President Clinton today will unveil the first federal protections to safeguard the confidentiality of Americans' medical records, restricting the conditions under which doctors, hospitals and health plans can divulge patients' medical information without their consent.
Under broad new rules the administration has worked on for years, the federal government would ensure patients the right to peer into their own medical records, determine who else has looked at them and pursue criminal action against anyone who misuses their medical history.
Unless people give permission for other uses, the policy allows health care records to be shared primarily to help treat patients and pay their medical bills, and is designed to prevent the release of such sensitive information to marketing firms, financial institutions and an individual's employer. It also would permit the release of information for activities that promote the public's health and for a somewhat vague category allowing their disclosure if a health care organization deemed it necessary for "business operations."
The policy is emerging at a time when the proliferation of electronic records has allowed medical information to be used in ways that would have been unimaginable even a few years ago, provoking widespread public anxiety about the security of information that once remained a secret between patients and their personal doctors. Companies that manage pharmacy benefits, for example, routinely inspect what drugs patients take and call their doctors to recommend alternatives.
The rules that Clinton will put forth mark the first time the government has developed a concrete standard after a lengthy tug of war between the administration and Capitol Hill over how far the federal government should reach in reining in the use of medical records. Mindful of the promise and peril of the new era of medical information, Congress three years ago gave the administration the power to develop a policy, unless lawmakers passed a medical privacy law by August 1999. Congress missed its self-imposed deadline.
The protections the president will announce at a White House ceremony this morning come in the form of proposed regulations that will become law in February and will be enforced starting in 2002. The rules could be modified before becoming final, depending on the comments that pour in during the next two months, but they do not require congressional approval.
On Capitol Hill, lawmakers proved unable to thread their way between lobbyists for greater medical privacy, on the one hand, and much of the medical industry, on the other. The industry has argued that restricting the use of records would be counterproductive, raising health care costs while thwarting the research that will bring about effective new treatments. The approach the administration will lay out today largely, but not entirely, sides with the privacy advocates.
In remarks prepared for this morning's ceremony, Clinton calls the strategy "an unprecedented step toward putting Americans back in control of their own medical records."
But administration officials, speaking on background yesterday, emphasized that they were frustrated because the 1996 law, which cleared the way for the administration's regulation, contained several significant restrictions on how far it could go. As a result, Clinton aides said they would prefer that Congress adopt a privacy law to address the areas that these regulations cannot.
The 1996 law, for example, allows the administration to regulate only electronic records, even though the majority of medical information remains in paper form, for now. The rules can apply to health insurers and providers of health care, but not to pharmaceutical companies and a variety of outside business that help process medical claims. And while permitting civil and criminal penalties for confidentiality violations, the administration cannot give individuals the power to file their own lawsuits against those who breach their privacy.
At a time when a growing number of states have adopted their own medical privacy laws, the regulation is intended as a minimum national standard, overriding weaker state statutes but not interfering with states that have taken a more aggressive approach.
The new federal rules say that medical information should be released, whenever possible, without patients' names attached and only in the smallest amounts needed for a specific purpose. White House documents say, for example, that an employer who needs to process an insurance claim for a work-related injury should not be given a patient's entire health record.
Similarly, unless patients give permission, all health care researchers who want access to identifiable information will have to go through an approval process similar to one that exists for federally funded research. And in a reversal of the administration's stance two years ago, law enforcement officials who want access to records will have to get permission first from a judge or administrative hearing office.
For the first time, patients would get a guarantee--currently available only in certain parts of the country--that they could inspect their own medical records and demand that mistakes be corrected. Health plans and those who provide care will have to tell patients what their policy is for disclosing medical information and, if patients ask, will be required to give them a list of every organization that has gotten their medical information.