New HHS Rules Mute Hospital Staff, Health Workers
Daugherty, Rebecca, News Media and the Law
The U.S. Department of Health and Human Services received more than 52,000 comments on its proposed medical privacy rules - at least two of which were from journalists' organizations.
Not surprisingly, final rules published in late December restrict the information any health care providers can make public and promise to penalize employees who give out patient information without, at least in most cases, written consent from the patients themselves.
In the 330 pages in the Federal Register devoted to addressing comments, the agency did not address journalists' concerns that the new rules will hinder reporting.
The complicated rules take effect in late February, but health care providers will have two years to implement them. The rules set minimum standards for what the health care industry must keep secret. They displace existing state laws that are less strict, but they allow states to impose their own more stringent rules against disclosure.
President George W. Bush has put on hold those regulations adopted late in the Clinton administration.
Except for some directory information, journalists will not likely obtain any identifiable patient information unless the information is leaked to them, and leakers will face new penalties. These rules do not actually set the penalties for unauthorized disclosure of patient information, but promise that separate regulations will address monetary penalties and the referral of criminal cases when the rules are violated. The law allows both civil and criminal penalties including civil fines of $100 per incident up to $25,000 a year, and criminal penalties as high as $250,000 or ten years imprisonment.
The proposed rules only addressed complaints from patients about disclosure of patient information, but the final rules allow anyone to make a complaint about patient privacy to the government and any complaint can result in penalties for disclosure.
In another change, the agency extended the privacy rules to cover not only electronic records, as described in the law and in the proposed rules, but records in paper form as well.
The rules require secrecy about patients not only from hospitals but from a wide range of health plan and health care providers as well - even ambulance services and pharmacies are covered.
Even the standard directory information that hospitals traditionally have made available will be limited under these rules. Without consent, hospitals can only release patients' names, where they are located within the facility, and their condition, described only in general medical terms. This is not markedly different from the rules most hospitals already observe, but under the new rules, even this information cannot be released unless a patient has an opportunity to object to the disclosure, or unless the patient is incapacitated or an emergency exists.
And even when it is impossible to obtain a patient's consent, disclosure is only allowed if it would be "consistent with a prior expressed preference" of the individual known to the hospital, or disclosure would be "in the patient's best interest according to the professional judgment of the health care provider." If disclosures are made, the patient must be given the opportunity to object to further disclosures as soon as is practicable.
The rules regarding exceptions to written consent do not mention journalists - either by excluding or including them. They do mention health care institutions, family members, close friends, other persons assisting in care, government agencies and disaster relief agencies. One section addresses uses for marketing purposes. Only twice in the lengthy commentary on the rules, does HHS mention journalists' access at all. Two deprecatory references each say that an exception allowing minor disclosure "is not intended to allow disclosures to a broad range of individuals, such as journalists who may be curious about a celebrity's health status. …