Bush Team Drops Privacy Rule for Patients’ Records

WASHINGTON —  The Bush administration on Thursday eliminated a privacy rule that would have required written consent before patients’ medical records are sent to other medical facilities, pharmacies or insurance companies.

Instead, health-care providers will only have to notify patients of their privacy rights, federal health officials said. They will also have to make a “good-faith effort” to have patients sign a form acknowledging that they had reviewed the provider’s policies on medical privacy.

The change was disclosed Thursday as the Department of Health and Human Services unveiled several revisions to a set of comprehensive medical privacy regulations that will limit how doctors, insurers and other health-care providers may disclose and distribute patient health records. The rules were ordered by Congress in 1996 and written by the Clinton administration. They are scheduled to take effect in April 2003.

Medical privacy has been a thorny political problem for Bush administration officials who have said they want strong privacy protections but faced a major lobbying campaign from the potent health-care industry, which felt that the Clinton administration rules were too extreme.

A patient advocacy group said the new rules would significantly weaken important privacy protections. Health industry groups, which tried last year to kill or delay the rule, cheered the revisions.

Health Official Calls Proposals Unworkable

Bill Pierce, a spokesman for the Department of Health and Human Services, said that some of the Clinton-era proposals were unworkable and would have prevented patients from receiving timely care.

“We tried to put ourselves in the place of the patient . . . sitting in the doctor’s office and feeling lousy,” he said.

The original regulation, requiring written consent to share patient information, might have prevented pharmacists from taking orders for medication by phone, federal health officials said.

Doctors also might have faced problems in referring patients to specialists. The regulation might have also complicated the work of paramedics and other emergency workers.

Under the new proposal, health-care providers still will have to notify patients as to who might see their medical records. But there is no requirement that this occur before treatment or services begin. And instead of consent to share information, patients would sign an acknowledgment that they had seen the policy.

“We’re very pleased,” said Mary Grealy, president of the Healthcare Leadership Council, an association of chief executives from health-care companies. “We think they’ve come a long way in striking the right balance between protecting privacy and still making sure people can access the system.”

But the Health Privacy Project at Georgetown University in Washington called the change a “devastating blow to patient privacy.”

“It will seriously undermine privacy, and I believe the consumer and disability rights groups are going to be up in arms,” said JanLori Goldman, director of the project. “If people aren’t given a consent form and are required to sign it, chances are likely that they won’t know what their right to privacy is and how their personal information is being used.”

Sen. Edward M. Kennedy (D-Mass.) said he was “very concerned that they’ve eliminated the consent form. It was a core part of the rules.”

Separate rules apply when a doctor or other health-care provider wants to share patient information with marketing companies or for other purposes unrelated to treatment, billing or quality improvement.

In those cases, health-care providers must seek prior approval to share the information. A separate approval is needed each time the provider wants to release patient information.

Health and Human Services officials said they had strengthened patient protections by broadening the types of activity that are considered marketing and which need specific record-release authorization from patients. The Health Privacy Project applauded the new marketing rule.

Health Agency May Make More Revisions

The public has 30 days to comment on the regulations, after which the agency might make more revisions. The rules do not require congressional approval.

Federal officials also said they had changed provisions that may have unintentionally limited parents’ access to their children’s medical records.

The issue applies to states that allow children to obtain mental health, abortion or other services without parental consent yet are silent on whether parents can have access to the records.

Where the Clinton rules would have given some children in those states the right to privacy from their parents, the new regulation would allow doctors and other health professionals discretion on whether to provide or deny a parent access to the records.

The health officials said they did not know how many children or states would be affected.