Articles

Jobs

Education

News

Links

 

Related Sites

Consumer Project on Technology's medical privacy page

Electronic Frontier Foundation's medcial record privacy archive

Patient privacy legislation deadline comes and goes with no bill

Posted 8-23-99
By
Richard A. Marini

Washington. Congress missed its deadline for passing medical privacy legislation, but there's still time to act.

The Health Insurance Portability and Accountability Act of 1996 requires that if Congress failed to act by Aug. 21, the U.S. Department of Health and Human Services (HHS) must issue privacy regulations by Feb. 21, 2000. The HHS is not yet scrambling to draft those rules.

"There have been some internal meetings, but we've told Congress we prefer that they pass legislation to guarantee medical privacy for all Americans," said HHS spokesperson Melissa Skolfield. The Kennedy-Kassebaum bill, as the 1996 legislation is called, restricts HHS to issuing guidelines for electronic records. It has limited authority over paper records.

Despite the missed deadline, Congress could still pass legislation before February. Indeed, Rep. Benjamin Cardin, D-Md., continues to work with House Ways and Means Subcommittee on Health Chair Bill Thomas, R-Calif., on a confidentiality bill, according to Cardin's press secretary, Susan Sullam. "We don't believe the Kennedy-Kassebaum deadline is hard and fast," she explained, adding that it's too early to discuss details of the proposal.

According to Skolfield, any HHS regulations would closely follow the five principles for medical privacy previously enumerated by HHS Secretary Donna Shalala. These include:

  • Boundaries-healthcare information should be disclosed for healthcare reasons only.
  • Security-organizations possessing healthcare information should take steps to protect it.
  • Consumer control-patients have the right to know what's in their medical records, who has access to them, and to change incorrect information.
  • Accountability-anyone using healthcare information improperly will be punished.
  • Public responsibility-there must be a balance between protection of privacy and use of medical information for the public good, for example, research, public health, and the fight against healthcare fraud and abuse.