Patients 'Have Lost Control' of Medical Records, Govt. Critic Charges

By Christine Hall | July 7, 2008 | 8:29 PM EDT

( - New federal rules for medical privacy began phasing in Tuesday with the Bush administration insisting the changes would protect patient confidentiality even as some privacy advocates warned that a whole new array of individuals and data processing companies would be able to pore through our medical records.

The amended medical privacy rules allow health care providers to disclose detailed personal health information, in many instances without patient consent.

Critics warn that health care providers, health plans and data processing centers will be able to start sharing information -- like past medical records and genetic information -- for the broadly defined purposes of treatment, payment and health care.

"If there's anything in your medical record that you don't want to have disclosed, it's disclosable as of today," said Jim Pyles, an attorney who represents the American Psychoanalytic Association.

"You can go and ask your physician to not disclose it, but it's totally up to the physician or the 'covered entity' that has it, such as the hospital, as to whether it will be further disclosable," said Pyles.

"Patients and citizens have lost the control over their own health information," he said.

Starting April 14, 2003, most large providers will be required to fully comply with the Health Insurance Portability and Accountability Act (HIPAA) regulations, which were first issued in the final days of the Clinton administration and later amended by the Bush administration.

Health and Human Services (HHS) Secretary Tommy Thompson has called the privacy regulations a protection for medical records.

"Patients now will have a strong foundation of federal protections for the personal medical information that they share with their doctors, hospitals and others who provide their care and help pay for it," Thompson said in an August written statement.

"It strikes a common sense balance by providing consumers with personal privacy protections and access to high quality care," he maintained.

Under the rules, patients must give specific authorization before their health care information can be disclosed "in most non-routine circumstances, such as releasing information to an employer or for use in marketing activities."

Also, patients have the right to see and correct their medical records, in some cases find out who saw that information, and complain to the HHS if they feel their information was improperly disclosed. But they have no private right of action; enforcement is left to agency discretion.

Pyles and other privacy advocates across the political spectrum see a lot of holes in the privacy changes. That's why Rep. Ed Markey (D-Mass.) on Wednesday plans to introduce a bill to "put a stop to the Bush administration's actions that have left patients with little privacy and even less recourse when their privacy has been sold or invaded."

Markey's bill, the "Stop Taking Our Health Privacy Act", seeks to strengthen consent requirements and further restrict use of medical information for marketing purposes.

Gwen Hughes of the American Health Information Management Association, however, doesn't believe the new regulations give doctors, insurers, data processors and hospitals more information than they already had.

In any case, she says, the health insurance industry will try to gain patient consent for many types of disclosures.

"We're going to get authorizations for almost every disclosure of your health information, except probably in an emergency, [and] to your third party payer," said Hughes.

"If it's in your best interest, we're going to try to find a way to legally release it," she said. "[But] we'll still get authorizations for most disclosures of health information."

And patients can take steps on their own to control the access to their medical records, Hughes said. Patients should ask for copies of their medical records and try to reword consent forms or write in expiration dates for consent, she recommended.

That way, said Hughes, "you wouldn't have to wonder, when that doctor asked you questions about who your sex partners were, what he actually said in that record and who's getting copies of it."

E-mail a news tip to Christine Hall.

Send a Letter to the Editor about this article.