Appellate Judge: “If I pay cash and tell the doctor I don't want anyone to know I have HIV, under the Rule can I exercise that right?”
Appellate Judge: “The insurance company calls and asks you how many patients have you treated in the last month with drug X for HIV, do you disclose?”
Government Attorney: “I don't know.”
Appellate Judge: “If you don't know, how is the patient supposed to know?”
This is not an excerpt from a Pinter play; this is an exchange that took place on March 9, 2005, in the U.S. Court of Appeals for the Third Circuit in Philadelphia. A three-judge panel convened to hear the case of Citizens for Health vs. Leavitt. Jim Pyles, counsel for the American Psychoanalytic Association is the lead attorney. The case seeks to restore the patient's right to consent prior to the release of health information, which was specifically eliminated by the HIPAA (Health Insurance Portability and Accountability Act) Amended Privacy Rule.
When asked direct, simple questions by the justices, the government's attorney seemed confused, gave contradictory answers, and reversed himself, resulting in one judge observing “as good a litigator and scholarly gentleman as you are, if you are not sure…, how is [an] 89-year-old woman going to know?” The judges asked whether paying for treatment privately would protect privacy. They asked whether a patient could get an accounting of the entities that had been given information about him. After much confusion, the answer to both of these questions was ultimately “no.” This obviated much of the government's argument that citizens were safeguarded by their right to file a complaint with the Department of Health and Human Services (HHS), since they would be hard pressed to know that a violation had taken place.
The attorneys for the government insisted that citizens had no privacy protection prior to the Amended Rule, and that HHS successfully balanced loss of privacy with enhanced efficiency. Both of these points were vigorously challenged by our attorney as well as the judges. One of the judges questioned whether “efficiency” was a compelling reason to sacrifice privacy.
Could it be true that the federal government can simply issue regulations that eliminate basic freedoms, without consequence or public outcry?
It was clearly understood by the judges that the Amended Rule allows for the routine release of personal health information (without consent) for the purposes of “treatment, payment, and health care operations.” They focused on the meaning of “health care operations,” which the government's attorneys were hard pressed to define. The release of information to other health care professionals for purposes of treatment, and the release of information to insurance companies for purposes of payment, seemed logical and customary to the judges. The release of information for “health care operations” came across as questionable.
Our attorney made four key points.
The Amended Rule violates patient rights by authorizing the use and disclosure of every kind of health information without consent.
The Amended Rule authorizes disclosures to untold numbers of members of the public.
Under the Amended Rule citizens are powerless to prevent disclosures without consent, without accounting, and over their objection; this is the case even if they pay privately, and extends retroactively prior to the implementation of the Rule. There is no effective remedy.
The Amended Rule waives the individual's fundamental right to privacy against his or her will.
Emotions ran high in the courtroom. It seemed clear that fundamental rights were at issue. Could it be true that the federal government can simply issue regulations that eliminate basic freedoms, without consequence or public outcry? It was no accident that this case was filed in Philadelphia, the birthplace of our nation's Constitution. The questions and comments posed by the judges showed a clear understanding of the magnitude of the case, giving a sense of hope. On the other hand, there was no avoiding a feeling of vulnerability and despair over how fragile and quickly lost these freedoms seem. How did this happen?
In 1996 Congress passed HIPAA to protect the security and privacy of identifiable health information as the country moved toward the use of electronic records and billing. Congress granted power to HHS to develop standards. The tradition of protecting patient privacy was well established in professional
Janis G. Chester, M.D., who is a psychotherapist associate member of the Association, is an individual plaintiff in the suit. She is president of the American Association of Practicing Psychiatrists, which is a plaintiff in the suit.
ethics and clinical practice. The clear intent of Congress was that these ethical practices should carry over into the electronic realm.
When HHS implemented the Amended Privacy Rule in April 2003, the very opposite was achieved. Personal health information could be routinely disclosed without patient consent, without the patient's knowledge and over the patient's objection. An unethical practice was now authorized by law. Since the time of Hippocrates, confidentiality was encoded in the ethical standards of professional organizations. The American Medical Association incorporated confidentiality into its ethical code in 1847, and every other professional group has followed suit.
The American Psychoanalytic Association sued HHS days before the implementation of the regulations. The suit calls for the restoration of patient consent prior to the routine release of information, based on Constitutional rights and professional ethics. The leadership of the American Psychoanalytic Association played a key role in the formation of a coalition of 18 plaintiffs, including individuals, consumer advocate groups, and professional societies, representing 750,000 citizens. The case was heard in District Court in Philadelphia in December 2004. The judge ruled that the Amended Rule did eliminate medical privacy but dismissed the Constitutional claims on the grounds that while the Amended Rule does permit practitioners to release patient information without their consent, it does not compel them to do so.
Because the principle of patient consent and the critical Constitutional issues were not addressed, all 18 plaintiffs filed an appeal, joined by six amici, including the National Association of Social Workers and the Harvard Medical School Program for Law and Psychiatry.
While we await the court's decision, we can take pride in the fact that the research done for this case has already been put to good use. On behalf of the Association, Pyles worked successfully with attorneys protecting abortion records from subpoenas issued by Attorney General Ashcroft. Lawmakers on Capitol Hill increasingly turn to the Association for guidance on issues involving privacy.
While the Amended Rule has generated a good deal of red tape where patients can see it (extra forms in doctors' offices, hospitals, and pharmacies), this is merely window dressing. The Rule is not a privacy law, it is a disclosure law. This suit filed by APsaA seeks to return to the original intent of Congress, to maintain Constitutional and ethical principles safeguarding privacy as we enter the electronic age.