Protecting Americans'
Medical Privacy: Why Congress Must Act or Be Acted
Upon
Did you know that if Congress does not pass a medical
privacy law by next year, the Secretary of Health and
Human Services (HHS) will establish regulations governing
your medical records within the following six months?
This deadline was imposed by the Health Insurance
Portability and Accountability Act of 1996 (HIPAA),
also known as the Kennedy-Kassebaum health insurance
reform. The law puts pressure on Congress to act, or
be acted upon, to protect the confidentiality of Americans'
medical records. Specifically, if Congress does not
act by August 21, 1999, HIPAA requires the HHS Secretary
to issue regulations, which must be finalized by February
21, 2000.
Who's Reading Your Medical Records?
Hundreds of individuals and organizations have access
to your medical records now, whether you know it or not.
The Congressional Research Service reports that according
to one 1996 estimate, during the course of a hospital
stay, as many as 400 people may see at least part of a
patient's medical record. Records are accessed every day
to help researchers examine the outcomes of medical procedures,
assist actuaries in determining the price of health insurance,
and provide lawyers with information for medical malpractice
cases.
Medical information is also commonly bought and sold.
The National Research Council (NRC) estimates that the
health care industry spent between $10 billion to $15
billion on health care information technology in 1996.
The NRC reports that people and entities likely to gain
access to medical records include:
- health insurance companies
- life insurance companies
- self-insured employers
- employers' clinics and wellness programs
- state bureaus of vital statistics
- the Medical Information Bureau
- lawyers in malpractice cases
- consulting physicians
- managed care organizations
- clinical laboratories
- pharmacies and their benefits managers
- hospital-accrediting organizations
- health care researchers
- law enforcement agencies
Should Congress Override State Privacy Laws?
Today a patchwork of state laws protects patients' medical
records. A 1997 survey prepared by Lawrence Gostin, professor
of law at Georgetown University, and his colleagues [http://www.epic.org/privacy/medical/cdc_survey.html]
found that:
- 37 states require physicians to maintain the confidentiality
of medical records;
- 26 states extend this duty to other health care
providers;
- 33 states and territories require health care institutions
to maintain the confidentiality of medical records
they hold; and
- 4 states have specific legislation requiring insurers
to maintain the confidentiality of medical records
However, if recent activity is any indication, Congress
is likely to try to override these laws. The Republican's
Patient Protection Act (H.R. 4250), which passed the
House but was never enacted into law, would have done
just that. The act would have permitted the collection,
exchange, and distribution of personal medical information.
True, its use would have been limited to health care
providers and administrators engaged in "health care
operations," but that vague term includes everything
from monitoring people's health to auditing health insurance
records.
Whether or not Congress will act, or be acted upon,
to protect your medical privacy remains uncertain. But
one thing is certain: Your medical records are currently
available to many individuals and organizations. These
private and government entities have strong financial
interests in maintaining access to your medical records.
If you care about your medical privacy, be sure to
voice your opinion well before August 21, 1999. Watch
your medical privacy, or the federal government will
do it for you!
This article was originally published in the November/December
1998 issue of Health Freedom Watch.
|
|
|
Hundreds of individuals and organizations have access
to your medical records now, whether you know it
or not. The Congressional Research Service reports
that according to one 1996 estimate, during the
course of a hospital stay, as many as 400 people
may see at least part of a patient's medical record.
|
|
