Back to Front PageVOLUME 6, NUMBER 4

Complex Privacy Rules Greeted With Concern, Confusion

Caption: The AAMC's David Korn, M.D., discusses the privacy regulations' potential impact on biomedical research at a Jan. 10 program sponsored by the Association of Academic Health Centers.

Sweeping privacy regulations issued by President Clinton in December could change health care as we know it.

It's too soon to fully assess all of the nuances contained in the nearly 1,500 pages of the final regulation - the first set of federal standards to govern medical records privacy - but experts worry that the rule may strive too hard to protect patient confidentiality at the expense of the operations of the health care system and medical research.

"These regulations are very detailed, very minute, and very prescriptive; they will result in the biggest change in the health system in my lifetime," stressed David Korn, M.D., AAMC senior vice president of biomedical and health sciences research, speaking at a Jan. 10 forum sponsored by the Association of Academic Health Centers and broadcast live to 1,700 hospitals.

As called for in the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the regulations are designed to protect individually identifiable health care information. Among other requirements, they stipulate that covered entities, including hospitals, physicians, and insurers, maintain detailed records of how personal medical information is used and generally bar them from using or disclosing personal medical information without a patient's specific consent.

Under the regulations, covered entities must implement programs and designate a "privacy officer" to oversee compliance, and are subject to criminal and civil penalties for improperly using or disclosing medical information. The regulations will take effect in February 2003 for most providers. But it's possible that academic medical centers in some states will have to abide by even tougher standards: The regulations don't uniformly preempt state law. Instead, they only supersede less stringent state laws, potentially creating a confusing patchwork of rules and regulations that differ from one state to the next.

The regulations also will affect biomedical research by injecting a new and subjective standard into the institutional review board (IRB) approval process. The rules allow for the disclosure of protected health information for research without patient authorization so long as an IRB or privacy board determines that the risk of privacy intrusion does not outweigh the potential value of the research. But there are no normative standards to guide such determinations, says Dr. Korn, adding that "privacy beliefs are deeply personal and ideological, not scientific." The regulations also expand the requirement of independent oversight of research involving human subjects, currently limited to research funded with federal dollars, to all such research - a provision that the AAMC supports.

The scope of the confidentiality requirements was dramatically expanded in the final rules. While the proposed rule released in November 1999 applied only to electronic health information, the final version embraces paper and oral information as well. "The final regs appear more burdensome than the draft, especially given the expanded health information definition," says Debbie Troklus, assistant vice president for health affairs and compliance at the University of Louisville School of Medicine and immediate past president of the Health Care Compliance Association. The rules will require academic medical centers to maintain for six years records of any and all disclosures of protected health information and correspondence with patients about confidentiality. "Documentation will be the name of the game," Dr. Korn stresses. "It used to be publish or perish; now it's document or die."

Another potentially thorny area for academic medical centers is the regulations' stipulation that covered entities must restrict uses or disclosures to the "minimum amount necessary" for the purpose - a term the rules fail to clearly define. Unlike the proposed version, the final rules do allow full use and disclosure for treatment purposes, but the "minimum necessary" standard still applies for business uses, including billing. "Determining what 'minimum necessary' actually means is going to be difficult," says Troklus.

And the rules increase academic medical centers' potential liability exposure by holding covered entities accountable for compliance lapses of a broadly defined group of "business associates." While the final rules limit culpability to the knowing failure to report noncompliance, they still require covered entities to enter into contracts concerning privacy with all business affiliates, including attorneys, auditors, and consultants. "We are concerned that hospitals could be held responsible for the mistakes of their 'business partners' such as insurers, clearinghouses, and accrediting agencies that misuse patient information," says American Hospital Association President Dick Davidson.

What is clear is that teaching hospitals and medical schools should waste no time in tackling the regulations. "The primary message that health care providers should take away from the final rules is that they're going to be required over the next two years to develop and implement complex and costly procedures and methods to ensure the protection of personal information," says John Knapp, a health care attorney with Cozen and O'Connor in Philadelphia.

He points out that complying with the regulations will be extremely expensive. HHS estimates the new rules will cost the health care industry nearly $18 billion over 10 years - a figure that many say is a significant underestimate. "I am encouraging health care providers to plan and implement HIPAA compliance measures now," Knapp says. "Given the estimated expense of the regulations, academic medical centers should spread the compliance costs over as many budget periods as possible."

---

AAMC Home | Government Affairs | Newsroom | Publications | Meetings | Students and Applicants | About the AAMC | Search | Site Map
Questions and Comments | © 1995-2004 AAMC Terms and Conditions | Privacy Statement

08 February 2005