Health System Warily Prepares for Privacy Rules

Sun Apr 6 15:00:37 EDT 2003

--- begin forwarded text

Date: Sun, 6 Apr 2003 11:06:01 -0400
To: "Philodox Clips" <clips at philodox.com>
From: "R. A. Hettinga" <rah at shipwright.com>
Subject: Health System Warily Prepares for Privacy Rules
Sender: <clips at philodox.com>
List-Subscribe: <mailto:clips-on at philodox.com>

<http://www.nytimes.com/2003/04/06/national/06PRIV.html?th=&pagewanted=print&position=top>

The New York Times

April 6, 2003

Health System Warily Prepares for Privacy Rules
By ROBERT PEAR

WASHINGTON, April 5 ‹ When Dr. Stephen C. Albrecht of Olympia, Wash.,
called a hospital in Tacoma recently to inquire about one of his patients,
an 18-year-old treated for an infectious disease, he had trouble getting
information.

Under a new policy at the Hebrew Home of Greater Washington, a 558-bed
nursing home in Rockville, Md., callers can get information about patients
only if they have a password or "verification code."

And Dr. Matthew J. Messina, a dentist in Fairview Park, Ohio, near
Cleveland, said he had changed the schedule posted each day in his
treatment room, so patients would be identified only by their first names.

New federal rules to protect the privacy of medical records take effect on
April 14 and the changes have touched off a quiet revolution in the health
care industry. Doctors, hospitals, drugstores and other health care
providers must limit the disclosure of information about patients.

>From big teaching hospitals in New York to tiny clinics in west Texas, much
of the industry is preoccupied with the new standards, which will be
noticeable to anyone who visits a doctor or a dentist. Providers must now
give a written "notice of privacy practices" to every patient, and the
notice must be posted in a prominent place in every office, clinic and
hospital.

The notices tell patients how their medical information may be used and
advise them of their rights, including the right to inspect and copy their
records and request corrections. Patients can get copies of doctors' notes,
X-rays and laboratory results, as well as data collected on them by their
insurance companies.

Rarely have federal rules had such pervasive effects on the health care
industry. "It's a new era," said Dr. Spencer Foreman, president of
Montefiore Medical Center in the Bronx.

The rules affect not only health care providers but also their "business
associates," including answering services and the people who transcribe the
notes dictated by doctors after examining patients.

A whole industry of consultants is advising health care providers on how to
comply. They sell training manuals, software, security devices and other
technology to prevent the improper disclosure of health care information.
They highlight the need for their services by noting that violation of the
rules is punishable by civil and criminal penalties, including a $250,000
fine and 10 years in prison for the most serious offenses.

"The compliance seminars that I've attended are frightening and at times
overwhelming," said Dr. Michael J. Marcello, a family doctor in Mathews,
La. "The rules are vast and full of nuances."

But Joy L. Pritts, a privacy expert at Georgetown University, said the
federal standards would be "a major beneficial change for consumers in the
many states that don't have statutes telling patients how they can get
their own medical records."

Federal officials say the new rules should not interfere with the flow of
information needed to treat patients and pay claims. But doctors and
hospitals, uncertain about what the rules allow, have become much more
cautious about sharing or disclosing information.

Dr. Albrecht was surprised when even he had difficulty getting information
about his 18-year-old patient.

"The emergency room physician at the hospital in Tacoma would not discuss
his care, the X-ray results or the lab studies for my patient, for fear of
violating the federal rules," Dr. Albrecht said. "I don't know who was
right legally, but I do know that the rules are creating a lot of
confusion."

Researchers, journalists and clergy members say hospitals are refusing to
provide certain types of information that has been routinely available for
many years.

Alicia Mitchell, a spokeswoman for the American Hospital Association, said,
"The rules clearly mean that less information will be available to news
media and the public."

Scientists are racing to get permission from patients who were unaware that
their health information was being routinely used for research without
their consent.

Dr. David Korn, senior vice president of the Association of American
Medical Colleges, said: "Community hospitals are becoming much less willing
to give researchers access to medical information on their patients,
including those who were treated 5, 10 or 15 years ago. Some hospitals have
concluded that the burden and costs and the threat of liability are not
worth it."

The rules, issued under a 1996 law, the Health Insurance Portability and
Accountability Act, were written by the Clinton administration and
endorsed, with changes, by the Bush administration.

Advocates of the rules cite many cases in which people were harmed or
embarrassed by a breach of medical privacy. Workers with H.I.V. or mental
illness have lost their jobs. Computer hackers have gained access to
treatment records for thousands of patients. Drugstores have shared records
with companies marketing prescription drugs.

In general, the rules say, health care providers must limit the disclosure
of personal health information to the "minimum necessary" to achieve a
given purpose. In practice, that means a multitude of changes.

Many doctors have changed sign-in sheets in their offices, so patients do
not have to indicate the reasons for their visits.

Dr. Conrad L. Flick of Raleigh, N.C., said he had removed the names of
patients from the outside cover of their charts and installed a glass
partition, so staff members could not be overheard as they schedule
appointments on the telephone.

Many doctors, like Deborah G. Haynes in Wichita, Kan., have taken a simple
precaution to conceal patients' names. When charts are placed in boxes or
racks outside examining rooms, nurses make sure the names face the wall.

Elsewhere, doctors and nurses have been told to lower their voices and
minimize the use of patients' names in hallway conversations. Many doctors'
offices and hospitals have installed privacy screens on computers.

Montefiore Medical Center in the Bronx has put up walls in the reception
area where patients are interviewed prior to admission.

Giant Food, which operates more than 100 pharmacies at its grocery stores
in the Washington area, has told shoppers to "expect some delays at the
pharmacy counter." Under the federal rules, Giant notes, each person
filling a prescription will be given a notice of the company's privacy
practices and will be asked to sign a form acknowledging receipt.

In a leaflet for customers, Giant says: "You must now pay for all
prescriptions and regulated items, such as insulin and needles, in the
pharmacy. This procedure keeps your health information from being shared
with other store associates, who are not trained in privacy compliance."
Until now, Giant customers could pay for prescriptions in the grocery
checkout lines.

Many Blue Cross and Blue Shield plans will not discuss claims with the
spouse of a subscriber unless the subscriber has signed a form authorizing
such discussions.

At Blue Hill Memorial Hospital, on the coast of Maine, Linda O. Abernethy,
director of patient care services, said the federal rules made it more
difficult to arrange for meals to be delivered to people discharged from
the hospital.

"In the old days," she said, "a social worker could pick up the phone and
ask Meals on Wheels to deliver lunch to Mrs. Jones five days a week. Under
the federal rules, we'll now have to get a release from Mrs. Jones so we
can tell Meals on Wheels that, as a diabetic with cardiac problems, she has
special dietary needs."

William A. Dombi, vice president of the National Association for Home Care,
said the federal rules were changing the culture of home care agencies,
making it impossible for nurses to tell patients about the condition of
homebound neighbors.

"A visiting nurse can no longer tell Mabel that Gladys, with her broken
hip, is walking better than she did last month," Mr. Dombi said. "Those
informal communications are no longer allowed."

Under the rules, a hospital can disclose a patient's "condition, described
in general terms" ‹ good, fair, serious or critical ‹ but only to callers
who ask for the patient by name. If a journalist asks about patients
injured in an auto accident but does not know their names, the hospital is
not permitted to release any information. Moreover, each patient must be
given an opportunity to opt out of the hospital directory. In that case,
the hospital will not confirm whether the person is a patient.

-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

--- end forwarded text

-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at wasabisystems.com