President Clinton Issues New Rules
Background: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandated Congress to enact by August 21, 1999, a national standard governing access to electronic medical records. The Congress was unable to pass health privacy legislation by the deadline and responsibility for drafting medical privacy regulations shifted to the Secretary of Health and Human Services (HHS). On October 29, 1999, Secretary Donna Shalala issued draft regulations, and over 52,000 comments were submitted on the proposed rules. (To read the comments NAMI submitted on the draft regulations, please see NAMI E-News Vol. 00-91 at http://www.nami.org/update/000218.html).
The final medical privacy regulations are available at http://aspe.hhs.gov/admnsimp/. (Please note that the final regulations are more than 1,600 pages long). We are engaging in a thorough review of these regulations and will post more detailed information on the NAMI web site after this review is completed. A brief preliminary summary of the final regulations follows.
Date of effect:
The final rules will go into effect in two years to give health care providers time to develop the systems to conform to the new requirements.
Scope of the rule:
The final rule applies broadly to paper records, electronic records and oral communications between health care providers and health plans
Informed consent generally required:
The rule requires health care providers (including individual practitioners, medical facilities, and HMOs) to obtain informed consent from patients prior to disclosing protected health information about them for purposes of treatment, payment, or healthcare operations. However, the rule stipulates that health care providers may condition the provision of treatment on the patient providing consent.
Patient access to their own medical records:
Consumers frequently encounter resistance from mental health professionals when they request access to their own medical records. The new rule clearly establishes the right of individuals to see and copy their own health information. A limited exception applies when the healthcare provider proves that such access would endanger the life or safety of any individual.
Families/Next of Kin:
The rule allows medical information to be shared with "next of kin" without written consent, unless the consumer expressly objects to such disclosure. This is very important for family caregivers who are frequently denied access to fundamental information necessary to function in this capacity. Parents or other family members of persons with severe mental illnesses frequently assume care-giving responsibilities for their ill family member and the increasing role that families play in enhancing treatment outcomes is widely recognized. Thus, the new rules will assist families to obtain information they need to provide care, such as information about diagnosis, treatment plan, medications, side effects, prognosis, and community resources.
NAMI is concerned that the final rules allow hospitals, providers and/or insurers to share personal medical information with law enforcement officials. While the rules require law enforcement officials requesting records to obtain a subpoena or warrant, NAMI and many other advocacy organizations had pushed strongly for requiring an order from a judge as a condition for allowing law enforcement officials to have access to private medical information. Subpoenas and warrants may be obtained without review by a judge.
Other provisions contained in the final medical privacy regulations include: