Proposed Federal Medical Privacy Standards (HIPAA)
The Health Insurance Portability and Accountability Act of 1992 (HIPAA) mandated Congress to enact by August 21, 1999, a national standard governing access to medical records. If the Congress does not act, proposals made by the Secretary of Health and Human Services (HHS) in September 1997 will become the law of the land.
August 21, 1999 came and went, and Congress was unable to reach consensus on any of the medical privacy proposals before it. Thus responsibility for developing national medical privacy standards now falls on the Secretary of HHS. On October 29, 1999, Secretary Donna Shalala issued draft regulations. Comments on these regulations must be submitted by February 17, 2000.
The draft HHS regulations are complex and multifaceted.
Treatment providers and health plans would be allowed to disclose a patient’s protected health information (PHI) without authorization for purposes of treatment, payment, and health care operations related to payment (such as quality assessment; performance review; training programs; licensing and audits). However, separate voluntary authorization would be required for the use and disclosure of psychotherapy notes. Allowing disclosure of PHI for purposes of treatment, payment and health care operations is inconsistent with NAMI’s policy, which incorporates informed consent as a cornerstone.
Individuals would have the right to see and copy their own health information, except when such access would endanger the life or safety of any individual. (This is a far narrower exception than currently exists in most states laws, where treatment providers or health plans have broad discretion to deny access to individual health records). Allowing consumers to see and copy their own health information is consistent with NAMI’s policy.
The draft HHS regulations would permit treatment providers or health plans to disclose protected health information to family members if the individual has agreed to such disclosure or when such agreement cannot be practicably or reasonably obtained. Only information directly relevant to the family member’s involvement in the individual’s health care may be disclosed. This is consistent with NAMI’s policy, which states that treatment providers are responsible for making known to caring families and caregivers any information necessary to the ongoing care of persons with serious mental illnesses.
The draft HHS regulations serve as a baseline of minimum privacy protections, and allow states to maintain and enact laws that are more protective of individual privacy rights. This is consistent with NAMI’s policy, which specifies that states should be allowed to preempt the national standard with laws that are more protective of individual privacy rights.
The draft HHS regulations would prohibit treatment providers or health plans from denying treatment, enrollment in a health plan or payment of a claim if he or she refuses to authorize disclosure of psychotherapy notes. While this appears consistent with NAMI’s policy, the issue of conditioning care upon the provision of consent is largely irrelevant in the context of the HHS regulations because they would not require consent for purposes of treatment, payment and health care operations.