SUDDENLY EVERYONE wants to be on record protecting the confidentiality of medical information. But what constitutes real protection in an era of ever quicker data-swapping among insurers, businesses and banks? The banking reform bill passed by the House last week poses this question starkly. While allowing mergers among financial institutions -- and the data-sharing such mergers make possible -- the bill does contain a medical privacy provision, authored by Rep. Greg Ganske, that restricts release of medical data. But critics say the Ganske language contains loopholes so big that it is worse than no protection at all. The matter now goes to conference.

Key to the debate is whether the Ganske version's exceptions -- including one that allows the release of confidential, identifiable medical data for "research" -- are unworkably broad and lack the definitions and safeguards that other advocates have been trying to develop. Those supporting stronger legislation, including Reps. Henry Waxman, Edward Markey and Gary Condit, argue for an array of safeguards not contained in the Ganske language.

The Markey-Waxman-Condit approach would avoid preempting stronger privacy protections in the states, would narrowly define "research" and also would tighten the protections against misuse of personal data by law enforcement agencies and against reuse of data by third parties that had obtained the data for one purpose then kept it for another. Finally, they seek to avoid the danger that individuals might be offered the chance to "opt out" -- to refuse to let their medical information be shared -- but only under conditions that in fact coerce them to release the data. For instance, an employer or hospital could refuse health coverage or withhold treatment unless a patient approved release of data.

Though Ganske proponents say they don't intend to allow any of these nefarious effects, the vagueness of the language masks the potential for widespread privacy violations. The conference committee would do better to wait for separate medical privacy legislation or else substitute stronger language along the lines urged by Reps. Markey, Waxman and Condit.