFR 164.520(b)(1)(ii)(C) requires incorporating more stringent state privacy protections into notices of privacy practices.
23. B.K. Herman and D. Peel, "HIPAA's Real Effect: The End of Medical Privacy. A New Dilemma for Physician Executives," The Physician Executive, January/February (2004): 37.
24. Olmstead v. United States, 277 U.S. 438, 469 (1928) (Brandeis, J., dissenting).
25. Doscher, HIPAA: A Short and long Term Perspective on Health Care, 78. See E. Redden, "Fuzzy Understandings of FERPA," June 14, 2007 at http://www.uh. edu/ednews/2007/insidehe/200706/20070614ferpa.html, on how confusion about the provisions of HIPAA and FERPA (Family Educational Rights and Privacy Act) protect privacy.
26. According to HIPAA Section 264c, the DHHS secretary "shall promulgate final regulations containing such standards" - namely, standards that set forth the privacy rights individuals should have with respect to their identifiable health information and the procedures for exercising them. The original final rule (December 28, 2000) included the following consent requirement: "(1) Except as provided . . . a covered health care provider must obtain the individual's consent . . . prior to using or disclosing protected health information to carry out treatment, payment, or health care operations." However, the similarly numbered section of the amended rule (October 15, 2002) changed this to, "The consent provisions in section 164.506 are replaced with a new provision at section 164.506(a) that provides regulatory permission for covered entities to use or disclose protected health information for treatment, payment, and health care operations."
27. The complaint in Citizens included twenty-five affidavits and hundreds of privacy notices issued on or after April 14, 2003, showing "that Citizens' sensitive health information was being disclosed by covered entities without notice or consent, and over their objections." Beginning April 14, 2003, under the amended rule, "virtually all covered entities switched from their practice of obtaining consent for 'routine' uses and disclosures to the unauthorized use and disclosure of health information as a result of regulatory permission in the Amended Rule." See affidavits of Deborah Peel and others; Joint Appendix to District Court Case, 238-40, 312-14, 1476-85.
28. 65 Federal Register 82,771. Prior to HIPAA, the DHHS estimated that "most non-hospital providers and virtually all hospitals follow this practice [of obtaining some consent for use and disclosure of individually identifiable health information]." The DHHS assumed "that 90% of the non-hospital providers and all hospitals currently obtain some consent." Yet "[w]e found among the plaintiffs in the Citizens suit that very few covered entities of any kind were obtaining consent for disclosures for treatment, payment, and health care operations after April 14, 2003. All [plaintiffs'] requests for a consent process (restrictions) were denied and large insurers like Kaiser Permanente were found to be denying all such requests." Personal communication from James Pyles, November 13, 2006. See also the affidavits cited in note 17.
29. Doscher, HIPAA: A Short and Long Term Perspective on Health Care, 12-13.
30. Although consent may at times be considered pro forma or granted under pressure if providers are required to seek it from patients, "coerced consent" is a contradiction in terms; it must be informed and voluntary to be meaningfully granted.
31. One patient who attempted to substitute a consent request on a HIPAA notice was denied treatment. T. Francis, "Setting the Records Straight," Wall Street Journal, October 21, 2006. Another wrote in an email response to the Francis article that "Every hospital and doctor I asked to 'not share my records' refused. One hospital agreed to protect the records only after I threatened to sue under Illinois Statutes after I learned that they had shared my record." Personal communication to T. Francis, October 23, 2006.
32. J. Slutsman et al., "Health Information, the HIPAA Rule, and Health Care: What Do Physicians Think?" Health Affairs 24, no. 3 (2005): 832-42.
33. Ibid., Exhibit 3, 838.
34. Ibid., 837.
35. Tarasoff v. Regents of the University of California (17 Cal. 3d 425 [1976]).
36. See also Lamb warnings in R. Barnum et al., "Patient Warnings in Court-Ordered Evaluations of Children and Families," Bulletin of the American Academy of Psychiatry and Law 15, no. 3 (1987): 283-300.
37. See also Sobel, "Maintaining Informed Consent."
38. Louis Harris & Associates, July 26, 1993, national telephone survey; Wirthlin Group, June 22, 1994, national telephone survey; Princeton Survey Research for the Genetics and Public Policy Research Center at Johns Hopkins University, October 15, 2002, national telephone survey.
39. California HealthCare Foundation, "Medical Privacy and Confidentiality Survey," 1999; http://www.chcf.org/topics/view.cfm?itemID= 12500. The July 26, 1993, Harris Survey for Equifax found that 25 percent of respondents or family members had "paid for a medical test, treatment or counseling rather than submit a bill or claim under a health plan or program." The 1999 and 2005 CHCF surveys found 5 percent of individuals had paid for a medical test because they did not want an employer or others to gain access to the medical information.
40. California HealthCare Foundation, "National Consumer Health Privacy Survey 2005," 2005, 19; http://www.chcf.org/topics/view.cfm?itemID=115694.
41. Comparisons of the 1999 and 2005 CHCF surveys found that the proportion trying to hide medical information rose from 15 to over 20 percent. The 1999 survey found 3 percent nationally had asked a doctor not to write down a medical problem in their record or had gone to another doctor to avoid telling their regular doctor about a health condition, and in 2005, both figures grew to 5 percent. The 1999 figure of 15 percent engaging in privacy protecting behavior was based on six questions; the 2005 figure on only four of them. Statistical extrapolations (available from the author) estimate a comparable figure for 2005 at 20 to 22 percent. In short, the proportion engaging in privacy protecting behavior rose by over one-third in six years. How much HIPAA's lack of privacy protections contributed to the rise can be estimated in a later study.
42. See D. Linowes, "Many Companies Fail to Protect Confidential Employee Data," University of Illinois Survey Research Lab, Fall 1995, http://www.epic.org/privacy/workplace/linowesPR.html. One-third of employers in the survey acknowledge using health information for employment decisions.
43. Francis, "Setting the Records Straight."
44. U.S. Government Accountability Office, "Health Information: First-Year Experiences under the Federal Privacy Rule," report to the chairman, Committee on Health, Education, Labor, and Pensions, U.S. Senate, GAO-04-965, September 3, 2004.
45. Horn v. New York Times, No. 20, 2003 NY LEXIS 221, Ct. App. February 25, 2003.
46. Harold Eist v. Maryland State Board of Physician Quality Assurance (Civil Case No. 240300, Cir. Ct. Montgomery County; No. 00329, Court of Special Appeals of Maryland) and 29 Brief of Amicus Curiae, including the Program in Psychiatry and the Law, October 20, 2006, in support of Eist's position. The estranged husband of a divorcing mother and children in therapy with Eist filed a complaint about the therapy with the Maryland Board, which demanded the family records.
47. Daniel S. Shrager, M.D., v. Magellan Behavioral Health, Highmark Blue Cross and Blue Shield and Green Spring Health Services, Allegheny County (Pa.) Common Pleas Court, Civil Division (C.D. PA, GD 00 - 015809). In deciding that a health plan wrongly terminated a psychiatrist who refused to turn over complete patient records as part of a quality improvement assessment, the court's affirmative answer reinforces the importance of the physician-patient relationship.
48. U.S. Government Accountability Office, "Health Information." The report explains, "Nearly two-thirds of the privacy complaints closed during the rule's first year of operation fell outside the scope or time frame of the rule. This included the 35.4 percent of closed privacy complaints that involved alleged actions by providers, health plans, or other entities that OCR [Office of Civil Rights] determined would not constitute violations of the regulation even if true. In other words, they concerned actions to which the patient might object, but that were not prohibited by the Privacy Rule" (p. 22, cf. Table 1).
49. R. Pear, "Ruling Limits Prosecution of People Who Violate Law on Privacy of Medical Records," New York Times, June 7, 2005.
50. R. Pyles, "Brave New World," The American Psychoanalyst 39, no. 3 (2005): 31-32, at 31.
51. T. Sloane, "It's Private When They Say So," Modern Healthcare, February 23, 2004, 22.
52. Department of Justice brief, "Opposition to Northwestern's Motion to Quash Subpoena," National Abortion Federation et al. v. Ashcroft, No. 04 C 0055 (N.D. III).
53. See Program in Psychiatry and the Law amicus brief to Supreme Court cert. petition in Citizens on the costs from the absence of confidentiality and consent, pp. 10-11.
54. In addition, misunderstanding of HIPAA, which permits public health disclosures, may reduce the reporting of infection diseases; M. Wolf and C.L. Bennett, "Local Perspective of the Impact of the HIPAA Privacy Rule on Research," Cancer 106, no. 2 (2006): 474-79.
55. Also, the requirement for authorizations for research may reduce research study participation; D. Armstrong, "Potential Impact of the HIPAA Privacy Rule on Data Collection in a Registry of Patients with Acute Coronary Syndrome," Archives of Internal Medicine 165 (2005): 1125-29.
56. J. Ascher, D. Body, and M. Leppert, "HIPAA Privacy: HIPAA Standards for Privacy of Individually Identifiable Health Information: An Introduction to the Consent Debate," Journal of Health Law 35, no. 3 (2002): 387;
57. for a similar point, see the Health Privacy Project, "Comments on Proposed Modification to Federal Standards for Privacy of Individually Identifiable Health Information," April 26, 2002, 1 ; http://www. healthprivacy.org/usr_doc/NPRM_HPPComments.pdf.
58. M. Clyne, "President to Push Medical Record Computerization," Baltimore Sun, January 6, 2006.
59. See comments of the Health Care Leadership Council at the meeting of the U.S. House Ways and Means Subcommittee on Health, March 29, 2003.
60. See information on the DHHS contract with Research Triangle Institute (RTI) to identify "barriers" to interoperability of electronic medical records; http://www.mahealthdata.org/forums/hispc/index.html.
61. Doscher, HIPAA: A Short and Long Term Perspective on Health Care, 79.
62. The DHHS noted (65 Federal Register 82,771) that "for providers that currently obtain written consent, there is only a nominal cost for changing the language on the document [to ask consent]. For this activity we assumed $0.05 cost per document for revising existing consent documents."
63. Doscher, HIPAA: A Short and Long Term Perspective on Health Care, 79. The additional health care and other expenses created when 20 percent of patients feel required to pursue privacy-protecting behavior likely exceed the cost of consent ($101 million) by a great deal. Research is needed to establish the magnitude of the costs.
64. I draw here upon the policy suggestions of colleagues at the Program in Psychiatry and the Law, particularly Michael Commons and Barry Roth.
65. Ferguson v. City of Charleston, 532 US 67, 78 (2001).
66. See also Gruenke v. Seip, 225 F.3rd 290 (34d Cir. 2000)
67. and Sterling v. Borough of Minersville, 232 F.3rd 190, (3rd Cir. 2000).
68. See the Program in Psychiatry and the Law amicus brief in Citizens, available at http://www.pipatl.org/amicus.php. The district (03-02267) and appeals courts (04-2550) ruled against the plaintiffs largely on state action grounds: private entities are denying the right to medical privacy, and courts cannot force private actors to respect constitutional protections. The plaintiffs instead maintain that granting private entities the "license" of regulatory permission to use patient medical records without their consent constituted governmental action, as did levying fines for offering consent but not seeking it or violating confidentiality. The Supreme Court (05-1311, 127 S. Ct. 43) denied the petition for a writ certiorari to review the case on October 3, 2006. The plaintiffs are considering further legislative and litigation strategies.
69. Concerned patients and providers can contact the U.S. Senate Committee on Health, Education, Labor and Pensions and the House Committee on Energy and Commerce to urge them to include privacy and consent provisions in S. 1418 and H.R. 4157.
70. See American Medical Association Ethical Force Program, "The Domain of Health Care Information Privacy: Protecting Identifiable Health Care Informational Privacy: A Consensus Report on Eight Content Areas for Performance Measure Development," December 2000; www.ama-ssn.org/ama/pub/category/ 7726.html. The Ethical Force Program states: "Whenever feasible, health information trustees should obtain valid informed consent from individuals for the collection, storage, or use of personally identifiable health information" (p. 15). See S. Lohr, "Doctors' Journal Says Computing Is No Panacea," New York Times, March 9, 2005. The AMA has, however, supported electronic medical record systems that underplay privacy and consent issues; see materials available at www.amaassn.org/ama/pub/category/16195.html.