The American Psychoanalytic Association (APsaA) worked intensely and directly over the past year with many members of Congress to secure privacy protections in the Health Information Technology for Economic and Clinical Health Act (HITECH Act), which was part of the American Recovery and Reinvestment Act of 2009 signed into law by President Obama on February 17. That legislation will be implemented by regulations adopted over the next year. The goal of the legislation is “utilization of an electronic health record for each person in the United States by 2014.”
It is likely that many of the privacy protections included in the HITECH Act would not have been included had it not been for APsaA's efforts. The success of this effort was due to the commitment of APsaA leadership working with Washington counsel, APsaA members, and key members of Congress who withstood intense lobbying pressure from the insurance and information technology industries to defend the ethical practice of medicine and psychotherapy. Members of Congress who deserve particularly high praise for their efforts are Congressman Ed Markey (D-MA), Congressman Henry Waxman (D-CA), and Senator Olympia Snowe (R-ME). Others who were also helpful were Congresswomen Lois Capps (D-CA) and Jan Schakowsky (D-IL) and Senators Chris Dodd (D-CT), Ben Cardin (D-MD), and Barbara Mikulski (D-MD).
The HITECH Act contains the following provisions that should help preserve the patient's right to health information privacy as a national electronic health information system is implemented:
Privileges: Nothing in the legislation shall constitute a waiver of “any privilege otherwise applicable to an individual,” thereby expressly recognizing and preserving by statute the psychotherapist-patient privilege recognized in the Supreme Court's 1996 decision in Jaffee v. Redmond [see page 16]. Private pay: Under a new right, individuals who are willing to pay privately cannot have their health information disclosed to health plans without their consent for payment and health care operations.
Minimum necessary: Covered entities (including psychotherapists) and business associates disclosing identifiable health information shall have the right to decide what is the minimum necessary amount of information for any use.
Breach notice: Individuals have a right to notice when their identifiable health information has been, or reasonably is believed to have been, accessed or acquired as the result of a security breach.
Segmentation: The Department of Health and Human Services (HHS) is required to consider issuing standards for technologies that protect the privacy and promote the security of health information by allowing segmentation of particularly sensitive health information (such as mental health information) in order to minimize concerns by patients.
Encryption: HHS is required to consider issuing standards that allow individually identifiable health information that is being transmitted or transported to be rendered unreadable by unauthorized individuals.
Accounting: Individuals have new rights to obtain an accounting for disclosures of identifiable health information for treatment, payment, and health care operations.
Restrictions on sale: New prohibitions are placed on the sale of health information without the individual's authorization.
Restrictions on marketing: New restrictions are added on the use of health information for marketing without the individual's authorization.
Fundraising: A new right gives individuals the opportunity to opt out of fundraising communications that use identifiable health information.
Consumer representation: The number of consumer representatives on a key policy committee is increased from one to three.
Public participation: HHS must provide notice to the public and an opportunity for public comment on regulations implementing the act.
Enforcement: New civil and criminal penalties are established for business associates (those who handle health information on behalf of practitioners) and for employees of covered entities (hospital personnel, for example). The act also increases the civil monetary penalties for privacy breaches and provides for state attorneys general to bring enforcement actions to protect residents of the state from violations of the HITECH Act.
The strategic key to obtaining these new privacy protections was APsaA's adoption of a clear set of privacy principles in July of 2007, which became the core privacy concepts contained in joint letters to Congress from nearly 30 members of the Mental Health Liaison Group as well as numerous additional letters filed jointly by APsaA and the National Association for Social Workers. Those privacy principles then were incorporated into the TRUST Act (H.R. 5442) introduced in February 2008 by Congressman Markey and 13 other key Democratic members of the House including Rahm Emanuel (D-IL) and Henry Waxman.
Senator Snowe led the effort in the Senate to block repeated efforts by Senator Kennedy to pass the Wired for Health Care Quality Act (S.1693). The Wired Act, sponsored by Senators Ted Kennedy (D-MA), Hillary Clinton
Jim Pyles, J.D., is co-founder and principal of the national health law and policy firm of Powers, Pyles, Sutter & Verville, P.C., in Washington, D.C.
(D-NY), Mike Enzi (R-WY), and Orrin Hatch (R-UT), had none of the privacy protections that were included in either the TRUST Act or the HITECH Act. The failure of the Wired Act to pass in the Senate allowed new bills to progress through the House that contained more of the privacy protections that were included in the TRUST Act championed by Congressman Markey. As the HITECH Act moved toward a final vote, a strong effort was made by Senator Enzi to strip out the privacy protections. We also had to work intensely with Senator Snowe's staff to obtain last minute changes to the breach notice provisions to prevent them from being weakened by an exception.
As with any major piece of controversial legislation, we did not get all that we sought. APsaA privacy principles that were not included in the HITECH Act were express recognition that individuals have a right to health information privacy, consent for all disclosures of identifiable health information, and a definition of privacy that includes the individual's right to control uses and disclosures of health information. With more than 42 million electronic health records improperly disclosed since January 2005, those protections are likely in a later day. The near term goal for APsaA is to make sure the hard won gains reflected in the HITECH Act are not lost as the regulations are formulated.