[House Hearing, 106 Congress]
[From the U.S. Government Publishing Office]
CONFIDENTIALITY OF HEALTH INFORMATION
=======================================================================
HEARING
before the
SUBCOMMITTEE ON HEALTH
of the
COMMITTEE ON WAYS AND MEANS
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTH CONGRESS
FIRST SESSION
__________
JULY 20, 1999
__________
Serial 106-29
__________
Printed for the use of the Committee on Ways and Means
U.S. GOVERNMENT PRINTING OFFICE
64-128 CC WASHINGTON : 2000
COMMITTEE ON WAYS AND MEANS
BILL ARCHER, Texas, Chairman
PHILIP M. CRANE, Illinois CHARLES B. RANGEL, New York
BILL THOMAS, California FORTNEY PETE STARK, California
E. CLAY SHAW, Jr., Florida ROBERT T. MATSUI, California
NANCY L. JOHNSON, Connecticut WILLIAM J. COYNE, Pennsylvania
AMO HOUGHTON, New York SANDER M. LEVIN, Michigan
WALLY HERGER, California BENJAMIN L. CARDIN, Maryland
JIM McCRERY, Louisiana JIM McDERMOTT, Washington
DAVE CAMP, Michigan GERALD D. KLECZKA, Wisconsin
JIM RAMSTAD, Minnesota JOHN LEWIS, Georgia
JIM NUSSLE, Iowa RICHARD E. NEAL, Massachusetts
SAM JOHNSON, Texas MICHAEL R. McNULTY, New York
JENNIFER DUNN, Washington WILLIAM J. JEFFERSON, Louisiana
MAC COLLINS, Georgia JOHN S. TANNER, Tennessee
ROB PORTMAN, Ohio XAVIER BECERRA, California
PHILIP S. ENGLISH, Pennsylvania KAREN L. THURMAN, Florida
WES WATKINS, Oklahoma LLOYD DOGGETT, Texas
J.D. HAYWORTH, Arizona
JERRY WELLER, Illinois
KENNY HULSHOF, Missouri
SCOTT McINNIS, Colorado
RON LEWIS, Kentucky
MARK FOLEY, Florida
A.L. Singleton, Chief of Staff
Janice Mays, Minority Chief Counsel
______
Subcommittee on Health
BILL THOMAS, California, Chairman
NANCY L. JOHNSON, Connecticut FORTNEY PETE STARK, California
JIM McCRERY, Louisiana GERALD D. KLECZKA, Wisconsin
PHILIP M. CRANE, Illinois JOHN LEWIS, Georgia
SAM JOHNSON, Texas JIM McDERMOTT, Washington
DAVE CAMP, Michigan KAREN L. THURMAN, Florida
JIM RAMSTAD, Minnesota
PHILIP S. ENGLISH, Pennsylvania
Pursuant to clause 2(e)(4) of Rule XI of the Rules of the House, public
hearing records of the Committee on Ways and Means are also published
in electronic form. The printed hearing record remains the official
version. Because electronic submissions are used to prepare both
printed and electronic versions of the hearing record, the process of
converting between various electronic formats may introduce
unintentional errors or omissions. Such occurrences are inherent in the
current publication process and should diminish as the process is
further refined.
C O N T E N T S
__________
Page
Advisories announcing the hearing................................ 2
WITNESSES
U.S. Department of Health and Human Services, Mike Hash, Deputy
Director, Health Care Financing Administration................. 11
U.S. Department of Health and Human Services. Hon. Margaret
Hamburg, M.D., Assistant Secretary for Planning and Evaluation. 16
U.S. General Accounting Office, Leslie G. Aronovitz, Associate
Director, Health Financing and Public Health Issues, Health,
Education, and Human Services.................................. 22
______
American Hospital Association, and Intermountain Health Care,
Paul D. Clayton................................................ 53
Association of American Medical Colleges, and University of
Arkansas for Medical Sciences, G. Richard Smith, Jr............ 59
Blue Cross and Blue Shield of Nebraska, and Blue Cross and Blue
Shield Association, Tom Jenkins................................ 80
Goldman, Janlori, Institute for Health Care Research and Policy,
Georgetown University.......................................... 64
SUBMISSIONS FOR THE RECORD
American Association of Occupational Health Nurses, Inc.,
Atlanta, GA, statement......................................... 91
American Psychiatric Association, statement...................... 94
American Society of Health-System Pharmacists, Bethesda, MD,
statement...................................................... 97
Anderson, Joyce E., Minneapolis, MN, letter...................... 98
Blevins, Sue A., Institute for Health Freedom, statement......... 104
Burcham, Matthew and Carrie, Jefferson City, MO, letter.......... 99
Concerned Parents for Vaccine Safety, Ely, NV, Dawn Winkler,
letter......................................................... 100
Elensys, Woburn, MA, and Olsson, Frank and Weeda, P.C., Karen A.
Reis, letter................................................... 100
Goldman, Margo P., National Coalition for Patient Rights,
Lexington, MA, statement and attachments....................... 117
Greiner, Sandra K., Independence, MO, letter..................... 101
Hannon, Hon. Kemp, National Conference of State Legislatures,
letter and attachment.......................................... 121
Health Insurance Association of America, statement............... 101
Institute for Health Freedom, Sue A. Belevins, statement......... 104
Johnson, Randel K., U.S. Chamber of Commerce, statement and
attachment..................................................... 124
Kane, Peter, National Coalition for Patient Rights, Lexington,
MA, statement and attachments.................................. 117
LPA, Inc., statement............................................. 104
McDermott, Hon. Jim, a Representative in Congress from the State
of Washington.................................................. 7
National Association of Health Underwriters, Arlington, VA,
statement...................................................... 107
National Association of Insurance Commissioners, statement and
attachment..................................................... 109
National Coalition for Patient Rights, Lexington, MA, Margo P.
Goldman and Peter Kane, statement and attachments.............. 117
National Conference of State Legislatures, Hon. Kemp Hannon,
letter and attachment.......................................... 120
Reis, Karen A., Elensys, Woburn, MA, and Olsson, Frank and Weeda,
P.C. letter.................................................... 100
Smock, Elizabeth S., Kansas City, MO, letter..................... 124
U.S. Chamber of Commerce, Randel K. Johnson, statement and
attachment..................................................... 124
Winkler, Dawn, Concerned Parents for Vaccine Safety, Ely, NV,
letter......................................................... 100
CONFIDENTIALITY OF HEALTH INFORMATION
----------
TUESDAY, JULY 20, 1999
House of Representatives,
Committee on Ways and Means,
Subcommittee on Health,
Washington, DC.
The Subcommittee met, pursuant to call, at 3:20 p.m., in
room 1100, Longworth House Office Building, Hon. Bill Thomas
(Chairman of the Subcommittee) presiding.
[The advisories announcing the hearing follow:]
ADVISORY
FROM THE
COMMITTEE
ON WAYS
AND
MEANS
SUBCOMMITTEE ON HEALTH
CONTACT: (202) 225-3943
FOR IMMEDIATE RELEASE
July 13, 1999
No. HL-8
Thomas Announces Hearing on
Confidentiality of Health Information
Congressman Bill Thomas (R-CA), Chairman, Subcommittee on Health of
the Committee on Ways and Means, today announced that the Subcommittee
will hold a hearing on proposals to protect the confidentiality of
patients' health care information. The hearing will take place on
Tuesday, July 20, 1999, in the main Committee hearing room, 1100
Longworth House Office Building, beginning at 2:00 p.m.
In view of the limited time available to hear witnesses, oral
testimony at this hearing will be from invited witnesses only. However,
any individual or organization not scheduled for an oral appearance may
submit a written statement for consideration by the Committee and for
inclusion in the printed record of the hearing.
BACKGROUND:
Section 264 of the Health Insurance Portability and Accountability
Act of 1996 (HIPAA) (P.L. 104-191) required the Secretary of Health and
Human Services to develop policy recommendations with respect to the
confidentiality of health information by August 1997. Specifically, the
HIPAA mandate required that this new policy be designed to protect the
privacy of personal health information that is transmitted
electronically, in conjunction with one of the standardized health
transactions established by HIPAA's administrative simplification
provisions. Secretary Shalala submitted these recommendations to
Congress in September of 1997. Under HIPAA, Congress has until August
21, 1999, to enact a privacy law. If Congress fails to enact a medical
privacy law, the Secretary is then required to issue regulations within
six months. The law provides that, if regulations are issued, they will
not supercede stricter State privacy laws. The Subcommittee began its
exploration of this issue with a hearing on March 24, 1998. At that
meeting, Subcommittee members heard from a variety of private
witnesses, as well as Dr. Don Detmer, then Chairman of the National
Committee on Vital Health Statistics (NCHVS). The NCVHS advised the
Secretary in the development of her policy recommendations.
In announcing the hearing, Chairman Thomas stated: ``The importance
of information to America's modern health care delivery system cannot
be overstated. The rapid exchange of information B much of it personal
in nature B is critical to the delivery of high quality care, the
increasingly complex financing of care, and ongoing efforts to improve
quality. Protecting the confidentiality and security of this
information is even more important. Only by protecting the
confidentiality of health information can we give patients the
confidence they need to seek help, even for the most personal or
sensitive of health issues. Data integrity and system security measures
are critical to our ongoing efforts to improve health care outcomes and
find new cures through the application of information technology to
medical research. Today, every patient B including 38 million Medicare
patients B benefits from the extensive use and exchange of information
in our health system. However, our laws need to be updated to better
protect the confidentiality and security of this information.
FOCUS OF THE HEARING:
The hearing will focus on various aspects of the patient
confidentiality issue that have been raised by the Secretary's
recommendations to Congress and by other laws . The Subcommittee will
receive testimony from several public agency representatives and from a
variety of private sector witnesses representing different perspectives
from within the health care system.
DETAILS FOR SUBMISSION OF WRITTEN COMMENTS:
Any person or organization wishing to submit a written statement
for the printed record of the hearing should submit six (6) single-
spaced copies of their statement, along with an IBM compatible 3.5-inch
diskette in WordPerfect 5.1 format, with their name, address, and
hearing date noted on a label, by the close of business, Tuesday,
August 3, 1999, to A.L. Singleton, Chief of Staff, Committee on Ways
and Means, U.S. House of Representatives, 1102 Longworth House Office
Building, Washington, D.C. 20515. If those filing written statements
wish to have their statements distributed to the press and interested
public at the hearing, they may deliver 200 additional copies for this
purpose to the Subcommittee on Health office, room 1136 Longworth House
Office Building, by close of business the day before the hearing.
FORMATTING REQUIREMENTS:
Each statement presented for printing to the Committee by a
witness, any written statement or exhibit submitted for the printed
record or any written comments in response to a request for written
comments must conform to the guidelines listed below. Any statement or
exhibit not in compliance with these guidelines will not be printed,
but will be maintained in the Committee files for review and use by the
Committee.
1. All statements and any accompanying exhibits for printing must
be submitted on an IBM compatible 3.5-inch diskette in WordPerfect 5.1
format, typed in single space and may not exceed a total of 10 pages
including attachments. Witnesses are advised that the Committee will
rely on electronic submissions for printing the official hearing
record.
2. Copies of whole documents submitted as exhibit material will not
be accepted for printing. Instead, exhibit material should be
referenced and quoted or paraphrased. All exhibit material not meeting
these specifications will be maintained in the Committee files for
review and use by the Committee.
3. A witness appearing at a public hearing, or submitting a
statement for the record of a public hearing, or submitting written
comments in response to a published request for comments by the
Committee, must include on his statement or submission a list of all
clients, persons, or organizations on whose behalf the witness appears.
4. A supplemental sheet must accompany each statement listing the
name, company, address, telephone and fax numbers where the witness or
the designated representative may be reached. This supplemental sheet
will not be included in the printed record.
The above restrictions and limitations apply only to material being
submitted for printing. Statements and exhibits or supplementary
material submitted solely for distribution to the Members, the press
and the public during the course of a public hearing may be submitted
in other forms.
Note: All Committee advisories and news releases are available on
the World Wide Web at `HTTP://WWW.HOUSE.GOV/WAYS__MEANS/'.
The Committee seeks to make its facilities accessible to persons
with disabilities. If you are in need of special accommodations, please
call 202-225-1721 or 202-226-3411 TTD/TTY in advance of the event (four
business days notice is requested). Questions with regard to special
accommodation needs in general (including availability of Committee
materials in alternative formats) may be directed to the Committee as
noted above.
NOTICE--CHANGE IN TIME
ADVISORY
FROM THE
COMMITTEE
ON WAYS
AND
MEANS
SUBCOMMITTEE ON HEALTH
CONTACT: (202) 225-3943
FOR IMMEDIATE RELEASE
July 16, 1999
No. HL-8-Revised
Change in Time for Subcommittee Hearing on
Confidentiality of Health Information
Tuesday, July 20, 1999
Congressman Bill Thomas (R-CA), Chairman, Subcommittee on Health of
the Committee on Ways and Means, today announced that the Subcommittee
hearing on confidentiality of health information, previously scheduled
for Tuesday, July 20, 1999, at 2:00 p.m., in the main Committee hearing
room, 1100 Longworth House Office Building, will now begin at 3:00 p.m.
All other details for the hearing remain the same. (See
Subcommittee press release No. HL-8, dated July 13, 1999.)
Chairman Thomas. The Subcommittee will come to order. Well,
good afternoon.
Today, the Subcommittee will be holding its second hearing
on the confidentiality of health care information. The Ways and
Means Committee began focusing on this issue directly and
intently in 1996. That was the year Congress passed the Health
Insurance Portability and Accountability Act or, as we call it,
HIPAA.
Among HIPAA's many provisions was an initiative
specifically designed to reduce the administrative costs
associated with the processing of claims, other routine
transactions, Medicaid, Medicare and the rest of the health
care system. This initiative now codified in title XI of the
Social Security Act is known as administrative simplification.
Part of that administrative simplification effort, in
addition to standardized health care transactions, was
acknowledgment that there was a need for re-evaluation and
enhancement of the confidentiality protections afforded health
information, particularly in light of stories and knowledge
dealing with computers and the electronic forms of
communication that began advancing themselves in the health
care financing system.
We did that by including a provision in that administrative
simplification section requiring the Secretary of Health and
Human Services to develop and forward to the Ways and Means
Committee and the Senate Finance Committee recommendations for
national health care confidentiality legislation. Those
recommendations were forwarded to us in September 1997, and
they were a subject of this Subcommittee's hearing last spring.
Now, there is an aspect of HIPAA that says unless Congress
acts on the confidentiality legislation on its own by August 21
that the Secretary has the authority to promulgate regulations
to protect confidentiality of information transmitted
electronically. I think all of us hope that this will not be
necessary. As the administration has often said, and I believe
is sincere, it would be far better if Congress acted on the
HIPAA mandate and passed a comprehensive confidentiality
statute than regulations promulgated by the Secretary in
accordance with the HIPAA provisions.
We have all been working on this issue. The Senate has
labored, other Committees of the House have labored, and many
of you know I have been working with a number of our
colleagues, principally Ben Cardin, in the hopes of developing
a bill that can be widely supported by Members on both sides of
the aisle, by those who are involved in this issue and, most
importantly, by providers and patients.
We believe we are close to presenting the Subcommittee with
the proposal, but we believe this hearing will be very
informative and will assist us in understanding some of the
areas that we still have not been able to finalize. And more
specifically today, we will be looking at the many different
ways that personal health information is used in Medicare and
throughout the private health care system. We will be looking
at the Secretary's proposed policy under HIPAA, and I do think,
though, many of the hearings that we have had for background
and resource information are valuable, this one could be one of
the most valuable ones that we will hold.
Our failure to act in this area may, in fact, miss a window
to protect the confidentiality of patients' personal health
information in a broad and significant way for individuals but
just as importantly for health care outcomes research using the
material that a confidentiality Federal structure would
provide.
And so, I look forward to the testimony from our witnesses
and look forward to Members of this Subcommittee meeting and
trying to resolve what I think is one of the key issues today
and that is identify and develop policies that balance truly
competing needs, almost competing rights. This hearing will be
central in assisting us in doing that, and I will recognize my
colleague if he has any statement.
Mr. Kleczka. Thank you, Mr. Chairman.
Mr. Chairman, what I would like to do is ask unanimous
consent to enter into the record the opening statement by the
Ranking Member, Pete Stark, who is under the weather today.
Chairman Thomas. Without objection.
[The opening statements follow:]
Opening Statement of Chairman William M. Thomas, a Representative in
Congress from the State of California
Good Afternoon. Today the Subcommittee will be holding its
second hearing on the confidentiality of health care
information. The Ways and Means Committee began its focus on
this issue most recently, in 1996. That was the year Congress
passed the Health Insurance Portability and Accountability Act,
or HIPAA. Among HIPAA's many provisions, was an initiative
specifically designed to reduce the administrative costs
associated with the processing of claims and other routine
transactions in Medicare, Medicaid and the rest of the health
care system. This initiative, now codified in Title XI of the
Social Security Act, is known as Administrative Simplification.
As part of the Administrative Simplification effort,
Congress acknowledged that, in addition to standardized health
care transactions, there was a need for a reevaluation and
enhancement of the confidentiality protections afforded health
information--particularly in light of the increasing use of
computers and electronic forms of communication in the health
care financing system. Congress did this by including in the
Administrative Simplification provisions a requirement that the
Secretary of Health and Human Services develop and forward to
the House Ways and Means and Commerce Committees, and the
Senate Finance and Labor Committees, recommendations for
national health care confidentiality legislation. The
Secretary's recommendations were forwarded to us in September
of 1997 and they were the subject of our last hearing on this
issue last Spring. Unless Congress acts on confidentiality
legislation of its own by August 21st of this year, the HIPAA
law gives the Secretary the authority to promulgate regulations
to protect the confidentiality of information transmitted
electronically in connection with one of HIPAA standardized
transactions.
I hope that this will not be necessary. As the
Administration has often said, I believe it would be far better
if Congress acted on the HIPAA mandate and passed a much, more
comprehensive confidentiality bill--a bill that would protect
the confidentiality of all personal health information in the
system--not just that transmitted in accordance with HIPAA.
That is why I am intent on bringing legislation before this
panel shortly that will meet the HIPAA mandate and go beyond,
and establish protections for all personal health information.
As many of you know, I have been working with my colleague,
Representative Cardin, in the hopes of developing a bill that
can be widely supported by Members on both sides of the aisle.
While I believe we are close to presenting the subcommittee
with a proposal, I believe this hearing will be very
informative and help us greatly as we seek to hammer out the
final details.
More specifically, today we will be looking at the many
different ways that personal health information is used in
Medicare and throughout our private health care system.
Moreover, we will be examining the possible effects of the
Secretary's proposed policy to protect the confidentiality of
that information. As far as I am concerned, the importance of
this issue to health policy can not be overstated.
Confidentiality is a fundamental value of medicine. It is
essential to the delivery of care. Only by honoring the
confidences of patients can the system maintain the trust that
is critical to the patient-caregiver relationship. Only by
protecting the confidentiality of patient's personal health
information can we ensure that patients will continue to seek
out care when needed.
Similarly though, information about individual patient
encounters with the health system is of fundamental importance
to efforts to our improve the public health. The lessons
learned from one patient's encounter with the system makes it
possible to improve the care of the next patient. Finding new
cures for disease and identifying better methods of treatment
are dependent on information that is learned when patients
obtain care. Finally, information about individual patient
encounters is essential to the processing of today's
increasingly complex and sophisticated payment arrangements--
including those we employ today to finance Medicare and
Medicaid.
Our challenge is to identify and develop policies that
balance these competing needs. My hope is that today's hearing
will be instrumental in helping us do this.
Opening Statement of Hon. Fortney Pete Stark, a Representative in
Congress from the State of California
Thank you, Mr. Chairman, for holding this hearing today.
We have a lot of questions to ask our witnesses. They are
difficult questions that many committees have struggled to
answer over the course of numerous hearings during the last
several years.
I hope we can make progress today by getting some
thoughtful answers to some of the toughest issues in the
medical privacy arena. The most fundamental is this: Does
federal legislation that establishes uniform rules for all
health care providers have to preempt state laws?
I submit that the answer is no--that under the federal
Supremacy Clause that we will shortly be hearing more about
from GAO, any confidentiality legislation we enact will become
a baseline for medical privacy in this country. This means that
if federal law is more protective than similar state laws, then
our legislation will become the standard. And the degree of
public anxiety about eroding medical privacy tells me that any
federal standard should be as clear and as protective as
possible.
But in those cases where a state's law is stronger--as in
California's requirement that all law enforcement officials
must have a warrant to access identifiable health information--
then state law should govern.
If followed, this basic principle would provide meaning and
shape to a debate that has often sputtered and bogged down over
definitional squabbles that fail to produce a workable
agreement.
We have little enough time left to craft a consensus. And I
regret that the panel's real expert on medical privacy, Dr. Jim
McDermott, is not able to be with us today. As yet, we do not
have legislation under consideration by this Subcommittee. But
I hope that when we do, we will have plenty of time to discuss
it and ask further questions before marking it up.
Thank you.
Mr. Kleczka. And also the statement of another colleague
from the Subcommittee, Jim McDermott, who has been very active
in this issue. He is unable to be here. He is recuperating from
heart surgery back in his home State of Washington.
I talked to Jim a short time ago, and he is doing quite
well, and he thanks all the Members of Congress for their
concern and the friends that he has around the DC area.
So I would ask unanimous consent that Mr. McDermott's
statement be entered also in the record.
Chairman Thomas. Without objection.
[The opening statement follows:]
Statement of Hon. Jim McDermott, a Representative in Congress from the
State of Washington
Mr. Chairman, thank you for inserting my statement into the
record. I had hoped to be here for this hearing, but I am in
Seattle recuperating from heart surgery.
As you know, medical privacy is an issue that I have long
cared about. As a psychiatrist and health care consumer I
witnessed a need for strong federal privacy law protecting
patients. It is amazing that we don't have strong privacy
protections in place for medical records already yet we have
one for video rental records.
Why do we need a Federal medical privacy law? Currently,
privacy protections are weak and vary widely from state to
state. Only 28 states allow people to even examine their own
medical records. This lack of strong national standards could
allow employers, schools, marketing agencies and others access
to what ought to be confidential files.
Ensuring privacy in medical care is more important now than
ever before because of new technologies like genetic testing
and the computerization of medical records. Genetic research
and testing has profound implications for our country's health
care system because genetic information discloses not just our
current health, but also purports to accurately predict our
potential future health, and the health of our families.
The Human Genome Project may have a draft of the entire
genome by early next year. And, in the near future, tests will
be available for common genetically affected conditions. These
tests create opportunities even as they raise serious
challenges that we need to address immediately.
The BRCA-1 genetic test for breast cancer illustrates the
dimensions of this debate. Women have been advised to be
tested, but only as part of a research protocol.
Some patients see this as paternalistic, preferring to be
informed of the results of the test, even if those results are
not easily interpretable at this moment. Patients are warned
about the potential risks of whether they will be able to buy
health insurance or even if they will be able to get a job--
should others learn of their genetic status. Understandably,
this has discouraged some women from participating in even the
research, where their identities should be strictly protected.
Not everyone wants to know his or her genetic status. This
can cause friction for families in which some members wish to
be tested, but others do not. Sometimes the tests require
participation by several family members to determine which
mutation is common in that particular family. Some mothers have
opted not to be tested to prevent anticipated discrimination
against their daughters, while others feel compelled to be
tested to spare their daughters the anxiety of not knowing if
they carry the mutation.
Genetic tests also raise the issue of cost. Many insurance
plans do not cover genetic tests, or they do not cover the
counseling that is an integral part of genetic therapy. If a
woman has no health insurance, frequent mammography screenings
for breast cancer are a considerable expense, and the results
of the test may be worse than useless to her.
Increasing reliance on mass computer databases further
complicates the problem. Computers have revolutionized the way
an individual's medical information is collected, stored, and
disseminated. Without adequate, enforceable controls, this
information can be used to breach the privacy of patients and
to discriminate against them.
In 1995, Harvard and Stanford conducted a study of 200
people who suffered discrimination in insurance, jobs,
education, or child adoptions because of their predisposition
to a genetic disease. What makes their stories particularly
disturbing is that these people had no symptoms, and perhaps
would never develop that particular disease. These examples led
to my concern about what the future holds if we allow
indiscriminate use of these new technologies.
I will introduce this year, as I have in the last two
congresses, a bill called the ``Medical Privacy in the Age of
New Technologies Act.'' This measure is intended to ensure that
a patients personal health information will not be disclosed
without that patients explicit consent, and that patients have
access to their own records. It puts the individual in charge
of what happens to his or her medical information, who sees it,
and why.
As you may know, the Congress is required to pass privacy
legislation by this August. If we fail to meet this deadline,
the Secretary of Health and Human Services will promulgate
regulations. Even the Secretary agrees that regulations will
not provide patients with the kind of strong protections that
can be imposed by law.
As the Subcommittee considers legislative proposals there
are two basic principles that should be included in any privacy
legislation:
First, people need to be notified of how their
personal information might be used,
Second, they must have the opportunity for
meaningful informed consent. Informed consent in the realm of
health care is key. If patients fear that their records will be
used in ways they do not know about, or will be given to third
parties without their permission, they will not trust the
health care system, and they will not tell their doctors the
information necessary to provide them the best care.
It is likely that the generalizations we use to describe
competing privacy proposals will make the bills sound very
similar. But, to use an often-overused phrase, the devil is in
the details. When you examine the details of these bills you
will find a number of distinctions. Most notably they differ on
the issues of the informed consent, research, and the
preemption of state laws.
Following the basic principle that an individual has a
right to privacy of their health information, it is important
the patient is informed--in writing--of what information is to
be disclosed, for what purpose, to which entity, and for what
period of time. There should be two tiers of authorization: one
for treatment and payment, and another for other purposes, such
as research. Individuals can not ``opt out'' of using their
information for treatment and payment. However, in some bills
including my own, patients can opt out of using their
information for the second tier ``other purposes.'' The debate
in Congress has focused around what constitutes ``treatment and
payment.'' Does treatment and payment include auditing,
research, marketing, and so on?
Research is another area of distinction. How will medical
privacy legislation affect the ability to conduct medical
research? The legislation I have proposed will not undermine
research capabilities. It allows researchers to use coded
information, meaning information that either is anonymous, but
could be linked to protected health information by authorized
persons, or is nonidentifiable information, which is anonymous
and cannot be linked to anyone. Some legislation, such as the
Bennett bill, has taken the approach that since we have all
benefited from past medical research we are obligated to
participate in future research. This is a tremendously
important and difficult area to legislate. For which reason, I
am working to find a balance between the two approaches.
One of the most contentious issues we are grappling with is
the issue of pre-emption of state law. I believe that the only
meaningful medical privacy law will be one that is a ``federal
floor'' that does not pre-empt stronger state laws. There are
literally thousands of state laws that address the privacy of
medical records information in non-health related areas. The
pre-emption of all state law could have significant unintended
consequences and will be costly to states. For instance, laws
are on the books in many states regarding the privacy of the
health information of victims of sexual assault. To broadly
pre-empt these laws--not knowing what we are pre-empting and
what the impact will be--is very short sighted.
To argue the necessity of a ``federal ceiling'' claiming
that we must preempt state laws to make it easier for the
interstate health industry is incredible. For a Congress that
has advocated sending power back to the states, I find it
ironic that in this case they think the Federal government can
do it better. Restricting states from passing stronger privacy
laws would keep them from responding to many new, unique, and
inherently local challenges in health care and public health.
Especially, since there is no precedent in federal privacy or
civil rights law for pre-empting stronger state laws.
In the coming debate, many people will speak for industries
that stand to make money from the use and misuse of
information. For them, medical records are commodities that are
bought and sold.
We will hear many claims that any new legislation must not
interfere with those particular interests. But the group we
should listen to most will be hardest to hear: patients and
their families. Think about your own family's medical records
being available for anyone to look at. What value can we place
on the confidentiality of the doctor-patient relationship? It
is essential that we protect the privacy of individuals,
including their genetic privacy. Good legislation can ensure
that new technologies are used, not to deny health care or to
deny medical privacy, but to benefit all of us.
Thank you.
Opening Statement of Hon. Jim Ramstad, a Representative in Congress
from the State of Minnesota
Mr. Chairman, thank you for calling this important hearing
to discuss the confidentiality of medical records.
Given the sensitive nature of personal health records, I am
very aware of the importance of crafting appropriate
legislation, as well as the complexities that surround this
task. As Americans, we greatly value our personal privacy. As
the world leaders in innovative and quality health care, we
also understand the need to use some information in ways that
promote research and development and quality assessments, as
well as prevent fraud and abuse.
Since this Subcommittee is charged with the responsibility
of overseeing the Medicare program, I especially appreciate
this hearing's attention to the privacy of personally
identifiable information for the 39 million Americans enrolled
in that important health care program.
The General Accounting Office (GAO) will testify today
about the importance of using personally identifiable
information for the proper operation of the Medicare program,
as well as the effect of state restrictions on HCFA's behavior.
My constituents and I certainly look forward to learning more
about HCFA's policies and practices regarding the disclosure of
information, as well as HCFA's plans to improve the adequacy of
its confidentiality safeguards and monitoring activities.
Again, thank you for calling this important hearing. I look
forward to learning more from our witnesses about the
confidentiality of all medical records.
Mr. Kleczka. Mr. Chairman, I just want to say a couple of
things on the issue of privacy.
It is an area where I have had concerns for years now. This
is the second session that I have introduced my Personal
Information Privacy Act which indicates that a person's privacy
is theirs and should not be waived or given away.
I know the Chairman would like to have something done by
the Committee on medical privacy, hopefully by the Congress
before the August. However, I would caution the Committee
against rushing and passing a bill that does not truly protect
the privacy of the individual. Some of the things I have read
and heard about which concern me are legislation preempting
States' laws in this area, and provisions where a person who
doesn't give a blanket waiver for release of their health care
records could be denied health care services. You know, I am
hopeful that those rumored provisions won't be in the final
bill, but they disturb me greatly. I don't think there are
competing interests with my health care privacy. It is mine. It
is my medical record. It is my background. It is my past. I
paid, along with the insurance company, for the medical care
described in my records. We have gotten to the point in this
country where we don't recognize these important facts.
I happened to go to a new dentist in my home district of
Milwaukee, Wisconsin, and I was filling out the elongated form
before he looked at my mouth, and on the form he asked for my
Social Security number. Well, what does my Social Security
number have to do with my teeth? I think it has a lot more to
do with my tax liability and the interest I get from my bank,
so I left that blank.
Then there was another section of the application where he
asked whether or not he or the office could release this
information. It didn't indicate for what purpose, but he wanted
my blanket authorization to release the status of my teeth or
my root canals to anyone he deemed appropriate to receive that
information. There again I left that blank, and I think the
consumer should have those rights.
And the upshot, Mr. Chairman, was he treated me. Well, he
didn't really treat me. He gave me an evaluation. The treatment
comes this Friday, and $1,300 later I am going to be ``more
better''. But, nevertheless, whatever is in that office and in
my file is between my dentist and myself and my mouth. I don't
think it should be shared on the Internet; it should not be
shared with the world.
If, in fact, somebody wants to do a clinical evaluation of
Kleczka's teeth, they should ask me; and at that point I would
probably say yes because, you know, I have no special teeth.
But I think the legislation that we develop in this
Subcommittee or in this Congress should recognize that the
ultimate right of privacy is with the patient, is with the
consumer, and I would not be willing, through my vote, to give
away that right to any researcher, to any insurance company or
to anyone else.
Thank you, Mr. Chairman.
Chairman Thomas. I thank the gentleman.
If the first panel would come forward. The panel consists
of Peggy Hamburg, M.D., Assistant Secretary for Planning and
Evaluation, U.S. Department of Health and Human Services;
Michael Hash, Deputy Administrator at HCFA; and Leslie
Aronovitz, who is the Associate Director of Health Financing
and Public Health Issues, Health, Education, and Human Services
Division, United States General Accounting Office.
Your written testimony will be made a part of the record.
In the time that you have available you may address us in any
way you see fit; and between the two of you, Mr. Hash,
Honorable Hamburg, you can work out which one goes first.
Mr. Hash. I will be happy to go first.
Chairman Thomas. So we will start with you and move across
the panel. Thank you very much.
STATEMENT OF MIKE HASH, DEPUTY DIRECTOR, HEALTH CARE FINANCING
ADMINISTRATION, U.S. DEPARTMENT OF HEALTH AND HUMAN SERVICES
Mr. Hash. Thank you, Chairman Thomas and Members of the
Health Subcommittee. We appreciate the opportunity to come and
testify about our efforts to improve protections for personally
identified beneficiary information that is in our program's
possession.
No administration has been more committed to protecting
medical privacy. President Clinton and Vice President Gore have
both spoken about its paramount importance. We provide much
greater protection for sensitive personal health information in
our programs than does the private sector. We strive to
continually enhance our protections, and we greatly appreciate
the evaluations and the advice of our Office of Inspector
General at HHS, as well as the General Accounting Office.
As the GAO has confirmed in its report to you, personally
identifiable information on Medicare beneficiaries is essential
to the operation of the program. We need it to make accurate
payments in the fee-for-service portion of Medicare and to risk
adjust the Medicare+Choice payments so that they take into
account individual beneficiary health status information and
reduce any disincentives for the enrollment of sicker
beneficiaries.
We also need personally identifiable information to conduct
medical reviews and other activities that are essential to
fighting waste, fraud and abuse in our programs.
We certainly need it to coordinate benefits and ensure that
we do not pay for claims that other insurers are liable to pay.
And of course, we need it to protect--or to project, I
should say, spending trends to accurately determine premium
amounts for the Medicare Program, to develop and refine
policies, including payment policies; to assess and improve
quality and access; and last but far from least, we need to be
responsive to individual beneficiary inquiries about coverage
and payment affecting their interests.
Medicare data are also an invaluable asset in the efforts
to improve care and coverage for beneficiaries by our research
colleagues at the National Institutes of Health, the Agency for
Health Care Policy and Research, and other scientific
investigators and policy analysts.
Equally essential is our obligation to protect sensitive
beneficiary information and to clearly inform beneficiaries of
how information about them will be used in accordance with the
requirements of the Privacy Act. Whenever concerns are raised
about privacy, we take them seriously and we act on them
immediately.
That is what we did earlier this year when Vice President
Gore and a number of Members of Congress identified potential
problems with our home health patient Outcome and Assessment
Information Set known as OASIS. As you may recall, we halted
implementation of the use of that instrument and conducted a
thorough review of it. We made some important modifications to
ensure that only essential information would be collected and
that it would be properly protected, and we made sure that
beneficiaries would be fully informed on why it is being
collected and how it would be used.
Because protecting beneficiary information is essential to
our mission, we are taking several new steps to strengthen our
efforts.
First, we have established a new Beneficiary
Confidentiality Board to provide executive leadership in all
aspects of privacy protection.
Second, we are reviewing all of our beneficiary notices to
ensure that they fully disclose in plain language how data
collected from individual beneficiaries is to be used.
Third, we are designing new systems that will easily track
when and where the data are shared.
Fourth, we are increasing efforts to ensure that
researchers and Medicare contractors have properly protected
patient data.
And, finally, we have introduced a system security
initiative across HCFA to aggressively address vulnerabilities
that have been found through the Inspector General's
investigations and our own reviews.
The new steps we are taking can only strengthen our solid
track record of protecting confidential beneficiary
information. Our new Beneficiary Confidentiality Board in
particular will provide an overarching executive level focus on
our obligation to remain vigilant in this area. We encourage
continuing oversight by the Inspector General's Office and by
our colleagues at the General Accounting Office and others to
help us address any new privacy concerns promptly, and we
remain committed to swiftly addressing any related issue or
breaches that might occur.
Mr. Chairman, thank you for this opportunity to discuss
these issues; and I look forward to answering any questions
that you or other Members of the Subcommittee may have.
[The prepared statement follows:]
Statement of Mike Hash, Deputy Director, Health Care Financing
Administration, U.S. Department of Health and Human Services
Chairman Thomas, Congressman Stark, distinguished
Subcommittee members, thank you for inviting us to testify
about our efforts to improve protections for personally
identifiable beneficiary information. No Administration has
been more committed to protecting medical privacy. President
Clinton and Vice President Gore have both spoken about the
paramount importance of medical records privacy.
We provide much greater protection for sensitive
information than does the private sector. We strive to
continually enhance our protections. And we greatly appreciate
the evaluations and advice of the HHS Inspector General (IG)
and the General Accounting Office (GAO) in this regard.
As the GAO recently confirmed, personally identifiable
information on Medicare beneficiaries is essential to the
operation of the Medicare program. We need it to:
make accurate payments in fee-for-service and to
risk adjust Medicare+Choice payments so they take into account
individual beneficiaries health status and curtail the
disincentive for plans to enroll sicker beneficiaries;
conduct medical reviews and conduct other
activities essential to fighting fraud, waste and abuse;
coordinate benefits and ensure that we do not pay
claims for which other insurers are responsible;
project spending trends and accurately determine
premium amounts;
develop and refine policy to ensure proper
coverage and payment;
assess and improve quality and access to care, for
example by monitoring and then working to increase the number
of beneficiaries receiving an influenza vaccination; and,
be responsive to individual beneficiary inquiries
about coverage and payment.
Medicare data are also an invaluable asset in efforts to
improve care and coverage for beneficiaries by our research
colleagues at the National Institutes for Health, the Agency
for Health Care Policy and Research, and other scientific
investigators and policy analysts.
It is equally essential that we protect the sensitive
beneficiary information with which we are entrusted, and that
we clearly inform beneficiaries of how information about them
is used in accordance with the Privacy Act. Whenever concerns
are raised about privacy, we take immediate action to address
them.
For example, when Vice President Gore and members of
Congress identified potential problems with our home health
patient Outcome and Assessment Information Set (OASIS) earlier
this year, we halted implementation, conducted a thorough
review, and made important modifications to ensure that only
essential information would be collected, that it would be
properly protected, that disclosures would be limited to the
minimum necessary to carry out HCFA's mission, and that
beneficiaries would be fully informed on why it is being
collected and how it will be used.
Because protecting beneficiary information is essential to
our mission, we are taking several new steps to strengthen our
efforts.
We have established a new Beneficiary
Confidentiality Board to provide executive leadership in all
aspects of privacy protection.
We are reviewing all beneficiary notices to ensure
that they fully disclose in plain language how data are used.
We are designing new systems that will easily
track when and where data are shared.
We are increasing efforts to ensure that
researchers and Medicare contractors have properly protected
data.
And we have introduced a systems security
initiative to aggressively address vulnerabilities found
through the Inspector General's and our own reviews.
Confidentiality Board
We have established a new Beneficiary Confidentiality Board
to coordinate and consolidate privacy policies and ensure that
we do not collect or disseminate more information than is
absolutely necessary. The Board is led by the Director of the
Center for Beneficiary Services and includes senior executives
from all Agency components that have a direct stake in privacy
and confidentiality, including the Center for Medicaid and
State Organizations, the Center for Health Plans and Providers,
the Office of Clinical Standards and Quality, the Office of
Strategic Planning, the Program Integrity Group, the Office of
Information Services, the Office of the Actuary, and Regional
Office representatives. Core responsibilities include:
establishing strategic goals, overarching
policies, and objectives for protecting data;
establishing, coordinating, and issuing all policy
decisions on privacy and confidentiality;
assuring implementation and enforcement of guiding
principles for Agency-wide strategic goals and objectives;
providing executive oversight of compliance with
all privacy and confidentiality statutory and regulatory
requirements, and assuring that beneficiary protections are
enforced;
reviewing all current operations with regard to
systems of records and beneficiary protections to assure that
strategic goals and objectives and guiding principles are in
place and effective at all levels, including contractors to
sub-contractors;
evaluating legislative proposals involving the
collection, use, and disclosure of personal information by any
entity, public or private, for consistency with legal standards
and our guiding principles;
assuring that use of new information technologies
sustains protections of information that directly identifies an
individual or from which an individual's identity can be
deduced;
assuring that personal information contained in
our systems of records are handled in full compliance with fair
information practices as set out in the Privacy Act; and,
serving as a senior-level forum for the discussion
and resolution of key strategic issues affecting HCFA's privacy
and confidentiality policies and implementation strategies.
This will help ensure a central focal point for privacy
issues and accountability across all aspects of Agency
business.
Beneficiary Notices
Beneficiaries need to know and understand why personally
identifiable information is collected and how it is used. This
is both a legal requirement and an ethical obligation. There
are many different notices to beneficiaries about why
information is collected and how it is used.
Some, including the newest notice for OASIS, has been
carefully crafted to ensure that it is clear and comprehensive.
However, we agree with the GAO that some of the earlier
beneficiary notices do not meet the Privacy Act requirements to
inform beneficiaries about:
the authority under which we are collecting
information;
the principal purpose for which it will be used;
the routine uses for which it may be used; and
whether the individual is required to supply the
information and what the consequences are if the individual
does not supply the information
Earlier this year, we began a systematic review of all
beneficiary privacy notices, rewriting them as necessary, to
ensure that they provide full disclosure in plain language.
Tracking Data Releases
The Privacy Act stipulates that beneficiaries are entitled
to know, upon request, any and all instances in which
identifiable information about them has been shared. We have
never had such a request, but have realized that complying with
one would be extraordinarily labor intensive with our current
information systems. It also is currently difficult to provide
data on our Privacy Act compliance to the Office of Management
and Budget (OMB) for its oversight responsibilities.
We are now working to fully define the requirements for
information systems that will ensure full compliance with OMB
and Privacy Act requirements. Implementing these systems is a
top information technology priority once we have cleared the
Year 2000 hurdle. In the interim, we have increased our
surveillance of these requests and are improving our existing
tracking systems to align them more fully with OMB
requirements.
Data Use Oversight
The data files we maintain are an invaluable asset to
medical and health policy researchers in their efforts to
improve beneficiary care and coverage. For example:
we are able to share the extensive information we
have on beneficiaries with end-stage renal disease directly
with National Institute of Health scientists that they can use
to study and improve treatment;
the Agency for Health Care Policy and Research
Patient Outcome Research Teams rely upon this beneficiary
information to develop new insights on the treatment of the
most frequent medical conditions affecting the elderly; and,
the data files are also critical to investigators
under contract to us for evaluation and development of payment,
coverage and treatment policies.
The Privacy Act does allow for sharing data with
researchers as long as their work promotes the Agency's
mission, is compatible with the purpose for which the
information was collected, and proper privacy protections are
in place.
Many research needs are met by ``public use files'' that we
readily make available, and from which any data that could
identify individual beneficiaries is removed, including
information that could be used to deduce an individual
beneficiary's identity. Additional research needs are met by
encrypted data files in which data elements that explicitly
identify individuals (such as names, claim numbers, physician
numbers, service dates, and date of birth) are either removed,
encrypted, or stated as a range (of dates, for example). Some
data elements remain in these files that could possibly be
linked with other information to a deduce specific individual's
identity. Finally, there are some valid research endeavors for
which individually identifiable information is essential.
For all research requests, we conduct a careful review to
ensure that any disclosure of information is allowed under the
Privacy Act. For research projects outside of HHS, or not
funded by HHS, we conduct another careful level of review to
ensure that the request is for the bare minimum of information
that is essential to a given research project, and that the
project has scientific merit and sound research methodology. We
are also diligent in making clear to researchers how data that
could be used to identify individual beneficiaries must be
protected.
When proper criteria are met, we develop data use
agreements that contain explicit protections covering the
release and use of data. These agreements also specify that the
user must contact us within 30 days of completion of the
approved project for instructions on whether to return all data
files to us or to destroy such data and execute an attestation
to certify the destruction. We have taken swift action to
address the rare situations that we are aware of in which
researchers have not fully complied with Privacy Act
requirements and our data use agreements to clarify their
responsibilities to protect beneficiary confidentiality.
We are now increasing efforts to verify that researchers
have in fact complied with their data use agreements to protect
data and dispose of it properly once projects are completed. We
expect to reduce our backlog in half by the end of this fiscal
year. We also look forward to working with the GAO and other
experts to develop more systematic ways to proactively assure
compliance with data use agreements so we can prevent problems
before potential security breaches occur.
Systems Security
We are also working to improve security in electronic data
processing. We have introduced a systems security initiative to
aggressively address vulnerabilities found through the
Inspector General's and our own reviews. Our goal is to be able
to maintain the tightest possible security as the business
environment in which we operate changes, and to integrate
security into every aspect of our information technology
management activities.
One of the first things our new Chief Information Officer,
Gary Christoph, did when he came on board was to hire outside
experts to search out security weaknesses in our systems so we
could proactively address them. We also have acquired new
technology, beefed up staff training, conducted our own risk
assessments and internal audits, and enhanced procedures for
guarding access to sensitive systems. However, there are no
silver bullets, and vigilance here must be constant given the
ever changing nature of technology and evolution of new risks.
As we clear the Year 2000 hurdle and its demand on our
systems, we will be able to increase our security even more
through our comprehensive security initiative. We are now in
the process of developing the protocols to systematically
monitor the systems security of our claims processing
contractors. The new evaluation process will specifically
assess administrative, technical, and physical protection
measures to protect beneficiary privacy.
We also have recently restructured our contractor oversight
operations and initiated a new contractor evaluation process
which will incorporate the security review findings and improve
our overall management of the contractors. In addition, the
Administration has proposed comprehensive contracting reform
legislation that will bring Medicare contracting authority in
line with standard Federal government contracting procedures
and make it easier for us to terminate contractors if we find
they are not providing adequate privacy protections.
We will continue to use the annual Inspector General CFO
audits as an opportunity to identify threats to the integrity
of our data systems and to ensure that we address
vulnerabilities in a timely manner. We also are carrying out
activities required by the Presidential Decision Directive 63,
as well as security requirements in the Health Insurance
Portability and Accountability Act, which will further
strengthen our security protections.
Conclusion
The new steps we are taking can only strengthen our solid
track record of protecting confidential beneficiary
information. Our new Beneficiary Confidentiality Board, in
particular, will provide an overarching executive-level focus
on our obligation to remain ever vigilant. We encourage the IG,
GAO, and others to also be vigilant in raising and helping us
to address any concerns about protections for sensitive
information. And we remain committed to swiftly and effectively
addressing any related issues or breaches that might arise. I
thank you again for holding this hearing, and I am happy to
answer any questions you might have.
Chairman Thomas. Thank you very much.
Doctor.
Dr. Hamburg. Mr. Chairman.
Chairman Thomas. Let me caution you that these microphones
are very unidirectional, so you need to speak directly into it.
Thank you.
STATEMENT OF HON. MARGARET A. HAMBURG, M.D., ASSISTANT
SECRETARY FOR PLANNING AND EVALUATION, U.S. DEPARTMENT OF
HEALTH AND HUMAN SERVICES
Dr. Hamburg. Thank you for this opportunity to appear
before you to discuss the Secretary's recommendations for
privacy legislation.
I would also like to emphasize the administration's support
for passage of bipartisan legislation providing comprehensive
privacy protection for people's health care information.
Stories abound that raise concern that our sensitive medical
information can enter the wrong hands and be misused. For
example, at one HMO, every clinical employee could tap into
patients' computer records and see notes from psychotherapy
sessions. The director of a work site health clinic testified
before the National Committee on Vital and Health Statistics
that he was frequently pressed to disclose his patients' health
information to their supervisors.
These kinds of problems underlie the legitimate fear that
Americans have about the security of their health care
information. Almost 75 percent of our citizens say that they
are at least somewhat concerned that computerized medical
records will have a negative effect on their privacy. If we
don't act now, public distrust could deepen and ultimately stop
citizens from disclosing important information to their doctors
or from seeking needed medical testing or treatment, especially
for sensitive concerns like mental illness or genetic
disorders.
The problem is not theoretical. Numerous analyses over
several years by government, industry and professional groups
have identified serious gaps in protections for health
information and have recommended Federal legislation to close
them.
In September 1997, Secretary Shalala presented her
recommendations for protecting the ``confidentiality of
individually identifiable health information.'' In that report
the Secretary concluded that Federal legislation establishing a
basic, national floor of confidentiality is necessary to
provide rights for patients and define responsibilities of
recordkeepers. She recommended that Federal legislation focus
on health care payers and providers and the information they
create and receive in providing and paying for health care.
The Secretary recommended legislation to implement five key
principles:
First, information about a consumer that is obtained for
delivering and paying for health care should, with very few
exceptions, be used and disclosed for health purposes and
health purposes only.
Second, those who legally receive health information should
be required to take reasonable steps to safeguard it. They
should ensure that the information is available only to those
who should have access to it and only for purposes authorized
by the patient or authorized by law.
Third, consumers should have access to their health records
and should know how their health information is being used and
who has looked at it. Consumers should be given a clear
explanation of these rights.
Fourth, people who violate the confidentiality of our
personal health information should be accountable. Those who
use this information improperly should be punished.
These first four principles must, however, be balanced
against the fifth principle, public responsibility. Just like
our free speech rights, privacy rights cannot be absolute. We
must balance our protection of privacy with our public
responsibilities to support other critical national goals,
public health, research, quality care and our fight against
health care fraud and abuse.
Our Department is keenly aware of the need to use personal
health information for each of these national priorities. For
example, our researchers have used health records to help us
fight childhood leukemia and to learn that beta blocker therapy
results in fewer rehospitalizations and improved survival among
elderly survivors of acute myocardial infarction or heart
attack. Public health agencies use health records to warn of
outbreaks of emerging infectious disease threats. And our
efforts to improve quality in our health care system depend
upon our ability to review health information.
As you know, HIPAA requires that if Congress fails to enact
comprehensive privacy legislation by August of this year, HHS
must implement final regulations by February of the year 2000.
We have assembled a team from all of the relevant Federal
agencies to work on these regulations, and it is our intent to
have an NPRM, Notice of Proposed Rule Making ready for
publication by fall. While we are moving ahead to have the
regulation ready, the President and Secretary Shalala have made
it clear that their first priority is to see Congress enact a
comprehensive bill. Our staff have been working closely with
many of your staff, and staff in the Senate, to assist in
achieving this goal. We are eager to see legislation and want
to work with you to make this happen.
Mr. Chairman, the principles embodied in our
recommendations should guide a comprehensive law that will
create substantive Federal standards and provide our citizens
with real peace of mind. The principles represent a practical,
comprehensive and balanced strategy to protect health care
information that is collected, shared and used in an
increasingly complex world.
Thank you again for giving me this opportunity to testify.
I look forward to answering any questions that you may have.
[The prepared statement follows:]
Statement of the Hon. Margaret A. Hamburg, M.D., Assistant Secretary
for Planning and Evaluation, U.S. Department of Health and Human
Services
Mr. Chairman, Congressman Stark, distinguished members of
the Committee: I appreciate the opportunity to appear before
you to discuss the Administration's recommendations for federal
legislation to protect the privacy of health information.
As you may remember, Secretary Shalala first presented her
recommendations, required by the Congress under Section 264 of
the Health Insurance Portability and Accountability Act
(HIPAA), in September 1997.\1\ I think it is fair to say that
the recommendations were well received and have been used to
assist others in crafting their own legislative proposals.
---------------------------------------------------------------------------
\1\ ``Confidentiality of Individually-Identifiable Health
Information, Recommendations of the Secretary of Health and Human
Services, pursuant to section 264 of the Health Insurance Portability
and Accountability Act of 1996'' can be found on the HHS web site at:
.
---------------------------------------------------------------------------
HIPAA also requires that if Congress fails to enact
comprehensive privacy legislation by August of this year, HHS
must implement final regulations by February 2000. We have
assembled an interagency team to work on the regulations
including representatives from the Departments of Labor,
Defense, Commerce, the Social Security Administration, the
Veterans Administration and the Office of Management and
Budget. It is our intent to have the regulations prepared in
time to meet the statutory deadline.
While we are moving ahead to have the regulation ready, the
President and Secretary Shalala have made it very clear that
their first priority is to see Congress enact a comprehensive
health information privacy bill. Our staff have been working
closely with many of your staff, and staff in the Senate, to
assist you in achieving that goal. Again, let me reiterate, we
want to see legislation, and we want to work with you to make
that happen.
The issue of health information privacy is quite complex--
in order to resolve it legislatively, some difficult choices
will have to be made. We believe that our recommendations
strike the appropriate balance between the privacy needs of our
citizens and the critical needs of our health care system and
our nation. This is an issue that touches every single
American, and to reach resolution we will need a bipartisan
effort.
The Need for Legislation
It has been 25 years since former HEW Secretary Elliot
Richardson set forth principles that led to the landmark
Federal Privacy Act. Those 25 years have brought vast changes
in our health care system.
Revolutions in our health care delivery system mean that we
must place our trust in entire networks of insurers and health
care professionals--both public and private. The computer and
telecommunications revolutions mean that information no longer
exists in one place--it can travel in real time to many
hospitals, physicians, insurers, and across state lines.
In addition, revolutions in biology mean that a whole new
world of genetic tests have the potential to either help
prevent disease or reveal the most personal health information
of a family. Without safeguards to assure citizens that getting
tested will not endanger their families' privacy or health
insurance, we could endanger one of the most promising areas of
research our nation has ever seen.
Health care privacy can be safeguarded. It must be done
with national legislation, national education, and an on-going
national conversation.
Currently, when we give a physician or health insurance
company precious health information, the level of protection
will vary widely from state to state. We have no comprehensive
federal health information privacy standards. Because the
practice of health care is increasingly becoming interstate
through mergers, complex contractual relationships and enhanced
telecommunications, we need strong federal standards.
Establishing a baseline that provides uniformity will help
reassure the public that they can trust their providers and
insurers to keep their health information secure.
In developing our recommendations for federal legislation,
we learned a great deal through consultations with a variety of
outside groups and from six days of public hearings conducted
by the National Committee on Vital and Health Statistics, our
statutory federal advisory committee for health data and
privacy policy. The hearings involved over 40 witnesses from
across the health community, including health care
professionals, plans, insurance companies, the privacy
community, and the public health and research communities.
We believe our recommendations provide a balanced framework
for legislation that can protect the privacy of medical
records, guarantee consumers the right to inspect their
records, and punish unauthorized disclosures of personal health
data by hospitals, insurers, health plans, drug companies or
others.
The Principles
The Secretary's recommendations for legislation are
grounded in five key principles: Boundaries, Security, Consumer
Control, Accountability, and Public Responsibility.
Boundaries
The first is the principle of Boundaries: With very few
exceptions, personally identifiable health care information
should be disclosed for health purposes and health purposes
only. It should be easy to use it for those purposes, and very
difficult to use it for other purposes.
For example, employers should be able to use the
information furnished by their employers to provide on-site
care or to administer a health plan in the best interests of
those employees. But those same employers should not be able to
use information obtained for health care purposes to
discriminate against individuals when making employment
decisions--such as hiring, firing, placements and promotions.
To enforce these boundaries, we recommend strong penalties for
the inappropriate use or disclosure of medical records.
We recommend that the legislation apply specifically to
providers and payers, and to anyone who receives health
information from a provider or payer, either with the
authorization of the patient or as authorized explicitly by
legislation.
However, our recommendations acknowledge that these
providers and payers do not act alone. In order for a provider
or payer to operate efficiently, it may need to enlist a
service organization to perform an administrative or
operational function. For example, a hospital may hire an
organization to encode and process bills, or a managed care
organization may contract with a pharmaceutical benefit
management company to provide information to pharmacists about
what medications are covered and appropriate for their
customers.
The numbers and types of service organizations are
increasing every day. While most do not have direct
relationships with the patients, they do have access to their
personal health care information. Therefore, we recommend that
they should be bound by the same standards. For example, a
health plan's contractor should be allowed to have access to
patient lists in order to do mailings to remind patients to
schedule appointments for preventive care. But it should not be
able to sell the patient lists to a pharmaceutical company for
a direct mailing announcing a new product.
Because we recommend a minimum floor of protection for all
records, our report does not distinguish among types of health
care information based on sensitivity. For example, our
recommendations do not include specific provisions related to
genetic information in health records. Genetic information
should be covered by the same rules. However, we recognize that
the public is especially concerned about the unique properties
of genetic information--its predictive nature, and its link to
personal identity and kinship and its ability to reveal our
family secrets.
Therefore while you are developing privacy legislation, you
should also consider how to limit the collection and disclosure
of genetic information and prohibit health insurers and
employers from discriminating against individuals on the basis
of their genetic information. Because of the speedy development
of genetic technologies and its potential for abuse, we
recommend that legislation concerning discrimination in
underwriting by insurers or other improper use of such
information be considered expeditiously. We look forward to
continuing our work with you on this issue.
Security
The second principle is Security. Americans need to feel
secure that when they give out personal health care
information, they are leaving it in good hands. Information
should not be used or given out unless either the patient
authorizes it or there is a clear legal basis for doing so.
There are many different ways that private information like
your blood tests could become public. People who are allowed to
see it--such as lab technicians--can misuse it either
carelessly or intentionally. And people who should not be
seeing it--such as marketers--can find a way to access it,
either because the organization holding the information doesn't
have proper safeguards or the marketers can find an easy way
around the safeguards. To give Americans the security they
expect and deserve, Congress should develop legislation that
requires those who legally receive health information to take
reasonable steps to safeguard it and face consequences for
failure to do so.
What do we mean by reasonable steps? The organizations
should adopt protective administrative and management
techniques, educate their employees, and impose disciplinary
sanctions against employees who use information improperly.
We are addressing some of these steps in our Security
Standards regulation, implementing the Administrative
Simplification mandate under HIPAA. Our NPRM laid out a range
of approaches for safeguarding the information to which the
HIPAA mandate applies. However, that regulation will only cover
the security of specific electronically maintained records. We
need comprehensive privacy legislation to cover all health
information that needs this kind of protection.
We don't believe a law can specify the details of these
protections because each organization must keep pace with the
new threats to our privacy and the technology that can either
abate or exacerbate them. But a federal law can require
everyone who holds health information to have these types of
safeguards in place and specify the appropriate sanctions if
the information is improperly disclosed.
Consumer Control
The third principle is Consumer Control. The principles of
fair information practice (formulated in 1973 by a committee
appointed by Secretary Richardson) included as a basic right:
``There must be a way for an individual to find out what
information about him is in a record and how it is used.''
With very narrow exceptions, consumers should have the
right to find out what is contained in their records, find out
who has looked at them, and to inspect, copy and, if necessary,
correct them. Consumers should be given a clear explanation of
these rights and they should understand how organizations will
use their information. Let me give you an example of why this
is important. According to the Privacy Rights Clearinghouse, a
California physician in private practice was having trouble
getting health, disability, and life insurance. She ordered a
copy of her report from the Medical Information Bureau--an
information service used by many insurance companies. It
included information showing that she had a heart condition and
Alzheimer's disease. There was only one problem. None of it was
true. Unfortunately, under the current system these types of
errors occur all too often. Consumers often do not have access
to their own health records and even those who do are not
always able to correct some of the most egregious errors.
With that in mind, our recommendations set forth a set of
practices and procedures that would require that insurers and
health care providers provide consumers with a written
explanation detailing who has access to their information and
how that information will be used, how they can restrict or
limit access to it, and what their rights are if their
information is disclosed improperly.
We also recommend procedures for patients to inspect and
copy their information, and set out the very limited
circumstances under which patient inspection should be properly
denied.
Finally, we recommend a process for patients to seek
corrections or amendments to their health information to
resolve situations in which innocent coding errors cause
patients to be charged for procedures they never received, or
to be on record as having conditions or medical histories that
are inaccurate.
Accountability
The fourth principle is Accountability. If you are using
information improperly, you should be punished. This flows
directly from the second principle of security--the requirement
to safeguard information must be followed by real and severe
penalties for violations. Congress should send the message that
protecting the confidentiality of health information is vitally
important, and that people who violate that confidence will be
held accountable.
We recommend that offenders should be subject to criminal
felony penalties if they knowingly obtain or use health care
information in violation of the standards outlined in our
report. The penalties mandated in privacy legislation should be
higher when violations are for monetary gain, similar to those
Congress mandated in the administrative simplification
provisions of HIPAA. In addition, when there is a demonstrated
pattern or practice of unauthorized disclosure, those
committing it should be subject to civil monetary penalties.
In addition to punishing the perpetrators, we must give
redress to the victims. We believe that any individual whose
privacy rights have been violated--whether those rights were
violated negligently or knowingly--should be permitted to bring
a legal action for actual damages and equitable relief. When
the violation is done knowingly, attorney's fees and punitive
damages should be available.
These first four principles--Boundaries, Security, Consumer
Control and Accountability--must be carefully weighed against
the fifth principle, Public Responsibility.
Public Responsibility
Just like our free speech rights, privacy rights can never
be absolute. We have other critical--yet often competing--
interests and goals. We must balance our protections of privacy
with our public responsibility to support national priorities--
public health and safety, research, quality care, and our fight
against health care fraud and abuse and other unlawful
activities.
Our Department is acutely aware of the need to use personal
health information for each of these national priorities. For
example, HHS auditors use health records to uncover kickbacks,
overpayments and other fraudulent activity. Researchers have
used health records to help us fight childhood leukemia and
uncover the link between DES and reproductive cancers. Public
health agencies use health records to warn us of outbreaks of
emerging infectious diseases. In addition, our efforts to
improve quality in our health care system depend on our ability
to review health information to determine how well health
institutions and health professionals are caring for patients.
For public health and safety, research, quality
evaluations, fraud investigations, and legitimate law
enforcement purposes, it's not always possible, or desirable,
to ask for each patient's permission for access to the
necessary health information. And, in many cases, doing so
could create major obstacles in our efforts. While we must be
able to use identifiable information when necessary for these
purposes, we should use information that is not identifiable as
much as possible.
To demonstrate how access must be balanced against public
responsibility, let me outline a few of the areas in which we
recommend that disclosure of health information should be
permitted without patient authorization.
Public Health
Under certain circumstances, we recommend permitting health
care professionals, payers, and those receiving information
from them to disclose health information without patient
authorization to public health authorities for disease
reporting, adverse event reporting, public health
investigation, or intervention. This is currently how the
public health system operates under existing State and federal
laws.
For example, consider the outbreak of E. coli in hamburger
that resulted in the largest recall of meat products in
history. Public health authorities, working with other
officials, used personally identifiable information to identify
quickly the source of the outbreak and thereby prevent
thousands of other Americans from being exposed to a
contaminated product.
Research
An important mission for the Department of Health and Human
Services is to fund and conduct health research. We understand
that research is vitally important to our health care and to
progress in medical care. Legislation should not impede this
activity.
Today the Federal Policy for Protection of Human Subjects
and FDA's Human Subject Regulations protect participants in
most research studies that are funded or regulated by the
federal government. These rules have worked well to protect the
privacy of individuals while not impeding the conduct of
research. We recommend that similar privacy protections should
be extended to all research in which individually identifiable
health information is disclosed, and not just federally funded
or regulated research.
All researchers must determine whether their research
requires the retention of personal identifiers. There are
research studies that can only be conducted if identifiers are
retained; for example, outcomes studies for heart attack
victims or the recent study which identified a correlation
between the incidence of Sudden Infant Death Syndrome and the
infant's sleep position. If, and when, personal identifiers are
no longer needed, the researcher should be required to remove
them and provide assurances that the information will be
protected from improper use and unauthorized additional
disclosures.
Under the Common Rule, if personal identifiers are
necessary, an IRB must review the research proposal and
determine whether informed consent is required or may be
waived. In order for informed consent to be waived, an IRB must
determine that the research involves no more than minimal risk
to participants, that the absence of informed consent will not
adversely affect the rights or welfare of participants, and
that conducting the research would be impracticable if consent
were required. This or a similar mechanism of review should be
applicable for all research using individually identifiable
health information without informed consent regardless of
funding source.
This recommendation is consistent with the Federal Policy
for the Protection of Human Subjects as well as the Privacy
Act--policies that have protected federal research participants
and research records for a quarter of a century and that have
saved lives and fostered countless improvements in medical
treatment.
Preemption
Our recommendations call for national standards. But, we do
not recommend outright or overall federal preemption of
existing State laws that are more protective of health
information.
Some protections that we recommend may be stronger than
some existing State laws. Therefore, we recommend that Federal
legislation replace State law only when the State law is less
protective than the Federal law. Thus, the confidentiality
protections provided would be cumulative and the Federal
legislation would provide every American with a basic set of
rights with respect to health information.
Conclusion
Mr. Chairman, the five principles embodied in our
recommendations--Boundaries, Security, Consumer Control,
Accountability, and Public Responsibility--should guide a
comprehensive law that will create substantive federal
standards and provide our citizens with real peace of mind.
The principles represent a practical, comprehensive and
balanced strategy to protect health care information that is
collected, shared, and used in an increasingly complex world.
In addition to creating new federal standards, we must
ensure that every single person who comes in contact with
health care information understands why it is important to keep
the information safe, how it can be kept safe, and what will be
the consequences for failing to keep it safe. Most of all, we
must help consumers understand not just their privacy rights,
but also their responsibilities to ask questions and demand
answers--to become active participants in their health care.
We cannot expect to solve these problems all at once. With
changes in medical practices and technology occurring every
day, we need to be flexible, to change course if our strategy
isn't working and meet new challenges as they arise.
Mr. Chairman, we in the Department and the Administration
are eager to work with you to enact strong national medical
privacy legislation.
Thank you again, for giving me this opportunity to testify.
My colleagues and I look forward to answering any questions
that you may have.
Chairman Thomas. Thank you very much, Doctor.
Ms. Aronovitz.
STATEMENT OF LESLIE G. ARONOVITZ, ASSOCIATE DIRECTOR, HEALTH
FINANCING AND PUBLIC HEALTH ISSUES, HEALTH, EDUCATION, AND
HUMAN SERVICES DIVISION, U.S. GENERAL ACCOUNTING OFFICE
Ms. Aronovitz. Mr. Chairman and Members of the
Subcommittee, we are pleased to be here today as you discuss
the various issues associated with protecting the privacy of
personally identifiable information.
For the last several months, we have been studying the
manner in which HCFA protects personally identifiable health
information it collects on Medicare beneficiaries, and we are
releasing our report today at this hearing.
Mr. Hash has mentioned some of the initiatives HCFA is
undertaking. I would like to step back a bit and provide some
information on our study.
To carry out its legislative responsibilities, HCFA needs
to collect and maintain personally identifiable information on
its 39 million Medicare beneficiaries. For example, it needs
personally identifiable information about beneficiaries'
demographics, enrollment and utilization of health care
services to pay claims, determine the initial and ongoing
eligibility of beneficiaries and review the care beneficiaries
receive in terms of access, appropriateness and quality. HCFA
also uses this information in essential research activities
that can lead to improvements in rate setting, services
provided, and quality of care.
We found that HCFA's policies and practices regarding
disclosing personally identifiable health information are
generally consistent with the provisions of the Privacy Act.
When beneficiaries first sign up for Medicare and then when
they receive care or participate in a demonstration project,
for example, they receive notices that to different degrees
include a discussion about how their information might be used.
HCFA may disclose information without an individual's consent
under certain circumstances such as for research purposes or
authorized civil and criminal law enforcement activities.
In determining the validity of specific data requests, HCFA
attempts to balance the needs of the requesters with the need
to protect a beneficiary's confidentiality. Therefore, the
agency would screen requests for sensitive information from
non-HCFA researchers more thoroughly than it would from HCFA
staff who need the data to conduct the agency's business.
We did identify, however, some areas where HCFA needs to do
a better job to assure that personally identifiable information
is not intentionally or inadvertently shared with those not
authorized to have it. Specifically, the HHS OIG continues to
find vulnerabilities in HCFA and its contractors' management of
electronic information that could lead to individuals reading,
disclosing or simply tampering with confidential information.
In addition, because HCFA does not routinely monitor
contractors and others who obtain such sensitive information,
it cannot assure that those organizations are maintaining the
information in a safe manner.
This being said, we found that HCFA has actually received
very few complaints about Privacy Act violations to date.
Nevertheless, HCFA officials told us that they are in the
process of addressing the OIG's findings, to the extent that
resources permit, given the need to focus on Y2K computer
requirements in the short term, and that they are stepping up
their oversight efforts at their Medicare contractors to assure
that these organizations have established and are implementing
a sound security plan.
In regard to providing beneficiaries an accounting of the
disclosures it makes, which is a capability called for by the
Privacy Act, we found that HCFA would be hard pressed to do so
without a lot of effort. We also believe that HCFA could do a
better job in informing beneficiaries of the purposes to which
their information may be disclosed. To address these issues, as
Mr. Hash has mentioned, HCFA has established a new executive
Beneficiary Confidentiality Board and initiated a number of
actions in response to January 1999, OMB guidance to all
agencies to review information practices for compliance with
the Privacy Act.
The last area we looked at was the potential effect on HCFA
of State laws governing privacy. We found that some States
prohibit the disclosure of sensitive health-related information
except for very specific purposes. HCFA's practice has been to
respect State laws to the extent possible when these laws are
more restrictive than the Federal law. HCFA officials told us
that these State laws have not prevented the agency from
receiving information necessary for paying claims but may
change its policy as the agency develops and implements payment
systems that depend on diagnostic information.
If HCFA had to comply with the myriad of State laws
governing the receipt and use of health information, its
ability to set rates, monitor quality and conduct and support
health-related research could be hampered.
Currently, unlike the private sector, HCFA can invoke the
Supremacy Clause of the U.S. Constitution to get information it
needs to carry out its mission without regard to State
requirements, although it has not done so to date.
Mr. Chairman, this concludes my prepared statement, and I
also would be very happy to answer any questions you or the
other Members of the Subcommittee might have.
[The prepared statement follows:]
Statement of Leslie G. Aronovitz, Associate Director, Health Financing
and Public Health Issues, Health, Education, and Human Services
Division, U.S. General Accounting Office
Mr. Chairman and Members of the Subcommittee:
We are pleased to be here today to discuss how the Health
Care Financing Administration (HCFA) protects personally
identifiable health information on Medicare beneficiaries.
HCFA, an agency of the Department of Health and Human Services
(HHS), possesses the nation's largest collection of health care
data, with information on 39 million Medicare beneficiaries. To
operate the Medicare program, HCFA must collect personally
identifiable information on Medicare beneficiaries, such as
their names, addresses, and health insurance claims numbers, as
well their diagnostic and treatment information. HCFA uses this
information for a variety of purposes, including paying
approximately 900 million Medicare claims annually and
conducting health-related research to improve quality of care.
When a person signs up for Medicare, he or she might not
realize the variety of uses HCFA makes of his or her personally
identifiable information or that this personal information may
legitimately be disclosed by HCFA outside the agency.
The personally identifiable information that HCFA collects
on Medicare beneficiaries is protected by the Privacy Act of
1974. This law, which governs the collection, maintenance, and
disclosure of federal agency records, balances the government's
need to maintain information about individuals with their right
to be protected against unwarranted invasions of their privacy.
State laws also protect the privacy of certain personally
identifiable medical information, and vary significantly in
their scope and specific provisions. To create a more uniform
set of protections, the Health Insurance Portability and
Accountability Act of 1996 (HIPAA) requires that, unless
Congress enacts a health privacy law establishing standards for
the electronic exchange of health information by August 21,
1999, HHS must promulgate such standards within the following 6
months.
Today, we are releasing a report you requested that focuses
on four areas related to HCFA's use of personally identifiable
information.\1\ They are:
---------------------------------------------------------------------------
\1\ MEDICARE: Improvements Needed to Enhance Protection of
Confidential Health Information (GAO/HEHS-99-140, July 20, 1999).
---------------------------------------------------------------------------
HCFA's need for personally identifiable health
information to manage the Medicare program;
HCFA's policies and practices regarding disclosure
of information on Medicare beneficiaries to other
organizations;
The adequacy of HCFA's safeguards for protecting
the confidentiality of electronic information and its
monitoring of other organizations that obtain information on
Medicare beneficiaries; and
The effect on HCFA of state restrictions on the
disclosure of confidential health information.
To develop our findings, we interviewed HCFA officials and
reviewed documents HCFA provided on its confidentiality
policies and procedures. We also reviewed guidance from the
Office of Management and Budget (OMB) related to the Privacy
Act, financial statement audits of HCFA from the HHS Office of
Inspector General (OIG), and HCFA's plan for addressing
problems identified in OIG audits. In addition, we examined the
privacy protections of a number of state laws and obtained
comments from HCFA officials about the effects of such laws on
the management of the Medicare program.
In summary, we found that personally identifiable
information on Medicare beneficiaries is vital to the operation
of the Medicare program, and that HCFA can disclose such
information to other organizations consistent with provisions
of the Privacy Act. HCFA has policies and procedures for
evaluating requests for disclosure of personally identifiable
health information, but HCFA's confidentiality practices have a
number of weaknesses. These weaknesses include HCFA's inability
to easily provide beneficiaries with an accounting of
disclosures made of their personal information and failure to
always give them clear notification of the purposes for which
their personal information may be disclosed outside of HCFA as
required by the Privacy Act. Although few complaints of
violations have been reported to date, the HHS OIG also
continues to report vulnerabilities in HCFA's safeguards for
confidentiality of electronic information. These
vulnerabilities could lead to unauthorized individuals reading,
disclosing, or altering confidential information. Finally,
potential conflicts exist between HCFA and state laws regarding
the disclosure of sensitive health information. To date,
conflicts have been minimal and the administration of Medicare
has not been hindered, according to HCFA officials, because all
states permit release of information for health care treatment
and payment. However, if the same data elements were not
available from all states, it might compromise HCFA's ability
to conduct research and analysis to improve Medicare policies.
Background
In protecting the confidentiality of beneficiaries' health
information, HCFA's activities, like those of other federal
agencies, are governed by the Privacy Act of 1974. The Privacy
Act requires that agencies limit their maintenance of
individually identifiable records to those that are relevant
and necessary to accomplish an agency's mission. Federal
agencies store personally identifiable information in systems
of records. A system of records is a group of records under the
control of a federal agency from which information can be
retrieved using the name of an individual or an identifier such
as a number assigned to the individual. The Privacy Act defines
a record as any item, collection, or grouping of information
maintained by an agency that contains an individual's name or
other identifying information. A record, for example, could
include information on education, financial transactions, or
medical history. Under the Privacy Act, federal agencies must
inform the public when they create a new system of records or
revise an existing system. This is done through publication in
the Federal Register. A new system of records is announced when
an agency wishes to collect new data. Sixty-two of HCFA's 81
systems of records relate directly to Medicare beneficiaries
and include personally identifiable data on a Medicare
beneficiary's enrollment and entitlement to benefits;
demographic information such as age, race, ethnicity, and
language preference; and diagnostic and treatment information.
HCFA's systems of records contain information stored in
electronic and paper forms.
The Privacy Act generally prohibits the disclosure of
individuals' records without their consent. However, it allows
the disclosure of information without an individual's consent
under 12 circumstances called conditions of disclosure. One
example is disclosure by a federal agency to its employees
baseD on their need for the records to perform their duties.
Another condition of disclosure allows an agency to establish
routine uses under which information can be disclosed to a data
requestor. One routine use, for example, could be disclosure to
an individual or organization for a research project related to
an agency objective, such as prevention of disease or
disability in HCFA's case. To establish a routine use, the
agency must determine that a use is compatible with the
purposes for which the information was collected and they must
publish the notice of the routine use in the Federal Register.
While the Privacy Act permits agencies to disclose information,
it does not require that they do so; they can, for example,
determine that in a particular case, the individual's privacy
interest outweighs the public interest in disclosure.
HCFA Needs Personally Identifiable Information on Medicare
Beneficiaries
Personally identifiable information is essential to HCFA's
day-to-day administration of the Medicare program. Of primary
importance is the need of the agency and its contractors to use
personally identifiable information on Medicare patients to pay
approximately 900 million fee-for-service claims annually. HCFA
also uses this information to determine the initial and ongoing
eligibility of Medicare beneficiaries, determine risk-adjusted
payments, make monthly payments to about 400 Medicare managed
care plans, and track which managed care plans have been
selected by over 6 million Medicare beneficiaries. HCFA and its
contractors use beneficiary claims data containing personally
identifiable information to prevent fraud and abuse; administer
the Medicare Secondary Payer program;\2\ develop fee schedules
and payment rates used in fee-for-service claims processing;
review the access, appropriateness, and quality of care
received by beneficiaries; and conduct research and
demonstrations including the development and implementation of
new health care payment approaches and financing policies.
---------------------------------------------------------------------------
\2\ The Medicare Secondary Payer provision limits payment under
Medicare for otherwise covered items or services if that payment has
been made or can be reasonably expected to be made from another source
such as under a workmen's compensation law, automobile or liability
insurance policy, or certain health plans. In such cases, Medicare
payments for items or services are conditional payments and Medicare is
entitled to reimbursement from the other sources for the full amount of
Medicare payments.
---------------------------------------------------------------------------
HCFA Discloses Information About Beneficiaries for Authorized Purposes
In screening requests for identifiable information, HCFA
determines whether disclosure is authorized by the Privacy Act.
It also has different levels of review depending upon the type
of organization making a request for information. HCFA's policy
and practice is generally to limit disclosures to information
needed to accomplish the requestor's purposes. However, we
found weaknesses in its recordkeeping system for tracking and
reporting on disclosures and its notices to beneficiaries that
their information could be disclosed.
HCFA Screens Requests for Personally Identifiable Information
In making decisions about whether to disclose information,
HCFA's primary criterion is whether the disclosure is permitted
under a routine use or one of the 11 other Privacy Act
conditions of disclosure. HCFA can disclose information under
routine uses to publicly and privately funded researchers and
to public agencies such as the Agency for Health Care Policy
and Research for health services research projects; to
qualified state agencies for the purposes of determining,
evaluating, or assessing cost effectiveness or quality of
health care services provided in a state; and to insurers,
underwriters, employers who self-insure, and others for
coordination of benefits with the Medicare Secondary Payer
program.
When deciding whether to disclose personally identifiable
information, HCFA has different levels of review depending on
the type of organization making a request for information.
According to HCFA policy, HCFA employees and claims
administration contractors are provided access to personally
identifiable information only when they require such
information to perform their official duties. Other federal
agencies and organizations, such as state governments and law
enforcement agencies seeking information on Medicare
beneficiaries, must submit documentation, such as a signed data
use agreement that indicates their acceptance of the
confidentiality requirements of the Privacy Act and HCFA's data
use policies and procedures. These policies and procedures
include a requirement that the data user will not publish or
release information that could allow deduction of a
beneficiary's identity. When reviewing documentation from
requestors, HCFA determines whether the disclosure, is
permitted under a routine use for a system of records or other
condition of disclosure, as allowed by the Privacy Act. In
screening requests from outside researchers, HCFA also requires
the submission of a detailed study protocol. Further,
researchers must receive approval from the HCFA Administrator
when they request the names and addresses of Medicare
beneficiaries they intend to contact to collect new data.
HCFA Generally Limits Disclosures to Information Needed to
Accomplish Purposes
HCFA officials told us their practice is to disclose the
least amount of personally identifiable information that will
accomplish the purpose of the individual or organization making
the request. HCFA generally provides one of three types of data
files--public-use files, beneficiary-encrypted files, and files
which contain explicitly identifiable information. Public-use
files are stripped of identifying information on beneficiaries
and usually are summarized data. Beneficiary-encrypted files
are data sets in which HCFA has encoded or removed the health
insurance claim number, date of service, beneficiary name, or
beneficiary zip code. Explicitly identifiable files contain
such information as beneficiary names, addresses, and health
insurance claim numbers. HCFA officials said they direct
requestors whenever possible to either public use files or to
beneficiary-encrypted files rather than to the files containing
more identifiable beneficiary information. However, when HCFA
does disclose data files with personally identifiable
information, it generally does not customize them for the
specific purpose of reducing the amount of information
disclosed. HCFA officials told us that to do so would be a
resource-intensive process; however, they are now developing
software that will permit them to more easily customize data
elements in the future.
HCFA's Recordkeeping System for Tracking and Reporting Has
Weaknesses
Although Medicare beneficiaries have the right under the
Privacy Act to ask for and receive an accounting of disclosures
of their personally identifiable information and to examine or
amend their individual records, HCFA's recordkeeping system is
incapable of readily providing an accounting of disclosures to
beneficiaries. The Act requires that the accounting include
information on the nature and purpose of the disclosure and the
name and address of the person or organization to whom the
disclosure was made. HCFA officials told us that the agency's
computerized system for tracking disclosures cannot easily
generate information for an individual beneficiary on
disclosures made from HCFA's system of records. Weaknesses in
HCFA's recordkeeping system also affect its ability to report
on its Privacy Act activities to oversight agencies such as
OMB.
HCFA officials also told us that they are working on
improving their recordkeeping system to better account for
disclosures of personally identifiable information made by the
agency. HCFA officials said that, as directed by OMB, they have
begun reviewing their recordkeeping for Privacy Act activities.
In January 1999, OMB released guidance based on a May 14, 1998,
Presidential memorandum directing each agency to review its
information practices to ensure compliance with the Privacy
Act. HCFA has begun to address OMB guidance and officials told
us that they are reviewing routine uses that allow disclosure
of Medicare beneficiaries' information. In May 1999, HCFA
established an executive-level Beneficiary Confidentiality
Board to review strategic confidentiality issues including
HCFA's policies and procedures for disclosing personally
identifiable information.
Weaknesses in Notifications to Beneficiaries That Their
Information Could be Disclosed
The Privacy Act requires federal agencies to permit an
individual to find out what records pertaining to him or her
are collected, maintained, used, or disseminated by the
agencies. The Act requires an agency to notify individuals of
the following when it collects information: (1) the authority
under which the agency is collecting the information, (2) the
principal purpose for the information, (3) routine uses that
may be made of the information, and (4) whether the individual
is required to supply the information and the effects on the
individual of not providing it.
HCFA officials told us they use more than a dozen different
Privacy Act notifications when collecting information from
beneficiaries. Individuals' first exposure to a Medicare-
related Privacy Act notice is usually at the time of their
application for Social Security retirement benefits, when they
are provided with a multi-page Privacy Act notice. Approved
Social Security retirement benefit applicants are automatically
enrolled in Medicare at age 65. Beneficiaries should receive
other Privacy Act notifications whenever HCFA collects
information about them--for example, if they separately enroll
in Supplemental Medical Insurance (Medicare Part B), receive
medical care, or participate in a survey or a demonstration
project.\3\
---------------------------------------------------------------------------
\3\ Medicare Part B helps pay for doctors, outpatient hospital
care, and other medical services such as physical and occupational
therapy.
---------------------------------------------------------------------------
While some of the HCFA Privacy Act notification forms we
reviewed contain the required information, we found that others
do not tell beneficiaries the purposes for which their
information may be disclosed outside of HCFA, or they do so in
an unclear fashion. For example, a form for beneficiaries
receiving services in skilled nursing facilities provided the
required information, but the Privacy Act notice for Medicare
Part B enrollment did not identify the routine uses that would
be made of the beneficiary's information and provided only a
vague reference to the Federal Register as a source for such
information. We found similar problems in a form used to
collect information on end-stage renal disease beneficiaries.
Inadequate HCFA Safeguards Could Compromise Confidentiality
Although the procedures specified in HCFA's systems
security manual generally adhere to OMB's guidance for
safeguarding electronic information, HHS's OIG has identified
serious control weaknesses with HCFA's safeguarding of
confidential information.\4\ OIG's audits of fiscal years 1997
and 1998 financial statements identified a variety of problems
with HCFA's safeguards for electronic information at HCFA's
central office and for selected Medicare claims administration
contractors. The OIG reported the need for HCFA to implement an
overall security structure and discussed weaknesses in the
following areas: computer access controls (techniques to ensure
that only authorized persons access the computer system),
segregation of duties (the division of steps among different
individuals to reduce the risk that a single individual could
compromise security), and service continuity (the ability to
recover from a security violation and provide service
sufficient to meet the minimal needs of users of the system).
The OIG also reported problems with controls over operating
system software integrity and application development and
change controls. However, HCFA has reported few complaints of
potential Privacy Act violations.
---------------------------------------------------------------------------
\4\ HHS/OIG, Report on the Financial Statement Audit of the Health
Care Financing Administration for Fiscal Year 1996 (CIN: A-17-95-00096,
July 17, 1997); HHS/OIG, Report on the Financial Statement Audit of the
Health Care Financing Administration for Fiscal Year 1997 (CIN: A-17-
97-00097, Apr. 24, 1998); HHS/OIG, Report on the Financial Statement
Audit of the Health Care Financing Administration for Fiscal Year 1998
(CIN: A-17-98-00098, Feb. 26, 1999). See also Information Security:
Serious Weaknesses Place Critical Federal Operations and Assets at Risk
(GAO/AIMD-98-92, Sept. 23, 1998).
---------------------------------------------------------------------------
When the OIG conducted work at 12 Medicare contractors for
its fiscal year 1998 audit, auditors were able to penetrate
security and obtain access to sensitive Medicare data at 5 of
them. The auditors' ability to do so without using their formal
access privileges is of particular concern because unauthorized
users can exploit this security weakness in several ways, and
compromise confidential medical data.
Agency officials told us they are in the process of taking
action to correct the weaknesses identified by OIG. However,
HCFA's ability to make progress is currently affected by the
agency's efforts to address computer requirements for the year
2000 so that there will be no interruption of services and
claims payments. HCFA, consistent with priorities established
by OMB, has a moratorium on software and hardware changes until
it is compliant with year 2000 computer requirements. OIG will
evaluate the effectiveness of any corrective actions that HCFA
is able to implement during its fiscal year 1999 financial
statement audit.
HCFA Does Not Systematically Monitor How Organizations Protect
the Confidentiality of Medicare Data
Although HCFA has a process for monitoring systems security
at its claims administration contractors, agency officials told
us that competing demands and resource constraints have
prevented them from monitoring whether these organizations
follow OMB guidance for protecting the confidentiality of
information. HCFA officials told us that, other than OIG
reviews, there were no explicit on-site reviews of contractor's
security protections in fiscal years 1997 and 1998 because of
resource constraints and the assignment of staff to assess
contractor year 2000 computer requirements. However, HCFA did
initiate reviews of network security in 1998 for 12 Medicare
contracts at 4 of its 60 claims processing contractors.
In addition, HCFA officials told us that they do not have a
system for monitoring whether organizations outside of HCFA
have established safeguards for personally identifiable
information received from the agency. When organizations sign
data use agreements with HCFA, they agree to establish
appropriate administrative, technical, and physical safeguards,
providing a level and scope of security that is not less than
the level and scope established by OMB. Data use agreements
also include requirements that those receiving information from
HCFA use the data only for their HCFA-approved purpose and that
the data be returned to HCFA or destroyed upon completion of
the project. HCFA does not systematically monitor how the data
are being used. Although the agency follows up on expired data
use agreements, HCFA currently has a backlog of about 1,400
expired agreements. It expects to reduce the backlog by one-
half by September 30, 1999.
HCFA's failure to monitor contractors and others who use
personally identifiable Medicare information hampers HCFA's
ability to prevent the occurrence of problems and to provide
timely identification and corrective action for those that have
occurred.
Few Complaints of Privacy Act Violations Reported
The agency identified 7 complaints of potential violations
of the Privacy Act it has received and resolved in the past 4
years. Six complaints involved contractors conducting research
for HCFA, health data organizations, and individual
researchers; the seventh complaint was made by a Medicare
beneficiary's attorney. The first six complaints were raised by
similar organizations or other researchers and involved posting
of potentially identifiable Medicare billing information on an
Internet website, using and publishing data in a second
research project without authorization from HCFA, and offering
to share Medicare files at a national research conference. In
the first six cases, HCFA provided direction on Privacy Act
requirements to those involved. In the seventh case, HCFA
provided the beneficiary's attorney with a letter addressing
the issues raised.
HCFA reported only one internal disciplinary action within
the past 5 years relating to violations of HCFA's
confidentiality policies. This incident involved an agency
employee who was accessing beneficiary files more frequently
than appeared necessary for performing his job. The employee
admitted to looking at files of famous people. He was placed on
administrative leave and later signed an affidavit stating that
the files had not been sold or shared with other persons;
accordingly, he was allowed to resign.
Some States Restrict Disclosure of Sensitive Confidential Information
In its oversight of the Medicare program, HCFA necessarily
deals with beneficiaries and providers from every state.
Although states have laws governing the confidentiality of
health information, these laws vary significantly, resulting in
what has been called a patchwork system of protections. For
example, in Florida, mental health records are confidential and
may be disclosed only under limited circumstances.
Conflicts between HCFA and the states involving medical
record disclosures have been minimal, according to HCFA
officials, and HCFA officials believe its administration of the
Medicare program has not been hindered because all states
permit release of information for health care treatment and
payment. If a state law prohibited disclosure of information to
HCFA that was critical for these purposes, and a federal
statute required such disclosure, HCFA officials told us that
the agency would rely on the Supremacy Clause of the U.S.
Constitution and its express statutory authority.\5\
---------------------------------------------------------------------------
\5\ U.S. Const. Art. VI, cl.2. The Supreme Court has construed the
Supremacy Clause of the U.S. Constitution to hold that federal law
preempts state law where, for example: (1) the state law directly
conflicts with federal law, (2) the federal legislative scheme leaves
no room for state regulation, or (3) the state statute frustrates or
conflicts with the purposes of the federal law.
---------------------------------------------------------------------------
HCFA officials told us that if information is not critical
to HCFA operations, HCFA's policy is to respect and abide by
state laws that provide greater health records protection than
would otherwise be required by federal law or regulation. For
example, when California and Washington notified HCFA that laws
in their states did not authorize the disclosure of diagnostic
information related to the human immunodeficiency virus (HIV),
acquired immunodeficiency syndrome (AIDS) and sexually
transmitted diseases (STD), HCFA changed the system used to
collect and analyze certain nursing home information by
allowing the states to withhold diagnostic information
collected about HIV/AIDS and STDs for their nursing home
patients.\6\ HCFA told us that 15 states have exercised this
option by blanking out identifiable codes for HIV/AIDs or STDs
before submitting the requisite information to HCFA. According
to HCFA officials, the deletion of diagnostic information
collected about HIV/AIDS and STDs for nursing home patients
generally has not affected its operations. However, HCFA
officials told us that the agency will require diagnostic
information as it refines its new prospective payment system
for skilled nursing facilities as well as its other payment
systems and may, therefore, need to change its policy of
allowing states to withhold information.
---------------------------------------------------------------------------
\6\ The information is used by HCFA to track changes in health and
functional status of nursing home residents. The information system is
known as the National Minimum Data Set (Resident Assessment Instrument)
repository.
---------------------------------------------------------------------------
Restricting HCFA from receiving uniform health information
across the country could adversely affect internal operations
such as rate-setting and monitoring for quality assurance. It
could also affect the ability of analysts in HCFA, other
federal agencies, and non-governmental organizations to conduct
policy analysis and health services research because of the
difficulty in complying with varying state laws. If the same
data elements and health information were not available from
all states, HCFA's ability to conduct research and analysis to
improve Medicare policies might be compromised.
Conclusions and Recommendations
In its role as administrator and overseer of the nation's
Medicare program, HCFA must collect and maintain personally
identifiable information on millions of beneficiaries to
effectively operate and manage the program. As a steward of
confidential information, HCFA must balance its need to
effectively manage the Medicare program with the privacy
concerns of its beneficiaries. HCFA must protect beneficiaries'
health information from inappropriate or inadvertent
disclosures.
We found that HCFA's policies and practices are generally
consistent with Privacy Act protections. However, we also found
that the agency needs to do a better job implementing and
enforcing certain protections. As the HHS OIG has reported,
HCFA continues to have vulnerabilities in its information
management systems. In addition, HCFA has not consistently
monitored its claims administration contractors' safeguards for
protecting confidential information. We recognize that HCFA,
consistent with priorities set forth by OMB, has focused its
resources on ensuring that the agency and its contractors are
compliant with year 2000 computer requirements. Nonetheless, we
believe that reducing the vulnerabilities in its information
systems and increasing its monitoring of contractors are
important concerns that HCFA must address in the coming year.
HCFA also needs to better implement other aspects of its
confidentiality policies and practices. The agency does not
always fully and clearly inform beneficiaries that their
information may be disclosed. It also lacks the ability to
readily provide beneficiaries with an accounting of
disclosures. In addition, HCFA does not have a formal system
for monitoring the confidentiality protections of organizations
to which it discloses personally identifiable information. As a
result, HCFA is unable to systematically reduce the likelihood
of inappropriate use of the data or identify instances of such
misuse.
Although few complaints about Privacy Act violations have
been made to date, we believe that the weaknesses we and others
have identified potentially compromise the confidentiality of
health information on Medicare beneficiaries. However, HCFA has
begun some important initiatives that appear promising and
could improve its protection of Medicare beneficiary health
information. These include the creation of a new beneficiary
confidentiality board and actions taken in response to OMB
guidance for agencies to reevaluate the circumstances under
which they disclose information.
Our report makes recommendations to the HCFA Administrator
to improve HCFA's protection of the confidentiality of
personally identifiable information on Medicare beneficiaries.
In summary, we recommend that HCFA correct the vulnerabilities
identified in its information management systems by OIG,
systematically monitor contractors' safeguards for protecting
confidential information; develop a system to routinely monitor
other organizations that have received personally identifiable
information on Medicare beneficiaries; ensure that all agency
Privacy Act notifications contain the information required by
the Act in a form that is clear and informative to
beneficiaries, and implement a system that would permit HCFA to
respond in a timely fashion to beneficiary inquiries about
disclosure of their information outside HCFA as well as to
provide information on Privacy Act activities to OMB and
others.
-----
Mr. Chairman, this concludes my prepared statement. I would
be happy to answer any questions you or the Subcommittee
Members may have.
GAO Contacts and Acknowledgements
For future contacts regarding this testimony, please call
Leslie G. Aronovitz at (312) 220-7600 or Bruce D. Layton at
(202) 512-6837. Key contributors to this testimony include
Nancy Donovan, Bonnie Brown, Nila Garces-Osorio, Barry Bedrick,
and Julian Klazkin.
Related GAO Products
Medicare: Improvements Needed to Enhance Protection of
Confidential Health Information (GAO/HEHS-99-140, July 20,
1999).
Year 2000 Computing Challenge: Estimated Costs, Planned
Uses of Emergency Funding, and Future Implications (GAO/T-AIMD-
99-214, June 22, 1999).
Year 2000 Computing Crisis: Readiness of Medicare and the
Health Care Sector (GAO/T-AIMD-99-160, Apr. 27, 1999).
Financial Audit: 1998 Financial Report of the United States
Government (GAO/AIMD-99-130, Mar. 31, 1999).
Auditing the Nation's Finances: Fiscal Year 1998 Results
Highlight Major Issues Needing Resolution (GAO/T-AIMD-99-131,
Mar. 31, 1999).
Medical Records Privacy: Access Needed for Health Research,
but Oversight of Privacy Protections Is Limited (GAO/HEHS-99-
55, Feb. 24, 1999).
Year 2000 Computing Crisis: Readiness Improving, But Much
Work Remains to Avoid
Major Disruptions (GAO/T-AIMD-50, Jan. 20, 1999).
Major Management Challenges and Program Risks: Department
of Health and Human Services (GAO/OGC-99-7, Jan. 1999).
Medicare Computer Systems: Year 2000 Challenges Put
Benefits and Services in Jeopardy (GAO/AIMD-98-284, Sept. 28,
1998).
Information Security: Serious Weaknesses Place Critical
Federal Operations and Assets at Risk (GAO/AIMD-98-92, Sept.
23, 1998).
Chairman Thomas. Thank you very much.
Dr. Hamburg, it has been a source of frustration for many
of us that the administration has failed almost in every
instance to meet a date that was prescribed for it in law and
to provide information or structure dealing with the BBA in
terms of prospective payment structures of the rest. So that
source of frustration may indeed be finally useful in your
announcing that the administration plans to produce its
document on a particular timetable, and I feel comfortable that
that timetable will not be carried out. This is the first time
I feel good about the Administration not making a timetable.
Ms. Aronovitz, in the GAO report, on page 6, you indicate
that HCFA relies on, under current conditions, the disclosure
structure provided for in the Privacy Act dealing with release
of information to outside researchers and other entities; and
you also mentioned in your testimony and on page 14 and 15 you
note that HCFA's current recordkeeping system makes it almost
impossible for someone to go back and determine where all
someone's data was sent. And I know Dr. Hamburg mentioned an
HMO in terms of disclosing this information, and I appreciate
your pointing out this problem.
However, in looking at GAO information the way you have it
structured, Ms. Aronovitz, I don't see much of an indication of
the number of these disclosures. You talk about 1,400 expired
data use agreements. Now, the assumption is that covers a kind
of an understanding of what information is going to be provided
and what you are going to do with it, but those are expired
data use agreements, 1,400 of them. How many are out there that
are not expired? That would be one of the questions. How many
over a time period, 1 year, 5 years, has there been in terms of
agreements in which information has been moved? Do we have any
indication of the total number of agreements?
Ms. Aronovitz. No. It is actually quite a complicated
accounting process. When you think of the Privacy Act, we
usually think of a system of records, and that is the kind of
denominator which we use to try to figure out disclosures. We
could not get an accounting of the total number of times data
that were in a particular system of records were disclosed to
an outside requester.
Chairman Thomas. Is HCFA required to report Privacy Act
information activity and to whom is it supposed to report this?
Ms. Aronovitz. HCFA has two obligations. The first is to
the beneficiary, when the beneficiary asks for an accounting of
disclosures. We believe that, right now, a beneficiary would
probably have to wait for a while, because HCFA could not
readily provide that information. HCFA also must provide
certain types of information through HHS to OMB the information
to be provided to OMB concerns the number of beneficiaries who
have asked to access their own records.
Chairman Thomas. So the only information under the Privacy
Act that is kind of held responsible for telling folk you are
doing it is either to the individuals or the number of
individuals information? Who are these entities, for example,
on the 1,400 expired data use? Who would these agreements be
with, typically? I know they are expired, but it would be an
indication of who they would be with if they were alive.
Ms. Aronovitz. Data use agreements are used for a variety
of requesters of information from HCFA. They would be almost
everyone outside of HCFA itself.
Chairman Thomas. Who is everyone? Are these entities?
Mr. Hash. It would be HCFA, it would be researchers that
HCFA is sponsoring, research or non-HCFA sponsored researchers.
It could also be States or other Federal agencies.
Chairman Thomas. And there is no requirement that they list
or include who it is that they have transmitted this
information to on a Privacy Act report to OMB?
Mr. Hash. No, there is no requirement for disclosures to
third parties in the OMB. It is only to the number of times a
beneficiary has asked to access its own information.
Chairman Thomas. Thank you.
Do you volunteer this information anyway or do you follow
strictly the Privacy Act?
Mr. Hash. Mr. Chairman, we have been trying to follow the
Privacy Act. We have actually to my knowledge not recorded any
requests from beneficiaries for the information that Ms.
Aronovitz----.
Chairman Thomas. I am asking the question the other way. Do
you keep track of who it is, the entity that you enter into
these agreements with and to which you release personally
identifiable information?
Mr. Hash. We do.
Chairman Thomas. Then tell me how many you have entered
into over the last 1 year, 5 years.
Mr. Hash. I will have to get you that for the record, Mr.
Chairman.
Chairman Thomas. Do you believe you can get it for the
record?
Mr. Hash. I believe we can. I believe we could determine
the number of data use agreements that we have.
[The following was subsequently received:]
Within the last year 1,911 data use agreements were initiated. Of
these, 1,261 involve identifiable data and 650 involve encrypted data.
Within the last five years 5,167 data use agreements were initiated. Of
these, 3,950 involve identifiable data and 1,217 involve encrypted
data.
Chairman Thomas. OK. My problem is, if you can do that, Ms.
Aronovitz, my understanding is you interviewed HCFA folk, and
did you ask that question of them?
Ms. Aronovitz. The data use agreement is between the
researcher and HCFA. HCFA needs to be able to better account
for specifically what records they are disclosing on a
particular beneficiary.
Chairman Thomas. So we don't even know what information is
transmitted to these individuals? Or we do, but we can't recall
it after it is done?
Ms. Aronovitz. The details are kept in paper records filed
by the requester's name, not by an individual beneficiary or by
a system of records.
Chairman Thomas. Now I also noted in the GAO report that
HCFA indicated that what they did was follow the tail of the
comet, that is, they would review on the Internet, read
materials to see if any of this information was out there. And
it just kind of concerns me that they don't look at the comet,
they look at the tail of the comet, so it is already out there
before their detection structure would function; is that
correct?
Ms. Aronovitz. Yes. We think they need to do a much better
job doing more proactive monitoring of entities that they
provide information to, making sure that they are following
their data use agreements and, in fact, complying with the
provisions of those agreements.
Chairman Thomas. So, based upon Dr. Hamburg's testimony, I
could very comfortably ask her who has HCFA released individual
information out of HCFA to, and she probably wouldn't be able
to tell me who she released it to. Probably just as important,
she wouldn't be able to tell me what it was that was released,
unless of course it appeared on the Internet being misused if
your monitoring is 100 percent accurate after the fact. Is that
a reasonable statement of what we have got right now with
individualized records being sent out of HCFA to researchers
and other entities?
Ms. Aronovitz. I think it is reasonable. We would have to
say that it would take quite a lot of effort, for HCFA to get
that information.
Chairman Thomas. Mike, you want to respond?
Mr. Hash. Mr. Chairman, what I would like to say is that
we, in fact, do I think have, as I mentioned a moment ago, the
records, the data use agreements that we have entered into.
Chairman Thomas. And you know what it is that has been
transmitted under this agreement? You have a record of that?
Mr. Hash. We do. We do. What would take a greater effort
that was referred to was the identification specifically on a
beneficiary by beneficiary basis, what various systems of
record information was transmitted. It could be done, but
because we maintain our records on the basis of the data use
agreement, you would have to go in and manually identify the
individuals that were included in that data use agreement, but
we know what we gave and to whom we gave it.
Chairman Thomas. You know what you gave.
Mr. Hash. Correct.
Chairman Thomas. Including personalized medical record
information from an individual.
Mr. Hash. We know the systems of records that include
personally identified information that we made available to a
user under a data use agreement.
Chairman Thomas. And do you know they honored that use
agreement?
Mr. Hash. I believe except for the monitoring activity we
need to put into place stronger oversight of exactly whether
all of the users in these data use agreements are complying
with the requirements of the Privacy Act.
Chairman Thomas. I appreciate the answer. The question was,
do you know if they are living up to the agreement?
Mr. Hash. Not in every case, Mr. Chairman.
Chairman Thomas. And have you found some since, not in
every case, there are some who are not?
Mr. Hash. Very few.
Chairman Thomas. OK. What do you do with the few that you
find?
Mr. Hash. In the cases where people have violated the
Privacy Act, we have of course withdrawn, canceled their----.
Chairman Thomas. Don't you want to modify the statement to
say that in those instances when we are aware they have
violated the agreement?
Mr. Hash. In those instances, where we believe there has
been a violation of the Privacy Act by one of our----.
Chairman Thomas. No, that you are able to determine--see,
what you did was just go from a statement in which you don't do
a very good job of keeping track of it and you have discovered
some violations----.
Mr. Hash. Mr. Chairman, I think we do a good job of keeping
track of it. What we don't do as good a job of as we should is
in oversight with these users to make sure that, once they get
the data, they are in fact actually complying with the
requirements of the Privacy Act.
Chairman Thomas. And how many agreements are there today
in effect?
Mr. Hash. I will be happy to try to supply that to you for
the record. I don't have it with me, Mr. Chairman.
[The following was subsequently received:]
As of July 21, 1999, there are 4,377 data use agreements in effect.
Of these, 2,924 involve identifiable data and 1,453 involve encrypted
data. The majority are with government agencies and researchers under
contract to do work for the government; only 515 are not with Federal
or State agencies or researchers under contract to such agencies.
Chairman Thomas. OK. Now, GAO has identified, you know,
many uses that HCFA has with the individually identified
information. You got to do a lot of stuff. You have got payment
activities that you have to deal with that data, claims
processing. You do some utilization review. You got secondary
payment enforcement, eligibility determinations. What else?
Integrity activities, peer review, quality assurance.
Mr. Hash. Yes, sir.
Chairman Thomas. What else? I mean, some research----.
Mr. Hash. Yes, sir, for purposes of improving either our
payment policies or our quality improvement strategies.
Chairman Thomas. Yes. Would you classify the surveying of
individual claims files in order to determine something like,
say, the relative mammography rates of seniors in the
traditional fee for Medicare service program to be a quality
assurance activity?
Mr. Hash. I believe we would, Mr. Chairman.
Chairman Thomas. How about peer review and credentialing
activities?
Mr. Hash. If you mean by that organized systems of care,
Mr. Chairman?
Chairman Thomas. Yes, trying to take a look at who does
what in the credentialing area as a kind of, in my opinion, a
quality assurance procedure. Would you classify that, the
credentialing, the review of the ability to live up to the
agreement that was made for credentialing purposes, quality
assurance?
Mr. Hash. The situation that that suggests to me is that
the--only one area wherein we review applications of private
health plans and want to contract with Medicare and we look to
those private health plans to provide us information about
their credentialing procedures for health care professionals
who are going to serve our enrollees.
Chairman Thomas. OK. Let me give you an example. The
President's recent proposal said that he is interested in
moving toward a PPO, preferred provider organization structure,
and my assumption is you are going to have to do some
additional monitoring and perhaps some credentialing in that
regard. Would that be a quality assurance activity?
Mr. Hash. Well, we have been thinking about two approaches
to that, Mr. Chairman. One would be to contract with existing
PPO organizations that are already out there; and in that case,
obviously, we would be interested in assurances that they do
have some criteria for determining who gets admitted to their
PPO. We had not really anticipated, at least initially, that we
would be forming under that proposal our own PPOs.
Chairman Thomas. But it doesn't preclude that.
Mr. Hash. It does not.
Chairman Thomas. And this line of questioning was in part
to establish that, obviously, health information is sensitive,
it is important, but there are truly legitimate reasons beyond
treatment and payment that you need to utilize this kind of
data if for no other reason quality assurance but certainly in
terms of best practices and other activities I think are
important.
My real concern as we move forward in this is that we take
a look at where we are philosophically, where we may want to be
for public health purposes and, in fact, providing statistical
data to be able to assist in improving individual health care
and look at what is happening at the State level and the
ability of the Federal Government, notwithstanding the fact it
is a sovereign, to make sure all legitimate health entities
have the ability to do the same thing. And I am concerned about
the administration's position that they are less concerned
about what is happening at the State level because of the
sovereign position and HCFA's ability to collect information.
But the formation of a confidentiality structure which provides
for research collection needs to be looked at from a Federal
perspective, not just a government but a national perspective
for the data. Is there any reaction to that?
Dr. Hamburg. Well, I think that the Secretary's
recommendations definitely acknowledge the important point you
are making and identify research as an important area of
activity for disclosure of information, public health concerns,
quality of care and certain emergency situations as well.
Chairman Thomas. The gentleman from Wisconsin has already
had his position violated by the Secretary's concerns. So since
we have blown through his concerns, my concerns are this. I
understand the concept of a Federal floor and allowing States
to go beyond that. If we are dealing with things like clean
water, clean air, it doesn't make sense to me if you are
dealing with the collection of data to say there could be a
Federal floor but States can impose more stringent data in
particular areas. We may want to carve out other areas
completely.
I do not understand--and this is kind of a bizarre
relationship to me--a Republican advocating Federal preemption
in an area in which that folk at a cocktail party would think
that would be understanding the importance of the collection of
data for very fundamental and critical reasons in the private
sector as well as in the public sector. And this is an area I
think we need to resolve because I do not understand how, in
the collection of data for useful purposes, the administration
can comfortably say we will establish a floor and if the State
wants to go beyond that, that is OK with us. How ever in the
world you have an accurate, universally reliable data
collection system with that basic organizing concept doesn't
make sense to me, and I look forward to continuing to work with
you.
The gentleman from Wisconsin wishes to inquire?
Mr. Kleczka. Thank you, Chairman Thomas.
I don't believe the Secretary did violate my preamble for
privacy, because I never said it was an absolute right. I said
as the owner of those records I think I should have the right
to express my desire for privacy. Throughout the discussion of
the use of these records for research and for collection of
data I think we should consider, de-identifying the records. I
think, for billing purposes my name and data might have to be
attached to it, but for a lot of stuff we can de-identify the
medical record and let the research or whatever go forward.
Mr. Hash, first let me ask a question we are all wondering
and I guess everyone is kind of embarrassed to ask, how is the
mother to be?
Mr. Hash. I am glad you asked that. I just talked to her
today, and she is expected to deliver at any moment, so she is
very near the end of her odyssey and very excited about the
next phase of her life.
Mr. Kleczka. Well, we wish her well and the baby and the
father.
Let me ask one question. You indicated that HCFA has just
approved the creation of a Beneficiary Confidentiality Board,
which I assume is going to be akin to the Independent Review
Boards that States have and some individual private
organizations have. What do you envision the responsibility of
this confidentiality board to be?
Mr. Hash. Mr. Kleczka, I am glad you asked, because we felt
we needed a high-level organization within HCFA that pulled
together the leadership of the agency to focus on the strategic
questions about the kind of information that needed to be
collected to operate our programs, as well as the protections
that need to be in place to ensure patient and individual
confidentiality. And the mission of this new Beneficiary
Confidentiality Board is to develop procedures and policies
that will govern our decisions about the collection of
information on the front end, as well as our requirements for
data users and, in fact, our policies and procedures for
overseeing, as I mentioned to Chairman Thomas, compliance with
these procedures by anyone with whom we enter into a data use
agreement.
We are also anxious that this board be an opportunity to
examine the existing systems of records that we have to
determine whether they are properly secured, whether we in
fact, in another critical area, are making adequate notices
available to our beneficiaries so that in plain language they
know under what authority we are collecting the information and
specifically to what uses it could be put.
So these are the range of broad questions that we expect
this board to address; and, as I say, not only does it involve
our computer and information systems people, but it is actually
housed, for staffing purposes, in our Center for Beneficiary
Services to focus attention that this is all about protecting
the interests of our beneficiaries.
Mr. Kleczka. With the thousands of contractors that you
enter into agreements with across the country, have you seen
any violations of the beneficiaries' medical records by
contractors either through unauthorized viewing or sale of
information?
Mr. Hash. We are not aware of any serious violations. We
think there have been instances in which the procedures for
gaining access to personally identifiable information may have
been breached because individuals who were not authorized by
the nature of their work to have access may have been given
access. When we have learned of that, we have, you know,
revoked their access privileges and taken steps to tighten up
on the approval of access, but, to my knowledge, we do not have
any cases where the information has been sold or publicly
disclosed.
Mr. Kleczka. OK. In how many instances do you recall having
a problem with contractors with regard to unauthorized access?
Mr. Hash. How many instances?
Mr. Kleczka. How many instances? Do you have any numbers?
Mr. Hash. I think it is very few over the last 5 or 6
years. We looked back, and I think we only found one or two
altogether.
Mr. Kleczka. OK. When you deal with a patient's privacy and
the records that you are responsible for you comply with
Federal Privacy Act, but you also defer to State law; is that
accurate?
Mr. Hash. We generally do respect State laws. For the most
part, what we have found is that State laws do recognize the
kinds of needs that we have for personally identified
information in their own laws, for example, data for payment
purposes, data for fraud and abuse purposes and law
enforcement, and data for quality assurance. These are
typically treatment, payment and health care operations
exceptions that are found in State privacy laws, and those laws
have allowed us to continue to have access to the data we need
to operate our programs.
Mr. Kleczka. OK. I will get back to Ms. Hamburg on the
second round with some preemption questions. Thank you.
Chairman Thomas. Gentlewoman from Connecticut wishes to
inquire?
Mrs. Johnson of Connecticut. I thank you for your testimony
today.
I want to talk a little bit more about this patient opt-out
power as well and particularly how it interfaces with the floor
proposal. If a patient has the right to opt-out, and I am very
sympathetic to the opt-out provision but I want to understand
more clearly how it works, could a Medicare beneficiary elect
to withhold the fact that they had had a certain diagnosis?
Mr. Hash. I think you are addressing that to me, Mrs.
Johnson.
Mrs. Johnson of Connecticut. Well, whoever is best suited
to answer it.
In other words, could they elect to withhold this
information from the carrier, you know, from the payor? I want
to know how far their election rights go. The doctor knows it
clearly. Now if they can elect to withhold this information, I
might want to do exactly what my friend did with his dentist. I
might like to elect to withhold that I was diagnosed with
shingles for a fear that people would fear that I was hyper
responsive to stress-related illnesses. So, you know, how much
could they withhold actually from the carrier?
Mr. Hash. Well, the requirements in the Medicare Program
are really to submit a claim to us that provides sufficient
information on the claim form for us to determine if the
individual is eligible, that the service provided was covered,
and that is the basic information that comes in on a claim
form. And if a claim form was submitted to us without the
diagnostic information or without the identification of the
individual or their health insurance number, then our
contractor would be unable to process that claim.
Mrs. Johnson of Connecticut. OK. Then in terms--because I
want to go through a sort of series of these--in terms of
program activities that HCFA is responsible for, could an
individual elect not to let HCFA use specific data in research
and development of new payment methodologies? In other words, I
could see that they would have to submit the information so
there would be payment, but could they prevent you from having
access to that information for your own internal research and
policy development?
Mr. Hash. As I understand it, Mrs. Johnson, under our
current notices, and the authorizations that we seek from our
beneficiaries when they enroll in Medicare, allow us to make
the judgment about the use of their personally identified
information for purposes that may involve research related to
the improvement of the payments in the program or to quality
oversight or to fraud and abuse, those kinds of activities.
Mrs. Johnson of Connecticut. How specific is your
requirement to inform consumers and to ask for their
permission? Because in the next 5 years there are people who
are going to get much more sensitive to this whole issue and
are going to be making different decisions. So do you inform
them they have a right to withhold information and will there
be subcategories that you have a right to withhold your
information from researchers, you have a right to withhold
information from whomever?
Mr. Hash. That is not the substance of our notices that we
give under the Privacy Act now. They do not have the option to
sub-limit the use of the data for the kinds of examples that
you were using.
Mrs. Johnson of Connecticut. So when they say disclose or
not disclose, do they know to whom the information may be
disclosed and to whom it may not be disclosed?
Mr. Hash. Of course they don't know specifically to whom it
may be disclosed, but they do know that it may be disclosed for
a series of purposes, and those purposes are indicated in the
notice.
Mrs. Johnson of Connecticut. And if they indicate they
don't want disclosure, do you interpret that to mean that you
simply can't disclose to an outside contractor but you can
disclose within your agency? Do you say that you can disclose
to other Federal agencies but not to outside contractors?
Ms. Aronovitz. My understanding right now is that on a
notice it is a blanket notification. We actually looked at some
notices that say, if you do not sign this form, you will not be
able to get benefits from Medicare.
Mrs. Johnson of Connecticut. That is not an opt-out to say
if you don't sign disclosure you don't get benefits under
Medicare. This is a sledgehammer.
Ms. Aronovitz. We don't consider that an opt-out.
Mrs. Johnson of Connecticut. Oh, I see.
Ms. Aronovitz. If there is an opt-out policy----.
Chairman Thomas. It may be a literal opt-out, depending
upon what options you need and medical service.
Ms. Aronovitz. Currently, we don't see HCFA having an opt-
out policy.
Mr. Hash. To my knowledge, we do not.
Mrs. Johnson of Connecticut. I thought you were
recommending an opt-out policy.
Mr. Hash. I am not aware of that, Mrs. Johnson.
Mrs. Johnson of Connecticut. My impression is that in your
recommendations you are proposing an opt-out policy. So I kind
of assumed from that, which I did not have the right to assume,
that if you are recommending an opt-out policy you must already
have one.
Mr. Hash. Perhaps this will be helpful, Mrs. Johnson. We do
have a procedure where if a researcher wants to contact an
individual about their participation in a survey or some kind
of a research protocol that we first contact that individual by
letter and indicate to them that they may elect not to
participate in such an activity if they do not want to. And
that is an area of patient choice, if you will, or opt-out that
we do routinely apply if the research protocol involves
contacting an individual directly and asking them for
participation in a research protocol.
Ms. Aronovitz. There is another example that might be
useful. Some of the notices that we looked at specifically said
if you don't sign this form you will not get Medicare benefits.
The OASIS notification, which we think is an improvement over
some of the other notices, does have language that specifically
states there are no Federal requirements for home health
agencies to refuse you services if you do not provide this
information. However, it takes a little bit of fortitude to
really understand what it says.
Mrs. Johnson of Connecticut. Sort of a backhanded way of
saying that you can get the services even if you refuse to
disclose.
Ms. Aronovitz. Right, in this particular case. So there
could be instances where you would not lose your benefits.
Mrs. Johnson of Connecticut. So there is not currently any
requirement that when you sign up for Medicare you have the
right to sign a waiver that says you may not release my medical
information.
Ms. Aronovitz. As far as we know, that is correct.
Mr. Hash. I believe that is correct. The authorization that
beneficiaries sign when they enroll in Medicare is a broad
authorization.
Mrs. Johnson of Connecticut. Thank you. I will pursue this
later, but I think in the new world this is a very big issue.
Thanks.
Chairman Thomas. Gentleman from Minnesota wishes to
inquire?
Mr. Ramstad. Thank you, Mr. Chairman. Thank you to today's
witnesses.
As a former adjunct professor of constitutional law, the
more I get into this area I am beginning to reach the
conclusion that health care privacy is an oxymoron given the
state of technology, and I am real concerned about the right to
privacy, the zone of privacy as the Supreme Court has talked
about, that we supposedly have through the first, fourth, fifth
and 14th amendments to the Constitution.
And I don't understand, if I may address the first question
to you, please, Mr. Hash, according to the GAO critique, the
report, when HCFA discloses data files with personally
identifiable information it doesn't customize them for the
specific purpose of reducing the amount of information. Now, I
thought this was departmental policy pursuant to the 1997 HHS
recommendations on privacy, and does this mean that they are
ignoring the issue of customizing the data you disclose?
Mr. Hash. I think maybe, and I will let Ms. Aronovitz speak
to that, but I think what we mean by customization is that at
HCFA when we review a request for personally identified
information for a research purpose, we actually go through a
kind of three-stage evaluation. We have what are called public
use tapes which have a lot of aggregated data which do not
identify individuals; and we see if, in fact, research can be
conducted with a public use tape.
We have a second level of release of data that involves the
encryption of identifying information. It is obviously
conceivable that with that data set you could identify
individuals, but it would be difficult.
But we then, last, only as a last resort do we actually
release a data file with person-specific identifiers in it, and
only then when we have made a determination that there is no
other way to conduct the research and that the research is
vital to a purpose of administering our program.
Ms. Aronovitz. I would agree with that. However, if HCFA
decided that the only way to fulfill the research purpose was
to provide personally identifiable information, it does not
have the capacity to only provide the data elements that are
absolutely necessary to fulfill the research purpose. At that
point if HCFA felt that the researcher really only needed, let
us say, five data elements from that file that is where
customization would not occur.
Mr. Ramstad. And it is a question or an issue of capacity
of the resources?
Ms. Aronovitz. That is correct.
Mr. Ramstad. To customize to that degree?
Ms. Aronovitz. HCFA has said it is developing software that
in the future will enable it to do a much better job with
customization, but right now it doesn't have the capability.
Mr. Ramstad. Just recently I was privy to a demonstration
by a computer expert who accessed his file at Columbia
Presbyterian or wherever, revealed psychiatric data, other very
confidential, sensitive data. All I could think of was this is
Kafkaesque. I mean it was very, very unnerving, to say the
least, and it just seems to me that we need to, this session,
this year, we need to come to a consensus on a bill and get
this done sooner rather than later. Would all three of you
agree on that?
Mr. Hash. Yes.
Ms. Aronovitz. Yes.
Mr. Ramstad. And then, finally, I want to ask Ms. Aronovitz
a question just briefly in the remaining seconds I have. In
your GAO report, you mention that HCFA has not done much to
inform Medicare beneficiaries about their rights under the
Privacy Act. Could you elaborate on your findings? I mean, it
is disappointing when this Subcommittee did a lot of work
pursuant to the Balanced Budget amendment to ensure that
beneficiaries receive clear and complete information about the
Medicare Program, and I was just disappointed to read that
finding. I was just wondering if you could elaborate on that.
Ms. Aronovitz. As I said, the OASIS notification is an
improvement over prior ones. HCFA said it uses about a dozen or
so different types of notifications. When somebody signs up for
Medicare and then when they participate in the demonstration or
obtain health care, there would be a notification. The Privacy
Act requires a notification that has four elements, and they
are very straightforward. You have to tell the beneficiary your
authority for collecting the information, the principal
purposes you will use it for, all of the routine uses you will
make of the information and also the effects on the beneficiary
of not providing the information.
Well, first of all, we found that some of the forms HCFA
uses didn't have all these elements and, therefore, were
incomplete, in our judgment, in terms of providing information
to the beneficiary. However, interestingly, the Privacy Act
does not require HCFA anywhere on these notices to indicate
that beneficiaries have a right to get an account of the
disclosures that are made of their information. This type of
information did not appear on any of these notices.
Mr. Ramstad. Well, I see my time has expired, but I
appreciate the explanation. It only makes me wonder that
perhaps that is the reason so few seniors have ever contacted
HCFA to see their information or to see HCFA's accounting of
the disclosures it makes. But I look forward to working with
all three of you and others on re-establishing the right to
privacy in this country. A lot of this is truly alarming, and I
don't say that talking in hyperbolic tones. I am very
concerned, and I am glad to see you nodding affirmatively you
share that concern.
Thank you, Mr. Chairman.
Chairman Thomas. I thank the gentleman.
I do believe that it is a contest between public and
private rights, and there are significant public rights when it
comes to health and the effect that a single individual may
have on the public health, and these are sometimes competing
rights, and society historically has indicated that in certain
instances the public's right to know to deal with the public
health problem can even transcend privacy rights. And we are
going to try to deal with that in balancing it, not only in
after-the-fact information but hopefully in a successful prior-
to-the-fact management in a world in which it is far more
complicated with computers but ironically enough also simpler
in certain instances because of the ability to control the flow
of data via electronic means.
Gentlewoman from Florida wishes to inquire?
Mrs. Thurman. Thank you, Mr. Chairman, and it kind of goes
to that question.
Ms. Aronovitz, when I was looking over your report--and, of
course, it was basically to talk specifically about protecting
beneficiaries' confidential health information, one of the
things that struck me was that we talk about the security
weaknesses but we also talk about the moratorium that OMB has
placed on HCFA in securing or looking at any other kind of
computer software. Is that something we should look at
correcting to give them the tools that would be necessary to
help them in this job?
Ms. Aronovitz. Actually, the moratorium seems to be very
appropriate under the circumstances. We think, in our Y2K work,
that HCFA is facing quite a high risk in the fact that it is so
close to the end of the year. We understand that HCFA needs to
focus its resources on its immediate responsibility continuing
to be able to pay claims. Unfortunately, the moratorium had to
occur because it was one way for HCFA to assure itself that its
resources would be centered on that immediate problem.
However, we think that fixing the security systems for
privacy issues is extraordinarily important also and should be
addressed as soon as HCFA's systems have been tested and
certified as Y2K compliant.
Mrs. Thurman. And is that what OMB has indicated that, once
that is done, that those resources would be immediately
available for this particular issue, Mr. Hash?
Mr. Hash. Yes, Ms. Thurman, that is my understanding; and
it is certainly our intention that, once we pass the Y2K
period, that this issue of installing the appropriate
architecture for information technology security is our highest
priority with our contractors. Because it has been pointed out
to us by the GAO and by others that there are steps we can put
into place, new systems, new technology that mitigate the
possibility of breaches of those systems by unauthorized
persons, but, you know, this is an area where the technology is
racing ahead as fast as we can possibly think about keeping up
with it, and I think our real challenge is to remain vigilant
to the possibility that just when you think you may have a
computer system that cannot be hacked into, somebody will
undoubtedly be able to figure it out. But that doesn't relieve
us of the responsibility of taking all the steps we can to put
in the strongest security measures available.
Mrs. Thurman. So you all are working on this problem
somewhat consecutively with the Y2K? I mean, you are looking
for those ways, vendors, people who could in fact put in this
software?
Mr. Hash. We are. And, in fact, another aspect of this is
holding our contractors more accountable to, in our evaluation
of them, that they, in fact, have put into place the
appropriate kinds of security protections that are necessary to
protect this data. So we recognize, as I said to Chairman
Thomas earlier, that we need to strengthen our oversight of
those organizations that have access to this kind of
information to prevent unauthorized disclosures.
Mrs. Thurman. Thank you.
Chairman Thomas. I thank the gentlewoman.
Gentleman from Michigan wishes to inquire?
Mr. Camp. Thank you, Mr. Chairman.
I thank all three of you for testifying today.
Ms. Aronovitz, I have a question for you. In your testimony
you note that there are different needs that HCFA has for
individually identifiable information and that there are
beneficial uses of that information but, also, that there are
some problems in maintaining the security of that data, you
know, particularly regarding some of the administrative
procedures and managing this in the context of an information
system. What do you think the implications would be for HCFA if
they had to comply with 50 different State laws?
Ms. Aronovitz. I think that it would add a tremendous
complexity to their work and a burden and cost that we can't
estimate, but it could certainly create quite an additional
burden for them.
Mr. Camp. In addition, what if Medicare patients could
selectively demand that certain criteria were not or data
elements were not to be used for certain purposes?
Administratively, what do you think the impact and also that
that information couldn't be disclosed to certain employers or
employees or contractors?
Ms. Aronovitz. I am not an expert on HCFA's or anyone's
computer systems, but I certainly feel comfortable in saying
that the point that HCFA is at right now, if somebody were to
be very specific about the circumstance under which they wanted
their information to be used, it would be impossible for HCFA
to comply.
Mr. Camp. Would you agree that the private sector providers
would face the same administrative burdens if Federal law
wasn't preemptive and in fact might even be worse because they
wouldn't have the supremacy clause to ignore certain laws at
their discretion like HCFA might have?
Ms. Aronovitz. It seems as though they would have the same
burden.
On the other hand, we didn't really look at how they are
coping right now, and ostensibly there are companies that work
in more than one State or all 50 and somehow seem to figure out
how to get along, but we really don't know enough about how
they are doing it or the extent to which that burden could
convince some of them not to do commerce in the States.
Mr. Camp. Thank you very much.
Mr. Hash.
Mr. Hash. May I comment?
Mr. Camp. Yes.
Mr. Hash. I think there are a couple of observations I
would like to make, and that is, they are--first, it is
difficult to determine in advance exactly how States might in
the future design privacy laws. And as I mentioned at the
outset, our experience today has been that States have been
generally sensitive to the kinds of issues that are necessary
from our point of view to operate our programs and to meet our
fiduciary responsibilities as well as our quality oversight
responsibilities.
And so I think in that sense that ties into my second
observation which is that our position is, in the
administration, that we believe a strong Federal floor will
actually reduce the incentives for States to want to legislate
further in this area.
As an example, I might point out that in the HIPAA law
itself that Congress passed 3 years ago, it is basically
predicated on a notion of a very strong Federal floor, and to
date at least I think States have not been desirous of or felt
it was necessary to legislate beyond the HIPAA floor, and I
think that is why we are placing so much emphasis on working
with you and others to develop a Federal standard for
confidentiality and protection that will reduce the need for
additional State legislation.
Mr. Camp. Thank you. Thank you, Mr. Chairman.
Chairman Thomas. Well, to point out the absurdity of that
statement, if I might, Minnesota currently has a provision
which requires individual release for access to information. As
a matter of fact, Mayo Clinic built its record on its
epidemiological records which it now cannot do with any degree
of confidence because it can only get 97 percent sign-off.
When you are doing research in key areas, obviously any
hole in your data causes you problems. Let us take a Medicare
patient from Minnesota. If Johns Hopkins wants to utilize that
Medicare patient's medical records and tries to go through the
State of Minnesota, obviously, they are going to have go
through a sign-off procedure. I believe it is a three-denial
effort or get the permission of the individual to do it. If
Johns Hopkins goes to HCFA, can HCFA under the arrangement that
we were discussing release the information of that Medicare
patient who happens to live in Minnesota to Johns Hopkins?
Mr. Hash. The short answer is yes.
Chairman Thomas. And John Hopkins being a reputable
university and research structure would--of course you would be
pleased to enter into an agreement with them?
Mr. Hash. We would review their proposal as we do all other
research proposals to first see----.
Chairman Thomas. Careful, Ben is here and so you would
review it very quickly.
Mr. Hash. We would definitely review it in an expeditious
manner and ascertain that the proposal, in fact, that the
research questions being posed are ones that are important to
our program, that the methodology that the proposal includes is
one----.
Chairman Thomas. As young people say, yada, yada, yada. The
bottom line is, you will release that information to Johns
Hopkins without the approval of the individual, and if Johns
Hopkins tried to go through to get it from the State of
Minnesota, they would have to follow a different procedure.
Mr. Hash. I have to disagree with one statement you made,
Mr. Chairman, and that is, we would not release it without the
permission of the individual. The individual in Medicare has
already given their authorization for the use of these data to
advance the program.
Chairman Thomas. Let me see, I believe the trigger was you
won't get Medicare benefits if you don't sign this sheet.
Mr. Hash. I don't believe so, Mr. Chairman. We have a
variety of notices out there that when people sign up that
indicates that there is a possibility that we would use
personally identifiable data.
Chairman Thomas. What is the turn-down ratio of Medicare
benefits to people who refuse to receive Medicare benefits
because they won't sign the release data?
Mr. Hash. I am not aware that there are refusals, Mr.
Chairman.
Chairman Thomas. Well, all right, we can go around all
night on this if you want to. The answer you have given me,
once you filter all of the procedure, is Minnesota will not
release that information to Johns Hopkins unless the individual
person signs off or it goes through a very elaborate three-
denial check procedure.
Johns Hopkins can come and get it from HCFA without the
patient's knowledge, and in fact, although I know Johns Hopkins
wouldn't do it, based upon my earlier questions, Johns Hopkins
could provide the information, if they were someone other than
Johns Hopkins, to somebody else and unless it was done naked,
high noon in the town square, by the way you detect transfer of
information, cruising the net, you wouldn't know that it was
transferred.
So all I am saying is it makes it very difficult for me to
sit here and listen to you talk about building a floor and let
the States go beyond the floor and have a structure that makes
any sense at all because, as the sovereign, you are looking at
the world, in my opinion, slightly differently than a private
sector operation as reputable as Johns Hopkins in terms of its
ability to get information.
I understand why you are not concerned, you are the
sovereign, but this information is essential and I might say in
fact more valuable in some of the private research activities
in which the only way they are able to get the information is
to hide behind you, the sovereign.
So when you talk about building a floor and letting States
go beyond it, I think it gets kind of hypocritical when in fact
that same entity can come to you and get the information they
couldn't get from a State. It doesn't make a whole lot more
sense to build a uniform system that protects in a uniform way
and that lets folks opt-out in areas where there is general
agreement that it is necessary to allow under the police powers
of the State protections for those purposes, but otherwise a
uniform, structured, secure, confidential, preemption
arrangement is the better way to go.
Gentleman from Maryland I know wants to inquire, and let me
say before that, I am sorry he is no longer on the
Subcommittee. I know he had to make a choice and under
Democratic rules he became a powerful Ranking Member on another
Subcommittee, and we don't have him here, but it is a pleasure
to have him.
Mr. Cardin. Well, thank you, Mr. Chairman, and let me thank
you for your publicity on Johns Hopkins. I should point out it
is my understanding that Johns Hopkins has a request before NIH
for a research project related to dentistry. So I expect to get
my friend from Wisconsin and my friend from California
sponsoring that.
Let me, if I might, try to follow through on some of these
questions.
In regards to individually identified medical records you
are guided by the Privacy Act of 1974, I assume, and I have
just tried to quickly read that statute and find that the
language used there is significantly different than the
language we are using here.
I don't see, for example, fraud and abuse or quality
assurance or research or public health spelled out the same way
that we generally have used those terms, but I assume you
believe there is statutory authority within the Privacy Act of
1974 to release individually identified medical records for
those particular purposes. And I guess my question to you is,
we have been sort of dancing around this a bit, but if you were
to be required to comply with State law and if the States had
requirements for individual authorization for some of these
uses, or a requirement that you individually notify the
beneficiary of a request for information and an opportunity to
opt-out without any further sanction to their Medicare
benefits, is that workable for HCFA? Can you implement that? Is
it costly to implement, and do you think that is good policy?
Mr. Hash. Well, with regard to the last set of questions,
Mr. Cardin, we do have a procedure on research protocols that
involves contacting individual beneficiaries that gives them
the prior right to indicate that they do not want to
participate in such research protocols.
Mr. Cardin. How fast can you implement that? Is that a
pretty fast procedure?
Mr. Hash. It is a pretty fast procedure. It usually
involves a researcher who wants to draw a sample of our
beneficiaries to contact them for some purpose that is outlined
in their research proposal, and what we do is once we identify
a sample, we actually write individual letters to them and give
them this information about the opportunity to opt out if they
do not wish to participate in it.
Mr. Cardin. All right.
Chairman Thomas. Will the gentleman yield briefly? Even
Minnesota has a three follow-up kind of self-enacting
operation. What does HCFA have if you write the letter and
there is no response to the answer?
Mr. Hash. We write the letter and then we require the
researcher to wait a minimum of 10 days before contacting and
then contact and reinquire as to whether the individual wants
to participate or not, even though they have not replied to the
letter they got from us.
Mr. Cardin. If they don't reply, then that is assumed to be
you can't release the information?
Mr. Hash. This is a case again of, Mr. Cardin, when an
individual beneficiary is contacted by a researcher who wants
to interview them.
Mr. Cardin. If you don't get notification, they don't
reply, can you use the records or not, if the beneficiary
doesn't respond?
Mr. Hash. The researcher then may contact them and put the
question again.
Mr. Cardin. And there is still no response?
Mr. Hash. They contact them directly, you know, orally, by
telephone or by visit.
Mr. Cardin. So you need to get written authorization before
you release under that circumstance?
Mr. Hash. I don't know that it requires a written release,
but you have to get the authorization of the individual.
Mr. Cardin. How do you know if you don't have it in
writing?
Mr. Hash. I don't have an answer for that, Mr. Cardin, but
I think--well, except I think in the research protocol we
actually ask them to document the records about how they
contacted the sample.
Mr. Cardin. Mr. Hash, my time is running out. I really want
to get an answer to this.
We don't know what the States could enact in this area.
They could enact restrictions on your ability to use samples
for fraud and abuse for all we know because of their protection
on the individual's right of privacy, which is important. My
question to you is, if the State of Maryland enacts a law that
says you can't release information for fraud and abuse without
specific authorization signed by the beneficiary, do you think
that is a good policy to adhere to whatever the States indicate
is the right policy on release of medical records?
Mr. Hash. I would hope that that kind of a policy would be
built into the Federal floor that we are talking about, and
therefore, if there were a conflict with Maryland law, that the
Federal floor would obviously prevail there, but it is a
question of designing the requirements in a sound way in the
Federal floor to make sure we speak to those kinds of things.
Mr. Cardin. We are in complete agreement there, and I
expect there would be a cost associated, as I think you have
already responded, to trying to comply with 50 different State
standards as it relates to notice to the beneficiary and
authorization and opt-outs or things like that. There has got
to be a cost associated with that.
Mr. Hash. As I said, I think we need to address those
issues in the context of what we require as a kind of uniform
standard across all States.
Mr. Cardin. And one last point, if I might, and that is
that you said you were complying with the States to the extent
possible. I was just handed the Maryland--someone compiled a
book of all the different regulations--and in Maryland we have
a requirement that insurers cannot disclose information except
under a set of standards on release of information. Do you
comply with the Maryland rules on disclosure of information
currently?
Mr. Hash. I am not familiar with what the Maryland rules
are, Mr. Cardin, but I would assume they follow the same kind
of procedures that we follow under the Privacy Act, but I
think----.
Mr. Cardin. They are different. I am trying to match them
up, and they are clearly different standards. There are some
areas that are covered here that are not covered in the Privacy
Act. Some in the Privacy Act are not covered here.
Mr. Hash. We follow the Privacy Act.
Mr. Cardin. So you don't follow the Maryland general law on
disclosure of medical information by insurers?
Mr. Hash. I just would like to reserve the right to review
the Maryland law and see whether, in fact, we do or don't. But
without saying that, I am certain that we don't.
Mr. Cardin. Is there a conscientious effort to review the
laws of the 50 States to try to comply with their privacy acts?
Mr. Hash. Not to my knowledge, Mr. Cardin, no. But when it
is brought to our attention that someone asserts under a State
law a particular right or privilege, obviously that would
trigger our look at it and to see if there was a way that we
could work with the State and the individual to work through
that in a satisfactory manner. But as the Chairman points out,
there is always a question of trying to balance the important
rights of individuals to confidentiality and important rights
of the State.
Mr. Cardin. Well, I agree with your point and just
appreciate your comment. We need to adopt adequate national
standards in this area. I agree with the gentleman.
Chairman Thomas. I thank the gentleman. Where is HCFA's
headquarters?
Mr. Hash. In Baltimore, Maryland.
Chairman Thomas. I thank the gentleman.
Gentlewoman from Connecticut wishes to do a follow up?
Mrs. Johnson of Connecticut. Thank you, Mr. Chairman.
I just wanted to go back to the issue of privacy. Under
current practice at HCFA, do you routinely release individually
identifiable health information to these contractors? I am
talking about the payor contractor. I am talking about this
1,400 or so other people.
Mr. Hash. Researchers or other government agencies that
have data use agreements with us, we do not routinely release
individually identifiable data. It must go through the kinds of
evaluation that I have outlined that are in our testimony
before we do it. So we have a set of procedures to go through
to determine when we will release.
Mrs. Johnson of Connecticut. When do you ever need to
release individually identifiable data? I can see why you would
need to release disease and symptoms and treatment data, but
why would you have to have the person's name?
Mr. Hash. Well, for example, if we are engaged in an
activity of collecting a third party liability, coordinating
our benefits and trying to identify if the individual has
another insurance policy that is liable----.
Mrs. Johnson of Connecticut. I consider that a payment
problem.
Mr. Hash. OK. Within the context of research itself, there
can be research projects--and I would defer to Dr. Hamburg here
who is much more skilled in the research area than I am, but
there can be research projects that advance our knowledge in
terms of payment systems and how to do it more accurately or in
terms of quality oversight that could require the use of
personally identified information, but the presumption that we
use at HCFA is that we start with the notion of trying to
ascertain whether or not the research can be conducted
successfully without personally identified information. That is
where we start from, and only as a last resort do we agree to
release personally identified information.
Ms. Aronovitz. I might be able to offer one example. It
would be a longitudinal study, for instance, where you are
looking at a particular person over time and looking at their
health status over time. You might want to be able to identify
that person and their records.
Mrs. Johnson of Connecticut. And that person has no right
not to participate in that study? HCFA does not have to notify
them that their data are going to be used on a longitudinal
study?
Ms. Aronovitz. This is going to sound a bit bureaucratic,
but in fact the person has been notified through the routine
use conditions of disclosure that HCFA has in terms of guiding
whether it can give out information to researchers.
Mrs. Johnson of Connecticut. I am interested that there are
routine situations in which you would release somebody's
personally identifiable information outside of HCFA. I mean, I
understand for your payment system, but it seems to me that--
and I don't know what percentage of these use agreements
involve the release of individually identifiable information.
Do you have any? Any of you have any comment on that? Whether
it is most of them or--.
Mr. Hash. No. I think--as I say, I think our presumption is
either to provide aggregated data whenever we can or at least
encrypted data that is stripped of any individual----.
Mrs. Johnson of Connecticut. I appreciate that. The thing
is, you know, how many of your agreements provide individually
identifiable and how many provide encrypted data.
Mr. Hash. I would be happy to try to see if I can provide
that for the record.
Mrs. Johnson of Connecticut. I think we need to know that,
because I think in any bill we need to directly confront this
issue, and I personally think the burden is on us to make the
case that we wouldn't have to get permission.
[The following was subsequently received:]
As of July 21, 1999, there are 4,377 data use agreements in effect.
Of these, 2,924 involve identifiable data and 1,453 involve encrypted
data. The majority are with government agencies and researchers under
contract to do work for the government; only 515 are not with Federal
or State agencies or researchers under contract to such agencies.
[GRAPHIC] [TIFF OMITTED] T4128.001
Mr. Hash. Let me say if I may, Mrs. Johnson, that another
thing that comes to mind in terms of where an individual
identifier might be necessary in a research project, is when
someone might be trying to answer questions related to how
people were treated across different settings where there are
different data systems with the claims information, and the
only way to access that data across the different settings,
whether it is in-patient, hospital or outpatient or home health
or skilled nursing, is by being able to have the identifier
that can link the claims for an individual so that you can
actually see what happens to the patient from a hospital
episode to an outpatient episode to a home health episode and
answer some research questions associated with appropriate
types of care.
So that is an example of where, in order to access the data
on services that an individual has actually received, you can't
get it unless you have an identifier number that links that
data to a specific individual.
Mrs. Johnson of Connecticut [presiding]. I think it is very
concerning that people would not know when these data were
going to be used, that, you know, agreements that you have
literally no control over, you just really can't control the
number of agreements you are going to have, and really this
gives no privacy protection for Medicare participants when your
agency has allowed access by a researcher to their files.
So I think that we are not going to solve this here, but I
think as we move through this bill--I mean, when I look at the
battle that went on in H.R. 10 around privacy issues, health
issues information is just so much more important to people
individually that I think we are going to have to deal with
this up front and clean, and we can't sort of mask it behind
HCFA's judgment. At a certain point, if your information is
going to be released with your name identified to it----.
So, anyway, we need to move on to the next panel, but you
get the gist of my concerns.
Mr. Kleczka. I was waiting for the second round.
Mrs. Johnson of Connecticut. Briefly. They want us to move
on to the next panel because some of them have to leave.
Mr. Kleczka. I agree with the gentlelady that where to draw
that line is going to be very difficult for this Subcommittee
and for this Congress. Ms. Hamburg, in your testimony you
talked about the public responsibility. I agree with you that
an individual's privacy and medical privacy can never be
absolute. From the dialog that we have been listening to, some
people are stating there is an absolute right for all these
other entities and I am saying that is clearly wrong. I would
rather err on the side of personal privacy than going that way.
The gentlelady just referenced the bill we had before the
House the other day on banking modernization, H.R. 10. I am
sure you are aware of the controversy as it pertains to medical
records in that bill. Do you want to comment on that and also
briefly comment on this whole question of preemption? I am
getting very confused here.
First of all, we are told by the majority party that we
have to defer to State rights because that is where all the
knowledge and the power is. As a former legislator in the State
of Wisconsin, I totally disagree with that. But, nevertheless,
if they say so, maybe it is true.
The Senate debated the Patients' Bill of Rights and, they
argued that the States have to be recognized in their ultimate
power over the rights of patients in medical care, and so the
Senate only addressed the ERISA plans that cut down by almost
two-thirds the number of people covered by that bill.
Now on the other side of the Capitol, when it comes to
medical privacy, the arguments is be damned with States' rights
because we are the all-powerful and knowing.
And so I am saying, Mrs. Johnson, to you and your
Republican colleagues, make up your mind so I can get on the
same script with you. I want to be helpful, but if States
should have rights, let us do so. If States shouldn't have
rights, I might buy into that program, but we can't have it
both ways depending on the issue. The inconsistencies are
abundant.
Dr. Hamburg, would you want to respond--not to that last
point, but to the previous point on the modernization bill?
Dr. Hamburg. On H.R. 10?
Mr. Kleczka. H.R. 10 and the preemption issue. Those are
two big issues here.
Dr. Hamburg. Starting with the preemption issue, I think
obviously, as the discussion today has indicated and many other
discussions in recent months, it is a very complicated issue.
And as a relative newcomer to Washington and somewhat naive, I
have to say that I was originally confused about where people
were lining up on this issue. But I think that what we do all
agree on is that there is a need for a strong and comprehensive
set of national protections for privacy of health care
information and that we need to be very thoughtful about what
those are. We need to reflect many of the kinds of concerns
discussed today, but we need a strong and comprehensive set of
national standards.
We think that, given how rapidly medical issues and
technology are changing, how different certain States are in
terms of the demographics and patterns of disease, and given
that different States are in different places in terms of
confidentiality and privacy protection laws at the present
time, we don't want to put a straitjacket on States so that
they can't be innovators and so that they cannot adapt to the
unique needs of their States and their citizens, but I think we
all absolutely agree on the need for a comprehensive set of
national standards that have both breadth and depth to address
the kind of concerns we are talking about today.
With respect to H.R. 10, we think that the issue of medical
privacy is sufficiently important and complicated that it
should really be dealt with in a piece of legislation that is
targeted to the issue of medical privacy and that it is a
mistake to try to address it in a piecemeal fashion or as a
rider to another bill. We would really be best served not to
try to tinker with that, but instead to strike it all together
and focus on this important set of issues through a piece of
legislation that targets directly the issues we are discussing
today.
Mr. Kleczka. Thank you very much.
Mrs. Johnson of Connecticut. I thank the panel for your
testimony and we appreciate you being here this afternoon and
let me call the next panel.
Paul Clayton, Richard Smith, Janlori Goldman and Thomas
Jenkins. The Chairman will be returning as soon as possible,
but we will proceed.
Good afternoon. We will start with Paul Clayton, Ph.D.,
Senior Informaticist, Intermountain Health Care, Salt Lake
City, on behalf of the American Hospital Association. Please
proceed, Dr. Clayton.
STATEMENT OF PAUL D. CLAYTON, PH.D., SENIOR INFORMATICIST,
INTERMOUNTAIN HEALTH CARE, SALT LAKE CITY, UTAH, ON BEHALF OF
THE AMERICAN HOSPITAL ASSOCIATION
Mr. Clayton. I am Paul Clayton of Intermountain Health
Care, and I am also President of the American Medical
Informatics Association, a member of the health privacy working
group whose report was released last week, and I chaired the
National Research Council's 1997 study ``For The Record:
Protecting Electronic Health Information.''
I am here today on behalf of the American Hospital
Association, its 5,000 hospitals, health systems and other
providers. The AHA supports strong Federal legislation
establishing uniform national standards for all who use
protected health information, with strong penalties for
inappropriate use. Our comments today focus on how hospitals
use and protect patient information. Our longstanding
confidentiality principles cover a broader range of critical
patient privacy issues, and I have attached them to my written
statement.
People who make these decisions affecting the health of
patients must know about the medical and family history,
allergies to drugs, previous diagnostic results, current
medications, previous surgeries or therapies and chronic
problems. Access to this information dramatically affects the
level of care that can be provided.
For the past 14 years, IHC has used clinical data systems
to substantially improve patient care. Here are four examples.
First, for inpatient prescriptions, a computerized order
entry system warns physicians of potential allergies and drug-
to-drug interactions and calculates the ideal dose levels. That
dose system has reduced adverse drug reactions by two-thirds.
Second, improved management of mechanical respirators for
patients with acute respiratory distress syndrome. In these
most seriously ill patients, mortality rates fell from 90 to 60
percent.
Third, improved management of outpatient diabetic patients.
The proportion of patients brought to normal blood sugar levels
improved from less than 30 percent to more than 70 percent.
And, fourth, accountability for our performance. IHC
assembles and reports medical outcomes, patient satisfactions
and cost outcomes for major clinical processes.
These examples are all successful because patient
identifiable information flowed smoothly among the providers
that needed it.
Two provisions in various proposals could stem that
appropriate flow of information. The first is an opt-out where
patients could pick and choose which health information
providers could see. This mosaic of access restrictions could
greatly hinder our ability to render care. For example, when a
patient seeks care within our system, IHC laboratory analyzers
feed the patient's blood tests directly into our computers.
This improves our ability to make accurate results immediately
available, but it also necessarily eliminates our ability to
process laboratory tests without using the electronic medical
record.
Second, while we strongly support the development of policy
to restrict access privileges, we are concerned that some
proposals would require providers to limit the scope of
disclosures to the minimum, however that is defined, amount
necessary for the specific purpose at hand. This means
providers must repeatedly predict the exact present and future
implications for every piece of information. The intellectual
effort needed to ensure each person's compliance becomes
overwhelming.
I have reviewed how we use patient information to improve
care, and now I would like to review how we protect the
information. Every employee, health care professional,
researcher or volunteer must sign an agreement that they will
only look at or share information for specific legitimate
purposes of performing their health care delivery assignment.
Each new employee undergoes training in IHC confidentiality
policies which are set forth in a manual of more than 60 pages.
We impose consequences, including termination, for improper use
or handling of confidential information. We use audit trails to
monitor and access the electronic patient records. In the
electronic format, we are able to separate patient identifiers
from the rest of the clinical record, and we require formal
review, approval and oversight of research that uses patient
data.
Let me conclude by saying that the technology to protect
patient information is available, but without a Federal mandate
there is little incentive to make such an investment. We urge
Congress to enact legislation that will help hospitals,
physicians, nurses and others coordinate care and improve
quality and, at the same time, protect our patients' medical
information from misuse.
Thank you.
[The prepared statement and attachment follow:]
Statement of Paul D. Clayton, Ph.D., Senior Informaticist,
Intermountain Health Care, Salt Lake City, Utah, on behalf of the
American Hospital Association
Mr. Chairman, I am Paul D. Clayton, PhD, senior
informaticist at Intermountain Health Care (IHC) in Salt Lake
City, UT. IHC is an integrated health care delivery system that
operates in Utah, Idaho and Wyoming. The IHC system includes 23
hospitals, 78 clinics and physician offices, 23 outpatient
primary care centers, 16 home health agencies, and 400 employed
physicians. In addition, our system operates a large Health
Plans Division with enrollment of 475,000 directly insured,
plus 430,000 who use our networks through other insurers.
I am testifying today on behalf of the American Hospital
Association (AHA), which represents nearly 5,000 hospitals,
health systems, networks, and other providers of care. We
appreciate this opportunity to present our views on an issue
important to hospitals, health systems, and the patients they
serve: the confidentiality of protected health information.
Protecting Patients' Trust
Every day, thousands of Americans walk through the doors of
America's hospitals. Each and every one of them provides
caregivers information of the most intimate nature. They
provide this information under the assumption that it will
remain confidential. It is critical that this trust be
maintained. Otherwise, patients may be less forthcoming with
information about their conditions and needs-information that
is essential for physicians and other caregivers to know in
order to keep people well, ease pain, and treat and cure
illness.
If caregivers are not able to obtain and share patients'
medical histories, test results, physician observations, and
other important information, patients will not receive the most
appropriate, high-quality care possible.
Our members consider themselves guardians of this
information. That is why AHA has long supported the passage of
strong federal legislation to establish uniform national
standards for all who use patients' personal medical
information-what we refer to as protected health information.
We have been asked to focus our comments today on how hospitals
use and protect patient information to enhance the quality of
the patient care they deliver. Our longstanding principles for
the confidentiality of health information cover a broader range
of critical patient privacy issues, and we have attached them
for your information. We will measure any federal privacy
legislation against these principles in their entirety.
Confidentiality of health information is an issue that
affects all of us personally. We live in a time of rapidly
advancing technological improvement, when the world seems to
get smaller as computers get more powerful and databases get
bigger. This technological change can be positive--it has led
to significant improvements for both health care providers and
their patients--but it worries people who are justifiably
concerned about how information about them will be used.
In health care, we must take the steps necessary to protect
that information from those who would misuse it. We need
strong, uniform federal legislation to do it.
First and foremost, because we as hospitals and health
systems put our patients first, we must restore and maintain
people's trust in the privacy and confidentiality of their
personal health information. Federal legislation can do this by
establishing a uniform national standard for the protection of
this information--including genetic information--a standard
that balances patient privacy with the need for information to
flow freely among health care providers.
Privacy and Health Care Operations
Health care is increasingly provided by groups and systems
of providers, as opposed to individual providers. These new
systems create opportunities for real improvements, but they
rely heavily on a free flow of information among providers.
Patient confidentiality is of the utmost importance. But in
order to ensure that care can be coordinated and the patient's
experience is as seamless as possible, information must be
accessible to all providers who treat the patient.
There is very little disagreement that access to
information is important in the delivery of care to patients,
and in the system of payment for that care. Controversy has
developed, however, over the definition of ``health care
operations''--those essential functions performed by providers
to ensure that they maintain and improve the quality of the
care they deliver, train current and future caregivers, and
adhere to the laws and regulations that govern these daily
activities. AHA believes that protected health information must
be available to providers so that these functions can be
performed efficiently and effectively.
Information Breeds Health Care Success Stories
At IHC, we believe, as does the AHA, that individuals who
are making decisions that affect the health of another person
must know about past medical and family history, allergies to
drugs, previous diagnostic results, current medications,
previous surgeries or therapies, and chronic and acute
problems. Because the primary caregiver is not present all the
time, because others are asked for consultive opinions, and
because humans have limited memory, access to medical record
information dramatically affects the level of care that can be
provided. In some cases, the absence of information increases
the cost of diagnosis and treatment by causing tests to be
repeated because the results of an earlier tests are not
available.
Among the benefits of improved access are an enhanced
ability to generate bills and collect payment, and to transmit
information to payers and analyze the costs of providing care.
Care is also improved when a caregiver has access to the
medical record. A physician or other health care worker who
knows what drugs a patient is taking, a list of previous
problems, a history of family predisposition to certain
illnesses, and current laboratory results, will make better
decisions about how to diagnose and treat a patient.
At IHC, we have, for the past 14 years, used clinical data
systems to substantially improve patient care in a wide range
of circumstances. Here are a few examples.
Improved timing of delivery of pre-operative
antibiotics to prevent serious post-operative wound infections.
Our wound infection rate fell from 1.8 percent to 0.4 percent,
representing, at just one of our 23 hospitals, more than 50
patients per year who now do not suffer serious, potentially
life-threatening infections. We also saved the cost of treating
those infections, which, at that hospital, was estimated at
$750,000.
Improved support for inpatient prescriptions. A
computerized order entry system warns physicians, at the time
they place the order, of potential allergies and drug-to-drug
interactions. It also calculates ideal dose levels, using the
patient's age, weight, gender, and estimates of patient-
specific drug-absorption and excretion rates, based on
laboratory values. That system has reduced allergic reactions
and overdoses by more than two-thirds.
Improved management of mechanical respirators for
patients with acute respiratory distress syndrome. In the most
seriously ill category of these patients, mortality rates fell
from more than 90 percent to less than 60 percent.
Improved management of diabetic patients in an
outpatient setting. The proportion of patients brought to
normal blood sugar levels improved from less than 30 percent to
more than 70 percent. Major studies of diabetes demonstrate
that this kind of shift in blood sugar translates to
significantly less blindness, kidney failure, amputation and
death. Others indicate it should reduce the cost of treatment
for diabetes patients by about $1,000 per patient per year.
Improved treatment of community-acquired
pneumonia. By helping physicians more appropriately identify
patients who needed hospitalization, choose appropriate initial
antibiotics, and start antibiotic therapy quickly, we were able
to reduce inpatient mortality rates by 26 percent. That
translates into about 20 lives saved at 10 small rural IHC
hospitals when we first worked on this aspect of care. It also
reduced costs by more than 12 percent.
Accountability for health care delivery
performance. IHC has begun to assemble and report medical
outcomes, patient satisfaction outcomes, and cost outcomes for
major clinical care processes that make up more than 90 percent
of our total care delivery activities. We aggregate and report
those data at the level of individual physicians; practice
groups; hospitals; regions; and for our entire system. We use
the results to hold each health care professional and our
system accountable for the care we deliver to our patients, and
to set and achieve care improvement goals. We believe that this
system will eventually allow IHC to accurately report our
performance at community, state and national levels, and help
individuals and groups make better health care choices.
All of the examples above were successful because patient
information--not just individual patient information, but also
information about populations of patients--was available, and
flowed smoothly among the providers that needed it.
Potential Disruptions to the Free Flow of Information
There are two provisions in various patient privacy
proposals that could have the unintended effect of placing
enormous barriers in front of providers' ability to
appropriately use information for these and similar purposes.
The first is what has been referred to as the ``opt out,''
where patients would have the ability to prevent providers from
sharing the patient's information regardless of how important
such a disclosure might be.
The problem with such an opt out is that it sacrifices
hospitals' ability to deliver high-quality care to the
individual involved, as well as to other patients. For example,
IHC's laboratory analyzers feed directly into our computer
system. When we committed to that link, we not only
significantly improved our ability to deliver excellent care to
all of our patients, but also necessarily lost our ability to
process blood laboratory tests without using the electronic
medical record.
In addition, a patient who might decide to prevent his or
her records from being shared among providers is, effectively,
reducing the quality of health care he or she may receive in
the future. This is because, without access to that patient's
records, providers simply cannot make well-informed decisions.
At the same time, removing the patient's treatment information
as a factor in overall health care statistics degrades the
overall integrity of the health care information flow. In other
words, if less is known, less can be learned, and the overall
quality of care could be affected.
The second potential problem we see being discussed is a
requirement, included in several patient privacy proposals,
that providers must limit the scope of medical information
disclosures to no more than what is necessary for the specific
purpose of the disclosure. Penalties would be levied, according
to the proposals, presumably if too much information were to be
provided.
Health care providers, who deal with a mountain of
information every day, simply cannot be expected to determine
the exact need for every piece of information and the exact
measurement of information that may be required to meet that
need. The threat of penalties makes the proposals worse, and is
sure to inhibit the free flow of important information. In
addition, proper safeguards should already be in place that
would prevent the misuse of patient information, so that
requiring providers to justify each disclosure would be
unnecessary.
Proper policies and procedures will ensure that patient
information is used only where it is needed to benefit the
health care services provided to an individual patient, or to
improve the overall health care system through statistics and
analysis.
Safeguarding Patient Information
IHC and the AHA support strong, uniform federal
confidentiality standards that buttress our health care
delivery and clinical research work. IHC has placed appropriate
protection of patient confidentiality and privacy at the
forefront of our institutional values. Those values complement
a parallel mission to provide the best possible health
maintenance and disease treatment to those who trust their care
to our hands. Achieving this requires the use of population-
level patient data as well as individual patient data.
IHC uses enforceable corporate policy to maintain
confidentiality not just for patients, but for health care
professionals and employees as well, in those areas that are
clearly health care delivery operations (such as direct patient
care delivery; billing for services; quality review of
individual patient records, including mortality and morbidity
conferences; resource planning; unit performance evaluation;
quality improvement and disease management; and retrospective
epidemiologic evaluations of program performance). The core of
these policies and enforcement activities include:
We require every employee, health care
professional, researcher or volunteer to sign a confidentiality
agreement stating that they will only look at or share
information for the specific purpose of performing their health
care delivery assignment on behalf of our patients. We require
each new employee to undergo training in IHC confidentiality
policies, which are set forth in a manual that numbers more
than 60 pages and represents more than five years of discussion
and cross-testing.
We impose consequences--including termination--for
improper use or handling of confidential information.
To the extent that we have implemented an
electronic medical record, we are able to monitor access to
patient records (an ability not available for paper records).
We use that system as one important method of monitoring and
enforcing our confidentiality policy. We utilize software
controls, including warnings on log-on screens, unique log-on
passwords, and computerized audit trails. In the near future,
we hope to bring on-line the ability of all patients to review
a list of every individual who has accessed their electronic
medical record for any purpose.
We segregate our electronic databases, separating
patient identifiers from the remainder of the clinical record.
Outside of direct patient care and individual record review for
quality assurance, most health care delivery operations do not
require access to identifiable data. IHC's data access policies
regulate access to patient information using strict ``need to
know'' criteria by job description. While we afford tight
access control to all of our information, the identifiable
portion of the record receives the highest level of protection.
We are studying ways to segregate the core
clinical record itself, so that particularly sensitive
information--for example, HIV status, reproductive history, or
mental health status--are only available on a strict ``need to
know'' basis, even to the front-line care delivery team.
In addition, we require full institutional review board
(IRB) review, approval and on-going oversight for any research
project that involves experimental therapy, patient
randomization among treatment options, or patient contact for
research purposes. Indeed, the IHC system has 12 IRBs, but we
do not look to them as our sole--or even our primary--means to
protect confidentiality. Most of the risks to patient
confidentiality come in day-to-day care, as physicians and
nurses routinely access identifiable patient medical records,
both paper and electronic, to deliver care. Instead, we rely
upon the extensive array of enforceable policies and procedures
listed above.
If IRB review of each of these health care operations were
required, many--if not most--of the operational care delivery
and health outcome improvements described earlier could not
function on a day-to-day basis. The volume of review would be
staggering, far beyond the capacity of any reasonable system of
individual review and follow-up oversight.
Conclusion
As an integrated health care delivery system, IHC is
responsible for the health outcomes of the patients who seek
care from our system. In order to treat our patients and
improve the health outcomes of the entire population we serve,
we must be able to share information among IHC entities--our
physicians, our hospitals, and our health plans. IHC has
developed state-of-the-art electronic medical records and
common databases to facilitate this communication, to make sure
our physicians have complete information when treating patients
. We have put in place an extensive array of enforceable
confidentiality protections that are constantly updated and
improved.
We urge this panel to ensure that confidentiality
legislation does not unintentionally prevent the creation of
these common internal, operational databases, or limit the
types of data that can be shared within an integrated delivery
system. Such action would severely limit a health system's
ability to measure and improve the health care it delivers.
The outstanding care that physicians, nurses and others
deliver at IHC and in hospitals and health systems across
America relies more and more on coordination of care and on
effective quality improvement. Individually identifiable health
information is integral to such operations, and the free flow
of this information--properly safeguarded from misuse--is
critical to our ability to continue providing high-quality
health care for patients and communities.
American Hospital Association
Principles for Confidentiality of Health Information
Every day, thousands of Americans walk through the doors of
America's hospitals. Each and every one of them provides caregivers
information of the most intimate nature. They provide this information
under the assumption that it will remain confidential. It is critical
that this trust be maintained. Otherwise, patients may be less than
forthcoming with information about their conditions and needs--
information that is essential for physicians and other caregivers to
know in order to keep people well, ease pain, and treat and cure
illness.
If caregivers were not able to obtain and share patients' medical
histories, test results, physician observations, and other important
information, patients would not receive the most appropriate, high-
quality care possible. Our members consider themselves guardians of
this information, which is why AHA has long supported the passage of
strong federal legislation to establish uniform national standards for
all who use health information.
In health care, we must take the steps necessary to protect
patients' confidential information from those who would misuse it. We
need strong, uniform federal legislation to do it.
AHA goals for legislation
First and foremost, because we as hospitals and health systems put
our patients first, we must restore people's trust in the privacy and
confidentiality of their personal health information. Federal
legislation can do this by establishing a uniform national standard for
the protection of health information--including genetic information--a
standard that balances patient privacy with the need for information to
flow freely among health care providers. The AHA believes that federal
confidentiality legislation must meet the following goals:
Allow patients and enrollees access to their medical
information, including the opportunity, if practical, to inspect, copy,
and, where appropriate, add to the medical record. Patients have a
right to know what information is in their records. This level of
accountability encourages accuracy and has the added benefit of
encouraging patient involvement in their care.
Preempt state laws that relate to health care
confidentiality and privacy rights, with the exception of some public
health laws. Health care today is delivered through providers that are
linked together across delivery settings, and in organizations that
cross state boundaries. AHA believes that the best way to set important
standards for confidentiality of health information is to do so
uniformly--through a strong federal law. This law must be both a floor
and a ceiling, preempting all state laws with which it may conflict,
weaker or stronger. Only through such a uniform law can patients'
confidential information be equally protected regardless of the state
in which they live or travel.
Be broad in its application, covering all who generate,
store, transmit or use individually identifiable health information,
including but not limited to providers, payers, vendors, and employers.
Patient confidentiality cannot be ensured unless standards are applied
to all who may have access to their health information. Legislation
should cover all types of individually identifiable health information,
including sensitive issues such as substance abuse, mental health, and
genetic information.
Strike an appropriate balance between patient
confidentiality and the need to share clinical information among the
many physicians, hospitals and other caregivers involved in patient
care. Care is increasingly provided by groups and systems of providers
as opposed to individual providers. These new systems create
opportunities for real improvements, but they rely heavily on a free
flow of information among providers. Patient confidentiality is of the
utmost importance. But in order to ensure that care can be coordinated
and the patient's experience is as seamless as possible, information
must be accessible to all providers who treat the patient.
Recognize that a hierarchy of need exists among users of
health information. Access to individually identifiable information is
essential for patient care. Such access may also be necessary for
provider and health care system efforts to measure and improve the
quality of care. All internal and external uses of patient information
must be evaluated as to whether the use of individually identifiable
information is justified.
To limit its potential misuse, all within the health
system should restrict the availability of individually identifiable
information. Technology is available to do this, through encryption,
audit trails, and password protection, for example. Another method for
restricting the availability of individually identifiable information
is to aggregate information whenever possible. Patients should be
assured that unique, identifiable information about them is available
for their treatment, but that its availability for other uses is
tightly controlled.
Include sufficient civil and criminal penalties to deter
inappropriate disclosure of individually identifiable information. The
level of such sanctions should vary according to, the severity of the
violation. At the same time, any penalty imposed must take into account
good-faith efforts by providers who establish data safeguards, educate
employees about complying with these safeguards, and attempt to
maintain secure recordkeeping systems.
Mrs. Johnson of Connecticut. Thank you very much, Dr.
Clayton.
Dr. Richard Smith, Professor of Psychiatry at the Centers
for Mental Health Services Research, University of Arkansas on
behalf of the American Medical Colleges.
Dr. Smith.
STATEMENT OF G. RICHARD SMITH, JR., M.D., PROFESSOR OF
PSYCHIATRY AND MEDICINE, UNIVERSITY OF ARKANSAS FOR MEDICAL
SCIENCES, ON BEHALF OF THE ASSOCIATION OF AMERICAN MEDICAL
COLLEGES
Dr. Smith. Thank you, Mrs. Johnson and Members of the
Subcommittee. I am Dr. G. Richard Smith from the University of
Arkansas for Medical Sciences, a practicing psychiatrist and
director of one of the Nation's largest mental health services
research groups as well as our college of medicine's health
services research program. I am speaking today on behalf of the
Association of American Medical Colleges, the AAMC.
AAMC strongly supports the general intent of current
congressional efforts to strengthen the protection of
individual's personally identified health information from
inappropriate and harmful misuse that can lead to
discrimination or stigmatization. In the interest of public
health, this protection should take into account the need for
health services and biomedical researchers to have ready access
to archival materials on relevant populations required to
generate meaningful conclusions regarding the incidents and
expression of diseases in specified populations, the beneficial
and adverse outcomes of particular therapies and the medical
effectiveness and economic efficiency of the health care
system.
In attempting to deal with the difficult issues of medical
information confidentiality, legislative efforts should be
directed toward requiring the establishment of strong
administrative, technical and fiscal safeguards to protect the
confidentiality, security, accuracy and integrity of
information that directly identifies an individual. Legislation
should also specify stiff criminal, civil and administrative
penalties for intentional or recklessly negligent actions that
violate medical information confidentiality. With such
stringent security requirements in place, AAMC believes
legislation should refrain from attempting to construct
elaborate barriers to the relatively unimpeded flow of medical
information that is required for the promotion of a
comprehensive national agenda medical research.
In particular, the AAMC is concerned about secondary
research which utilizes patients records as research material
and does not involve interaction with individual patients. For
example, mental health services research on patient records has
established that pediatric patients treated for attention
deficit disorder, or ADHD, were far less likely to use and
become dependent upon illegal drugs during young adulthood than
people with ADHD who did not receive appropriate information.
Archival data was also critical to establishing the
postmarketing safety and effectiveness of drugs. Since many
patients with major mental illness require long-term medication
treatment, the effects of chronic use of new drugs cannot be
adequately assessed in conventional premarketing clinical
trials. The consequences can only be recognized by
retrospective study of large populations over prolonged periods
of time. Archival data were essential in establishing the
safety of a new generation of antidepressant drugs on the
fetuses of mothers who had been receiving these drugs
chronically for the treatment of depression.
In sum, access to archival data is critical to assuring the
health of patients with mental illness, just as with any other
medical illness. Archival data also help us to identify the
relative contribution of genetic, environmental and
developmental factors related to the risk of specific mental
disorders in families across generations.
The uncertainty and predictability of secondary research
make the applicability and traditional informed consent
procedures problematic. For secondary research using medical
information that is individually identified, the AAMC believes
a statutory requirement of specific authorization would be
unwise and could seriously bias and therefore undermine the
integrity of vital research databases. Rather, the Association
recommends that all such proposed research should be reviewed
by an institutional review board or equivalent mechanism to
ensure that research is credible, the need for individually
identifiable medical information is legitimate and the
investigators have in place confidentiality policies and
procedures required by statutes.
Patients' confidence in the medical research use of their
personal medical information would be greatly enhanced by the
inclusion of a statutory assurance of confidentiality as
provided in S. 881, sponsored by Senator Bennett, and H.R.
2470, sponsored by Representative Greenwood. Such an assurance
would prohibit any unauthorized attempts to gain access for
nonresearch purposes to individually identified health
information contained in research databases.
The AAMC strongly supports the position of new Federal
information privacy legislation preempting State privacy laws.
There is a compelling Federal interest in ensuring that medical
research is facilitated and not hindered by this disorganized
patchwork of State privacy laws. The AAMC commends this
Subcommittee for convening this hearing to address the need for
confidentiality legislation and the efforts of Chairman Thomas
and Representative Cardin in crafting legislation that would
enhance security of medical records.
This concludes my statement, and I would be happy to answer
any questions the Committee has.
[The prepared statement follows:]
Statement of G. Richard Smith, Jr., M.D., Professor of Psychiatry and
Medicine, University of Arkansas for Medical Sciences, on behalf of the
Association of American Medical Colleges
Mr. Chairman and members of the Subcommittee, I am Richard
Smith, M.D., Professor of Psychiatry and Medicine at the
University of Arkansas for Medical Sciences. I am a practicing
psychiatrist and also conduct mental health services research.
I lead the Centers for Mental Health Services Research at the
University of Arkansas, which is one of the nation's largest
mental health and services research groups, as well as our
College of Medicine's health services research program. I am a
recent past member of the National Mental Health Advisory
Council for the National Institute of Mental Health (NIMH). I
also chaired the NIMH Initial Review Group for mental health
services research, which reviews virtually all of the mental
health services research grant applications submitted to NIMH.
I am speaking today on behalf of the Association of
American Medical Colleges (AAMC). The AAMC represents the
nation's 125 accredited medical schools, nearly 400 major
teaching hospitals and health care systems, more than 87,000
faculty in 89 professional and scientific societies, and the
nation's 67,000 medical students and 102,000 residents.
The AAMC strongly supports the general intent of current
Congressional efforts to strengthen the protection of
individuals' personally identified health information from
inappropriate and harmful misuse that can lead to
discrimination or stigmatization.
Confidentiality legislation must acknowledge the compelling
public interest in continuing to ensure access to patient
records and other archival materials required to pursue
biomedical, behavioral, epidemiological and health services
research. Medicine has always been, and largely remains to this
day, an empirical discipline, and the history of medical
progress has been created over many centuries from the careful,
systematic study of normal and diseased individuals. From those
studies has emerged our present level of understanding of the
definition, patterns of expression and natural history of human
diseases, and their responses to ever improving strategies of
diagnosis, treatment, and prevention. In particular, health
services researchers continue to depend upon the ready
accessibility of archival materials to collect the large and
appropriately structured and unbiased population samples
required to generate meaningful conclusions regarding the
incidence and expression of diseases in specified populations,
the beneficial and adverse outcomes of particular therapies,
and the medical effectiveness and economic efficiency of the
health care system. Indeed, in the present climate of major
public concern about the costs, quality, and efficiency of our
rapidly changing health care delivery system, the need to
support and promote such retrospective epidemiological and
health services research has become an urgent priority.
The AAMC strongly believes that in attempting to deal with
the difficult issues of medical information confidentiality,
the most feasible and effective approach is not to erect costly
and burdensome new barriers to accessing medical information
required to conduct research. Rather, legislative efforts
should be directed, as most of the current proposals attempt to
do, toward requiring the establishment of strong
administrative, technical and physical safeguards to protect
the confidentiality, security, accuracy and integrity of
information that directly identifies an individual. Included
among these safeguards should be strong institutional policies
of confidentiality, which might appropriately meet federal
standards to be developed. To complete the ``security
package,'' legislation should specify stiff criminal, civil,
and administrative penalties for intentional or recklessly
negligent actions that violate medical information
confidentiality. With stringent security requirements of this
kind in place, the AAMC believes that legislation should
refrain from attempting to construct elaborate barriers to the
relatively unimpeded flow of medical information that is
required for the promotion of a comprehensive national agenda
of medical research.
Given the substantial penalties contained in the
confidentiality bills now in draft or under consideration, it
is imperative that bills' definitions be crafted with great
clarity. Of particular importance is the definition of
``individually identifiable health information,'' the class of
medical information most in need of protection from
inappropriate disclosure and harmful misuse, and
correspondingly of ``non-individually identifiable health
information,'' the class that would fall outside the purview of
confidentiality legislation. The AAMC believes that the
protected class of medical information should be sharply
circumscribed and limited to ``information that directly
reveals the identity or provides a direct means of identifying
an individual.'' Such a definition is least ambiguous and
incorporates the sum and substance of the information that the
public is most concerned to protect.
Correspondingly, the definition of ``nonidentifiable health
information'' should encompass ``information that does not
directly reveal the identity of an individual.'' This
definition should explicitly include coded or encrypted
information (sometimes called ``anonymized''), whether or not
the information is linkable to individuals, as long as the
encryption keys are secured and kept separate from the
encrypted information itself. The justification for including
encrypted, linkable information in the definition of
nonidentifiable health information is significantly
strengthened by adding additional provisions that make it a
crime to attempt to use encrypted patient data to discover an
individual's identity by any means other than the lawful use of
an encryption key.
The AAMC believes that a set of properly constructed
definitions of protected health information and nonidentifiable
health information will serve both to foster medical research
and establish an incentive system for using nonidentifiable
health information in such research to the maximum extent
practical.
The AAMC is especially concerned about the conduct of
secondary research on archival patient materials. These studies
utilize patient records as primary research materials and do
not involve interaction with individual patients. In mental
health services research, for example, secondary research on
patient records has established that pediatric patients treated
for attention deficit disorder (ADHD) were far less likely to
use and become dependent upon illegal drugs during adolescence
and young adulthood than patients with ADHD who had not
received appropriate treatment. Archival data were essential in
recently establishing the safety of the new generation of
antidepressant drugs (selective serotonin reuptake inhibitors)
on the fetuses of mothers who had been receiving these drugs
chronically for the treatment of depression. As these examples
suggest, archival patient data are critical to establishing the
post-marketing safety and effectiveness of drugs. Since many
patients with major mental illness require long-term medication
treatment, and the effects of chronic use of new drugs cannot
be adequately assessed in conventional pre-marketing clinical
trials, the consequences can only be recognized by
retrospective study of large populations over prolonged periods
of time. In sum, access to archival data is critical to
assuring the health of patients with mental illnesses.
Archival data can also be useful in identifying risk
factors related to the onset of a mental illness. For example,
there continues to be strong interest in the role of genetic
factors in the etiology of major mental illnesses such as
schizophrenia, bipolar disorder, major depression and obsessive
compulsive disorder. In seeking clues that could help to direct
future research in this area, it is critical for researchers to
be able to access archival patient care records, for example,
of deceased family members of patients involved in genetic
studies. It is possible that mental illnesses that are now not
linked in any way might be found to cluster in families in a
manner that suggests a common genetic etiology. Archival data
can also help to clarify the relative contribution of genetic,
environmental and developmental factors related to risk of
specific mental disorders in families across generations.
In contrast to the typical interventional clinical research
study, in which researchers directly interact with patients in
well-defined protocols and can provide them with the detailed
information required for informed consent, the uncertainties
and unpredictability of secondary research make the
applicability of traditional informed consent procedures
problematic. Accordingly, under the provisions of the federal
Common Rule, such retrospective research has been singled out
for special attention and, under the criterion that the
proposed research is commonly deemed to be of no more than
minimal risk to research subjects, has typically been handled
by Institutional Review Boards (IRBs) by use of the expedited
review mechanism, or even on occasion, by wavier of review.
For secondary research using medical information that is
individually identified, i.e. that fall within the definition
of protected health information, the AAMC believes that a
statutory requirement of specific authorization would be unwise
and could seriously bias, and thereby undermine the integrity
of these vital research databases. Rather, the Association
recommends that all such proposed research must be reviewed by
an IRB or equivalent mechanism. The reviewing body should be
required to determine that (1) the organizational setting in
which the research will be conducted is in conformity with
statutory requirements for safeguarding medical information
confidentiality; (2) the research requires the use of
individually identifiable patient information and could not be
performed without it; and (3) it would not be practicable or
feasible for the investigators to attempt to obtain individual
informed consent from the subject population. Such a review
procedure would sufficiently protect the privacy interests of
the research subjects, while at the same time continuing to
facilitate the conduct of a broad spectrum of beneficial
secondary research on archival patient materials. Instead of
mandating specific consent for secondary research, the
Association recommends that IRBs or other equivalent review
bodies should continue to review such research and determine
whether specific consent is necessary on a project by project
basis.
In addition, AAMC firmly believes that patients' confidence
in medical research uses of their personal medical information
would be greatly enhanced by the inclusion of a ``statutory
assurance of confidentiality'' as provided by S. 881 sponsored
by Senator Bennett and H.R. 2470 sponsored by Rep. Greenwood.
Such an assurance would prohibit any unauthorized attempts to
gain access for non-research purposes to individually
identifiable health information contained in research
databases, including Federal, State, or local civil, criminal,
administrative, legislative, or other proceedings.
Consequently, researchers could confidently assure patients
that all individually identifiable medical information that
might be used in the course of research would be shielded from
forced disclosure to anyone, including family members,
employers, insurers, health care organizations or legal or
judiciary processes.
The ``statutory assurance of confidentiality'' provision is
modeled on the existing Certificate of Confidentiality issued
by the National Institutes of Health on a project by project
basis. The origin of the Certificate of Confidentiality dates
back to the Vietnam War era. Scientists and policy makers were
very concerned about the extent of heroin use by our soldiers
in Vietnam--and the danger that they might be permanently
addicted when they returned to the United States. Since heroin
possession was then--and is--a crime, it would have been
impossible to enlist the subjects necessary to conduct a
follow-up study of heroin use in the US by these ex-GIs. The
grant of confidentiality enabled scientists to track a cohort
of former service men, to collect urine to screen for drugs,
and to conduct detailed interviews. The study documented an
extremely low percentage of heroin use in the US by former
users in Vietnam. The Certificate of Confidentiality has been
applied to other studies in the addictions field, for example,
to the studies that demonstrated the effectiveness of Methadone
substitution therapy for heroin addicts, and it continues to be
crucial to much clinical research in this area.
The AAMC strongly supports the argument that new federal
legislation dealing with medical information privacy be
preemptive of state privacy laws, with the exception of those
state laws dealing with public health reporting requirements,
which are well established, time tested and closely integrated
with the nationwide data collection and evaluation activities
of the Centers for Disease Control and Prevention. The
Association recognizes that this recommendation is
controversial, but argues that the support of medical research
is a long-established and high priority of the federal
government, and that there is therefore a compelling federal
interest in ensuring that medical research is facilitated, and
not hindered or blocked by a discoordinated patchwork of
burdensome state privacy legislation. Much contemporary medical
research, especially epidemiological and health services
research, requires access to large, unbiased population samples
encompassing many states. Accordingly, the Association
recommends that any new federal confidentiality legislation
should over-ride state laws to ensure consistent nation-wide
governance of access to archival patient materials for
research. The Association is troubled by legislation that allow
states to enact tougher privacy laws or carve-out certain
disease-specific state statutes from federal pre-emption. While
acknowledging the sensitivity of this issue, we point out that
many different diseases are considered especially sensitive by
those who suffer from them and their advocates, and to single
out a particular type of information, such as mental health
records, for special protection opens a loophole in the
intended federal preemption that the AAMC believes would prove
very difficult to limit.
The impact of managed behavioral health care on mental
health services has been profound. The health insurance
programs of more than 162 million Americans requires them to
access mental health services through these carve-out
companies. The major companies offer services across the
country. The positive side of managed behavioral health care is
that it has made parity of health care coverage for mental
illness a realistic option. In addition, the companies have
been able to amass a great deal of information on the mental
health services being provided to the US population. On the
down side, controversies abound regarding the quality of care
in some managed behavioral health care programs. Health
services researchers have a great opportunity and
responsibility to help the American public to assess the
quality of mental health services in these programs. This is
not an issue that can be stopped at a state line. It is
critical that managed behavioral health care companies be
encouraged to work with the health services research community
to assess quality of treatment outcomes, and that federal law
pre-empt state privacy laws that would make this impossible.
The AAMC commends this Subcommittee for convening this
hearing to address the need for confidentiality legislation and
the efforts of Chairman Thomas and Rep. Cardin in crafting
legislation that would enhance the security of medical records.
The Association urges Congress to be mindful of the fact that
the facilitation of biomedical, epidemiological and health
services research is a compelling public priority that has
served this nation well and offers bright promise for the
future of human health. The AAMC strongly believes that the
combination of statutory safeguards of the security of
individually identifiable medical information, stiff penalties
for violations, and the creation of special protections for
medical information that is created in research and maintained
in research databases, as we have suggested, make it
unnecessary to elaborate new, burdensome and potentially
chilling restrictions of access to medical information for
purposes of retrospective non-interventional research.
Mrs. Johnson of Connecticut. Thank you very much.
Ms. Janlori Goldman, Director of Health Privacy Project for
the Institute for Health Care Research and Policy. Nice to have
you.
STATEMENT OF JANLORI GOLDMAN, DIRECTOR, HEALTH PRIVACY PROJECT,
INSTITUTE FOR HEALTH CARE RESEARCH AND POLICY, GEORGETOWN
UNIVERSITY
Ms. Goldman. Thank you for inviting me to testify here
today. I appreciate it.
As you said, I am the Director of the Health Privacy
Project at Georgetown University. I have been working on
privacy and medical privacy issues for almost 13 years. What I
would like to ask is that a revised version of my testimony, a
neater version and one on disk, be allowed to be submitted for
the record at a later date.
Mrs. Johnson of Connecticut. So ordered.
Ms. Goldman. Thank you.
When I started the health privacy project a year and a half
ago, I tried to position health privacy issues in a way that is
a little bit different than how we tended to look at it in the
past, to see protecting privacy as a critical goal to improving
the quality of care in this country and access to care. We have
tended to view these as values in conflict, and what we have
found in some of our recent research is that protecting privacy
is critical to improving health care in this country and in
opening doors to access.
In a recent survey that came out in January it was
documented that one out of every six people in this country
withdraw from fully participating in their own health care
because they are afraid that their records will not be
protected, so they don't fully disclose to their doctors, they
leave information out. Sometimes they pay out of pocket to
avoid having to file a claim or they don't seek care at all. So
the quality of their care is undermined in those circumstances,
and the information that is available downstream for public
health and research is also undermined.
So I truly believe that we need to enact strong privacy
legislation in order to give the public trust and confidence
that this Nation's health care system will protect their
privacy.
You are all well aware Congress has imposed on itself a
deadline of August 21 to enact comprehensive legislation or the
Secretary will issue regulations. When we started the Project,
we tried to identify what is missing in the debate, what
contribution can we make, and we decided that we would bring
together the diverse stakeholders in the debate, the health
plans, doctors, ethicists, mental health advocates, those
representing people with AIDS and others, to say can we reach
outside of the glare of the legislative spotlight, can we reach
some common ground on a set of best principles for health
privacy.
I had the privilege of working with Dr. Paul Clayton on
that working group, and I included for you a copy of the
working group's principles. I want to just highlight--we
released this report last week, so we are just in time for the
deadline--just a few of the key findings that we made.
We want to reverse the status quo and encourage people to
use nonidentifiable data wherever they can, and to put in some
real protections for individuals by having authorization
requirements that are more meaningful than we heard about in
the first panel, and to provide some oversight, some
accountability for all research that is conducted in this
country, not just the research that receives Federal funds and
is covered by the common rule.
We were able to reach that common ground, and I think we
have a lot to be proud of, and I hope that Congress will look
and see if there is some guidance that you can find in this
report as you move forward.
The second thing that we did, which we just released this
morning and which has already been referred to by Congressman
Cardin, is a report that is a comprehensive survey of the 50
State health privacy laws. That has never been available until
today. And so when the question was asked earlier, well, do you
comply with the 50 State laws, the truth is no one has known
what they are. So today we released this report.
We have a summary of every State's law. You can look at
your State of Connecticut, you can look at your State of
Wisconsin and say what protections are provided to our
citizens. And so when you are looking at this issue of
preemption, which is one of the most controversial issues in
the debate, you can say, what would be the impact on my State's
law? What has my State done in moving forward to protect
privacy?
Now, one of the things that we found in our State report,
which I think is very important, the State law in this area is
not simple, and it is not easy to find, which is why it took us
so long and so many people to put this together. There is a lot
of law, and it exists in the nooks and crannies of the States'
code. There are very few examples, although Wisconsin is a
shining exception, of comprehensive law. There are very few
States that have enacted comprehensive health privacy law. They
tend to legislate by entity. They might have restrictions on
hospitals, health plans or doctors, but they don't tend to take
a very comprehensive view. But what the States have done in a
very, I think, responsive and responsible way, is to enact
condition-specific rules. So for people, for instance, who want
to seek genetic testing, for people with mental illness or
communicable disease, the cancer registries and other kinds of
disease registries, the States have been very responsive to
protecting the needs of their citizens in those areas. We need
to be cautious and look at those laws before we talk about
creating a Federal ceiling.
What we also found is that some of the State laws are weak
and some are strong, but they are for the most part very
detailed and nuanced. I want to make a final point about the
State laws. When we talk about uniformity, and this is the big
discussion we are all having, how do we create uniformity. I
think we all agreed that in this complex, health care
environment with managed care and integrated health data
networks, we all need uniformity to have good quality care in
this country. The question is if we set the bar high enough at
the Federal level, in other words, if we enact strong enough
protections at the Federal level so that we don't have to worry
about wiping out stronger laws that already exist at the State
level, we don't have to worry about passing or enacting a
Federal ceiling, because we will have done the best that we can
do to create a baseline of protections for people in this
country.
I think we want to be very careful and respect what the
States have already done. The States have been very responsive.
We don't want to tie the hands of the State in being able to
respond to future public health threats. Many of the State laws
on the books were enacted to respond to a particular public
health threat or a public health concern. Again, the number one
barrier to people receiving genetic testing is they are afraid
of how that information will be used by somebody else, in
employment, in insurance, so the States are moving forward to
protect, to enact protections, to encourage people to get these
critical tests that can help improve their care, so they have
been able to respond to these concerns. We need to be mindful
of the regulatory powers of the State and the details of the
State law. So I just suggest some caution. The State report, by
its title suggests there is an uneven terrain in the States,
but I don't want to suggest it is an unimportant terrain. The
States have done a lot of good in this area.
In conclusion, we should ensure that a Federal law does not
weaken or erode the critical protections that already exist at
the State level. Consumers have come to rely on those State
laws for whatever protections do exist in the absence of a
Federal law. If we do, we will jeopardize their health care and
we might undermine their trust in public health and research.
We should do our best to make that floor as high a level of
baseline protections as possible.
Thank you very much.
[The prepared statement follows:]
Statement of Janlori Goldman, Director, Health Privacy Project,
Institute for Health Care Research and Policy, Georgetown University
Chairman Thomas and Members of the Subcommittee:
Thank you for the opportunity to testify before you today
on the issue of health privacy. I am Janlori Goldman, Director
of the Health Privacy Project at Georgetown University's
Institute for Health Care Research and Policy. In the past
week, the Project has issued two reports on health privacy,
which we hope will make a significant contribution to the
ongoing policy initiatives. We include as our testimony today
the top findings and executive summaries of these reports. The
full text of both reports is available on our website at
www.healthprivacy.org.
Your continued attention to health privacy is greatly
appreciated, and we look forward to working with you, as you,
and the rest of the Congress, move forward to meet the August
deadline for enacting comprehensive health privacy legislation.
Best Principles for Health Privacy
Executive Summary
Privacy and confidentiality have long been recognized as essential
elements of the doctor-patient relationship. Also essential to optimal
care is the compilation of a complete medical record. But that same
record is used for a wide variety of purposes--including insurance
functions, coordination of care, and research. The long-standing
friction between these two goals--patient privacy and access to
information for legitimate purposes--has been heightened by the
transition to electronic health information and a push toward
integrated information in support of integrated health care delivery
and health data networks. While these developments are intended to
improve health care, they also raise many questions about the role of
privacy in the health care environment.
Recent polls demonstrate that the public has significant concern
about the lack of privacy protection for their medical records and that
it can impact how they engage with health care providers. In order to
protect their privacy, some patients lie or withhold information from
their providers; pay out-of-pocket for care; see multiple providers to
avoid the creation of a consolidated record; or sometimes avoid care
altogether. Such ``privacy-protective'' behavior can compromise both
individual care and public health initiatives.
The public has some reason to be concerned. Today, there is little
consistency in approaches to patient confidentiality and no national
standards or policies on patient confidentiality. The 1996 Health
Insurance Portability and Accountability Act provides that if Congress
fails to enact comprehensive health privacy legislation by August 1999,
the Secretary of Health and Human Services must issue regulations.
Therefore, either through legislation, government regulation, or self-
regulation, there will be significant developments with regard to
health privacy in the next two years.
What has been missing from the debate is a consensus document that
offers policy recommendations regarding how best to protect patient
confidentiality. To fill this void, the Health Privacy Project, with
funding from the Robert Wood Johnson Foundation, created the Health
Privacy Working Group in June 1998. Its mission was to achieve common
ground on ``best principles'' for health privacy, while identifying a
range of options for putting those principles into practice. The
Working Group is comprised of diverse stakeholders, including:
disability and mental health advocates; health plans; providers;
employers; standards and accreditation representatives; and experts in
public health, medical ethics, information systems, and health policy.
The Working Group spent the past year crafting a consensus document
that reflects ``best principles'' for health privacy. This report
outlines the 11 principles to which the Working Group agreed and
details the rationale behind the recommendations.
The principles represent significant compromises between Working
Group members and should be seen as a framework that aims to
accommodate the various information needs of diverse interest groups.
The principles are designed to establish a baseline of protections that
should be considered when implementing comprehensive patient privacy
policies and practices.
The Working Group adopted the following 11 principles. Because
these principles are intended to establish a comprehensive framework,
they should be read and implemented as a whole.
1. For all uses and disclosures of health information, health care
organizations should remove personal identifiers to the fullest extent
possible, consistent with maintaining the usefulness of the
information.
Generally, the use and disclosure of information that does not
identify individuals does not compromise patient confidentiality. As
such, the use and disclosure of non-identifiable health information
should ``fall outside'' the scope of policies that govern personally-
identifiable health information. Health care organizations will need to
take into consideration the practicality and cost of using and
disclosing non-identifiable information. Ultimately, through the
creation and use of non-identifiable health information, more people
can have more information, without compromising patient
confidentiality.
2. Privacy protections should follow the data.
All recipients of health information should be bound by all the
protections and limitations attached to the data at the initial point
of collection. Recipients of health information can use or disclose
personally-identifiable health information only within the limits of
existing authorizations. Any further uses or disclosures require
specific, voluntary patient authorization.
3. An individual should have the right to access his or her own health
information and the right to supplement such information.
All patients should be allowed to copy their records and to
supplement them if necessary. But supplementation should not be implied
to mean ``deletion'' or ``alteration'' of the medical record.
Furthermore, data holders may charge a reasonable fee for copying the
records, but they cannot refuse inspection of the records simply
because they are owed money by the individual requesting inspection.
In certain cases, patients may be denied access to their medical
records. Such instances include if the disclosure could endanger the
life or physical safety of an individual; if the information identifies
a confidential source; if the information was compiled in connection
with a fraud or criminal investigation that is not yet complete; or if
the information was collected as part of a clinical trial that is not
yet complete and the patient was notified in advance about his or her
rights to access information.
4. Individuals should be given notice about the use and disclosure of
their health information and their rights with regard to that
information.
The notice should tell the patient how information will be
collected and compiled, how the collecting organization will use or
disclose the information, what information the patient can inspect and
copy, steps the patient can take to limit access, and any consequences
the patient may face by refusing to authorize disclosure of
information.
5. Health care organizations should implement security safeguards for
the storage, use, and disclosure of health information.
Security safeguards consistent with the Secretary's standards,
whether technological or administrative, should be developed to protect
health information from unauthorized use or disclosure and should be
appropriate for use with electronic and paper records. Any safeguards
should recognize the trade-off between availability and confidentiality
and should be tailored to meet needs as organizations adopt more
sophisticated technologies.
6. Personally identifiable health information should not be disclosed
without patient authorization, except in limited circumstances. Health
care organizations should provide patients with certain choices about
the use and disclosure of their health information.
Patient authorization should be obtained prior to disclosure of any
health information. But, at the same time, some patient information
needs to be shared for treatment, payment, and core business functions.
With this in mind, the Working Group recommends a two-tiered approach
to patient authorization.
The authorization structure allows for a health care organization
to obtain a single, one-time authorization for core activities that are
considered necessary or routine. These activities--identified as Tier
One--are directly tied to treatment, payment and necessary business
functions in keeping with medical ethics. The health care organization
may condition the delivery of care, or payment for care upon receiving
authorization for these activities, which can be obtained at the point
of enrollment or at the time of treatment.
Any activities that fall outside this core group (sometimes
commonly referred to as uses) must be authorized separately by the
patient and fall under Tier Two authorization. The patient can refuse
authorization for these activities without facing any adverse
consequences. Activities in this category include, but are not limited
to:
purposes of marketing;
disclosure of psychotherapy notes;
disclosure of personally identifiable information to an
employer, except where necessary to provide or pay for care;
disclosure of personally identifiable health information
outside the health care treatment entity that collected the
information, if other tier one authorizations do not apply; and
disclosure of personally identifiable health information,
if adequate notice has not been given at the point of the initial
authorization.
The Working Group identified a limited number of circumstances in
which personally-identifiable health information may be disclosed
without patient authorization. These include:
when information is required by law, such as for public
health reporting;
for oversight purposes, such as in fraud and abuse
investigations;
when compelled by a court order or warrant; and
for research, as described in Principle 8 below.
7. Health care organizations should establish policies and review
procedures regarding the collection, use, and disclosure of health
information.
An organization's confidentiality policies and procedures should be
coherent, tying together authorization requirements, notice given to
patients, safeguards, and procedures for accessing personally
identifiable health information. Organizations should also establish
review processes that ensure a degree of accountability for decisions
about the use and disclosure of personally identifiable health
information. During such a process organizations might, for example,
wish to determine routine procedures and special procedures for some
areas of health care where medical information is considered highly
sensitive to the patient.
8. Health care organizations should use an objective and balanced
process to review the use and disclosure of personally identifiable
health information for research.
For some areas of research, it is not always practical to obtain
informed consent and in some cases, a consent requirement could bias
results. Recognizing this, the Working Group advises that patient
authorization should not always be required for research. However, any
waivers of informed consent should only be granted through an objective
and balanced process.
Currently, any federally funded research is subject to the ``Common
Rule,'' where an Institutional Review Board (IRB) is required to make a
determination about the need for informed consent. An IRB can choose to
give a researcher access to personally identifiable health information
with or without informed consent. But some research falls outside the
scope of federal regulations. In such circumstances, health care
organizations should use a balanced and objective process before
granting researchers access to personally-identifiable health
information.
9. Health care organizations should not disclose personally
identifiable health information to law enforcement officials, absent a
compulsory legal process, such as a warrant or court order.
Federal privacy laws generally require that some form of compulsory
legal process, based on a standard of proof, be presented in order to
disclose to law enforcement officers. Law enforcement access to health
information should be held to similar standards. In some instances,
however, government officials may access health information with legal
process for the purposes of health care oversight. In these instances,
the information obtained should not be used against the individual in
an action unrelated to the oversight or enforcement of law nor should
the information be re-disclosed, including to another law enforcement
agency, except in conformance with the privacy protections that have
attached to the data.
10. Health privacy protections should be implemented in such a way as
to enhance existing laws prohibiting discrimination.
Currently, there are state and federal laws that prohibit
discrimination on the basis of a person's health status in areas such
as employment or insurance underwriting. Confidentiality policies
should be implemented in such a way as to enhance and complement these
protections. In effect, privacy can serve as the first line of defense
against discrimination, creating a more comprehensive framework of
protection.
11. Strong and effective remedies for violations of privacy protections
should be established.
Remedies should be available for internal and external violations
of confidentiality. Health care organizations should also establish
appropriate employee training, sanctions, and disciplinary measures for
employees and contractors who violate confidentiality policies.
The 11 principles outlined above focus on information gathered in
the context of providing patient care and are written to establish a
broad framework for the use and disclosure of health information.
Although the Working Group recognizes that the need for privacy
protections in other areas is no less urgent, this consensus document
does not address the following areas:
special considerations about the needs of minors;
information that locates an individual in a particular
health care organization (sometimes referred to as ``directory
information'');
information provided to spouses, dependents and other next
of kin;
public health reporting;
fraud and abuse investigations; and
the appropriate relationship between state and federal
law.
These 11 principles are designed to serve as a baseline for
establishing patient privacy protections. While we all agree that
health information, used in the right hands and with the right
safeguards, can lead to improved health and advances in research, this
information should not be used with disregard for patient privacy.
Patients need to know that adequate protections are in place to protect
their health information. Our hope is that these principles will go a
long way towards establishing appropriate protections and, in the
process, help build public trust and confidence in our health care
system.
The State of Health Privacy: An Uneven Terrain
Preface
Eighteen months ago, the Health Privacy Project launched an
initiative to compile and publish a comprehensive survey of state
health privacy statutes. As word spread that we had undertaken this
effort, we heard two distinct messages, often delivered by the same
people in the same breath: First, ``Nothing like this exists.'' Second,
``Are you crazy? Do you have any idea what you are getting into?'' Over
the past year and a half, we have come to appreciate both the
importance of this effort, and the near impossibility of the task.
At the outset, it is important to say what this report is, and what
it is not. The State of Health Privacy includes a summary of each
state's major statutes related to the confidentiality of personal
health information. The survey is specifically and exclusively a survey
of statutes, not laws. This distinction is important: we did not
research or include regulations, or common law, both of which
ultimately must be understood in order to appreciate the full range of
protections at the state level.
The survey is not exhaustive--there are many more statutes that
address the confidentiality of health information. The summaries speak
most directly to the use and disclosure of information gathered and
shared in the context of providing and paying for health care. In
particular, the condition-specific requirements are meant to be
illustrative; we did not do an exhaustive search for mandatory
reporting requirements or specific conditions.
Throughout, keep in mind that medical information is used in many
different settings, and for many different reasons. There are
innumerable state laws that speak to the confidentiality of health
information--such as laws on workers compensation, public health
reporting, adoption records, birth and death records, motor vehicle
requirements, minor's rights, and so on--that are not generally
addressed in our summaries. For this reason, we have given four
states--Florida, Maryland, New York, and Washington--a more exhaustive
treatment that highlights the breadth and the depth of the state laws
that relate to the confidentiality of health records.
To satisfy diligent scholars and the excessively curious, we
augment the summaries with a comprehensive list of each health privacy-
related law we discovered in the state. (Given the length of these
lists, they are only available in the online edition at the Health
Privacy Project's website: http://www.healthprivacy.org/resources.) We
have also provided a number of overview documents that attempt to pull
together the findings and provide a snapshot of how the states compare
to each other.
This report is not perfect. We may have missed some laws. Laws may
have been repealed or re-interpreted by the courts. Laws may take on a
different meaning in their application than they do in the plain
reading. States may have issued regulations implementing their laws
that amplify, diminish, or otherwise affect the law's impact. However,
we determined that you-the reader-would benefit from the timely
publication of this report, and would not be offended by our asking
your indulgence for what we did not have the time or the resources to
accomplish. In fact, we ask your assistance--if you discover a major
statute we have overlooked, or if you find we mis-characterize a law,
or if there is anything else you would like to contribute to enhance
the accuracy and completeness of The State of Health Privacy, contact
us. Your input is appreciated.
Finally, and most importantly, this survey is part of a larger body
of work undertaken by the Health Privacy Project. Throughout, we have
tried to maintain a sense the ultimate goal: to protect the privacy of
people's health information.
In the health care arena, maintaining the confidentiality of
medical information and communications has been an essential element of
the relationship between doctors and their patients. Increasingly,
however, major changes in health care--such as the rise of managed
care, the development of electronic health information networks, and
reform efforts to improve individual and community health--all depend
on accumulation of and access to complete and reliable patient data.
Protecting privacy and improving health and access to health care
are values that have long been viewed as in conflict. Consumer
advocates often view public health and research initiatives as threats
to individual privacy, whereas public health officials and researchers
may treat privacy as a barrier to improving health. In fact, the
converse is true--protecting privacy and promoting health are values
that must go hand-in-hand.
Without trust that the personal, sensitive information that they
share with their doctors will be handled with some degree of
confidentiality, patients will not fully participate in their own
health care.
The consequences of people not fully participating in their own
care are quite troubling, for individual patients as well as the larger
community. For instance, incomplete or inaccurate information can
hamper a doctor's ability to accurately diagnose and treat a patient,
inadvertently placing a person at risk for undetected and untreated
conditions. In turn, if doctors are receiving incomplete, inaccurate
information, the data they disclose for payment, research, public
health reporting, and outcome analysis will be unreliable. Ultimately,
information that lacks integrity at the front end will lack integrity
as it moves through the health care system. Thus, protecting patient
privacy is integral both to improving individual care and to the
success of public health initiatives and quality of care.
There is no doubt that the public is deeply concerned about the
lack of privacy in the health care environment. A survey released by
the California Health Care Foundation in January 1999 found that
``public distrust of private and government health insurers to keep
personal information confidential is pervasive. No more than about a
third of U.S. adults say they trust health plans (35%) and government
programs like Medicare (33%) to maintain confidentiality all or most of
the time.'' The consequences of such distrust--real or perceived--are
significant. The Foundation's survey identified that:
One in every five people believe their health information
has been used or disclosed inappropriately.
One of six people engage in some form of ``privacy-
protective'' behavior when they seek, receive, or pay for health care
in this country. Such behavior includes paying out of pocket for care;
intentionally seeing multiple providers to avoid the creation of a
consolidated record; giving inaccurate or incomplete information on a
medical history; asking a doctor to not write down the health problem
or record a less serious or embarrassing condition; and even not
seeking care to avoid disclosure to an employer.
Currently, there is no comprehensive federal law protecting the
privacy of people's medical records. Congress has acknowledged that
such a law should be passed and imposed a deadline on itself to do so
by August 1999. If Congress fails to meet the deadline, the Secretary
of Health and Human Services is required to issue regulations by
February 2000.
Health privacy is not a new issue to the U.S. Congress. Each year
over the past decade as debate has resumed over how to best craft a
health privacy law, the question is inevitably raised, ``What have the
states done? What are the state health privacy laws? What will be the
impact on the states of any federal preemption of state law? What
negative and positive models exist for us to learn from?'' For the most
part, these questions have gone unanswered. Until now, no comprehensive
compilation of state health privacy existed.
Bear in mind as you read this report that, in the absence of a
comprehensive federal health privacy law, the limited privacy
protections people currently enjoy have been put in place by state
legislatures. The terrain of state health privacy law may be uneven,
but that shaky ground plays a significant role.
Executive Summary
There is no comprehensive federal law that protects the privacy of
people's health information. The U.S. Congress is moving ahead to meet
a self-imposed deadline to enact a broad health privacy statue by
August 1999. If the deadline is not met, the Secretary of Health and
Human Services must issue regulations by February 2000. At this time,
people must rely on whatever health privacy protections are built into
their state's statutes.
As the congressional debate over health privacy heats up, there is
a question that is always asked but--until now--impossible to answer.
``What state laws exist in this area? How have states responded to the
health privacy needs of their citizens? ''
This report is the first-ever comprehensive 50-state survey of
health privacy statutes. In our experience, the hallmarks of
researching state health privacy laws have been that: 1) nothing is
simple; and 2) nothing is predictable. In the process of researching,
analyzing, and summarizing the statutes, we reached a number of
conclusions and made a few surprising discoveries. But in many more
ways, the states defy categorization.
State laws relating to health privacy have been enacted at
different points in time, over many years, to address a wide variety of
uses and public health concerns. One must approach each state on its
own terms and attempt to understand the protections as a unique whole
within the state. In striving for precision and nuance, our labels of
state laws are accompanied by qualifiers and explanations.
Laws relating to health privacy can be found in nearly every nook
and cranny of a state's statutes--in obvious and obscure sections of a
state's code, buried in regulations, developed in case law, and
detailed in licensing rules. Florida, for example, has more than 60
statutes that address health privacy, and it is not unique.
A number of initial observations emerge from the state summaries:
States legislate and regulate health privacy by entity.
There is little mystery about why state health privacy laws are so
extensive, vast, and detailed: the statutes reflect the diverse users
of health information. Consider the following four types of users:
physicians, schools, insurers, and state agencies. Each has a specific
function in the state and a legal and regulatory structure specific to
their roles. Thus, the statutory requirements for how they handle
medical information are different.
To understand what confidentiality protections do exist at the
state level, one must first begin by examining the laws applying to the
different entities that collect, use, maintain, and distribute health
information. Even states that attempt to handle health privacy in a
comprehensive fashion ultimately establish unique rules for different
entities. In looking at a state's laws and determining what kind of
privacy protections exist, one must always ask, ``Who's holding the
data?'' and ``What is the medical condition at issue?''
The end result of this legislating by entity is that state laws--
with a few notable exceptions--do not extend comprehensive protections
to people's medical records. Thus, a state statute may impose privacy
rules on hospitals but not dentists. The state may restrict the use and
disclosure of information derived from a genetic test but not
information obtained in a routine physical. Or just the opposite may be
true in a neighboring state.
The cumulative effect of these various statutes might appear
erratic, but so many of the laws that do exist provide meaningful
protections for consumers and speak to the specific needs of the
organizations and citizens of the state. For instance, a nursing home
may have different information needs than a public hospital, and state
laws attempt to accommodate these differences.
The vast majority of state statutes were never intended to
be comprehensive.
Virtually every state has some law aimed at the confidentiality of
patient, but very few states have anything approaching a comprehensive
health privacy law. Two notable exceptions are Rhode Island and
Wisconsin, each of which has comprehensive health privacy laws. Many
states have health privacy laws governing certain health care entities,
such as hospitals or clinics, but no privacy protections regulating
health plans and HMOs.
State confidentiality requirements are part and parcel of larger
statutes that provide consumer protections or regulate persons or
entities. Many of the statutes, for example, are imbedded within
licensing requirements. In this context, the provider is required to
maintain health information in confidence in order to obtain and
maintain a license to practice from the state. One must read all of the
statutes together in order to glean an understanding of how health
information is protected as it moves between persons and entities.
An ethical duty to maintain confidentiality is often
assumed.
Most states appear to presume an ethical duty on the part of health
care providers to keep information confidential. Many statutes, for
instance, do not explicitly impose a duty of confidentiality, but they
do stipulate a penalty for breaching patient confidentiality. It seems
that in these instances, the states did not see a need to legislate the
ethical duty. Unfortunately, the users of health information have
extended well beyond those who may be bound by a professional codes of
ethics.
State laws have not kept pace with changes in health care
delivery and technology.
Most state laws do not reflect the dramatic changes in the health
care environment or the dramatic changes in information technology.
Today, for instance, the majority of health care is not delivered by
physicians. Integrated delivery systems (such as HMOs and provider
networks) and the establishment of statewide health information
databases have created new demands for data that push well beyond the
limits originally anticipated by the states. The variety of people and
entities collecting, receiving and using health information has also
extended far beyond the health care environment. A physician, for
example, may be obligated to report a person with epilepsy to the
Department of Motor Vehicles, which in turn may revoke a driver's
license.
Therefore, in many ways, the state laws defy summarization--they
are detailed, specific, and intricate. Nevertheless, we have attempted
to bring some coherence to this report. The summaries are arranged in
four broad categories: Patient Right of Access, Restrictions on
Disclosure, Privilege and Condition-specific Requirements. Our major
findings in each category are listed below.
Key Findings
Patient Access
States vary widely in the rights they grant to patients to receive
and copy their own medical records. Some states have no statutory right
of access such as Kansas and North Dakota. Three states--Alabama,
Idaho, and New Mexico--and the District of Columbia only have a
statutory right for patients to access their own mental health records.
On the opposite end of the continuum, a few states--such as
Connecticut and Minnesota--grant access to records maintained by nearly
all of the potential sources of patient data, i.e. government agencies
and entities, hospitals, physicians, insurers, schools, and even non-
traditional health care providers such as natureopaths. Maine and South
Dakota, for example, have cast a particularly wide net with respect to
providing access to records maintained by health care providers by
using broad definitions that anticipate future users and holders of
medical information, such as those performing in vitro fertilization
and blood banks.
Most states fall somewhere in the middle of these two extremes.
Forty-four states provide some right of access, but this figure is a
bit misleading. The right of access quickly breaks down:
33 states provide a right of access to hospital records;
13 states provide a right of access to HMO records; and
16 states provide a right of access to insurance records.
Many additional statutes cover specific providers--such as
physicians, psychiatrists, and pharmacists. However limited the right,
the impact of providing the right should not be underestimated. For
example, in response to the public's desire to utilize alternative
sources for contact lenses, Colorado and other states require
optometrists to disclose prescriptions to their patients.
All state statutes that grant people a right to see and copy their
own medical records limit that right with a set of exceptions. The most
common exception is that a patient can be refused access to his or her
own medical record if the record holder believes that the release of
the information could endanger the life and safety of the subject of
the information or another person.
Many states have also granted patients the right to amend or
correct their medical information, particularly when the records are
held by insurance companies. In Illinois, New Jersey and Ohio, for
example, the statute includes a detailed procedure for resolving a
patient's challenge to the accuracy or completeness of the record.
Where the provider and the patient disagree, for example, the patient
may be able to insert a statement of his or her position in the record.
Most states allow a person or entity to charge patients for copies
of their medical record. Some states specify a cost in the statute--in
Kentucky, for example, a health care provider or hospital must provide
a patient with a free copy of their medical record. A patient may be
charged for additional copies, but not more than $1 per page. Other
states require that the fee be waived if the patient is contesting an
adverse underwriting decision. The most common approach is to stipulate
that an entity may charge a ``reasonable'' fee.
Restrictions on Disclosure
States vary widely in terms of the restrictions or prohibitions
they impose on disclosures of medical records and medical information.
The restrictions tend to be triggered in two instances: by the entity
holding the data, and the kind of information being held.
For the most part, the state statutes prohibit a person or entity
from disclosing information unless certain conditions are met. The most
notable impact of this approach is that it may limit the actual
protections afforded the data. Once the information is disclosed, it
may or may not be afforded the same protections by the receiving
entity. For instance, the state laws may not place limits on the re-
disclosure patient data, or the receiving entity may not be under any
legal obligation to adhere the privacy rules imposed on the disclosing
entity.
In comparison, a few states--such as Wisconsin and Rhode Island--
have statutes that prohibit medical information from being disclosed,
regardless of the entity holding the record.
Overall, the most common restriction found in state statute is that
patient authorization must be secured prior to health information being
disclosed. Some states specify the format and content of the
authorization form in statute. Many states allow patients to revoke
authorizations.
At the same time, these statutes all specify numerous exceptions to
this general rule in which a person or entity may disclose information
without patient authorization. The most common instances include: for
purposes of treatment; to secure payment for healthcare; for auditing;
and for quality assurance activities. Most statutes allow access to
patient data for research purposes, without any patient notification or
authorization. (See later discussion on research.)
Also of note is that some states do prohibit the re-disclosure of
medical information. In such instances, an entity that receives medical
information is prohibited from re-disclosing the information unless a
separate authorization is secured, or the disclosure is in keeping with
the statutory requirements. Montana has stated that although it is
state public policy that a patient's interest in the proper use of
health care information survives, the state is not going to statutorily
regulate disclosures because a person' expectation of privacy changes
when the information is held by a non-health care provider.
Privileges
A common myth is that the doctor-patient privilege prohibits health
care providers from sharing information about their patients. The truth
is the law of privilege is a rule of evidence and quite limited in
scope. Privilege applies to a patient's (or provider's) right to keep
certain communications confidential in a legal proceeding.
We have included a survey of states' statutory privileges for two
reasons: 1) to date, all of the proposed federal health privacy
legislation leaves state privilege law intact; and 2) many states'
statutes governing the confidentiality of health care information
maintained by HMOs provide that an HMO is entitled to claim any
statutory privilege against disclosure that the provider of the
information is entitled to claim. Thus, in order to understand what
privilege an HMO might be able to exercise, it is necessary to know
what statutory privileges exist.
A common misconception about the physician-patient privilege is
that it is a general prohibition against a health care provider sharing
information about his or her patients. However, it is important to
recognize that in legal terms, there is a distinction between
``privilege'' and ``confidential.'' The law of privilege is generally
seen as a rule of evidence which is limited in scope. It allows a
patient in a legal or quasi legal proceeding to refuse to disclose and
to prevent others from disclosing certain confidential information
(usually communications) obtained during the course of diagnosis and
treatment. In contrast, a health care provider's duty of
confidentiality to her patients, arising from a code of ethics, by
regulation, or otherwise, is a broader duty not to disclose to the
public information obtained in a professional capacity.
That being said, it must be noted that even legal professionals
often use the terms interchangeably. We have attempted to note where a
state has worded its statutory privilege in such a way as to extend it
beyond a legal or quasi legal proceeding.
It must be emphasized that this is a summary of statutory rules of
privilege. Many more providers and entities may be covered by a state's
common law privilege. The summaries do not include a discussion of when
privilege may be waived. State law is detailed and voluminous on this
subject, and we chose simply to indicate to whom the statutory
privilege applies.
Condition-specific Requirements
Nearly all states have laws that impose condition-specific privacy
requirements, most often to shield people with mental illness,
communicable diseases, cancer, and other sensitive, stigmatized
illnesses from broad disclosures. Many of these laws were passed to
respond to public fear that certain health information would be widely
disclosed and used to deny them benefits or could result in other harm.
Where this fear acted as a barrier to seeking health care, treatment,
or counseling, states have moved to bolster public trust and confidence
in the health care system by enacting heightened privacy rules in these
specific areas. The protections tend to attach to the information at
the point of collection, before the information is disclosed. These
requirements may, for example, direct a provider, hospital, or
laboratory to obtain a particular kind of authorization from the
patient or more stringently restrict disclosure.
In some circumstances, the condition-specific requirements allow
for greater disclosure of the information. Some mental health statutes,
for example, explicitly allow family members to access the mental
health records of a family member who has been committed. Other
statutes allow employers to share medical information about an employee
if it affects the performance of her job.
Most of the condition-specific requirements that exist at the state
level, however, were enacted hand-in-hand with mandatory reporting
laws. While the summaries note the protections afforded the data, it is
important not to lose sight of the fact that these privacy laws were
enacted on the backend of laws requiring doctors and other health care
providers to report to state officials identifiable patient data
related to certain illnesses and conditions. Clearly, state lawmakers
viewed such privacy protections as a necessary balm to quiet public
fears of the government developing health information databases on
vulnerable citizens. Our inclusion of the public health reporting
requirements and related privacy protections are not comprehensive, but
we point out that many states' reporting requirements are aimed beyond
communicable or infectious diseases. Many states collect health
information to study costs, outcomes, and quality--all of which rely on
extensive patient data. In turn, there is a great demand--often
answered in the affirmative--for access to this data.
All states have laws designed to control the spread of contagious
diseases, which include requirements that named individuals with
particular illnesses or conditions be reported to health authorities.
Again, in the vast majority of these condition-specific requirements,
the privacy protections are linked to the mandatory reporting
requirements. In such instances, the confidentiality requirements and
protections only apply to the agency collecting the data. Many states,
for example, require providers to report birth defects to the state's
registry. The statute then limits how the registry can use and disclose
the information. These protections, however, do not apply to any other
entity holding the same information--such as a provider, hospital or
insurance company.
Remedies and Penalties
Most state health privacy statutes contain some form of remedies
and penalties that are triggered by violations of the law. Commonly
found are private right of action provisions granting people the
ability to bring lawsuits when the statute has been violated, without
first having to meet any additional standard of proof, i.e. that the
violation was willful or intentional. It is enough that the law was
violated. A full range of damages, remedies, and attorney's fees and
costs are usually available, however the monetary damages are often set
quite low. In some cases, these statutory remedies may be construed as
exclusive, thereby barring people from raising other claims, such as
privacy torts or other common law claims.
Government-maintained Records
Across the board, records held by government agencies and officials
are treated differently--and are usually more protected--than the
medical information collected and held by the private sector. In some
instances, the medical records held by the government are the only
records protected in statute. In effect, a state statute may impose
confidentiality requirements only on public hospitals, leaving people
who are treated in private hospitals without the same legal safeguards.
In Oregon, for example, the statutory prohibitions on disclosure,
including authorizations, apply only to public providers of health
care. Private health care providers are simply ``encouraged, but not
required to adopt voluntary guidelines limiting the disclosure of
medical records...''
Although this legal distinction--between public and private holders
of medical information--is rooted in the constitutional principle that
there must be limits on government action vis-a-vis the individual, it
may not be particularly meaningful to health care consumers. Therefore,
privacy protections have been extended in a number of federal and state
privacy statutes to restrict the private sector's collection and use of
personal information.
Research
Again, there is little uniformity in how state statutes regulate
researcher access to people's medical information. The vast majority of
laws, however, do allow researchers broad access to patient records. As
the laws apply to private entities, researcher access is almost always
built in as an exception to a statute's patient authorization
requirements. What limits do exist usually speak only to specific
information--such as genetic information or HIV/AIDS information.
On the other hand, researcher access to patient data held by
government entities, i.e., agencies, registries, is in some instances
more detailed. Some registries, for example, have strict conditions
that must be met before researchers can access data and may require
that personal identifiers be removed before a researcher can access
information. Laws applying to government entities are also more likely
to prohibit researchers from re-disclosing patient data.
Conclusion
Again, there is no comprehensive federal law protecting the privacy
of people's medical records. Congress has acknowledged that such a law
should be passed and imposed a deadline on itself to do so by August
1999. If Congress fails to meet the deadline, the Secretary of Health
and Human Services is required to issue regulations by February 2000.
We hope these reports are useful to you as you move forward. We are
available to work with you.
The Health Privacy Working Group Members: Dr. Bernard Lo,
University of California-San Francisco; Paul Clayton, Columbia
Pesbyterian Medical Center; Jeff Crowley, National Association of
People with AIDS; John Glaser, Partners Health Care System, Inc.; Nan
Hunter, Brooklyn Law School; Shannah Koss, IBM; Chris Koyanagi, Bazelon
Center for Mental Health Law; John Nielsen, Intermountain Healthcare;
Linda Shelton, National Committee for Quality Assurance; and Margaret
VanAmringe, Joint Commission on Accreditation of Healthcare
Organizations.
As this report documents, there is little probability that any
federal law could match the breadth and scope of the existing state
laws. As such, any federal law that fully preempted state law would
eliminate for consumers some of the rights and protections they
currently enjoy and disrupt current state legal and regulatory
structures. Here's why----
States have been the first to respond to concerns about
health privacy and they have enacted many strong protections.
State health privacy statutes cover a broad range of entities and,
not surprisingly, are both weak and strong. In terms of broad consumer
protections, one can identify many significant gaps and weaknesses in
most state statutes: such as a limited right for a patient to access
his or her own medical record; little ability for patients to limit
disclosure of their medical records; and little recourse when the laws
are violated.
On the other hand, state laws enacted in response to a particular
public concern, or a public health threat--such as in the areas of
mental illness, communicable disease, cancer, and genetic testing--are
often strong, detailed, and aimed at the states' unique experiences
with their citizens.
State laws address a level of detail not considered in any
of the federal proposals.
The importance of the detail in state health privacy law should not
be underestimated. Because the states legislate by entity, they are
often able to craft laws that speak to the unique needs of the patient
population and the information needs of particular entities. An HMO,
for example, has very different needs than a family planning clinic.
State law is extensive--it is impossible to predict the
full impact of full federal preemption.
Most importantly, it is almost impossible to predict the full
impact of federal preemption on state laws relating to health privacy.
Remember that these summaries are only the tip of the iceberg in terms
of relevant state statutes. Many more laws govern areas such as
adoption, workers compensation, public health reporting, civil,
judicial and administrative procedures, fraud and abuse, and law
enforcement access.
There is widespread consensus that a federal law could help to
provide significant new protections and to establish some basic rules
about the use and disclosure of health information. However, until this
point, the policy debate about preemption tended to be based on
rhetoric, not fact. There is a large body of law before us now. While
many of the facts are reassuring, it does not lend itself to easy
answers.
A significant challenge is before us. There is no doubt that such a
comprehensive federal health privacy law could be beneficial in many
ways. But while a federal law could substantially benefit people by
establishing a baseline of consumer protections, a federal law that
ignored the significant role states have played in protecting health
information could disrupt the legal and regulatory structures at the
state level and, in turn, some of the protections currently afforded to
consumers.
Our hope is that this report will serve as the factual basis upon
which to proceed, providing us with a true opportunity to move beyond
the rhetoric that has so far defined this debate.
The Preemption Debate
At the national level, there is an ongoing debate over how a future
federal health privacy law should relate to existing and future
stronger state laws. Passage of any federal law will necessarily
preempt weaker state laws. But will Congress choose to establish a
federal ``floor'' above which states would be free to enact greater
protections? Or will the federal law fully preempt state laws by
creating a ``ceiling,'' thus eliminating both weaker and stronger state
laws and preventing the passage of future stronger state laws?
We must begin with the obvious: there is a large body of state law
that will be impacted by any federal law. Many of these laws were
passed over many years, and they cover significant ground. Out of
necessity, the states have moved forward in recent years to pass health
privacy laws to fill a vacuum that might otherwise be addressed in a
federal law--such as in the areas of genetic testing, prescription
records, HMO records, and integrated databases. A couple of states--
such as Rhode Island and Wisconsin--have even passed fairly
comprehensive laws.
Thus far, the preemption debate has played out as follows.
Proponents of the full preemption of state law argue that a one-size-
fits-all national standard is necessary to conduct health care
activities across state lines. Advocates for a federal floor argue that
states must be free to enact stronger protections to shield its most
vulnerable citizens from stigma and discrimination, and encourage them
to seek care without fear of reprisals.
But this debate must be about much more. As our research shows, the
states' health privacy protections are deeply integrated into powers
traditionally held by the states: licensing, public health, and police
powers. As such, it would be unwise--and, in fact, unprecedented--for
the federal law to fully preempt state law. At a minimum, the states
must be free to enact greater protections for its citizens, to regulate
health care entities, and to conduct vital public health functions.
Health Care Organizations Already Comply With 50 State Laws
Consider the state of affairs today: health care entities that do a
great deal of business across state lines are currently required to
comply with fifty different business across state lines are currently
required to comply with fifty different state laws. The interplay
between state and federal laws is not unique to the health care
environment. In the context of other complex, interstate activities,
Congress has addressed the interplay between state and federal laws,
such as in the Right to Financial Privacy Act, the Fair Credit
Reporting Act, and the Electronic Communications Privacy Act, which
regulate the banking, credit, and communications industries. In
enacting these laws, Congress left the states free to enact more
protective laws as they see fit.
Some preemption supporters have expressed the fear that states will
pass laws tat are too privacy protective, thereby interfering with
important health-related activities. Our research documents that states
have been quick to take corrective action to respond to the concerns of
health plans, researchers, and others when they have `gone too far.' In
two instances in which a state health privacy statute was deemed to
interfere with vital health care functions, states have moved quickly
to amend their laws. Minnesota, for example, amended its law relating
to researcher access to medical records after hearing objections from
health care organizations in the state. More recently, Maine repealed a
health privacy law after objections on the part of press and family
members and later enacted a more limited statute.
Many states are considering pending health privacy bills in an
attempt to fill the gap created by the absence of a federal health
privacy law. In other contexts, however, the momentum behind such state
initiatives drops significantly following the passage of comprehensive
federal legislation. After passage, state activity is likely to reflect
the standards set out in the federal law, thereby increasing
uniformity.
One of the more surprising--and potentially unifying--findings of
this report is the most state laws are weaker than the standards
proposed in many of the federal now under consideration. Therefore, a
federal law may provide a substantial degree of uniformity simply by
preempting weaker state laws, However, policymakers should be cautions
not to interfere with the states' vital and established public health
and regulatory mechanisms.
State Laws Address a Level of Detail Not Considered in Any of the
Federal Proposals
State health privacy laws address a level of detail not found in
any of the federal proposals. For the most part, state health privacy
laws are organized by entity, and the statutes include requirements and
specifications explicitly related to that entity. There may be separate
statutes governing many different entities: employers, nursing homes,
health maintenance organizations, health and life insurers,
psychiatrists, chiropractors, hospitals and insurers.
In addition, there are numerous policy issues traditionally acted
on at the state level that include health privacy provisions. There
include anti-discrimination laws, commitment proceedings for the
mentally ill, adoption, foster care, mental health treatment,
reproductive health, parental involvement, partner notification, and
abuse and neglect.
In comparison, federal health privacy proposals have on the whole
treated all health care organizations the same. The federal proposals
would also establish--with a broad brush--general rules governing the
use and disclosure of health information. These proposed Rules aim to
address the vast majority of circumstances in which health information
is used and disclosed, but they do not begin to approach the level of
detail that has been imbedded in state law. For instance:
In South Carolina a physician is expressly prohibited from
selling medical records to someone other than a hospital or provider
licensed by the state. Before a physician may sell medical records, he
must publish a public notice of his intention to sell the records and
of a patient's right to retrieve their records if they prefer that
their records not be included in the sale.
Maryland has an intricate statutory system for dealing
with mental health records. The disclosure of mental health records is
governed by the state's Confidentiality of Medical Records Act. One
provision stipulates that mental health records may not be disclosed
between health care providers unless a patient has received a current
list of the participating providers and has signed a written agreement
to participate in the client information system developed by the
agency.
In Florida, a minor may obtain treatment for sexually
transmissible diseases without the consent to their parents or
guardians. [Fla. Stat. Ann. Sec. 384.30.] The fact of consultation,
examination, and treatment of the minor is co0nfidential, not subject
to the disclosure requirements of other statutes, and cannot be
divulged in any direct or indirect manner except as authorized by
statute, including sending a bill to the parent or guardian.
The level of detail illustrated above is not even contemplated by
any of the current federal proposals, and regulating these specific and
unique spheres is clearly not the intent of any of the federal
proposals. If Congress decides to fully preempt state law, it will most
likely eliminate significant consumer protections without replacing
them with an equivalent degree of federal safeguards.
States are the First to Respond to Concerns About Privacy and Have
Enacted Many Strong Protections
Based on our research, it appears that many state laws governing
the broad agrees sought to be covered in the federal law--patient
access to records, notice of information practices, patient
authorizations for disclosure, remedies for violations of the law--are
weaker than many of the federal proposals. Thus, a federal law that
established a floor could provide uniformity, while raising the overall
privacy protections for consumers.
However, it appears that even the strongest federal proposals would
not set the bar as high as the condition-specific protections in
certain state laws. Thus, a preemptive federal ceiling could cause the
citizens of some states to actually forfeit the protections they are
now guaranteed under their state laws. Again, states have enacted
condition-specific protections in two main areas: 1) to provide back-
end protection to information collected as part of a mandatory
reporting requirement; and 2) to encourage people to seek care for
conditions that are sensitive and for which there is a high risk of
stigma and discrimination.
Almost every state has enacted laws specific to HIV/AIDS.
California, for example, has enacted laws, covering testing, reporting,
partner notification, and discovery. The results of an HIV/AIDS test
may not be disclosed in a form that identifies an individual, without
patient consent for each disclosure, except in very limited
circumstances. For instance, a physician or local health officer may
disclose HIV test results to the sex or needle-sharing partner of the
patient without consent, but only after the patient refused or was
unable to make the notification. The law also requires patient
authorization in more circumstances than provided for under the Senate
proposals. In California, an individual's health care provider may not
disclose to another provider or health plan without written
authorization, unless to a provider for the direct purposes of
diagnosis, care, or treatment of the individual.
Almost half the states now provide specific and strong
protection for information derived from genetic information. In Georgia
this information is considered to be strictly confidential and may be
released only to the individual tested and to persons specifically
authorized by such individual to receive the information. Any insurer
that possesses information derived from genetic testing may not release
the information to any third party without the explicit written consent
of the individual tested.
Every state has laws that establish rules particular to
mental health information, covering a wide range of activities. In
Massachusetts, for example, a psychologist needs a patient's written
consent to disclose any confidential communications about the patient,
including the fact that the patient is undergoing treatment. An HMO is
prohibited from acquiring or disclosing any communication by a member
to a psychotherapist arising out of the outpatient diagnosis or
treatment of a mental or nervous condition without the express and
informed written consent of the member. No such written consent may be
made a condition of the receipt of such benefits or any other benefits
for which the member is otherwise covered.
Tennessee law stipulates that the state's Department of
Health records on sexually transmitted diseases may not be released
even under subpoena, court order, or other legal process, unless the
court makes a specific finding concerning each of five criteria
including: weighting probative value of the evidence against the
individual's and public's interest in maintaining its confidentiality;
and determining that the evidence is necessary to avoid substantial
injustice to the party seeking it and either that the disclosure will
not significantly harm the person whose records are at issue or that it
would be substantially unfair as between the requesting party and the
patient not to require disclosure.
Many states have laws similar to the ones cited above. Again, none
of the federal proposals reach these levels of specific protection.
Wiping out such laws could create a public health crisis, leaving
people vulnerable by undoing protections that encourage people to seek
testing, counseling, and treatment for a number of conditions.
It is Impossible to Predict the Full Impact of Full Federal Preemption.
State Law is Extensive--a Fully Preemptive Federal Law Runs the Risk of
Significant, Unintended Consequences.
Even a cursory glance at the state statutes reveals that laws
relating to the confidentiality of medical information are found
throughout state codes. Major statutes are found in the Civil Code, the
Insurance Code, the Health and Safety Code, the Penal Code, and the
Welfare and Institutions Code. The laws cover a wide range of
activities including treatment, payment, insurance-related activities,
peer review, research, and prescribing drugs. Most importantly, states
have developed bodies of law around discrete issues that touch on the
use of health information--such as anti-discrimination, worker's
compensation, parental involvement, adoption, HIV/AIDS partner
notification, and access by law enforcement, and even real estate.
It is nearly impossible to predict in advance the full impact of
total preemption on state law and consumer protections. Some laws, for
example, may be tied to larger anti-discrimination statutes. A fully
preemptive federal law may inadvertently nullify the entire statute.
For instance, A California law that prohibits insurers
from discriminating on the basis of a person's ``genetic
characteristics that may, under some circumstances be associated with
disability in that person or that person's offspring.'' The law
includes a provision on authorization requirements for the disclosure
of genetic information, which may open up the entire statute to
preemption.
Overall, the states are best equipped to respond to new, unique,
and inherently local challenges in health care and public health. It is
impossible to predict what issues will require prompt attention in the
future, but a preemptive federal law would prevent states from
responding at all.
Conclusion
State health privacy statutes are both weak and strong. In terms of
broad consumer protections, many gaps and weaknesses can be identified
in most state statutes--such as a limited right for a patient to access
his or her own medical record; little ability for patients to limit
disclosure of their medical records; and limited recourse available to
people when the laws are violated.
On the other hand, state laws enacted in response to a specific and
heightened public concern, or a public health treat--such as in the
areas of mental illness, communicable disease, cancer, and genetic
testing--are strong, detailed, and aimed at a state's experience with
its own citizens.
The level of detail in state health privacy law should not be
underestimated. Because the states legislate by entity, they are able
to craft laws that speak to the unique needs of their citizens, both in
terms of the patient population, and the information needs of
particular entities. An HMO, for example, has very different
information needs than a family planning clinic.
An urgency exists to pass a comprehensive federal law that protects
the confidentiality of medical information, fueled in part by the
congressionally-mandated deadline to do so and by escalating public
anxiety over the lack of enforceable health privacy rules. There is
widespread consensus that the federal government must act to protect
the privacy of people's records. However, as this report documents, we
must proceed with extreme caution in determining the appropriate
relationship between any future federal law and existing and future
state laws.
While a federal health privacy law could significantly benefit
consumers by establishing a baseline of consumer protections, if not
handled properly and with an eye to the existing state laws, a federal
law could also significantly disrupt the regulatory and legal structure
at the state level, thereby weakening or eliminating crucial consumer
protections.
Bear in mind that these summaries are only the tip of the iceberg
of the state statutes relating to health privacy. It is impossible to
foresee all of the laws that would be affected by a preemptive federal
law. This report is intended to be the beginning of a dialogue on
preemption that is grounded in fact, not rhetoric and conjecture.
The challenge before us now is to examine the impact of the passage
of any federal health law on the privacy rights of various state
citizens. We must also rely on this compilation of state statutes as we
address the federal proposals' impact on state public health and
regulatory regimes. The State of Health Privacy takes the first step to
answering many of these challenges before us by providing the empirical
basis on which to do so.
Mrs. Johnson of Connecticut. Thank you very much. Mr.
Thomas Jenkins, the Assistant General Counsel for Blue Cross
Blue Shield of Nebraska, on behalf of Blue Cross Blue Shield
Association.
STATEMENT OF TOM JENKINS, ASSISTANT GENERAL COUNSEL, BLUE CROSS
AND BLUE SHIELD OF NEBRASKA, ON BEHALF OF THE BLUE CROSS AND
BLUE SHIELD ASSOCIATION
Mr. Jenkins. I am Thomas J. Jenkins, Assistant General
Counsel of Blue Cross and Blue Shield in Nebraska, testifying
today on behalf of the Association. Thank you for the
opportunity to testify.
Protection of the confidentiality of subscriber data is of
paramount importance to us. As part of employee training at
Blue Cross and Blue Shield in Nebraska, employees must sign a
policy that stipulates confidentiality breaches may result in
termination. While we believe that consumers must be assured
that their records are kept confidential, we believe that
Federal legislation must balance the need to safeguard medical
records with the need for health plans to provide health care
services efficiently.
Let me highlight four areas where certain proposals on the
table now fail to achieve this balance.
Number one, new authorizations. One of the goals of Federal
legislation is to guard against disclosure of personal data. Of
course, health plans must disclose personal data in order to
administer health benefits.
Some bills accommodate this through a statutory
authorization for data disclosure for treatment, payment or
health care operations. Other legislation requires health plans
to obtain new and multiple authorizations from all of their
subscribers. This requires mailing authorization forms to each
of our 550,000 subscribers, as well as developing new systems
to track whether or not those authorizations have been
returned.
Even after multiple mailings, some subscribers will never
respond. The postage costs alone would be significant, but
would pale in comparison to the personnel and system costs
necessary to accommodate this authorization process.
Because of these proposals, we would be forced to cancel
the coverage of subscribers who fail to return these
authorizations because we could not process their claims
without legal access to their personal data. We urge Members of
Congress to adopt a statutory authorization as part of
confidentiality legislation.
Number two, static definitions. The statutory authorization
makes it imperative that the definition of health care
operations include all the functions we now use to administer
benefits, but most proposals incorporate a static definition.
They do not allow for innovative services to be added.
This year another Blues plan adopted a new program called
SARA, Systematic Analysis Review and Assistance. Every day
their computer evaluates data to identify files that need
further review. This program has improved the care of
subscribers. For instance, a 60-year-old male had claims for
Viagra as well as for nitrates. The combination of these two
types of drugs has the potential to be fatal. The SARA program
worked with his physician to resolve this conflict.
A 1-year-old child had 15 claims for emergency room visits
in the past 18 months. The parents were referred to an asthma
program. No further visits to the emergency room were required
in the next 6 months after that.
If a prescriptive definition for health care operations had
been legislated in, say, 1995, we could never have developed
this program. I urge you, therefore, to assure any definition
can accommodate innovation.
Third, inspection and copying. This problem involves
provisions that would allow subscribers to inspect, copy and
amend all information that is individually identifiable. Most
data we obtain are administrative in nature. For example, the
claims. We believe it is important to differentiate between
these data which must be protected from the data which must be
produced.
Under some proposals, we would have to produce even
insignificant paper that may have a subscriber's name or
identifying item on it, routine claim runs, and so forth. This
would require us to redesign our computer systems and
operations to centralize all data, an extremely expensive
investment that would increase premiums. This absolute approach
is not necessary. In my State a recent law limits the
inspection rights to medical records held by providers. We urge
Congress to limit inspection rights to actual medical records.
Fourth and final, the preemption of State law. We have had
a lot of discussion of that today. We believe any Federal
legislation should preempt State confidentiality rules. The
patchwork of State privacy laws are especially difficult when
viewed from the patient-provider perspective. For instance, if
a patient's insurance is through an employer in New York City,
but their physician is located in New Jersey and the patient
lives in Pennsylvania, whose confidentiality laws apply? How
does the provider know how to comply?
We urge Congress to provide a full preemption of State
confidentiality laws.
Thank you again for the opportunity to testify today.
[The prepared statement follows:]
Statement of Tom Jenkins, Assistant General Counsel, Blue Cross and
Blue Shield of Nebraska, on behalf of the Blue Cross and Blue Shield
Association
Mr. Chairman and Members of the House Ways and Means
Subcommittee on Health, I am Tom Jenkins, Assistant General
Counsel of Blue Cross and Blue Shield of Nebraska, testifying
today on behalf of the Blue Cross and Blue Shield Association.
BCBSA represents 51 independent Blue Cross and Blue Shield
Plans throughout the nation that together provide health
coverage to 73 million Americans. Thank you for the opportunity
to testify on efforts to protect the confidentiality of medical
records. I want to especially thank you Chairman Thomas for
your work and the extensive efforts of your staff regarding
confidentiality and other key health care issues over the last
few years.
During my testimony, I will discuss:
(I) the importance of confidentiality of medical records;
(II) general principles for confidentiality legislation;
and
(III) key issues raised by pending confidentiality
legislation. These include:
requirements for new authorizations from all
subscribers;
a static definition of health care operations;
provisions mandating inspection, copying and
amendment of individually identifiable information by
subscribers; and
preemption of state law.
I. The Importance of Confidentiality of Medical Records
Blue Cross Blue Shield of Nebraska covers 550,000 residents
in Nebraska--or 1 out of 3 people in the state. We offer the
choice of products that our customers demand--health
maintenance organizations, preferred provider organizations,
point of service products, as well as traditional indemnity
coverage.
Protection of the confidentiality of subscriber and patient
information is of paramount importance to Blue Cross and Blue
Shield Plans. We believe that health plans should make every
effort to guard this confidentiality and should put into place
procedures and policies that facilitate this goal.
Since its inception, Blue Cross Blue Shield of Nebraska has
had protections to safeguard the privacy of our subscribers. As
part of training for all new employees, we emphasize the
importance of the information with which they are entrusted to
maintain and safeguard. Dissemination of confidential
information is absolutely forbidden. Violation of
confidentiality by an employee is grounds for disciplinary
action or termination. Employees also are educated that it is
completely inappropriate to share medical information with
their fellow workers outside those whose direct function
necessitates it.
As a health insurer, we require medical information to pay
claims, guard against fraud and abuse, and manage health care
coverage. Our employees must sign a confidentiality policy with
Blue Cross Blue Shield of Nebraska that includes recognition of
a disciplinary policy that enforces our code of conduct.
II. General Principles for Confidentiality Legislation
While the Blue Cross and Blue Shield Association believes
that consumers must be assured that their medical records are
kept confidential, we believe that federal legislation must
balance the need to safeguard medical records with the need for
providers and health plans to provide and cover health care
services efficiently.
Federal legislation should:
Protect consumers: All subscribers and patients
should be confident that their medical records are kept
confidential.
Be practical and simple: Federal confidentiality
rules must be practical and straightforward, so that providers
and health plans can adopt and implement them. Consumers'
rights must be easily understood. Complex rules will only
confuse and frustrate consumers, and could hamper
implementation throughout the industry.
Allow for innovation and flexibility: The delivery
and financing of health care continues to evolve at an
exponential rate as new technologies and therapies are
introduced and as e-commerce revolutionizes the way health care
entities conduct business. Legislation must assure that health
plans and providers can continue to evolve and provide
innovative benefits to consumers.
Have an achievable implementation date:
Considering the challenges that health plans already face in
terms of systems changes and backlogs due to Y2K, it is
imperative that federal confidentiality legislation have a
workable, achievable effective date. We urge an effective date
of plan years beginning on or after 2 years after promulgation
of final regulations.
Provide for uniformity: Given the complex and
interstate nature of the way information flows in today's
health care environment, and the increasingly integrated nature
of our health care delivery system, we believe consistent rules
across the country are critical to assuring uniform treatment
of confidential information.
Avoid excessive penalties: Congress should not
impose a new private right of action allowing individuals to
file lawsuits against health plans, providers, employers, and
others. Unfortunately, it is subscribers who suffer most
because premiums would ultimately be increased to cover the
costs of frivolous lawsuits. Moreover, some employers,
especially smaller employers, may view the increased liability
as an unacceptable risk and drop their employer sponsored
health coverage altogether.
III. Key Issues Raised By Pending Confidentiality Legislation
Many federal proposals addressing the issue of
confidentiality fail to incorporate all of the above
principles. I would like to highlight several of the key issues
we have identified with pending legislation.
(a) Requirements For New Authorizations
One of the general premises of federal confidentiality
legislation is to prohibit health providers and plans from
inappropriately disclosing personal data. Of course, health
plans must disclose personal data to doctors, hospitals, and
others in order to administer health insurance benefits. Some
legislators have tried to accommodate this need by including a
``statutory authorization'' for the disclosure of data for
treatment, payment or health care operations. That is, personal
data are legally allowed to be disclosed or used without a
separate authorization from the individual if it is needed for
treatment, payment or health plan operations. We support this
approach because the statutory authorization serves all parties
well--it allows health plans to provide the services for which
their subscribers are paying premiums in an efficient manner.
Unfortunately, other confidentiality legislation requires
health plans to obtain new and multiple authorizations from all
of their subscribers and their families before data can be used
for treatment, payment, and health care operations. This would
require us to mail new authorization forms to our 550,000
subscribers as well as develop new computer systems to track
whether or not authorizations have been returned.
Many subscribers already are inundated with ``junk'' mail
and may inadvertently throw these authorization forms away. We
may have to mail to our subscribers two, three or more times
before successfully receiving the new signed authorizations.
Some may never respond. The initial postage cost alone would be
significant but would pale in comparison to the personnel and
system costs necessary to accommodate the authorization
process. Unfortunately, according to various bills, we would be
forced to cancel the coverage of subscribers who failed to
return these authorizations because we could not process their
claims without legal access to their personal data. And this is
just on the private side of our business.
Medicare provides another example of the extraordinary
difficulties of complying with this rule. Medicare enrolls over
37 million individuals. Over half of the older population
reports having at least one disability. Over 4.4 million have
difficulty carrying out activities of daily living such as
bathing, dressing, eating and getting around the house. And
yet, many confidentiality bills would require these individuals
to return a written authorization to Medicare before their
benefits could continue. If for any reason this authorization
was not returned, the payment process would have to be
suspended while further attempts to obtain the needed
authorization were made. Ultimately, payments to providers
would be slowed down, anti-fraud and abuse efforts would be
impeded, and it could be nearly impossible to maintain an
efficient system.
Similar issues are raised in the Medicaid program. The
National Association of State Medicaid Directors recently
reported to the Blue Cross and Blue Shield Association that the
following issues complicate the dissemination of materials to
Medicaid recipients:
High turnover rates in the Medicaid program;
Homelessness and frequent residence-changing;
Illiteracy;
Nursing home residence; and
The fact that beneficiaries often overlook the
numerous notices that they receive in the mail.
Whether or not our customers enroll with us through our
private business, Medicare contracts, Medicaid, or other
government programs (e.g., CHAMPUS, Federal Employees
Program)--they all share a common expectation: their health
data will be used to cover their health costs. Requirements for
new authorizations would only anger customers who already abhor
paperwork, increase the cost of their coverage, and disrupt the
payment of claims.
We urge Members of Congress to adopt a statutory
authorization as part of confidentiality legislation.
(b) Static Definition of Health Care Operations
As I mentioned previously, a ``statutory'' authorization
would allow health plans to use patient data for the purpose of
health plan operations. This elevates the importance of the
definition of health plan operations, and makes it imperative
that it encompass the many functions a health plan now uses to
assure the quality and cost-effectiveness of benefits for
subscribers. Our concern is that most legislative approaches
incorporate a static definition of health care operations--a
prescriptive list of operations as they currently exist. They
do not allow for innovative services to be added. This could
deprive consumers of important--yet to be developed--services
in the future.
For instance, this year another Blue Plan adopted a new
program called the Early Risk Management Program. So far, it
covers about 100,000 of their enrollees. Every day, their
computer program evaluates data on those enrollees to identify
``triggers'' that indicate a need for further review of that
patient's record. Those triggers may be a certain prescription
drug or another admission to the hospital. On average, about 60
patient records per day are pulled for review. If, based upon
this review, a problem is suspected, the patient's physician is
contacted. Through this early risk management program, they
have been able to improve the care of subscribers. For
instance:
A 60 year-old male had claims indicating
prescriptions for Viagra as well as nitrates. The combination
of these two types of drugs has the potential to be fatal. When
the treating physician was called, he was unaware that the
patient had obtained a prescription for Viagra. He agreed to
contact the patient and no further prescriptions for Viagra
were filled.
A one year-old child had 15 claims for emergency
room visits in the past 18 months as well as office visit
claims for asthma. The parents were referred to an asthma case
management program including outreach and education. No further
emergency room visits occurred in the next six months.
A 49 year-old male had recent claims for abdominal
pain with no apparent etiology. Drug claims also indicated the
patient was taking Naproxen. The treating physician was
contacted and the physician indicated that a prescription for
Naproxen had been given some time ago. The physician suspected
that the patient continued taking this drug after the original
episode for which it was prescribed had ended--likely leading
to the abdominal pain.
New technology has allowed us to provide this quality
improvement and potentially life-saving service to customers.
But this type of program was not possible--or even
contemplated--several years ago. If a prescriptive definition
for health care operations had been legislated in 1995, we
could never have developed this program.
I want to reemphasize that the delivery and financing of
health care continues to evolve at an exponential rate as new
technologies and therapies are introduced and as e-commerce
revolutionizes the way health care entities conduct business.
We are concerned strict definitions of health care operations
could limit health plans' roles as they seek to redefine
themselves to meet consumer demands of the 21st century.
I urge Members of Congress to assure that any legislative
definition of health care operations be fluid, and easily
adjusted over time as innovative programs that benefit
consumers are further developed.
(c) Inspection, Copying And Amendment Of Individually
Identifiable Information By Subscribers
Another example of problematic pending confidentiality
legislation involves provisions that would allow subscribers to
inspect, copy and amend all information that is individually
identifiable. BCBSA believes that patients should be allowed to
inspect and copy their medical records. However, the vast
majority of information that health plans maintain is
administrative in nature (e.g., claims) and does not reflect
actual patient medical records. We believe it is important to
differentiate between what information must be protected from
what information must be produced.
The way most proposals are currently written, virtually
every piece of information in a health plan could be copied and
amended. Moreover, how a health plan would be required to
produce or provide access to data in an intelligible format is
a crucial question to consider.
For example, under some legislative proposals, we would
have to produce even insignificant paper that may have a
subscriber's name or identifying feature on it--customer
service telephone memos, recordings of conversations, internal
audit memorandum, routine claim runs, etc. We have concerns
that producing and providing access to all of this data would
require health plans to redesign their computer systems and
operations to centralize all Plan data--an extremely expensive
investment. It is conceivable that we may also have to provide
the subscriber access to our computer systems. But in order to
accomplish this, we may have to provide a ``translator'' to
teach the subscriber how to translate the coded information on
the computer. And of course, we would have to design new
systems that would prevent the consumer from accessing other
subscriber files while reviewing their own.
All in all, these requirements would pose administrative
costs that would be passed along to consumers in the form of
higher premiums. And all to create absolute access to
information that is unlikely to provide meaningful information
to the vast majority of subscribers. This absolute approach is
not necessary. For instance, in my state a recent law limits
the inspection and copying rights to medical records held by
providers. These records are those that provide the basis for
our operations, and are of the most interest to patients.
We urge Congress to limit inspection, copying, and
amendment rights to actual medical records when adopting
federal legislation.
(d) Preemption of State Law
Finally, we believe any federal confidentiality legislation
should preempt state confidentiality rules. The intent of the
Health Insurance Portability and Accountability Act (HIPAA)
administrative simplification provisions was to simplify health
insurance claims processes, reduce paperwork, and decrease
administrative costs through wider use of automation and
electronic data interchange (EDI). Federal standardization of
confidentiality rules is essential to the integrity of that
information. Lack of federal preemption may lead to the
unintended consequence of a decline in use of EDI since it
would be extremely difficult to create a computerized system
that could assure compliance with conflicting state laws.
Further, lack of federal preemption leads to higher compliance
costs, which would ultimately be passed onto consumers in the
form of higher premiums.
The patchwork of state privacy laws are particularly
difficult when viewed from the patient and provider
perspective. For instance, if a patient's insurance is through
an employer in New York City, but their physician is located in
New Jersey and the patient lives in Pennsylvania--whose
confidentiality laws apply to the consumer? And how does the
provider know how to comply?
Given the complex and interstate nature of the way
information flows in today's health care environment, and the
increasingly integrated nature of our health care delivery
system, we believe consistent rules across the country are
critical to assuring uniform treatment of confidential
information.
We urge Congress to provide a full preemption of state
confidentiality laws.
IV. Conclusion
The issues raised by confidentiality legislation are
complex and fraught with potential unintended consequences.
During my testimony, I have highlighted only a few of the
difficult issues with this important subject. This Committee--
and Congress--must successfully navigate through a labyrinth of
land mines in order to enact confidentiality legislation that
provides practical, strong protections for consumers without
disrupting the basic day-to-day services of a health plan and
raising unnecessary administrative costs.
On behalf of all Blue Plans, I would like to offer our
assistance to you as you continue upon this important endeavor.
Thank you again for the opportunity to testify.
Mrs. Johnson of Connecticut. Thank you very much. I
appreciate the panel's input. I very much appreciate examples
of how review of patient records has improved the quality of
care.
Ms. Goldman, you said something that was really very
interesting. First of all, your review of State law would be
very helpful to us and I thank you for that.
Ms. Goldman. You are welcome.
Mrs. Johnson of Connecticut. It is not surprising to me
that the laws are fragmented and complex.
Given that fact, if we pass a national comprehensive law,
it seems to me that we should allow a certain amount of time
for States to conform to that law. I would not be opposed to
States then applying for a waiver to have some additional law.
But I am very concerned about going through all of the
difficulty of coming to agreement on national standards, which
I think is going to be very difficult. You can tell from my
questioning, I am pretty conflicted about it. I don't know as
much about it as my Chairman. It is not an area on which I
spent a lot of time, but it is an area in which I have a lot of
anxiety, and people I represent have a lot of anxiety.
So it is going to be hard to do this. It does seem to me
that it is an area in which we do need uniformity. So I think
everybody needs to sort of think about how do we deal with the
States on this and if we do this right, there shouldn't be too
many areas in which there is legitimate need to be different.
Ms. Goldman. May I give an example of where there might be?
Some may find that this is oversimplifying, but I want to just
try to take this massive tome and create a simple conclusion.
In the broad areas that Congress is seeking to regulate in
the health privacy area, the right of access, limits on
disclosure, law enforcement, restrictions on law enforcement
access, and those broad areas, the State law tends to be weaker
than what many of the Federal proposals put forth.
So any Federal law that passes would create a floor. The
question is where is that floor? The higher the floor, the
higher the bar; the more State laws that are weaker will be
eliminated and the greater the uniformity. In many ways there
is an incentive on Congress if you are looking to develop
uniformity to set that bar as high as possible because you will
create significant uniformity given the state of the State
laws.
However, in these, as I pointed out, these condition-
specific areas, the protections that are on the back end of the
cancer registries or other disease registries, where there is
mandatory reporting requirements, but they are there for
research purposes and the State has then enacted
confidentiality protections to prevent redisclosure, or in the
HIV/AIDS area, in a number of States there are very specific
and detailed limits on the collection and use of communicable
disease information, again to encourage people to get testing,
counseling and treatment.
The Federal proposals contemplate that level of detail and
they tend not to be condition-specific. They tend to cover
broad entities in the health care area and broad information
that is identifiable health information.
So I would just suggest a great deal of caution about
creating a totally preemptive approach at the national level,
because there will be State laws that I think will be more
protective than what we are able to come to consensus on here
at the national level, because there will have to be a great
deal of consensus and compromise necessary. Also States,
because of their unique circumstances and needs of their
citizens, have enacted particular kinds of rules in very, as I
said, narrow areas.
Given that many in the industry: and the health plans,
hospitals, doctors, right now have to comply with 50 different
laws, that is their obligation now, we will greatly simplify
that with a floor, with the greater simplification where we set
that floor.
Mrs. Johnson of Connecticut. Would you all agree that the
rules should be the same for HCVA as for private plans and for
all providers and all State agencies?
Mr. Clayton. Yes. The problem is now there are no laws in
many areas. We desperately need some laws. Where I lived in New
York, we saw people from Connecticut and New Jersey; and if you
build a computer program that has to look and see whether this
person is from New Jersey before you can display their
medication list, and have to look and see if they are from
Connecticut before you can look at their problem list, people
will be used to treating someone, and then when they don't see
problems on the problem list, they may make mistakes in their
judgments. When they use an information system, it has to be
uniform.
As we start going to telemedicine, which will erase all
political boundaries in terms of where things get done, then
the preemption issue becomes even more difficult. I would just
point out, even though Janlori is one of my friends, that her
opinion on preemption was not one of the conclusions of the
working group, that that is her personal opinion, and the
working group did not reach that conclusion.
Dr. Smith. When you limit research to just within a
particular State because that is the only place you can get
permission to do that research, you have a tremendous problem
with generalizability. In other words, is it generalizable to
other sections of the country, are there enough patients with
that disorder or that particular issue within that particular
State. So the idea of being able to move beyond State
boundaries is very important. In order to have an informed
health policy, this not only relates to specific diseases, but
it relates to the economics of health care, it relates to how
we improve our health care system, it relates to how we pay for
it, how we monitor it. It is a very broad issue, and that is
why we need a strong Federal law.
Mr. Jenkins. I think the truth may be also that the
patchwork of laws may appear to be stronger in some instances
as related there, but that may be a theoretical protection only
if the laws are such patchwork that it is difficult to discern
them, and that a strong national framework would, in practice,
be actually stronger, even though an editor or writer of an
article like that might find it had been a reduction.
Mrs. Johnson of Connecticut. My understanding is the
administration has not recommended overriding State law, just
creating a floor. Do all of you agree that is the right thing?
Mr. Jenkins. No, I don't. I think it is an area where we
are so fluid as a nation now in this health care area, that we
need a set of rules that is standardized and we need to be able
to follow them.
Mr. Clayton. I would, however, agree with Janlori, at least
one idea, and I am thinking on my feet now. When a State
mandates a certain data collection they are doing as a State,
they might be able to have rules that pertain to that database.
What we are against is the State regulating the use of
health care information in the normal operation of delivering
health care; if there were a certain database that was required
just in one State, there could certainly be a law concerning
that State-mandated database, but not one that is in the normal
operation of delivering health care.
So you might, following up on their suggestion, exempt
specific types of databases, but not the ones that a physician
or a nurse would be using in her general practice.
Mrs. Johnson of Connecticut. Would you differentiate
between patient-identified information and nonidentified
information?
Mr. Clayton. We definitely should differentiate and use,
according to the need, legitimate need, for when it has to be
identified.
Mrs. Johnson of Connecticut. Mr. Kleczka.
Mr. Kleczka. Mr. Jenkins, does your organization support a
Patients' Bill of Rights that covers all health consumers in
the country, or only those consumers that the Federal
Government has control of or regulation over?
Mr. Jenkins. We support rules that apply to the private
plans, as well as the government plans, yes, sir.
Mr. Kleczka. So you would support a Patients' Bill of
Rights covering all 150-plus health care consumers, not only
the ERISA plan consumers?
Mr. Jenkins. I am not sure of the position of the
association on that. I better defer in speaking.
Mr. Kleczka. I am trying to see if you share my problem
with inconsistency on States rights. That is what I am trying
to ascertain.
Mr. Jenkins. I think Mr. Thomas pointed out there are
situations where, and I agree with his statement, there are
situations where a full preemption is appropriate.
Mr. Kleczka. I know your position on privacy legislation. I
am asking your position on the Patients' Bill of Rights. There
is a controversy in the Senate over whether or not to have the
States control plans through their insurance commissioners'
officers, and only have Congress deal with the federally
controlled plans for the Patients' Bill of Rights.
Mr. Jenkins. My Association didn't take a position on that.
Mr. Kleczka. I think you have a note coming forward on
that.
Mr. Jenkins. On the Patients' Bill of Rights, the
association supported the ERISA plan's approach that the Senate
took. That is a note from the association staff.
Mr. Kleczka. That indicates to me that on managed care
reform you are letting the States govern. When it comes to
health care privacy, the States don't know what they are doing
and we should preempt them and the almighty Fed should
regulate.
Mr. Jenkins. I don't think it is a matter of them not
having the knowledge. There are good people who are on
different sides of this issue at various points and decisions
can and must be made.
Mr. Kleczka. As a former State legislator and one from a
State which has some exemplary protections in the medical
records area, I think State legislators and the Governor should
have the right to provide and afford protection to any degree
for their consumers. I don't think the national interests
outweigh that to the extent which some of you folks on this
panel and some on the other panel would dictate.
Mr. Jenkins. I understand that, sir.
Mr. Kleczka. Let me ask Dr. Clayton, who do you believe
owns the medical records? Is it the health care provider or do
you think that the patient is the owner of those records?
Mr. Clayton. Most of us in the field don't believe anybody
owns the record. We are stewards. We act as the steward of that
information, but nobody has really established who really owns
it.
Mr. Kleczka. So I as the health care patient have no direct
ownership or claim to those records?
Mr. Clayton. I think what----.
Mr. Kleczka. Even though I paid for them in part or at
times in total, if I don't have insurance?
Mr. Clayton. What most laws that are being proposed say is
that the patient has the right to look at those records, know
that those records exist. That is fair information practice.
Whether they can say they own them and then physically remove
them from a doctor's office, I don't think anyone would
maintain that is true.
Mr. Kleczka. Maybe I don't own them, but I do have some
control over them?
Mr. Clayton. If you own them, you can retrieve the
property. But in this case you cannot retrieve it, which
indicates to me you don't really have title. It has been a
sticky issue that has a lot of case law, and most people agree
that we are stewards of the records.
Mr. Kleczka. You are the health care provider. I am the
patient, OK. Do you think I have the right to make judgments as
to who should see those records? Basically an opt in, not an
opt out.
Mr. Clayton. I think if you wish to receive care and have
someone pay for that care, you need to be able to let the
people who are providing care have access to the information
they need to provide that care.
Mr. Kleczka. For specific purposes, not for any and every
purpose.
Mr. Clayton. That is why I said in my statement that we
strongly want to restrict the scope through policies. For
example, an x-ray technician should have no information except
the radiology results. A billing clerk who you call on the
phone to complain, ``Why is my pharmacy bill so large? '' needs
to see what medications you are on. They may need to see what
laboratory tests you took to answer your complaint about how
large the bill was. But they don't need to see the results of
those tests.
So we go through, we have at Columbian Presbyterian, three
different categories of people and have listed them under what
circumstances that person is in and what geographic location.
In other words, if you are in the emergency room, a nurse could
see more than if the nurse was at the nursing floor. So you
restrict the scope of access to what is the legitimate need to
know.
Mr. Kleczka. That access is all pretty relevant to the
course of business, and unless somebody is just a snoop, I
don't see that much of a problem. The problem occurs when
either the health care provider or some attendant group wants
to give medical information to a third party or a fourth party,
or when a doctor is selling patient information for a clinical
drug trial where the physician receives rather substantial sums
as payment for disseminating the names of patients.
Mr. Clayton. I think when you are using it for research,
then it has to go through an accredited body that will
determine need--so you don't just give information. Right now
you can, because there is no law. If you make it law, then you
will prescribe the ways in which we can divulge knowledge that
information.
Mr. Kleczka. Let me ask any of the panelists, what was your
reaction to the drugstore chain in Washington selling lists of
customers and the drugs they were prescribed to a competing
drug manufacturer.
Mr. Clayton. Absolutely abhorrent.
Mr. Kleczka. You can say it happened because of the absence
of any medical privacy laws. What is your reaction to that?
Mr. Clayton. Should be illegal.
Mr. Smith. In my opinion, it is immoral, unethical, and
should be illegal.
Ms. Goldman. One of the wonderful things about that case is
right after it became public, that many drugstores were making
this information available, people around the country went
crazy. It was a tremendous outcry and uproar. There was article
after article, and the chain drugstores that were responsible
for this immediately eliminated the program. They didn't fix
it, they didn't try to retool it in some way. They were doing
it without patient knowledge, without their consent, and they
eliminated the program. There are a couple of lawsuits ongoing
on this right now.
Mr. Jenkins. The same feeling here.
Mr. Kleczka. I don't think it is only a question of privacy
for medical records, it is the entire question of privacy from
the dissemination of Social Security numbers and medical
records. We all know that Social Security number release leads
to identity fraud. We have a Federal statute on that now. There
is heightened public awareness in this whole issue. That is why
when we discussed a banking bill, the big contentious issue on
the floor of the House was the privacy provision in that bill.
Someone got up and said, we did this bill 2 years ago. Why
wasn't privacy a big issue then? Because even though some of us
were talking about it then, the public is now becoming more
aware of it. You take any poll and 85 to 95 percent of the
people say it is a big issue.
During my last campaign, I did a poll. We asked people
about Medicare and Social Security. We also asked about
privacy, because I had an interest in it. That scored the
highest of constituent interest in my district.
So, folks, if you think this is going to go away or we are
going to be able to preempt States, I don't think we will get
away with it. The public is irritated to the point now where
politicians like yourselves should be listening.
I have to agree with the lady from Connecticut. Are we too
late? Is the horse out of the barn? The Internet is there. I am
frustrated, nervous and scared. We have to do something. We
can't let it go on. It is going to get, as they say in some
parts of the country, worser. We don't want it to get worser.
We want it to get more better.
Mr. Clayton. Everybody strongly argued that there needs to
be strong penalties and strong legislation. Not one of us would
disagree with that.
Mr. Kleczka. Thank you.
Mrs. Johnson of Connecticut. Thank you. I did want to just
add for the record that the legislation for the patient
protection that Mr. Thomas helped write and he and I both voted
for did apply to all health plans, unlike the Senate bill. So I
wouldn't want to have any misinformation out there on that
score.
I do thank you all for your testimony. This is certainly a
very difficult area and a very important one. We look forward
to working with you and the administration to see if we can't
get a bill that we can move through with some agreement on the
difficult issues it poses.
Thank you.
[Whereupon, at 5:45 p.m., the hearing was adjourned.]
[Submissions for the record follow:]
American Association of
Occupational Health Nurses
Atlanta, GA 30341-4146
July 27, 1999
Committee on Ways and Means
U.S. House of Representatives
Subcommittee on Health
1102 Longworth House Office Building
Washington, D.C. 20515-6349
The American Association of Occupational Health Nurses, Inc.
(``AAOHN'') appreciates the opportunity to submit written testimony to
the House Ways and Means Committee for the hearing record on the matter
of confidentiality of personal health care information. Our primary
purpose in submitting these comments is to urge Congress, in the
strongest terms, to enact comprehensive medical records confidentiality
legislation. We believe that for any medical record privacy bill to be
truly meaningful, Congress must craft legislation that will ensure that
all medical records are protected under the law regardless of the mode
of payment or the setting where the health information is obtained or
maintained.
AAOHN is the professional association for more than 12,000
occupational and environmental health nurses who provide on-the-job
health care for the nation's workers. Occupational health nurses are
the largest group of health care providers at the worksite. AAOHN has
had a long-standing involvement in the confidentiality of health
information debate and continues to work vigorously to ensure that
employee medical records created and maintained at the worksite or any
occupational health clinic are protected from improper disclosure.
Personal health information generated or maintained at the
workplace or in connection with an individual's employment is as
personal and sensitive as that collected in more traditionally thought
of health care settings, and therefore, must be extended the same
confidentiality protections. AAOHN trusts Congress recognizes the high
degree of public concern about the very real potential for employment
discrimination based on health information. Worksite health records
frequently document medical and/or health surveillance activities, pre-
job placement and fitness-to-work physical examinations, and employee
assistance program assessments, as well as information collected
through voluntary worksite wellness programs. Clearly, such
information, if improperly disclosed, may be used in ways harmful to an
individual's interests.
A. Balancing Individual Employee Privacy with Employers Needs
Indeed, AAOHN maintains that an individual employee's right to
privacy must be balanced with employers' legitimate need for certain
personal health information when considering fitness to work, workplace
safety, workers' compensation benefits, disability job accommodations,
or some employer-sponsored benefits. Employers must be permitted to
fulfill their obligations under laws such as the Americans with
Disabilities Act, the Family Medical Leave Act, and the Occupational
Safety and Health Act, but employers need not be granted unfettered
access to an employee's entire medical record to meet these legal
requirements.
It is well documented that employers often inappropriately use
employees' personal health information in making personnel decisions.
For example, a 1996 research study by the University of Illinois
revealed that at least one-third of the Fortune 500 company respondents
admitted using employee medical records in making employment-related
decisions.\1\ Furthermore, AAOHN members can attest that they are often
pressured by employers to release a worker's entire medical record or
to divulge unnecessary personal health information of employees.\2\
---------------------------------------------------------------------------
\1\ David F. Linowes, Privacy in the Workplace, University of
Illinois at Urbana-Champaign, April 1996 (copy on file with AAOHN).
\2\ See, e.g., Health Care Information Confidentiality: Hearings
Before the Committee on Labor and Human Resources of the United States
Senate, 105th Cong. (Feb. 26, 1998) (oral and written testimony of
AAOHN).
---------------------------------------------------------------------------
B. Goals of Federal Privacy Legislation
Federal legislation can protect individual privacy and meet
employers' legitimate needs for some employee protected health
information (``PHI'') if it includes safeguards that (1) limit the
scope of individually identifiable PHI disclosed to an employer to that
information necessary to answer a legitimate workplace health-related
question and (2) create firewalls restricting access to employees' raw
medical record by officers, management, and other employees responsible
for personnel decision-making. It is essential to recognize that it is
the health care provider, not an employer's administrative, human
resource, or management personnel, who is the professional qualified to
interpret medical data and determine what information is relevant for a
particular health situation and should be disclosed. For example, AAOHN
unequivocally believes that in cases of fitness-to-work examinations
(e.g., medical surveillance records, health screening, return-to-work
physical records) health care professionals should provide the employer
with a written medical determination of an employee's health status
based upon the medical record rather than handing the employer the
actual record itself. Any employer entity would be hard-pressed to
assert that its administrative, human resource or management personnel
have the requisite qualifications to render a medical judgement as to
the health of an employee based on their review of a medical record.
Limiting the amount of PHI an employer may learn about his or her
employee is not a novel or untested approach. The ``bloodborne
pathogens'' regulations issued by the Occupational Safety and Health
Administration (``OHSA'') explicitly require that such information must
be kept confidential and ``not disclosed or reported without the
employee's express written consent to any person within or outside the
workplace except when required by this section or as may required by
law.'' \3\ The law also narrows the extent of PHI provided to employers
to that which is necessary to make a determination regarding work
fitness. To this end, the regulation states that the ``healthcare
professional's written opinion . . .shall be limited to whether
(appropriate treatment) is indicated for an employee, and if the
employee has received such (appropriate treatment).\4\
---------------------------------------------------------------------------
\3\ 29 C.F.R. Ch. XVII, Sec. 1910.1030 (1998).
\4\ Id.
---------------------------------------------------------------------------
C. AAOHN Support
Because of the importance of this issue, AAOHN will only support a
federal medical records confidentiality bill that ensures worksite
health records are recognized as PHI and that includes statutory
language limiting intra-employer use and disclosure of PHI. To date,
the only House bill including these types of provisions is H.R.
1941.\5\ The ``Medical Information Protection Act of 1999,'' H.R. 2470,
introduced by Representative Greenwood does not cover worksite medical
records. As originally drafted the Greenwood bill contained the same
protections found in S. 881 introduced by Senator Bennett.
Nevertheless, Representative Greenwood has stated for the record that
these safeguards were inadvertently removed in the final version of his
bill and that it is his intention to do all in his ability to add these
protections to H.R. 2470.\6\
---------------------------------------------------------------------------
\5\ Senate bills S. 881 and S. 573 are notable for worksite
protections.
\6\ Legislative Hearing Regarding: H.R. 2470--Medical Information
Protection and Research Enhancement Act of 1999 Before the Subcomm. on
Health and Environment of the House Committee, 106th Cong. (July 15,
1999) (opening statement of Rep. Greenwood).
---------------------------------------------------------------------------
To ensure that worksite health records are recognized as PHI and
that the special concerns surrounding health information generated or
maintained at the workplace are covered, AAOHN believes that at a
minimum the following amendments to H.R. 2470 are critical:
1. Add the term ``assessment'' to the definition of ``health care''
in section 2(6) to ensure that all types of health data generated at
the worksite are ``protected health information.''
2. Amend the definition of ``health plan'' to exclude 42 U.S.C.
Sec. 300gg-91(c)(1)(G), ``coverage for on-site medical clinics,'' from
the benefits not included within the term ``health plan''
3. Add new Sec. 201(c):
(c) APPLICABILITY TO EMPLOYERS.--An employer may use an employee or
agent to create, receive, or maintain protected health information in
order to carry out an otherwise lawful activity, provided that
(i) disclosure of protected employee health information within the
entity is compatible with the purpose for which the information was
obtained and limited to the information necessary to accomplish the
purpose of disclosure and (ii) the employer prohibits the release,
transfer or communication of the protected health information to
officers, employees, or agents responsible for making work assignment
decisions with respect to the subject of the information.
(1) The determination of what constitutes the information necessary
to accomplish the purpose for which the information is obtained shall
be made by a health care provider, except in situations involving
payment or health plan operations undertaken by the employer.
AAOHN appreciates the opportunity to offer our comments regarding
the importance of strong medical records privacy legislation to our
nation's workers. In summary, effective federal privacy legislation
must:
Define PHI broadly enough to include all medical records generated
or maintained at the worksite or in connection with employment for
purposes other than for treatment, payment, or health care operations;
Build barriers designed to restrict intra-entity disclosure in
order to prevent management misuse of workers' health records without
jeopardizing a company's ability to operate safely and efficiently; and
Recognize that the health care professional who creates or
maintains worksite records is the appropriate person, not employer
administrative, human resource, or management personnel, to determine
whether a PHI disclosure is consistent with the purpose for which the
information was lawfully obtained and limited to the minimum disclosure
necessary to accomplish the purposes of the disclosure.
We urge Congress to keep these principles in mind when drafting any
medical records privacy bill and look forward to working with Members
of the Committee on Ways and Means on this important issue during the
days ahead.
Statement of American Psychiatric Association
Introduction
APA, a medical specialty society representing 40,000
psychiatric physicians nationwide, appreciates the opportunity
to provide a statement for this hearing. We believe patient
privacy issues are one of the key issues before the Congress,
and we greatly appreciate the Committee's interest in passing
medical records privacy legislation.
As changes in technology and health care delivery have
outpaced the statutory, common law, and other protections that
traditionally have ensured patient confidentiality, the level
of confidentiality enjoyed by patients has eroded dramatically.
We must seize this valuable opportunity to protect and restore
needed confidentiality protections.
But APA also urges you to craft legislation that will avoid
the unintended consequences of many of the confidentiality
bills pending before the Congress. Let's give a couple of real
world examples of the impact of several of these bills on
patients.
You go into your doctor's office, and the doctor gives you
a comprehensive physical. He takes your blood and runs some lab
tests. Sounds harmless enough. After all you never signed
anything giving permission for your personal information to be
broadly used and disclosed. You were never told your medical
record would be broadly used, and nothing was sent to you. But
it will be. Your medical records can be used for commercial
research purposes. Without your consent or knowledge. Your age,
sex, demographic information, psychiatric status and other
information can be used for insurance underwriting and other
broadly and vaguely defined health care operations purposes.
Again without your consent or knowledge and even though
aggregate, i.e. non-personally identifiable information would
suffice. Even the banker reviewing your mortgage application
can review your medical record without your consent or
knowledge.
But certainly you think at least my employer is
specifically prohibited from gaining access to this
information. Not true. Several of the major proposals before
the Congress lack the strong specific protections that are
needed to insure that supervisory personnel cannot gain
inappropriate access to your medical record. APA urges
Committee members to avoid including any provisions in your
legislation that would allow these disclosures to occur.
The Need for Federal Legislation
APA believes medical records confidentiality is one of the
most important issues to come before the Committee this year.
Our medical record, when it relates to conditions as varied as
high blood pressure, communicable diseases, Alzheimer's
disease, mental illness and substance abuse, domestic violence,
sexual assault information, terminal illnesses, HIV/AIDS,
cancer, eating disorders, sexual function or reproductive
health issues, as well as many other conditions, is highly
sensitive.
But whether or not we are affected by these illnesses,
medical records privacy issues affect us all. Today's
comprehensive medical assessments and wellness questionnaires
can contain questions about patients' sexual behavior, social
relationships, state of mind, and psychiatric status--even if
patients are not receiving medical treatment relating to these
issues. The forms can also contain extensive personal and
financial information.
Confidentiality is a Requirement for High Quality Medical Care
Common sense, the experience of physicians and patients,
and research data all show that privacy is a critical component
of quality health care. The sad fact is that the health care
system has, on occasion, not earned the trust of patients, and
many patients do not trust the system to keep their information
confidential. In many cases, the result has been that
physicians are not able to provide the best possible quality
care nor reach many individuals in need of care.
Some patients refrain from seeking medical care or drop out
of treatment in order to avoid any risk of disclosure. And some
simply will not provide the full information necessary for
successful treatment. At other times, physicians are approached
by patients who ask us not to include certain information in
their medical record for fear that it will be indiscriminately
used or disclosed. The result of all these behaviors resulting
from patients' reasonable concerns is unfortunate. More
patients do not receive needed care and medical records' data
that we need for many purposes, such as outcomes research, is
regrettably tainted in ways that we often cannot measure.
The solution is not to take short cuts that will further
deprive patients of their rights. Instead, we must enact into
law meaningful medical records privacy legislation based on the
voluntary informed consent of patients and reliance upon the
fullest possible use of deidentified and aggregate patient
data. In this way the full advantages of patient privacy as
well as the benefits of new medical technology can be
harnessed.
Informed, voluntary, and non-coerced patient consent prior
to the use and disclosure of medical records should be the
foundation of medical records confidentiality legislation. As a
general principle, we believe that the American Medical
Association's position--that patient consent should be required
for disclosure of information in the medical record with
narrowly drawn and infrequent exceptions permitted for
overriding public health purposes--is eminently reasonable.
The Special Sensitivity of Mental Health Information and the U.S.
Supreme Court's Jaffee Decision
Patients often refrain from entering psychiatric treatment
because of concerns about confidentiality. Not only do patients
refrain from telling family members and close friends the
information they share with their therapist, but some may not
even tell their family members that they are receiving mental
health treatment. Often, if the information were disclosed to a
spouse or an employer it might jeopardize their marriage or
employment. But even the privacy protection afforded to
psychotherapy notes has eroded so much in recent years that
many psychiatrists and other mental health professionals have
stopped taking notes or take only very abbreviated notes.
Without the very highest level of confidentiality, patients
receiving mental health services will be less likely to enter
treatment and less likely to remain in treatment. Worse yet, if
confidentiality is not protected, the treatment patients
receive will be less effective.
For these and other reasons, the U.S. Supreme Court
recognized the special status of mental health information in
its 1996 Jaffee v. Redmond decision and ruled that additional
protections for mental health information are needed. The Court
held that ``Effective psychotherapy depends upon an atmosphere
of confidence and trusta...disclosure of confidential
communications made during counseling sessions may cause
embarrassment or disgrace. For this reason the mere possibility
of disclosure may impede the development of the confidential
relationship necessary for successful treatment.''
It is also worth recognizing that the extent of mental
illness is widespread. According to the World Health
Organization mental illnesses account for four out of ten of
the leading causes of disability. APA urges members of this
committee not only to protect the letter of the Jaffee decision
but indeed to protect its spirit by including appropriate
provisions in the legislation.
Provisions Needed in Congressional Legislation
It is not our intention to provide a detailed analysis of
each bill before Congress. Instead, APA would like to recommend
several key provisions that we believe should guide the
Committee in its deliberations.
Preemption. The most important medical records privacy
issue before the Committee is to insure that stronger state
medical records privacy laws are preserved and that states'
ability to enact stronger medical records privacy laws are
preserved. States have adopted valuable protections for
patients, including laws limiting the disclosure of pharmacy
records and laws blocking insurers' access to verbatim
psychiatric notes. States are also actively considering
numerous additional medical records proposals. In fact, the
National Council of State Legislatures estimates that a total
of 56 medical records confidentiality bills have passed through
at least one chamber of a state legislature. We must not block
states' efforts to protect citizens' medical privacy. We
recommend that the Committee adopt a floor preemption approach,
allowing stronger state medical records privacy laws to be
preserved.
Consent. APA believes three principles should govern
sections of the legislation concerning authorization and
consent for disclosure. First, patients themselves should
decide whether or not personal health information is disclosed.
Consent before use and disclosure of medical records is
critically important. This time-tested approach should be
preserved and strengthened in order to remain meaningful in the
changing world of health care delivery. In general, whatever
problems may now exist with confidentiality of health
information are derived from our failure to observe this
principle. No one is in a better position than patients
themselves to identify sensitive information and to determine
to whom it ought not to be revealed. Those who would alter this
traditional approach have failed to justify such a radical
change.
Second, identifiable personal health information should be
released only when deidentified data is inadequate for the
purpose at hand. Third, even when consent has been obtained,
disclosure should be limited to the least amount of personal
health information necessary for the purpose at hand. This is
consistent with our recognition of the importance of protecting
medical privacy.
These principles have implications for some of the major
policy questions regarding authorization of disclosure. For
patients to retain meaningful control over personal health
information, prospective consent for routine disclosures of
identifiable information should be largely limited to
information needed for treatment and payment purposes. Other
health care operations can usually be accomplished with
deidentified data. With such a provision, a strong incentive
will exist for the use and further enhancement of technology to
perform a wide array of administrative functions.
Employee Protections. Millions and millions of Americans
have great concern about the threat to confidentiality of their
medical records due to employer access. Whether it is idle
gossip by individuals with access to medical records, employer
review of identifiable medical records data, or supervisors'
inappropriate interest in the personal lives of their employees
we must protect employees right to medical records privacy.
Wouldn't most people want to decide if anyone in their company,
not to mention their supervisor, would know if they obtained
medical care from a psychiatrist, from a cardiologist, from an
obstetrician/gynecologist, or from an oncologist? We believe
that the strong, explicit protections are needed in this area.
Health Care Operations. APA is very concerned by the
definition of ``health care operations'' in many of the bills
before the Congress. Entities providing health care can use and
disclose this information for ``operations'' purposes, i.e.
many purposes not directly related to treating a patient or
performing payment or reimbursement functions. Some of the
terms that are used to define ``operations'' are quite vague
and broad and could endanger patient privacy. Do we really want
to permit patients to be terminated from their health care
coverage because they don't want their personal records to be
used for largely commercial functions that can be performed
with aggregate data?
Needed Protections for Particularly Sensitive Medical
Information. As indicated above, especially sensitive
information, including mental health information needs to
receive a very high level of protection. Indeed, the U.S.
Supreme Court itself in its Jaffee decision recognized that
additional privacy protections, above and beyond those afforded
to other health information, are needed to insure effective
psychiatric care. APA believes that in order to promote high
quality medical care and patient privacy, the Congress should
pass legislation that provides a level of protection high
enough so that no class of information needs additional
protections. However, in the event that the Congress proceeds
with legislation that does not meet this test, strong
additional privacy protections will clearly be needed for
mental health information. Most important among these are
protections to prevent access by insurers to verbatim
psychiatric notes.
Self Pay. If individuals enter into a private contract with
a physician and pay for those medical services out of their own
pocket, it is difficult to understand why the government or a
health plan should compel them to sign a form allowing their
medical information to be broadly disclosed beyond the
treatment team. Both liberal members of Congress who support
personal privacy and members of Congress who support medical
savings accounts and private contracting under Medicare should
recognize the importance of strong self-pay provisions in
medical records confidentiality legislation.
Protections from Overzealous Actions by Police. APA
strongly believes that strong protections are required in this
legislation including a requirement that law enforcement agents
obtain judicial approval based on a probable cause standard
before they are granted access to individually identifiable
medical records. This approach would allow legitimate law
enforcement investigations to proceed, without unnecessarily
jeopardizing the privacy of sensitive health information. APA
further believes that the Committee should incorporate a
requirement that protected health information obtained pursuant
to a court order for one investigation should not be used for
any other investigation, except a secondary investigation
arising out of or directly related to the original
investigation. Finally, APA urges that law enforcement agencies
and officials should be subject to the same requirements for
protecting individually identifiable health information
obtained pursuant to a court order as apply to other recipients
of protected health information, including health providers and
payers.
Conclusion
As physicians, we take an oath first stated by Hippocrates
that, ``Whatsoever things I see or hear concerning the life of
men, in my attendance on the sick...I will keep silence
thereon, counting such things to be as sacred secrets.'' In
order to make sure that doctor-patient confidentiality
continues to protect patients in the new millennium, I strongly
urge the Committee to provide the highest possible level of
confidentiality in your legislation.
We thank you for this opportunity and we look forward to
working with the Committee on these important issues.
Statement of American Society of Health-System Pharmacists, Bethesda,
MD
Re: Confidentiality of Health Information
The American Society of Health-System Pharmacists (ASHP)
supports responsible federal legislation to ensure that
patients will be comfortable communicating fully with their
pharmacists, physicians, and other members of the health care
team, with the knowledge that their sensitive medical
information will not be disclosed for illegitimate purposes.
ASHP is the 30,000-member national professional association
that represents pharmacists who practice in hospitals, health
maintenance organizations, long-term care facilities, home
care, and other components of health care systems.
ASHP believes the patient should have the right to access
and review his/her medical records, and the ability to correct
factual errors. Patients should also have the right to know who
has access to their medical records, and authorize how their
medical information is or will be used. ASHP recognizes that
patients view certain medical information to be particularly
sensitive. Nevertheless, ASHP believes all medical information
is sensitive and should be treated with the utmost protection.
ASHP believes that pharmacists must have access to patient
health records in order to provide quality care and ensure the
safe use of medications. ASHP also believes that with access to
the patient's health record comes the pharmacist's professional
responsibility to safeguard the patient's rights to privacy and
confidentiality. Within health systems, communication among all
authorized health care practitioners is to be encouraged and in
no way restricted, while ensuring patient confidentiality and
privacy.
Pharmacists also participate extensively in many clinical
trials involving drugs. ASHP believes that all clinical trial
data must be recorded and stored in such a way that the
subject's rights of privacy and confidentiality are protected.
Adequate safeguards are already in place to protect a patient's
health care information during the clinical trial process,
including the storage and retrieval of data. As part of the
established process of informed consent, patients receive a
statement describing who will have access to patient
identifiable information. This includes personnel from the
study sponsor or the FDA for compliance purposes as well as
institutional personnel who audit the information for quality
or financial integrity.
ASHP believes that pharmacy residency and other training
programs must implement policies and procedures to assure the
confidentiality of patient medical records, while recognizing
that pharmacy students and residents must have access to
medical records in the course of their training.
ASHP believes that in cases where patient information is
aggregated into a larger population and used for legitimate
research and statistical measurement, there is no potential for
a breach of patient confidentiality because it is not uniquely
identifiable. Therefore, a specific authorization for access to
this information by individual patients is unnecessary.
ASHP believes there should be a minimum standard adopted in
federal law for protection of patient health information.
ASHP believes that strict governmental protections, with
appropriate penalties for violations, must be in place to
preclude the dissemination of patient-identifiable information
outside of the health system (i.e., to an unauthorized third
party) for any purposes that do not involve the direct
provision of patient care or reimbursement. Health systems must
have written policies and procedures in place to guard against
the unauthorized collection, use, or disclosure of protected
health information. Strict governmental penalties including
criminal sanctions for egregious violations should be
considered. However, inadvertent infractions with no intent to
harm should be subject to the health care organization's
disciplinary process or civil penalties.
The American Society of Health-System Pharmacists is
grateful for the opportunity to submit its views in writing on
the subject of confidentiality of patient medical records.
Questions regarding ASHP's policy in this area should be
directed to Ellen C. Evans, Director, Federal Legislative
Affairs, Government Affairs Division, 301-657-3000 ext. 1326.
Minneapolis, MN 55416
August 1, 1999
A.L. Singleton
Chief of Staff, Committee on Ways and Meams
U.S. House of Representatives
1102 Longworth House Office Building
Washington, DC 20515
Dear Mr. Singleton:
Confidentiality of my patient records is so important to me that
should I feel it is no longer secure, I would think twice before
receiving medical treatment for a serious illness. Thank you for giving
me the opportunity to express my concerns to the July 20th hearing on
medical confidentiality.
Patients and doctors have a special relationship requiring the
divulging of confidential information that sometimes even the best of
friends or family members do not share. There must be trust between the
doctor and patient to allow for sharing what could be damaging
information in order to allow timely and appropriate medical care.
For the integrity of this relationship and the health care system
in general, it is important that patients have informed, voluntary
consent prior to the sharing of information. The bills before the House
and Senate do not protect this right. Rather, they would create a
federal law allowing researchers, government agencies, law enforcement,
and managed care organizations to enter my medical records at will. I
am very uncomfortable with other people reviewing my personal medical
records without my consent. They would also limit the right of my state
legislators to enact stronger privacy legislation that Congress enacts.
As an American, I am entitled to certain rights, including the
right of protection against unlawful search and seizure by others of my
personal property. This includes personal information about myself.
Also, the Nuremberg Code protects me against becoming an unwilling
research subject.
Unconsented access to my medical records will not only violate my
Constitutional rights as a citizen of the United States of America, it
will leave me vulnerable to employment, insurance, and medical
discrimination.
I urge you to truly protect my confidentiality by assuring patient
consent prior to all medical record access. I also urge you to make the
research consent form separate from the authorization to treat form and
that it be made perfectly clear to the patient that their medical care
is not in jeopardy should they elect NOT to authorize research on there
medical records.
The doctor/patient relationship has eroded too much already with
the induction of managed care into our medical community. As far as I'm
concerned, medical privacy is the last bastion protecting that
relationship and guaranteeing quality of care. When you destroy the
sacred trust between a doctor and her patient, you compromise the
physician's ability to practice medicine. Further, when patients no
longer trust their physician, then the whole truth surrounding their
medical condition will not be forthcoming and your research is tainted
from the start.
Please pass REAL medical privacy legislation that is strong on
protection for the patient, not on protection for the researcher.
Otherwise, it is guaranteed that PRIVACY will have its day in court.
Thank you for your time.
Sincerely,
Joyce E. Anderson
Citizen of the United States of America
Jefferson City, MO 65109
July 21, 1999
Mr. A. L. Singleton
Chief of Staff
Committee on Ways and Means
U.S. House of Representatives
1102 Longworth House Office Building
Washington, D.C. 20515
Dear Mr. Singleton:
Confidentiality of our patient records is very important to us.
Thank you for giving us the opportunity to lend our comments to the
July 20th hearing on medical confidentiality.
We would like to let you know what we, as private law-abiding
citizens feel it is necessary for you to protect our medical records.
Really protect it, not just say you tried to protect it, or that you
thought you protected it.
First and foremost, no information should be released without our
informed voluntary consent. There should be no coercion to sign. We
should not be threatened with denial of care or additional expenses. In
addition, it should be clearly stated on the consent form who the
information will go to if we give our consent, and that we can limit
the list. It should be clearly stated that consent is not required for
us to receive treatment. It should also be clearly stated that we can
revoke the consent at any time. The consent should be only for a
limited period of time. We realize that if the doctor does the billing
or if we have insurance pay the bill, we have to release information,
but the information released should be limited to the claim for
payment. It concerns us that HMOs and insurance companies are creating
patient profiles with the information they receive. We think that is
wrong. To get health care should not mean that we must give away all
the intimate details of our life for someone else to track and sell.
We also want you to know that we believe that state legislatures
should not be restricted to whatever law Congress enacts. We want our
legislators to have the right to protect us to the greatest degree
possible. Because the federal government's power is limited by the
Constitution's according to the 10th Amendment, states are given the
right to make decisions best for their own constituents. The federal
government and Congress should not try to revoke it.
We have heard that the federal government and medical researchers
believe that we should give up our right to privacy for the greater
good and the public health of all. We also read that officials want us
to let the police look at our records without our consent. Forcing us
to display the intimate details of our life to the government and the
police will not benefit our health. Given our ability to cross match
data, we're not even sure that our unidentified data is unidentifiable,
but we would have no problem letting our information be used if it was
guaranteed that we could not be identified or found.
If it becomes law for the police, profit hungry researchers, and
government to get into our records without our consent, we can assure
you that we no longer will be forthright with our doctors. Just knowing
the government is going to look willy-nilly through our medical records
and create databases with our name and information on them will damage
the relationship we have with our doctor. We're particularly concerned
that whatever information is collected on us will be used against us.
Maybe by insurance companies or employers, or regarding certain
illnesses, by the people who hand out passports and drivers' licenses.
These are not small issues.
There are few things more necessary to our freedom than our
privacy. Imagine having to weigh every word and nuance when we go into
the doctor. This could bring us into the black market for medical care
or mental health. We want to trust our doctor, not fear him. He's
supposed to be there to protect us, not hurt us. Every day, we see
privacy being taken away. We would like you to help us protect our
patient and privacy rights when you write this law. We don't care about
the inconvenience it might make for health plans and researchers. We
have ourselves to protect. Please keep us in mind.
Sincerely,
Matthew and Carrie Burcham
Concerned Parents for Vaccine Safety
Ely, NV
August 3, 1999
A.L. Singleton
Chief of Staff
Committee on Ways and Means
U.S. House of Representatives
1102 Longworth House Office Building
Washington, DC. 20515
Dear Members of Congress:
Please include these written comments as part of the official
record.
I am writing to urge all of you to pass legislation which would
require the written consent of all patients in order to access, share,
or enter personal medical information into any database. We, Concerned
Parents for Vaccine Safety, are extremely concerned about the possible
invasion of medical privacy that is about to take place in the form of
national databases, etc.
No one's personal medical information should be entered into ANY
database without their written permission. Yet this is going on all
across the country. In Washington state, infants are being entered into
a database called Child Profile at birth without the parent's
knowledge, much less consent. This is wrong. The government does not
have the right to tag and track individuals for any purpose. Medical
choices are exactly that, choices and are between the individual and
the physician. These choices as well as other medical information
should remain between those two parties and no one else without the
explicit permission of the patient.
If something is not done soon, we can never go back. Once unique
personal identifiers are assigned and once we open the flood gates and
let anyone and everyone have access to private citizens' medical
information, the sky is the limit for abuse, punishment, and
discrimination. Please allow the American public to keep what little
freedom and privacy they have left. Do not allow the creation of unique
personal identifiers. Do not allow access to personal health
information to every Tom, Dick and Harry. Do not allow American
citizens to have their last little bit of privacy violated. Do not
allow American citizens to be tagged and tracked like a herd of cattle.
There is no good reason to allow such things to happen. We are all
individuals with hopes, dreams and lives. We deserve to control our own
personal health information and we do not deserve to be punished for
our choices or for heath histories which might leave something to be
desired. We beg of you, PLEASE PROTECT OUR PRIVACY!!!
Sincerely,
Dawn Winkler
Vice President
Olsson, Frank, and Weeda, P.C.
Attorneys at Law
August 3, 1999
The Honorable Bill Thomas
Chairman, Committee on Ways and Means
Subcommittee on Health
United States House of Representatives
Washington, DC. 20515
Dear Chairman Thomas:
I am writing to clarify the record of your Subcommittee's July 20,
1999 hearing regarding confidentiality of health information. At the
end of the July 20 hearing, a Member of the Subcommittee asked a
question the premise of which was that last year Washington area drug
stores sold protected health information to a competing pharmaceutical
firm. The premise of this question was apparently based on inaccurate
press reports that were later retracted.
In a February 15, 1998, front-page story and February 18, 1998
editorial, the Washington Post asserted that Elensys used patient
prescription information it received from CVS and Giant for marketing
purposes and implied that Elensys sold patient prescription information
to pharmaceutical manufacturers. That is wrong. Elensys does not use
prescription information for marketing purposes and has never sold,
given, or provided in any way, private pharmacy customer information to
any third party.
Elensys is a small business with 20 employees based out of Woburn,
Massachusetts. Elensys supports pharmacies in implementing important
prescription compliance, therapy management, and education programs. By
contract, all of the services Elensys performs are on behalf of and at
the direction of the pharmacy. Elensys' contracts with pharmacies
expressly prohibit Elensys from utilizing confidential prescription
data for its own internal purposes or sharing the information with
anyone outside the scope of the agency relationship.
Elensys is committed to supporting pharmacists in offering
important healthcare services to their customers. Most importantly,
Elensys has always protected the privacy of each patient's health
information.
Sincerely,
Karen A. Reis, Counsel
Elensys, Inc.
Independence, MO 64055
July 21, 1999
A. L. Singleton, Chief of Staff
Committee on Ways and Means
US House of Representatives
1102 Longworth House Office Bldg
Washington, DC. 20515
Dear Mr. Singleton:
I am interested in protecting patient privacy, preventing
discrimination, and controlling my own health information.
Confidentiality of my patient records is very important to me.
Thank you for giving me the opportunity to lend my comments to the July
20th hearing on medical confidentiality.
Patients and doctors have a special relationship requiring the
divulging of confidential information that sometimes even the best of
friends or family members do not share. There must be trust between the
doctor and patient to allow for sharing what could be damaging
information in order to allow timely and appropriate medical care.
For the integrity of this relationship and the health care system
in general it is important that patients have informed voluntary
consent prior to the sharing of information. The bills before the House
and Senate do not protect this right. Rather they would create a
federal law allowing researchers, government agencies, law enforcement,
and managed care organizations to enter my medical records without my
authorization. They would also limit the right of my state legislators
to enact stronger privacy legislation that Congress enacts.
As an American, I am entitled to certain rights, including the
right of protection against unlawful search and seizure by others of my
personal property. This includes personal information about myself.
Also, the Nuremberg Code protects me against becoming an unwilling
research subject.
Unconsented access to my medical records will not only violate my
Constitutional rights as a citizen, it will leave me vulnerable to
employment, insurance, and medical discrimination. I urge you to truly
protect my confidentiality by assuring patient consent prior to all
medical record access.
Sincerely,
Sandra K. Greiner
Statement of Health Insurance Association of America
Confidentiality of Health Information
The Health Insurance Association of America (HIAA)
appreciates the opportunity to submit a written statement for
the record for the hearing on ``Courier New'' Confidentiality
of Health Information ``Courier New'' held on July 20, 1999 by
the Committee on Ways and Means Subcommittee on Health.
HIAA is the nation leading advocate for the private,
market-based health care system. Its more than 269 member
companies provide health, long-term care, and disability income
insurance coverage to more than 115 million Americans, and
offer a range of health care financing products, including
indemnity health insurance, managed care plans, preferred
provider organization services, Medicare Supplemental
(``Medigap'') Insurance, Medicare Select, and Medicare+Choice.
HIAA member companies have had, and will continue to have,
strict standards in place for protecting patient medical
records. In addition, HIAA has been a vocal proponent of the
need to protect individually identifiable health information
through balanced federal legislation that protects personal
health information from public disclosure while ensuring that
information is available to carry out basis insurance and
health plan functions.
Both public and private payers require personal health
information in order to administer health care benefits. As
noted by the General Accounting Office (GAO), [p]ersonally
identifiable information is essential to the Health Care
Financing Administration (HCFA) day-to-day administration of
the Medicare Program.'' \1\ Of primary importance is the need
for public and private payers to use personally identifiable
patient information to pay billions of health care claims
annually. Other vital activities that require the use of
personally identifiable patient information by public and
private payers are:
---------------------------------------------------------------------------
\1\ MEDICARE: HCFA Needs to Better Protect Beneficiaries
Confidential Health Information (GAO/T-HEH--99-172, July 20, 1999).
---------------------------------------------------------------------------
Determination of eligibility for benefits;
Determination of risk-adjustment mechanisms;
Detection and prevention of fraud and abuse; and
Review appropriateness and quality of care
received by beneficiaries.
In its July 20, 1999 testimony, the GAO also noted several
problems faced by HCFA when there are non-uniform state laws
for confidentiality of health information. First, if HCFA could
not receive uniform health information from sources in all
states, there could be an adverse affect on internal operations
such as rate setting and quality assurance monitoring. Second,
barriers to information gathering could affect the ability of
government analysts to perform public policy analysis and
health services research because of the burden resulting from
compliance with various, non-uniform state laws.
Private payers face similar problems when state
confidentiality laws are not uniform. The current patchwork of
state laws relating to patient confidentiality leaves consumers
with fewer protections in some states than in others. Moreover,
laws and regulations governing the collection, use,
transmission, and disclosure of health information reach to the
heart of the insurance transactional process and thus have a
major impact on insurers' core business and systems functions.
These critical functions increasingly are carried out across
state lines by insurance companies and contractors through the
use of computerized data transaction systems. Therefore, health
information confidentiality is an area of insurance law in
which a significant degree of non-uniformity could impede the
industry's ability to operate efficiently and meet the demands
of its customers. The resources that must be devoted to
compliance with differing state laws in this area can be
significant. Adding a new layer of federal regulation without
preemption of existing state confidentiality laws would only
compound the difficulty. As a result, HIAA would support only
those pieces of federal legislation that preempted most state
laws.
Consumers' concerns over the confidentiality of health
information must be addressed. At the same time, however, we
must be careful not to adopt overly prescriptive legislation
that undermines the ability of the health care industry to
provide these same consumers with the high quality, affordable
health care services.
Health information is the lifeblood of the health care
system. The days of a patient seeing only a single family
practitioner have ended. Today, patients obtain care from a
diverse group of health care practitioners, such as specialists
and allied health care professionals. In this environment,
effective care can only be provided through cooperation among
practitioners who must share (and often communicate about) a
patient's medical information. As our nation has moved
increasingly toward a system of integrated care and
computerized transactions, the free flow of medical information
becomes even more critical. Accurate, readily available health
information is vital to determining the best course of
treatment for a patient, and that is clearly its central and
most important use.
Also critical is the use of such information to help ensure
that basic insurance functions are carried out, such as paying
claims and preventing fraud and abuse. Finally, health
information is used for many other purposes: to assure health
care quality, to help measure health outcomes, and to ensure
that patients receive preventive services, to name only a few.
Proposed state and federal confidentiality laws generally
contain rules affecting health insurers' and health plans'
claims administration, enrollment and disenrollment processes,
payment and remittance procedures, referrals and authorization
certifications, quality improvement and research activities,
and other areas. As such, they can have a significant impact on
day-to-day business operations. Therefore, it is critical that
balanced, responsible federal legislation be enacted that
provides strong protections for consumers while not placing
undue regulatory burdens on the private health care system.
In May 1999, the HIAA Board of Directors adopted formal
policy supporting the enactment of federal confidentiality
legislation that contains several important principles:
Federal standards for confidentiality of patient
health information.
As noted above, federal standards ensuring the
confidentiality of patient health information are critical to
guaranteeing uniform and consistent treatment of such
information throughout the country. Congress took important
steps in the right direction with HIPAA by requiring
standardized electronic transmission of health care information
with appropriate security protections. HIAA believes strongly
that a uniform standard is the only way to avoid a dual-
regulatory environment for medical records. State authority
should remain paramount over areas of confidentiality that do
not conflict with national uniformity and consistency, such as
state reporting requirements for public health and safety
dangers.
Strong and consistent confidentiality protections
for all individually identifiable patient health information.
HIAA believes that all sensitive, personal health
information should be kept confidential. Certain types of
health information or information about illnesses should not be
singled out legislatively for stronger protection, or weaker
protections.
Facilitate appropriate use of patient health
information and recognize that access to health information is
helpful to patients and often critical to providing quality
care.
Today, most health care services are delivered through some
form of coordinated or organized system of delivery. As health
plans, providers, hospitals, purchasers, and others in the
health care industry continue to design and enter into
innovative health care delivery arrangements, it is important
to recognize that appropriate information sharing and use must
occur within that system to ensure patients receive appropriate
health care. The trend toward the coordinated delivery of care
provides greater opportunities to protect confidential patient
health information, and to ensure such information is used
appropriately to benefit consumers. Such coordinated systems
enable improved tracking of an individual's health information
to better monitor appropriate access to and uses of such
information.
Do not impede public and private sector efforts to
combat health care waste, fraud, and abuse.
Patient medical information is important to anti-fraud
activities carried out both by the state and federal
governments, and by insurers. A 1999 audit by the HHS Office of
the Inspector General found that Medicare made improper
payments of over $12 billion in fiscal year 1998 alone, and the
General Accounting Office has estimated that health care fraud
accounts for up to 10 percent of national health care spending
each year.
Insurance information and patient information are the
vehicles through which health care fraud is committed.
Providers cannot falsify claims and medical equipment suppliers
cannot submit inflated bills without access to patient
information. At the same time, this information is critical to
combating fraud, as investigators must depend heavily upon the
use of medical records to document fraud cases. This does not
necessarily mean that individually identifiable patient
information must be publicly disclosed in order to successfully
investigate and prosecute fraud. But it does mean that fraud
investigators in both the public and private sectors must
continue to have access to such information. Thus, when
developing federal legislation for confidentiality of health
information, Congress should be mindful that overly
prescriptive privacy protections might adversely affect health
care fraud enforcement and ultimately be detrimental to
consumers.
Provide fair penalties as a strong deterrent to
misuse of individually identifiable health information, rather
than imposing process-oriented regulatory requirements.
HIAA believes that strong administrative penalties should
be put in place for those who inappropriately use or disclose
sensitive, individually identifiable health information. New
penalties should not be authorized for administrative mistakes
or errors, but only for material violations that lead to
demonstrated harm to consumers.
Statement of Sue A. Blevins, President, Institute for Health Freedom
Chairman Thomas and members of the Ways and Means
Subcommittee on Health:
Thank you for holding the important hearing on July 20,
1999 to discuss confidentiality of health information. My name
is Sue Blevins. I am founder and president of the Institute for
Health Freedom (IHF), a nonpartisan, nonprofit research center
dedicated to promoting individual freedom to choose health
care.
For nearly three years, Congressional leaders have known
that they must pass a medical privacy law by August 21, 1999 or
the Clinton Administration will be handed the authority to
regulate Americans' medical privacy. The Health Insurance
Portability and Accountability Act of 1996 mandates that if
Congress fails to act by the August 21 deadline, then
regulations governing medical privacy must be promulgated by
February 2000. The regulations will affect millions of
individuals across the nation, including patients, doctors, law
enforcement officials, health insurers, researchers, and
government agencies.
Current proposals claiming to make medical information as
``non-identifiable as possible'' are no guarantee for true
medical privacy. Can such vague legislation really guarantee
that researchers won't be able to trace back patients' personal
information--including genetic and cellular information? With
efforts to double the current $15 billion federal budget for
biomedical research, it is apparent that scientists are going
to need more data to complete research projects. But government
has no right to allow researchers access to private-paying
patients' medical information without first obtaining their
consent.
The Clinton Administration recently announced that its
National Bioethics Advisory Commission (NBAC) completed a
review of the ethical and medical considerations associated
with human stem cell research. The Administration reports that
it ``recognizes that human stem cell technology's potential
medical benefits are compelling and worthy of pursuit, so long
as the research is conducted according to the highest ethical
standards. NIH is putting in place guidelines and an oversight
system that will ensure that the cells are obtained in an
ethically sound manner.''
The Institute for Health Freedom urges Congress, the
Clinton Administration, and the NIH to maintain and enforce
strong informed consent principles. Research without consent is
unethical.
Statement of LPA, Inc.
Mr. Chairman and Members of the Subcommittee:
Thank you for allowing us to present our views to your
Subcommittee regarding medical privacy legislation. LPA, Inc.,
formerly the Labor Policy Association, is a public policy
advocacy organization representing senior human resource
executives of more than 250 of the largest corporations doing
business in the United States. LPA's purpose is to ensure that
U.S. employment policy supports the competitive goals of its
member companies and their employees. LPA member companies
employ more than 12 million employees, or 12 percent of the
private sector workforce.
While there are numerous issues in the medical privacy area
where we share the concerns of others within the business
community, LPA's primary concern deals with the ability of
employers to make critical human resource decisions that serve
the interests of employees and the public at large. The
principle at stake is whether employers, primarily through
fitness-for-duty testing and drug testing, may ensure that
employees are not only capable of performing the functions of
their position but also that, in doing so, they do not pose a
threat to themselves, their co-employees, or the public at
large. This concern goes well beyond the bottom-line interests
of the employer.
Moreover, we urge the Subcommittee not to overlook the
substantial protections that already exist under current law to
ensure that employers do not abuse this responsibility. First
and foremost, almost ten years ago, the Congress enacted
sweeping legislation--the Americans With Disabilities Act
(ADA)--that establishes substantial protections for employees
regarding employment decisions based on their physical and
mental capabilities. As part of those protections, the law
imposes carefully crafted restrictions on what employers can
ask and how they can use medical information about applicants
and employees.
Mr. Chairman, we appreciate the work your staff has done to
learn about these issues as it drafted your version of medical
privacy legislation. We look forward to working with them
further to ensure that final legislation allows employers to
meet their obligations to employees and others under current
labor and employment laws.
The Executive Branch has not been as responsive. In her
September 1996 testimony before Congress, Secretary of Health
and Human Services Donna Shalala spoke at great length about
the need for specific and far-reaching protections for the
personal health information of patients. However, the
Secretary's testimony gave far less attention to the very
legitimate need of employers for health information for the
purposes of ensuring a safe and efficient workplace and
complying with existing law.
Under legislation previously introduced in the House--H.R.
1057 and S. 573, the ``Medical Information Privacy and Security
Act,'' H.R. 1941, the ``Health Information Privacy Act,'' H.R.
2404, the ``Personal Medical Information Protection Act of
1999,'' and H.R. 2470, the ``Medical Information Protection and
Research Enhancement Act of 1999''--and in the Senate--S. 578,
the ``Health Care Personal Information and Nondisclosure Act of
1999'' and S. 881, the ``Medical Information Protection Act of
1999''--the impact on these restrictions would be, at best,
unclear. At worst, the careful balance in the ADA between the
individual employee's interests and those of his or her co-
employees, the employer and the public would be completely
undermined. A similar analysis applies to drug testing which,
in many instances, employers are required or encouraged to
perform by law.
Since these employer activities have never been the focus
of the medical privacy debate, we do not believe the supporters
of medical privacy legislation would intend to disrupt them.
Instead, it is our sense that, in the rush to enact legislation
by the August 1999 deadline, the Congress is still gathering
information about all the various endeavors that could be
affected, and this is an impact that has not been fully
considered. Indeed, after raising these concerns with the
Senate Committee on Health, Education, Labor and Pensions, the
medical privacy legislation currently under consideration by
the Committee now protects these employer activities.
Therefore, it is our purpose today to provide you with the
necessary information to assist you in crafting legislation
that does not pose a threat to the ability of employers to
protect their own employees as well as the public at large.
Drug and Fitness for Duty Tests
Many jobs require certain levels of physical and/or mental
competencies. Fitness for duty examinations allow employers to
determine whether an individual can perform the essential
functions of the job and, if they are not able to because of a
disability, whether a reasonable accommodation can be made to
enable them to perform those functions.
The Equal Employment Opportunity Commission, in its January
1992 ``Technical Assistance Manual on the Employment Provisions
(Title I) of the Americans With Disabilities Act,'' provides
several examples of fitness tests, all of which are consistent
with the ADA's protections:
ensuring that ``prospective construction crane
operators do not have disabilities such as uncontrolled
seizures that would pose a significant risk to other workers;''
testing of workers in certain health care jobs
``to ensure they do not have a current contagious disease or
infection that would pose a significant risk of transmission to
others;'' and
ensuring that an individual considered for a
position operating power saws or other dangerous equipment is
not someone ``disabled by narcolepsy who frequently and
unexpectedly loses consciousness.''
In addition to fitness for duty tests, many employers
implement drug testing of prospective and current employees.
Workplace drug testing, as part of a drug-free workplace
policy, has proven extremely effective in reducing work-related
accidents. In the 1980s, many companies implemented these
programs and began experiencing immediate positive results in
their health and safety records. Many of these were described
in a 1989 study by the Employment Policy Foundation entitled
``Winning the War on Drugs: The Role of Workplace Testing'':
Southern Pacific Transportation Co. first
implemented its drug testing program in 1984. According to the
company, personal injuries per 200,000 employee hours worked
dropped from 15.6 in 1983 to 6.5 in 1988. Train accidents
attributable to human failure dropped from 911 incidents in
1983 to 96 in 1988.
Pacific Gas and Electric Co. enjoyed a 25%
reduction in accidents and a 40% decrease in serious injuries
after it implemented its pre-employment screening program,
designed to alert the company to drug-using job applicants.
Illinois Bell reported saving $459,000 in reduced
absences, accidents and medical disability resulting from a
rehabilitation program in which drug-using employees were
enrolled.
Because of the success of programs like these, testing in
some industries is now even required by law, such as the
mandatory drug testing programs for commercial drivers required
by the Omnibus Transportation Employee Testing Act of 1991.
Even where drug testing is not required, it is often
encouraged. Thus, the Drug-Free Workplace Act of 1988 requires
all federal contractors with contracts of at least $25,000 to
certify that they are providing a drug-free workplace, at the
risk of contract debarment if they fail to do so. Many
contractors are able to provide this certification as a result
of their drug testing programs.
Application of Pending Legislation
None of the bills introduced so far in the 106th Congress
contain specific provisions dealing with fitness for duty tests
or drug testing. However, it seems clear that the broad
definitions of ``protected health information'' (PHI) under the
various bills would encompass the data obtained from those
tests, since PHI includes all information that relates to the
``past, present or future physical or mental health or
condition of an individual'' that is ``created or received
by,'' among others, an employer.
The bills require that employers obtain a separate
authorization from an employee before receiving such protected
health information. If the employee refuses to provide the
authorization, the employer is forbidden from viewing the
results of those tests. This is specifically stated in Section
203 of H.R. 1057 and S. 573 which provides that an employer,
health plan, health or life insurers, or providers ``may not
disclose protected health information to any employees or
agents who are responsible for making employment, work
assignment, or other personnel decisions with respect to the
subject of the information without a separate authorization
permitting such disclosure.'' Section 103 of H.R. 1941 provides
that employers may not require an authorization of disclosure
of protected health information as a condition of providing or
paying for health care.
The requirement for an authorization in these instances is,
of itself, not problematic, as long as the employer may take
appropriate action where the employee or applicant fails to
provide the authorization. Thus, if a job applicant takes a
mandatory fitness for duty test, but refuses to authorize
disclosure of the results to the employer, the employer should
be able to refuse to hire the individual on that basis, or else
the test is no longer mandatory.
Two of the bills--H.R. 1057 and S. 573--generally require
employers to provide written notice to their employees of,
among other things: ``The right of an individual not to have
employment or the receipt of services conditioned upon the
execution by the individual of an authorization for
disclosure.'' This is the only place in the bills where this
right is mentioned, but if the bills do indeed create such a
right and become law, then an employer would violate the law by
refusing to hire an individual who failed to authorize the
release of the results of a drug or fitness for duty test.
We believe that Congress has no inclination to prevent
employer practices designed to protect the health and safety
interests of their employees and the public, particularly in
view of the history of strong congressional support for drug
testing programs. Thus, we strongly urge this Subcommittee to
clarify any medical privacy legislation that it considers to
ensure that mandatory fitness and drug testing can continue to
exist.
Relationship of Legislation to Existing Laws
A broader unintended problem is the failure to contemplate
the interaction with other laws which may not comprehensively
regulate disclosure of individual medical information, but
where that information is implicated in the compliance with
those laws. In particular, the ability of employers to comply
with both the Americans with Disabilities Act (ADA) and the
Family and Medical Leave Act (FMLA) could be substantially
impaired.
Americans with Disabilities Act. Under the Americans with
Disabilities Act, employers are already substantially regulated
as to when they can require medical exams of, or request
medical information from individuals; what they can examine or
ask them for; and what employment decisions are permissible
once medical information concerning the individual is acquired.
An employer is generally prohibited from discriminating against
a ``qualified individual with a disability,'' which means a
disabled individual who can perform the ``essential functions
of the job'' with or without a ``reasonable accommodation.''
The ADA rightfully recognizes that the employer must have
access to a certain amount of medical information about
employees and prospective employees. Under Section 102 of the
ADA, employers have the right to require a medical examination
after an offer of employment has been made and prior to the
commencement of employment. If, during the medical examination,
the doctor discovers a condition that may affect the person's
ability to do the job, the employer still must go through the
``reasonable accommodation process'' to determine whether the
individual could do the essential functions of the job with
reasonable accommodation. Once the individual has been hired,
the employer may not require medical examinations unless they
are ``job-related and consistent with business necessity.''
Meanwhile, the ADA limits the amount of medical information
that can be obtained during employment to that information
which is job-related and consistent with business necessity.
Strict confidentiality requirements apply to the information.
During the hiring process, the employer may share medical
information only with decision makers with a ``need to know''
the information. Even an employee's supervisor and manager are
not entitled to any medical information beyond what limitations
the employee has to do the particular job. Thus, the ADA
already protects against any improper use of critical medical
data by the employer.
Yet, the data obtained consistent with ADA requirements
would clearly constitute protected health information under
legislation introduced so far. Thus, even though the employer
would have a right to access the data under the ADA, a new
authorization requirement would be superimposed and employers
could be forbidden from viewing the results of medical exams
taken to detect or confirm the existence of a disability that
could affect the ability of an employee to do his or her job
competently and safely. While H.R. 1941 provides explicitly
that it shall not preempt the Americans with Disabilities Act,
the disclosure requirements in the bill make compliance with
the ADA potentially problematic.
Family and Medical Leave Act. Under the Family and Medical
Leave Act (FMLA), employees are guaranteed a right to up to
twelve weeks of leave annually for a serious medical condition.
Under Section 103 of the FMLA, employees who wish to use FMLA
medical leave can be required by their employer to provide a
certification issued by a health care provider that discloses,
in part:
the date on which the employee's ``serious medical
condition'' began;
the probable duration of the condition;
the ``appropriate medical facts within the
knowledge of the health care provider'' regarding the
condition; and
a statement that the employee is unable to
``perform the functions of the position.''
Clearly, most or all of the information contained in the
medical certification would meet the definition of protected
health information under all the proposed bills, and would
therefore be covered by the requirements of those bills. Thus,
for the employer to receive the certification, the employee
would have to provide the requisite authorization. Since the
employer may, under the FMLA, deny leave for an alleged serious
medical condition where no certification is provided, could an
employee argue that his or her consent was coerced in this
situation and thus not valid? This issue must be clarified in
the legislation.
Conclusion
In conclusion, we believe it is extremely important that
any legislation crafted by your Subcommittee in this area
recognize the critical role played by medical information in
enabling employers to provide necessary protections to their
employees as well as the general public. These protections are
provided within a framework of existing laws that were
carefully crafted to achieve a balance between the competing
interests of the individual employee, his or her co-employees,
the employer and the public. A dismantling of this framework,
whether intended or not, would be disastrous.
Statement of National Association of Health Underwriters, Arlington, VA
The National Association of Health Underwriters is an
association of insurance professionals involved in the sale and
service of health insurance, long-term care insurance, and
related products, serving the insurance needs of over 100
million Americans. We have almost 16,000 members around the
country. We appreciate this opportunity to present our comments
regarding confidentiality of health information.
THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF
1996 (HIPAA), called for Congress to pass legislation to
protect the confidentiality of patient medical records no later
than August 1, 1999. Should Congress fail to act, HIPAA
requires the Department of Health and Human Services to write
regulations by February 2000. While there is general agreement
on the need for such legislation, it is clear that absolute
confidentiality may be unobtainable, and that a balance must be
achieved between a person's reasonable desire and expectation
of confidentiality, and a payer's right and duty to know what
they are paying for.
Technological advances have vastly improved the ability of
providers to track patient care and outcomes, develop disease
management programs, and exchange information with other
providers to improve patient care. These same advances have
enabled payers and providers to exchange information quickly to
improve the speed and accuracy of claims payment. These
technological advances combined with new medical advances in
the treatment, and prevention of disease have changed and
improved the way medical care is delivered in the United
States. When these changes are combined with a now highly
mobile society, it becomes clear that the picture of a person's
medical records being stored only in the family physician's
locked filing cabinet is a thing of the past.
In spite of these changes, NAHU believes that individuals
should have an expectation of confidentiality with respect to
their personal health information and records. A patient who is
fearful that his or her medical records might be disclosed
without authorization to a third party may withhold medical
information, give false information, or simply not seek
treatment for his or her medical condition, resulting in a lack
of proper medical treatment, the wrong treatment or no
treatment at all.
NAHU believes that individuals have certain rights with
respect to their medical records. Individuals should be able to
inspect or copy their medical records, to request an amendment
to their medical records, and to have a written copy of any
disagreement they have with the content of their medical
records be listed as a permanent part of their medical file, if
their request for amendment is denied.
Health plans, health care providers, public health
agencies, researchers, schools, and others who must collect
certain medical information should retain on file an
authorization for the release of medical information. This
authorization allows disclosure of only the medical information
necessary to accomplish the purpose for which it is disclosed.
Some groups have called for specialized confidentiality
standards on certain ``specially protected'' portions of a
person's medical records, such as information on genetic
testing, mental health history, or HIV status. NAHU is opposed
to this separation of records for two reasons. First, this
approach focuses attention away from the importance of
protecting the entire medical record. It is important to note
that different individuals have differing ideas about which
parts of their medical records are most sensitive. One person
may be most sensitive about the results of a genetic test,
while another may be concerned about a record of cosmetic
surgery. It is impossible for us to know what each person would
choose to keep in a ``super secret'' file, if they had the
choice.
Our second concern relates to the practical aspect of
keeping two sets of files. For NAHU's members, for example,
copies of applications are retained for individuals as well as
employer groups that apply for coverage. On small employer
plans, individual employees also complete medical
questionnaires. So agents may actually have these records on
each of 50 employees for each of the employer groups they
service, in addition to those of all of the individuals who
apply for coverage. Depending on what Congress decided would be
kept in which file, not only would our members have to
duplicate each file, but they would have to re-screen each
application and block out information which could not be
retained in the standard file. This merely describes the
process for insurance agents, which handle the initial
paperwork on an insurance application. Insurance companies
would be required to do the same thing. Doctors would have to
complete two different medical records, and shift back and
forth between both records. All other providers would be
required to do the same thing. Not only would the chance for
errors in the delivery of medical care increase dramatically,
it would greatly increase the cost of delivery of health care.
For these reasons, NAHU cannot support a confidentiality
proposal that calls for dual record keeping and disclosure
requirements.
Thirty-four states currently have some form of
confidentiality standards that have been enacted at the state
level. Secretary Shalala and some others have suggested that
new federal standards should be a ``floor,'' allowing the
states to adopt more stringent standards. Many others believe
that the interstate way medical care is delivered in today's
society, the cost implications of fifty separate sets of
standards, and the potential confusion for providers and
payers, especially those which operate on or near state lines,
call for a uniform system nationwide. Confidentiality standards
are different from insurance regulations, in that they impact
doctors, labs, clinics, hospitals, ambulatory facilities,
nursing homes, researchers, and law enforcement officials, in
addition to insurance companies, insurance agents, HMOs, and
other health plans. In order to truly protect patients, it is
important to be absolutely certain that there is no
misunderstanding as to the provisions of new confidentiality
standards. NAHU believes that a uniform national system would
be more easily understood by patients, providers, and payers,
and that a single uniform system would be more cost effective.
NAHU supports state enforcement authority of these uniform
standards.
NAHU has serious concerns about initiatives that would call
for a private right of action for breaches of confidentiality.
Particularly if state laws are not preempted, the complexities
of confidentiality legislation, and the different rules in
states that already exist for different types of medical
information greatly enhance the opportunity for accidental non-
compliance. Legal action is expensive, and the cost will
directly affect the cost of health care plans and the premiums
people pay for their insurance. If plans become unaffordable,
the ranks of the uninsured will increase.
NAHU recognizes that, while medical researchers may
generally not require individually identifiable health
information, there have been many occasions where it served the
public health interest to be able to access individual
information, for example, when discoveries have been made
relative to dangers associated with certain medications. NAHU
believes that researchers subject to peer review should
continue to have the opportunity to advise participants in
clinical trials or their physicians of these types of negative
findings.
Finally, NAHU acknowledges that law enforcement may have a
legitimate use for medical records where an authorization for
disclosure has not been made, for example, in the lawful
interest of public safety when investigating a felony. NAHU
believes, however, that these uses should be the exception and
not the rule, and that specific requirements for their use
should be laid out in legislation, to ensure only appropriate
release of information.
NAHU believes that the American consumer will benefit
greatly from reasonable and understandable standards for the
protection of the confidentiality of medical records. These
important protections will make for a healthier America by
restoring confidence and trust in the confidentiality of the
patient/provider relationship. NAHU looks forward to working
with Congress on the passage and implementation of this very
important legislation.
We thank you for this opportunity to present testimony to
the committee. Should you have any questions, please contact
NAHU's Director of Federal Policy Analysis, Janet Trautwein at
(703) 276-3806, [email protected].
Statement of National Association of Insurance Commissioners, Special
Committee on Health Insurance
I. Introduction
This testimony is submitted by the National Association of
Insurance Commissioners' (NAIC) (EX) Special Committee on
Health Insurance. The NAIC requests that this written testimony
be submitted as part of the record for the hearing on
``Confidentiality of Health Information'' held by the Health
Subcommittee of the House Ways and Means Committee.
The NAIC, founded in 1871, is the organization of the chief
insurance regulators from the 50 states, the District of
Columbia, and four of the U.S. territories. The NAIC's
objective is to serve the public by assisting state insurance
regulators in fulfilling their regulatory responsibilities.
Protection of consumers is the fundamental purpose of insurance
regulation.
The NAIC Special Committee on Health Insurance (``Special
Committee'') is comprised of 46 state insurance regulators. The
Special Committee was established as a forum to discuss federal
proposals related to health insurance and to provide technical
assistance to Congress and the Administration on a nonpartisan
basis.
Our testimony focuses on four aspects of the preemption
issue raised by the current federal health information privacy
legislation. First, we will discuss the states' recognition of
the desire for a minimum standard to protect the privacy of
health information. Second, we will give some examples of what
the states have done to ensure that health information is kept
confidential, and discuss the concerns we have about the
preemption language in the proposed federal legislation and how
Congress can develop a minimum standard without eliminating
existing state protections. Third, we will address the need for
Congress to clarify the scope of any federal health information
privacy legislation and to develop a way for states to measure
their laws against any federal standard for compliance.
Finally, we will discuss the enforcement of privacy laws, which
may seem to go beyond the issue of preemption, but actually
gets to the heart of whether Congress should adopt a floor in
this area or completely preempt the states.
II. Recognizing the Desire for a Federal Minimum Standard
As required by the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), Congress must enact privacy
legislation by August 21, 1999. Should Congress fail to act,
HIPAA requires the Secretary of Health and Human Services to
promulgate regulations by February 2000.
The states, acting through the NAIC, understand the desire
for minimum standards to protect the privacy of health
information. A minimum standard in this area is considered
necessary given that health information is transmitted across
state and national boundaries. The transmission of health
information, as opposed to the delivery of health care
services, is not a local activity. This was one of our main
reasons for developing a model on this issue--The Health
Information Privacy Model Act (attached).
The NAIC adopted the Health Information Privacy Model Act
in September 1998.\1\ This model addresses many of the same
issues that the federal legislation does, such as: (1)
providing an individual the right to access and to amend the
individual's protected health information; (2) requiring an
entity to obtain an authorization from the individual to
collect, use or disclose information; and (3) establishing
exceptions to the authorization requirement. Our model was
developed to assist the states in drafting uniform standards
for ensuring the privacy of health information.\2\ However,
because our jurisdiction is limited to insurance, and health
information privacy encompasses more issues than insurance and
more entities than insurers, we understand the desire for
broader federal legislation.\3\
---------------------------------------------------------------------------
\1\ This model was developed with state regulators, representatives
of the insurance and managed care industries, and representatives from
the provider and consumer communities. The NAIC model reflects the
excellent work that has been done by a number of states on this
difficult topic. The NAIC recognized the need to update the provisions
of its existing ``NAIC Insurance Information and Privacy Protection
Model Act,'' which was adopted by the NAIC in 1980, to reflect the
rapidly evolving marketplace for health care and health insurance and
the dramatic changes that have occurred over the past 19 years in
information technology.
\2\ The NAIC model requires carriers to establish procedures for
the treatment of all health information, whether or not it is protected
health information. The model then establishes additional rules for
protected health information. In contrast, the federal bills require
that named entities establish and maintain safeguards to protect the
confidentiality of protected health information, which is more limited.
The NAIC believes that Congress should establish procedures to assure
the accuracy and integrity of all health information, not just
protected health information.
\3\ The most obvious difference between the NAIC model and the
federal bills is in the scope of the entities to which the respective
proposals would apply. The NAIC model applies to all insurance
carriers. The federal bills are much broader and apply to health care
providers, health plans, public health authorities, health oversight
agencies, health researchers, health or life insurers, employers,
schools, universities, law enforcement officials, and agents. Different
sections of the federal bills apply to different combinations of these
named entities. However, we are concerned that the federal bills only
apply to health and life insurers and not to all insurers.
With respect to insurers, we recommend the approach of the NAIC
model, which applies to all insurance carriers and is not limited to
health and life insurers. The NAIC had an extensive public discussion
about whether the NAIC model should apply only to health insurance
carriers, or instead, to all carriers. Health and life insurance
carriers are not the only types of carriers that use health information
to transact their business. Health information is often essential to
property and casualty insurers in settling workers' compensation claims
and automobile claims involving personal injury, for example.
Reinsurers also use protected health information to write reinsurance.
The NAIC concluded that it was illogical to apply one set of rules to
health insurance carriers but different rules, or no rules, to other
carriers that were using the same type of information. Consumers
deserve the same protection with respect to their health information,
regardless of the entity using it. Nor is it equitable to subject life
and health insurance carriers to more stringent rules than those
applied to other insurers. Our model applies to all insurance carriers
and establishes uniform rules to the greatest extent possible.
---------------------------------------------------------------------------
Recognizing all of the above factors, along with the fact
that all of the health information privacy bills currently
before Congress preempt state law in one fashion or another,
the members of the NAIC have concluded that the privacy of
health information is one of the few areas where it may be
appropriate for the federal government to set a minimum
standard. However, it should be noted that up until this point
there has been no federal standard in place. Rather, states
have been the protector of consumers in this area. Any federal
legislation must recognize this fact and make allowances for
it.
III. Preemption
A. Existing State Laws
As this Subcommittee is well aware, the drafting of
legislation to establish standards that protect the privacy
rights of individuals with respect to highly personal health
information is a very difficult task. Like you, the members of
the NAIC sought to write standards into the NAIC Model that
would not cripple the flow of useful information, that would
not impose prohibitive costs on entities affected by the
legislation, and that would not prove impossible to implement
in a world that is rapidly changing from paper to electronic
records. At the same time, the members of the NAIC recognized
the need to assure consumers that their health information is
used only for the legitimate purposes for which it was
obtained, and that this information is not disclosed without
the consumer's consent or knowledge for purposes that may harm
or offend the individual.
When developing protections for health information,
Congress must recognize the impact of any federal privacy
legislation on existing federal and state laws. Although we
cannot fully address the impact on federal law, we do know that
many state laws touch on protected health information and
appear in many locations within the states' statutes and
regulations. These laws do not neatly fit into a federal bill's
list of exceptions. For example, privacy laws can be found in
the insurance code, probate code, and the code of civil
procedure. Numerous privacy laws relating to health information
are also contained in the states' public health laws, which
address such topics as child immunization, laboratory testing,
and the licensure of health professionals. Other potential
areas involve workers compensation laws, automobile insurance
laws, and laws regulating state agencies and institutions. In
addition, many state privacy laws only address health programs
or health-related information that are unique to a particular
state.
Let us give you some examples of the existing state laws
that protect health information.
California
California's Business and Professions Code provides
protections for health information used in telemedicine, which
is the practice of health care delivery, diagnosis,
consultation, treatment, transfer of medical data and education
using interactive audio, video or data communications (Cal.
Bus. & Prof.. Code Sec. 2290.5). These protections are in
addition to other existing confidentiality protections provided
by law, including the ``Confidentiality of Medical
Information'' statute in California's Civil Code (Cal. Civ.
Code Sec. 56 et seq.). Under the telemedicine law, the health
care practitioner must obtain verbal and written informed
consent from the patient prior to the delivery of health care
via telemedicine. The individual retains the option to withhold
or withdraw consent at any time without affecting the right to
future care or treatment or without risking the loss or
withdrawal of any program benefits to which the individual
would otherwise be entitled. The patient is guaranteed access
to all medical information transmitted during a telemedicine
consultation, and copies of this information are available for
a reasonable fee. Dissemination of any patient-identifiable
images or information from the telemedicine interaction to
researchers or other entities is prohibited without the consent
of the patient. This statute provides only three exceptions to
the requirement of patient consent for disclosure of health
information: (1) when a patient is not directly involved in the
telemedicine interaction, such as when one health care
practitioner consults with another health care practitioner;
(2) in an emergency situation in which a patient or
representative is unable to give informed consent; and (3) to a
patient under the jurisdiction of the Department of
Corrections.
California's telemedicine statute could arguably be
preempted by federal legislation that uses a total preemption
approach. This statute is one example of states responding to
changes in technology and addressing issues beyond those
addressed in any of the federal bills. California not only
protects the confidentiality of medical records but it protects
health information in telemedicine. The telemedicine statute
also requires consent for disclosing health information and has
far fewer exceptions for disclosure without consent than any of
the federal bills. The state law also guarantees patients the
right to access all medical information without exception,
whereas the federal bills have exceptions to patient access.
Finally, the state law allows the patient to revoke consent at
any time without affecting the right to future care or program
benefits; however, this right is not included in the federal
legislation. If a federal privacy bill using a total preemption
approach is enacted, California's telemedicine protections,
which are stronger than those in the pending federal
legislation, would arguably be preempted.
Connecticut
Connecticut has already enacted a privacy protection law
for insurance information. (Conn. Gen. Stat. 38a-975 et seq.).
This law applies to insurance institutions, agents and
insurance-support organizations, and it protects health
information that is collected, received or maintained in
connection with insurance transactions that pertain to
individuals who are residents of the state or who engage in
insurance transactions with applicants, individuals or
policyholders who are residents of the state. It also applies
to insurance transactions involving policies, contracts or
certificates of insurance delivered, issued for delivery, or
renewed in the state. This law applies to life, health,
disability, and property and casualty insurance, and therefore
to issuers of these products. This state law would be preempted
under a federal bill that used a total preemption approach.
Arguably any health information held by life or health insurers
may still be protected under the federal legislation; however,
health information held by disability or property and casualty
insurers, which is currently protected under this state law,
would become unprotected under the current federal legislation.
Without the opportunity for the state to implement its own laws
to address these types of insurers, the health information they
hold would be vulnerable to potential misuse or disclosure by
those who hold it. In addition, if the federal standard were to
fall short of Connecticut law in some way, the level of
protection for information held by life and health insurers
would be diminished.
Florida
Florida's Civil Rights law requires confidentiality and
informed consent for genetic testing. (Fla. Stat. Ann.
Sec. 760.40). The law provides that except for purposes of
criminal prosecution, determining paternity, or acquiring
specimens from persons convicted of certain offenses, DNA
analysis may be performed only with the informed consent of the
person to be tested, and the results of such DNA analysis,
whether held by a public or private entity, are the exclusive
property of the person tested, are confidential, and may not be
disclosed without the consent of the person tested. This law
arguably would be preempted by a total preemption approach that
uses the ``related to'' standard. Civil rights laws and genetic
testing laws do not fall within any of the federal bills'
exceptions, so presumably DNA tests would be governed by the
provisions of federal bills. However, the federal legislation
would arguably allow DNA test results and the identity of the
individual to be disclosed without the individual's
authorization under some of the federal bills' provisions,
including the research provisions.
Massachusetts
Under Massachusetts' education statutes, provisions are
established for the testing, treatment and care of persons
susceptible to genetically-linked diseases. (Mass. Ann. Laws
ch.76, Sec. 15B). The law requires the Department of Public
Health to furnish necessary laboratory and testing facilities
for a voluntary screening program for sickle cell anemia or for
the sickle cell trait and for such genetically-linked diseases
as may be determined by the Commissioner of Public Health.
Records maintained as part of any screening program must be
kept confidential and will not be accessible to anyone other
than the Commissioner of Public Health or to the local health
department which is conducting the screening program, except by
permission of the parents or guardian of any child or
adolescent who has been screened. Information on the results of
any particular screening program shall be limited to
notification of the parent or guardian of the result if the
person screened is under the age of 18 or to the person himself
if he is over the age of 18. The results may be used otherwise
only for collective statistical purposes. Again, this state
program may be preempted by a federal privacy law because it
does not fall under the federal bills' preemption exceptions.
Under the federal bills this health information would be at
risk of disclosure without authorization under the public
health or research provisions.
Michigan
Michigan's Public Health Code mandates confidentiality of
HIV testing and requires written, informed consent (Mich. Comp.
Laws. Sec. 333.5114, 333.5133). A physician or the physician's
agent shall not order an HIV test for the purpose of diagnosing
HIV infection without first receiving the written, informed
consent of the test subject. Written, informed consent must
contain at a minimum all of the following: (1) an explanation
of the test, including the purpose of the test, the potential
uses and limitations of the test, and the meaning of the test
results; (2) an explanation of the rights of the test subject,
including the right to withdraw consent prior to the
administration of the test, the right to confidentiality of the
test and the results, and the right to participate in the test
on an anonymous basis; and (3) the persons or class of persons
to who the test results may be disclosed. In addition, an
individual who undergoes an HIV test at a department-approved
testing site may request that the HIV test be performed on an
anonymous basis. Staff shall administer the HIV test
anonymously and shall obtain consent to the test using a coded
system that does not link the individual's identity with the
request for the HIV test or the results. The Michigan law
states that consent is not required for an HIV test performed
for the purpose of research, if the test is performed in such a
manner that the identity of the test subject is not revealed to
the researcher and the test results are not made known to the
test subject. This state law risks being preempted by the
federal legislation depending on the preemption approach and
the exceptions. If state public health laws are exempt from
federal law, this state law could be left in place depending on
how the federal legislation classifies public health laws. If
state public health laws are not excepted, this state law would
arguably be preempted by federal legislation that uses a total
preemption approach, but the protection the state law offers
would not be replaced with a federal equivalent. Some of the
federal bills would allow the identity of the individual to be
disclosed without the individual's consent under the public
health or research provisions.
Montana
Under Montana's laws governing health maintenance
organizations, any data or information pertaining to the
diagnosis, treatment, or health of an enrollee or applicant
obtained from the enrollee, applicant or a provider by a health
maintenance organization must be held in confidence and may not
be disclosed to any person, except upon express consent of the
enrollee or applicant, pursuant to statute or court order for
the production of evidence or discovery, in the event of a
claim or litigation between the enrollee or applicant and the
health maintenance organization where in the data or
information is pertinent, or to the extent necessary to carry
out the purposes of this chapter. (Mont. Code Ann. Sec. 33-31-
113). The provisions of the state law would presumably be
preempted by a total preemption approach and would not be saved
under any current exception in the federal bills. The state law
prohibits disclosure except in a few limited cases, mostly
pertaining to litigation, whereas the federal legislation would
allow health maintenance organizations (health plans) to
disclose this protected information without authorization under
many more instances.
In addition, Montana just enacted a comprehensive medical
records privacy bill targeted at insurers. This new law was
modeled after the NAIC Health Information Privacy Model Act,
and it builds upon Montana's Insurance Information and Privacy
Protection Act (Mont. Code Ann. Sec. 33-19-101 et seq.), which
is very similar to Connecticut's law (see above). The efforts
and careful consideration of the state legislature to adopt
privacy legislation would be lost, if the federal privacy
legislation preempts all state laws relating to confidentiality
of health information.
Ohio
Under Ohio law, information collected by the Ohio Health
Care Data Center must be kept confidential, and may only be
released in aggregate statistical form. (Ohio Rev. Code Ann.
Sec. 3729.46(B)). The Director of Health, employees of the
Department of Health including employees of the data center,
and any person or governmental entity under contract with the
director shall keep confidential any information collected that
identifies an individual, including information pertaining to
medical history, genetic information, and medical or
psychological diagnosis, prognosis, and treatment. Theses
persons and entities shall not release such information without
the individual's consent, except in summary or statistical form
with the prior written permission of the Director or as
necessary for the Director to perform his duties. This state
law would be preempted by a federal privacy law that totally
preempted state law or did not include this type of law as an
exception to federal preemption. The state law only allows
release of information in summary form without identification
of the individual, but this same information risks being
released as personally identifiable information under the
federal legislation. The federal legislation would end up
unprotecting this information that is currently protected under
state law.
Vermont
Vermont, like some other states, has a cancer registry. (18
V.S.A. Sec. Sec. 154, 155, 156). The Vermont statutes require
the Vermont Health Commissioner to keep confidential all
information reported to the cancer registry, with exceptions
for the exchange of confidential information with other states'
cancer registries, federal cancer control agencies and health
researchers under specified conditions. The provisions of these
state laws would arguably be preempted by a federal privacy law
that totally preempted state law or did not include state
cancer registry laws as an exception to federal preemption.
Presumably, a federal privacy law would allow the Vermont
Health Commissioner to disclose protected health information in
situations not authorized by the state's statutes, but allowed
to be disclosed without authorization under the federal bills'
public health or research provisions.
These examples should not be construed as a definitive
legal analysis of the relationship between these state laws and
the federal bills. The comments are not based on an extensive
review of all relevant state laws that might affect the
ultimate conclusion about the interaction of the federal bills
and the states' laws. However, the range of state laws relating
to protected health information, and the diversity of their
purposes and of the entities that they affect, are critical
factors for assessing the impact of any federal preemption
language.
B. The Best Approach to Developing a Federal Standard
An argument will be made that the only solution to this
collection of state privacy laws is a total preemption of state
law. However, this ``solution'' is a deceptively easy response
to the various state privacy laws and will most certainly
result in adverse, unintended consequences. The language ``any
State law that relates to matters covered by this Act'' could
preempt literally hundreds of state laws that affect protected
health information.\4\ Many state laws that are seemingly
unrelated to health information on their face affect health
information privacy and could be eliminated by a total
preemption approach without any equivalent federal protection.
Health information or health-related information that is
currently protected will end up unprotected, and states will
not be able to remedy the problem or ``re-protect'' the
information. We offer this perspective not to ``protect our
turf,'' but rather as a caution against unintended consequences
to the consumer. Because of the number and scope of the laws
involved, our concerns are not limited to insurance law. We do
not want Congress to reduce or eliminate any protections
already in place. Preemption of state law is not a workable
solution.
---------------------------------------------------------------------------
\4\ This language is very similar to the preemption language
contained in the Employee Retirement Income Security Act of 1974
(ERISA), which states: ``[T]he provisions of this title...shall
supersede any and all State laws insofar as they may now or hereafter
relate to any employee benefit plana....'' (emphasis added). As this
Committee is well aware, twenty-five years of litigation and numerous
Supreme Court decisions have yet to clarify the scope of the ERISA
preemption language. We would respectfully suggest that a ``relate to''
standard is not a good standard to adopt in federal legislation
regulating the use of health information. Total preemption language
will unintentionally erase important state laws but not provide
equivalent federal protections. This is the unfortunate situation that
has occurred as the result of the preemption language contained in
ERISA.
---------------------------------------------------------------------------
We believe the best approach would be to set a federal
standard that does not preempt state laws that have been
protecting health information for so many years. Up until now,
there has been no federal standard in place, and the states
have been protecting consumers. We understand the desire to
establish a federal floor in this area, but it is not
appropriate to preempt stronger state laws or preempt state
laws that are outside the scope of the federal privacy
legislation. As discussed earlier, the states have enacted
privacy protections for their citizens in a variety of areas.
These citizens should not lose stronger protections for their
health information or lose protections granted by the states in
areas not contemplated by the federal legislation.
In addition, we believe that states should be allowed to
enact stronger privacy protections in the future in response to
innovation in technology and changes in the use of health
information. We believe the best approach would balance the
desire for uniformity with the recognition of the states'
ability to respond quickly and to provide additional
protections to their citizens. States can quickly identify the
impact of any federal privacy law or any changes in technology
or in the use of health information and can efficiently remedy
any adverse situation. We urge Congress not to take a ``broad-
brush'' approach to preemption that would unintentionally take
away protections at the state level, eliminate the states'
ability to remedy unintended consequences that result from
federal privacy legislation, or prevent states from responding
in the future.
Since Congress is certain to set some type of federal
standard, we offer the following language as a suggestion of
how federal privacy legislation may be drafted. This language
sets a federal minimum standard that leaves in place existing
state laws that are at least as protective as the federal
legislation and allows states to enact stronger laws in the
future.
Nothing in this Act shall be construed as preempting,
superseding, or repealing, explicitly or implicitly, any
provision of State law or regulation currently in effect or
enacted in the future that establishes, implements, or
continues in effect any standard or requirement relating to the
privacy of protected health information, if such state laws or
regulations provide protections for the rights of individuals
to the privacy of, and access to, their health information that
are at least as protective of the privacy of protected health
information as those protections provided for under this Act.
Any state laws or regulations governing the privacy of health
information or health-related information that are not
contemplated by this Act, not addressed by this Act, or which
do not directly conflict with this Act, shall not be preempted.
Federal law shall not occupy the field of privacy protection.
The appropriate federal authority shall promulgate regulations
whereby states can measure their laws and regulations against
the federal standard.
We believe this language recognizes the desire for a
federal standard while respecting what the states have already
done.
IV. Scope of the Legislation
In addition to adopting an approach that recognizes the privacy
protections already enacted by the states and that allows states the
flexibility to enact stronger privacy laws in the future, we urge
Congress to draft legislation that specifically outlines the areas that
Congress intends to address. Congress needs to be very specific about
the scope of any federal privacy legislation. This is of particular
concern since the current privacy legislation is silent on many issues
affecting federal and state law. The scope should not be left ambiguous
or left to the courts to decide. We believe it would be better for the
protection of consumers' health information if Congress would specify
what is addressed by the federal legislation as opposed to attempting
to list all of the state laws that are exempt from the federal
legislation.
All of the current federal bills contain specific exceptions to the
federal preemption language for certain state laws. Reviewing all of
the bills, these exceptions include state laws that: (1) provide for
the reporting of vital statistics such as birth or death information;
(2) require the reporting of abuse or neglect information about any
individual; (3) regulate the disclosure or reporting of information
concerning an individual's mental health; (4) relate to public or
mental health and prevent or otherwise restrict disclosure of
information otherwise permissible under the federal legislation; (5)
govern a minor's rights to access protected health information or
health care services; (6) relate to the disclosure of protected health
information or any other information about a minor to a parent or
guardian of such minor; (7) authorize the collecting, analysis, or
dissemination of information from an entity for the purpose of
developing use, cost effectiveness, performance, or quality data; and
(8) concern a privilege of a witness or person in state court.
Although each of the exceptions is appropriate and the list
represents a good start at enumerating the specific categories of state
laws that should not be preempted, these specific exceptions to the
preemption language do not alleviate our concerns. There are other
state laws that do not fit into any of the explicit categories and that
would therefore be preempted by the broad scope of the general
preemption language. In addition, not all of these specified exceptions
are included in each of the bills. We mention this to underscore the
critical importance of clearly defining the scope of what the federal
legislation is addressing and the applicability of any specific privacy
standard or exception. We believe it wiser and easier to define what
types of health information and what state laws are within the scope of
the federal legislation, rather than what types of health information
and what state laws are outside of the scope of the federal
legislation.
In addition, we urge Congress to outline a way in the federal
privacy legislation for the states to measure their laws against any
federal standard and to provide options for states to meet those
requirements. In HIPAA, Congress gave the states three options in
meeting the requirements of that legislation. Similar guidelines are
needed in the privacy legislation. States need to be able to judge
whether their state laws are stronger than the federal law in order to
determine whether they need to take further action to revise their
laws.
V. Enforcement
Finally, we strongly caution Congress against enacting legislation
that would preempt state laws, because we have several concerns about
the enforcement of any federal privacy law. First, while all of the
federal bills include criminal and civil sanctions and some of the
bills allow a private right of action, we are concerned about the level
of penalties. All of the federal bills include criminal sanctions for
those who ``knowingly and intentionally'' disclose protected health
information; however, under such a strict standard, it is unlikely that
very many prosecutions will take place at the federal level. The
federal bills also impose civil sanctions, but the maximum penalty is
only $100,000 for violations occurring so frequently as to be
considered a business practice. For a multi-million dollar company,
$100,000 can be written off as a business expense. Given the lucrative
market for the sale of individually identifiable health information,
such an expense could be considered a minor inconvenience.
The states possess a more effective enforcement tool than just
monetary penalties. Insurers and other entities, such as hospitals and
providers who hold protected health information, are licensed by the
state. For repeated violations, the appropriate state agency can revoke
the entity's license to do business in the state. This type of penalty
forces the entity involved to change its business practices to conform
to the law. Total preemption of state law could eliminate this
enforcement mechanism.
Second, we also have concerns regarding the federal government's
ability to conduct day-to-day oversight and enforcement of these laws.
Our internal and informal surveys have shown that states get very few
complaints from individuals about inappropriate disclosures of their
protected health information. Consumers generally are not aware when a
company releases their information. Instead the state agency overseeing
that entity uncovers the violation. State insurance departments employ
examiners who conduct on-site reviews of insurance companies' files.
When a violation is found, it can be corrected immediately. Unless the
federal government is prepared to duplicate this system, states should
not be preempted from enforcing their own laws.
In addition, state insurance departments offer consumers a place to
register their complaints. Those consumers who believe their rights may
have been violated can call their state insurance departments and talk
with someone about their concerns and have their concerns investigated.
We do not believe that this degree of interaction and involvement will
exist at the federal level. When a consumer believes his or her rights
may have been violated under the new federal law, who in the federal
government will that individual call? States already have an
enforcement structure in place. This is a structure that should be
built upon not preempted.
VI. Conclusion
Establishing standards to protect the collection, use, and
disclosure of health information is a very important undertaking. The
growth of managed care, the increasing use of electronic information,
and the advances in medical science and communications technology have
dramatically increased both the availability and the importance of
health information. The efficient exchange of health information will
save thousands of lives. The information is critical for measuring and
analyzing the quality and cost effectiveness of the health care
provided to consumers. Consumer benefits from advances in health
information are vast. However, the potential for misuse of this
information is also vast. The information itself has become a valuable
product that can be sold for significant amounts of money, and the
consequences of unauthorized disclosure of health information can be
potentially damaging to individuals' lives. The opportunities to
exploit available health information will grow in number and value as
technology and medical science advance.
As Members of Congress address this critical topic, we would urge
you to recognize the importance of existing state laws addressing the
use of health information in many contexts. Congress should be aware of
the complexity of implementing federal standards without inadvertently
displacing important provisions of state law. We urge Congress not to
take a ``broad-brush'' approach to preemption that would
unintentionally take away protections at the state level, eliminate
states' ability to remedy unintended consequences that result from
federal privacy legislation, or prevent states from responding to
future changes in technology or changes in the use of health
information. The scope of the preemption is a critical issue, and if
not carefully constructed it could lead to unintended consequences. We
urge you to recognize the impact of any privacy legislation on federal
and state laws as you debate this issue. The members of the NAIC would
be happy to work with the Members of Congress in this area. Thank you.
[An attachment is being retained in the Committee files.]
Statement of Margo P. Goldman, MD, and Peter Kane, MSW, LCSW, BCD,
National Coalition for Patient Rights, Lexington, MA
Chairman Thomas and members of the Committee. Thank you for
the opportunity to submit written testimony on behalf of the
National Coalition for Patient Rights (National CPR) about
protecting the privacy and confidentiality of health
information.
First, we appreciate the Chair's stated commitment to
protecting the confidentiality and security of our health
information. We agree that these principles are critical to the
delivery of quality health care. A patient knowing that his
clinician will preserve his privacy and maintain the
confidentiality of his medical records is the first pillar to
constructing a reliable, efficient, and first-rate health care
system. As stated in National CPR's recently published White
Paper (included as an attachment), ``the primary purpose for
collecting personal medical information from a patient is for
clinical diagnosis and treatment of that patient.
Fundamentally, this is the reason a patient confides
information to a physician or other health care provider in the
first place.'' (P2) Such communication frequently occurs when a
patient is sick, and therefore, vulnerable. It is done with the
expectation originally set forth hundreds of years ago in the
Hippocratic Oath--that one's health care provider will not
disclose what they have learned about the patient unless the
patient agrees for them to do so. This is the basis of trust in
the doctor patient relationship.
Unfortunately, patients can no longer trust that their most
personal information will remain private. The state of affairs
is in critical condition. First, rapidly advancing information
technology has created a literal gold mine of medical records.
And the feeding frenzy is intensifying. In 1998, CVS and Giant
Foods sold prescription data to a Woburn Massachusetts
marketing firm in order to promote products. Patients learned
of this when they received mail solicitations, specific for
their medical conditions. Second, the war against fraud and
abuse has led to a virtual assault of patients' privacy.
Because HCFA mandated random audits to detect fraud, local
Medicare carriers were demanding copies of patient records,
including psychotherapy notes, as a condition of processing
claims. Finally, as health insurers garner their efforts to
contain costs by managing care, more and more sensitive
information is demanded and collected. A case in point is the
``Erectile Dysfunction Medical Necessity Treatment'' form that
a local health insurer required from all physicians prescribing
medication for impotence. (Copy enclosed) This is but one
particularly glaring example where patients are asked to choose
between receiving treatments for the most personal of issues
and their privacy.
And citizens are reacting to this: A survey recently
conducted by the California Healthcare Foundation found 15% of
adults said they have done something ``out of the ordinary'' to
keep medical information confidential. This includes self-
paying instead of using one's health insurance, avoiding or
delaying needed care, giving inaccurate or partial information
about medical histories, and asking doctors to not write
something down in the record. (California HealthCare
Foundation, 1999)
If this trend is allowed to continue, quality health care
will be impossible and we will all suffer. Physicians and other
health care providers will diagnose and treat patients based on
inaccurate or incomplete data. If patients delay or avoid
needed care, they will ultimately present for treatment when
they are sicker, and less readily (and more expensively)
treated. Doctors will increasingly be forced to rely on their
memories, rather than the medical record, because of patients'
or their own reluctance to record information that may come
back to haunt the patient. And sorely necessary biomedical
research will be based on tainted data, unless we can ensure
that patients trust the system enough to communicate honestly
and openly with caregivers.
National CPR was founded over five years ago in response to
this grave health care crisis. As an organization whose sole
mission has been the patient-centered protection of medical
privacy and confidentiality, we have developed policy
recommendations. Congress is quickly approaching the August 21
HIPAA deadline to enact legislation; we urge you to use our
recommendations (contained in the White Paper) as a basis for
sound medical privacy policy. The full White Paper is included
as an attachment to our testimony. The recommendations are as
follows:
Recommendation 1: Medical records should be maintained as
confidential and private for the purpose of the clinical
benefits of the patient. Disclosure of medical records outside
the context of clinical care requires the consent of the
patient.
Recommendation 2: The right of patients to determine what
information in their medical records is shared with other
providers and other institutions and agencies should be
recognized both by law and by institutional policy. Patients
who wish not to disclose medical information to other health
care providers that may be important in their medical care
should be counseled about the risks of nondisclosure and sign
an acknowledgment of their being warned.
Recommendation 3: Patients should have the legal right to
review and copy their medical records. Patient access to
medical records should be facilitated by providers, and charges
to patients limited to the cost of copying. Institutions should
develop clear policies and procedures for patients to correct
and amend errors in the medical record. Patients should have
the right to review the audit trails of who have accessed their
medical records and for what purposes.
Recommendation 4: Third party payers of medical services
should be required to specify in advance the medical
information they require to assess claims and manage medical
care. Public notice should be made to patients of the kinds of
medical information that will be requested from their
providers. Physician notes should not routinely be disclosed to
third party payers, and, consistent with the Supreme Court's
decision in Jaffe v. Redmond, psychotherapist notes should
never be disclosed to third party payers. Patient consent
should be required before medical records are transferred to or
patients are enrolled in disease management programs. Disease
management programs should be based on sound clinical research
and arranged through the patient's own health care provider.
Recommendation 5: Third party payers should be held
accountable to the same standards of privacy and
confidentiality as are medical care providers. Third party
payers should be limited in their use of medical records to the
terms specified in the patient consent to release medical
records. No disclosure by third party payers to any other party
may be made without the written freely given consent of the
patient, i.e., participation in the health plan or other
benefits should not be contingent upon patient consent to
further disclosures. Patients of third party medical payers
should have the right to review and copy the medical records
held by these organizations, and to review the logs of whom has
had access to their records and for what purposes. Third party
payers should establish procedures for patients to correct
errors in their medical information.
Recommendation 6: The psychotherapeutic relationship is of
such sensitivity as to require special recognition as a domain
of absolute privacy. Records and notes of psychotherapy
sessions should always remain confidential and third parties
should be prohibited by law from demanding their disclosure for
any reason. For reimbursement purposes, only the minimal amount
of information should be disclosed to process claims.
Recommendation 7: Research involving medical records must
either be conducted with the freely given informed consent of
patients, or with blanket consent which delegates to a Medical
Records Review Board (MRRB) the authority to waive further
consent. The MRRB should be constituted by at least a majority
of community members (individuals not employed by or otherwise
affiliated with the institution) in addition to appropriate
scientific, medical and allied health personnel and
administered by the Medical Records Trustee. MRRB decisions not
to grant a waiver of informed consent should be final. The MRRB
should insure that the confidentiality of patient information
is protected as it passes through a research protocol, that the
information is not used for other purposes without explicit
MRRB approval, and that the purposes of research will not be
reasonably objectionable to the patient populations involved.
Recommendation 8: All health services research that relies
on personal medical information should be reviewed, approved,
and overseen by an institutional Medical Records Review Board,
with the Medical Records Trustee being the main point of
contact for both patients seeking information about these
research/evaluation projects, and for those people conducting
the research and/or evaluation projects.
Recommendation 9: Each clinical institution maintaining
medical records has the responsibility to safeguard their
confidentiality by minimizing access to medical records to
those individuals whose ``need to know'' is of clinical benefit
to the patient or is otherwise consented to by the patient.
Institutions should employ encryption schemes and password
protection, and log each access to or modification of the
medical record (e.g., computerized audit trails). Institutions
should develop auditing programs to ensure that access to and
use of medical records is appropriate and take appropriate
punitive measures when it is not. Patients should have the
right to limit access to particularly sensitive information.
Recommendation 10: Each health care institution maintaining
medical records or medical information should designate a
``Medical Records Trustee'' responsible for promulgating and
enforcing institutional confidentiality and privacy policies,
and ensuring compliance with the law. The Medical Records
Trustee shall be the final responsible authority for granting
any and all access to medical records and information within
the institution. The Medical Records Trustee should also be
responsible for making notification to patients and the general
public of the institution's policies for protecting patient
privacy and confidentiality of their medical records.
Recommendation 11: Public health investigations in which an
imminent danger to the health of individuals or communities is
at stake, should be permitted to access private medical records
as necessary and as provided for under current law. The consent
of patients is not necessary, but patients should be notified
by their providers that their records may be opened to public
health authorities. When providers make legally mandated
disclosures to public health authorities they should be
required to inform the patient of this requirement at the time
the condition is discovered.
Recommendation 12: In general, employers should not have
access to clinical medical records. These records should be
segregated from all other personnel-related information, and be
used only in the benefits determination process (and only where
the employer is a self-insurer). Employers should be barred
from using this information for employment, promotion and other
personnel decisions, and provide notification to all employees
and prospective employees of what information they collect and
for what purposes. Employers with access to medical records
should be barred from disclosing this information to other
parties, and should maintain audit trails of who has accessed
the records and for what purposes, and made available to the
employees.
Recommendation 13: Health care institutions maintaining
medical records should notify the public and patients
individually of the offices and functions which have access to
their medical records. Institutions should also prominently
display their policies on maintaining confidentiality of
medical records. The name, address, and phone number of the
Medical Records Trustee should be provided to all patients.
Recommendation 14: Proposals to create systems designed to
link private medical information or otherwise collate medical
record information, such as the Unique Patient Identifier or
the Master Patient Index, should not be implemented without
explicit patient informed consent. Patients should always have
the freedom to determine for themselves what medical
information may be collated together and for what purposes.
Recommendation 15: Law enforcement access to medical
records should be limited to court order. When records are thus
obtained, they should contain only the minimal amount of
information necessary to fulfill the purpose for which they
were sought. Moreover, law enforcement officials should
maintain the confidentiality of the information they obtain,
and should only allow the least number of people access as is
absolutely necessary. Under no circumstances should personal
medical records become part of an open court record, where the
patients are not parties to the court proceeding. In the
limited case of health care fraud investigations, anonymous
records should be used to assess patterns of fraudulent
billing, with identified information used only where specific
instances of fraud are suspected.
Recommendation 16: The buying and selling of medical
records or information derived from them, and the use of these
records for any marketing purposes, including disease
management programs, without the freely given informed consent
of the patient, should be prohibited by law and institutional
policy.
Before we conclude, we will also comment about Federal pre-
emption of state and common law privacy protection. As noted in
the White paper and elsewhere, a number of states have passed
(or are considering) medical privacy legislation that is
stronger than some of the Federal proposals. In addition, there
exist a host of state common law protections and condition-
specific statutes (i.e. HIV, mental health, substance abuse,
etc.) to ensure information privacy. The convenience of inter-
state information sharing that would be aided by a Federal
ceiling of protection does not justify trumping individual and
states' rights. Furthermore, ``there is no precedent federally
for pre-empting state statutory and/or common laws for
information-based industries on this sort of scale.''(White
Paper, p7) National CPR recognizes this is a complicated issue
due to the rapidly changing technologies. Because of this, it
is critical for states to have legislative flexibility and
leeway to search out the best methods of safeguarding their own
citizens. Finally, the HIPAA mandate for medical privacy
legislation specified that Federal legislation NOT be
preemptive. In keeping with Congress' 1996 requirement for
Federal law protecting medical information, National CPR
strongly urges you to create a Federal floor, not a ceiling, of
protection.
Once again, we want to thank Chairman Thomas and the
Committee for the opportunity to submit testimony. After over
five years of working on medical information privacy, we at
National CPR are keenly aware of the complicated nature of the
issue and the debate. We gladly offer all possible assistance
to the Committee and your staff as you work through this bill.
In conclusion, if Congress fails to enact true, patient-
centered medical privacy protection, the quality and integrity
of our entire health care system will be in danger. Ann
Cavoukian, the Privacy and Information Commissioner in Canada
captured this:
``Confidentiality is to medical records, what sterile
procedures are to surgery. Having one without the other is not
only undesirable, but potentially bad for your health.'' (May
1996, Ontario, Canada)
[Attachments are being retained in the Committee files.]
National Conference of
State Legislatures
July 19, 1999
The Honorable William M. Thomas
Chairman, Health Subcommittee
Committee on Ways and Means
U.S. House of Representatives
Washington, DC. 20515
The Honorable Fortney Stark
Ranking Member, Health Subcommittee
Committee on Ways and Means
U.S. House of Representatives
Washington, DC. 20515
Dear Representative Thomas and Representative Stark:
On behalf on the National Conference of State Legislatures (NCSL),
I would like to take this opportunity to comment on proposals regarding
medical records confidentiality.
NCSL firmly believes that states should regulate insurance. We
oppose preemption of state law, but we understand the desire to
establish a minimum standard in this area given that health information
is transmitted across state and national boundaries. We also realize
that Congress must enact privacy legislation by August 21, 1999, as set
forth by the Health Insurance Portability and Accountability Act of
1996 (HIPAA), and we recognize that all of the current approaches set
some type of federal standard. Given these factors, we believe that the
privacy of health information is one of the few areas where it is
appropriate for the federal government to set a minimum standard.
Federal medical records confidentiality legislation should provide
every American with a basic set or rights regarding their health
information. These federal standards, in concert with state law, should
be cumulative, providing the maximum protection for our citizens. Our
mutual goal should be to assure that not one individual's health
information is more vulnerable under federal law, than it was without
it.
Preemption of State Law
Federal legislation should establish basic consumer rights and
should only preempt state laws that are less protective than the
federal standard. Unfortunately many of the proposals pending before
Congress take a different approach.
NCSL is particularly concerned about proposals that would preempt
all state laws ``relating to'' medical records privacy. The universe of
state laws relating to medical records confidentiality is extremely
large and is spread across a state's legal code. For example, state
laws regarding medical records confidentiality can be found in the
sections of a state's code regarding: health, mental health, education,
juvenile justice, criminal code, civil procedure, family law, labor and
employment law.
While no compendium of state confidentiality laws exists, The
Health Privacy Project at Georgetown University, part of the Institute
for Health Care Research and Policy has just completed a summary of
major state statutes related to medical records privacy. It shows that
state law in this area is extensive and at a level of detail that is
not contemplated in most of the federal proposals. A blanket preemption
of state law is virtually the same as throwing the baby out with the
bath water.
Should Congress seek to pass federal medical record confidentiality
legislation, NCSL firmly believes it should: (1) grandfather existing
state confidentiality laws; (2) narrowly and specifically define the
scope of the preemption, preserving issues not addressed in the federal
proposal for state action; and (3) permit and encourage states to enact
legislation that provides additional protections. If states are
precluded in some general way from taking action in specific areas,
there must be a mechanism for a state legislature to act if federal
legislation adversely impacts the citizens in the state.
Some proposals attempt to address the preemption issue through the
inclusion of state legislative ``carve outs.'' This approach attempts
to identify all the areas that states would be permitted to continue to
enact legislation. While well-intended, there is no way for states to
know the full extent and impact of the preemption and carve-outs until
the federal law has been implemented. NCSL and the National Association
of Insurance Commissioners (NAIC) recommend that states be allowed to
continue to legislate and regulate in any area that is not specifically
addressed in the federal legislation. Below is language jointly
supported by NCSL and NAIC:
Nothing in this Act shall be construed as preempting, superseding,
or repealing, explicitly or implicitly, any provision of state law or
regulation currently in effect or enacted in the future that
establishes, implements, or continues in effect, any standard or
requirement relating to the privacy of protected health information.,
if such laws or regulations provide protections for the rights of
individuals to the privacy of, and access to, their health information
that are at least as protective of the privacy of protected health
information as those protections provided for under this Act. Any state
laws or regulations governing the privacy of health information or
health-related information that are not contemplated by this Act, shall
not be preempted. Federal law shall not occupy the field of privacy
protection. The appropriate federal authority shall promulgate
regulations whereby states can measure their laws and regulations
against the federal standard.
Current State Legislative Activity
Since January 1999, 26 states have enacted laws regarding medical
records confidentiality. Montana enacted comprehensive legislation
addressing the activities of insurers and North Dakota enacted
legislation that established comprehensive public health
confidentiality standards. After years of debate, Hawaii enacted a
comprehensive law that sets standards for the use and disclosure of
both public and private health information. Most states enacted
legislation building on existing state law or legislation focused on a
specific issue. Six laws, addressing a wide variety of medical records
privacy concerns, were enacted in Virginia during the 1999 legislative
session. Other states that enacted legislation this year are: Arkansas,
Colorado, Connecticut, Georgia, Idaho, Indiana, Iowa, Louisiana, Maine,
Mississippi, Nebraska, Nevada, New Mexico, Ohio, Oklahoma, South
Carolina, South Dakota, Tennessee, Texas, Utah, West Virginia and
Wyoming.
Several of these new laws address issues that are not addressed in
many of the federal proposals. For example, many states have laws
establishing strict confidentiality standards for medical information
in the possession of employers. These laws would make records from
employee assistance programs (EAP) and workplace drug-testing results,
protected health care information, subject to strict disclosure and
reporting requirements. Several states have laws that set limits on how
much a health care provider can charge an individual to make copies of
their medical records. These laws, designed to help assure access,
regardless of income, would be preempted under some proposals. These
are but a few examples that illustrate both the breadth and complexity
of the preemption issue.
I thank you for this opportunity to share the perspective of NCSL
on this very important issue. Enclosed for your information is a copy
of the NCSL policy, ``Principles for Federal Health Insurance Reform.''
I look forward to working with you and your colleagues over the next
several months to develop a consensus proposal that will provide basic
medical records privacy protections for all.
Sincerely,
Kemp Hannon
New York Senate
Chair, NCSL Health Committee
cc: Representative Bill Archer
Representative Charles B. Rangel
Members, House Ways and Means Subcommittee on Health
OFFICIAL POLICY
Insurance Regulation
States should regulate insurance and should
continue to set and enforce solvency standards and to provide
oversight on insurance matters.
Modifications to the Employee Retirement Income
Security Act of 1974 (ERISA) that would eliminate states'
preemption or strengthen the regulatory authority of the
states, including consumer access to state remedies, should be
adopted. Conversely, NCSL opposes initiatives that would expand
the reach of ERISA.
Absent changes that would permit states to
regulate ERISA plans, Congress should impose requirements on
ERISA plans that closely track state legislative and regulatory
initiatives. In addition, federal remedies, that more closely
resemble remedies available at the state level, should be
adopted for consumers in ERISA plans.
Federal legislation that establishes uniform
standards, should establish a floor, but not a ceiling.
When federal insurance reforms are adopted, the
consumer should easily understand the implementation process
and a massive community education effort should be an integral
part of program implementation.
Federal reforms, that require state enforcement,
should be funded by the federal government.
Any federal legislation requiring state action to
comply with the law should allow a reasonable period of time
for state legislatures to adequately debate and enact
legislation. Where states already have similar legislation in
place, a process for declaring ``substantial compliance''
should be developed.
Medical Records Privacy
Scope of Law
No patient identifiable medical information may be
released without written and oral informed consent of the
patient, unless otherwise exempted.
A federal privacy statute should define a range of
health care conditions and services and protect patient
identifiable information, including demographic information,
collected during the health care process.
A federal privacy statute also should define
``information'' to include records held in whatever form
possible--paper, electronic, or otherwise.
Strong protections for individuals from the
inappropriate disclosure of their medical records should be
established.
Anyone who provides or pays for healthcare or who
receives health information from a provider, payer, or an
individual should be required to conform to the provisions of
the law.
Health care providers that do not have direct
relationships with the patient must also abide by the same
standards.
A payer should not be required to provide a benefit or
commence or continue payment of a claim in the absence of
protected health information, as set forth in each state's
statutes, to support or deny the benefit or claim.
Security
Information should not be used or given out unless
either the patient authorizes it or there is a clear legal
basis, under state or federal law, for doing so.
Consumer Rights
Individuals should have the right to:
Find out what information is in their medical
record; and
How the information is used.
Practices and procedures must be established that
would:
Require a written explanation from insurers or
health care professionals detailing who has access to an
individual's information;
Require insurers or health care professionals to
tell individuals how that information is kept;
Inform individuals how they can restrict or limit
access to their medical records;
Inform individuals how they can authorize
disclosures or revoke such authorizations; and
Inform individuals of their rights should an
improper disclosure occur.
In general, individuals should be permitted to
inspect and copy information from their medical record.
Finally, a process should be developed for
patients to seek corrections or amendments to their health
information to resolve situations in which coding errors cause
patients to be charged for procedures they never receive or to
be on record as having conditions or medical histories that are
inaccurate.
Accountability
Severe penalties should be imposed on individuals
who knowingly disclose medical records improperly, or who
misrepresent themselves to obtain health information.
Civil monetary and/or criminal penalties should be
imposed on individuals who have a demonstrated pattern or
practice of unauthorized disclosure.
Any individual whose rights under the federal
privacy law have been violated should be permitted to bring a
legal action for actual damages and equitable relief. If the
violation was done knowingly, attorney's fees and punitive
damages should be available.
Public Health
Under certain limited circumstances, health care
professionals, payers, and those receiving information from
them should be permitted to disclose health information without
patient authorization to public health authorities for disease
reporting, public health investigation, or intervention, as
required by state or federal law.
Research
Research protocols and confidentiality standards
should be continued and strengthened.
Law Enforcement
Law enforcement representatives should be required
to have a court order to obtain information from an
individual's medical record.
Preemption
Federal legislation should provide every American
with a basic set of rights with respect to health information;
however, confidentiality protections provided in state and
federal law should be cumulative, and the federal legislation
should provide a floor.
Federal law should only preempt state laws that
are less protective.
Administrative Simplification
Administrative simplification is a key component in
efforts to reduce health care costs and to improve quality of care.
Simplification initiatives should include:
the development of uniform claims forms;
the establishment and continued refinement of uniform
codes;
electronic claims processing and billing; and
computerized medical records and ``smart cards'' for
medical records and medical history.
Federal and state governments should share information;
however, confidentiality of medical records and information must be
protected.
Under the provisions of the Health Insurance Portability
and Accountability Act of 1996, federal law supercedes state law,
except when the Secretary determines that the state law is necessary:
To prevent fraud and abuse,
To ensure the appropriate state regulation of insurance or
health plans,
For addressing controlled substances, or for other
purposes.
NCSL supports a broad interpretation of this provision that would
result in limited preemption of state laws.
July 1998
Kansas City, MO 64111
22 July 1999
A.L. Singleton
Chief of Staff
Committee on Ways and Means
U.S. House of Representatives
1102 Longworth House Office Building
Washington, DC. 20515
Dear Mr. Singleton:
Confidentiality of my patient records is very important to me.
Thank you for giving me the opportunity to lend my comments to the July
20th hearing on medical confidentiality.
Patients and doctors have a special relationship requiring the
divulging of confidential information that sometimes even the best of
friends or family members do not share. There must be trust between the
doctor and patient to allow for sharing what could be damaging
information in order to allow timely and appropriate medical care.
For the integrity of this relationship and the health care system
in general it is important that patients have informed voluntary
consent prior to the sharing of information. The bills before the House
and Senate do not protect this right. Rather they would create a
federal law allowing researchers, government agencies, law enforcement,
and managed care organizations to enter my medical records at will.
They would also limit the right of my state legislators to enact
stronger privacy legislation than Congress enacts.
As an American, I am entitled to certain rights, including the
right of protection against unlawful search and seizure by others of my
personal property. This includes personal information about myself.
Also, the Nuremberg Code protects me against becoming an unwilling
research subject.
Unconsented access to my medical records will not only violate my
Constitutional rights as a citizen, it will leave me vulnerable to
employment, insurance, and medical discrimination. I urge you to truly
protect my confidentiality by assuring patient consent prior to all
medical record access.
Sincerely,
Elizabeth S. Smock, M.A.
Statement of Randel K. Johnson, Vice President of Labor and Employee
Benefits, U.S. Chamber of Commerce
Mr. Chairman and Members of the Committee, good morning. I
am Randel Johnson, Vice President, Labor and Employee Benefits,
U.S. Chamber of Commerce. The U.S. Chamber of Commerce is the
world's largest business federation representing more than
three million businesses and organizations of every size,
sector and region.
Mr. Chairman, I have been asked to address the narrow issue
of whether or not a private cause of action in court should be
authorized under the legislation before you today, the
``Medical Information and Research Enhancement Act of 1999.''
We believe the only reasonable answer to this question is
``no'' and the Chamber would strongly oppose inclusion of a new
individual right to sue in addition to the severe civil and
criminal penalties already in the legislation. Contrary to the
assumptions of some, it is not true that a new right to sue
must, or should be, created each time Congress creates a new
substantive legal right or that such a right is necessary for
effective enforcement. Furthermore, experience would suggest
that--given the inherent negatives associated with court
litigation--Congress reserve creation of new private causes of
action in court for only those situations where there has been
a demonstrated and well-documented problem with existing
enforcement mechanisms. This threshold criteria has not been
met here.
It should be emphasized that whatever is enacted will be an
important, but complicated new federal law. Before we subject
individuals and organizations to the expense and uncertainty of
private litigation, we need to allow time for any uncertainties
in the law to be clarified. Hopefully, much of this will be
accomplished through administrative regulations that will flesh
out the many rights, responsibilities and protections in the
legislation, a far preferable course than the vagaries, expense
and inconsistencies of the court system developing policy on a
case by case basis.
Since the question of whether a private cause of action is
necessary turns on whether or not the existing legislation has
adequate provisions to deter violations of its provisions, we
need to look carefully at what is in the legislation now. I
urge the Members to refer to the actual text of the legislation
in this regard because these existing sanctions are actually
quite severe. First, let's review the criminal penalties under
proposed Section 2801 ``Wrongful Disclosure of Protected Health
Information.'' Under this section, a ``person that knowingly
and intentionally'' \1\ discloses protected health information
shall be fined up to $50,000, imprisoned not more than one year
or both; and if the offense is committed under ``false
pretenses,'' be fined not more than $100,000, imprisoned up to
five years or both. And if the offense is committed with ``the
intent to sell, transfer, or use protected health information
for monetary gain or malicious harm'' the person could be fined
up to $250,000, and imprisoned not more than 10 years or both.
All of these penalties and prison sentences could be doubled
under certain circumstances. I also note that the ``person''
subject to these sanctions apparently could be anybody employed
by, or with any connection to, the health information--from a
clerical worker on up; hence the sweep of these provisions is
quite broad.
---------------------------------------------------------------------------
\1\ We urge the committee to define this concept to encompass only
knowing and intentional violations of the law in the sense that the
individual knew his or her conduct violated the Act and intended harm.
---------------------------------------------------------------------------
Now let's turn to the civil penalties under new Section
311. Under this section, ``a person'' who the Secretary of
Health and Human Services determines has ``substantially and
materially failed to comply with this Act'' shall be subject to
up to $500 for each violation and up to $5,000 for multiple
violations arising from failure to comply with Title I of the
act; and, where a violation relates to Title II, a civil
penalty of up to $10,000 for each violation, and up to $50,000
in the aggregate for multiple violations, may be imposed. A
$100,000 penalty is provided for violations which constitute a
general business practice. This legislation also sets out
detailed procedures for consideration of penalties under
Section 312. The Secretary is empowered to seek injunctive
relief.
To state the obvious, I can assure you that any entity
covered by this legislation will take these civil and criminal
penalties quite seriously, and I have to ask if there is anyone
in this room today who would view these possible jail terms and
monetary penalties lightly if they were subject to this law--I
doubt it. I would ask you for one moment to put yourself in the
place of an individual within a business handling health care
information--of whatever size--and ask yourself that question.
To help demonstrate the extreme nature of these criminal
and civil penalties, it might be useful to refer, for the
purposes of comparison, to a few employment laws. Under the
Occupational Safety and Health Act willful or repeat violations
can be penalized by monetary penalties of between $5,000 and
$70,000; a serious violation up to $7,000; a non-serious
violation up to $7,000, and for failure to correct a violation,
a civil penalty of not more than $7,000. With regard to
criminal penalties, a willful violation causing an employee's
death can be punished by a fine of not more than $10,000 and
imprisonment for not more than 6 months or both, except that if
the violation is committed after a prior conviction, punishment
can be doubled.\2\
---------------------------------------------------------------------------
\2\ By operation of the 1984 Comprehensive Crime Control and
Criminal Fine Collection Act, which standardized penalties and
sentences for federal offenses, willful violations of the OSH Act
resulting in a loss of human life are punishable by fines up to
$250,000 for individuals and $500,000 for organizations.
---------------------------------------------------------------------------
The Family and Medical Leave Act and Title VII of the 1964
Civil Rights Act contain no criminal penalties and only a civil
fine of $100 for a willful failure to post a notice of FMLA and
Title VII rights. The Age Discrimination in Employment Act has
a criminal penalty of up to $500 or imprisonment of up to 1
year for interfering with an EEOC agent. Similarly, the
National Labor Relations Act, protecting the rights of
employees to unionize, provides only for a fine of not more
than $5,000 or imprisonment for one year for interfering with a
Board agent. The Fair Labor Standards Act contains fines of not
more than $10,000 and imprisonment at up to 6 months for
certain violations.
As you can see, the proposed civil and criminal penalties
of the legislation before you are quite severe in comparison to
other laws--laws which also protect important rights.
I led my testimony with a discussion on civil and criminal
penalties to dispel any doubt that this legislation somehow
provides an invitation for non-compliance or that such
penalties are not otherwise adequate to deter violation.
Nothing could be further from the truth. In this context, I
turn to the question of the need for a private cause of action.
Contrary to what seems to be a popular conception, many
laws rely exclusively on government enforcement for protection
of important substantive rights, as does this legislation. In
the labor area alone these include: The Davis Bacon Act
(requires payment of prevailing wages on government contracts
for construction), the Service Contract Act (requires payment
of prevailing wages on government services contracts), the
Walsh-Healey Act (payment of minimum wages and overtime to
employees working on government contracts); Executive Order
11246 (prohibits discrimination by government contractors);
Section 503 of the Rehabilitation Act (prohibits discrimination
by government contractors on the basis of disability), and,
perhaps most notably, the Occupational Safety and Health Act
(protects employee safety and health), the Mine Safety and
Health Act (protects safety and health of miners), and the
National Labor Relations Act (protects the rights of employees
to engage in concerted activities, including unionization.) \3\
---------------------------------------------------------------------------
\3\ Other examples include the Paperwork Reduction Act, Section
17(a) of the Securities Exchange Act (see Touche Ross v. Redington, 442
U.S. 560 (1979)), and the Federal Service Labor Management Relations
Act.
---------------------------------------------------------------------------
Of course some labor statutes (in interest of full
disclosure) do have a private cause of action, typically with
remedies keyed to economic damages, such as lost pay with--in
some instances--a doubling where the violation was willful or
without good faith. (But let me again emphasize that these laws
do not have the severe criminal and civil penalties contained
in the privacy legislation.) An atypical example is Title VII
of the 1964 Civil Rights Act, which was amended in 1991 to
include non-economic damages (capped at various levels), but
only after two years of much contentious debate encompassing
two separate Congresses.
These changes were based on a long record of experience
amassed over some 30 years, which demonstrated that by the
1990's changes were needed. Even with this lengthy
consideration by Congress, the results have not been pretty.
Litigation has exploded--tripling since 1991--with
discrimination cases constituting almost one of every ten cases
in federal court, the second highest number after prisoner
petitions.\4\ That only 5% of cases filed with the Equal
Employment Opportunity Commission are found to have
``reasonable cause'' and 61% ``no reasonable cause,'' tells us
that many of these cases are of questionable validity. I've
also attached for the Members' reference an article entitled,
``Lawsuits Gone Wild,'' February 1998, discussing the plight of
businesses under this surge of litigation. Litigation expenses
alone to defend a case can approach $50,000-$150,000 even
before trial.
---------------------------------------------------------------------------
\4\ See study by Lawyers Committee on Civil Rights under Law, Daily
Labor Report, March 25, 1999. The Americans with Disabilities Act
includes the same remedies as Title VII although it was originally
passed and enacted with only equitable relief. The ADA was premised on
longstanding principles and regulations found under Section 504 of the
1973 Rehabilitation Act. Nevertheless, it, like Title VII since amended
by the Civil Rights Act of 1991, has resulted in considerable
litigation, much of it frivolous. See ``Helping Employers Comply with
the ADA,'' Report of the U.S. Commission on Civil Rights, September
1998, pp. 274-283.
---------------------------------------------------------------------------
Perhaps this isn't surprising given the nature of civil
litigation, but it does emphasize the importance of Congress
carefully deliberating before it authorizes individual civil
litigation as a remedy. Indeed, the fact that private lawsuits
are expensive, blunt enforcement instruments with enormous
transactional costs can hardly be argued. While I do not wish
to debate tort reform here, it may be worthwhile to refer to a
few further facts on this issue:
A Tillinghast-Towers Perrin analysis (Nov. 1995) of the
U.S. tort system found that when viewed as a method of
compensating claimants, the U.S. tort system is highly
inefficient, returning less than 50 cents on the dollar to the
people it is designed to help--and less than 25 cents on the
dollar to compensate for actual economic losses. (Tillinghast-
Towers Perrin, ``Tort Cost Trends: An International
Perspective,'' pp. 4, 8)
The study broke down costs as follows:
Awards for economic loss 24%
Administration 24%
Awards for pain and suffering 22%
Claimants' attorney fees 16%
Defense costs 14%
Hence, even when non-economic ``pain and suffering'' awards are
included, claimants ultimately collected only 46% of the money raised,
the balance going for the high transactional costs of the system.
These conclusions are consistent with a 1985 RAND study which
indicated that plaintiffs in tort lawsuits in state and federal courts
of general jurisdiction received only approximately half of the $29
billion to $36 billion spent in 1985. The cost of litigation consumed
the other half with about 37% going to attorney's fees (pp. v-xi). A
1988 RAND study of wrongful discharge cases in California found that
``total legal fees, including defense billings, sum to over $160,000
per case. The defense and plaintiff lawyer fees represent more than
half of the money changing hands in this litigation.'' (pp. viii, 39-
40) (The range of jury verdicts were from $7,000 to $8 million with an
average of $646,855. pp. vii, 25-27, excluding defense judgements.)
(Average award after post-trial settlement and appellate review was
still $356,033, p. 36)
A March 1998 study by the Public Policy Institute entitled, ``How
Lawsuit Lottery is Distorting Justice and Costing New Yorkers Billions
of Dollars a Year,'' applied the Tillinghast-Tower's analysis for New
York's tort liability system and calculated that liability expenditures
broke out as follows:
$6.57 billion in payments to claimants (including $3.1
billion in pain and suffering awards and only $3.4 billion for actual
economic damages).
$3.4 billion for administrative overhead.
$2 billion for defense costs.
And nearly $2.3 billion for plaintiffs' attorneys.
The study found: ``In sum, more than half of the money extracted
from our consumers, our taxpayers, and our economy by New York's
phenomenally expensive liability system doesn't go to its supposed
beneficiaries'' (p. 26).
And a May 1995 Hudson Briefing Paper, ``The Case for Fundamental
Tort Reform'' noted that:
The U.S. tort system needs to be made far more efficient
and our society far less litigious and far larger shares of tort
payments should go to injured parties rather than to lawyers.
Currently, more than fifty cents of every dollar paid out of the tort
system goes to cover attorneys' fees.
Lawyers monopoly of access to the courts allows them to
impose a 33.33 to 40 percent toll charge on all damage recoveries, even
in cases in which defendants are willing to pay on a rapid no-dispute
basis. Contingency fees, the near-uniform means of compensating tort
claim attorneys, can provide risk free windfall profits to lawyers
while harming defendants, plaintiffs, and the economy as a whole.
The real costs of the nation's tort civil litigation system is
enormous \5\ , and the broader a civil action is in terms of grounds
for liability and damages the more incentive there is for frivolous
litigation--as many lawyers and plaintiffs seek to play the litigation
lottery in front of juries for huge monetary rewards. However, my
primary point here is that simple logic dictates that a system with
such heavy transactional costs should, by definition, be considered as
an option of last resort.
---------------------------------------------------------------------------
\5\ For other overviews of expenses associated with court
litigation, see, generally, The Illinois Tort Reform Act: Illinois'
Landmark Tort Reform: The Sponsor's Explanation, 27 Loy. University of
Chicago L. J. 805, Summer 1996. Also see Symposium: Municipal
Liability: The Impact of Litigation on Municipalities: Total Cost,
Driving Factors, and Cost Containment Mechanisms; 44 Syracuse Law
Review 833, 1993.
---------------------------------------------------------------------------
Of course, I realize that there are those who would argue that a
business need not fear litigation so long as it obeys the law--so a
provision for civil court litigation should only trouble truly bad
actors and not present a problem to others. The only problem with this
argument is that it is patently false. The reality of laws in this
country is that they are invariably complex and, often, simply vague,
with the lines of compliance uncertain and often changing. The Code of
Federal Regulations governing the workplace arena alone covers over
4,000 pages of fine print, and hundreds of court and administrative
decisions provide their own gloss of what the law is, or is not, on any
given day. The Supreme Court handed down three decisions on the
Americans with Disabilities Act just a month ago and two on what
constitutes sexual harassment under Title VII and one on the Age
Discrimination in Employment Act in the last session. Eleven Circuit
Courts of Appeal render their own versions of the law. One treatise on
discrimination law stretches over two volumes and two thousand pages of
analysis with more footnotes, as does another on the National Labor
Relations Act. And these are not atypical examples of one area of the
law. Even enforcement agencies, with all their expertise, cannot give
clear answers as to what is or is not required. (See ``Workplace
Regulation--Information on Selected Employer and Union Practices,'' GAO
Report #94-138)
All of these problems are magnified when it comes to a new law,
such as that before you today, which will, no matter how well drafted,
be subject to much interpretation. Many times there will not be right
or wrong answer and that problem will be heightened if courts across
the country, likely combined with jury trials, are immediately faced
with cases to sort out every nuance--which may very well differ from
jurisdiction to jurisdiction--while the employer is faced with both
uncertain requirements and liability.
In closing, our opposition to inclusion of a private right of
action is premised on the straightforward notions that (1) the civil
and criminal penalties now in the legislation are quite severe and
provide more than adequate deterrence, (2) many laws are adequately
enforced without private causes of actions, and (3) law suits are a
rough, blunt and expensive instrument of justice with many negative
attributes which should only be used where there is a clear track
record demonstrating that the law in question currently has inadequate
enforcement mechanisms--a record which certainly does not exist here.
Should the Congress find that, after passage of this legislation and a
period of enforcement, the business community is ignoring its
responsibilities, it can always revisit the issue and authorize new
enforcement mechanisms.
Thank you.
[Attachments are being retained in Committee files.]
-