HIPAA Regulations Take Effect But the Battle Is Far From Over

The Privacy Debate: HIPAA Regulations Take Effect But the Battle Is Far From Over

Texas Medicine Logo

Legislative Affairs Feature -- June 2001

By  Ken Ortolon
Associate Editor

The Bush administration's announcement on April 12 that it was letting the final medical privacy regulations developed by the Clinton administration under the Health Insurance Portability and Accountability Act (HIPAA) take effect without changes caught many in the health care industry by surprise.

After all, only a week before, the Bush administration had called the rules "unworkable" and said they would impose unreasonable and costly burdens on physicians, hospitals, pharmacists, health plans, and others.

"It was a real turnaround," said Austin psychiatrist Deborah Peel, MD, immediate past president of the Texas Society of Psychiatric Physicians and a member of the American Psychoanalytic Association (APA). "All of the talk in the media was that they were going to delay and delay and rewrite the regulations."

But the fact that the regulations now are in effect does not mean the HIPAA debate is over. Physicians, other health care professionals, and health care entities impacted by the rules have two years to fully comply. And, efforts are already under way to extend the compliance date or make changes in the regulations, either through revisions to the rules or new legislation.

Putting on the brakes

The final HIPAA privacy regulations were issued less than a month before President Bill Clinton left office. They were among a large group of last-minute Clinton regulations that were suspended by an executive order President George W. Bush signed just minutes after he took office on Jan. 20.

"Clinton had issued quite a few rules in the last few days of his presidency," said Lee Spangler, JD, assistant general counsel for the Texas Medical Association. "The new administration came in and decided that some of those regulations might be suspect politically or just a little rushed. President Bush instructed Chief of Staff Andrew Card to put out a memorandum to all federal agencies directing them to review all regulations that had been issued in the last few weeks of Clinton's presidency and that had not yet gone into effect to make sure they were appropriate."

That directive imposed a moratorium to prevent any new Clinton administration rules from being printed in the Federal Register , ordered all agency heads to withdraw any proposed regulations already sent to the Federal Register for publication, and put a 60-day delay on any regulations already printed in the Register .

The Clinton privacy regulations were the culmination of more than four years of work on medical privacy in Washington. Under HIPAA, which passed in 1996, Congress gave itself a deadline to pass privacy laws and directed that if it failed to meet that deadline, the U.S. Department of Health and Human Services (HHS) would promulgate rules on privacy. Not surprisingly, Congress failed to meet its own deadline and HHS took up the challenge.

But the preliminary rules that were published for comment in 1999 and the final regulations released in December 2000 were controversial. Health plans complained they would be costly to implement and would interfere with their ability to process claims, conduct utilization review, and carry out other activities. Pharmaceutical manufacturers said the cost and complexity of complying with the rules would discourage hospitals and other health care professionals from participating in clinical trials and other research, thereby hurting their ability to measure the safety and effectiveness of their products.

Even staunch proponents of patient privacy were not universally pleased with the regulations. The American Medical Association said it agreed "in principle" with the rules but expressed multiple concerns about them. So did TMA and others.

In a letter about the preliminary rules of 1999 to then-HHS Secretary Donna Shalala on Feb. 17, 2000, TMA said they would be overly burdensome on solo practitioners and small group practices. TMA also argued that the patient privacy protections did not apply to employers, workers' compensation carriers, life insurers, schools, and others who might gain access to medical records.

The turnaround

Despite problems with the regulations, several groups -- particularly psychoanalysts, other physicians, and consumer organizations -- urged that the rules be put into effect and that problems be fixed later.

In a March 30 letter to new HHS Secretary Tommy Thompson, then-TMA President Jim Rohack, MD, continued to express concerns that the rules were more burdensome on physicians and others who were longtime advocates of patient privacy than they were on employers, third-party payers, and government entities that were more likely to abuse patients' privacy. Still, he urged the Bush administration to go forward with the rules.

"TMA appreciates the dilemma faced by HHS in balancing the urgent need to protect privacy with the need to ensure that physicians' offices and other entities that have information-stewardship responsibilities are not inappropriately burdened from an operational and administrative standpoint," Dr. Rohack wrote. "However, we urge that you not unnecessarily suspend or delay these rules, as meaningful compliance will depend on everyone's ability to clearly interpret and anticipate the final product."

Still, privacy proponents felt it likely that the Bush administration would gut the rules and leave patients with little or nothing in the way of privacy protections.

Dr. Peel says it seemed obvious during a March 12 meeting between psychoanalysts and Sally Canfield, counselor to HHS Secretary Thompson, that the administration had no intent to implement the rules anytime in the near future.

"We could see that the clear plan was that the regulations would never see the light of day," Dr. Peel said. "Three or four times during the conversation, we asked her when they planned to implement the regulations. Her response was, 'We have no clue.' She used the words 'no clue' multiple times during the conversation."

Dr. Peel says that is when psychoanalysts decided the regulations might never be implemented without legal action. Following that meeting, APA began developing a lawsuit that sought to force implementation of the HIPAA regulations on the grounds the government was violating provisions requiring HHS to implement regulations by February 2000.

Dr. Peel says the American Civil Liberties Union, Consumers Union, and the National Coalition of Mental Health Professionals and Consumers came on board in support of that suit.

The lawsuit never was actually filed, but some observers say the mere threat may have been enough to get the Bush administration to do an about-face on the regulations.

"There's speculation that that was the gun put to their head that inspired them to move on," said Kim Ross, TMA vice president for public policy. "There's no way of knowing that one way or another. But our assessment of the prospective litigation is that it was viable because the way HIPAA rolled out did not leave a great deal of discretion in the implementation phase to the executive branch."

Moving forward

Dr. Peel says psychoanalysts are ecstatic that the regulations finally have been put into effect, even though they are not perfect and will not be fully implemented for at least two years.

"For the first time ever, the private communications that take place in psychotherapy and mental health visits are going to be protected from release and scrutiny," she said. "These records will no longer ever have to be released for treatment, payment, insurability, or so forth.

"We felt that without protections for the most sensitive psychotherapy communications there would be no mental health treatment left in the country because people can't talk when their most private thoughts aren't safe," she added. "We've argued all along that managed care and health care systems have no need to know the intimate details of anyone's mental health treatment."

Still, she recognizes that the HIPAA regulations will require modification as they are implemented. One case in point is the lack of prohibitions against using confidential patient information for marketing purposes. That, Dr. Peel says, was a major victory for pharmacy benefits managers.

"There are some major flaws in the regulations," she said. "The marketing provisions are terrible. Law enforcement has almost unfettered access -- so does public health -- without permission or notification. So there are some bad problems with the rules."

It seems no one is completely happy with the rules. Some are not happy at all. Sources close to the issue say health plans already are preparing to go to Congress seeking legislation to delay the compliance date. Pharmaceutical manufacturers also likely will continue to pursue their efforts to ease restrictions on hospitals and health care professionals who supply them with information that helps measure safety and effectiveness of new drugs.

Despite allowing the rules to take effect, the Bush administration has made it clear that it intends to continue evaluating them and likely will seek changes.

Physicians also continue to press their concerns.

"At a minimum, physicians need the full two-year compliance period to modify their practices in order to comply with the rule," said AMA Trustee Donald J. Palmisano, MD.

Dr. Palmisano also noted that "with further improvement, the final rule can be a starting point for basic privacy protections for all patients. Meanwhile, Congress needs to continue to pass legislation to extend privacy requirements to all entities that handle patient information, including employers, marketers, life insurers, and others."

Shifting the focus

Regardless of what changes ultimately are made to the regulations, physicians say a major loophole regarding the use of confidential patient information for marketing purposes must be addressed. That task likely will fall to the state legislatures across the country.

Dr. Peel says it is important that the federal rules provide a "floor" for privacy legislation but do not prevent states from providing more stringent regulations if they so choose.

Mr. Ross also says the arena now has shifted to the state legislatures.

"Because of the compliance date, these HIPAA regulations have a two-year fuse," Mr. Ross said. "So, regardless of the final end product, there is still a loophole that allows the marketing of personal health information. That makes it incumbent upon the state legislatures to close that loophole or at least define under what conditions, if any, a patient's personal health information can be exploited for commercial purposes."

The Texas Legislature already has attempted to address that issue this year. Senate Bill 11, authored by Sen. Jane Nelson (R-Flower Mound), would substantially close the marketing loophole left in the HIPAA regulations.

TMA was a staunch supporter of SB 11, which as of late April had passed the Texas Senate and was pending in a House committee. Senator Nelson says she drafted the bill because of troubling stories she heard from her constituents about how their medical information was being used.

"Unfortunately, the reality is that medical privacy does not truly exist anymore because so many hands are involved in the delivery of health care today," she said. "We need to restore some order to the handling of our medical information because the release of such data can bring harm or embarrassment to individuals, not to mention prevent patients from seeking the health care they need."

Senator Nelson says she realizes there are costs associated with complying with HIPAA or other privacy laws. "But in no way is it unreasonable to ask that our most sensitive medical information be handled with care and that lists of patients not be blasted into cyberspace as a potential client base," she said. "We are not talking about the list of people who receive the Sears Christmas catalog every year. This is highly sensitive information, and it should be treated as such."

For more information and to read the rules, log on to the TMA Web site .

Ken Ortolon can be reached at (800) 880-1300, ext. 1392, or (512) 370-1392; or by e-mail at ken.ortolon@texmed.org.

June 2001 Texas Medicine Contents
Texas Medicine Back Issues


Comment on this (Must be logged in to comment)

Add Comment

Text Only 2000 character limit

Looking for more?