CCHC's Public Comments on Medical Privacy

RE: Standards for Privacy of Individually Identifiable Health Information (45 CFR Parts 160 and 164) - Proposed Modifications (March 27, 2002)

April 25, 2002

U.S. Department of Health and Human Services
Office for Civil Rights
Attention: Privacy 2
Hubert H. Humphrey Building, Room 425A
200 Independence Ave., S.W.
Washington, DC 20201

Dear Secretary Thompson:

As president of Citizens' Council on Health Care, I am writing to share my comments regarding your plans to modify the federal medical privacy rule (Standards for Privacy of Individually Identifiable Health Information). CCHC is an independent, non-profit, free-market health care policy organization.

Sections 164.502 and 164.506: Patient consent is foundational to the practice of medicine and the preservation of the patient-doctor relationship. Regardless of the purpose for which patient information is requested or used, the individual patient must continue to have the power to assert control over the most intimate details of their lives contained in their medical record.

The Bush Administration and HHS should be protecting the high standards of American medicine. Instead the administration is eviscerating the basic right of citizens to preserve the privacy of their medical information. The very concept of patient consent and patient control has been eliminated by this modification. Substituting consent with a requirement that patients only be allowed to sign a paper agreeing that they have received a copy of the privacy practices of an institution or practitioner is disrespectful to the rights and dignity of patients.

We have seen several letters requesting these changes written by the health care industry. However the desires of corporations and health care executives must never supercede the rights of individual patients who are vulnerable and depend on the provision of health care services for their health, life and livelihood. The health care system was created to serve patients. Patients were not created to serve health care systems.

Furthermore, the federal government does not have the legal or moral authority to strip individuals of basic patient rights in order to achieve faster transactions, more convenience, or any other stated rationale. In fact the implementation of the medical privacy rule is an infringement of federalism, to say nothing of Fourth amendment rights.

Section 164.512: We continue to oppose the regulatory permission previously given that allows health care practitioners, health care institutions, and other covered entities to disclose data for "national health care priorities" such as law enforcement, public health activities, government databases, research, organ donor solicitation, and public safety. Furthermore, we strongly object to third parties having access to genetic information-without written, informed consent. Consent is critical for databases such as the new genetic database announced by the Mayo Clinic. Will the 4-6 million patients have a say in whether their data undergoes analysis, is banked and then used for research?

Section 164.514: In response to the department's request for comments on lessening the number of deidentified data elements, we urge you not to back down from protecting citizens in medical research. The identification of admission, discharge and service dates, date of death, age, city, precinct, neighborhood, county and zip code will allow individuals to be more easily identified. This is especially true if the data is matched with another public database. All 18 data elements listed in the final rule should remain deidentified.

Regarding the proposed data use agreements: It is not enough to require that researchers pledge in writing that they won't abuse the data, sell the data, or contact the patients once they identify the data. Written data use agreements can be broken and just one breach can ruin the life of an individual. We see no enforcement or penalties that would assure compliance.

Please remember that research does not supercede the rights of patients. The Nuremberg Code made that clear. In fact, as patients grow more and more concerned about the use of their data, research may yield fewer and fewer accurate results. Worried patient may decide to alter their information as much as possible. Research results will be skewed, perhaps negatively impacting treatment for patients around the world.

Section 164.512: Privacy rights must always supercede consideration of minimal privacy risk. There should be no deletion of the medical privacy rule's requirement that an Institutional Review Board's (IRB) waiver of the patient's right to give or refuse consent for use of their data for research be conditioned on whether the disclosure will adversely affect the privacy rights and the welfare of the individual. The IRB system is itself problematic. The GAO reported that IRBs do a poor job of considering patient confidentiality in their reviews and decisions. To protect privacy - the purpose of the privacy rule-IRB's should not be able to waive the patient's right to refuse or to give consent for use of their data for research.

Section 164.512: It is critical that consents and authorizations have end dates. If the research requires more time, an extension should be sought. Open-ended projects encourage lack of accountability. Furthermore, no patient data should be placed on a database without explicit written patient consent.

Section 164.508 We appreciate the requirement that specific patient consent be received before health care providers can send advertisements to patients or use their information in marketing campaign.

Section 164.502: We agree that state legislatures should have the right to determine parent access to medical records.

Additionally, the privacy rule modification, and the rule itself do not clarify that individuals can make private contracts with their physicians and other health care professionals to maintain the confidentiality of patient medical information. We would like that clarification added. Such a contract should allow patients to specifically request that access to medical records is not available to any government official without a search warrant.

The basic premise of a privacy protection rule is privacy protection. Unfortunately, these modifications assure the dismantling of patient consent requirements begun by the Clinton Administration and approved by the Bush Administration last year. Patient records are not public property. Guaranteeing that they stay private property should be the goal of the Administration. These modifications do not address that goal.

Please contact me if I can be of further assistance in your assessment of the modifications: 651-646-8935 ph


Twila Brase, R.N.

President, CCHC

Media Contact:

Twila Brase, President and Co-founder
Office: 651-646-8935