If we are to maintain the integrity of the clinician-patient relationship in an era of electronic transactions, it must be given special recognition and protection from third-party intrusion. Psychoanalysts are in a unique position to deliver this message to lawmakers, the health care industry, fellow health care professionals, and the general public. To accomplish this goal, the Committee on Government Relations has developed a Patient Privacy Bill of Rights, modeled after the Consumer Privacy Bill of Rights recently published by the Obama administration. An abbreviated version of the proposed Patient Privacy Bill of Rights is included below. The entire version can be viewed on the APsaA website by first signing on to apsa.org and clicking on the link bit.ly
We welcome your comments on content.
The Obama administration issued in February a Consumer Privacy Bill of Rights in response to privacy requirements necessary for commerce with European and Asian countries. According to the White House, the privacy principles set forth in this document “provide a baseline of clear protections for consumers and greater certainty for companies” with respect to the collection and use of electronic data about consumers, and are “essential” for the trust necessary to permit public acceptance of networked technologies. “Citizens who feel protected from misuse of their personal information,” explained President Obama, “feel free to engage in commerce, to participate in the political process, or to seek needed health care.”
Interestingly, there is a subset of consumers who has been excluded by this bill. Specifically patients being treated under the Health Insurance Portability and Accountability Act (HIPAA) are not covered by the Consumer Bill of Rights, and no Patient Privacy Bill of Rights currently exists to protect their privacy.
The HIPAA/HITECH Act and associated regulations, rather than establishing patient trust as the top priority, ignore standards of professional ethics, do not recognize the patient's right to health information privacy, and do not contain a clear and understandable architecture to protect confidentiality.
To address these deficiencies, our patient rights outline is modeled after the Consumer Privacy Bill of Rights. As with the privacy bill for consumers, a privacy bill for patients should also be implemented “without delay.” In fact there is an even greater urgency, because of the sensitivity of personal health information (PHI) and the potential harm to patients from improper disclosure.
Consonant with President Obama's concerns about consumer privacy, the Department of Health and Human Services (HHS) has recently stressed the importance of the privacy and security of health care information, noting that it “could have life-threatening consequences” if individuals are reluctant to disclose health information due to privacy concerns. HHS previously determined that the right to health information privacy is necessary “to secure effective, high-quality health care” and is reflected in established standards of professional ethics and codes of conduct as well as constitutional, statutory, and common law, and the law of physician-patient and psychotherapist-patient privilege.
Yet patients are becoming increasingly aware of the prospect of unparalleled electronic data breaches of their personal and sensitive information. A March 2012 report issued by the American National Standards Institute found that:
More than 40 million Americans have had the privacy of their electronic health records breached in the past 15 years since the enactment of the Health Insurance Portability and Accountability Act.
These breaches are adding billions of dollars in unanticipated costs to the health care delivery system.
Patients do not trust that their health information privacy is adequately protected by current laws.
Regulated entities are having difficulty complying with fragmented and incoherent health information privacy laws.
More Americans doubt the effectiveness of electronic health information privacy laws under HIPAA to ensure patient privacy. Similarly, covered entities are finding such policies confusing and difficult to implement. Further, the limited privacy protections under the HIPAA/HITECH Act apply only to covered entities and their business associates, rather than to the rapidly expanding group of “uncovered entities” who will also transmit PHI.
The original HIPAA Privacy Rule issued by President Clinton on December 28, 2000, which was intended to be the “floor” of federal privacy protections, included the right of consent for routine uses and disclosures of health information consistent with well-established privacy protections and standards of ethics. Two years later, however, this right of consent was eliminated from the federal floor of privacy protections for treatment,
Graham Lindley Spruiell, M.D., is co-chair of the Committee on Government Relations and Insurance and is a member of the Program in Psychiatry and the Law, Beth Israel Deaconess Medical Center. Email:
payment, and health care operations. The preamble to that change contained no discussion of the importance of the patient's well-established right to control disclosures and uses of health information.
The HIPAA Privacy Rule now allows the disclosure and use of an individual's PHI to a virtually unlimited number of covered entities and business associates without the patient's consent or knowledge and, at times, over the patient's objection.
In order to protect the fundamental right to privacy of all Americans and the health information privacy that is essential for quality health care and to provide greater certainty for those who handle PHI, the following Patient Privacy Bill of Rights should be implemented through codes of conduct and federal legislation. This bill was developed by our legislative representative, Jim Pyles, in coordination with Deborah Peel, founder of .
(For a complete version of this plan, please visit the APsaA website mentioned on page 24.)
The patient reserves the right to keep personal health information confidential. Privacy is a right that has been recognized in common law, the Constitution, by Congress, and by the U.S. Supreme Court. The clinician is the steward of this right and has ethical and fiduciary duties to prevent confidential information from being breached.
A first principle of patient control is that individual patients reserve the right to consent or not to consent to the inclusion of their health information in the Electronic Health Record (EHR), and to limit disclosure of particular information such as psychotherapy notes. Patients should not be coerced to participate by requirements of the insurance industry or government, and should be given the opportunity to provide informed consent, analogous to informed consent for a medical procedure.
A clinician should not disclose health care information to an entity unless the patient (or surrogate) has provided written consent. Entities should provide an easily exercisable means of granting or refusing consent as well as a means of withdrawing or limiting consent.
If a patient provides informed consent to participate in the EHR, a patient also has the right to informed consent regarding privacy and security practices, and to be informed about where personal health data flows and who is accessing PHI, so that patients may weigh both the risks and benefits of continued participation.
Entities should limit the use and disclosure of PHI to those purposes intended by the patient, unless required by law. Without a written release by the patient, defaults should be set to the highest level of privacy protection, “Do Not Disclose.”
Patients have a right to secure and responsible handling of their PHI. Entities should continually assess the privacy and security risks associated with their personal data practices and should maintain reasonable safeguards to control risks such as loss; unauthorized access, use, destruction, or modification; and improper disclosure. If there is a breach of PHI, patients have the right to be notified, regardless of whether an entity believes harm has occurred.
Patients should be able to correct inaccuracies in their PHI in a manner that is appropriate to the sensitivity of the information and the risk of adverse consequences to patients if the information is inaccurate. This principle recognizes that the use of inaccurate PHI may result in harm to patients.
Patients who give consent for the use or disclosure of their PHI also have a right to limit that use and disclosure. Entities should collect only as much personal data as allowed by the patient. Entities should securely dispose of PHI once they no longer need it, unless they are legally mandated to do otherwise. It is imperative that health information be destroyed, not held in perpetuity by anyone, unless a patient has been informed and consents to this practice. It is well-known that de-identification of health information is practically impossible and that releases of de-identified health data without patient consent must be prohibited. Patients [and] clinicians should apply “the minimum necessary rule” in the HIPAA Privacy Rule in a manner that is consistent with, and does not override, professional ethics and judgment.
Patients have a right to have PHI handled by companies and government agencies with appropriate measures in place to assure they adhere to the Patient Privacy Bill of Rights. Patients must have a right to obtain upon request, an accounting of all disclosures from all entities that hold or disclose their health information to assure accountability. This creates a “chain of custody” so that patients can know exactly where their health information is held and exactly for what purposes it is being used.
This Patient Privacy Bill of Rights should be integrated into the architecture of the EHR. It should apply to any entity that handles or stores electronic health information.
Patients have a right to enforcement of their rights under this Bill of Rights.
Patients have a right to notice of this Patient Health Privacy Bill of Rights in plain, understandable language by entities using the method most likely to inform patients of [about] their health information privacy rights.
This Patient Privacy Bill of Rights should be incorporated into legislation passed by Congress in order to enforce these principles. Such a Bill of Rights should be interpreted in a manner that is consistent with constitutional law, laws pertaining to privileged communications, and standards of professional ethics; all of which strengthen the clinician-patient relationship, confidentiality, and patient trust in health information technology.