Privacy by rue

REAL WORLD EVENT DISCUSSIONS

Privacy

POSTED BY: RUE
UPDATED: Thursday, October 4, 2007 11:55
SHORT URL:
VIEWED: 585
PAGE 1 of 1

Thursday, October 4, 2007 10:40 AM

I have a vote and I'm not afraid to use it!

"Yes, the Notice of Privacy Practices says you can request information not to be released -- but it also says that the health-care provider and related businesses may deny your request for any reason or no reason. You might be thinking, at this point, well I just won't sign that anymore, but alas, it wouldn't matter in the least. Your signature does not mean that you agree to allow the disclosures described in the notice, but only that you have been informed of them."

Privacy Form Delivers Precious Little Protection to Citizens

You know the drill -- you appear for a first visit at a doctor's office or treatment clinic and among the routine papers for your signature is a Notice of Privacy Practices that explains the federal privacy standards set by HIPAA. You sign that too and all is well... or is it? In fact, the paper you have just signed notifies you that your right to privacy concerning even your most personal health issues no longer exists.

A common misperception is that the "P" in HIPAA stands for privacy. Actually, though the "Health Insurance Portability and Accountability Act" was initially intended to help consumers obtain continual health insurance coverage after leaving a job, despite certain preexisting medical conditions, as well as provide standards for electronic transmission of health-care information. Protecting the individual right to privacy in passing those records along was a secondary concern -- though an important one. The regulations to protect patient privacy put a burden on health-care providers and insurance companies -- particularly as the nation moves toward development of a national health information system. Addressing those concerns ("administrative simplification" as it was called by Congress) resulted in a complicated and ultimately ineffectual law that, on the one hand, recognizes and protects an individual's right to privacy with regard to health information -- but, on the other hand, fails to delineate those privacy rights that individuals should have. All this was explained to me by James C. Pyles, a Washington, DC, attorney who specializes in health privacy issues and legal issues associated with HIPAA. "I find this ironic, in that the original intent of HIPAA was to protect consumer rights," he told me.

Obviously doctors and other health-care providers need to be able to disclose information about diagnosis and treatments to insurance companies to the extent it is necessary for reimbursement -- that's not the issue. Rather, the problem is, the way HIPAA now reads makes it acceptable for doctors and insurance companies to use and disclose personal health information in identifiable form for routine purposes defined as treatment, payment or health-care operations -- terms that are so broadly defined, says Pyles, that the "least imaginative insurance company can justify nearly any disclosure in any situation, even if the patient wishes to pay privately." This right to disclose also extends to all business associates of insurance companies and physicians, with no requirement of an audit trail to keep records of these uses and disclosures.

WHY IT DOESN'T WORK TO JUST SAY NO

Yes, the Notice of Privacy Practices says you can request information not to be released -- but it also says that the health-care provider and related businesses may deny your request for any reason or no reason. You might be thinking, at this point, well I just won't sign that anymore, but alas, it wouldn't matter in the least. Your signature does not mean that you agree to allow the disclosures described in the notice, but only that you have been informed of them.

Pyles told me that the principal groups that supported the amended HIPAA Privacy Rule were the insurance companies and the American Hospital Association (AHA), which makes it easier for them to conduct business. In contrast, numerous medical associations, practitioners and consumer groups as well as Attorneys General of New York, California and Vermont protested how wrong it is to eliminate right of consent.

WORKING WITH THE WINDS OF CHANGE

An opportunity for improvement presents itself with the movement toward creation of a national registry of electronic health-care records. This has rightly stirred up considerable concern about HIPAA -- Pyles points out that in the past three years there have been more than 100 million data breaches in electronic records, so it's obvious that electronic information systems are not secure. Hacking in can result in instantaneous disclosure of millions of individuals' health information (HIPAA, as it now stands, would allow this to be disclosed on insurance company records and among their business associates, as well) and once the information has leaked, it's impossible to contain it. Among the intimate secrets that hackers can obtain about you, me and millions of others is genetic information, sexual orientation, prescriptions for mental health conditions, disease and diagnostic history -- and the list goes on. It's not hard to imagine patients deciding not to tell their medical providers about sensitive issues, such as drug abuse or mental health problems, which will in turn impair the quality of their care.

As Pyles says, "Once information is out there, it lives forever and electronic information nationwide will create the capacity to violate privacy on a scale we have never dreamed of." Not surprisingly, a number of politicians have joined the ranks to promote HIPAA reform recognizing, as Pyles says, that it is much easier to incorporate rules to protect privacy in the creation of electronic systems than to add them later.

Even though the push is on to revise the HIPAA law, we can't expect anything to change in the immediate future. So what can health-care consumers do today to protect private information?

WHAT YOU CAN DO

Frankly, says Pyles, there's precious little we can do to keep our information truly private -- but he offers a few suggestions to provide at least minimal protection...

Research your state's laws regarding privacy of health information. Some states have strong laws that protect privacy and HIPAA does not preempt them. Unfortunately it is difficult to find out which states these are, says Pyles, because the laws are often spread throughout the state code. You can learn more by calling the State Attorney General's office to inquire about your state -- but even with stringent laws concerning privacy, there is no way for you to know if your information has been revealed inappropriately.

Share your concerns with your doctor. Regarding disclosure of medical information, most doctors will abide by a patient's request for restrictions, rather than risk loss of your trust -- Pyles suggests reminding your doctor that he or she has an ethical obligation to disclose your identifiable health information only with your consent.
Pyles also advises that people request and check medical records to correct any errors.

Hospital patients should make a list of people to receive information. Put in writing the names of those you want to have access to information about your health status, and make sure doctors and nurses have the information and your permission.

Take a stand. You can also refuse to sign the Notice of Privacy Practices, or cross out the information about inappropriate disclosure, but this might preclude treatment in some places. Pyles says he modifies the notices before he signs them and has never had a physician's office refuse to treat him.

Get political. Become an active, involved citizen. Write to your Congresspersons to tell them you are in complete support of basic privacy rights in any national electronic health information system. It is a right guaranteed by the Constitution, after all, and without it, as Pyles points out, "life, health, job opportunities -- everything is at stake."

Source(s):

James C. Pyles, Attorney at law, senior partner, Powers, Pyles, Sutter and Verville, PC, Washington, DC.

NOTIFY: N | REPLY | REPLY WITH QUOTE | TOP | HOME

Thursday, October 4, 2007 11:08 AM

LEADB

Yep, when that crossed my plate I made all sorts of modifications to the form I was given, then I signed it. The receptionist looked at me a bit funny, but I did get in that day, and subsequent. However, as the above indicates, the thing is merely telling you 'how it is'; most of my modifications had to do with what I would do if they did what I didn't want them to do, and telling them what I wanted them to do instead. Probably didn't help any, but at least I was on record to objecting.

NOTIFY: N | REPLY | REPLY WITH QUOTE | TOP | HOME

Thursday, October 4, 2007 11:55 AM

FLETCH2

I actually read one that said that the hospital could use my data in marketing and clinical studies. Don't know if that was standard but like LeadB I explicity edited that out and initialed the changes before submitting it.

NOTIFY: Y | REPLY | REPLY WITH QUOTE | TOP | HOME

YOUR OPTIONS

SHARE THREAD

NEW POSTS TODAY

USER	POST DATE

USER

POST DATE