Will New Regulations Mean Real Privacy?

Published in the Richmond Times-Dispatch
November 4, 2002

Next April, massive regulations on the privacy of health information take effect. Will they really give you more privacy and, if so, at what cost?

The federal Health Insurance Portability and Accountability Act will require health-care providers and health insurers to follow rules governing the use and disclosure of individual health information. The act, known by the acronym HIPAA, will create the first nationwide, comprehensive scheme for protecting health privacy.

What changes will you see? Mainly, a written privacy notice will confront you when you visit a doctor’s office or hospital. Expect to see it posted on the wall with copies available at the registration desk. You might be asked to sign it, although the act doesn’t require you to do so. This notice will be several pages long and difficult to digest in one reading.

HIPAA requires health providers to give written notice of their privacy practices to their patients. This notice will tell you the details of your doctor’s health-information privacy practices and will tell you when your written authorization will be needed to use your health information for ancillary purposes, such as marketing other services to you.

The notice will tell you that your health-care provider will not need written consent from you to use your health information to treat you, to interact with other doctors, to get paid (by your insurance company, for instance) or generally for that provider’s health-care operations.

What if I don’t like what the notice says?

What if you don’t like what the privacy policy says and want your medical information handled differently? For example, what if you don’t want test results reported to your health insurer?

While you can request that an exception be made to the privacy policy for you, I predict most medical providers will reject most requests and only offer an informal effort to honor others. Keeping track of various special requests is hard and expensive.

If you don’t like your doctor’s privacy practices, you could look for a doctor with a privacy policy that suits you. Yet, I expect most privacy policies will look similar. A proper privacy notice has to cover lots of HIPAA-mandated ground, and the lawyers drafting them will try to preserve maximum flexibility for their clients.

Still, you will have some control over your privacy. For example, your doctor cannot withhold services just because you refuse to authorize an unnecessary use of your medical information, such as for marketing purposes.

Will HIPAA give me more real privacy?

HIPAA will give patients new rights. Among others, patients usually may inspect and copy their medical records, and they may request an accounting of all disclosures of their medical information occurring in the past six years.

Yet, HIPAA won’t change much of the way medical information is handled. Doctors still can communicate with nurses, other doctors and hospitals to treat you. Medical practices still can communicate with your health insurers to get paid. A doctor’s office still can call to remind you of appointments.

Also, HIPAA allows disclosure if state law mandates the disclosure, such as in reporting West Nile Virus to a public health agency or child abuse to social services. Thus, aside from more paper being shuffled, the public won’t see much change.

Will HIPAA keep others from helping me?

What if you want to pick up a prescription for your spouse? What if you want to help an elderly neighbor navigate the hospital obstacle course? Will HIPAA get in your way?

Probably not, although that’s not certain. Under HIPAA, almost any adult can be someone else’s personal representative in the health-care process. The act allows personal representatives of the patient to have access to medical information when such access is directly relevant to the caregiver’s role. A health provider can withhold disclosure if doing so is in the patient’s best interest, such as cases of suspected child abuse.

Still, HIPAA might make some doctors feel constrained from talking as much as before. A doctor concerned about a potential privacy lawsuit could decide that the layperson doesn’t need some medical information in order to assist the patient, even if knowing that information would enable the caregiver to be a more effective champion in the health-care process.

Also, navigating a patient through the medical maze can require the tag-team efforts of many family members and friends. A doctor could become concerned that not everyone asking questions is a caregiver, making teamwork less available.

Hippocrates advised doctors to help “or at least do no harm.” Recent amendments to HIPAA removed burdensome requirements for getting signed consents for most routine disclosures in the treatment and payment process, so much potential harm has been avoided. Yet, the tradeoff is that medical privacy will not change much from what we have today.

By John B. Farmer

© 2002 Leading-Edge Law Group, PLC. All rights reserved.