Balanced Against Other Interests, Patient Privacy Lost Out in Bush Administration's Modification of Federal Medical Privacy Rule

The Bush Administration's modification of the final federal medical privacy did not focus on the privacy needs of patients. It focused on the health care industry's desire for date, says one health care policy organization.

"The modified rule is chock full of privacy loopholes. While the Clinton rule allowed disclosure to government agencies without consent, the Bush Administration has tacked on unconsented disclosure for almost everyone else," says Twila Brase, president of Minnesota-based Citizens' Council on Health Care (CCHC).

The 474-pages of modifications to the original final privacy rule was released today by the Department of Health and Human Services (HHS) and is available online. The Bush Administration modified the final Clinton Administration rule slightly in 2001, shortly after President George W. Bush took office, and now has made significant modifications. An official copy of the modifications will be in the Federal Register on Wednesday, August 14, 2002. The HHS received over 11,400 public comments regarding the proposed modifications. The final rule with modifications will take effective April 14, 2003.

"Protecting privacy is easy if you care about the patient. Just require patient consent. With the complete elimination of patient consent requirements, the federal medical privacy rule, as finalized by the Clinton Administration and modified by the Bush Administration, does not care about patients. It cares about health care industry, research organizations, government databases and law enforcement," says Brase.

Brase says regulators writing the modifications used variations of the word 'balance' 17 times to describe why patient privacy did not take first place in their considerations. Throughout today's document, the HHS wrote that patient privacy interests were balanced against:

• "public health and safety"
• "public health"
• "permitting researchers to access data...for studies"
• "the need to allow deidentified databases to be useful"
• "important research"
• "burden on entities to track all disclosures, regardless of purpose"
• "financial and administrative burden on entities"
• "alleviating burden on covered entities"
• "legitimate need that plan sponsors have"
• "need for core activities [payment, treatment and health care operations] to continue"
• "quality health care"
• "administrative burden"
• "covered entities need for information for quality-related health care operations"
• "covered entity's need for information for reimbursement and quality purposes"
• "covered entities need for information"
• "entities needs for information"
• "other public goods"

"The most important thing to understand about this rule is that according to the government, patients do not have a right to keep their personal lives private." Brase emphasizes. "They have no right to control who sees their personal information. Throughout this document, the department makes it clear that regulators have 'balanced' privacy interests against other interests, and the other interests won."