Health Privacy Rules To Be Issued

Wednesday, December 20th 2000, 12:00 am

By: News On 6

WASHINGTON (AP) â€” President Clinton is issuing sweeping new privacy protections that for the first time will sharply limit doctors, hospitals and insurance companies from sharing confidential medical information about their patients.

Until now, there's been no federal law protecting medical privacy, even as technology allows personal information to bounce swiftly from one computer to the next. Nearly a decade in the making, the new rules were intensely debated as privacy advocates sought broad protections and industry officials looked for greater flexibility.

Under the rules, patients could sign a one-time consent form on their first visit to a doctor allowing disclosures for routine matters like billing and treatment. But they would have to explicitly authorize most other uses of their records, said administration officials and others who have been briefed on the rules.

Patients also are gaining the right to inspect and request corrections to their records. And employers will be barred from perusing medical information about their workers unless it's directly related to providing health care.

``This will touch nearly every aspect of health care,'' said Janlori Goldman, who directs the Health Privacy Project at Georgetown University. ``We have tried for years and years to get these protections, and we have been unsuccessful until now. This is just a huge victory.''

Under the rules, which take effect in two years, violators face civil and criminal fines and, in severe cases, prison.

Until now, patients have had to rely on state laws, which range from comprehensive to nonexistent.

The new federal rules cover both electronic and paper records, as well as oral communications â€” a major change won by privacy advocates. As originally proposed last year, the rules would have affected only electronic records.

And, in a change won by industry, the administration deleted a provision that could have opened the door for patients to sue if their records were improperly released.

The administration would have liked to include an explicit new right to lawsuits, but did have the legislative authority to do so.

Law enforcement agencies could obtain access to records with an administrative subpoena or summons, but they would not have to go to court as advocates would have liked.

The ACLU worries that it will be too easy for the police to get their hands on private records, said Ronald Weich, legislative consultant to the civil liberties group. But overall, he said, ``we think it's a significant step forward.''

The administration revised its initial regulation after receiving some 52,000 comments from the public, an overwhelming number that highlights the intense interest in the matter.

President-elect Bush could undo the rules with a new regulation, but starting over would be a tremendous task. Likewise, Congress could overturn them, but lawmakers would be unlikely to agree on specific changes.

The health industry supports the notion of improved medical privacy, but worries because the rule allows states to write even stricter standards.

``Without uniformity, the regulations are going to cause more, not less, confusion,'' Chip Kahn, president of the Health Insurance Association of America, complained Tuesday.

And industry officials argued that requiring consent might prevent doctors and insurers from trading information needed to ensure quality health care.

``The problem is when the person refuses to give consent,'' said Kristin Stewart, who has been tracking this issue for the American Association of Health Plans.

In 1996, Congress gave the Department of Health and Human Services the power to issue privacy regulations if it failed to enact legislation within three years. Negotiators in the Senate came close but couldn't close the deal.

``Congress dropped the ball,'' said Sen. Patrick Leahy, D-Vt., a leader in the failed effort. ``The administration has done much of what Congress should have done.''

Administration officials estimate that the rules will cost the health care industry and employers about $17.6 billion over 10 years, but that would be offset by an estimated $30 billion in savings from companion rules that eliminate paperwork and allow for electronic filing of insurance claims.

The new regulation also:

â€”Requires health providers and insurance companies to rewrite contracts with business partners, including attorneys, auditors and consultants, to ensure they adhere to the privacy rules. But if the outside businesses violate the rules, there are no federal sanctions.

â€”Holds health care providers responsible for the partners' violations only if they knew about them. The original proposal held them accountable if they should have known.

â€”Provides for a range of punishments.

Violators who unintentionally disclose information would face civil fines of $100 per violation, up to a total of $25,000 per year.

Those who intentionally disclose information face criminal sanctions of up to $50,000 and up to a year in prison. And intent to sell the information is punishable by up to $250,000 and 10 years in prison.