As we feared and predicted, the effects of requiring over 600,000-plus “covered entities” to comply with the Amended Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule led immediately to the loss of privacy rights and dismantling of medical ethics across our nation.
The diabolical complexity and apparent contradictions in the 1,500 pages of dense bureaucratic regulations caused the worst possible outcome: Attorneys in every state wrote Privacy Notices that simply omitted mention of the state laws and medical ethics that are more protective of privacy, even though HIPAA requires notices to include them. HIPAA, intended as the “floor” for medical privacy protections, has instead become the “ceiling.”
Take a close look at the Privacy Notices you have received. They are so authoritatively written that they make the loss of privacy seem like a done deal.
Since the April 14, 2003 compliance date, most Americans have received multiple Privacy Notices from “covered entities” informing them that their personal health information is being used and disclosed for routine purposes without their permission. The notices come from every kind of covered entity, including health professionals, clinics, labs, hospitals, pharmacies, dentists, and insurers.
We reviewed dozens of Privacy Notices from around the nation in researching our federal lawsuit against the U.S. Department of Health and Human Services (HHS), filed April 10, 2003. Not a single one is legal.
Few Privacy Notices even offer the option of consent. Most notices inform patients that they have the right to request restrictions, BUT all carefully stated that covered entities do not have to honor such requests. That point was often emphasized in intimidating caps, such as, “We do NOT have to agree to this restriction.”
The preamble to the Amended Rule states clearly: “The Privacy Rule provides a floor of privacy protection. State laws that are more stringent remain in force. In order not to interfere with such laws and ethical standards, this Rule permits covered entities to obtain consent. Nor is the Privacy Rule intended to serve as a ‘best practices’ standard. Thus, professional standards that are more protective of privacy retain their vitality.” 67 Fed. Reg. at 53,212.
The citations from HIPAA which require notices to include the stronger privacy protections in state laws and medical ethics follow:
45 CFR 164.520(b)(1) Required elements. The covered entity must provide a notice that is written in plain language and that contains the elements required by this paragraph.
(ii)(C) If a use or disclosure for any purpose described in paragraphs (b)(1)(ii)(A) and (B) of this section [treatment, payment and health care operations and other uses and disclosures permitted by the Rule without authorization] is prohibited or materially limited by other applicable law, the description of such use or disclosure must reflect the more stringent law as defined in 160.202 of this subchapter.
45 CFR 160.202 More stringent means, in the context of a comparison of a provision of state law and a standard, requirement, or implementation of specification adopted under … this subchapter, a State law that meets one or more of the following criteria:
(4) With respect to the form, substance, or the need for express legal permission from an individual, who is the subject of the individually identifiable health information, for use or disclosure of individually identifiable health information, provides requirements that narrow the scope or duration, increase the privacy protections afforded (such as by expanding the criteria for), or reduce the coercive effect of the circumstances surrounding the express legal permission, as applicable.
Jim Pyles, our attorney on privacy and lobbying issues, explains the effects of the foregoing language:“lt is to require covered entities to include in their written notice to patients any state law (constitution, statute, regulation, rule, common law, or other State action having the force and effect of law) that prohibits or materially limits any disclosure that is permitted without authorization by the Amended Privacy Rule. The required elements for the notice do not include more protective ethical standards, but the notice is required to include the individual's rights and the covered entity's legal duties with respect to protected health information. Ethical standards would seem to fall into the category of legal duties since practitioners can be held liable for malpractice for failing to abide by their ethical standards.”
He concludes, “Any notice that does not include mention of more privacy-protective state laws and ethical standards is in violation of the Privacy Rule.”
The public has reacted to Privacy Notices with dismay and resignation. Most people have no idea that they received illegal notices or that the notices were supposed to tell them how to protect their personal health information. So the public has been mistakenly led to
Deborah C. Peel, M.D., is co-chair of the Committee on Government Relations and Insurance.
believe they lost the right to consent to the release of personal health information. After all, official looking Privacy Notices appear to say they have no rights under federal law.
HHS never intended for citizens to have to become experts on the medical privacy laws of their states. But unless citizens already happen to be experts on state privacy laws and medical ethics, they will conclude the right to medical privacy has been eliminated.
Your help is essential to correct the widespread public belief that medical privacy ended and to make sure people understand that state laws and medical ethics actually prevail. More than any other group, psychoanalysts understand the effects of privacy violations: discrimination, job loss, shame and humiliation, and the elimination of effective psychotherapy and analysis. Speak out and write. Publicize our lawsuit and our efforts to restore every American's right of consent and constitutional right of privacy. Help save privacy, a basic human right.