Since when are my medical records no longer private? Since April 14, 2003. Although the concept of a patient’s right to privacy dates back more than two thousand years to the creation of the Hippocratic oath, the Bush administration recently made an official change to the so-called privacy rule in the Health Insurance Portability and Accountability Act (HIPAA), a federal law governing the electronic exchange of patient information between doctors, hospitals, and insurance companies. The original HIPAA rule, written in 1996, gave patients the strict right of consent before any of their records were shared; the new rule eliminates the consent requirement, opening your records to more than 600,000 “covered entities” for “routine purposes.” Even in Texas, which has its own privacy laws, your records may no longer be yours and yours alone.
Whoa—who are these “covered entities,” and what’s a “routine purpose”? In addition to the groups you might expect to have access to your files—doctors (for treatment) and insurance companies (for payment)—“covered entities” include the pharmaceutical industry, credit bureaus, and some employers (those with privately administered health care plans). As for a “routine purpose,” critics say the term can be defined so broadly that it may open the door to innumerable privacy violations.
Such as? Let’s say you work for one of the 600,000 “covered entities.” During your first few years of employment, the company looks at your records to track your medical bills on its health care plan. Concerned that you’re costing it too much money, the company eventually decides to lay you off. Another scenario: In a few years, your newly independent daughter applies for health insurance. The insurance company has access to your records, discovers a genetic test that shows that you and your descendants have a high risk for breast cancer, and then raises your child’s premiums as a result. “The possibilities for such violations are endless,” says Austin psychiatrist Deborah Peel, a plaintiff in a federal lawsuit filed last year against the new rule. “But the worst part is that many patients will forgo health care, especially mental health treatment and genetic testing, because they’re afraid of who will get their hands on the information.”
Why was the privacy rule changed in the first place? Proponents say it will help speed the transfer of our health care information from bulky paper records to electronic files, improving efficiency and cutting costs. But opponents claim the rule was changed only after lobbyists for the health insurance and pharmaceutical industries put the screws to the Bush administration. These groups, the critics charge, want to use your records to customize their marketing. For instance, the makers of Cialis could find out that you take Viagra and send you a sample of their competing drug.
Why weren’t we told about this? We probably were and didn’t know it. Any of us who have visited the doctor since the new rule went into effect should have signed a HIPAA privacy notice informing us of the rule change—you know, one of those two-page, single-space documents written in dense legalese, the kind of thing we can’t make sense of before putting pen to paper.
Is there anything we can do to keep our records private? That’s where Texas comes into play. A section of HIPAA says more-stringent state laws and regulations can preempt changes made by the new privacy rule, and recent health care decisions by the state Supreme Court have recognized a strict right of privacy in our constitution.
So there’s nothing to worry about in Texas? Not exactly. In 2003 the Legislature passed a bill giving the state health commissioner the right to bring Texas’s medical privacy regulations into compliance with HIPAA’s. On November 1 a task force headed up by the attorney general’s office will issue a report on how our privacy laws differ from federal ones. But since the task force includes many representatives from the health care industry, critics like Peel say state laws protecting your medical privacy could be in line for an extreme makeover.
