10/11/99

Open Secrets.

Federal law does more to protect the privacy of your video rentals than it does to keep your medical records confidential. Congress was supposed to deal with that-but so far it hasn't.

In 1996, when Congress approved legislation making it easier for people to carry health insurance policies from one job to the next, it gave itself three years to resolve another important health policy issue: how to protect the confidentiality of patients' medical records.

But the self-imposed deadline came and went on Aug. 21, while lawmakers were away on their usual monthlong summer recess. Now the Clinton Administration gets a shot at making the rules, and even Donna E. Shalala, the Secretary of the Health and Human Services Department, says that's not such a great idea. Selling medical information is a multibillion-dollar business.

Details of patients' doctor and hospital visits-for everything from the flu to abortion to depression to cancer-can be found on enormous databases. Insurance companies and employers can access countless records-with names attached-over the Internet. One Web site, operated by Toronto-based MIB Inc., allows insurance companies to look at an individual's medical past before deciding whether to accept his or her application for insurance coverage. Employers who run their own insurance plans (and most large companies do) also have access to employees' medical records.

"The unwarranted disclosure of medical problems isn't only embarrassing, it can result in the denial of insurance, jobs, and even bank loans," Shalala wrote in a Los Angeles Times op-ed column in which she urged Congress to meet the Aug. 21 deadline. Federal law does more today to guarantee the privacy of our choice of video rentals than it does to protect our medical histories. But privacy concerns have been a low priority on Capitol Hill. Members of Congress are aware of the issue, but it is not something they wake up in the morning wondering about, said Sen. James M. Jeffords, R-Vt., who chairs the Health, Education, Labor and Pensions Committee, which has jurisdiction over the subject. Part of the complacency is attributable to the lack of public pressure. Recent surveys show that more than 80 percent of people believe their medical privacy is already protected under federal law. "People don't know when their privacy has been violated," said Janlori Goldman, the director of Georgetown University's Health Privacy Project. "They're afraid that employers are getting access, they're afraid of the repercussions, but they don't know."

"It's up to legislators," said Jeffords, "to create the federal laws that people believe they already have. It's not something that you think about until it happens. People are unaware of how intrusive the Information Age technology has become, or how vulnerable their records are." And those people who have had their privacy breached are reluctant to dredge up their embarrassing stories to further the cause, patient advocates explain.

The best shot at action came before Congress's August recess, when Jeffords wrote a bill, got Sen. Christopher Dodd, D-Conn., to co-sponsor it, and scheduled a date for a committee vote. But the process came to a halt when Sen. Sam Brownback, R-Kan., an anti-abortion force on the committee, charged that the bill would be a setback for abortion foes. At issue was whether parents should be able to see the medical records of minor children who have sought medical care on their own.

Anti-abortion advocates argued that parents have a right to know whether their children are getting abortions, contraceptives, or any type of medical care. Abortion-rights advocates and mental health professionals countered that minors might forgo important medical care-for instance, treatment for substance abuse or depression-if they knew their parents could see their records. They noted that many state laws allow minors to get certain types of care on their own, and said that allowing parents to see medical records would violate the intent of those laws. Jeffords scheduled, and then canceled, several committee markups until Congress finally adjourned for its August recess.

When it passed the Health Insurance Portability and Accountability Act, Congress gave itself three years to pass a privacy bill that would both protect patients and make sure that important information was readily available for research and law enforcement, and to improve quality in the health care system. Because Congress missed the deadline, Shalala is required by statute to issue regulations governing the privacy of medical records by Feb. 21, 2000. Even Shalala has said she prefers that Congress fix the problem, partly because HHS has only limited authority in the area. For example, the regulations could apply only to electronically transferred information, and not to the 90 percent of medical records that are still on paper. Nevertheless, Shalala is prepared to issue draft regulations by the end of October.

Jeffords and several other key members of Congress say they'll try to pass legislation before Shalala issues her final regulations on Feb. 21. But it will be an uphill fight. There's little time left in this session of Congress; the House has barely begun working on the issue; and there's no evidence of an emerging consensus on minors' rights and other important questions, such as who would have access to patients' information, whether federal law should trump stronger state laws, and whether victims should be able to win large legal awards. Fear of the Known Consumer advocates say they fear the public will wake up to the importance of privacy legislation after new rules are in place and it's too late for them to have a say. For some people, the issue is already of intense concern.

The California HealthCare Foundation released a survey in January that found that one in six adults had done something out of the ordinary to keep medical information confidential. People reported that they had changed doctors, paid out-of-pocket even though they were insured, avoided seeking care to prevent disclosure to an employer, given inaccurate or incomplete information on medical histories, asked a doctor to not write down the health problem, or asked a doctor to record a less-serious or less-embarrassing condition.

What are they afraid of? Consider the case of Robin Kaigh, a New Jersey contracts lawyer who has become a privacy advocate. Her father, a doctor, didn't want anyone to know that he was dying. He had a rare form of cancer, and his colleagues persuaded him to allow slides with his cancer cells to be used `anonymously' for research and education. By mistake, his name appeared alongside the slides, and it wasn't long before his colleagues were calling to say how sorry they were that he was dying.

Paul Appelbaum, the chairman of the psychiatry department at the University of Massachusetts Medical School, said he frequently sees fears about disclosure play out in his office. "I treated a working-class man, a plumber, who wanted to pay out-of-pocket for his treatment. I said, `Well, it's pretty expensive. Why not let your insurance cover it?' He said that his insurance was paid for by his union and that he didn't want the guys at the union to know he was seeing a shrink. He worked overtime for three years to pay for the cost of his treatment."

For others, the concern is that employers won't hire or promote them-or may even fire them-if some costly medical condition becomes known. And they worry that insurers won't sell them policies for the same reason. Could that really happen?

A 1996 survey conducted by David F. Linowes, a professor of political economy and public policy at the University of Illinois (Urbana-Champaign), questioned executives at 300 Fortune 500 corporations about their use of medical information. More than one-third of the respondents-35 percent-said they looked at people's medical records before making hiring and promotion decisions. On Capitol Hill, nurses and other health care professionals have testified that their corporate bosses have leaned on them to turn over medical information about employees.

Most large companies self-insure or finance their own insurance programs for their employees. In some cases, the employer also administers the program. "It's Helen in personnel who's looking at all the forms, and knows whether you're seeing a psychiatrist, you just had your tubes tied, or you've just been diagnosed with cancer," said Appelbaum. Even if the company hires an administrator, such as Aetna-US Healthcare or Prudential Insurance Co., the company can often instruct the administrator to identify the highest-cost employees.

These dangers, whether real or perceived, create another that is all too real: that patients won't get optimum care, said Thomas Reardon, the president of the American Medical Association, which is pushing for privacy protections. "If medical records aren't private and confidential, people aren't going to tell their physicians things" that are important, he said. "They tell their physician things they wouldn't tell their clergy, their spouse, or their best friend. A lot of that information is very helpful in treating patients."

It's not hard for employers, insurers, and researchers to get medical information. A number of Web sites provide detailed information to any insurance company or self-insured company that's willing to pay a membership fee. Some of them require the members to sign contracts stating that the information will be used only to detect claims fraud. (An insurer doesn't want to pay a patient's claim if another insurer has already written a check.) Other Web sites state plainly that insurance companies may use the information in deciding whether to sell a person a policy. Balancing Act The challenge for Congress is addressing the legitimate fears of patients without preventing the vast amounts of medical information that can now be processed electronically to be used for legitimate and even heroic purposes.

Advocates of disseminating medical information say health plans can't improve quality, law enforcers can't solve some crimes, researchers can't cure diseases, and public health officials can't protect the public, unless they all have easy access to medical records. Public health officials want to use the information in medical records without getting patients' permission, and they're exploring ways to code patients' files so that names can be removed, but that records can be traced back to the patient when necessary.

"We [can't] have information and the ability to analyze information shut down through the legislation," said Karen Ignagni, the president of the American Association of Health Plans, which represents most of the nation's HMOs. "Everyone talks the talk of quality, but if we're going to walk the walk, we really need information to evaluate medical practice, to evaluate the effectiveness of disease management prevention. If we don't have that, we can't take the next step to bring the health care system into the 21st century.

"We've gotten to the tough issues where the entire future of the health care system and the ability to deliver on the promise of quality health care is contingent upon having information to assess progress toward that goal," said Ignagni. "How do you balance that very real social need with the rights of the individuals and the legitimacy of the concerns that, `I don't want my individual experience or record to be disclosed or known.' " That leaves lawmakers with a series of tough questions to be answered:

* Access. Who should have access to medical records? Most of the bills introduced in Congress, plus Shalala's initial recommendations, list various categories of people or companies that can have access without asking anyone's permission. Appelbaum says that the Republican bills provide the least amount of protection. "Although labeled as patient privacy bills, in fact most of them would ... strip from patients the control over dissemination of their medical information."

Currently, before a physician can release a patient's information, that patient must give written consent to the information's use for a specific purpose. Under many pending bills, patient consent would not be required to secure the release of information for treatment purposes (if a doctor thinks another of the patient's doctors should have information); for payment purposes (to an insurance company or HMO); for health care operations (for an insurance or pharmaceutical company, for example); or for law enforcement, hospital directories, or research.

* State pre-emption. Should stronger state laws be allowed to trump whatever federal law is established? State laws vary wildly. If the rules come by way of HHS regulation, there will be no state pre-emption, because HHS rules don't prevail over state laws.

* Private right of action. Most members of Congress agree that privacy laws won't be effective unless they can be enforced. But the issue of lawsuits is difficult. Various Democrats want high caps on civil penalties or no caps at all for violations of privacy laws. Republicans want some limits.

* Minors' rights. The abortion question is what's holding up action in Jeffords' committee. About half of all states require parental notification or consent before doctors can perform certain procedures, such as abortion. Other states allow minors to seek such treatment without their parents' knowledge, but give parents the right to see the records.

In still other states, minors can get the care and have their records kept private. Jeffords had scheduled a committee markup, and had narrowed potential amendments to a handful, when Brownback objected. Jeffords drafted a compromise that he hoped would suit Brownback, Dodd, and ranking Democrat Edward Kennedy of Massachusetts. The compromise would have essentially left the question to the states, letting them continue on whatever course they had chosen. Anti-abortion and abortion-rights advocates were summoned to bless the compromise, but abortion-rights advocates objected.

"It's not OK to ignore this and let the states deal with it," said Joanne L. Hustead, the director of legal and public policy of the Washington-based National Partnership for Women & Families. "It doesn't work, because we're creating a new set of federal rights, and it's irresponsible to punt this to state law. By punting to state law, you're punting to a whole lot of uncertainty." What's needed, says Hustead, is Jeffords' original language, which would keep allowable medical services confidential. If the state says a minor can get the care without parental consent, then the minor should be able to keep that care private, she said. "The only way you can provide health care confidentially is if it's confidential on the day of the service, and the week after, and the month after that," said Hustead.

The anti-abortion community argues differently. The National Conference of Catholic Bishops was perfectly happy with the compromise language, said Richard M. Doerflinger, the associate director of the secretariat for pro-life activities. "We didn't go looking for this [battle]. We would have been OK with leaving it up to the states," said Doerflinger, who argued that a substantive federal policy on either side of the issue would be so controversial that it would lead to no bill at all. "We don't want Congress doing anything new that puts parents in worse shape."

Outlook in Congress Jeffords needs to break the stalemate over minors' rights or cede the entire privacy issue to the Administration. "He has to figure out whether the group he's going to appease is fellow Republicans or Democrats on the committee," said Doerflinger. Jeffords is a self-proclaimed abortion-rights Republican, but he has checked many of his personal beliefs in his role as chairman of the committee.

Jeffords says he won't schedule another committee markup for the bill until the issue of minors' rights is settled. He says that his personal preference is to define the issue in federal law. "If you just don't mention the issues, it leaves it open to litigation." However, he said, "if you try to define them, you run the risk of not getting it accepted." Both Republicans and Democrats agree that a bill, to move quickly, must have bipartisan support. Congressional aides hope the issue will not stir up any big fights.

But that's just about impossible, said Ignagni. "We really are living in extraordinary times, where it is difficult in the congressional arena to actually move forward on what are legitimate policy proposals vs. having political discussions," she said.

Even if Jeffords wins approval in his committee, a bill must also go through the House, and that side of the Capitol has been moving much more slowly on privacy issues. Several bills have been introduced in the House, but members had been waiting to see what kind of bill emerged from the Senate. Several panels-primarily the Commerce and Ways and Means committees-have jurisdiction over the issue, but neither appears close to action.

"It's complex," said Rep. Michael Bilirakis, R-Fla., who chairs the Commerce Health Subcommittee. "I can't assure you we'll do something this year," he said. "The difficulty is trying to satisfy everybody, not wanting to do any harm, because so much harm could be done." Bilirakis said he would rather defer the issue until next year.

But that's not what Rep. William M. Thomas, R-Calif., chairman of the Ways and Means Health Subcommittee, has in mind. Thomas and committee member Benjamin Cardin, D-Md., are putting the final touches on a bill that would leave the tough issues to the states in hopes of winning congressional approval this year. But abortion-rights advocates have already said they would not support a bill that doesn't address the issue of minors' rights. Shalala's draft regulations, due out later this month, may give Congress the push it needs. Some consumer advocates believe that the Secretary's initial package of recommendations didn't go far enough to protect privacy rights. Patient advocates want no information to be available unless, as under current law, the patient gives written permission. In her recent column, though, Shalala wrote that there should be a few exceptions. For instance, she said, "a hospital should be able to use personal health information to provide care, teach, train, conduct research, and ensure quality."

"The [initial recommendations] of HHS two years ago," said the American Psychiatric Association's Appelbaum, "were really not very much different in tone or approach than many of the leading bills in Congress right now. They were similarly cavalier about the importance of protecting patient privacy, and focused on all of the uses in which medical information could be put, and on easing discrimination."

For Doerflinger and other anti-abortion advocates, the concern is very specific to the minors' rights issue. "If [HHS takes] an ideological position, it's unlikely to be mine," Doerflinger said. But that may be what it takes to get Congress to act, he contended. "If the Clinton regs look really bad, it may be the final impetus to breaking the logjam in Congress and getting out a bill that is more reasonable."

Some, though, question whether Shalala will be able to meet her deadline any better than Congress did. Said Ignagni: "I don't think HHS will meet that deadline, given the complexity of the issues that are on their plate right now, before we even add privacy to the list."

By Marilyn Werber Serafini.
NATIONAL JOURNAL 09/10/1999