Wall Street Journal examines concerns over limits of HIPAA Medical Privacy Rule

The Wall Street Journal on Saturday examined how forms that outline the medical privacy rule under the Health Insurance Portability and Accountability Act "essentially detai[l] the many ways a doctor can use and disclose medical information -- often without a patient's consent or knowledge" -- and how patients who visit physician offices, hospitals and pharmacies mistakenly "assume signing somehow protects their privacy" (Francis, Wall Street Journal, 10/21).

The HIPAA Federal Privacy Rule allows health care providers to share patient medical records for the purposes of treatment and other "health care operations."

Providers do not have to obtain written consent before they disclose medical records but are required to inform patients of their rights and make a "good-faith effort" to obtain written acknowledgment from patients that they have received the information.

Providers must obtain consent from patients before they can disclose medical records in "nonroutine" cases (Kaiser Daily Health Policy Report, 3/11/05).

According to critics, the rule allows providers "to put medical information to myriad uses," the Journal reports.

For example, providers can hire outside companies to survey patients on customer satisfaction or hire third-party marketers to advertise their products.

Although the rule allows patients to extend restrictions on the use of their medical records through written agreements, providers do not have to agree to the terms under federal law.

In addition, although violation of the rule can result in fines, the Office for Civil Rights, which received more than 22,600 complaints between mid-April 2003 and Sept. 30, to date has not issued any fines. Karen Hinton, a spokesperson for Patient Privacy Rights, said, "It's impossible to violate HIPAA."

However, Thomas Wilder, vice president for private market regulation at America's Health Insurance Plans, said that the rule encourages "the appropriate use of information" and discourages "inappropriate sharing" (Wall Street Journal, 10/21).