WASHINGTON — After years of fruitless congressional efforts, the Clinton administration today will issue the first comprehensive regulations protecting the privacy of patients' medical records.
The rules prohibit doctors, hospitals, HMOs and other health providers from sharing patients' medical records--except for treatment and payment.
The new measure--considerably broader than earlier versions--covers all records, not just those stored electronically. It also strengthens the provisions that limit employer access to medical data.
"The new rules will apply to all health insurers and virtually every health care provider . . . and it will give patients more control over and access to their medical records," said Chris Jennings, chief health care advisor to President Clinton.
The president, however, will emphasize when he unveils the regulations that more needs to be done to guarantee the privacy of patients' records. He will argue for additional legislation requiring that life insurers and worker compensation programs also safeguard patients' records--and that consumers should have a right to sue providers who violate the medical confidentiality rules.
The privacy regulations were required by the 1996 Health Insurance Portability and Accountability Act--which said that if Congress had failed to produce legislation to protect medical records by August 1999, the secretary of Health and Human Services should issue such regulations. Congress considered legislation for several years but could not reach agreement on several key provisions--including a consumer's right to sue health care plans and providers if they breached the privacy rules, and how to handle teenagers' reproductive health information.
The rules would prohibit a number of practices that consumers often are unaware of--but which violate the privacy of their health care records. For instance, the regulations would end the practice by some pharmacies of sharing specific information about the drugs prescribed to the patient. That practice, while rare, allows pharmaceutical companies with competing drugs to promote their products directly to a specific patient.
The rules also would also make it illegal to disclose more medical information than a patient had authorized. In one such case, a California woman who was suffering from a work-related injury to her wrist told her insurance company to release information about her ailment to her employer. The insurer, however, sent her entire medical record--including information on her recent fertility treatment and pregnancy loss. While such breaches often are inadvertent, they can harm a patient's reputation and standing in the workplace.
