President George W. Bush's decision to implement the medical privacy rule of the 1996 Health Insurance Portability and Accountability Act (HIPAA) is historic. Its importance will become even clearer in the next few years as we see assaults on its protections.
Bush's decision is a huge victory for the future of psychodynamic and psychoanalytic treatment. It means that the strong privacy protections in the HIPAA preamble, the new protections for psychotherapy notes, and patients' rights to consent will now have the full effect of law. Without these new privacy protections in the HIPAA, effective mental health treatment in the United States — not to mention psychoanalysis — was in dire trouble.
The HIPAA has a broader impact for the future of our field than the Supreme Court's decision in Jaffee v. Redmond. Now every person in our nation can have private psychotherapy communications, and every clinical setting is safe from intrusions. Jaffee v. Redmond protected psychotherapy communications only at the federal level and only in judicial settings. The broad scope of the HIPAA, which applies to every state and federal setting, every office, hospital, and clinic, not just federal courts, is an incredible accomplishment.
The decision to implement the HIPAA is also far more critical than achieving parity to the future of good mental health care. Parity, or access to treatment, is useless if no one wants the treatment because it is not safe to talk. With HIPAA privacy protections, real parity laws could finally help those needing treatment.
The American played a major role in forcing the Bush Administration to reverse its plans. A Washington Post editorial April 12 made our case very strongly to Congress and the Bush Administration:
History gives the rule a stronger than usual legal grounding and has led the American Psychoanalytic Association and the American Civil Liberties Union to say that they will sue to block any delay.
Deborah C. Peel, M.D., is co-chair of the Committee on Government Relations and Insurance. She is also president of the Texas Society of Psychiatric Physicians and president-elect of the National Coalition of Mental Health Professionals and Consumers.
Page 1They shouldn't have to. If the rule goes into effect as scheduled, affected agencies still have two years to comply, and problems of complication or excessive cost can be addressed in that time — without the likely overall weakening that would result from a full-scale redrafting.
The Bush Administration could not see defending actions to delay the HIPAA in court when the public is so supportive of privacy. Wrote the Wall Street Journal April 13, “Republicans believe privacy issues could provide [Bush] some much-needed political cover, and private GOP polls confirm the popularity of this position.”
Our strategy to sue to force implementation jelled after our meeting with Health and Human Services staff on March 12 (Liz Hersh and Deborah Peel attended with Jim Pyles). HHS staff clearly told us they could not say when the HIPAA would be implemented, that no date was even being considered, and that the delays would be indefinite. They also told us that HHS secretary Tommy G. Thompson wanted the “right rule,” which obviously was not the final HIPAA rule as published.
Finally they said that Thompson especially wanted to change the scope of the rule and patients' rights to consent, curtail the privacy rights of minors, and review the marketing sections.
We were able to find other groups and individuals to support the suit, including the ACLU, Public Citizen, the National Coalition of Mental Health Professionals and Consumers, the National Membership Committee on Psychoanalysis in Clinical Social Work, the IPA, the Bazelon Center, and Alpha 1. Pam Wright-Etter and Kevin Etter agreed to be individual plaintiffs.
Congress now will be much less likely to try to write medical privacy legislation, because Thompson's press release about the decision, saying that “the President considers this a tremendous victory for American consumers, who will continue to receive high-quality health care without sacrificing the confidentiality of their private health matters,” ties the Administration to support for the HIPAA going forward. Thompson further said,
President Bush wants strong patient privacy protections put in place now. Therefore, we will immediately begin the process of implementing the patient privacy rule that will give patients greater access to their own medical records and more control over how their personal information is used.
More than thirty-nine health care/insurance groups — including the American Pharmaceutical Organization, the Association of American Medical Colleges, the Blue Cross-Blue Shield Association (a group of independent Blue Cross and Blue shield plans), the American Hospital Association, the Healthcare Leadership Council, and the Health Insurance Association of America — sought to block the HIPAA rule.
Organizations and interest groups whose profits will be adversely affected by their inability to access identifiable medical and prescription records for corporate profit will certainly fight to weaken the new HIPAA privacy rule. Shocked health groups, along with some Administration officials, had fully expected the effective date of the medical privacy regulations to be delayed while the rules were rewritten.
Blue Cross–Blue Shield called the regulation an “operational nightmare” for patients and health plans. The American Hospital Association was “profoundly disappointed” over the President's decision. “These rules could create a bureaucratic nightmare … needlessly adding billions to the nation's medical bills,” according to an AHA spokesperson quoted in USA Today April 13.
However, in a “nod to industry groups,” which have run an “aggressive campaign” against the rules, reported the Los Angeles Times April 13, the Bush Administration will likely try to modify several provisions in the regulation, “making the rules more appealing” to hospitals, insurers, and drug companies. Those groups have maintained that the rules would “cost billions of dollars to implement” and may “interfere with patient care.” These opponents of the health privacy rule will also try to convince the Administration to delay compliance even further beyond the twenty-four-month deadline for implementation.
We can expect that the HIPAA privacy regulations will be formally incorporated very quickly into the Joint Commission on the Accreditation of Healthcare Organizations (JCAHO) standards, which will speed compliance and implementation across the nation.
In fact, the new privacy standards in the HIPAA regulations are similar to standards that most hospitals across the country have complied with for years under Medicare Conditions of Participation and standards, which were previously issued by the JCAHO.
The health care industry is calling the HIPAA rule a new unfunded federal mandate, which will place 'barriers in the way of health care professionals,“ according to Mary Grealy, president of the Healthcare Leadership Council.
Health industry organizations cite high costs, complexity, and lack of practicality of the HIPAA rule as reasons to halt implementation. They object to the expense of hiring privacy officers, purchasing costly new information technology and software to limit access and keep audit trails, and rewriting all contracts with suppliers and subcontractors to assure downstream protection of medical privacy. They claim, too, that essential operations and research would be disrupted.
Out-and-out scare tactics are also being used. Rick Pollack, executive vice president of the American Hospital Association, wrote that the rule apparently will “restrict any discussions between a doctor and patient in the hospital if the patient shares a room with another patient.” Privacy opponents even assert that the new regulations will create obstacles to getting prescriptions filled. They claim family members will not be able to pick up one another's prescriptions and patients will have to sign consent forms at their pharmacies.
Although the final regulations certainly do require hospitals to take reasonable measures (consistent with their size and capability) to prevent patients' identifiable health information from being communicated to roommates in semi-private hospital rooms, these measures are already required today under current Medicare Conditions of Participation and JCAHO standards.
Some of the more troubling opponents of health privacy come from within our own professional ranks — our medical, academic, and public health colleagues who are accustomed to accessing patient records freely for research and public health purposes, without obtaining consent.
Institutional research boards do not regard patient record searches or chart reviews as privacy intrusions and routinely give permission for these activities. Public health officials and the Centers for Disease Control have long sought access to the health records of all Americans. The CDC is the primary proponent for mandatory individual patient and provider identifiers in order to be able to link all health records across time and place. This apparent clash between the goals of researchers, academics, public health officials, and clinicians and the patients right to consent and medical privacy is reflected in the difficulty some of our national professional associations have had in taking clear stands to protect privacy. This division was a big reason that no other medical organization signed on to support our suit against HHS.
We must remind our professional and medical colleagues that the public must know and trust that their most sensitive communications are protected. Otherwise, people will avoid needed health care, lie, or omit important information to protect their privacy. This will destroy the validity of research and public health surveys.
Our posture overall must be to defend the protections we helped to enact in the HIPAA.
Given the adverse climate toward privacy in Washington, despite the President's newly professed enthusiasm, we must actively press this Administration and Congress to uphold the HIPAA.
At the same time, we must advocate that the states pass medical privacy legislation to fill the serious gaps in the HIPAA. Its weakest sections allow direct marketing to patients and easy access to records by law enforcement officials, public health entities, and hospital fundraisers. We must support federal and state legislation to plug these egregious loopholes.
Working to protect privacy continues to be a necessary, ongoing, and difficult task. We must each remain vigilant and work with the public, the media, and legislators for the privacy of psychotherapy communications. The voices of each of us and the unified voice of the American Psychoanalytic Association have been effective in bringing attention to the need for legislative and regulatory measures to protect the public from the appropriation and sale of sensitive medical data, particularly the need to preserve effective psychotherapy and psychoanalysis.
Public and grassroots support of medical privacy are the two forces that have kept the nation's focus on the fundamental rights and freedoms of individuals to be left alone and to control access to sensitive personal information. These are basic human rights.