APsaA, Congress, and Health Information Privacy

As Mark Twain has been accused of saying, “No man's life, liberty or property is safe while the legislature is in session.” So we were relatively safe for a month while Congress was on its August recess. But before Congress left town, Senator Ted Kennedy (D-Mass.), supported by Senator Hillary Clinton (D-N.Y.), tried to ram through the Senate a health information technology (IT) bill that would have eliminated the individual's right to health information privacy and the psychotherapist-patient privilege recognized in Jaffee v. Redmond. These senators, who have professed to support the right to health information privacy, tried to get this bill, the Wired for Health Care Quality Act (S. 1693), approved by the Senate without a hearing, any debate, or any opportunity for amendments. Fortunately, others such as Senators Patrick Leahy (D-Vt.), Jack Reed (D-R.I.), Max Baucus (D-Mont.), and Joseph Lieberman (I-Conn.) blocked passage of the bill. APsaA worked with these senators to alert them to the threat to health information privacy.

Now where does this leave us with respect to federal health IT and health information privacy legislation? We are in a better position than we have been, but the future for quality psychotherapy is not yet assured. In 2006, the Senate actually passed a health IT bill similar to the “Wired” bill without privacy protections, and the House passed a health IT bill that was nearly as bad, which was introduced by former Congresswoman Nancy Johnson (R-Conn.). However, Congress adjourned before the differences in the bills could be reconciled, and Congresswoman Johnson and many supporters of the House bill left Congress after the November elections.

Prior to the beginning of the new Congress, APsaA adopted a set of nine privacy principles to be included in any health IT legislation. Those principles are recognition of the patient's right to privacy, an opportunity to exercise that right by giving or withholding consent, the right to keep highly sensitive information private, privacy protections that attach to the information regardless of who handles it, notification of breaches, meaningful relief for privacy violations, preservation of state privacy laws and ethical standards, preservation of the psychotherapist-patient privilege, and definitions of privacy, confidentiality, and security. Increasingly, members of Congress are coming to appreciate the importance of these principles. The legislators are beginning to understand that electronic information systems increase the risk of privacy violations because they cannot be made secure. They make it possible to breach the privacy of millions of individuals instantaneously, and once an individual's health privacy is breached electronically, it can never be restored.

A letter to Senate leaders signed by 27 organizations within the Mental Health Liaison Group opposed the Wired bill and stated that any health IT bill should, “at a minimum” recognize the right to health information privacy and consent and provide for notice of privacy breaches and adequate remedies for violations. These minimum protections are contained in APsaA's privacy principles. Representatives of the American Psychiatric Association, the American Psychological Association, and the National Association of Social Workers worked closely with APsaA representatives to prepare this letter and get it delivered to Senate leaders. The letter was very helpful in convincing senators to block passage of the Wired act without privacy protections.

On July 18, Senator Leahy introduced the Health Information Privacy and Security Act (S. 1814). This bill includes all nine of APsaA's privacy principles while the Wired bill includes only one. APsaA is working with the other major mental health practitioner groups to get the privacy provisions of the Health Information Privacy bill included in the Wired bill.

The Wired bill is particularly disturbing because it contains no privacy protections and establishes a process under which the right to health information privacy can be eliminated without an opportunity for consumers to prevent it. The bill establishes three government/private or private committees to make recommendations to the secretary of Health and Human Services (HHS) for health IT standards, national policy, and quality measures. Consumers are allowed to have only one representative on these committees while employers, health IT vendors, and insurers are each allowed a representative and are certain to out vote the consumer representative on any privacy issue. Further, the secretary is authorized to put the recommendations into effect without an opportunity for public comment. Finally, there is no provision for congressional oversight. This coupled with the effort to get the bill passed by the Senate without a hearing, debate, or amendment renders consumers powerless to prevent elimination of the right to privacy.

Those responsible for drafting the health IT bill on the House side appear to be willing to include APsaA's privacy principles in health IT legislation. However, nothing is certain until privacy protections are signed into law.

APsaA was recently asked by representatives of the secretary of Health and Human Services to share its privacy principles and supporting research. Those officials indicated that they plan to adopt a set of privacy principles that are likely to be quite similar. This interest in privacy principles appears to be the result of findings by several congressional investigatory agencies and committees that HHS has shown little commitment to protecting health information privacy in either the health IT standards it is developing or in its handling of sensitive health information. Privacy protections enacted by Congress would ensure that HHS includes strong privacy protections in the health IT standards it adopts.

That is why APsaA members should contact their senators and representatives by telephone and e-mail and at campaign events to urge that basic privacy principles must be included in any health IT bill. The right of health information privacy and quality health care remains in jeopardy now that Congress has returned in September.