For Immediate Release, 18 Feb 00
Contact: Chris Marshall
NAMI Submits Comments On Department Of Health And Human Services Medical Records Privacy Regulations
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) mandated Congress to enact by August 21, 1999, a national standard governing access to medical records. If the Congress did not act, proposals made by the Secretary of Health and Human Services (HHS) in September 1997 were to become the law of the land.
August 21, 1999 came and went, and Congress was unable to reach consensus on any of the medical privacy proposals before it. Thus responsibility for developing national medical privacy standards fell on the Secretary of HHS. On October 29, 1999, Secretary Donna Shalala issued draft regulations which can be accessed at http://aspe.hhs.gov/admnsimp/ NAMI's comments on these regulations appear below.
February 14, 2000
Margaret Ann Hamburg, M.D.
Assistant Secretary for Planning and Evaluation
U.S. Department of Health and Human Services
Washington, D.C. 20201
Dear Assistant Secretary Hamburg:
The National Alliance for the Mentally Ill (NAMI) is pleased to submit the following comments regarding proposed federal standards for protecting the privacy of individually identifiable health information, as published in the Federal Register, November 3, 1999. With more than 210,000 members who are persons with severe mental illnesses and their families, NAMI is the nation's leading grassroots advocacy organization solely dedicated to improving the lives of persons with severe mental illnesses including schizophrenia, bipolar disorder (manic-depressive illness), major depression, obsessive-compulsive disorder, and severe anxiety disorders. NAMI has 1,200 state and local affiliates in all 50 states and the District of Columbia. NAMI provides education about severe mental illnesses, supports increased funding for research, and advocates for adequate health insurance, housing, rehabilitation and services.
NAMI applauds the Administration for developing proposed rules to establish universal standards for protecting the privacy of individual health information. People with severe mental illnesses, as much as anyone, have historically been victimized by stigma and discrimination resulting from societal misperceptions about these disorders and the characteristics of those who suffer from them. The unauthorized release of information about psychiatric diagnosis and treatment status can impact in a devastating way on individuals who are the subject of that information, including loss of employment, housing, insurance or social rejection. At the same time, our members understand the importance of allowing information to be communicated among clinical treatment providers to facilitate good treatment outcomes and prevent adverse consequences stemming from negative drug interactions or other clinical errors.
In an era of increasing sophistication with respect to the storage and transmission of electronic medical records, NAMI recognizes the importance of developing uniform national health privacy standards to achieve uniformity in privacy practices instead of the patchwork quilt of uneven state medical privacy laws currently in existence. We appreciate the effort you have undertaken to develop standards that attempt to strike an appropriate balance between the critically important objective of protecting medical privacy and the equally important objective of facilitating access to necessary information for purposes of clinical treatment, research, care-giving, rights protection, and other purposes. Our comments regarding specific sections of the draft federal standards follow.
Rights and Procedures for Access for Inspection and Copying (164.514)
NAMI supports the strong right set forth in the proposed rule, with very limited exceptions, for individuals to inspect and copy protected health information about them maintained by a health care provider or covered health plan. We believe that consumers own their own personal health records, especially those parts that include individual identifying information, while providers and health plans are custodians of these records. As such, consumers should, as a general rule, have free and open access to their own records for purposes of inspection and copying.
Many existing state laws afford treating professionals broad discretion to deny consumers access to their own medical records. Individuals with mental illnesses are commonly denied access to their own records on the grounds that seeing these records might be detrimental to their emotional health or well being. We believe that the proper approach is to place the burden on treating professionals to provide clear justification for the denial of an individual's personal records. Thus, we are particularly pleased that the proposed rule would permit covered plans and providers to deny requests to inspect or copy one's own records only when a licensed health care professional determines, in the exercise of reasonable professional judgment, that inspection and copying is reasonably likely to endanger the life or physical safety of the individual or another person.
As currently worded, the proposed rule would allow any licensed health care professional to make the determination that providing access to health information would endanger life or physical safety of the individual or another person. NAMI believes that this decision should be made only by a medical professional directly involved in the treatment of the individual. We further recommend that consumers who disagree with decisions to deny them access to their own records should have the right to seek an independent opinion from a qualified third party medical professional with specific expertise in treating the medical condition at issue.
Frequently, medical records contain abbreviations, codes, or other forms of "shorthand" that may be understandable to qualified medical professionals but not understandable to health care consumers reviewing their own records. Under such circumstances, we recommend that the regulations should encourage treating professionals to provide face to face explanations to consumers of information contained in records that may not be clearly understandable. A face to face discussion of this nature may prove beneficial to the therapeutic relationship between patient and physician.
Disclosure of Protected Health Information (PHI) for Treatment, Payment or Health Care Operations (164.506(a))
The proposed rule would allow health providers, health plans and other covered entities to use or disclose PHI without individual authorization to carry out treatment, payment or health care operations. In fact, covered entities are prohibited from seeking individual authorization for the release of this information unless required to do so by state law. However, covered entities would be required to provide individuals with written notice of their information practices. Covered entities would be prohibited, except in the case of clinical trials, from conditioning treatment or payment for health care on obtaining consent.
An exception to this general rule is made for the disclosure of psychotherapy notes, which would require authorization. The definition of psychotherapy notes specifically excludes "medication prescription and monitoring, counseling session start and stop times, the modalities and frequencies of treatment furnished, results of clinical tests, and any summary of the following items: diagnosis, functional status, the treatment plan, symptoms, prognosis, and progress to date." (164.508 (a) (3) (iv) (A).
The rationale given in the proposed rule for departing from commonly accepted informed consent requirements is that the current health care environment affords individuals with little control over their health information. In fact, the authors of the proposed rule posit that individuals may be coerced into signing blanket authorizations as a condition for receiving treatment or third party payment for treatment. Moreover, under current informed consent requirements, PHI may be released for purposes other than anticipated by the individual, e.g. for marketing purposes. Therefore, the proposed rule attempts to make the exchange of PHI relatively easy for health care purposes and more difficult for other purposes such as the marketing of information, disclosures to employers, and other purposes.
NAMI recognizes and appreciates the importance of facilitating the efficient flow of information among those involved in the clinical provision of treatment. This may be particularly important for individuals who receive treatment from multiple medical providers. For example, a psychiatrist prescribing anti-psychotic medications to an individual who suffers from schizophrenia must be aware of other medications the individual is taking for non mental illness purposes to protect against adverse medication reactions or negative side effects. Additionally, it may be critically important for a psychiatrist treating an individual in an emergency room in one locale to communicate on a timely basis with a psychiatrist who previously treated that individual to learn about that individual's treatment history and specific treatment interventions that have worked in the past.
Nevertheless, NAMI believes that the federal rule should require that consumers/patients provide informed consent for the use or disclosure of their personal health information for purposes of treatment, payment, and health care operations. In an ever more complex healthcare environment, this is the best way to ensure that patients retain some control over sensitive medical information pertaining to them. This is particularly important for people who suffer from conditions such as schizophrenia, bipolar disorder, major depression and other severe mental illnesses which have historically been the subject of societal stigma and misunderstanding.
NAMI recognizes that a patient's refusal to provide for the release of PHI may create a dilemma for treatment providers concerned with receiving payment for their services. These situations can frequently be resolved through ongoing communications between treatment provider and patient. For example, an individual experiencing symptoms of paranoia may be unwilling to initially sign a consent form authorizing the disclosure of information for treatment, payment, and healthcare operations. However, through treatment and the formation of a trusting relationship, the treatment provider may be able to help the person understand the benefits of providing consent for these limited purposes. Therefore, in cases in which individuals with severe mental illnesses require urgent care, we strongly assert that healthcare providers should not condition this care on the willingness of the individual to provide authorization for the release of his/her medical information. Rather, in accordance with the Hippocratic oath, treatment should be provided to address the immediate symptoms of the mental illness. In many cases, it is likely that his/her patient will ultimately prove willing to provide consent after the immediate symptoms are successfully alleviated.
Preemption/Relationship to State Laws (160.203)
NAMI supports the approach set forth in the NPRM that these federal regulations are intended to serve as a floor but not a ceiling for individual medical privacy protections. Thus, the regulations would generally preempt State medical privacy laws, except to the extent that specific provisions in State laws afford stronger individual medical privacy protections.
Section 160.204 of the proposed rule sets forth procedures which would potentially allow States to submit written requests to the Secretary of HHS to except weaker provisions of State law from federal preemption. NAMI strongly urges that all State requests for non-preemption should include a process that is open for public participation. Members of the public and other interested stakeholders should be permitted to submit comments upon a State's request for waiver from the federal requirements, and these comments should be reviewed and considered by the Secretary in determining whether the waiver should be granted.
Disclosure to Next-of-Kin (164.510(l))
Parents or other family members of persons with severe mental illnesses frequently assume care-giving responsibilities for their ill family member. A 1992 survey of NAMI's membership revealed that 42% of a large sample of persons with mental illnesses lived with their family. The critical role that families play in enhancing treatment outcomes for persons with severe mental illnesses is increasingly recognized in clinical guidelines developed for the treatment of conditions such as schizophrenia and major depression. Despite this, treatment providers frequently cite confidentiality concerns as a reason not to communicate fundamental information to families. To be sure, families generally do not require access to all information revealed in the course of a therapeutic relationship between a mental health professional and a family member who suffers from mental illness. However, families who assume care-giving responsibilities do need information fundamental to providing care, such as diagnosis, treatment plan, medications and side effects, prognosis and community resources.
We are therefore very pleased that the draft regulations specifically allow covered entities to disclose PHI to next-of-kin, other family members or close personal friends if (a) the individual who is the subject of the PHI verbally agrees to such disclosure, or (b) in circumstances where such agreement cannot practicably or reasonably be obtained.
NAMI also agrees with the language in the proposed rule specifying that only that information "directly relevant to the person's involvement in the individual's health care" should be disclosed. (164.510 (l) (ii)).
Historically, treatment providers have frequently assumed that they cannot share information with family members of persons with severe mental illnesses. The proposed rule creates a presumption in favor of the sharing of information, in accordance with good clinical practices, absent specific dissent by the individual who is the subject of the PHI.
NAMI supports bringing all research, including privately funded research, under the federal Common Rule and therefore IRB review. IRBs should be responsible for all research, regardless of funding source, and their review of waiver requests should be part of their overall review process. While bringing all research within the Common Rule may require consensus among the various federal agencies subject to the requirements of the rule, this would be preferable to creating specialized "privacy boards" for the purpose of reviewing research authorization waivers and not other aspects of research.
The eight criteria for IRBs or privacy boards to follow in reviewing waivers are set forth in Section 164.510 (j) (3) of the proposed rule. The first four criteria are already included in the section on waivers of informed consent contained in the Common Rule. NAMI supports the additional criteria set forth in the proposed rule and recommends that they be added to the criteria set forth in the waiver provisions of the Common Rule.
Historically, research information generated in the course of conducting research has been kept formally separated and distinct from clinical information used in the provision of patient care. Over the past several decades, the interests and privacy concerns of our members who participate in research have been generally well addressed through this clear, physical distinction between clinical/medical records on the one hand and research records on the other. When researchers gather data relevant to a consumer/patient's clinical care, this should be entered into the medical record and governed by the HHS medical privacy regulations. Research data which has no or unknown relevance to clinical care should remain in a separate record, not subject to disclosure.
While we believe that this separately maintained research record affords the greatest security for our members, the issues of inappropriate release and patient access to medical information are very important. Years of experience with research suggest that neither inappropriate release of research information nor denial of access have been problematic. Should this history change, we would revisit this issue, but the approach currently taken in the draft regulations of separating research information into the categories of information "related" and "unrelated" to treatment represents a solution in the absence of a problem.
Judicial and Administrative Proceedings (164.510(d))
NAMI is very concerned that the proposed rule would allow one party in litigation to obtain the private medical records of the other party in the litigation merely upon assertion in a subpoena that the first party's health status is at issue in the litigation. This is particularly a problem for people with mental illnesses, because mental health status is frequently raised as an issue in litigation that, on its face, may seem to have no relevance to mental illness. For example, one party in litigation may raise the other party's mental illness in an effort to damage his/her credibility. We strongly recommend that the final rule must afford individuals whose personal health information is requested through a subpoena or a similar mechanism for obtaining information in civil litigation the right to reasonable notice of the subpoena and a reasonable opportunity to move the court to quash the subpoena, or at least the section of the subpoena requesting the health information.
Law Enforcement (Section 164.510(f)).
While the proposed rule addresses law enforcement is a way that is a significant improvement over the recommendations issued by the Department to Congress in 1997, NAMI believes that it does not go far enough in protecting individual medical privacy rights. For example, the proposed rule would allow law enforcement agents to demand medical information from health care providers, hospitals, insurance companies, or others merely upon their representation that the information sought is relevant and material to their investigation. No judicial oversight or probable cause determination is required.
As discussed in great detail in the comments submitted by Georgetown University's Health Privacy Project, the proposed standard for access to private medical information by law enforcement officers is far less protective than standards currently in law governing video records, cable television records, educational records, or press records. We assert that protections in the final regulations for individually identifiable medical records must be at least as strong as those existing in these other areas. Thus we recommend that the final regulations should require a probable cause or similar judicial determination before law enforcement officials can access private medical records.
Disclosures for Governmental Health Data Systems (Section 164.510(g))
Section 164.510(g) of the proposed rule would permit covered entities to "disclose protected health information to a government agency, or private agency acting on behalf of a government agency, for inclusion in a governmental health data system that collects health data for analysis in support of policy, planning, regulatory or management functions authorized by law." Although we understand and support the wisdom of permitting information to flow to government health data systems under some circumstances, this proposed language creates potentially troubling consequences as well.
Currently, only 22 state mental health systems in the nation can offer unduplicated counts of persons with mental illnesses served in their systems. NAMI has been strongly advocating for all states to develop unduplicated counts of the persons they serve for purposes of analysis, policy development and planning. The proposed rule would allow states to proceed with collecting this important information.
On the flip side, NAMI is concerned that the proposed rule would allow state law enforcement agencies, motor vehicle administrations, and other agencies not directly concerned with mental health services to collect information about persons with mental illnesses, potentially for far less beneficial or enlightened purposes. We are concerned about abuses of individual rights that could potentially occur through these mechanisms.
While NAMI is dedicated to promoting improved data collection activities by state mental health agencies, we are not comfortable with affording unbridled access to sensitive mental health information to all government agencies. A potential solution would be to address our concern about good data collection practices through a minor alteration to the definition of "health care operations." We recommend that the terms "health plan" and "health care providers" in the definition of "health care operations" should include public agencies responsible for the provision or administration of health care services to members of the public, including state mental health agencies.
Civil Rights of Institutionalized Persons
NAMI is concerned that the proposed rule would inadvertently hinder investigations undertaken by the Department of Justice Civil Rights Division under the Civil Rights of Institutionalized Persons Act (CRIPA). This Act is an important source of protections for vulnerable individuals with severe mental illnesses or other mental disabilities in civil or criminal institutions. Over the years, CRIPA investigations have led to important reforms and more humane treatment for people with severe mental illnesses in numerous institutional facilities across the country. To conduct these investigations, the Department must have access to the medical records of individuals presently or previously residing in these institutions.
An easy solution to this problem can be accomplished by specifically citing the Department of Justice Civil Rights Division and its investigations under CRIPA in Section 164.510(b) of the regulation, the health care oversight section. This minor modification to the regulation would have significantly positive implications for civil rights protections of vulnerable individuals with severe mental illnesses or other mental disabilities who are in institutional facilities.
NAMI greatly appreciates the monumental effort undertaken by the Administration to develop comprehensive and fair federal standards governing medical records privacy. In behalf of our more than 200,000 members, we also appreciate the opportunity to comment on the proposed standards. Thank you for considering our views. We look forward to discussing them further with you. Please feel free to contact me or Ron Honberg, our Legal Director, at 703-524-7600.
Laurie M. Flynn